@datalayer/core 1.1.66 → 1.2.12

package/lib/api/iam/profile.d.ts

@@ -1,4 +1,4 @@
-import { MembershipsResponse, ShareablePrincipalsResponse, UserMeResponse, WhoAmIResponse } from '../../models/IAM';
+import { MembershipsResponse, PrincipalSearchResponse, PrincipalSearchUser, ShareablePrincipalsResponse, UserMeResponse, WhoAmIResponse } from '../../models/IAM';
 /**
  * Get current authenticated user profile
  * @param token - Authentication token (required)
@@ -28,3 +28,19 @@ export declare const memberships: (token: string, baseUrl?: string) => Promise<M
  * @param baseUrl - Base URL for the API (defaults to production IAM URL)
  */
 export declare const principalsShareable: (token: string, baseUrl?: string) => Promise<ShareablePrincipalsResponse>;
+/**
+ * Search the people, teams and organizations the caller may name: what the
+ * sharing dialogs search, and whom a comment mentions or assigns (B4-02).
+ *
+ * @param token - Authentication token (required)
+ * @param query - What is typed: part of a handle or of a name
+ * @param principalTypes - What to search; people only by default
+ * @param baseUrl - Base URL for the API (defaults to production IAM URL)
+ */
+export declare const searchPrincipals: (token: string, query: string, principalTypes?: Array<"user" | "team" | "organization">, baseUrl?: string) => Promise<PrincipalSearchResponse>;
+/** A person `searchPrincipals` found, as a comment or a report names them. */
+export declare const personOfPrincipalUser: (user: PrincipalSearchUser) => {
+    uid: string;
+    handle: string;
+    name: string | null;
+};

package/lib/api/iam/profile.js

@@ -69,3 +69,30 @@ export const principalsShareable = async (token, baseUrl = DEFAULT_SERVICE_URLS.
         token,
     });
 };
+/**
+ * Search the people, teams and organizations the caller may name: what the
+ * sharing dialogs search, and whom a comment mentions or assigns (B4-02).
+ *
+ * @param token - Authentication token (required)
+ * @param query - What is typed: part of a handle or of a name
+ * @param principalTypes - What to search; people only by default
+ * @param baseUrl - Base URL for the API (defaults to production IAM URL)
+ */
+export const searchPrincipals = async (token, query, principalTypes = ['user'], baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    validateToken(token);
+    return requestDatalayerAPI({
+        url: `${baseUrl}${API_BASE_PATHS.IAM}/principals/search`,
+        method: 'POST',
+        body: { query, principalTypes },
+        token,
+    });
+};
+/** A person `searchPrincipals` found, as a comment or a report names them. */
+export const personOfPrincipalUser = (user) => ({
+    uid: user.uid,
+    handle: user.handle_s,
+    name: `${user.first_name_t ?? ''} ${user.last_name_t ?? ''}`.trim() ||
+        user.display_name_t ||
+        user.display_name ||
+        null,
+});

package/lib/api/iam/scimTokens.d.ts

@@ -0,0 +1,79 @@
+/** A SCIM credential as the console may see it — never the secret or its hash. */
+export interface ScimToken {
+    uid: string;
+    orgUid: string;
+    /** What an administrator called it, to tell two directories apart. */
+    name: string;
+    /**
+     * Revoked rather than deleted, so the rows a provisioning run wrote can
+     * still name the token that wrote them.
+     */
+    revoked: boolean;
+    /**
+     * When the secret was last replaced. A token that has never been rotated
+     * carries its creation moment here.
+     */
+    rotatedAt?: string;
+    /**
+     * When it last authenticated a SCIM call, or empty for never. Written best
+     * effort — a provisioning call is never failed for the bookkeeping.
+     */
+    lastUsedAt?: string;
+    createdBy?: string;
+    createdAt?: string;
+    updatedAt?: string;
+}
+/**
+ * A freshly minted credential: the record, and the secret **this once**.
+ *
+ * The two are separate fields rather than one merged object on purpose. The
+ * secret does not belong in anything the console stores, renders twice, or
+ * puts in a list, and a shape that carried it alongside every other field
+ * invites exactly that.
+ */
+export interface MintedScimToken {
+    token: ScimToken;
+    /** Shown once. Not retrievable, by construction — only a hash is stored. */
+    secret: string;
+}
+export declare const listScimTokens: (token: string, orgUid: string, baseUrl?: string) => Promise<ScimToken[]>;
+/**
+ * Mint one. The secret is in this answer and nowhere else, ever again.
+ *
+ * The caller must put it in front of somebody before the next render. There
+ * is no second chance and no call that would provide one.
+ */
+export declare const createScimToken: (token: string, orgUid: string, name: string, baseUrl?: string) => Promise<MintedScimToken>;
+/**
+ * A new secret for the same record; the old one stops at once.
+ *
+ * Rotation rather than delete-and-recreate because the record's uid is what
+ * the provisioning rows name. Replacing it would leave them pointing at
+ * nothing.
+ */
+export declare const rotateScimToken: (token: string, orgUid: string, uid: string, baseUrl?: string) => Promise<MintedScimToken>;
+/** Stop a token, keeping the rows that name it readable. */
+export declare const revokeScimToken: (token: string, orgUid: string, uid: string, baseUrl?: string) => Promise<ScimToken>;
+/**
+ * The base URL a directory is configured with.
+ *
+ * Built here rather than typed into the page, because it is half of what an
+ * administrator copies into Okta or Entra and a typo in it looks like an
+ * outage on the directory's side. The directory appends `/Users` itself;
+ * RFC 7644 fixes everything after this.
+ */
+export declare const scimBaseUrl: (baseUrl?: string) => string;
+/**
+ * Whether this organization can actually be provisioned into right now.
+ *
+ * A list with tokens in it is not the same as a working integration, and the
+ * distinction is the one an administrator most needs: every token revoked
+ * reads, in a table, almost exactly like a healthy setup. `neverUsed` is the
+ * other quiet state — configured, live, and never once called, which is what
+ * a directory that was set up and never switched on looks like.
+ */
+export declare const scimStatus: (tokens: ScimToken[]) => {
+    state: "none" | "revoked" | "never-used" | "active";
+    live: ScimToken[];
+    lastUsedAt?: string;
+};

package/lib/api/iam/scimTokens.js

@@ -0,0 +1,141 @@
+/*
+ * Copyright (c) 2023-2025 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/*
+ * Copyright (c) 2023-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * The credentials an organization's directory provisions with, over SCIM.
+ *
+ * The identity provider registry beside this one made a directory able to
+ * *sign somebody in*. SCIM is the half that does not wait for them to turn
+ * up: the directory says who exists when they join and, far more
+ * importantly, who has left.
+ *
+ * **The token is the tenant.** Every SCIM call resolves its organization
+ * from the bearer credential before it looks at anything else, so these
+ * records are not a convenience — each one *is* an organization's provisioning
+ * authority, and there is nothing else identifying the caller.
+ *
+ * **The secret is answered once and never again.** `createScimToken` and
+ * `rotateScimToken` return it; nothing reads it back, because only a SHA-256
+ * of it is stored. A console that offered to show it later would be
+ * promising something the server cannot do — so this client has no call that
+ * could, and the UI has to say "copy it now" and mean it.
+ *
+ * `lastUsedAt` is the column worth reading. A directory configured once and
+ * forgotten looks exactly like a live one in every other field, and the
+ * difference matters most for deprovisioning: the integration that has not
+ * called in a month is not removing anybody.
+ *
+ * @module api/iam/scimTokens
+ */
+import { requestDatalayerAPI } from '../DatalayerApi.js';
+import { API_BASE_PATHS, DEFAULT_SERVICE_URLS } from '../constants.js';
+const fromWire = (wire) => ({
+    uid: wire.uid ?? '',
+    orgUid: wire.org_uid ?? '',
+    name: wire.name ?? '',
+    // A record with no `revoked` field is a live one: absence is not
+    // revocation, and reading it as one would show every token as stopped.
+    revoked: wire.revoked === true,
+    rotatedAt: wire.rotated_at || undefined,
+    lastUsedAt: wire.last_used_at || undefined,
+    createdBy: wire.created_by || undefined,
+    createdAt: wire.created_at || undefined,
+    updatedAt: wire.updated_at || undefined,
+});
+const tokensUrl = (baseUrl, orgUid, suffix = '') => `${baseUrl}${API_BASE_PATHS.IAM}/organizations/${encodeURIComponent(orgUid)}` +
+    `/scim-tokens${suffix}`;
+export const listScimTokens = async (token, orgUid, baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await requestDatalayerAPI({
+        url: tokensUrl(baseUrl, orgUid),
+        method: 'GET',
+        token,
+    });
+    return (response.tokens ?? []).map(fromWire);
+};
+/**
+ * Mint one. The secret is in this answer and nowhere else, ever again.
+ *
+ * The caller must put it in front of somebody before the next render. There
+ * is no second chance and no call that would provide one.
+ */
+export const createScimToken = async (token, orgUid, name, baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await requestDatalayerAPI({
+        url: tokensUrl(baseUrl, orgUid),
+        method: 'POST',
+        token,
+        body: { name },
+    });
+    return {
+        token: fromWire(response.token ?? {}),
+        secret: response.token?.token ?? '',
+    };
+};
+/**
+ * A new secret for the same record; the old one stops at once.
+ *
+ * Rotation rather than delete-and-recreate because the record's uid is what
+ * the provisioning rows name. Replacing it would leave them pointing at
+ * nothing.
+ */
+export const rotateScimToken = async (token, orgUid, uid, baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await requestDatalayerAPI({
+        url: tokensUrl(baseUrl, orgUid, `/${encodeURIComponent(uid)}/rotate`),
+        method: 'POST',
+        token,
+    });
+    return {
+        token: fromWire(response.token ?? {}),
+        secret: response.token?.token ?? '',
+    };
+};
+/** Stop a token, keeping the rows that name it readable. */
+export const revokeScimToken = async (token, orgUid, uid, baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await requestDatalayerAPI({
+        url: tokensUrl(baseUrl, orgUid, `/${encodeURIComponent(uid)}`),
+        method: 'DELETE',
+        token,
+    });
+    return fromWire(response.token ?? {});
+};
+/**
+ * The base URL a directory is configured with.
+ *
+ * Built here rather than typed into the page, because it is half of what an
+ * administrator copies into Okta or Entra and a typo in it looks like an
+ * outage on the directory's side. The directory appends `/Users` itself;
+ * RFC 7644 fixes everything after this.
+ */
+export const scimBaseUrl = (baseUrl = DEFAULT_SERVICE_URLS.IAM) => `${baseUrl}/api/iam/scim/v2`;
+/**
+ * Whether this organization can actually be provisioned into right now.
+ *
+ * A list with tokens in it is not the same as a working integration, and the
+ * distinction is the one an administrator most needs: every token revoked
+ * reads, in a table, almost exactly like a healthy setup. `neverUsed` is the
+ * other quiet state — configured, live, and never once called, which is what
+ * a directory that was set up and never switched on looks like.
+ */
+export const scimStatus = (tokens) => {
+    const live = tokens.filter(entry => !entry.revoked);
+    if (tokens.length === 0) {
+        return { state: 'none', live };
+    }
+    if (live.length === 0) {
+        return { state: 'revoked', live };
+    }
+    const used = live
+        .map(entry => entry.lastUsedAt)
+        .filter((value) => Boolean(value))
+        .sort();
+    const lastUsedAt = used.length > 0 ? used[used.length - 1] : undefined;
+    return {
+        state: lastUsedAt ? 'active' : 'never-used',
+        live,
+        lastUsedAt,
+    };
+};

package/lib/api/iam/secrets.js

@@ -9,21 +9,6 @@
 import { requestDatalayerAPI } from '../DatalayerApi.js';
 import { API_BASE_PATHS, DEFAULT_SERVICE_URLS } from '../constants.js';
 import { validateToken, validateRequiredString } from '../utils/validation.js';
-/**
- * Helper function to Base64 encode a value (cross-platform).
- * @param value - Plain text value to encode
- * @returns Base64 encoded string
- */
-function encodeValue(value) {
-    if (typeof Buffer !== 'undefined') {
-        // Node.js environment
-        return Buffer.from(value).toString('base64');
-    }
-    else {
-        // Browser environment
-        return btoa(value);
-    }
-}
 /**
  * Create a new secret.
  * Creates a new encrypted secret for the authenticated user.
@@ -47,12 +32,14 @@ export const createSecret = async (token, data, baseUrl = DEFAULT_SERVICE_URLS.I
     validateToken(token);
     validateRequiredString(data.name, 'Secret name');
     validateRequiredString(data.value, 'Secret value');
-    // Base64 encode the value before sending to API
     const requestBody = {
         variant: data.variant || 'generic',
         name: data.name,
         description: data.description || '',
-        value: encodeValue(data.value),
+        // As it is. A secret has one representation end to end (PLAN_ENVS.md
+        // E3-05): this used to base64-encode, and nothing on the read side undid
+        // it, so a build secret arrived at its build encoded and opened nothing.
+        value: data.value,
     };
     try {
         return await requestDatalayerAPI({
@@ -64,7 +51,7 @@ export const createSecret = async (token, data, baseUrl = DEFAULT_SERVICE_URLS.I
     }
     catch (error) {
         if (error.response?.status === 409) {
-            throw new Error(`Secret with name '${data.name}' already exists. Please use a different name.`);
+            throw new Error(`Secret with name '${data.name}' already exists. Please use a different name.`, { cause: error });
         }
         throw error;
     }
@@ -118,7 +105,7 @@ export const getSecret = async (token, secretId, baseUrl = DEFAULT_SERVICE_URLS.
     }
     catch (error) {
         if (error.response?.status === 404) {
-            throw new Error(`Secret '${secretId}' not found.`);
+            throw new Error(`Secret '${secretId}' not found.`, { cause: error });
         }
         throw error;
     }
@@ -144,10 +131,10 @@ export const getSecret = async (token, secretId, baseUrl = DEFAULT_SERVICE_URLS.
 export const updateSecret = async (token, secretId, data, baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
     validateToken(token);
     validateRequiredString(secretId, 'Secret ID');
-    // Base64 encode value if provided
+    // Secret values are opaque. Send exactly what the owner supplied.
     const requestBody = { ...data };
     if (data.value) {
-        requestBody.value = encodeValue(data.value);
+        requestBody.value = data.value;
     }
     try {
         return await requestDatalayerAPI({
@@ -159,7 +146,7 @@ export const updateSecret = async (token, secretId, data, baseUrl = DEFAULT_SERV
     }
     catch (error) {
         if (error.response?.status === 404) {
-            throw new Error(`Secret '${secretId}' not found.`);
+            throw new Error(`Secret '${secretId}' not found.`, { cause: error });
         }
         throw error;
     }
@@ -189,7 +176,7 @@ export const deleteSecret = async (token, secretId, baseUrl = DEFAULT_SERVICE_UR
     }
     catch (error) {
         if (error.response?.status === 404) {
-            throw new Error(`Secret '${secretId}' not found.`);
+            throw new Error(`Secret '${secretId}' not found.`, { cause: error });
         }
         throw error;
     }

package/lib/api/iam/trials.d.ts

@@ -0,0 +1,38 @@
+/** Where a claim carries the trial's own key. */
+export declare const TRIAL_TOKEN_HEADER = "X-Datalayer-Trial-Token";
+/** What a visitor may try here, if anything. */
+export interface TrialOffer {
+    offered: boolean;
+    /** The one benchmark a trial may run. */
+    evalsetId: string;
+    /** The credits it may spend. */
+    credits: number;
+    /** How long it lives, in seconds. */
+    ttlSeconds: number;
+}
+export interface Trial {
+    id: string;
+    /** The uid the trial's work is owned by, which is the trial's own. */
+    ownerUid: string;
+    state: 'open' | 'claimed' | 'expired';
+    evalsetId: string;
+    creditsLimit: number | null;
+    creditsSpent: number;
+    expiresAt: string | null;
+    claimedByUid: string;
+    claimedAt: string | null;
+}
+/** A trial and the key that acts as it. The key is answered once. */
+export interface IssuedTrial {
+    trial: Trial;
+    token: string;
+}
+/**
+ * Whether this deployment lets a visitor try a benchmark, and which one.
+ * Unauthenticated: it is what a public page asks before it offers the run.
+ */
+export declare const getTrialOffer: (baseUrl?: string) => Promise<TrialOffer>;
+/** Take a trial. Unauthenticated, rate limited, and refused where none are offered. */
+export declare const createTrial: (baseUrl?: string) => Promise<IssuedTrial>;
+/** The trial a key acts as: what it has left, and how long it has. */
+export declare const getCurrentTrial: (trialToken: string, baseUrl?: string) => Promise<Trial>;

package/lib/api/iam/trials.js

@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2023-2025 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/*
+ * Copyright (c) 2023-2026 Datalayer, Inc.
+ * Distributed under the terms of the Modified BSD License.
+ */
+/**
+ * The anonymous trial: running the public benchmark before signing up
+ * (BENCHMARK.md, B2-14).
+ *
+ * A visitor with no account asks for a trial and gets a principal of its
+ * own with one benchmark it may run, a few credits and a short expiry. The
+ * work they make is owned by that principal, so when they sign up it is
+ * given to them rather than lost — `claimTrial` in the evals client moves
+ * it, and the trial's own key has to be presented alongside their new one.
+ *
+ * A deployment that has not named a public benchmark offers no trials, and
+ * `getTrialOffer` says so: a page asks before it shows the button.
+ *
+ * @module api/iam/trials
+ */
+import { requestDatalayerAPI } from '../DatalayerApi.js';
+import { API_BASE_PATHS, DEFAULT_SERVICE_URLS } from '../constants.js';
+/** Where a claim carries the trial's own key. */
+export const TRIAL_TOKEN_HEADER = 'X-Datalayer-Trial-Token';
+const trialsUrl = (baseUrl, suffix = '') => `${baseUrl}${API_BASE_PATHS.IAM}/trials${suffix}`;
+const asTrial = (wire) => ({
+    id: wire.id,
+    ownerUid: wire.owner_uid ?? wire.id,
+    state: wire.state ?? 'open',
+    evalsetId: wire.evalset_id ?? '',
+    creditsLimit: wire.credits_limit ?? null,
+    creditsSpent: wire.credits_spent ?? 0,
+    expiresAt: wire.expires_at ?? null,
+    claimedByUid: wire.claimed_by_uid ?? '',
+    claimedAt: wire.claimed_at ?? null,
+});
+/**
+ * Whether this deployment lets a visitor try a benchmark, and which one.
+ * Unauthenticated: it is what a public page asks before it offers the run.
+ */
+export const getTrialOffer = async (baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await requestDatalayerAPI({ url: trialsUrl(baseUrl, '/offer'), method: 'GET' });
+    return {
+        offered: !!response.offered,
+        evalsetId: response.evalset_id ?? '',
+        credits: response.credits ?? 0,
+        ttlSeconds: response.ttl_seconds ?? 0,
+    };
+};
+/** Take a trial. Unauthenticated, rate limited, and refused where none are offered. */
+export const createTrial = async (baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await requestDatalayerAPI({ url: trialsUrl(baseUrl), method: 'POST' });
+    return { trial: asTrial(response.trial), token: response.token };
+};
+/** The trial a key acts as: what it has left, and how long it has. */
+export const getCurrentTrial = async (trialToken, baseUrl = DEFAULT_SERVICE_URLS.IAM) => {
+    const response = await requestDatalayerAPI({
+        url: trialsUrl(baseUrl, '/me'),
+        method: 'GET',
+        token: trialToken,
+    });
+    return asTrial(response.trial);
+};

package/lib/api/index.d.ts

@@ -11,6 +11,10 @@ export type { IRequestDatalayerAPIOptions } from './DatalayerApi';
 export type { IDatalayerAPIResponse } from './DatalayerApi';
 export * as iam from './iam';
 export * as contents from './contents';
+export * as evals from './evals';
 export * as mcp from './mcp';
+export * as orchestration from './orchestration';
 export * as otel from './otel';
+export * as scheduler from './scheduler';
+export * as spacer from './spacer';
 export * from '../api/DatalayerApi';

package/lib/api/index.js

@@ -15,6 +15,10 @@ export { requestDatalayerAPI, requestDatalayerAPIWithResponse, RunResponseError,
 // Domain-organized API exports
 export * as iam from './iam/index.js';
 export * as contents from './contents/index.js';
+export * as evals from './evals/index.js';
 export * as mcp from './mcp/index.js';
+export * as orchestration from './orchestration/index.js';
 export * as otel from './otel/index.js';
+export * as scheduler from './scheduler/index.js';
+export * as spacer from './spacer/index.js';
 export * from '../api/DatalayerApi.js';

package/lib/api/mcp/observability.d.ts

@@ -1,4 +1,5 @@
-import type { OtelLog, OtelMetric, OtelSpan } from '../otel/types';
+import { type DashboardData } from '../otel/dashboards';
+import type { OtelLog, OtelSpan } from '../otel/types';
 import type { McpTask } from '../../models/McpTask';
 /**
  * The `service.name` the gateway exports under, and the one its workers use.
@@ -9,8 +10,15 @@ import type { McpTask } from '../../models/McpTask';
  * queryable after the process is gone.
  */
 export declare const MCP_GATEWAY_SERVICE_NAME = "jupyter-mcp-server";
-/** The `service.name` a worker's relayed output is filed under. */
-export declare const MCP_WORKER_SERVICE_NAME = "jupyter-mcp-worker";
+/**
+ * The `service.name` a worker's relayed output is filed under.
+ *
+ * `mcp-worker` since the service was renamed to `datalayer-mcp-server`: the
+ * gateway names its workers, and a name carrying `jupyter` said the wrong
+ * thing about a process that serves Datalayer sandboxes as readily as a
+ * Jupyter server.
+ */
+export declare const MCP_WORKER_SERVICE_NAME = "mcp-worker";
 /**
  * The `service.name` the durable execution service exports under.
  *
@@ -40,11 +48,25 @@ export declare const MCP_SLI_METRICS: {
     readonly taskSuccess: "mcp.tasks";
     readonly sandboxLaunch: "sandbox.launch_seconds";
 };
+/** The OTEL service's built-in dashboard the four SLIs are read from. */
+export declare const MCP_SERVICE_LEVELS_DASHBOARD = "mcp-service-levels";
+/**
+ * Its panels, by the ids the OTEL service gives them. A contract test there
+ * holds them, so a panel renamed on the service fails a test rather than
+ * reading here as nothing measured.
+ */
+export declare const MCP_SERVICE_LEVEL_PANELS: {
+    readonly callsByOutcome: "mcp-calls-by-outcome";
+    readonly callDurationP95: "mcp-call-duration-p95";
+    readonly tasksByStatus: "mcp-tasks-by-status";
+    readonly sandboxLaunchP95: "sandbox-launch_seconds-by-provider-p95";
+    readonly sandboxLaunches: "sandbox-launch_seconds-by-provider-count";
+};
 export interface McpMetricsFilters {
     /** The `client_id` of one agent: read from spans, not from metrics. */
     agent?: string;
     org?: string;
-    /** ISO 8601; points and spans before it are left out. */
+    /** ISO 8601; the reading starts there. */
     since?: string;
     limit?: number;
 }
@@ -66,8 +88,8 @@ export interface McpSliSummary {
 }
 export interface McpMetricsSnapshot {
     filters: McpMetricsFilters;
-    /** The catalog points read, by metric name. */
-    metrics: Partial<Record<McpMetricName, OtelMetric[]>>;
+    /** The catalog metrics the OTEL service holds points of, in catalog order. */
+    reporting: McpMetricName[];
     /** The `mcp.request` spans a per-agent or per-organization reading rests on. */
     spans: OtelSpan[];
     slis: McpSliSummary;
@@ -76,13 +98,14 @@ export interface McpMetricsSnapshot {
 /** The nearest-rank percentile of a sample; `null` for an empty one. */
 export declare const percentile: (values: number[], fraction: number) => number | null;
 /**
- * The SLIs over catalog points — the platform-wide reading.
+ * The SLIs from the service levels dashboard — the platform-wide reading.
  *
- * `mcp.calls{outcome}` gives availability, `mcp.call.duration{tool}` the
- * latency, `mcp.tasks{status}` the task success rate and
- * `sandbox.launch_seconds{provider}` the launches.
+ * Its panels arrive summarised: calls and tasks as how much each counter grew
+ * over the window, the two p95s from their histograms' buckets. The call
+ * duration is recorded in seconds and shown in milliseconds. A panel with
+ * nothing in it reads as not measured, never as a zero.
  */
-export declare const summarizeMetricPoints: (metrics: Partial<Record<McpMetricName, OtelMetric[]>>, filters?: McpMetricsFilters) => McpSliSummary;
+export declare const summarizeServiceLevels: (data: DashboardData) => McpSliSummary;
 /**
  * The SLIs over `mcp.request` spans — the per-agent or per-organization
  * reading, since metrics carry neither label.