@datalayer/core 1.1.66 → 1.2.10

package/lib/api/iam/scimTokens.d.ts

@@ -0,0 +1,79 @@
+/** A SCIM credential as the console may see it — never the secret or its hash. */
+export interface ScimToken {
+    uid: string;
+    orgUid: string;
+    /** What an administrator called it, to tell two directories apart. */
+    name: string;
+    /**
+     * Revoked rather than deleted, so the rows a provisioning run wrote can
+     * still name the token that wrote them.
+     */
+    revoked: boolean;
+    /**
+     * When the secret was last replaced. A token that has never been rotated
+     * carries its creation moment here.
+     */
+    rotatedAt?: string;
+    /**
+     * When it last authenticated a SCIM call, or empty for never. Written best
+     * effort — a provisioning call is never failed for the bookkeeping.
+     */
+    lastUsedAt?: string;
+    createdBy?: string;
+    createdAt?: string;
+    updatedAt?: string;
+}
+/**
+ * A freshly minted credential: the record, and the secret **this once**.
+ *
+ * The two are separate fields rather than one merged object on purpose. The
+ * secret does not belong in anything the console stores, renders twice, or
+ * puts in a list, and a shape that carried it alongside every other field
+ * invites exactly that.
+ */
+export interface MintedScimToken {
+    token: ScimToken;
+    /** Shown once. Not retrievable, by construction — only a hash is stored. */
+    secret: string;
+}
+export declare const listScimTokens: (token: string, orgUid: string, baseUrl?: string) => Promise<ScimToken[]>;
+/**
+ * Mint one. The secret is in this answer and nowhere else, ever again.
+ *
+ * The caller must put it in front of somebody before the next render. There
+ * is no second chance and no call that would provide one.
+ */
+export declare const createScimToken: (token: string, orgUid: string, name: string, baseUrl?: string) => Promise<MintedScimToken>;
+/**
+ * A new secret for the same record; the old one stops at once.
+ *
+ * Rotation rather than delete-and-recreate because the record's uid is what
+ * the provisioning rows name. Replacing it would leave them pointing at
+ * nothing.
+ */
+export declare const rotateScimToken: (token: string, orgUid: string, uid: string, baseUrl?: string) => Promise<MintedScimToken>;
+/** Stop a token, keeping the rows that name it readable. */
+export declare const revokeScimToken: (token: string, orgUid: string, uid: string, baseUrl?: string) => Promise<ScimToken>;
+/**
+ * The base URL a directory is configured with.
+ *
+ * Built here rather than typed into the page, because it is half of what an
+ * administrator copies into Okta or Entra and a typo in it looks like an
+ * outage on the directory's side. The directory appends `/Users` itself;
+ * RFC 7644 fixes everything after this.
+ */
+export declare const scimBaseUrl: (baseUrl?: string) => string;
+/**
+ * Whether this organization can actually be provisioned into right now.
+ *
+ * A list with tokens in it is not the same as a working integration, and the
+ * distinction is the one an administrator most needs: every token revoked
+ * reads, in a table, almost exactly like a healthy setup. `neverUsed` is the
+ * other quiet state — configured, live, and never once called, which is what
+ * a directory that was set up and never switched on looks like.
+ */
+export declare const scimStatus: (tokens: ScimToken[]) => {
+    state: "none" | "revoked" | "never-used" | "active";
+    live: ScimToken[];
+    lastUsedAt?: string;
+};

package/lib/api/iam/scimTokens.js

@@ -0,0 +1,141 @@
+/*
+ * Copyright (c) 2023-2025 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/*
+ * Copyright (c) 2023-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * The credentials an organization's directory provisions with, over SCIM.
+ *
+ * The identity provider registry beside this one made a directory able to
+ * *sign somebody in*. SCIM is the half that does not wait for them to turn
+ * up: the directory says who exists when they join and, far more
+ * importantly, who has left.
+ *
+ * **The token is the tenant.** Every SCIM call resolves its organization
+ * from the bearer credential before it looks at anything else, so these
+ * records are not a convenience — each one *is* an organization's provisioning
+ * authority, and there is nothing else identifying the caller.
+ *
+ * **The secret is answered once and never again.** `createScimToken` and
+ * `rotateScimToken` return it; nothing reads it back, because only a SHA-256
+ * of it is stored. A console that offered to show it later would be
+ * promising something the server cannot do — so this client has no call that
+ * could, and the UI has to say "copy it now" and mean it.
+ *
+ * `lastUsedAt` is the column worth reading. A directory configured once and
+ * forgotten looks exactly like a live one in every other field, and the
+ * difference matters most for deprovisioning: the integration that has not
+ * called in a month is not removing anybody.
+ *
+ * @module api/iam/scimTokens
+ */
+import { requestDatalayerAPI } from '../DatalayerApi.js';
+import { API_BASE_PATHS, DEFAULT_SERVICE_URLS } from '../constants.js';
+const fromWire = (wire) => ({
+    uid: wire.uid ?? '',
+    orgUid: wire.org_uid ?? '',
+    name: wire.name ?? '',
+    // A record with no `revoked` field is a live one: absence is not
+    // revocation, and reading it as one would show every token as stopped.
+    revoked: wire.revoked === true,
+    rotatedAt: wire.rotated_at || undefined,
+    lastUsedAt: wire.last_used_at || undefined,
+    createdBy: wire.created_by || undefined,
+    createdAt: wire.created_at || undefined,
+    updatedAt: wire.updated_at || undefined,
+});
+const tokensUrl = (baseUrl, orgUid, suffix = '') => `${baseUrl}${API_BASE_PATHS.IAM}/organizations/${encodeURIComponent(orgUid)}` +
+    `/scim-tokens${suffix}`;
+export const listScimTokens = async (token, orgUid, baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await requestDatalayerAPI({
+        url: tokensUrl(baseUrl, orgUid),
+        method: 'GET',
+        token,
+    });
+    return (response.tokens ?? []).map(fromWire);
+};
+/**
+ * Mint one. The secret is in this answer and nowhere else, ever again.
+ *
+ * The caller must put it in front of somebody before the next render. There
+ * is no second chance and no call that would provide one.
+ */
+export const createScimToken = async (token, orgUid, name, baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await requestDatalayerAPI({
+        url: tokensUrl(baseUrl, orgUid),
+        method: 'POST',
+        token,
+        body: { name },
+    });
+    return {
+        token: fromWire(response.token ?? {}),
+        secret: response.token?.token ?? '',
+    };
+};
+/**
+ * A new secret for the same record; the old one stops at once.
+ *
+ * Rotation rather than delete-and-recreate because the record's uid is what
+ * the provisioning rows name. Replacing it would leave them pointing at
+ * nothing.
+ */
+export const rotateScimToken = async (token, orgUid, uid, baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await requestDatalayerAPI({
+        url: tokensUrl(baseUrl, orgUid, `/${encodeURIComponent(uid)}/rotate`),
+        method: 'POST',
+        token,
+    });
+    return {
+        token: fromWire(response.token ?? {}),
+        secret: response.token?.token ?? '',
+    };
+};
+/** Stop a token, keeping the rows that name it readable. */
+export const revokeScimToken = async (token, orgUid, uid, baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await requestDatalayerAPI({
+        url: tokensUrl(baseUrl, orgUid, `/${encodeURIComponent(uid)}`),
+        method: 'DELETE',
+        token,
+    });
+    return fromWire(response.token ?? {});
+};
+/**
+ * The base URL a directory is configured with.
+ *
+ * Built here rather than typed into the page, because it is half of what an
+ * administrator copies into Okta or Entra and a typo in it looks like an
+ * outage on the directory's side. The directory appends `/Users` itself;
+ * RFC 7644 fixes everything after this.
+ */
+export const scimBaseUrl = (baseUrl = DEFAULT_SERVICE_URLS.IAM) => `${baseUrl}/api/iam/scim/v2`;
+/**
+ * Whether this organization can actually be provisioned into right now.
+ *
+ * A list with tokens in it is not the same as a working integration, and the
+ * distinction is the one an administrator most needs: every token revoked
+ * reads, in a table, almost exactly like a healthy setup. `neverUsed` is the
+ * other quiet state — configured, live, and never once called, which is what
+ * a directory that was set up and never switched on looks like.
+ */
+export const scimStatus = (tokens) => {
+    const live = tokens.filter(entry => !entry.revoked);
+    if (tokens.length === 0) {
+        return { state: 'none', live };
+    }
+    if (live.length === 0) {
+        return { state: 'revoked', live };
+    }
+    const used = live
+        .map(entry => entry.lastUsedAt)
+        .filter((value) => Boolean(value))
+        .sort();
+    const lastUsedAt = used.length > 0 ? used[used.length - 1] : undefined;
+    return {
+        state: lastUsedAt ? 'active' : 'never-used',
+        live,
+        lastUsedAt,
+    };
+};

package/lib/api/iam/secrets.js

@@ -9,21 +9,6 @@
 import { requestDatalayerAPI } from '../DatalayerApi.js';
 import { API_BASE_PATHS, DEFAULT_SERVICE_URLS } from '../constants.js';
 import { validateToken, validateRequiredString } from '../utils/validation.js';
-/**
- * Helper function to Base64 encode a value (cross-platform).
- * @param value - Plain text value to encode
- * @returns Base64 encoded string
- */
-function encodeValue(value) {
-    if (typeof Buffer !== 'undefined') {
-        // Node.js environment
-        return Buffer.from(value).toString('base64');
-    }
-    else {
-        // Browser environment
-        return btoa(value);
-    }
-}
 /**
  * Create a new secret.
  * Creates a new encrypted secret for the authenticated user.
@@ -52,7 +37,10 @@ export const createSecret = async (token, data, baseUrl = DEFAULT_SERVICE_URLS.I
         variant: data.variant || 'generic',
         name: data.name,
         description: data.description || '',
-        value: encodeValue(data.value),
+        // As it is. A secret has one representation end to end (PLAN_ENVS.md
+        // E3-05): this used to base64-encode, and nothing on the read side undid
+        // it, so a build secret arrived at its build encoded and opened nothing.
+        value: data.value,
     };
     try {
         return await requestDatalayerAPI({
@@ -64,7 +52,7 @@ export const createSecret = async (token, data, baseUrl = DEFAULT_SERVICE_URLS.I
     }
     catch (error) {
         if (error.response?.status === 409) {
-            throw new Error(`Secret with name '${data.name}' already exists. Please use a different name.`);
+            throw new Error(`Secret with name '${data.name}' already exists. Please use a different name.`, { cause: error });
         }
         throw error;
     }
@@ -118,7 +106,7 @@ export const getSecret = async (token, secretId, baseUrl = DEFAULT_SERVICE_URLS.
     }
     catch (error) {
         if (error.response?.status === 404) {
-            throw new Error(`Secret '${secretId}' not found.`);
+            throw new Error(`Secret '${secretId}' not found.`, { cause: error });
         }
         throw error;
     }
@@ -147,7 +135,7 @@ export const updateSecret = async (token, secretId, data, baseUrl = DEFAULT_SERV
     // Base64 encode value if provided
     const requestBody = { ...data };
     if (data.value) {
-        requestBody.value = encodeValue(data.value);
+        requestBody.value = data.value;
     }
     try {
         return await requestDatalayerAPI({
@@ -159,7 +147,7 @@ export const updateSecret = async (token, secretId, data, baseUrl = DEFAULT_SERV
     }
     catch (error) {
         if (error.response?.status === 404) {
-            throw new Error(`Secret '${secretId}' not found.`);
+            throw new Error(`Secret '${secretId}' not found.`, { cause: error });
         }
         throw error;
     }
@@ -189,7 +177,7 @@ export const deleteSecret = async (token, secretId, baseUrl = DEFAULT_SERVICE_UR
     }
     catch (error) {
         if (error.response?.status === 404) {
-            throw new Error(`Secret '${secretId}' not found.`);
+            throw new Error(`Secret '${secretId}' not found.`, { cause: error });
         }
         throw error;
     }

package/lib/api/iam/trials.d.ts

@@ -0,0 +1,38 @@
+/** Where a claim carries the trial's own key. */
+export declare const TRIAL_TOKEN_HEADER = "X-Datalayer-Trial-Token";
+/** What a visitor may try here, if anything. */
+export interface TrialOffer {
+    offered: boolean;
+    /** The one benchmark a trial may run. */
+    evalsetId: string;
+    /** The credits it may spend. */
+    credits: number;
+    /** How long it lives, in seconds. */
+    ttlSeconds: number;
+}
+export interface Trial {
+    id: string;
+    /** The uid the trial's work is owned by, which is the trial's own. */
+    ownerUid: string;
+    state: 'open' | 'claimed' | 'expired';
+    evalsetId: string;
+    creditsLimit: number | null;
+    creditsSpent: number;
+    expiresAt: string | null;
+    claimedByUid: string;
+    claimedAt: string | null;
+}
+/** A trial and the key that acts as it. The key is answered once. */
+export interface IssuedTrial {
+    trial: Trial;
+    token: string;
+}
+/**
+ * Whether this deployment lets a visitor try a benchmark, and which one.
+ * Unauthenticated: it is what a public page asks before it offers the run.
+ */
+export declare const getTrialOffer: (baseUrl?: string) => Promise<TrialOffer>;
+/** Take a trial. Unauthenticated, rate limited, and refused where none are offered. */
+export declare const createTrial: (baseUrl?: string) => Promise<IssuedTrial>;
+/** The trial a key acts as: what it has left, and how long it has. */
+export declare const getCurrentTrial: (trialToken: string, baseUrl?: string) => Promise<Trial>;

package/lib/api/iam/trials.js

@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2023-2025 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/*
+ * Copyright (c) 2023-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * The anonymous trial: running the public benchmark before signing up
+ * (BENCHMARK.md, B2-14).
+ *
+ * A visitor with no account asks for a trial and gets a principal of its
+ * own with one benchmark it may run, a few credits and a short expiry. The
+ * work they make is owned by that principal, so when they sign up it is
+ * given to them rather than lost — `claimTrial` in the evals client moves
+ * it, and the trial's own key has to be presented alongside their new one.
+ *
+ * A deployment that has not named a public benchmark offers no trials, and
+ * `getTrialOffer` says so: a page asks before it shows the button.
+ *
+ * @module api/iam/trials
+ */
+import { requestDatalayerAPI } from '../DatalayerApi.js';
+import { API_BASE_PATHS, DEFAULT_SERVICE_URLS } from '../constants.js';
+/** Where a claim carries the trial's own key. */
+export const TRIAL_TOKEN_HEADER = 'X-Datalayer-Trial-Token';
+const trialsUrl = (baseUrl, suffix = '') => `${baseUrl}${API_BASE_PATHS.IAM}/trials${suffix}`;
+const asTrial = (wire) => ({
+    id: wire.id,
+    ownerUid: wire.owner_uid ?? wire.id,
+    state: wire.state ?? 'open',
+    evalsetId: wire.evalset_id ?? '',
+    creditsLimit: wire.credits_limit ?? null,
+    creditsSpent: wire.credits_spent ?? 0,
+    expiresAt: wire.expires_at ?? null,
+    claimedByUid: wire.claimed_by_uid ?? '',
+    claimedAt: wire.claimed_at ?? null,
+});
+/**
+ * Whether this deployment lets a visitor try a benchmark, and which one.
+ * Unauthenticated: it is what a public page asks before it offers the run.
+ */
+export const getTrialOffer = async (baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await requestDatalayerAPI({ url: trialsUrl(baseUrl, '/offer'), method: 'GET' });
+    return {
+        offered: !!response.offered,
+        evalsetId: response.evalset_id ?? '',
+        credits: response.credits ?? 0,
+        ttlSeconds: response.ttl_seconds ?? 0,
+    };
+};
+/** Take a trial. Unauthenticated, rate limited, and refused where none are offered. */
+export const createTrial = async (baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await requestDatalayerAPI({ url: trialsUrl(baseUrl), method: 'POST' });
+    return { trial: asTrial(response.trial), token: response.token };
+};
+/** The trial a key acts as: what it has left, and how long it has. */
+export const getCurrentTrial = async (trialToken, baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await requestDatalayerAPI({
+        url: trialsUrl(baseUrl, '/me'),
+        method: 'GET',
+        token: trialToken,
+    });
+    return asTrial(response.trial);
+};

package/lib/api/index.d.ts

@@ -11,6 +11,10 @@ export type { IRequestDatalayerAPIOptions } from './DatalayerApi';
 export type { IDatalayerAPIResponse } from './DatalayerApi';
 export * as iam from './iam';
 export * as contents from './contents';
+export * as evals from './evals';
 export * as mcp from './mcp';
+export * as orchestration from './orchestration';
 export * as otel from './otel';
+export * as scheduler from './scheduler';
+export * as spacer from './spacer';
 export * from '../api/DatalayerApi';

package/lib/api/index.js

@@ -15,6 +15,10 @@ export { requestDatalayerAPI, requestDatalayerAPIWithResponse, RunResponseError,
 // Domain-organized API exports
 export * as iam from './iam/index.js';
 export * as contents from './contents/index.js';
+export * as evals from './evals/index.js';
 export * as mcp from './mcp/index.js';
+export * as orchestration from './orchestration/index.js';
 export * as otel from './otel/index.js';
+export * as scheduler from './scheduler/index.js';
+export * as spacer from './spacer/index.js';
 export * from '../api/DatalayerApi.js';

package/lib/api/mcp/observability.d.ts

@@ -1,4 +1,5 @@
-import type { OtelLog, OtelMetric, OtelSpan } from '../otel/types';
+import { type DashboardData } from '../otel/dashboards';
+import type { OtelLog, OtelSpan } from '../otel/types';
 import type { McpTask } from '../../models/McpTask';
 /**
  * The `service.name` the gateway exports under, and the one its workers use.
@@ -40,11 +41,25 @@ export declare const MCP_SLI_METRICS: {
     readonly taskSuccess: "mcp.tasks";
     readonly sandboxLaunch: "sandbox.launch_seconds";
 };
+/** The OTEL service's built-in dashboard the four SLIs are read from. */
+export declare const MCP_SERVICE_LEVELS_DASHBOARD = "mcp-service-levels";
+/**
+ * Its panels, by the ids the OTEL service gives them. A contract test there
+ * holds them, so a panel renamed on the service fails a test rather than
+ * reading here as nothing measured.
+ */
+export declare const MCP_SERVICE_LEVEL_PANELS: {
+    readonly callsByOutcome: "mcp-calls-by-outcome";
+    readonly callDurationP95: "mcp-call-duration-p95";
+    readonly tasksByStatus: "mcp-tasks-by-status";
+    readonly sandboxLaunchP95: "sandbox-launch_seconds-by-provider-p95";
+    readonly sandboxLaunches: "sandbox-launch_seconds-by-provider-count";
+};
 export interface McpMetricsFilters {
     /** The `client_id` of one agent: read from spans, not from metrics. */
     agent?: string;
     org?: string;
-    /** ISO 8601; points and spans before it are left out. */
+    /** ISO 8601; the reading starts there. */
     since?: string;
     limit?: number;
 }
@@ -66,8 +81,8 @@ export interface McpSliSummary {
 }
 export interface McpMetricsSnapshot {
     filters: McpMetricsFilters;
-    /** The catalog points read, by metric name. */
-    metrics: Partial<Record<McpMetricName, OtelMetric[]>>;
+    /** The catalog metrics the OTEL service holds points of, in catalog order. */
+    reporting: McpMetricName[];
     /** The `mcp.request` spans a per-agent or per-organization reading rests on. */
     spans: OtelSpan[];
     slis: McpSliSummary;
@@ -76,13 +91,14 @@ export interface McpMetricsSnapshot {
 /** The nearest-rank percentile of a sample; `null` for an empty one. */
 export declare const percentile: (values: number[], fraction: number) => number | null;
 /**
- * The SLIs over catalog points — the platform-wide reading.
+ * The SLIs from the service levels dashboard — the platform-wide reading.
  *
- * `mcp.calls{outcome}` gives availability, `mcp.call.duration{tool}` the
- * latency, `mcp.tasks{status}` the task success rate and
- * `sandbox.launch_seconds{provider}` the launches.
+ * Its panels arrive summarised: calls and tasks as how much each counter grew
+ * over the window, the two p95s from their histograms' buckets. The call
+ * duration is recorded in seconds and shown in milliseconds. A panel with
+ * nothing in it reads as not measured, never as a zero.
  */
-export declare const summarizeMetricPoints: (metrics: Partial<Record<McpMetricName, OtelMetric[]>>, filters?: McpMetricsFilters) => McpSliSummary;
+export declare const summarizeServiceLevels: (data: DashboardData) => McpSliSummary;
 /**
  * The SLIs over `mcp.request` spans — the per-agent or per-organization
  * reading, since metrics carry neither label.

package/lib/api/mcp/observability.js

@@ -13,17 +13,21 @@
  * Audit answers *who did what, and was it allowed*; this answers *how did
  * it run*. A task carries its `trace_id`, so "show me this run" is the
  * task's spans; its logs are the log records of that trace; and the four
- * SLIs are read from the gateway's metric catalog. Metrics carry no user,
- * agent or organization label by design, so a per-agent reading is
- * computed from the `mcp.request` spans, which do carry `client.id` and
- * `org.uid`.
+ * SLIs are read from the OTEL service's service levels dashboard, which
+ * computes them from the metrics as they were exported — a counter's
+ * increase, a percentile from a histogram's buckets. Nothing here adds
+ * metric points up: the gateway reports running totals, and adding those
+ * counts every earlier report again. Metrics carry no user, agent or
+ * organization label by design, so a per-agent reading is computed from the
+ * `mcp.request` spans, which do carry `client.id` and `org.uid`.
  *
  * @module api/mcp/observability
  */
 import { DEFAULT_SERVICE_URLS } from '../constants.js';
 import { getTrace, listTraces } from '../otel/traces.js';
-import { queryMetrics } from '../otel/metrics.js';
+import { listMetricNames } from '../otel/metrics.js';
 import { queryLogs } from '../otel/logs.js';
+import { getDashboardData } from '../otel/dashboards.js';
 /**
  * The `service.name` the gateway exports under, and the one its workers use.
  *
@@ -94,6 +98,21 @@ export const MCP_SLI_METRICS = {
     taskSuccess: 'mcp.tasks',
     sandboxLaunch: 'sandbox.launch_seconds',
 };
+/** The OTEL service's built-in dashboard the four SLIs are read from. */
+export const MCP_SERVICE_LEVELS_DASHBOARD = 'mcp-service-levels';
+/**
+ * Its panels, by the ids the OTEL service gives them. A contract test there
+ * holds them, so a panel renamed on the service fails a test rather than
+ * reading here as nothing measured.
+ */
+export const MCP_SERVICE_LEVEL_PANELS = {
+    callsByOutcome: 'mcp-calls-by-outcome',
+    callDurationP95: 'mcp-call-duration-p95',
+    tasksByStatus: 'mcp-tasks-by-status',
+    sandboxLaunchP95: 'sandbox-launch_seconds-by-provider-p95',
+    sandboxLaunches: 'sandbox-launch_seconds-by-provider-count',
+};
+const TERMINAL_STATUSES = ['completed', 'failed', 'cancelled'];
 /** The nearest-rank percentile of a sample; `null` for an empty one. */
 export const percentile = (values, fraction) => {
     if (values.length === 0) {
@@ -112,45 +131,39 @@ const isUnavailable = (span) => {
     return status.startsWith('5') || rpc === '-32001';
 };
 /**
- * The SLIs over catalog points — the platform-wide reading.
+ * The SLIs from the service levels dashboard — the platform-wide reading.
  *
- * `mcp.calls{outcome}` gives availability, `mcp.call.duration{tool}` the
- * latency, `mcp.tasks{status}` the task success rate and
- * `sandbox.launch_seconds{provider}` the launches.
+ * Its panels arrive summarised: calls and tasks as how much each counter grew
+ * over the window, the two p95s from their histograms' buckets. The call
+ * duration is recorded in seconds and shown in milliseconds. A panel with
+ * nothing in it reads as not measured, never as a zero.
  */
-export const summarizeMetricPoints = (metrics, filters = {}) => {
-    const within = (point) => notBefore(point.timestamp, filters.since);
-    const calls = (metrics['mcp.calls'] ?? []).filter(within);
-    const totalCalls = calls.reduce((sum, point) => sum + point.value, 0);
-    const failedCalls = calls
-        .filter(point => ['error', 'unavailable'].includes(attribute(point, 'outcome')))
-        .reduce((sum, point) => sum + point.value, 0);
-    const durations = (metrics['mcp.call.duration'] ?? []).filter(within).map(point => point.value);
-    const tasks = (metrics['mcp.tasks'] ?? []).filter(within);
-    const terminal = tasks.filter(point => ['completed', 'failed', 'cancelled'].includes(attribute(point, 'status')));
-    const totalTerminal = terminal.reduce((sum, point) => sum + point.value, 0);
-    const completed = terminal
-        .filter(point => attribute(point, 'status') === 'completed')
-        .reduce((sum, point) => sum + point.value, 0);
-    const launches = (metrics['sandbox.launch_seconds'] ?? []).filter(within);
-    const byProvider = new Map();
-    for (const point of launches) {
-        const provider = attribute(point, 'provider') || 'unknown';
-        byProvider.set(provider, [...(byProvider.get(provider) ?? []), point.value]);
-    }
-    const p95SandboxLaunchSeconds = {};
-    for (const [provider, values] of byProvider) {
-        const p95 = percentile(values, 0.95);
-        if (p95 !== null) {
-            p95SandboxLaunchSeconds[provider] = p95;
-        }
-    }
+export const summarizeServiceLevels = (data) => {
+    const panels = new Map(data.panels.map(panel => [panel.id, panel]));
+    const byLabel = (id) => Object.fromEntries((panels.get(id)?.series ?? [])
+        .filter(entry => entry.summary !== null)
+        .map(entry => [entry.label, entry.summary]));
+    const total = (values) => Object.values(values).reduce((sum, value) => sum + value, 0);
+    const calls = byLabel(MCP_SERVICE_LEVEL_PANELS.callsByOutcome);
+    const totalCalls = total(calls);
+    const failedCalls = (calls.error ?? 0) + (calls.unavailable ?? 0);
+    const tasks = byLabel(MCP_SERVICE_LEVEL_PANELS.tasksByStatus);
+    const terminal = TERMINAL_STATUSES.reduce((sum, status) => sum + (tasks[status] ?? 0), 0);
+    const p95Seconds = byLabel(MCP_SERVICE_LEVEL_PANELS.callDurationP95)[''];
+    const p95SandboxLaunchSeconds = Object.fromEntries(Object.entries(byLabel(MCP_SERVICE_LEVEL_PANELS.sandboxLaunchP95)).map(([provider, seconds]) => [
+        provider || 'unknown',
+        seconds,
+    ]));
     return {
         availability: totalCalls > 0 ? (totalCalls - failedCalls) / totalCalls : null,
-        p95CallDurationMs: percentile(durations, 0.95),
-        taskSuccessRate: totalTerminal > 0 ? completed / totalTerminal : null,
+        p95CallDurationMs: p95Seconds === undefined ? null : p95Seconds * 1000,
+        taskSuccessRate: terminal > 0 ? (tasks.completed ?? 0) / terminal : null,
         p95SandboxLaunchSeconds,
-        samples: { calls: totalCalls, tasks: totalTerminal, launches: launches.length },
+        samples: {
+            calls: totalCalls,
+            tasks: terminal,
+            launches: total(byLabel(MCP_SERVICE_LEVEL_PANELS.sandboxLaunches)),
+        },
     };
 };
 /**
@@ -183,21 +196,21 @@ export const summarizeRequestSpans = (spans, filters = {}) => {
 /** The four SLIs and the catalog, for everyone or for one agent or organization. */
 export const fetchMcpMetrics = async (token, filters = {}, otelUrl = DEFAULT_SERVICE_URLS.OTEL) => {
     const limit = filters.limit ?? 500;
-    const names = Object.values(MCP_SLI_METRICS);
-    const pages = await Promise.all(names.map(name => queryMetrics(token, { metricName: name, serviceName: serviceNameFor(name), limit }, otelUrl)));
-    const metrics = {};
-    names.forEach((name, index) => {
-        metrics[name] = pages[index].data ?? [];
-    });
     const scoped = Boolean(filters.agent || filters.org);
-    const spans = scoped
-        ? (await listTraces(token, { serviceName: MCP_GATEWAY_SERVICE_NAME, limit }, otelUrl)).data ?? []
-        : [];
+    const [levels, names, traces] = await Promise.all([
+        scoped
+            ? undefined
+            : getDashboardData(token, MCP_SERVICE_LEVELS_DASHBOARD, { since: filters.since ? new Date(filters.since) : undefined }, otelUrl),
+        listMetricNames(token, otelUrl),
+        scoped ? listTraces(token, { serviceName: MCP_GATEWAY_SERVICE_NAME, limit }, otelUrl) : undefined,
+    ]);
+    const reported = new Set((names.data ?? []).map(row => row.metric_name));
+    const spans = traces?.data ?? [];
     return {
         filters,
-        metrics,
+        reporting: MCP_METRIC_CATALOG.filter(name => reported.has(name)),
         spans,
-        slis: scoped ? summarizeRequestSpans(spans, filters) : summarizeMetricPoints(metrics, filters),
+        slis: levels ? summarizeServiceLevels(levels) : summarizeRequestSpans(spans, filters),
         readAt: new Date().toISOString(),
     };
 };