@datalayer/core 1.1.60 → 1.2.10

package/lib/api/evals/types.js

@@ -0,0 +1,5 @@
+/*
+ * Copyright (c) 2023-2025 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+export {};

package/lib/api/iam/connectedAgents.d.ts

@@ -0,0 +1,68 @@
+/** A scope in the words of the consent screen. */
+export interface ConnectedAgentScope {
+    name: string;
+    title: string;
+    description: string;
+}
+/** How the client registered: by document URL, or the deprecated fallback. */
+export type ConnectedAgentRegistration = 'cimd' | 'dcr';
+export interface ConnectedAgent {
+    /** The grant's uid: what **Disconnect** names. */
+    uid: string;
+    clientId: string;
+    clientName: string;
+    /**
+     * The hostname of the client's document when it registered by URL — the
+     * part of a client's identity that cannot be invented, and what the
+     * consent screen showed. Empty for a DCR client.
+     */
+    clientHostname: string;
+    registration: ConnectedAgentRegistration;
+    scopes: string[];
+    scopeDetails: ConnectedAgentScope[];
+    /** The MCP resource the grant is for. */
+    resource: string;
+    createdAt?: string | null;
+    lastUsedAt?: string | null;
+}
+/**
+ * Whether a client id is a Client ID Metadata Document URL: `https`, a host
+ * and a path, no fragment. IAM answers `registration` itself; this is for a
+ * client id read from somewhere else, such as an audit row or a task.
+ */
+export declare const isCimdClientId: (clientId: string) => boolean;
+export declare const listConnectedAgents: (token: string, baseUrl?: string) => Promise<ConnectedAgent[]>;
+/** Revoke one grant. A grant that is not the caller's is a `404`, not a revocation. */
+export declare const disconnectAgent: (token: string, grantUid: string, baseUrl?: string) => Promise<{
+    success: boolean;
+    message?: string;
+}>;
+/**
+ * Disconnect every agent this person has connected — sign out everywhere.
+ *
+ * **This is also how a forced re-consent is done.** A grant *is* the consent,
+ * so ending them all sends the next authorization through the consent screen
+ * rather than letting it be answered from what was agreed before; there is no
+ * separate "ask again" flag to keep in step with this one.
+ *
+ * Always the caller's own. A person cannot end somebody else's sessions here
+ * — an organization taking back what it granted is deprovisioning, which runs
+ * when a membership ends.
+ */
+export declare const disconnectEveryAgent: (token: string, baseUrl?: string) => Promise<{
+    success: boolean;
+    revoked: number;
+    message?: string;
+}>;
+/**
+ * Disconnect every agent connected while acting for one team.
+ *
+ * For the people who may manage that team: ending a team's sessions is the
+ * same kind of authority as removing somebody from it. It never touches a
+ * personal agent or another team's — the same narrowness deprovisioning has.
+ */
+export declare const disconnectEveryAgentInTeam: (token: string, teamUid: string, baseUrl?: string) => Promise<{
+    success: boolean;
+    revoked: number;
+    message?: string;
+}>;

package/lib/api/iam/connectedAgents.js

@@ -0,0 +1,87 @@
+/*
+ * Copyright (c) 2023-2025 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/*
+ * Copyright (c) 2023-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * The agents a person has connected: the OAuth grants IAM holds for them,
+ * one per client, with the scopes approved and when each was last used.
+ *
+ * Disconnecting revokes the grant: the refresh token stops working at once,
+ * and an access token the agent still holds dies with its own expiry, which
+ * is why they are short.
+ *
+ * @module api/iam/connectedAgents
+ */
+import { requestDatalayerAPI } from '../DatalayerApi.js';
+import { API_BASE_PATHS, DEFAULT_SERVICE_URLS } from '../constants.js';
+const connectedAgentsUrl = (baseUrl, suffix = '') => `${baseUrl}${API_BASE_PATHS.IAM}/oauth/connected-agents${suffix}`;
+/**
+ * Whether a client id is a Client ID Metadata Document URL: `https`, a host
+ * and a path, no fragment. IAM answers `registration` itself; this is for a
+ * client id read from somewhere else, such as an audit row or a task.
+ */
+export const isCimdClientId = (clientId) => /^https:\/\/[^/?#]+\/[^#]*$/.test(clientId);
+export const listConnectedAgents = async (token, baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await requestDatalayerAPI({
+        url: connectedAgentsUrl(baseUrl),
+        method: 'GET',
+        token,
+    });
+    return (response.agents ?? []).map(agent => ({
+        uid: agent.uid,
+        clientId: agent.client_id ?? '',
+        clientName: agent.client_name ?? agent.client_id ?? '',
+        clientHostname: agent.client_hostname ?? '',
+        registration: agent.registration ?? 'dcr',
+        scopes: agent.scopes ?? [],
+        scopeDetails: agent.scope_details ?? [],
+        resource: agent.resource ?? '',
+        createdAt: agent.created_at ?? null,
+        lastUsedAt: agent.last_used_at ?? null,
+    }));
+};
+/** Revoke one grant. A grant that is not the caller's is a `404`, not a revocation. */
+export const disconnectAgent = async (token, grantUid, baseUrl = DEFAULT_SERVICE_URLS.IAM) => requestDatalayerAPI({
+    url: connectedAgentsUrl(baseUrl, `/${encodeURIComponent(grantUid)}`),
+    method: 'DELETE',
+    token,
+});
+/**
+ * Disconnect every agent this person has connected — sign out everywhere.
+ *
+ * **This is also how a forced re-consent is done.** A grant *is* the consent,
+ * so ending them all sends the next authorization through the consent screen
+ * rather than letting it be answered from what was agreed before; there is no
+ * separate "ask again" flag to keep in step with this one.
+ *
+ * Always the caller's own. A person cannot end somebody else's sessions here
+ * — an organization taking back what it granted is deprovisioning, which runs
+ * when a membership ends.
+ */
+export const disconnectEveryAgent = async (token, baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await requestDatalayerAPI({
+        url: connectedAgentsUrl(baseUrl),
+        method: 'DELETE',
+        token,
+    });
+    return { ...response, revoked: response.revoked ?? 0 };
+};
+/**
+ * Disconnect every agent connected while acting for one team.
+ *
+ * For the people who may manage that team: ending a team's sessions is the
+ * same kind of authority as removing somebody from it. It never touches a
+ * personal agent or another team's — the same narrowness deprovisioning has.
+ */
+export const disconnectEveryAgentInTeam = async (token, teamUid, baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await requestDatalayerAPI({
+        url: `${baseUrl}${API_BASE_PATHS.IAM}/oauth/teams/${encodeURIComponent(teamUid)}/connected-agents`,
+        method: 'DELETE',
+        token,
+    });
+    return { ...response, revoked: response.revoked ?? 0 };
+};

package/lib/api/iam/identityProviders.d.ts

@@ -0,0 +1,76 @@
+/** A role a group mapping may grant, at the organization or at a team. */
+export declare const ORGANIZATION_ROLES: readonly ["organization_owner", "organization_security_auditor", "organization_user_reviewer", "organization_member"];
+export declare const TEAM_ROLES: readonly ["team_owner", "team_member"];
+export type OrganizationRole = (typeof ORGANIZATION_ROLES)[number];
+export type TeamRole = (typeof TEAM_ROLES)[number];
+/** One `groups` claim mapped onto one role, at the organization or a team. */
+export interface RoleMapping {
+    /** The group, exactly as the token names it. */
+    group: string;
+    role: OrganizationRole | TeamRole;
+    /** Which team, when `role` is a team role; empty for an organization role. */
+    teamUid: string;
+}
+export interface IdentityProvider {
+    uid: string;
+    orgUid: string;
+    name: string;
+    protocol: 'oidc';
+    issuer: string;
+    clientId: string;
+    /** The *name* of a secret in this organization's store — never the secret. */
+    clientSecretRef: string;
+    /** Domains this provider claims. Claiming is free; see `verifiedDomains`. */
+    domains: string[];
+    /** The claimed domains proved by DNS. Only these route a sign-in. */
+    verifiedDomains: string[];
+    groupClaim: string;
+    /** Whether a sign-in may adopt a Datalayer account that already exists
+     * with the asserted address, rather than being refused. Off by default:
+     * see the module and provisioning notes for why. */
+    allowEmailLinking: boolean;
+    roleMappings: RoleMapping[];
+    enabled: boolean;
+    createdBy?: string;
+    createdAt?: string;
+    updatedAt?: string;
+    version?: number;
+}
+/**
+ * A provider as it is written. Everything but what the route already names
+ * and `verifiedDomains` — which is never sent, only ever read: it is set
+ * exclusively by `verifyDomain` checking DNS, and a draft that could set it
+ * directly would be a way to claim verification without proving anything.
+ */
+export type IdentityProviderDraft = Omit<IdentityProvider, 'uid' | 'orgUid' | 'verifiedDomains' | 'createdBy' | 'createdAt' | 'updatedAt' | 'version'>;
+export interface DomainVerification {
+    host: string;
+    type: 'TXT';
+    value: string;
+}
+/** Raised when the registry refused a provider as written — a bad issuer, an
+ * unowned domain, an unknown role in a mapping. The message is IAM's own. */
+export declare class IdentityProviderInvalid extends Error {
+    constructor(message: string);
+}
+export declare const listIdentityProviders: (token: string, orgUid: string, baseUrl?: string) => Promise<IdentityProvider[]>;
+export declare const getIdentityProvider: (token: string, orgUid: string, uid: string, baseUrl?: string) => Promise<IdentityProvider>;
+export declare const createIdentityProvider: (token: string, orgUid: string, provider: IdentityProviderDraft, baseUrl?: string) => Promise<IdentityProvider>;
+export declare const updateIdentityProvider: (token: string, orgUid: string, uid: string, provider: IdentityProviderDraft, baseUrl?: string) => Promise<IdentityProvider>;
+export declare const enableIdentityProvider: (token: string, orgUid: string, uid: string, baseUrl?: string) => Promise<IdentityProvider>;
+export declare const disableIdentityProvider: (token: string, orgUid: string, uid: string, baseUrl?: string) => Promise<IdentityProvider>;
+/** Remove a registration outright. Prefer disabling one that has been used:
+ * this keeps no trace for the sign-in rows that name it. */
+export declare const deleteIdentityProvider: (token: string, orgUid: string, uid: string, baseUrl?: string) => Promise<void>;
+/** What to publish in DNS to prove this organization holds `domain`. */
+export declare const getDomainVerification: (token: string, orgUid: string, uid: string, domain: string, baseUrl?: string) => Promise<{
+    verification: DomainVerification;
+    verified: boolean;
+}>;
+/**
+ * Check DNS now and, if the record is there, make the domain route sign-in.
+ *
+ * Until this succeeds the domain routes nothing at all, whatever was typed
+ * when the provider was registered.
+ */
+export declare const verifyDomain: (token: string, orgUid: string, uid: string, domain: string, baseUrl?: string) => Promise<IdentityProvider>;

package/lib/api/iam/identityProviders.js

@@ -0,0 +1,187 @@
+/*
+ * Copyright (c) 2023-2025 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/*
+ * Copyright (c) 2023-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * An organization's own identity provider.
+ *
+ * Enterprise sign-in used to be one Okta for the whole deployment. This is
+ * the registry that replaces it: an organization registers an OIDC provider
+ * — issuer, client id, the email domains it claims — and a sign-in is routed
+ * to it by domain.
+ *
+ * **A claim is not proof.** Registering a domain here does not route
+ * anything: only a domain proved by a DNS TXT record does, because a domain
+ * that only had to be typed would let one organization receive another's
+ * sign-ins. `getDomainVerification` reads what to publish; `verifyDomain`
+ * checks it and is the only call that turns a claim into a route.
+ *
+ * **The client secret never appears here.** The record names a secret in the
+ * organization's own secret store (`clientSecretRef`); this client never
+ * reads or writes a secret's value.
+ *
+ * @module api/iam/identityProviders
+ */
+import { requestDatalayerAPI } from '../DatalayerApi.js';
+import { API_BASE_PATHS, DEFAULT_SERVICE_URLS } from '../constants.js';
+/** A role a group mapping may grant, at the organization or at a team. */
+export const ORGANIZATION_ROLES = [
+    'organization_owner',
+    'organization_security_auditor',
+    'organization_user_reviewer',
+    'organization_member',
+];
+export const TEAM_ROLES = ['team_owner', 'team_member'];
+const roleMappingFromWire = (mapping) => ({
+    group: mapping.group ?? '',
+    role: mapping.role ?? 'organization_member',
+    teamUid: mapping.team_uid ?? '',
+});
+const roleMappingToWire = (mapping) => ({
+    group: mapping.group,
+    role: mapping.role,
+    team_uid: mapping.teamUid,
+});
+const fromWire = (provider) => ({
+    uid: provider.uid,
+    orgUid: provider.org_uid ?? '',
+    name: provider.name ?? '',
+    protocol: 'oidc',
+    issuer: provider.issuer ?? '',
+    clientId: provider.client_id ?? '',
+    clientSecretRef: provider.client_secret_ref ?? '',
+    domains: provider.domains ?? [],
+    verifiedDomains: provider.verified_domains ?? [],
+    groupClaim: provider.group_claim ?? 'groups',
+    allowEmailLinking: provider.allow_email_linking ?? false,
+    roleMappings: (provider.role_mappings ?? []).map(roleMappingFromWire),
+    enabled: provider.enabled ?? true,
+    createdBy: provider.created_by ?? undefined,
+    createdAt: provider.created_at ?? undefined,
+    updatedAt: provider.updated_at ?? undefined,
+    version: provider.version ?? undefined,
+});
+const toWire = (provider) => ({
+    name: provider.name,
+    protocol: provider.protocol,
+    issuer: provider.issuer,
+    client_id: provider.clientId,
+    client_secret_ref: provider.clientSecretRef,
+    domains: provider.domains,
+    group_claim: provider.groupClaim,
+    allow_email_linking: provider.allowEmailLinking,
+    role_mappings: provider.roleMappings.map(roleMappingToWire),
+    enabled: provider.enabled,
+});
+/** Raised when the registry refused a provider as written — a bad issuer, an
+ * unowned domain, an unknown role in a mapping. The message is IAM's own. */
+export class IdentityProviderInvalid extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'IdentityProviderInvalid';
+    }
+}
+const providersUrl = (baseUrl, orgUid, suffix = '') => `${baseUrl}${API_BASE_PATHS.IAM}/organizations/${encodeURIComponent(orgUid)}/identity-providers${suffix}`;
+export const listIdentityProviders = async (token, orgUid, baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await requestDatalayerAPI({
+        url: providersUrl(baseUrl, orgUid),
+        method: 'GET',
+        token,
+    });
+    return (response.providers ?? []).map(fromWire);
+};
+export const getIdentityProvider = async (token, orgUid, uid, baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await requestDatalayerAPI({
+        url: providersUrl(baseUrl, orgUid, `/${encodeURIComponent(uid)}`),
+        method: 'GET',
+        token,
+    });
+    return fromWire(response.provider ?? { uid });
+};
+export const createIdentityProvider = async (token, orgUid, provider, baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await withRefusal(() => requestDatalayerAPI({
+        url: providersUrl(baseUrl, orgUid),
+        method: 'POST',
+        token,
+        body: toWire(provider),
+    }));
+    return fromWire(response.provider ?? { uid: '' });
+};
+export const updateIdentityProvider = async (token, orgUid, uid, provider, baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await withRefusal(() => requestDatalayerAPI({
+        url: providersUrl(baseUrl, orgUid, `/${encodeURIComponent(uid)}`),
+        method: 'PUT',
+        token,
+        body: toWire(provider),
+    }));
+    return fromWire(response.provider ?? { uid });
+};
+const setEnabled = async (token, orgUid, uid, enabled, baseUrl) => {
+    const response = await requestDatalayerAPI({
+        url: providersUrl(baseUrl, orgUid, `/${encodeURIComponent(uid)}/${enabled ? 'enable' : 'disable'}`),
+        method: 'POST',
+        token,
+    });
+    return fromWire(response.provider ?? { uid });
+};
+export const enableIdentityProvider = (token, orgUid, uid, baseUrl = DEFAULT_SERVICE_URLS.IAM) => setEnabled(token, orgUid, uid, true, baseUrl);
+export const disableIdentityProvider = (token, orgUid, uid, baseUrl = DEFAULT_SERVICE_URLS.IAM) => setEnabled(token, orgUid, uid, false, baseUrl);
+/** Remove a registration outright. Prefer disabling one that has been used:
+ * this keeps no trace for the sign-in rows that name it. */
+export const deleteIdentityProvider = async (token, orgUid, uid, baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    await requestDatalayerAPI({
+        url: providersUrl(baseUrl, orgUid, `/${encodeURIComponent(uid)}`),
+        method: 'DELETE',
+        token,
+    });
+};
+/** What to publish in DNS to prove this organization holds `domain`. */
+export const getDomainVerification = async (token, orgUid, uid, domain, baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await requestDatalayerAPI({
+        url: providersUrl(baseUrl, orgUid, `/${encodeURIComponent(uid)}/domains/${encodeURIComponent(domain)}/verification`),
+        method: 'GET',
+        token,
+    });
+    return {
+        verification: response.verification ?? { host: '', type: 'TXT', value: '' },
+        verified: response.verified ?? false,
+    };
+};
+/**
+ * Check DNS now and, if the record is there, make the domain route sign-in.
+ *
+ * Until this succeeds the domain routes nothing at all, whatever was typed
+ * when the provider was registered.
+ */
+export const verifyDomain = async (token, orgUid, uid, domain, baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await withRefusal(() => requestDatalayerAPI({
+        url: providersUrl(baseUrl, orgUid, `/${encodeURIComponent(uid)}/domains/${encodeURIComponent(domain)}/verify`),
+        method: 'POST',
+        token,
+    }));
+    return fromWire(response.provider ?? { uid });
+};
+/**
+ * Turn IAM's `400` into one the form can show beside the field.
+ *
+ * A `400` here is never a bug in the client: it is the registry saying it
+ * refused what was written, and its message names why — an `http` issuer, a
+ * domain somebody else already verified, an unknown role in a mapping.
+ */
+const withRefusal = async (call) => {
+    try {
+        return await call();
+    }
+    catch (error) {
+        const candidate = error;
+        const status = candidate?.status ?? candidate?.response?.status;
+        if (status === 400) {
+            throw new IdentityProviderInvalid(candidate.message || 'This identity provider was refused.');
+        }
+        throw error;
+    }
+};

package/lib/api/iam/index.d.ts

@@ -11,9 +11,11 @@ export * as profile from './profile';
 export * as healthz from './healthz';
 export * as usage from './usage';
 export * as secrets from './secrets';
-export * as datasources from './datasources';
+export * as connectedAgents from './connectedAgents';
+export * as trials from './trials';
 export { login, logout, checkAuth } from './authentication';
 export { getOAuth2AuthzUrl, getOAuth2AuthzUrlForLink, handleGitHubOAuth2Callback, handleLinkedInOAuth2Callback, handleOktaOAuth2Callback, type OAuth2Provider, type OAuth2AuthzUrlResponse, type OAuth2CallbackParams, type OAuth2CallbackResponse, } from './oauth2';
 export { me, whoami } from './profile';
 export { ping } from './healthz';
 export { getCredits } from './usage';
+export { listConnectedAgents, disconnectAgent, isCimdClientId, type ConnectedAgent, type ConnectedAgentRegistration, type ConnectedAgentScope, } from './connectedAgents';

package/lib/api/iam/index.js

@@ -15,10 +15,12 @@ export * as profile from './profile.js';
 export * as healthz from './healthz.js';
 export * as usage from './usage.js';
 export * as secrets from './secrets.js';
-export * as datasources from './datasources.js';
+export * as connectedAgents from './connectedAgents.js';
+export * as trials from './trials.js';
 // For backward compatibility, export the old API structure
 export { login, logout, checkAuth } from './authentication.js';
 export { getOAuth2AuthzUrl, getOAuth2AuthzUrlForLink, handleGitHubOAuth2Callback, handleLinkedInOAuth2Callback, handleOktaOAuth2Callback, } from './oauth2.js';
 export { me, whoami } from './profile.js';
 export { ping } from './healthz.js';
 export { getCredits } from './usage.js';
+export { listConnectedAgents, disconnectAgent, isCimdClientId, } from './connectedAgents.js';

package/lib/api/iam/mcpAlertRules.d.ts

@@ -0,0 +1,51 @@
+/**
+ * What a rule may be about.
+ *
+ * Each name is answered by one reader in the gateway. `measurable` says
+ * whether a reader exists *today*: a condition with none is counted
+ * unreadable and never fires, which is exactly the silence rules are written
+ * to avoid — so a form shows it as not yet available rather than offering it
+ * as though it worked.
+ */
+export declare const ALERT_CONDITIONS: {
+    name: string;
+    label: string;
+    help: string;
+    measurable: boolean;
+}[];
+/** How a reading is compared with the threshold. */
+export declare const ALERT_OPERATORS: {
+    name: string;
+    label: string;
+}[];
+export declare const ALERT_SEVERITIES: readonly ["info", "warning", "critical"];
+/** What a rule is measured over. */
+export declare const ALERT_SCOPE_KINDS: readonly ["organization", "team", "user", "agent"];
+export type AlertSeverity = (typeof ALERT_SEVERITIES)[number];
+export type AlertScopeKind = (typeof ALERT_SCOPE_KINDS)[number];
+export interface McpAlertRule {
+    uid: string;
+    orgUid: string;
+    condition: string;
+    operator: string;
+    threshold: number;
+    severity: AlertSeverity;
+    /** How far back a reading looks. Whole seconds — the tick is a minute. */
+    windowSeconds: number;
+    scopeKind: AlertScopeKind;
+    /** The team, user or agent the rule is about; empty for the organization. */
+    scopeUid: string;
+    enabled: boolean;
+    version?: number;
+}
+/** A rule as it is written. `uid` and `orgUid` come from the route. */
+export type McpAlertRuleDraft = Omit<McpAlertRule, 'uid' | 'orgUid' | 'version'>;
+/** Raised when the evaluator could not evaluate the rule as written. */
+export declare class AlertRuleInvalid extends Error {
+    constructor(message: string);
+}
+export declare const listAlertRules: (token: string, orgUid: string, baseUrl?: string) => Promise<McpAlertRule[]>;
+export declare const createAlertRule: (token: string, orgUid: string, rule: McpAlertRuleDraft, baseUrl?: string) => Promise<McpAlertRule>;
+export declare const updateAlertRule: (token: string, orgUid: string, uid: string, rule: McpAlertRuleDraft, baseUrl?: string) => Promise<McpAlertRule>;
+/** Remove one rule. What it watched is unwatched from the next tick. */
+export declare const deleteAlertRule: (token: string, orgUid: string, uid: string, baseUrl?: string) => Promise<void>;