@xpert-ai/plugin-live-dashboard 0.4.1 → 0.6.0

package/dist/lib/archive.service.d.ts

@@ -0,0 +1,169 @@
+import { DashboardSaveRequests } from './save-requests';
+import { z } from 'zod/v3';
+import type { XpertResolvedViewHostContext } from '@xpert-ai/contracts';
+import { type RuntimeCapabilityRegistry, type WorkspacePortableFileReference } from '@xpert-ai/plugin-sdk';
+import { DashboardService } from './dashboard.service';
+export declare const importInputSchema: z.ZodObject<{
+    importId: z.ZodString;
+    bindings: z.ZodArray<z.ZodObject<{
+        bindingId: z.ZodString;
+        source: z.ZodType<import("@xpert-ai/contracts").AnalyticsSourceRef, z.ZodTypeDef, import("@xpert-ai/contracts").AnalyticsSourceRef>;
+        payload: z.ZodType<import("@xpert-ai/contracts").JSONValue, z.ZodTypeDef, import("@xpert-ai/contracts").JSONValue>;
+    }, "strict", z.ZodTypeAny, {
+        bindingId: string;
+        source: import("@xpert-ai/contracts").AnalyticsSourceRef;
+        payload: import("@xpert-ai/contracts").JSONValue;
+    }, {
+        bindingId: string;
+        source: import("@xpert-ai/contracts").AnalyticsSourceRef;
+        payload: import("@xpert-ai/contracts").JSONValue;
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    bindings: {
+        bindingId: string;
+        source: import("@xpert-ai/contracts").AnalyticsSourceRef;
+        payload: import("@xpert-ai/contracts").JSONValue;
+    }[];
+    importId: string;
+}, {
+    bindings: {
+        bindingId: string;
+        source: import("@xpert-ai/contracts").AnalyticsSourceRef;
+        payload: import("@xpert-ai/contracts").JSONValue;
+    }[];
+    importId: string;
+}>;
+declare const importBrowseSchema: z.ZodObject<{
+    importId: z.ZodString;
+    bindingId: z.ZodString;
+    source: z.ZodType<import("@xpert-ai/contracts").AnalyticsSourceRef, z.ZodTypeDef, import("@xpert-ai/contracts").AnalyticsSourceRef>;
+    request: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodType<import("@xpert-ai/contracts").JSONValue, z.ZodTypeDef, import("@xpert-ai/contracts").JSONValue>>>;
+}, "strict", z.ZodTypeAny, {
+    bindingId: string;
+    source: import("@xpert-ai/contracts").AnalyticsSourceRef;
+    importId: string;
+    request: Record<string, import("@xpert-ai/contracts").JSONValue>;
+}, {
+    bindingId: string;
+    source: import("@xpert-ai/contracts").AnalyticsSourceRef;
+    importId: string;
+    request?: Record<string, import("@xpert-ai/contracts").JSONValue> | undefined;
+}>;
+type ImportInput = z.infer<typeof importInputSchema>;
+export declare class DashboardArchiveService {
+    private readonly dashboards;
+    private readonly runtime;
+    private readonly saves?;
+    private readonly imports;
+    constructor(dashboards: DashboardService, runtime: RuntimeCapabilityRegistry, saves?: DashboardSaveRequests | undefined);
+    private authorize;
+    private session;
+    prepare(context: XpertResolvedViewHostContext, bytes: Buffer): Promise<{
+        importId: `${string}-${string}-${string}-${string}-${string}`;
+        manifest: {
+            title: string;
+            id: string;
+            schema: "xpert.live-dashboard";
+            bindings: import("@xpert-ai/contracts").AnalyticsBinding[];
+            controls: {
+                type: "string" | "number" | "boolean" | "date";
+                controlId: string;
+                label: string;
+                defaultValue?: string | number | boolean | null | undefined;
+                allowedValues?: (string | number | boolean | null)[] | undefined;
+            }[];
+            charts: {
+                type: "bar" | "line" | "area" | "pie" | "scatter";
+                title: string;
+                id: string;
+                datasetId: string;
+                x: string;
+                y: string;
+                color?: string | undefined;
+            }[];
+            tables: {
+                title: string;
+                id: string;
+                datasetId: string;
+                fields: string[];
+            }[];
+            sourceMetadata?: {
+                bindingId: string;
+                title: string;
+                description?: string | undefined;
+            }[] | undefined;
+            components?: {
+                title: string;
+                id: string;
+                elementId: string;
+                kind: "filter" | "metric" | "chart" | "table" | "text";
+                sources: {
+                    bindingId: string;
+                    fieldIds?: string[] | undefined;
+                }[];
+            }[] | undefined;
+            presentation?: {
+                type: "html";
+                html: string;
+                dependencies?: import("@xpert-ai/plugin-sdk/artifact-document").ArtifactDocumentDependencyLock[] | undefined;
+            } | undefined;
+        };
+        requirements: {
+            schema: string;
+            version: number;
+            bindings: {
+                id: string;
+                providerId: string;
+                operation: string;
+                contractVersion: number;
+                source: import("@xpert-ai/contracts").AnalyticsSourceRef;
+            }[];
+            externalResources: string[];
+            dynamicResourcesMayExist: boolean;
+            includesQueryResults: boolean;
+            requiresAuthorizedHost: boolean;
+        };
+        sources: import("@xpert-ai/contracts").AnalyticsSourceSummary[];
+    }>;
+    browse(context: XpertResolvedViewHostContext, input: z.infer<typeof importBrowseSchema>): Promise<import("@xpert-ai/contracts").AnalyticsDiscoveryResult>;
+    commit(context: XpertResolvedViewHostContext, input: ImportInput): Promise<{
+        artifactId: string;
+        draftId: string;
+        draftRevision: number;
+        baseVersionId: string | null;
+        status: "draft";
+        title: string;
+    } | {
+        cursor: string;
+        nextAction: string;
+        error?: string | undefined;
+        sourceFile?: {
+            path: string;
+            sha256: string;
+        } | undefined;
+        dashboard?: {
+            status: "draft";
+            title: string;
+            artifactId: string;
+            draftRevision: number;
+            draftId: string;
+            baseVersionId: string | null;
+        } | undefined;
+        requestId: string;
+        state: "failed" | "running" | "succeeded" | "queued";
+        stage: string;
+        completed: number;
+        total: number;
+        terminal: boolean;
+    }>;
+    discard(context: XpertResolvedViewHostContext, id: string): Promise<{
+        discarded: boolean;
+    }>;
+    exportFile(context: XpertResolvedViewHostContext, fileKey: string): Promise<{
+        reference: WorkspacePortableFileReference;
+        fileName: string;
+        mimeType: string;
+        size: number;
+    }>;
+}
+export { importBrowseSchema };

package/dist/lib/archive.service.js

@@ -0,0 +1,147 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.importBrowseSchema = exports.DashboardArchiveService = exports.importInputSchema = void 0;
+const save_requests_1 = require("./save-requests");
+const capacity_1 = require("./capacity");
+const common_1 = require("@nestjs/common");
+const node_crypto_1 = require("node:crypto");
+const v3_1 = require("zod/v3");
+const plugin_sdk_1 = require("@xpert-ai/plugin-sdk");
+const analytics_1 = require("@xpert-ai/plugin-sdk/analytics");
+const dashboard_service_1 = require("./dashboard.service");
+const dashboard_schema_1 = require("./dashboard.schema");
+const dashboard_archive_1 = require("./dashboard-archive");
+const document_package_1 = require("./document-package");
+exports.importInputSchema = v3_1.z.object({ importId: v3_1.z.string().uuid(),
+    bindings: v3_1.z.array(v3_1.z.object({ bindingId: v3_1.z.string(), source: analytics_1.analyticsSourceRefSchema, payload: analytics_1.analyticsBindingObjectSchema.shape.payload }).strict()).max(capacity_1.MAX_DASHBOARD_BINDINGS)
+}).strict();
+const importBrowseSchema = v3_1.z.object({ importId: v3_1.z.string().uuid(), bindingId: v3_1.z.string(), source: analytics_1.analyticsSourceRefSchema, request: analytics_1.analyticsOptionsSchema.default({}) }).strict();
+exports.importBrowseSchema = importBrowseSchema;
+let DashboardArchiveService = class DashboardArchiveService {
+    constructor(dashboards, runtime, saves) {
+        this.dashboards = dashboards;
+        this.runtime = runtime;
+        this.saves = saves;
+        this.imports = new Map();
+    }
+    async authorize(context) {
+        if (!(await this.dashboards.access(context)).canEdit)
+            throw new common_1.ForbiddenException('DASHBOARD_DEFINITION_ACCESS_DENIED');
+    }
+    session(context, id) {
+        const session = this.imports.get(id);
+        if (!session || session.scope !== importScope(context) || Date.now() - session.created > 30 * 60_000)
+            throw new common_1.BadRequestException('DASHBOARD_IMPORT_EXPIRED');
+        return session;
+    }
+    async prepare(context, bytes) {
+        await this.authorize(context);
+        const document = (0, dashboard_archive_1.decodeDashboardArchive)(bytes);
+        for (const [key, session] of this.imports)
+            if (Date.now() - session.created > 30 * 60_000)
+                this.imports.delete(key);
+        if (this.imports.size >= 16)
+            throw new common_1.BadRequestException('DASHBOARD_IMPORT_LIMIT');
+        const importId = (0, node_crypto_1.randomUUID)();
+        this.imports.set(importId, { ...document, scope: importScope(context), created: Date.now(), newId: (0, node_crypto_1.randomUUID)(), busy: false });
+        return { importId, manifest: document.manifest, requirements: (0, dashboard_archive_1.dashboardRequirements)(document.manifest), sources: await this.dashboards.sources(context) };
+    }
+    async browse(context, input) {
+        await this.authorize(context);
+        const session = this.session(context, input.importId);
+        const binding = session.manifest.bindings.find(item => item.id === input.bindingId);
+        if (!binding)
+            throw new common_1.BadRequestException('DASHBOARD_BINDING_DENIED');
+        return this.dashboards.discover(context, { source: input.source, providerId: binding.providerId, request: input.request });
+    }
+    async commit(context, input) {
+        await this.authorize(context);
+        const session = this.session(context, input.importId);
+        if (session.busy)
+            throw new common_1.BadRequestException('DASHBOARD_IMPORT_RUNNING');
+        if (new Set(input.bindings.map(item => item.bindingId)).size !== input.bindings.length || input.bindings.some(item => !session.manifest.bindings.some(binding => binding.id === item.bindingId)))
+            throw new common_1.BadRequestException('DASHBOARD_IMPORT_BINDINGS_INVALID');
+        const manifest = dashboard_schema_1.dashboardSchema.parse({ ...session.manifest, id: session.newId,
+            bindings: session.manifest.bindings.map(binding => {
+                const replacement = input.bindings.find(item => item.bindingId === binding.id);
+                return replacement ? { ...binding, source: replacement.source, payload: replacement.payload } : binding;
+            }) });
+        const hash = (0, node_crypto_1.createHash)('sha256').update((0, document_package_1.encodeDashboardPackage)(manifest, session.dependencies)).digest('hex');
+        if (session.submitted && this.saves) {
+            if (session.submitted.hash !== hash)
+                throw new common_1.BadRequestException('DASHBOARD_IMPORT_ALREADY_SUBMITTED');
+            return this.saves.get(context, session.submitted.requestId);
+        }
+        if (session.committed) {
+            if (session.committed.hash !== hash)
+                throw new common_1.BadRequestException('DASHBOARD_IMPORT_ALREADY_COMPLETED');
+            // Revalidate ownership and current access before returning an idempotent receipt.
+            await this.dashboards.open(context, session.committed.receipt.artifactId);
+            return session.committed.receipt;
+        }
+        session.busy = true;
+        try {
+            if (this.saves && manifest.bindings.length > 8) {
+                const request = await this.saves.submit(context, manifest, null, 0, `import/${input.importId}/${hash}`, undefined, session.dependencies);
+                session.submitted = { hash, requestId: request.requestId };
+                return request;
+            }
+            const receipt = await this.dashboards.save(context, manifest, null, 0, session.dependencies);
+            session.committed = { hash, receipt };
+            return receipt;
+        }
+        finally {
+            session.busy = false;
+        }
+    }
+    async discard(context, id) {
+        await this.authorize(context);
+        const session = this.session(context, id);
+        if (session.busy)
+            throw new common_1.BadRequestException('DASHBOARD_IMPORT_RUNNING');
+        this.imports.delete(id);
+        return { discarded: true };
+    }
+    async exportFile(context, fileKey) {
+        await this.authorize(context);
+        const match = /^archive\/([a-f0-9-]{36})\/(draft|version)\/([a-f0-9-]+)$/.exec(fileKey);
+        if (!match)
+            throw new common_1.BadRequestException('DASHBOARD_EXPORT_TARGET_INVALID');
+        const artifactId = v3_1.z.string().uuid().parse(match[1]);
+        const versionId = match[2] === 'version' ? v3_1.z.string().uuid().parse(match[3]) : undefined;
+        const revision = match[2] === 'draft' ? v3_1.z.coerce.number().int().positive().parse(match[3]) : undefined;
+        const saved = await this.dashboards.openDocument(context, artifactId, versionId, revision, versionId ? 'published' : 'draft');
+        const buffer = (0, dashboard_archive_1.encodeDashboardArchive)(saved.manifest, saved.dependencies);
+        const fileName = `${saved.manifest.title.replace(/[\\/\u0000-\u001f]/g, '_').slice(0, 100)}.xpert-dashboard.zip`;
+        const project = (0, dashboard_service_1.projectId)(context), hash = (0, node_crypto_1.createHash)('sha256').update(buffer).digest('hex');
+        const scope = { tenantId: context.tenantId, organizationId: context.organizationId, userId: context.userId,
+            ...(project ? { catalog: 'projects', scopeId: project, projectId: project } : { catalog: 'xperts', scopeId: context.hostId, xpertId: context.hostId }) };
+        const uploaded = await this.runtime.require(plugin_sdk_1.WorkspaceFilesRuntimeCapability).uploadBuffer({ ...scope, buffer, originalName: fileName,
+            fileName: `${hash}.zip`, folder: `dashboards/exports/${artifactId}`, mimeType: 'application/zip' });
+        const reference = { ...scope, source: 'platform.workspace.files', filePath: uploaded.filePath,
+            workspacePath: uploaded.filePath, originalName: fileName, mimeType: 'application/zip', size: buffer.length };
+        return { reference, fileName, mimeType: 'application/zip', size: buffer.length };
+    }
+};
+exports.DashboardArchiveService = DashboardArchiveService;
+exports.DashboardArchiveService = DashboardArchiveService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Inject)(plugin_sdk_1.XPERT_RUNTIME_CAPABILITIES_TOKEN)),
+    __param(2, (0, common_1.Optional)()),
+    __metadata("design:paramtypes", [dashboard_service_1.DashboardService, Object, save_requests_1.DashboardSaveRequests])
+], DashboardArchiveService);
+function importScope(context) {
+    return JSON.stringify([context.tenantId, context.organizationId, context.userId, context.hostType, context.hostId, (0, dashboard_service_1.projectId)(context)]);
+}

package/dist/lib/bounded-map.d.ts

@@ -0,0 +1,2 @@
+/** Drain every started task before returning; never exceed the worker budget on rejection. */
+export declare function boundedMap<T, R>(items: readonly T[], run: (item: T, index: number) => Promise<R>, concurrency?: number): Promise<R[]>;

package/dist/lib/bounded-map.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.boundedMap = boundedMap;
+/** Drain every started task before returning; never exceed the worker budget on rejection. */
+async function boundedMap(items, run, concurrency = 4) {
+    const results = new Array(items.length);
+    let next = 0, failed = false, failure;
+    await Promise.all(Array.from({ length: Math.min(Math.max(1, Math.min(8, concurrency)), items.length) }, async () => {
+        while (!failed && next < items.length) {
+            const index = next++;
+            try {
+                results[index] = await run(items[index], index);
+            }
+            catch (error) {
+                if (!failed) {
+                    failed = true;
+                    failure = error;
+                }
+            }
+        }
+    }));
+    if (failed)
+        throw failure;
+    return results;
+}

package/dist/lib/capacity.d.ts

@@ -0,0 +1,14 @@
+import { z } from 'zod/v3';
+/** Storage compatibility is independent of the administrator's authoring policy. */
+export declare const MAX_DASHBOARD_BINDINGS = 64;
+export declare const DEFAULT_DASHBOARD_BINDINGS = 32;
+export declare const DASHBOARD_CONFIG = "live-dashboard.config";
+export declare const dashboardConfigSchema: z.ZodDefault<z.ZodObject<{
+    maxBindings: z.ZodDefault<z.ZodNumber>;
+}, "strict", z.ZodTypeAny, {
+    maxBindings: number;
+}, {
+    maxBindings?: number | undefined;
+}>>;
+export type DashboardConfig = z.infer<typeof dashboardConfigSchema>;
+export declare function assertBindingCapacity(count: number, previousCount?: number, limit?: number): void;

package/dist/lib/capacity.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dashboardConfigSchema = exports.DASHBOARD_CONFIG = exports.DEFAULT_DASHBOARD_BINDINGS = exports.MAX_DASHBOARD_BINDINGS = void 0;
+exports.assertBindingCapacity = assertBindingCapacity;
+const v3_1 = require("zod/v3");
+/** Storage compatibility is independent of the administrator's authoring policy. */
+exports.MAX_DASHBOARD_BINDINGS = 64;
+exports.DEFAULT_DASHBOARD_BINDINGS = 32;
+exports.DASHBOARD_CONFIG = 'live-dashboard.config';
+exports.dashboardConfigSchema = v3_1.z.object({
+    maxBindings: v3_1.z.number().int().min(1).max(exports.MAX_DASHBOARD_BINDINGS).default(exports.DEFAULT_DASHBOARD_BINDINGS)
+}).strict().default({});
+function assertBindingCapacity(count, previousCount = 0, limit = exports.DEFAULT_DASHBOARD_BINDINGS) {
+    if (count > exports.MAX_DASHBOARD_BINDINGS || count > limit && count > previousCount)
+        throw new Error(`DASHBOARD_BINDING_CAPACITY: ${count} bindings; authoring limit ${limit}, storage limit ${exports.MAX_DASHBOARD_BINDINGS}. Reuse existing queries or increase the installation policy.`);
+}

package/dist/lib/content.provider.d.ts

@@ -15,7 +15,7 @@ export declare class DashboardContentProvider implements IContentResourceProvide
         providerKey: string;
         resourceId: string;
         title: string;
-        role: "owner" | "manager" | "editor" | "member";
+        role: "owner" | "manager" | "editor" | "member" | "assistant";
         canWrite: boolean;
         canManage: boolean;
     }>;

package/dist/lib/dashboard-archive.d.ts

@@ -0,0 +1,70 @@
+import type { DashboardManifest } from './dashboard.schema';
+import type { ArtifactDocumentDependencyAsset } from '@xpert-ai/plugin-sdk/artifact-document';
+export declare const MAX_DASHBOARD_ARCHIVE_BYTES = 12000000;
+export declare function dashboardRequirements(manifest: DashboardManifest): {
+    schema: string;
+    version: number;
+    bindings: {
+        id: string;
+        providerId: string;
+        operation: string;
+        contractVersion: number;
+        source: import("@xpert-ai/contracts").AnalyticsSourceRef;
+    }[];
+    externalResources: string[];
+    dynamicResourcesMayExist: boolean;
+    includesQueryResults: boolean;
+    requiresAuthorizedHost: boolean;
+};
+export declare function encodeDashboardArchive(manifest: DashboardManifest, dependencies: ArtifactDocumentDependencyAsset[]): Buffer<ArrayBuffer>;
+export declare function decodeDashboardArchive(bytes: Buffer): {
+    manifest: {
+        title: string;
+        id: string;
+        schema: "xpert.live-dashboard";
+        bindings: import("@xpert-ai/contracts").AnalyticsBinding[];
+        controls: {
+            type: "string" | "number" | "boolean" | "date";
+            controlId: string;
+            label: string;
+            defaultValue?: string | number | boolean | null | undefined;
+            allowedValues?: (string | number | boolean | null)[] | undefined;
+        }[];
+        charts: {
+            type: "bar" | "line" | "area" | "pie" | "scatter";
+            title: string;
+            id: string;
+            datasetId: string;
+            x: string;
+            y: string;
+            color?: string | undefined;
+        }[];
+        tables: {
+            title: string;
+            id: string;
+            datasetId: string;
+            fields: string[];
+        }[];
+        sourceMetadata?: {
+            bindingId: string;
+            title: string;
+            description?: string | undefined;
+        }[] | undefined;
+        components?: {
+            title: string;
+            id: string;
+            elementId: string;
+            kind: "filter" | "metric" | "chart" | "table" | "text";
+            sources: {
+                bindingId: string;
+                fieldIds?: string[] | undefined;
+            }[];
+        }[] | undefined;
+        presentation?: {
+            type: "html";
+            html: string;
+            dependencies?: import("@xpert-ai/plugin-sdk/artifact-document").ArtifactDocumentDependencyLock[] | undefined;
+        } | undefined;
+    };
+    dependencies: ArtifactDocumentDependencyAsset[];
+};

package/dist/lib/dashboard-archive.js

@@ -0,0 +1,118 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_DASHBOARD_ARCHIVE_BYTES = void 0;
+exports.dashboardRequirements = dashboardRequirements;
+exports.encodeDashboardArchive = encodeDashboardArchive;
+exports.decodeDashboardArchive = decodeDashboardArchive;
+const node_crypto_1 = require("node:crypto");
+const fflate_1 = require("fflate");
+const v3_1 = require("zod/v3");
+const parse5_1 = require("parse5");
+const document_package_1 = require("./document-package");
+exports.MAX_DASHBOARD_ARCHIVE_BYTES = 12_000_000;
+const entryNames = ['dashboard.json', 'dashboard.html', 'requirements.json'];
+const archiveIndex = v3_1.z.object({
+    schema: v3_1.z.literal('xpert.live-dashboard.archive'), version: v3_1.z.literal(1),
+    files: v3_1.z.array(v3_1.z.object({ name: v3_1.z.enum(entryNames), bytes: v3_1.z.number().int().nonnegative().max(document_package_1.MAX_DASHBOARD_PACKAGE_BYTES), sha256: v3_1.z.string().regex(/^[a-f0-9]{64}$/) }).strict()).min(2).max(3)
+}).strict();
+const hash = (value) => (0, node_crypto_1.createHash)('sha256').update(value).digest('hex');
+function dashboardRequirements(manifest) {
+    const externalResources = new Set();
+    const visit = (node) => {
+        if ('attrs' in node)
+            for (const attr of node.attrs) {
+                if (['src', 'href'].includes(attr.name) && /^(https?:)?\/\//i.test(attr.value))
+                    externalResources.add(attr.value);
+            }
+        if ('childNodes' in node)
+            node.childNodes.forEach(visit);
+    };
+    if (manifest.presentation)
+        visit((0, parse5_1.parse)(manifest.presentation.html));
+    return { schema: 'xpert.live-dashboard.requirements', version: 1,
+        bindings: manifest.bindings.map(({ id, providerId, operation, contractVersion, source }) => ({ id, providerId, operation, contractVersion, source })),
+        externalResources: [...externalResources], dynamicResourcesMayExist: !!manifest.presentation,
+        includesQueryResults: false, requiresAuthorizedHost: true };
+}
+function encodeDashboardArchive(manifest, dependencies) {
+    const entries = {
+        'dashboard.json': (0, document_package_1.encodeDashboardPackage)(manifest, dependencies),
+        'requirements.json': Buffer.from(JSON.stringify(dashboardRequirements(manifest), null, 2))
+    };
+    if (entries['dashboard.json'].length > document_package_1.MAX_DASHBOARD_PACKAGE_BYTES)
+        throw new Error('DASHBOARD_PACKAGE_TOO_LARGE');
+    if (manifest.presentation)
+        entries['dashboard.html'] = Buffer.from(manifest.presentation.html);
+    const index = { schema: 'xpert.live-dashboard.archive', version: 1,
+        files: Object.entries(entries).map(([name, bytes]) => ({ name, bytes: bytes.length, sha256: hash(bytes) })) };
+    entries['package.json'] = Buffer.from(JSON.stringify(index, null, 2));
+    const bytes = Buffer.from((0, fflate_1.zipSync)(entries, { level: 6 }));
+    if (bytes.length > exports.MAX_DASHBOARD_ARCHIVE_BYTES)
+        throw new Error('DASHBOARD_ARCHIVE_TOO_LARGE');
+    return bytes;
+}
+/** Never extracts paths to disk. Bound both advertised and actually inflated bytes. */
+function unzipBounded(bytes) {
+    const files = new Map(), seen = new Set();
+    let total = 0, active = 0, failed;
+    const unzip = new fflate_1.Unzip(file => {
+        if (seen.has(file.name) || !['package.json', ...entryNames].includes(file.name) || (file.originalSize ?? 0) > document_package_1.MAX_DASHBOARD_PACKAGE_BYTES)
+            throw new Error('DASHBOARD_ARCHIVE_ENTRY_INVALID');
+        seen.add(file.name);
+        active++;
+        const chunks = [];
+        let size = 0;
+        file.ondata = (error, data, final) => {
+            if (error) {
+                failed = error;
+                file.terminate();
+                return;
+            }
+            size += data.length;
+            total += data.length;
+            if (size > document_package_1.MAX_DASHBOARD_PACKAGE_BYTES || total > exports.MAX_DASHBOARD_ARCHIVE_BYTES) {
+                failed = new Error('DASHBOARD_ARCHIVE_TOO_LARGE');
+                file.terminate();
+                return;
+            }
+            chunks.push(data);
+            if (final) {
+                files.set(file.name, Buffer.concat(chunks));
+                active--;
+            }
+        };
+        file.start();
+    });
+    unzip.register(fflate_1.UnzipInflate);
+    for (let offset = 0; offset < bytes.length; offset += 1024) {
+        unzip.push(bytes.subarray(offset, offset + 1024), offset + 1024 >= bytes.length);
+        if (failed)
+            throw failed;
+    }
+    if (active || !files.has('package.json') || !files.has('dashboard.json') || !files.has('requirements.json'))
+        throw new Error('DASHBOARD_ARCHIVE_INCOMPLETE');
+    return files;
+}
+function decodeDashboardArchive(bytes) {
+    if (bytes.length > exports.MAX_DASHBOARD_ARCHIVE_BYTES)
+        throw new Error('DASHBOARD_ARCHIVE_TOO_LARGE');
+    if (bytes[0] !== 0x50 || bytes[1] !== 0x4b)
+        return (0, document_package_1.decodeDashboardPackage)(bytes);
+    const files = unzipBounded(bytes);
+    const index = archiveIndex.parse(JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(files.get('package.json'))));
+    if (new Set(index.files.map(entry => entry.name)).size !== index.files.length || files.size !== index.files.length + 1)
+        throw new Error('DASHBOARD_ARCHIVE_ENTRY_INVALID');
+    for (const entry of index.files) {
+        const file = files.get(entry.name);
+        if (!file || file.length !== entry.bytes || hash(file) !== entry.sha256)
+            throw new Error('DASHBOARD_ARCHIVE_INTEGRITY_FAILED');
+    }
+    if (!index.files.some(entry => entry.name === 'dashboard.json') || !index.files.some(entry => entry.name === 'requirements.json'))
+        throw new Error('DASHBOARD_ARCHIVE_INCOMPLETE');
+    const result = (0, document_package_1.decodeDashboardPackage)(files.get('dashboard.json'));
+    if (result.manifest.presentation ? !files.get('dashboard.html')?.equals(Buffer.from(result.manifest.presentation.html)) : files.has('dashboard.html'))
+        throw new Error('DASHBOARD_ARCHIVE_HTML_MISMATCH');
+    if (!files.get('requirements.json')?.equals(Buffer.from(JSON.stringify(dashboardRequirements(result.manifest), null, 2))))
+        throw new Error('DASHBOARD_ARCHIVE_REQUIREMENTS_MISMATCH');
+    return result;
+}

package/dist/lib/dashboard-queries.d.ts

@@ -5,7 +5,7 @@ export declare function validateControls(manifest: DashboardManifest, input: Rec
     [x: string]: AnalyticsValue;
 };
 export declare function queryDashboardBinding(runtime: RuntimeCapabilityRegistry, actor: DataSourceActor, manifest: DashboardManifest, bindingId: string, input: Record<string, AnalyticsValue>): Promise<AnalyticalDataset>;
-export declare function queryDashboard(runtime: RuntimeCapabilityRegistry, actor: DataSourceActor, manifest: DashboardManifest, input: Record<string, AnalyticsValue>): Promise<AnalyticalDataset[]>;
+export declare function queryDashboard(runtime: RuntimeCapabilityRegistry, actor: DataSourceActor, manifest: DashboardManifest, input: Record<string, AnalyticsValue>, progress?: (completed: number) => Promise<void>): Promise<AnalyticalDataset[]>;
 /** Read-only rendering can show independent successful bindings. Saving/publishing still
  * uses queryDashboard and requires every binding to validate. Never return native error
  * details, which may contain private source configuration or query text. */

package/dist/lib/dashboard-queries.js

@@ -4,6 +4,7 @@ exports.validateControls = validateControls;
 exports.queryDashboardBinding = queryDashboardBinding;
 exports.queryDashboard = queryDashboard;
 exports.queryDashboardPartial = queryDashboardPartial;
+const bounded_map_1 = require("./bounded-map");
 const common_1 = require("@nestjs/common");
 const plugin_sdk_1 = require("@xpert-ai/plugin-sdk");
 function validateControls(manifest, input) {
@@ -29,11 +30,15 @@ async function queryDashboardBinding(runtime, actor, manifest, bindingId, input)
     const selected = Object.fromEntries(Object.entries(controls).filter(([id]) => binding.parameters.some(parameter => parameter.controlId === id)));
     return runtime.require(plugin_sdk_1.AnalyticsRuntimeCapability).query(actor, { binding, controls: selected });
 }
-async function queryDashboard(runtime, actor, manifest, input) {
+async function queryDashboard(runtime, actor, manifest, input, progress) {
     validateControls(manifest, input);
-    const datasets = [];
-    for (const binding of manifest.bindings)
-        datasets.push(await queryDashboardBinding(runtime, actor, manifest, binding.id, input));
+    let completed = 0;
+    const datasets = await (0, bounded_map_1.boundedMap)(manifest.bindings, async (binding) => {
+        await progress?.(completed);
+        const result = await queryDashboardBinding(runtime, actor, manifest, binding.id, input);
+        await progress?.(++completed);
+        return result;
+    });
     if (Buffer.byteLength(JSON.stringify(datasets)) > 3_000_000)
         throw new common_1.BadRequestException('DASHBOARD_RESULT_TOO_LARGE');
     return datasets;
@@ -45,14 +50,14 @@ async function queryDashboardPartial(runtime, actor, manifest, input) {
     validateControls(manifest, input);
     const datasets = [];
     const failures = [];
-    for (const binding of manifest.bindings) {
+    await (0, bounded_map_1.boundedMap)(manifest.bindings, async (binding) => {
         try {
             datasets.push(await queryDashboardBinding(runtime, actor, manifest, binding.id, input));
         }
         catch {
             failures.push({ bindingId: binding.id, datasetId: binding.output.datasetId, reason: 'unavailable' });
         }
-    }
+    });
     if (Buffer.byteLength(JSON.stringify(datasets)) > 3_000_000)
         throw new common_1.BadRequestException('DASHBOARD_RESULT_TOO_LARGE');
     return { datasets, failures };

package/dist/lib/dashboard-receipt.js

@@ -4,7 +4,7 @@ exports.DASHBOARD_MUTATION_TOOLS = void 0;
 exports.createdDashboard = createdDashboard;
 exports.savedDashboardSource = savedDashboardSource;
 const v3_1 = require("zod/v3");
-exports.DASHBOARD_MUTATION_TOOLS = ['dashboard_create', 'dashboard_create_html', 'dashboard_update'];
+exports.DASHBOARD_MUTATION_TOOLS = ['dashboard_create', 'dashboard_create_html', 'dashboard_update', 'dashboard_wait_request', 'dashboard_get_request'];
 const receiptSchema = v3_1.z.object({ dashboard: v3_1.z.object({ artifactId: v3_1.z.string().uuid(), draftRevision: v3_1.z.number().int().positive(), status: v3_1.z.literal('draft') }) });
 /** Tool start/failed logs can share the host event channel; only a saved receipt opens a View. */
 function createdDashboard(output) {