@xpert-ai/plugin-live-dashboard 0.4.0 → 0.5.0

package/dist/remote/build-manifest.json

@@ -1,7 +1,7 @@
 {
   "sources": {
-    ".xpertai-plugin/plugin.json": "98f0f6e081fb01dd15bd9943ef590542d8cedb5c0e724930ff722b42a6129e82",
-    "package.json": "00f34097d89de7924bbf6893f8c622be922f9911bdd75ad2215946860536a6a1",
+    ".xpertai-plugin/plugin.json": "0c8205abe876e3435cb3069b58589a97fc28f0518dede5369dd12b31ab40b9bd",
+    "package.json": "d861677be9aef2017c261639204ecada5c145b75c070b27a8fdbfa3e68770430",
     "scripts/build-action.mjs": "3a3de4d7fd05d81f5fdeb9eacbd04235dcc6e5000c6fff2d07f0e4bdc7b40c30",
     "scripts/build-libraries.mjs": "9ea0317ca0c20f87d8d13b83833e0c834858d4eb2e059bd3da40b494e7b08e24",
     "scripts/build-remote.mjs": "492550ac5c95eb371253d863567723d8853522013a0bcdfa0e264720206fda16",
@@ -9,7 +9,7 @@
     "scripts/import-prompts.mjs": "c8c611fec92e168f63487a09ce0509d6ccef80d0b6d2c44ecf23da63e782a05d",
     "scripts/renderer-asset.mjs": "e7edf2fb41f2384e838c27c2e5566f5d479135ad365ae2a99fb421433464d82a",
     "scripts/verify-dist.mjs": "523d0fe9703a0f3d12099173d115b5145d5665b06551cfab2869a2db76d880e2",
-    "skills/live-dashboard/SKILL.md": "a6820a6d10756eae4b88b396c803d7533fb01b67d3b5a44ba4268668468de439",
+    "skills/live-dashboard/SKILL.md": "e818c9f54f38754470a65f87e61875cdd8b9c52bc5da85a98e98e617d854f644",
     "skills/live-dashboard/agents/xpertai.yaml": "307eca084cbcaf0c250cca1bba7438e794ff4e9b039a920ad9763acfca236f82",
     "skills/live-dashboard/examples/README.md": "0eb3516324cdc6c288a55504452114e5498f1c12aa02e085b4cd6018268ebc84",
     "skills/live-dashboard/examples/catalog.json": "7aad2e4d40d5ed7a8655850dd4de42b2c192be4d396d5e49cb8e11dc8f765d92",
@@ -67,6 +67,7 @@
     "skills/live-dashboard/references/data-validation.md": "4455240470b3456fcd7db8f0f58b040d1dceb548010414542dd5cc86f3abfe63",
     "skills/live-dashboard/references/html-lifecycle.md": "4bf88730709ab45166425e1917610d1e618c9a0883e615ce76c0fe55488ffd51",
     "skills/live-dashboard/references/html-runtime.md": "a64c4a485938b67743c5f847f4968ef68ec08bf43bceae6914af72f8ff4dae23",
+    "skills/live-dashboard/references/source-inspection.md": "7bac2efb079cd931f615d0b5d409773834f6f4c91f806bee1718e342e2c0cc1f",
     "skills/live-dashboard/themes/README.md": "0aa48bccc8b633877339226bda273ca3454360c53d270d5c7d57c58b01f803a2",
     "skills/live-dashboard/themes/customer-brief/README.md": "a95dd76cc891bff77d65e5722208ce41eacde8dec798368b5a7b11483015a4ff",
     "skills/live-dashboard/themes/customer-brief/charts.js": "fcf022c27342209f5ecbfd305a649862bad87299c17275f29d1b241cf1fa4052",
@@ -84,42 +85,49 @@
     "skills/live-dashboard/themes/trend-workspace/select.js": "b9eab2a2ae09269e2f94539fb5230d3bf905d356884519abec9296675fe09293",
     "skills/live-dashboard/themes/trend-workspace/theme.css": "d5087c989bdb7c727816c2ec92de938a31617bf0861518ef895d1c07589db3c4",
     "src/index.ts": "9ebe5b31646f7d5d188f555d28086024eb9f35e7a6a808b213109d4c18b5efec",
-    "src/lib/agent.schema.ts": "eaee40b20a029db97d5d245b93dda33d33e6f018ecabb56f8dbef914c3004447",
+    "src/lib/agent.schema.ts": "ddb45f54aef45b25042e9a1b03bfebddefb73adfe43e1ad7a9aec696e2a28009",
     "src/lib/analytics-source.ts": "6fb5fd394fffa5a0c12f1fe32d0c9d7dbd8597052047b6122fc5b160fa7af54f",
     "src/lib/app-config.ts": "46934ebb735e952803de98dba3f35626ade04172eac9e885df4502f601f148b5",
+    "src/lib/archive.service.ts": "72bf4ec89942228a6140b0e4d644f4bf3b174cb40e0695564a30e92d78bc006b",
     "src/lib/artifact-type.provider.ts": "34239e4de7dd7f9f0526001ae5a9ab10ac5933012f0b9137e350e34600dc1322",
     "src/lib/assistant-template.ts": "ff2eb38ce3290b76ff6884696493ba67d562299f607d4929581f6c026085a0f5",
     "src/lib/content-capability.ts": "fa1252a539a681be9780d318b2b3710da273c4405c8e21d58ac675294cef3836",
     "src/lib/content.provider.ts": "e85128a4e95f1e7f184b7b9eca37e4cb4edfd35d14a15062dfcb2040c1e63e73",
+    "src/lib/dashboard-archive.ts": "2d3a16ef689ea94049e55ffe18c66536266585ca67c413808a81d092626c7acf",
     "src/lib/dashboard-icon.ts": "3f95a626e91d3ce198cdef6b05365591b6e65af4f58d6f5765ec0836a590a494",
     "src/lib/dashboard-navigation.ts": "35c13ae08e6d3908409ed2ffdb0020c927b40abce4353c5ce50986acd20c658f",
     "src/lib/dashboard-queries.ts": "85c945c0862af353b366bdbfeaafb94aa4185d35cce0f51ec39dd8c60b4fc598",
     "src/lib/dashboard-receipt.ts": "d02b7e4e1be0a075b7f27e887ebb555684f17036ebb9442982e6725ab37a53ab",
     "src/lib/dashboard-search.ts": "0cd14c0004fb078b54c095faeab3195fb7e03a20c3400b5e67aec7cb4b2442e2",
     "src/lib/dashboard-sharing.ts": "61199f135cc53b6b9f0bef0f75f14c4d40bff6a3986e62e2823ab80c564534d3",
-    "src/lib/dashboard-view.schema.ts": "64cafe4750d4c56cd83d0ab5ce8440f015cee83dce082e9c750b5da527016dbc",
-    "src/lib/dashboard.schema.ts": "982e15591e70102ea506951cd10de9ec4864281157b0b95a7b591a8fff3da813",
-    "src/lib/dashboard.service.ts": "28bfe535ba804c1d80b9a50cfde73481a40d0b44a53bbec336eafe2ce413343f",
+    "src/lib/dashboard-sources.ts": "b6cdc637a930283df91f1f002965a40478c943c1b6c79b50ec00ece24c0a160c",
+    "src/lib/dashboard-view.schema.ts": "a3766d779d33684b40d988c1857d3abcac403188b99c5e20bcfd9c36b34360bc",
+    "src/lib/dashboard.schema.ts": "148379d1fe0ea3efd19ce169fd50cdfe9c97d71d489805645aca10658ee1b1f4",
+    "src/lib/dashboard.service.ts": "525062918ebd73cb6d89b871b05fd01cb0f10f3b6f23c6c7e1e273655e01f02f",
     "src/lib/definition-tools.ts": "ba48842396e57499331a52ca7cf5e4e1eb72e1e519b5dabfff2743fddf15947d",
     "src/lib/document-host.ts": "3543ddb443006b90cd4689b65446b0e3b3305362d3d24d93209c094967921ffe",
     "src/lib/document-libraries.ts": "4fd5ba504e16ef0c7a4ff2ffab6c984a90a0011cc399313c60be7d149c840466",
     "src/lib/document-network.ts": "1c7a6d8d4ad545379b85f0305756739ddc83a86777676fc38fe1755071266032",
     "src/lib/document-package.ts": "367f51ab8b2458b6391472fbacde117603ad1a538df26079709eb17ff42e3cf4",
     "src/lib/editing-feedback.ts": "23c341fcb36e7cce9eb52a04d0b9d14662d7d72365e5ad9cd3fada7506c07f73",
-    "src/lib/editing-patch.ts": "6e511b18257d68f74e3a6d8a82f1c26c97b48e82cce98356d79ca47fafa4d8d0",
+    "src/lib/editing-patch.ts": "9b8dc3608830549a18d0043fea3342c38d405058b04ac30c6bde7d3aaca82e31",
     "src/lib/editing-session.ts": "6b474db9f3cc8114ced45f0020ec8d13d2f5f0c50df5ed4fc70f3f0cac9edd11",
-    "src/lib/editing.ts": "a3d42102d5c93effee15f83c1107f3365f057b7442aff89c8489a003d549f838",
+    "src/lib/editing.ts": "72b235dfcfed30c64042f4b98a3fd1afe147df5dbd7485fcd11b8f612fff9be5",
     "src/lib/filter-evidence.ts": "594ea9065e5c8d32c6bd4fc055e78c2df7ad2418c2019106136917c89c8ac331",
     "src/lib/html-guidance.ts": "bfc1ece1fdae101e735a1887552d1d480b0dab7d7aa493918491d5f02278f27e",
-    "src/lib/html-validation.ts": "9f342f6716d457ba1a46c9d228f3f7858dcae2c0f64a3c98bc1d28d35a8f43ac",
-    "src/lib/middleware.ts": "43a298504581405459a5ca7c28994f376667dbcd6bbc71346454e8e669c0e36d",
+    "src/lib/html-validation-feedback.ts": "a9460f4b22f843404296fdb5d5ed9509aceebdeeff4a4acec9a51ed7847918f2",
+    "src/lib/html-validation.ts": "f163f74a0fdd97cdb907d62a9d05d51bead252478a6c5b48472ce28bebb87993",
+    "src/lib/inspection-host.ts": "b5c91ca134ff20cf47a78a7625bc900bc61c8cc856e85c1141c762e0e8367d21",
+    "src/lib/inspection-runtime.ts": "9e7473b45f5b484ce45c10c416f042fb94de0c7708895871eb64d27e82cb669f",
+    "src/lib/json-input.ts": "67fd2cd9b2c347706158f87b91b8cb4dc6a95900359b02b2ee43609a181ac9db",
+    "src/lib/middleware.ts": "3f6e84833c683368872aee1ab9a029b97cdc5fcb83588c2ade8ea0ab9e42ba2e",
     "src/lib/monitor.ts": "6d592bff4e60d7af3d8fbb42477ee2a7127f166f8fecac93557b5668527ddaff",
-    "src/lib/plugin.ts": "59b553e0f4c21c66224ad2c3d3880630a7339bbd579b80808a26357b407d13a1",
-    "src/lib/presentation.provider.ts": "3b37387636d9e7317ee6e36c9e607fadb20002c08c24d54e424342e913b2405f",
+    "src/lib/plugin.ts": "f295a8497a3bfa6243812f1ce7620df52a6a9463d13e9a050d72bb0aba3a1838",
+    "src/lib/presentation.provider.ts": "55b3ff953d8b40498a2ee2a0ee3143ccb960d8bbd84f5eb3daf9f91906a14f2f",
     "src/lib/preview-retry.ts": "55fa28cc61f11adac4dce5a2066cbdd6d529ffd5ffd3cca7dcb552c6b7299500",
     "src/lib/project.ts": "7dec615bd878a94290998f9f3ca8fd33577610cff26ab3b55363a417d5ca57b9",
-    "src/lib/projects.schema.ts": "371d1d79dd5f17d0fae05498d045d7ae1449e75b4a3ba4d0df3e509daaa56fd9",
-    "src/lib/projects.service.ts": "fe05e80f52c40ba2408281cc0e75bfc06acf6fc725b86981f32e9d0155af594c",
+    "src/lib/projects.schema.ts": "f7af10dae122897ce8f379897d3630136f774666cf5295081f3e6d7cb51c82fa",
+    "src/lib/projects.service.ts": "bf0b083b6afd18f12e1f7f8bbd0232f25c085f7ec578dafbcd98534081f12d73",
     "src/lib/prompt-workflows.ts": "c2aa959f7fad508415394bc0ce6e19ec48f27b82fa04105e6dc2dfd30b7bfe25",
     "src/lib/provider-options.controller.ts": "0b329686f75182ec6a6db2bb741bedd3ade0e7a25093ddbb7b15336282270349",
     "src/lib/remote-entry.ts": "4c760963ff099b4d9a8961c933b1a586c0ac57d85a88c745c2578e2f66bf1539",
@@ -128,27 +136,34 @@
     "src/lib/runtime-context.ts": "0cf05522188f92646bcd7f8ca6b0ab029d0b011a2e725426c99d20dadaa508a4",
     "src/lib/save-evidence.ts": "458f8fe2ef74fd4809fb9543d8c31bb42e0e16b10550b2a7808ca92ec3662bda",
     "src/lib/sharing.service.ts": "e52c98d967f27a2f3bc80614f31da15e373dd4450b80aea250156efe24c77f3b",
+    "src/lib/source-executions.ts": "552f3f65ddc9c6b430048e50a37912f870d31e755e41f4554d21a49c7a2fabe7",
+    "src/lib/source-validation.ts": "803fed8d53fe88d3f75f3c94e86e921999dd65953e96a567d3a3d9ead8ed015a",
     "src/lib/templates.ts": "730157b557d796237b04b4c0e48211fa42ca31d8eca5106ccc821ab7a71ad71c",
-    "src/lib/view.provider.ts": "4177d9100a4bcf7b9ea1bac869c5c3240b331ce47b2d337241119be2bf97e6fc",
-    "src/remote/bridge.ts": "0c222730807bbf0b3d89e19aa0f20b887529ac24042b98b0db920e1a26ffad96",
-    "src/remote/dashboard-picker.tsx": "9b2c10e8c31d08a350647b348fc480969247920b61e63396e04930e0e399080e",
+    "src/lib/view.provider.ts": "811ec7c37853c4039a21303b7ce28436307fa03fa87332a9c994eff9ce3cbf2c",
+    "src/remote/bridge.ts": "2dbaa7d2b7648bb98495f93c6c8aec09a9d974f2f45babf9e2f21e8877480c30",
+    "src/remote/dashboard-picker.tsx": "c8c804ea6944292a819979b01d956c38b7ac3f5a777cb64bbff8439fc58da75e",
     "src/remote/dashboard-starter.tsx": "082a82581411a40711a583a582be1c66e926167fc8a48ac767f446f3d06518d6",
-    "src/remote/html-dashboard.tsx": "3e7eba0f8f760cd5334735a790278eea51beaa33ad9ff36a31b560bf7a0ed20d",
+    "src/remote/html-dashboard.tsx": "796972b9c2f128e1b94e1db80fa186dd83ffca4cdcd2c3c308f123fb6b9fc879",
     "src/remote/i18n.ts": "65bb7941903e0a0e6445836cdf25f22e30d875d709fb07d60ac2d88d591b7218",
-    "src/remote/locales/en.json": "fdc5bd50f71e6d41bae8271687fa008571dbe4e66d83f29314e4ee09f46539d4",
-    "src/remote/locales/zh-Hans.json": "19def6cdd024486647b843f9130b310f51df951b3cad18e8755261f924018733",
-    "src/remote/locales/zh-Hant.json": "be3b1aff110b4638c464ee532302f82cb93cc377acab215b123b2fa1cda4b2a7",
-    "src/remote/main.tsx": "0b2e88a8c49c4f203914f69ce446dff40043ce77477a3ecf7a5f333610800869",
+    "src/remote/import-dialog.tsx": "249a950f889257e6be8b1f8bd7ef3654cc998e22ea53cd330d4d662ca5e6bcd8",
+    "src/remote/import-targets.tsx": "853763f8197f2cafddc62234bc0f27984299cb0ba3a5679f911cfce4f3c016c6",
+    "src/remote/locales/en.json": "35c1a7b390d7bbde48ddcbbed174c3b12597b28fe511e892a83ea884d47a645b",
+    "src/remote/locales/zh-Hans.json": "dd2ac68a4d8847bd66729418f1293994754e6b2f23a8b5ee7c4cdb27567dd188",
+    "src/remote/locales/zh-Hant.json": "c15b6914cbebed67b35f58ba6a92610936a7fc85bffd5f90c3905a81c66e429f",
+    "src/remote/main.tsx": "1d1fea7d363b1fc2d7814c928fb3ded4bff8713bd5824293760d3c580c294643",
+    "src/remote/picker-data.ts": "0901155c58b42f344ee203c19900d676058842b16d8e1818f098e28d4950b69d",
     "src/remote/share-dialog.tsx": "3cb576148aeb28add10745a40aa4aac735e903755def95c3701244ac9c67b568",
-    "src/remote/style.css": "a050933e6ec1d13562286bf35a97f8fdc5b36776fc9299c4d7b470de8ac32f79",
-    "src/remote/toolbar-menu.tsx": "6a8dc0d0ecfa3f228cc973af19bced4c013ec7f6779fd9a1e2eef73e8f188dff",
+    "src/remote/sources-panel.tsx": "f3e9e8caaf5c9bd49c63c5d98696299c5792635f44ef73c368230dc8fa3a1792",
+    "src/remote/standard-dashboard.tsx": "daac0d730c37e32b89cb5f74582a6788ae20b6c17b9295a7b9c03eddb31df0d4",
+    "src/remote/style.css": "79b5321b62e597dd3d3a86b07b52b50a2b75f1849632b89cc82101ac813f52e4",
+    "src/remote/toolbar-menu.tsx": "da7eec816d77ad16bcdb6fcfbb3ed03f06d1d2bb5c0aa94827af2e2415bedc40",
     "src/remote/viewer-controls.tsx": "b55e27a8a7932575a994fe30645b535c3dd5ba7e27df1f18a1f86462a6354ca3",
     "src/validation/host-entry.ts": "d48af4a2ac3f520fa2f22dae5fbf9be59486ce0a8ae2e53a8652bfe6953fa803",
     "tsconfig.remote.json": "e0b173f885c7439dfce09d411ff97fb7511bd77f6f1d7fdd66b5adb477a1f411"
   },
   "outputs": {
-    "app.js": "68b202660b455cddcd46fcae6654bdb651f6ef29ab0e44079d70f3c1d08e3277",
-    "app.css": "e3f304fece8a60a64a2098853e39300b6015a71690754908053218f0b5b4bdaa",
+    "app.js": "9adace641b06f2feae8d7dfca396b455bb23b05dd51eb938651119267920437f",
+    "app.css": "8c2c905bac141c0fcede447c20e9a19fdf39bf48eced303b7ecc34ddebea2015",
     "renderer.html": "30abe65cd0d32a7596e02c5e94f2e20879fa73644507fefa35c7119a018ff7d2"
   },
   "libraries": {

package/docs/docs.json

@@ -38,7 +38,9 @@
               "evolution-acceptance",
               "retry-regression-acceptance",
               "fixed-build-multimodel-acceptance",
-              "verification"
+              "verification",
+              "sources-inspect-portability",
+              "sources-inspect-portability-acceptance"
             ]
           },
           {

package/docs/sources-inspect-portability-acceptance.mdx

@@ -0,0 +1,67 @@
+---
+title: Sources、Inspect 与迁移验收记录
+description: 2026-11-05 的自动化、真实部署、查询及浏览器导入闭环验证。
+---
+
+## 当前结论
+
+2026-11-05：实现已部署到本地 Xpert / Data Xpert 联调环境。自动化、真实数据查询、服务端档案往返及浏览器导入闭环通过；浏览器验证了来源侧栏、组件 Inspect、文件上传、资源与实体映射、提交并打开独立草稿。
+
+实施计划已转换为[功能文档](./sources-inspect-portability)。本记录不替代历史验收，也不声明完成新的 Agent 生成、SSO、Sandbox 或跨服务器部署验收。
+
+## 自动化与产物
+
+| 范围 | 结果 |
+| --- | --- |
+| Live Dashboard Nx 构建及测试 | 227 项通过，0 失败 |
+| Data Xpert Analytics Provider Nx 构建及测试 | 21 项通过，0 失败 |
+| 最终只读投影断言复验 | 项目成员及共享展示相关 18 项通过；属于上述测试的重复执行，不另计总数 |
+| 产物一致性 | `verify:dist` 通过，包含远程组件、Action 与固定图库依赖 |
+| 插件元数据 | 两个插件检查均通过 |
+| Lifecycle harness | 两个插件均成功加载并关闭；此项使用 harness mocks，不代表真实业务查询 |
+| 差异格式 | `git diff --check` 通过 |
+
+覆盖来源引用和静态 DOM 锚点、只读 payload 投影、过期响应丢弃、失败时保留上次结果、Inspect Window/nonce/组件校验、动态标准图表、键盘恢复，以及档案损坏/超限/未知条目/版本/依赖字节校验。导入测试覆盖当前权限复验、失败不创建草稿、新身份、会话隔离及重复提交幂等。
+
+## 已部署环境与真实数据
+
+联调前已检查相关仓库分支与工作区、执行快进拉取及冻结锁文件安装，保留原有未提交修改。插件通过平台正常认证部署并重启 API，核验实际实例与健康检查。
+
+| 真实看板 | Sources | 声明组件 | 本次保存验证 |
+| --- | ---: | ---: | --- |
+| 采购执行 | 2 | 21 | 所有绑定真实查询与 HTML 保存验证通过 |
+| 销售经营 | 3 | 19 | 所有绑定真实查询与 HTML 保存验证通过 |
+| 库存数量与价值 | 2 | 16 | 所有绑定真实查询与 HTML 保存验证通过 |
+
+三个看板补充显式来源/组件关联。自定义筛选替换标签时同步保留容器 ID，避免静态校验通过但运行时 Inspect 无法定位。没有新增资源授权或自动发布。
+
+库存档案通过真实 View 文件协议导出，大小为 376,981 字节；在独立验收项目中重新导入并执行真实查询、控件与 HTML 校验。验证新 dashboard 身份、完整 Manifest 除身份外相同、依赖字节保留，以及同会话重复提交返回同一草稿。该证据来自正常认证 API，不冒充浏览器下载事件或浏览器提交验收。
+
+Data Xpert 迁移发现接口已验证资源 → 实体 → 显式 payloadPatch，重映射保留原参数和路径。此验证在同环境的另一项目完成，不等同于独立服务器迁移验收。
+
+## 浏览器已验证项
+
+| 场景 | 证据及边界 |
+| --- | --- |
+| 真实 Bosi 库存来源侧栏 | 两个绑定与保存定义一致；来源详情、查询配置、折叠组件列表可见 |
+| 真实 KPI Inspect | 点击指标打开对应来源详情 |
+| 真实筛选多来源 Inspect | 定位保留的筛选容器，显示两个来源；不改变原筛选值或触发业务查询 |
+| 面板开关 | iframe 保持，已有查询时间不变 |
+| 标准图表/表格 Inspect | Chrome 测试宿主验证，使用模拟结果；依据真实渲染 DOM 的 `chart:id` / `table:id` 定位 |
+| 标准筛选与刷新 | 模拟区域筛选改变图表/表格及详情参数、结果行，刷新更新时间 |
+| 键盘和窄屏 | Esc 退出 Inspect；600px 视图使用抽屉；测试后恢复视口 |
+| 浏览器导出入口 | 显示档案已准备和下载链接；完整文件获取另由上述 API 验证 |
+| 浏览器文件导入 | 原生文件选择成功，ZIP 解析、标题、两个请求及资源映射入口显示正常 |
+| 浏览器映射与提交 | 选择库存模型及其目标实体，验证并导入为新的 r1 草稿；真实库存指标返回，两个 Sources、16 个组件关联和来源详情保留 |
+
+## 验收边界
+
+浏览器首次映射遇到会话 HTTP 401，正常重新登录后由用户处理 Chrome 密码安全提示，随后重新上传、映射及提交成功。未绕过认证或浏览器安全提示。
+
+标准看板交互使用明确标识的模拟测试宿主；真实业务查询与浏览器导入使用库存语义模型。真实迁移发生在同一部署的不同项目，未据此宣称另一台服务器上的部署验收。浏览器已确认导出生成下载链接，完整文件字节和完整性由正常认证 API 验证；未将浏览器自动化的下载事件记为通过。
+
+## 提交前同步上游后的回归
+
+2026-11-05 提交前同步 `develop` 的 Analytics 公共诊断修复，保留其诊断处理和本功能的导入发现。重新执行冻结依赖安装与两个插件的 Nx 测试：Live Dashboard 227 项通过；Data Xpert Provider 在构建阶段受配套 Contracts/SDK 依赖阻挡，当前锁定版本没有 `AnalyticsProviderError`、`parseAnalyticsDiagnostic` 和 `AnalyticsDiagnostic` 导出。
+
+该前置条件已由上游 `analytics-public-diagnostics` changeset 与 Provider README 明确记录：先发布配套 Contracts/SDK，再更新依赖和锁文件。上述 Provider 21 项及真实部署记录属于同步该修复之前的已验证版本，不能当作合入上游后 Provider 再次通过的证据。本次代码提交不代表完成依赖升级或插件发布。

package/docs/sources-inspect-portability.mdx

@@ -0,0 +1,115 @@
+---
+title: Sources、Inspect 与看板迁移
+description: 查看真实查询来源，从页面组件追溯配置，并通过完整档案迁移看板。
+---
+
+Live Dashboard 支持查询来源侧栏、组件 Inspect、ZIP 档案导出与跨项目导入。本页由 2026-11-04 的实施计划在验收后转换，实际验证范围见[验收记录](./sources-inspect-portability-acceptance)。
+
+## 查看来源
+
+有定义编辑权限时，工具栏显示“数据来源”和来源数量。每个已保存 `binding` 对应一个来源；同一物理数据源上的多条请求分别列出，筛选候选项请求也包含在内。
+
+点击来源进入详情，返回按钮回到列表。桌面端使用约 380px 的右侧栏；视图宽度小于 900px 时使用抽屉。开关面板保留当前 iframe 和筛选状态，不额外发起查询。界面使用共享 shadcn 组件与宿主主题，提供英文、简体中文、繁体中文文本。
+
+| 分组 | 内容 |
+| --- | --- |
+| 概览 | 名称、说明、bindingId、datasetId、执行状态 |
+| 使用此来源的组件 | 可展开的指标、图表、表格和筛选组件列表 |
+| 查询配置 | 资源引用、providerId、operation、contractVersion、完整原生 payload；可复制 |
+| 筛选与参数 | controlId/name 映射、类型、必填、保存的默认值、最近提交值、允许值 |
+| 输出字段 | 字段标识、来源字段、标签、类型、单位、可空性、粒度 |
+| 最近查询结果 | 请求时间、完整性、获取时间、执行标识、对应筛选值、最多 50 行预览 |
+
+`null`、空字符串、零分别展示。重新查询失败时保留上次成功预览，并标明它是旧结果。每个 binding 按 requestId 接受最新响应，晚到的旧响应不会覆盖新请求。切换看板或版本会清理运行状态；结果预览只保存在页面内存中，不写入定义或导出档案。
+
+这里展示 Provider 实际接收的配置。语义查询不会被虚构成 SQL；没有显式转换定义时，不生成 Transform 分组。首版来源配置只读，修改仍通过原有定义编辑或 Agent 更新流程。
+
+## 从页面检查组件
+
+点击“检查组件来源”开启 Inspect，悬停或键盘聚焦会高亮已关联组件：
+
+- 单来源组件直接打开详情。
+- 多来源组件先列出使用的请求。
+- 未关联区域显示未声明来源提示，不猜测数据来源。
+- Inspect 中的点击不触发原组件的筛选或导航；按 Esc 或再次点击工具栏按钮退出。
+
+HTML 模式使用显式组件声明，Canvas 图表定位到其容器。标准模式自动按 chart/table → datasetId → bindingId 建立关联，适配渲染器实际的 `chart:id` / `table:id` DOM 标记。
+
+### HTML 作者与 Agent 的声明
+
+Manifest 可选字段：
+
+```json
+{
+  "sourceMetadata": [
+    { "bindingId": "sales", "title": "销售汇总", "description": "按当前区域汇总销售额" }
+  ],
+  "components": [
+    {
+      "id": "sales-total",
+      "elementId": "sales-total-card",
+      "title": "销售额",
+      "kind": "metric",
+      "sources": [{ "bindingId": "sales", "fieldIds": ["amount"] }]
+    }
+  ]
+}
+```
+
+查询仅保存在 `bindings`，组件声明只保存引用。`kind` 可为 `metric`、`chart`、`table`、`filter`、`text`。校验重复 ID、未知 binding/field，以及 HTML 中缺失或重复的静态容器 ID。最多 8 条来源元数据、160 个组件。ID 以字母开头，允许字母、数字、下划线、点和连字符，最长 80 字符。
+
+容器必须在运行时保持稳定。自定义筛选若用新 DOM 替换原标签，应把原容器 ID 转移到新容器；不能只把 ID 留在被删除的标签或隐藏的原生 select 上。静态校验不能替代实际渲染验收。
+
+`dashboard_create` / `dashboard_create_html` 接受这些可选声明；`dashboard_update` 以 bindingId/component id 合并，省略时保留，删除组件使用 `removals.componentIds`。删除绑定会移除对应来源元数据；剩余组件不能引用已删除的绑定。作者说明见插件技能的 `references/source-inspection.md`。
+
+## 导出与导入
+
+在“更多操作”中选择“导出看板”。导出固定当前已保存草稿 revision 或发布版本；草稿在导出期间已变化时会报冲突，需要重新打开最新版。下载链接在准备完成后显示。
+
+```text
+看板.xpert-dashboard.zip
+  package.json       档案格式版本、条目大小、SHA-256
+  dashboard.json     权威文档包：Manifest、HTML、依赖锁和依赖字节
+  dashboard.html     HTML 模式的便于查看副本
+  requirements.json  Provider、资源引用、外部资源说明
+```
+
+标准模式不合成 HTML。HTML 的固定图库依赖随包保留，导入不要求目标环境安装同版本图库。档案不额外带入查询结果、连接凭据、访问策略或发布权限；已有 HTML/原生 payload 是作者定义的一部分。
+
+`dashboard.html` 不是脱离平台运行的离线应用。实时查询仍需要授权宿主；在线 CDN、图片、动态资源不自动下载。`requirements.json` 列出静态 src/href 外部引用，并提示 HTML 可能包含动态资源。
+
+导入流程：
+
+1. 先选择目标项目，在“更多操作”中选择“导入看板文件”。
+2. 上传 ZIP、原始 Manifest JSON 或已有文档包 JSON。
+3. 检查每个数据请求的目标来源；同环境有效引用可以直接保留。
+4. 跨环境时使用“映射目标环境中的资源”。没有迁移扩展的 Provider 可以通过“高级请求配置”填写其原生 payload。
+5. 点击“验证并导入草稿”。服务器按当前账号重新查询并执行已有控件与 HTML 页面校验；全部通过后才创建独立草稿。
+
+内部 binding/control/component ID 保留，新的 dashboard 身份由服务器生成。原看板不被覆盖，不自动发布，也不复制授权。查询、字段或目标资源不匹配时保留准备界面，可修正后重试。同一导入会话成功后再次提交相同配置返回同一结果。
+
+### 格式与会话限制
+
+- 上传档案最大 12,000,000 字节；权威文档包最大 9,000,000 字节。
+- 解压同时限制条目与实际展开总量，不向文件系统解压路径。
+- 只允许约定条目；重复路径、未知条目、不支持版本、哈希/大小不符、HTML 副本或 requirements 不一致、缺失/损坏依赖均拒绝。
+- 导入准备会话保存在进程内，30 分钟过期，最多 16 个；绑定租户、组织、用户、宿主及项目。服务重启或项目切换后需重新选择文件。
+
+## Provider 迁移边界
+
+看板层不判断 SQL 或 MDX，也不按名称猜测、替换字符串。迁移通过现有 Analytics discovery 的显式扩展完成：
+
+- `queryContract.payloadSchema["x-xpert-import"]` 声明 `{ version: 1, request: {...} }`。
+- 初次迁移请求在该声明上附加原始 `payload`；后续使用返回的 `inspectRequest` / `nextRequest`。
+- 可选目标的 metadata 为 `{ schema: "xpert.analytics.import-target", version: 1, payloadPatch: {...} }`。
+- `payloadPatch` 对原 payload 做顶层字段替换，不是递归合并或任意字符串替换。
+
+Data Xpert Provider 实现资源和实体浏览，返回明确的 `resourceId`、`target` 替换值；保留原生 Action、参数和参数路径。是否可查询、Action/字段是否兼容仍以保存阶段的真实验证为准。
+
+## 权限与隔离
+
+完整查询配置、Inspect、导入、导出沿用定义编辑权限。服务器检查权限；只读视图与共享展示中的 binding payload 被投影为空对象，不能仅依靠隐藏按钮保护配置。实时查询仍按当前 actor 执行，不扩大资源权限。
+
+Inspect 使用插件内的只读元数据通道，每代 iframe 使用随机 nonce，并校验消息 Window 身份。宿主只接受声明的 componentId，不接受页面传来的查询配置。查询仍走原有隔离文档 MessagePort；本功能没有新增 SDK API 或放宽页面查询权限。
+
+实现按来源声明、运行状态、Inspect 协议、来源面板、档案解析、导入服务和 UI 分文件维护。历史验收文档保留，当前验证证据单独记录。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xpert-ai/plugin-live-dashboard",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Versioned live dashboards using platform analytics and Data Analytics renderer",
   "main": "./index.cjs",
   "types": "./dist/index.d.ts",
@@ -33,12 +33,12 @@
   },
   "peerDependencies": {
     "@langchain/core": ">=0.3.0",
+    "@langchain/langgraph": "^0.4.7",
     "@nestjs/common": "^11.1.6",
     "@nestjs/core": "^11.1.6",
     "@xpert-ai/contracts": "^3.30.0",
     "@xpert-ai/plugin-sdk": "^3.30.0",
-    "zod": "3.25.67",
-    "@langchain/langgraph": "^0.4.7"
+    "zod": "3.25.67"
   },
   "devDependencies": {
     "@langchain/core": "0.3.72",
@@ -50,8 +50,8 @@
     "@types/react": "^18.3.24",
     "@types/react-dom": "^18.3.7",
     "@xpert-ai/community-data-analytics": "0.1.35",
-    "@xpert-ai/contracts": "^3.30.0",
-    "@xpert-ai/plugin-sdk": "^3.30.0",
+    "@xpert-ai/contracts": "3.31.0",
+    "@xpert-ai/plugin-sdk": "3.31.0",
     "echarts": "5.6.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
@@ -72,6 +72,7 @@
     "access": "public"
   },
   "dependencies": {
+    "fflate": "0.8.3",
     "parse5": "7.2.1"
   },
   "scripts": {

package/skills/live-dashboard/SKILL.md

@@ -65,7 +65,7 @@ upgrades, follow the theme's existing-Artifact procedure and keep saved bindings
 
 1. Call `dashboard_list_sources` before searching raw files, reading old scripts or creating transformations. For a named governed source, inspect that source/provider contract first; file-backed sources do not automatically require a script. Discover the authorized source and business schema. Validate the metric, period, grain, units and filters through real preview results; follow the data-validation reference.
 2. For HTML mode, read the HTML runtime reference and call `dashboard_libraries` before using ECharts, Three.js or online dependencies such as Tailwind CDN. Network access is temporarily unrestricted for functional acceptance, including CDN scripts/styles/fonts, images and fetch/XHR. Browser CORS and mixed-content rules still apply. Online URLs are not entries in the packaged `libraries` array; business data must still use saved Bindings and credentials must never be embedded in HTML. Write a complete HTML page using SandboxFile. First declare `const live = window.xpertLiveArtifact` inside the page script; `live` is not a host global. Then register `live.subscribe(bindingId, renderDataset)`, await `live.ready()`, then call `live.query(bindingId, typedControls)`. There is no `window.subscribe` or `window.__datasets`. Shared filters must query every affected Binding, not just call `bindSelect` for the first one.
-3. Call `dashboard_create_html` with `title`, the relative `path`, verified `previewIds`, matching `controls` and the complete required `libraries` list. Standard charts instead use `dashboard_create`.
+3. Declare readable `sourceMetadata` for each Binding and `components` for each HTML KPI/chart/table/filter. Read [source inspection](references/source-inspection.md); preserve the mapping when updating HTML. Call `dashboard_create_html` with `title`, the relative `path`, verified `previewIds`, matching `controls` and the complete required `libraries` list. Standard charts instead use `dashboard_create`.
 4. Correct validation errors and retry the domain save. A file write, screenshot or `present_files` receipt does not save a live dashboard. Do not present the HTML as a static deliverable.
 5. Check the returned `dashboard.artifactId`, `dashboard.status: "draft"` and `dashboard.draftRevision`. The successful domain receipt opens/refreshes the Workbench preview.
 
@@ -74,9 +74,10 @@ upgrades, follow the theme's existing-Artifact procedure and keep saved bindings
 1. Call `dashboard_open({})` for the selected Workbench dashboard, or provide an exact Artifact ID from `dashboard_list`. Do not choose the most recent dashboard by guesswork or create a replacement Artifact.
 2. Inspect `presentation.type`. For a standard dashboard, update definition fields directly; a rename needs only `title`, `editId`, `expectedRevision` and `expectedCurrentVersionId`. No HTML file exists: omit `htmlPath` and `libraries`. For a current HTML dashboard, the result includes a new `htmlPath` editing copy of the latest saved draft, plus `editId`, `expectedRevision` and `expectedCurrentVersionId`. Read this copy with SandboxFile before editing. Each open prepares a separate copy, preserving any uncommitted earlier files.
 3. For HTML pages, apply requested changes with SandboxFile edits. Preserve data semantics, controls, query/subscription lifecycle, existing element IDs and library locks unless the request changes them. Assign stable IDs to new KPI/chart/table/filter components. Standard arrays and preview Bindings upsert by stable ID: omitted components remain. Use `removals` with exact binding/control/view/HTML element IDs only for user-requested deletions. HTML ID preservation checks deletion, not arbitrary semantic equivalence.
-4. Automatically call `dashboard_update({"editId":"<returned ID>","expectedRevision":<returned revision>,"expectedCurrentVersionId":<returned UUID or null>,"title":"<new title if requested>"})` with the changed definition fields. When saving edited HTML, also supply the exact `htmlPath` of the editing file. Omit unchanged fields. Updating the visible heading does not rename the saved dashboard; pass `title` as well when renaming.
-5. Check the saved draft receipt; for HTML file updates also check its `sourceFile` path/hash. For another batch, reopen the latest draft and use its new revisions. If the save fails, correct the definition or editing file and retry; do not claim success. If a revision conflict occurs, keep the edited file, open/read the latest state and reconcile before saving.
-6. Historical `versionId` reads do not prepare an editable copy. Use `dashboard_read_html` to inspect historical source, then open the current draft to apply an intentional change.
+4. To add filters or change a saved query, copy the complete `dashboard_open.bindings[]` entry, preserve its `id` and existing `parameters[].controlId`, then preview the edited Binding using `dashboard_preview_binding({"bindingJson":"<complete canonical Binding JSON>"})`. Binding `id` and `output.datasetId` are separate identities. The simplified `dashboard_preview` derives the Binding ID from `datasetId`; using a new probe dataset name can add a Binding instead of replacing the intended one. HTML `query`/`subscribe` calls use Binding IDs. Preview changes to query parameters/defaults again and perform any filter tests required by the preview receipt.
+5. Automatically call `dashboard_update({"editId":"<returned ID>","expectedRevision":<returned revision>,"expectedCurrentVersionId":<returned UUID or null>,"title":"<new title if requested>"})` with the changed definition fields. Include **all intended changed/new Binding `previewIds` from this run**, matching `controls`, and the exact edited `htmlPath` together. Unchanged bindings remain saved. Updating the visible heading does not rename the saved dashboard; pass `title` as well when renaming.
+6. Check the saved draft receipt; for HTML file updates also check its `sourceFile` path/hash. For another batch, reopen the latest draft and use its new revisions. On `DASHBOARD_HTML_PREFLIGHT_FAILED`, inspect the reported expected/requested Binding IDs and page errors. Observed requests are not a static inventory of every reference; a page error can prevent a query from reaching the host. Repair the file or binding previews, retaining every intended `previewId`, control, title and `htmlPath` in the retry. Omitting previews does not adopt new queries from HTML. Never remove saved bindings merely to bypass validation, and do not claim success without a save receipt. On a revision conflict, keep the edited file, open/read the latest state and reconcile before saving.
+7. Historical `versionId` reads do not prepare an editable copy. Use `dashboard_read_html` to inspect historical source, then open the current draft to apply an intentional change.
 
 ## Save, preview and human publication
 

package/skills/live-dashboard/references/source-inspection.md

@@ -0,0 +1,17 @@
+# Source inspection
+
+For each Binding, author `sourceMetadata: [{bindingId,title,description?}]`. Use business names, not invented SQL summaries. Include option-catalog/filter queries too.
+
+HTML pages declare `components: [{id,elementId,title,kind,sources:[{bindingId,fieldIds?}]}]`. `kind` is metric, chart, table, filter or text. The HTML must contain exactly one element with each `elementId`; put IDs on static containers (including canvas parents) rather than dynamically generated children. IDs start with a letter and use letters, digits, dot, underscore or hyphen, at most 80 characters. A multi-query metric lists all of its Binding dependencies. A static element can declare an empty sources array. Field IDs refer to Binding output field IDs, not provider column guesses.
+
+Example (as JSON text in Agent tools):
+
+```json
+[{"id":"revenue","elementId":"revenue-card","title":"Revenue","kind":"metric","sources":[{"bindingId":"sales","fieldIds":["amount"]}]}]
+```
+
+The declared Binding owns the only query payload. Do not embed payloads, credentials or query results in component metadata. Standard chart/table definitions already associate their dataset with its Binding and need no extra component mapping.
+
+`dashboard_update` merges source metadata by bindingId and components by id. Omitted declarations stay unchanged. Use `removals.componentIds` for deliberate removal; changing a DOM ID also requires updating elementId. Removing a Binding requires updating/removing any component references to it. Sources and Inspect read the exact saved revision. Inspect is read-only; its click does not trigger a business filter.
+
+Export/import is a Workbench file operation. An imported dashboard is a new draft, retaining internal Binding/control/component IDs and verified dependency bytes. It must pass current-user data and HTML validation; importing does not grant access or publish a version.