@datalayer/core 1.1.59 → 1.1.66

package/lib/models/StartedBy.js

@@ -0,0 +1,81 @@
+/*
+ * Copyright (c) 2023-2025 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/*
+ * Copyright (c) 2023-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * Who started a runtime: a person, one of their agents, or a service agent.
+ *
+ * The reservation has carried this since agents could make one — IAM writes
+ * `client_id_s` and `agent_uid_s` onto the usage record's metadata, and
+ * `useUsages` already hands the whole map to the views. Nothing displayed
+ * it, so a person looking at their running runtimes could not tell which of
+ * them they had started and which an agent had, on a platform whose premise
+ * is that agents start things on your behalf.
+ *
+ * The distinction that matters is **agent versus service agent**, not
+ * "automated versus not". A delegated agent runs as you, spends your
+ * credits, and stops when you disconnect it. A service agent is the
+ * organization's own principal with its own key: it keeps running when the
+ * person who set it up leaves, and it is the row somebody has to go and turn
+ * off. Told apart, one is "I did that yesterday" and the other is "who owns
+ * this".
+ *
+ * @module models/StartedBy
+ */
+/** The Solr field names IAM writes the dimensions on. */
+export const CLIENT_ID_KEY = 'client_id_s';
+export const AGENT_UID_KEY = 'agent_uid_s';
+const read = (metadata, key) => {
+    if (!metadata) {
+        return '';
+    }
+    const value = metadata instanceof Map
+        ? metadata.get(key)
+        : metadata[key];
+    return typeof value === 'string' ? value.trim() : '';
+};
+/**
+ * Who started this reservation.
+ *
+ * `agent_uid_s` decides before `client_id_s`, because a service agent
+ * reaching Runtimes through the MCP gateway carries **the gateway's** client
+ * id: read the other way round, every one of an organization's pipelines
+ * would show as the same agent.
+ *
+ * A record with neither dimension is a person's own work. It is *not* an
+ * agent whose name we failed to read, and saying "unknown" would suggest it
+ * was — so the answer is the reader themselves.
+ */
+export const startedBy = (metadata) => {
+    const agentUid = read(metadata, AGENT_UID_KEY);
+    const clientId = read(metadata, CLIENT_ID_KEY);
+    if (agentUid) {
+        return { kind: 'service-agent', label: agentUid, clientId, agentUid };
+    }
+    if (clientId) {
+        return { kind: 'agent', label: clientId, clientId, agentUid: '' };
+    }
+    return { kind: 'person', label: 'You', clientId: '', agentUid: '' };
+};
+/**
+ * The words a search box matches on for this row.
+ *
+ * "agent" matches every agent-started runtime, the client id matches one
+ * client, and "you" matches your own — so the filter the plan asks for is the
+ * search box that is already there rather than a second control beside it.
+ */
+export const startedBySearchTerms = (metadata) => {
+    const who = startedBy(metadata);
+    if (who.kind === 'person') {
+        return 'you person';
+    }
+    if (who.kind === 'service-agent') {
+        return `agent service-agent ${who.agentUid} ${who.clientId}`.trim();
+    }
+    return `agent ${who.clientId}`;
+};
+export default startedBy;

package/lib/models/UserDTO.js

@@ -60,6 +60,8 @@ export class UserDTO {
      * @returns Core user data with camelCase properties
      */
     toJSON() {
+        // avatarIcon and banner are optional: omit them when the API did not
+        // return them, as validateJSON rejects undefined property values.
         const obj = {
             id: this.id,
             uid: this.uid,
@@ -69,8 +71,8 @@ export class UserDTO {
             email: this.email,
             handle: this.handle,
             avatarUrl: this.avatarUrl,
-            avatarIcon: this.avatarIcon,
-            banner: this.banner,
+            ...(this.avatarIcon !== undefined ? { avatarIcon: this.avatarIcon } : {}),
+            ...(this.banner !== undefined ? { banner: this.banner } : {}),
         };
         validateJSON(obj, 'User');
         return obj;

package/lib/models/contents/__fixtures__/solr-codec.json

@@ -0,0 +1,57 @@
+{
+  "solr": {
+    "id": "internal-root",
+    "_version_": 42,
+    "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
+    "source_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ",
+    "type_s": "content_source",
+    "name_t": "Earth observations",
+    "code_s": "earth-observations",
+    "capabilities_ss": ["browse", "query"],
+    "rank_i": 7,
+    "ranks_is": [7, 8],
+    "completed_bytes_l": 12,
+    "part_sizes_ls": [5, 7],
+    "progress_f": 0.5,
+    "progress_samples_fs": [0.25, 0.5],
+    "ratio_d": 0.125,
+    "ratios_ds": [0.125, 0.25],
+    "is_public_b": false,
+    "checks_bs": [true, false],
+    "created_at_dt": "2026-08-24T12:00:00Z",
+    "observed_at_dts": ["2026-08-24T12:00:00Z", "2026-08-24T12:01:00Z"],
+    "notes_txt": "typed suffix coverage",
+    "description_t": null,
+    "grants": [{
+      "id": "internal-child",
+      "_root_": "internal-root",
+      "_nest_parent_": "internal-root",
+      "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
+      "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ",
+      "access_level_s": "view"
+    }]
+  },
+  "python": {
+    "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
+    "source_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ",
+    "type": "content_source",
+    "name": "Earth observations",
+    "code": "earth-observations",
+    "capabilities": ["browse", "query"],
+    "rank": 7,
+    "ranks": [7, 8],
+    "completed_bytes": 12,
+    "part_sizes": [5, 7],
+    "progress": 0.5,
+    "progress_samples": [0.25, 0.5],
+    "ratio": 0.125,
+    "ratios": [0.125, 0.25],
+    "is_public": false,
+    "checks": [true, false],
+    "created_at": "2026-08-24T12:00:00Z",
+    "observed_at": ["2026-08-24T12:00:00Z", "2026-08-24T12:01:00Z"],
+    "notes": "typed suffix coverage",
+    "description": null,
+    "grants": [{"uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV", "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ", "access_level": "view"}]
+  }
+}

package/lib/models/contents/__fixtures__/v1-contracts.json

@@ -0,0 +1,66 @@
+{
+  "sources": [
+    {
+      "contract_version": "v1",
+      "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
+      "kind": "files",
+      "name": "User Folder",
+      "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ",
+      "principal_kind": "user",
+      "configuration": {"kind": "files", "owning_user_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ", "storage_backend_id": "users", "quota_policy": "standard", "versioning_policy": "retained"},
+      "capabilities": ["browse", "transfer", "mount"],
+      "status": "ready",
+      "created_at": "2026-08-24T12:00:00Z",
+      "updated_at": "2026-08-24T12:00:00Z"
+    },
+    {
+      "contract_version": "v1", "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV", "kind": "dataset", "name": "Dataset", "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ", "principal_kind": "user",
+      "configuration": {"kind": "dataset", "tags": ["curated"], "publication_eligible": true}, "capabilities": ["browse", "materialize"], "status": "ready", "created_at": "2026-08-24T12:00:00Z", "updated_at": "2026-08-24T12:00:00Z"
+    },
+    {
+      "contract_version": "v1", "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV", "kind": "volume", "name": "Volume", "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ", "principal_kind": "user",
+      "configuration": {"kind": "volume", "capacity_bytes": 1073741824, "scope": "user", "backing_resource_id": "pvc-1", "default_mount_path": "/home/jovyan/data", "access_modes": ["ro", "rw"], "concurrent_readers": true, "concurrent_writers": false}, "capabilities": ["browse", "mount"], "status": "ready", "created_at": "2026-08-24T12:00:00Z", "updated_at": "2026-08-24T12:00:00Z"
+    },
+    {
+      "contract_version": "v1", "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV", "kind": "cloud-storage", "name": "S3", "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ", "principal_kind": "user",
+      "configuration": {"kind": "cloud-storage", "provider": "s3", "bucket_or_container": "research", "prefix": "inputs/", "region": "eu-west-1", "access_preference": "automatic"}, "capabilities": ["browse", "transfer"], "status": "ready", "created_at": "2026-08-24T12:00:00Z", "updated_at": "2026-08-24T12:00:00Z"
+    },
+    {
+      "contract_version": "v1", "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV", "kind": "datasource", "name": "Warehouse", "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ", "principal_kind": "user",
+      "configuration": {"kind": "datasource", "connector_type": "sql", "endpoint": "duckdb://", "credential_uid": "01HZY7WQ8XKJ4M2N5P6R7S8T9V", "database_or_project": "analytics", "allowed_operations": ["select"], "default_row_limit": 10000}, "capabilities": ["query"], "status": "ready", "created_at": "2026-08-24T12:00:00Z", "updated_at": "2026-08-24T12:00:00Z"
+    },
+    {
+      "contract_version": "v1", "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV", "kind": "data-server", "name": "Private gateway", "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ", "principal_kind": "organization",
+      "configuration": {"kind": "data-server", "registration_identity": "gateway-1", "mtls_issuer": "datalayer-contents-ca", "connectors": [{"connector_type": "sql", "operations": ["select"], "policy_version": "v1"}], "policy_version": "v1"}, "capabilities": ["query"], "status": "ready", "created_at": "2026-08-24T12:00:00Z", "updated_at": "2026-08-24T12:00:00Z"
+    },
+    {
+      "contract_version": "v1", "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV", "kind": "mcp", "name": "Earthdata", "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ", "principal_kind": "team",
+      "configuration": {"kind": "mcp", "transport": "streamable-http", "endpoint": "https://example.test/mcp", "allowed_tools": ["search_earthdata"], "allowed_domains": ["earthdata.nasa.gov"], "allowed_destinations": ["home-folder:///acquisitions/"], "approval_policy": "explicit", "destination_policy": "home-folder-only", "max_result_bytes": 67108864}, "capabilities": ["browse", "transfer"], "status": "ready", "created_at": "2026-08-24T12:00:00Z", "updated_at": "2026-08-24T12:00:00Z"
+    },
+    {
+      "contract_version": "v1", "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV", "kind": "environment", "name": "Environment content", "principal_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ", "principal_kind": "organization",
+      "configuration": {"kind": "environment", "environment_uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV", "build_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ", "runtime_content_uids": [], "resolved_provider_paths": {}, "build_entries": []}, "capabilities": ["materialize"], "status": "ready", "created_at": "2026-08-24T12:00:00Z", "updated_at": "2026-08-24T12:00:00Z"
+    }
+  ],
+  "attachment_manifest": {
+    "contract_version": "v1",
+    "sandbox_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ",
+    "sandbox_provider": "daytona",
+    "generated_at": "2026-08-24T12:00:00Z",
+    "attachments": [{
+      "uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
+      "source_uid": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
+      "sandbox_uid": "01BX5ZZKBKACTAV9WEVGEMMVRZ",
+      "sandbox_provider": "daytona",
+      "mode": "ro",
+      "mount_path": "/home/daytona/data",
+      "delivery": "materialize",
+      "required": true,
+      "capabilities": ["browse", "materialize"],
+      "status": "ready",
+      "limits": {"bytes": 1073741824},
+      "created_at": "2026-08-24T12:00:00Z",
+      "cleanup_policy": "remove-materialization"
+    }]
+  }
+}

package/lib/models/contents/fieldCase.d.ts

@@ -0,0 +1,8 @@
+/** JSON values accepted at the Contents HTTP boundary. */
+export type JsonValue = null | boolean | number | string | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+/** Recursively convert suffixless Python/API snake-case fields to camel case. */
+export declare const contentsToCamelCase: (value: JsonValue) => JsonValue;
+/** Recursively convert camel-case Contents client values to API snake case. */
+export declare const contentsToSnakeCase: (value: JsonValue) => JsonValue;

package/lib/models/contents/fieldCase.js

@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2023-2025 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+const snakeToCamelKey = (key) => key.replace(/_([a-zA-Z0-9])/g, (_, character) => character.toUpperCase());
+const camelToSnakeKey = (key) => key.replace(/([A-Z])/g, '_$1').toLowerCase();
+const convertObject = (value, keyConverter, valueConverter) => {
+    const converted = {};
+    for (const [key, item] of Object.entries(value)) {
+        const convertedKey = keyConverter(key);
+        if (Object.hasOwn(converted, convertedKey)) {
+            throw new Error(`Contents field collision: ${key} -> ${convertedKey}`);
+        }
+        converted[convertedKey] = valueConverter(item);
+    }
+    return converted;
+};
+/** Recursively convert suffixless Python/API snake-case fields to camel case. */
+export const contentsToCamelCase = (value) => {
+    if (Array.isArray(value)) {
+        return value.map(contentsToCamelCase);
+    }
+    if (value !== null && typeof value === 'object') {
+        return convertObject(value, snakeToCamelKey, contentsToCamelCase);
+    }
+    return value;
+};
+/** Recursively convert camel-case Contents client values to API snake case. */
+export const contentsToSnakeCase = (value) => {
+    if (Array.isArray(value)) {
+        return value.map(contentsToSnakeCase);
+    }
+    if (value !== null && typeof value === 'object') {
+        return convertObject(value, camelToSnakeKey, contentsToSnakeCase);
+    }
+    return value;
+};

package/lib/models/contents/index.d.ts

@@ -0,0 +1,2 @@
+export * from './fieldCase';
+export * from './permissions';

package/lib/models/contents/index.js

@@ -0,0 +1,6 @@
+/*
+ * Copyright (c) 2023-2025 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+export * from './fieldCase.js';
+export * from './permissions.js';

package/lib/models/contents/permissions.d.ts

@@ -0,0 +1,16 @@
+import type { CatalogSource, ContentSource } from '../../api/contents';
+/**
+ * What each content source is called where a person reads it.
+ *
+ * Keyed by the wire field, which is still `kind`: the contract names it that,
+ * and renaming a stored field is a migration rather than a vocabulary choice.
+ * Everything above the wire says content source.
+ */
+export declare const CONTENT_SOURCE_LABELS: Record<ContentSource['kind'], string>;
+export declare const contentSourceLabel: (kind: ContentSource["kind"]) => string;
+export declare const contentSourceEffectiveRole: (item: CatalogSource) => string;
+export declare const canViewContentSource: (item: CatalogSource) => boolean;
+export declare const canUpdateContentSource: (item: CatalogSource) => boolean;
+export declare const canExecuteContentSource: (item: CatalogSource) => boolean;
+/** Sharing mutations are owner-only in the v1 Contents service contract. */
+export declare const canShareContentSource: (item: CatalogSource) => boolean;

package/lib/models/contents/permissions.js

@@ -0,0 +1,34 @@
+/*
+ * Copyright (c) 2023-2025 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * What each content source is called where a person reads it.
+ *
+ * Keyed by the wire field, which is still `kind`: the contract names it that,
+ * and renaming a stored field is a migration rather than a vocabulary choice.
+ * Everything above the wire says content source.
+ */
+export const CONTENT_SOURCE_LABELS = {
+    files: 'Home Folder',
+    dataset: 'Dataset',
+    volume: 'Volume',
+    'cloud-storage': 'Cloud Storage',
+    datasource: 'Datasource',
+    'data-server': 'Dataserver',
+    mcp: 'MCP',
+    environment: 'Environment',
+};
+export const contentSourceLabel = (kind) => CONTENT_SOURCE_LABELS[kind];
+export const contentSourceEffectiveRole = (item) => {
+    if (item.permissions.isOwner) {
+        return 'Owner';
+    }
+    const level = item.permissions.effectiveAccessLevel;
+    return level ? `${level[0].toUpperCase()}${level.slice(1)}` : 'No access';
+};
+export const canViewContentSource = (item) => item.permissions.view;
+export const canUpdateContentSource = (item) => item.permissions.update;
+export const canExecuteContentSource = (item) => item.permissions.execute;
+/** Sharing mutations are owner-only in the v1 Contents service contract. */
+export const canShareContentSource = (item) => item.source.kind !== 'files' && item.permissions.isOwner;

package/lib/models/index.d.ts

@@ -36,7 +36,6 @@ export * from './ContactIAMProvider';
 export * from './ContactTags';
 export * from './Credits';
 export * from './CreditsDTO';
-export * from './Datasource';
 export * from './Dean';
 export * from './Errors';
 export * from './GrowthKPI';
@@ -50,6 +49,10 @@ export * from './Inbound';
 export * from './Instructor';
 export * from './Invite';
 export * from './LandingRoles';
+export * from './McpAuditEvent';
+export * from './McpBinding';
+export * from './McpPolicy';
+export * from './McpTask';
 export * from './Member';
 export * from './Organization';
 export * from './OrganizationMember';
@@ -68,6 +71,7 @@ export * from './TeamMember';
 export * from './URN';
 export * from './Usage';
 export * from './User';
+export * from './StartedBy';
 export * from './UserDTO';
 export * from './UserEvent';
 export * from './UserOnboarding';

package/lib/models/index.js

@@ -40,7 +40,6 @@ export * from './ContactIAMProvider.js';
 export * from './ContactTags.js';
 export * from './Credits.js';
 export * from './CreditsDTO.js';
-export * from './Datasource.js';
 export * from './Dean.js';
 export * from './Errors.js';
 export * from './GrowthKPI.js';
@@ -54,6 +53,10 @@ export * from './Inbound.js';
 export * from './Instructor.js';
 export * from './Invite.js';
 export * from './LandingRoles.js';
+export * from './McpAuditEvent.js';
+export * from './McpBinding.js';
+export * from './McpPolicy.js';
+export * from './McpTask.js';
 export * from './Member.js';
 export * from './Organization.js';
 export * from './OrganizationMember.js';
@@ -72,6 +75,7 @@ export * from './TeamMember.js';
 export * from './URN.js';
 export * from './Usage.js';
 export * from './User.js';
+export * from './StartedBy.js';
 export * from './UserDTO.js';
 export * from './UserEvent.js';
 export * from './UserOnboarding.js';

package/lib/state/substates/CoreState.d.ts

@@ -1,4 +1,15 @@
 import type { IDatalayerCoreConfig } from '../../config/Configuration';
+/**
+ * What the page itself stated, as opposed to what this module defaults to.
+ *
+ * The two cannot be told apart once merged, and they do not carry the same
+ * weight: a value written into the page describes the deployment that served
+ * it, while a default is only a guess. A consumer that reconciles this
+ * configuration with another source — the Jupyter server extension, say —
+ * needs to know which keys were actually stated, or it will let a stale
+ * answer from elsewhere override a deliberate one from here.
+ */
+export declare const pageConfiguration: Partial<IDatalayerCoreConfig>;
 export type DatalayerCoreState = {
     tab: number;
     getIntTab: () => number;
@@ -23,14 +34,11 @@ export declare const coreStore: import("zustand").StoreApi<DatalayerCoreState>;
 export declare function useCoreStore(): DatalayerCoreState;
 export declare function useCoreStore<T>(selector: (state: DatalayerCoreState) => T): T;
 /**
- * Resolve the OTEL base URL used to *consume* (read/query) telemetry.
- *
- * Prefers `otelInUrl` when set, otherwise falls back to `otelUrl`. This allows
- * local development to fetch telemetry from a remote (e.g. production) OTEL
- * service even when the local runtime exports telemetry to a different endpoint.
+ * The OTEL base URL used to *consume* (read/query) telemetry.
  *
- * Mirrors the `DATALAYER_OTEL_IN_URL` (consume) / `DATALAYER_OTEL_URL` (export)
- * split on the backend/build side.
+ * One address, `otelUrl`. A second one existed so local development could read
+ * from a remote service while exporting elsewhere; pointing `otelUrl` at that
+ * remote does the same thing without two fields that disagree.
  */
 export declare const getOtelConsumeUrl: () => string;
 export default useCoreStore;

package/lib/state/substates/CoreState.js

@@ -16,6 +16,7 @@ let initialConfiguration = {
     loadConfigurationFromServer: true,
     jupyterServerless: false,
     iamUrl: 'https://prod1.datalayer.run',
+    contentsUrl: 'https://r1.datalayer.run',
     managerUrl: 'https://prod1.datalayer.run',
     runtimesUrl: 'https://r1.datalayer.run',
     schedulerUrl: 'https://prod1.datalayer.run',
@@ -26,9 +27,6 @@ let initialConfiguration = {
     jupyterMcpServerUrl: 'https://mcp.datalayer.run/mcp',
     otelUrl: 'https://prod1.datalayer.run',
     // Defaults to prod so telemetry is consumed from the production OTEL service
-    // even when runtimes export elsewhere (see `getOtelConsumeUrl` and the
-    // `DATALAYER_OTEL_IN_URL` env var). Override to '' to consume from `otelUrl`.
-    otelInUrl: 'https://prod1.datalayer.run',
     growthUrl: 'https://prod1.datalayer.run',
     inboundsUrl: 'https://prod1.datalayer.run',
     successUrl: 'https://prod1.datalayer.run',
@@ -52,12 +50,24 @@ let initialConfiguration = {
         privacyUrl: 'https://datalayer.ai/privacy',
     },
 };
+/**
+ * What the page itself stated, as opposed to what this module defaults to.
+ *
+ * The two cannot be told apart once merged, and they do not carry the same
+ * weight: a value written into the page describes the deployment that served
+ * it, while a default is only a guess. A consumer that reconciles this
+ * configuration with another source — the Jupyter server extension, say —
+ * needs to know which keys were actually stated, or it will let a stale
+ * answer from elsewhere override a deliberate one from here.
+ */
+export const pageConfiguration = {};
 // Try loading initial state from datalayer-config-data element
 try {
     if (typeof document !== 'undefined') {
         const rawConfig = document.getElementById('datalayer-config-data');
         if (rawConfig?.innerText) {
             const htmlOverridingConfiguration = JSON.parse(rawConfig?.innerText || '{}');
+            Object.assign(pageConfiguration, htmlOverridingConfiguration);
             if (htmlOverridingConfiguration.loadConfigurationFromServer != undefined) {
                 loadConfigurationFromServer =
                     htmlOverridingConfiguration.loadConfigurationFromServer;
@@ -103,17 +113,11 @@ export function useCoreStore(selector) {
     return useStore(coreStore, selector);
 }
 /**
- * Resolve the OTEL base URL used to *consume* (read/query) telemetry.
+ * The OTEL base URL used to *consume* (read/query) telemetry.
  *
- * Prefers `otelInUrl` when set, otherwise falls back to `otelUrl`. This allows
- * local development to fetch telemetry from a remote (e.g. production) OTEL
- * service even when the local runtime exports telemetry to a different endpoint.
- *
- * Mirrors the `DATALAYER_OTEL_IN_URL` (consume) / `DATALAYER_OTEL_URL` (export)
- * split on the backend/build side.
+ * One address, `otelUrl`. A second one existed so local development could read
+ * from a remote service while exporting elsewhere; pointing `otelUrl` at that
+ * remote does the same thing without two fields that disagree.
  */
-export const getOtelConsumeUrl = () => {
-    const cfg = coreStore.getState().configuration;
-    return cfg.otelInUrl || cfg.otelUrl;
-};
+export const getOtelConsumeUrl = () => coreStore.getState().configuration.otelUrl;
 export default useCoreStore;

package/lib/state/substates/IAMState.d.ts

@@ -63,7 +63,7 @@ export type IAMState = IIAMState & {
     setExternalToken: (externalToken: string) => void;
     setVersion: (version: string) => void;
     /**
-     * Set the {@link token} and the {@link user}.
+     * Set the `token` and the `user`.
      *
      * The user detail will be automatically retrieve
      * to avoid inconsistency.

package/lib/state/substates/IAMState.js

@@ -6,6 +6,7 @@ import { Poll } from '@lumino/polling';
 import { useStore } from 'zustand';
 import { createStore } from 'zustand/vanilla';
 import { ANONYMOUS_USER_TOKEN, ANONYMOUS_USER, asUser, IAMProvidersSpecs, } from '../../models/index.js';
+import { availableCredits } from '../../models/Credits.js';
 import { getStoredToken, getStoredUser, loadRefreshTokenFromCookie, storeToken, storeUser, } from '../storage/index.js';
 import { requestDatalayerAPI, } from '../../api/DatalayerApi.js';
 import { getCookie, setCookie, deleteCookie } from '../../utils/index.js';
@@ -130,12 +131,11 @@ export const iamStore = createStore((set, get) => {
                             : undefined,
                     });
                     const { credits, reservations: creditsReservations = [] } = creditsRaw;
-                    let available = credits.quota !== null
-                        ? credits.quota - credits.credits
-                        : credits.credits;
-                    available -= creditsReservations.reduce((consumed, reservation) => consumed + reservation.credits, 0);
                     set({
-                        credits: { ...credits, available: Math.max(0, available) },
+                        credits: {
+                            ...credits,
+                            available: availableCredits(credits, creditsReservations),
+                        },
                         creditsReservations: creditsReservations,
                     });
                 }

package/lib/state/substates/ProfileState.js

@@ -2,10 +2,6 @@
  * Copyright (c) 2023-2025 Datalayer, Inc.
  * Distributed under the terms of the Modified BSD License.
  */
-/*
- * Copyright (c) 2023-2026 Datalayer, Inc.
- * Distributed under the terms of the Modified BSD License.
- */
 /**
  * ProfileState — the one place the authenticated user's profile lives.
  *

package/lib/state/substates/index.d.ts

@@ -1,5 +1,4 @@
 export * from './CoreState';
-export * from './DatasourceState';
 export * from './IAMState';
 export * from './LayoutState';
 export * from './ProfileState';

package/lib/state/substates/index.js

@@ -3,7 +3,6 @@
  * Distributed under the terms of the Modified BSD License.
  */
 export * from './CoreState.js';
-export * from './DatasourceState.js';
 export * from './IAMState.js';
 export * from './LayoutState.js';
 export * from './ProfileState.js';

package/lib/utils/Jwt.d.ts

@@ -24,6 +24,32 @@ export interface DatalayerJwtPayload {
  * Returns `null` on any error (malformed token, invalid base64, etc.).
  */
 export declare function parseJwtPayload<T = DatalayerJwtPayload>(token: string): T | null;
+/**
+ * When a JWT expires, in milliseconds since the epoch.
+ *
+ * `null` when there is no token, when it cannot be decoded, or when it
+ * carries no `exp` — three different unknowns that all mean the same thing to
+ * a caller: nothing here says this token has expired.
+ */
+export declare function getJwtExpiryMs(token: string | null | undefined): number | null;
+/**
+ * Whether a JWT has already expired.
+ *
+ * Answers `false` for anything it cannot read — a missing token, an opaque
+ * one, a payload with no `exp`. This is the only safe direction: a caller
+ * uses it to refuse a request before making it, and refusing on a token we
+ * failed to parse would break every non-JWT credential the API accepts.
+ *
+ * Unverified, and deliberately so. The signature is the server's business;
+ * what a client can usefully do with `exp` is avoid sending a request whose
+ * only possible answer is 401, and tell the person why in the meantime.
+ *
+ * `leewaySeconds` counts a token as expired slightly early. A request takes
+ * time to arrive, so a token with a second left on it is one the server may
+ * well reject by the time it reads it — and a typed expiry error is a better
+ * answer for the reader than an opaque 401.
+ */
+export declare function isJwtExpired(token: string | null | undefined, leewaySeconds?: number): boolean;
 /**
  * Extract the Datalayer user object from a JWT, returning `null` if the
  * token is missing or cannot be decoded.

package/lib/utils/Jwt.js

@@ -29,6 +29,43 @@ export function parseJwtPayload(token) {
         return null;
     }
 }
+/**
+ * When a JWT expires, in milliseconds since the epoch.
+ *
+ * `null` when there is no token, when it cannot be decoded, or when it
+ * carries no `exp` — three different unknowns that all mean the same thing to
+ * a caller: nothing here says this token has expired.
+ */
+export function getJwtExpiryMs(token) {
+    if (!token)
+        return null;
+    const payload = parseJwtPayload(token);
+    const exp = payload?.exp;
+    return typeof exp === 'number' && Number.isFinite(exp) ? exp * 1000 : null;
+}
+/**
+ * Whether a JWT has already expired.
+ *
+ * Answers `false` for anything it cannot read — a missing token, an opaque
+ * one, a payload with no `exp`. This is the only safe direction: a caller
+ * uses it to refuse a request before making it, and refusing on a token we
+ * failed to parse would break every non-JWT credential the API accepts.
+ *
+ * Unverified, and deliberately so. The signature is the server's business;
+ * what a client can usefully do with `exp` is avoid sending a request whose
+ * only possible answer is 401, and tell the person why in the meantime.
+ *
+ * `leewaySeconds` counts a token as expired slightly early. A request takes
+ * time to arrive, so a token with a second left on it is one the server may
+ * well reject by the time it reads it — and a typed expiry error is a better
+ * answer for the reader than an opaque 401.
+ */
+export function isJwtExpired(token, leewaySeconds = 0) {
+    const expiryMs = getJwtExpiryMs(token);
+    if (expiryMs === null)
+        return false;
+    return expiryMs - leewaySeconds * 1000 <= Date.now();
+}
 /**
  * Extract the Datalayer user object from a JWT, returning `null` if the
  * token is missing or cannot be decoded.

package/lib/utils/WithSuspense.d.ts

@@ -1,2 +1,2 @@
-export declare const WithSuspense: (Component: any, preload?: boolean, skeleton?: boolean) => (props: any) => import("react/jsx-runtime").JSX.Element;
+export declare const WithSuspense: (Component: any, preload?: boolean, skeleton?: boolean) => (props: any) => import("react").JSX.Element;
 export default WithSuspense;