@iblai/data-layer 1.22.0 → 1.24.0

package/dist/index.js

@@ -39082,13 +39082,13 @@ const SPEND_CAPS_REDUCER_PATH = 'spendCapsApiSlice';
  * provider rate limit, which also uses status 429.
  */
 const SPEND_CAP_EXCEEDED_ERROR_CODE = 'spend_cap_exceeded';
-const encodePathSegment$2 = (value) => encodeURIComponent(value);
-const tenantSpendCapPath = (org) => `/api/ai-mentor/orgs/${encodePathSegment$2(org)}/spend-caps/tenant/`;
-const agentSpendCapPath = (org, mentorId) => `/api/ai-mentor/orgs/${encodePathSegment$2(org)}/agents/${encodePathSegment$2(mentorId)}/spend-cap/`;
-const agentUserSpendCapsPath = (org, mentorId) => `/api/ai-mentor/orgs/${encodePathSegment$2(org)}/agents/${encodePathSegment$2(mentorId)}/spend-caps/users/`;
-const userSpendCapPath = (org, mentorId, username) => `${agentUserSpendCapsPath(org, mentorId)}${encodePathSegment$2(username)}/`;
-const spendCapStatusPath = (org, userId) => `/api/ai-mentor/orgs/${encodePathSegment$2(org)}/spend-caps/status/${encodePathSegment$2(userId)}/`;
-const agentSpendCapsListPath = (org) => `/api/ai-mentor/orgs/${encodePathSegment$2(org)}/spend-caps/agents/`;
+const encodePathSegment$3 = (value) => encodeURIComponent(value);
+const tenantSpendCapPath = (org) => `/api/ai-mentor/orgs/${encodePathSegment$3(org)}/spend-caps/tenant/`;
+const agentSpendCapPath = (org, mentorId) => `/api/ai-mentor/orgs/${encodePathSegment$3(org)}/agents/${encodePathSegment$3(mentorId)}/spend-cap/`;
+const agentUserSpendCapsPath = (org, mentorId) => `/api/ai-mentor/orgs/${encodePathSegment$3(org)}/agents/${encodePathSegment$3(mentorId)}/spend-caps/users/`;
+const userSpendCapPath = (org, mentorId, username) => `${agentUserSpendCapsPath(org, mentorId)}${encodePathSegment$3(username)}/`;
+const spendCapStatusPath = (org, userId) => `/api/ai-mentor/orgs/${encodePathSegment$3(org)}/spend-caps/status/${encodePathSegment$3(userId)}/`;
+const agentSpendCapsListPath = (org) => `/api/ai-mentor/orgs/${encodePathSegment$3(org)}/spend-caps/agents/`;
 const SPEND_CAPS_ENDPOINTS = {
     GET_TENANT_SPEND_CAP: {
         service: exports.SERVICES.DM,
@@ -39782,7 +39782,7 @@ const buildEndpointFromDmServiceLegacy = (serviceFn, options) => buildEndpointFr
 const API_TOKENS_PATH = '/api/core/platform/api-tokens/';
 /**
  * Normalizes a `getApiKeys` result: the endpoint returns a bare array unless
- * `pageSize` is sent, in which case it returns a DRF page envelope.
+ * `pageSize` is sent, in which case it returns a `{count, next_page, previous_page, results}` envelope.
  */
 function unwrapApiTokenList(response) {
     var _a, _b;
@@ -39832,7 +39832,10 @@ const apiKeysApiSlice = react.createApi({
                 if (args.pageSize !== undefined)
                     queryParams.set('page_size', String(args.pageSize));
                 return requestApiToken(`${API_TOKENS_PATH}?${queryParams.toString()}`, { method: 'GET' }, 'Failed to fetch API keys');
-            }),
+            }, 
+            // An out-of-range page is a 404 "Invalid page." — fail fast so the
+            // caller can step back instead of waiting out the retry backoff.
+            { expectedErrorStatuses: [404] }),
             providesTags: ['apiKeys'],
         }),
         /** Detail read — the only GET that returns the token's policies and groups. */
@@ -46576,11 +46579,11 @@ const VERCEL_SPA = 'vercel';
 // platform-wide listing, which is why "add a domain" can only offer the caller's
 // own deployed apps.
 const HOSTING_REDUCER_PATH = 'hostingApiSlice';
-const encodePathSegment$1 = (value) => encodeURIComponent(value);
-const userHostingPath = (org, username) => `/api/ai-mentor/orgs/${encodePathSegment$1(org)}/users/${encodePathSegment$1(username)}/providers/vercel/hosting`;
+const encodePathSegment$2 = (value) => encodeURIComponent(value);
+const userHostingPath = (org, username) => `/api/ai-mentor/orgs/${encodePathSegment$2(org)}/users/${encodePathSegment$2(username)}/providers/vercel/hosting`;
 const hostingProjectsPath = (org, username) => `${userHostingPath(org, username)}/deployment/`;
 const hostingProjectDomainsPath = (org, username) => `${userHostingPath(org, username)}/dns/`;
-const hostingDomainPath = (org, domainId) => `/api/ai-mentor/orgs/${encodePathSegment$1(org)}/providers/vercel/hosting/domains/${domainId}/`;
+const hostingDomainPath = (org, domainId) => `/api/ai-mentor/orgs/${encodePathSegment$2(org)}/providers/vercel/hosting/domains/${domainId}/`;
 const HOSTING_ENDPOINTS = {
     GET_HOSTING_PROJECTS: {
         service: exports.SERVICES.DM,
@@ -47421,8 +47424,8 @@ exports.recommendationPromptTypeEnum = void 0;
     recommendationPromptTypeEnum["catalog"] = "catalog";
 })(exports.recommendationPromptTypeEnum || (exports.recommendationPromptTypeEnum = {}));
 
-const encodePathSegment = (value) => encodeURIComponent(value);
-const periodicAgentsListPath = ({ org, userId }) => `/api/ai-mentor/orgs/${encodePathSegment(org)}/users/${encodePathSegment(userId)}/periodic-agents/`;
+const encodePathSegment$1 = (value) => encodeURIComponent(value);
+const periodicAgentsListPath = ({ org, userId }) => `/api/ai-mentor/orgs/${encodePathSegment$1(org)}/users/${encodePathSegment$1(userId)}/periodic-agents/`;
 const periodicAgentsListParams = ({ enabled, mentorId, ordering, page, pageSize, parentMentorId, parentSessionId, previousAgent, previousAgentStatus, search, status, title, username, startDate, endDate, }) => ({
     enabled,
     mentor_id: mentorId,
@@ -49115,6 +49118,357 @@ function useUserLlmTraceObservations(scope, options) {
     return useUserLlmUsageObservations(base && traceId ? { ...base, resource: 'observations', trace_id: traceId, limit } : null, options);
 }
 
+// Backend contract: the Virtual Machine Shell network features on iblai-dm-pro.
+// An agent with `enable_virtual_machine` runs its `execute` tool in an isolated
+// per-chat-run Linux VM that has no network by default. Two org-level records,
+// both under /api/ai-account/orgs/{org}/, decide what the VM can reach and
+// which credentials it can use:
+// 1. Network policies — virtual-machine-network-policy/ — named, reusable
+//    `host:port` allowlists an agent binds under the `custom` egress profile.
+// 2. VM secrets — virtual-machine-secret/ — API keys the VM can use but never
+//    read; the real value is swapped in on the wire, only for HTTPS requests to
+//    the secret's own hosts.
+// Both are bound to an agent through the mentor-settings endpoint
+// (`virtual_machine_egress`, `virtual_machine_network_policy_id`,
+// `virtual_machine_secret_ids`) — see ./types.ts.
+const VIRTUAL_MACHINE_REDUCER_PATH = 'virtualMachineApiSlice';
+const VIRTUAL_MACHINE_QUERY_KEYS = {
+    NETWORK_POLICIES: 'VirtualMachineNetworkPolicies',
+    SECRETS: 'VirtualMachineSecrets',
+};
+const encodePathSegment = (value) => encodeURIComponent(value);
+const VIRTUAL_MACHINE_ENDPOINTS = {
+    /** GET (list) / POST (create) / PATCH (update by `id`) / DELETE (by `id`). */
+    NETWORK_POLICIES: {
+        service: exports.SERVICES.DM,
+        path: (org) => `/api/ai-account/orgs/${encodePathSegment(org)}/virtual-machine-network-policy/`,
+    },
+    /** GET (list) / POST (create) / PATCH (update by `env_var`) / DELETE (by `env_var`). */
+    SECRETS: {
+        service: exports.SERVICES.DM,
+        path: (org) => `/api/ai-account/orgs/${encodePathSegment(org)}/virtual-machine-secret/`,
+    },
+};
+/**
+ * RBAC permission names the backend checks on each endpoint. Listed for
+ * reference — the UI gates on the list call's 403 rather than on these.
+ */
+const VIRTUAL_MACHINE_PERMISSIONS = {
+    NETWORK_POLICIES: {
+        LIST: 'Ibl.Mentor/VirtualMachineNetworkPolicies/list',
+        WRITE: 'Ibl.Mentor/VirtualMachineNetworkPolicies/write',
+        DELETE: 'Ibl.Mentor/VirtualMachineNetworkPolicies/delete',
+    },
+    SECRETS: {
+        LIST: 'Ibl.Mentor/VirtualMachineSecrets/list',
+        WRITE: 'Ibl.Mentor/VirtualMachineSecrets/write',
+        DELETE: 'Ibl.Mentor/VirtualMachineSecrets/delete',
+    },
+};
+/** Egress profiles, in the order the UI lists them. `none` is the default. */
+const VIRTUAL_MACHINE_EGRESS_PROFILES = ['none', 'registries', 'public', 'custom'];
+/**
+ * Fast client-side check for a `host:port` entry. The backend is authoritative
+ * (it also rejects wildcards, schemes, paths and the reserved hosts below), so
+ * its message is always surfaced when it disagrees.
+ */
+const VIRTUAL_MACHINE_HOST_PORT_PATTERN = /^[a-z0-9]([a-z0-9.-]*[a-z0-9])?:\d{1,5}$/i;
+/** Hostnames the backend refuses in any allowlist. */
+const VIRTUAL_MACHINE_REJECTED_HOSTS = [
+    'localhost',
+    'metadata',
+    'metadata.google.internal',
+    'instance-data',
+    'instance-data.ec2.internal',
+];
+/** Hostname suffixes the backend refuses in any allowlist. */
+const VIRTUAL_MACHINE_REJECTED_HOST_SUFFIXES = [
+    '.local',
+    '.internal',
+    '.localhost',
+];
+/** `env_var` of a VM secret: a POSIX-style environment variable name. */
+const VIRTUAL_MACHINE_ENV_VAR_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** A network policy holds between 1 and 100 hosts. */
+const VIRTUAL_MACHINE_MAX_POLICY_HOSTS = 100;
+/** An agent may bind at most 20 VM secrets. */
+const VIRTUAL_MACHINE_MAX_SECRETS_PER_MENTOR = 20;
+/** A pasted secret value must be at least this long. */
+const VIRTUAL_MACHINE_SECRET_VALUE_MIN_LENGTH = 8;
+/**
+ * Default VM runtime billing: charged to the chatting user's credits, prorated
+ * per second. The rate is configurable per org, so the UI presents these as
+ * the default rather than the org's actual rate.
+ */
+const VIRTUAL_MACHINE_DEFAULT_BILLING = {
+    usd: 1,
+    minutes: 10,
+};
+
+/**
+ * Virtual Machine Shell network policies and secrets
+ * (`/api/ai-account/orgs/{org}/virtual-machine-network-policy/` and
+ * `/api/ai-account/orgs/{org}/virtual-machine-secret/`).
+ *
+ * Hand-written: these endpoints are newer than the pinned `@iblai/iblai-api`
+ * release. Records are keyed in the body (PATCH) or the query string (DELETE),
+ * never in the URL. A 403 on either list means the caller lacks the matching
+ * `Ibl.Mentor/VirtualMachine…/list` permission — hosts hide the pages then.
+ */
+const virtualMachineApiSlice = react.createApi({
+    reducerPath: VIRTUAL_MACHINE_REDUCER_PATH,
+    tagTypes: [VIRTUAL_MACHINE_QUERY_KEYS.NETWORK_POLICIES, VIRTUAL_MACHINE_QUERY_KEYS.SECRETS],
+    baseQuery: iblFetchBaseQuery,
+    endpoints: (builder) => ({
+        // ── Network policies ────────────────────────────────────────────────
+        listVirtualMachineNetworkPolicies: builder.query({
+            query: ({ org }) => ({
+                url: VIRTUAL_MACHINE_ENDPOINTS.NETWORK_POLICIES.path(org),
+                service: VIRTUAL_MACHINE_ENDPOINTS.NETWORK_POLICIES.service,
+            }),
+            providesTags: [VIRTUAL_MACHINE_QUERY_KEYS.NETWORK_POLICIES],
+        }),
+        createVirtualMachineNetworkPolicy: builder.mutation({
+            query: ({ org, body }) => ({
+                url: VIRTUAL_MACHINE_ENDPOINTS.NETWORK_POLICIES.path(org),
+                service: VIRTUAL_MACHINE_ENDPOINTS.NETWORK_POLICIES.service,
+                method: 'POST',
+                body,
+            }),
+            invalidatesTags: [VIRTUAL_MACHINE_QUERY_KEYS.NETWORK_POLICIES],
+        }),
+        // `body.id` names the policy; `allowed_hosts` replaces the whole list.
+        updateVirtualMachineNetworkPolicy: builder.mutation({
+            query: ({ org, body }) => ({
+                url: VIRTUAL_MACHINE_ENDPOINTS.NETWORK_POLICIES.path(org),
+                service: VIRTUAL_MACHINE_ENDPOINTS.NETWORK_POLICIES.service,
+                method: 'PATCH',
+                body,
+            }),
+            invalidatesTags: [VIRTUAL_MACHINE_QUERY_KEYS.NETWORK_POLICIES],
+        }),
+        // 400 when an agent still uses the policy — the message names the agents.
+        deleteVirtualMachineNetworkPolicy: builder.mutation({
+            query: ({ org, id }) => ({
+                url: VIRTUAL_MACHINE_ENDPOINTS.NETWORK_POLICIES.path(org),
+                service: VIRTUAL_MACHINE_ENDPOINTS.NETWORK_POLICIES.service,
+                method: 'DELETE',
+                params: { id },
+            }),
+            invalidatesTags: [VIRTUAL_MACHINE_QUERY_KEYS.NETWORK_POLICIES],
+        }),
+        // ── VM secrets ──────────────────────────────────────────────────────
+        listVirtualMachineSecrets: builder.query({
+            query: ({ org }) => ({
+                url: VIRTUAL_MACHINE_ENDPOINTS.SECRETS.path(org),
+                service: VIRTUAL_MACHINE_ENDPOINTS.SECRETS.service,
+            }),
+            providesTags: [VIRTUAL_MACHINE_QUERY_KEYS.SECRETS],
+        }),
+        // Either `value` or `source_credential_id` + `source_field`, never both.
+        createVirtualMachineSecret: builder.mutation({
+            query: ({ org, body }) => ({
+                url: VIRTUAL_MACHINE_ENDPOINTS.SECRETS.path(org),
+                service: VIRTUAL_MACHINE_ENDPOINTS.SECRETS.service,
+                method: 'POST',
+                body,
+            }),
+            invalidatesTags: [VIRTUAL_MACHINE_QUERY_KEYS.SECRETS],
+        }),
+        // `body.env_var` names the secret and cannot change.
+        updateVirtualMachineSecret: builder.mutation({
+            query: ({ org, body }) => ({
+                url: VIRTUAL_MACHINE_ENDPOINTS.SECRETS.path(org),
+                service: VIRTUAL_MACHINE_ENDPOINTS.SECRETS.service,
+                method: 'PATCH',
+                body,
+            }),
+            invalidatesTags: [VIRTUAL_MACHINE_QUERY_KEYS.SECRETS],
+        }),
+        // Also unbinds the secret from every agent that uses it.
+        deleteVirtualMachineSecret: builder.mutation({
+            query: ({ org, envVar }) => ({
+                url: VIRTUAL_MACHINE_ENDPOINTS.SECRETS.path(org),
+                service: VIRTUAL_MACHINE_ENDPOINTS.SECRETS.service,
+                method: 'DELETE',
+                params: { env_var: envVar },
+            }),
+            invalidatesTags: [VIRTUAL_MACHINE_QUERY_KEYS.SECRETS],
+        }),
+    }),
+});
+const { useListVirtualMachineNetworkPoliciesQuery, useLazyListVirtualMachineNetworkPoliciesQuery, useCreateVirtualMachineNetworkPolicyMutation, useUpdateVirtualMachineNetworkPolicyMutation, useDeleteVirtualMachineNetworkPolicyMutation, useListVirtualMachineSecretsQuery, useLazyListVirtualMachineSecretsQuery, useCreateVirtualMachineSecretMutation, useUpdateVirtualMachineSecretMutation, useDeleteVirtualMachineSecretMutation, } = virtualMachineApiSlice;
+
+/**
+ * Normalise a `host:port` entry the way the backend stores it: trimmed and
+ * lowercased.
+ */
+function normalizeHostPort(value) {
+    return value.trim().toLowerCase();
+}
+/** Split a pasted or typed string into candidate `host:port` entries. */
+function splitHostPortInput(value) {
+    return value
+        .split(/[\s,;]+/)
+        .map(normalizeHostPort)
+        .filter((entry) => entry.length > 0);
+}
+const IPV4_PATTERN = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
+/** Whether the host part is an IPv4 literal (the `host:port` grammar admits no IPv6). */
+function isIpAddressHost(host) {
+    return IPV4_PATTERN.test(host);
+}
+/**
+ * IPv4 literals the backend refuses even where IPs are allowed: loopback,
+ * link-local, multicast, reserved and the unspecified address.
+ */
+function isRejectedIpAddress(host) {
+    const match = IPV4_PATTERN.exec(host);
+    if (!match)
+        return false;
+    const octets = match.slice(1, 5).map(Number);
+    if (octets.some((octet) => octet > 255))
+        return true;
+    const [first, second] = octets;
+    if (first === 0)
+        return true; // unspecified / "this" network
+    if (first === 127)
+        return true; // loopback
+    if (first === 169 && second === 254)
+        return true; // link-local
+    if (first >= 224)
+        return true; // multicast (224–239) and reserved (240+)
+    return false;
+}
+/** Whether the backend refuses this hostname outright (localhost, metadata, `.internal`, …). */
+function isRejectedHostname(host) {
+    const lowered = host.toLowerCase();
+    if (VIRTUAL_MACHINE_REJECTED_HOSTS.includes(lowered))
+        return true;
+    return VIRTUAL_MACHINE_REJECTED_HOST_SUFFIXES.some((suffix) => lowered.endsWith(suffix));
+}
+/**
+ * Client-side check of one `host:port` entry, returning why it fails or `null`
+ * when it looks valid. Network policies accept IP addresses; VM secrets do
+ * not (`allowIpAddresses: false`, the default). The backend remains
+ * authoritative, so always show its message when it rejects an entry.
+ */
+function validateHostPort(value, options = {}) {
+    const entry = normalizeHostPort(value);
+    if (!VIRTUAL_MACHINE_HOST_PORT_PATTERN.test(entry))
+        return 'format';
+    const separator = entry.lastIndexOf(':');
+    const host = entry.slice(0, separator);
+    const port = Number(entry.slice(separator + 1));
+    if (port < 1 || port > 65535)
+        return 'port';
+    if (isRejectedHostname(host))
+        return 'rejected_host';
+    if (isIpAddressHost(host)) {
+        if (!options.allowIpAddresses)
+            return 'ip_not_allowed';
+        if (isRejectedIpAddress(host))
+            return 'rejected_host';
+    }
+    return null;
+}
+/** Convenience wrapper around {@link validateHostPort}. */
+function isValidHostPort(value, options = {}) {
+    return validateHostPort(value, options) === null;
+}
+/** HTTP status of an RTK Query error, if it carries one. */
+function getVirtualMachineErrorStatus(error) {
+    const status = error === null || error === void 0 ? void 0 : error.status;
+    return typeof status === 'number' ? status : undefined;
+}
+function toMessages(value) {
+    if (typeof value === 'string')
+        return [value];
+    if (Array.isArray(value))
+        return value.filter((item) => typeof item === 'string');
+    return [];
+}
+/**
+ * Normalise a virtual-machine endpoint error for display. Every 400 has the
+ * form `{ error }`, where `error` is either a plain string (shown as a
+ * form-level message) or an object of field → messages (shown next to the
+ * matching field). `non_field_errors` is folded into the form-level message.
+ * Other shapes (`detail`, a bare string body) fall back to a message too.
+ */
+function getVirtualMachineApiError(error) {
+    const status = getVirtualMachineErrorStatus(error);
+    const data = error === null || error === void 0 ? void 0 : error.data;
+    const fieldErrors = {};
+    let message = null;
+    if (typeof data === 'string') {
+        message = data;
+    }
+    else if (data && typeof data === 'object') {
+        const body = data;
+        if (typeof body.error === 'string') {
+            message = body.error;
+        }
+        else if (body.error && typeof body.error === 'object') {
+            for (const [field, messages] of Object.entries(body.error)) {
+                const list = toMessages(messages);
+                if (list.length === 0)
+                    continue;
+                if (field === 'non_field_errors') {
+                    message = list.join(' ');
+                }
+                else {
+                    fieldErrors[field] = list;
+                }
+            }
+        }
+        else if (typeof body.detail === 'string') {
+            message = body.detail;
+        }
+        else if (typeof body.message === 'string') {
+            message = body.message;
+        }
+    }
+    return { status, message, fieldErrors };
+}
+/**
+ * Agent ids named by the "bound to mentors" delete error, e.g.
+ * `"This network policy is bound to mentors; move them off it first: ['<uuid>', '<uuid>']"`.
+ */
+function extractBoundMentorIds(message) {
+    if (!message)
+        return [];
+    const listStart = message.indexOf('[');
+    const listEnd = message.lastIndexOf(']');
+    if (listStart === -1 || listEnd <= listStart)
+        return [];
+    const ids = [];
+    const quoted = /['"]([^'"]+)['"]/g;
+    let match;
+    const list = message.slice(listStart + 1, listEnd);
+    while ((match = quoted.exec(list)) !== null) {
+        ids.push(match[1]);
+    }
+    return ids;
+}
+/** Whether an egress profile lets the VM reach hosts at all (and so may carry secrets). */
+function isVirtualMachineEgressNetworked(egress) {
+    return egress === 'public' || egress === 'custom';
+}
+/**
+ * Under the `custom` profile every host a bound secret is sent to must be in
+ * the network policy. Returns, per secret, the hosts the policy is missing.
+ */
+function findUncoveredSecretHosts(secrets, allowedHosts) {
+    const allowed = new Set(allowedHosts.map(normalizeHostPort));
+    const uncovered = [];
+    for (const secret of secrets) {
+        const hosts = secret.allow_hosts.map(normalizeHostPort).filter((host) => !allowed.has(host));
+        if (hosts.length > 0)
+            uncovered.push({ envVar: secret.env_var, hosts });
+    }
+    return uncovered;
+}
+
 const mentorReducer = {
     [mentorApiSlice.reducerPath]: mentorApiSlice.reducer,
     [tenantApiSlice.reducerPath]: tenantApiSlice.reducer,
@@ -49178,6 +49532,7 @@ const mentorReducer = {
     [gradingApiSlice.reducerPath]: gradingApiSlice.reducer,
     [spendCapsApiSlice.reducerPath]: spendCapsApiSlice.reducer,
     [userChatHistoryApiSlice.reducerPath]: userChatHistoryApiSlice.reducer,
+    [virtualMachineApiSlice.reducerPath]: virtualMachineApiSlice.reducer,
     [userLlmUsageApiSlice.reducerPath]: userLlmUsageApiSlice.reducer,
 };
 const mentorMiddleware = [
@@ -49243,6 +49598,7 @@ const mentorMiddleware = [
     gradingApiSlice.middleware,
     spendCapsApiSlice.middleware,
     userChatHistoryApiSlice.middleware,
+    virtualMachineApiSlice.middleware,
     userLlmUsageApiSlice.middleware,
 ];
 
@@ -49291,6 +49647,7 @@ const skillsReducer = {
     [chatPrivacyApiSlice.reducerPath]: chatPrivacyApiSlice.reducer,
     [agentSkillsApiSlice.reducerPath]: agentSkillsApiSlice.reducer,
     [userChatHistoryApiSlice.reducerPath]: userChatHistoryApiSlice.reducer,
+    [virtualMachineApiSlice.reducerPath]: virtualMachineApiSlice.reducer,
     [chatApiSlice.reducerPath]: chatApiSlice.reducer,
     [userLlmUsageApiSlice.reducerPath]: userLlmUsageApiSlice.reducer,
 };
@@ -49339,6 +49696,7 @@ const skillsMiddleware = [
     chatPrivacyApiSlice.middleware,
     agentSkillsApiSlice.middleware,
     userChatHistoryApiSlice.middleware,
+    virtualMachineApiSlice.middleware,
     chatApiSlice.middleware,
     userLlmUsageApiSlice.middleware,
 ];
@@ -49465,6 +49823,19 @@ exports.USER_LLM_USAGE_REDUCER_PATH = USER_LLM_USAGE_REDUCER_PATH;
 exports.USER_PROGRESS_DATA_POINTS = USER_PROGRESS_DATA_POINTS;
 exports.USER_PROGRESS_SUMMARY_TYPE = USER_PROGRESS_SUMMARY_TYPE;
 exports.VERCEL_SPA = VERCEL_SPA;
+exports.VIRTUAL_MACHINE_DEFAULT_BILLING = VIRTUAL_MACHINE_DEFAULT_BILLING;
+exports.VIRTUAL_MACHINE_EGRESS_PROFILES = VIRTUAL_MACHINE_EGRESS_PROFILES;
+exports.VIRTUAL_MACHINE_ENDPOINTS = VIRTUAL_MACHINE_ENDPOINTS;
+exports.VIRTUAL_MACHINE_ENV_VAR_PATTERN = VIRTUAL_MACHINE_ENV_VAR_PATTERN;
+exports.VIRTUAL_MACHINE_HOST_PORT_PATTERN = VIRTUAL_MACHINE_HOST_PORT_PATTERN;
+exports.VIRTUAL_MACHINE_MAX_POLICY_HOSTS = VIRTUAL_MACHINE_MAX_POLICY_HOSTS;
+exports.VIRTUAL_MACHINE_MAX_SECRETS_PER_MENTOR = VIRTUAL_MACHINE_MAX_SECRETS_PER_MENTOR;
+exports.VIRTUAL_MACHINE_PERMISSIONS = VIRTUAL_MACHINE_PERMISSIONS;
+exports.VIRTUAL_MACHINE_QUERY_KEYS = VIRTUAL_MACHINE_QUERY_KEYS;
+exports.VIRTUAL_MACHINE_REDUCER_PATH = VIRTUAL_MACHINE_REDUCER_PATH;
+exports.VIRTUAL_MACHINE_REJECTED_HOSTS = VIRTUAL_MACHINE_REJECTED_HOSTS;
+exports.VIRTUAL_MACHINE_REJECTED_HOST_SUFFIXES = VIRTUAL_MACHINE_REJECTED_HOST_SUFFIXES;
+exports.VIRTUAL_MACHINE_SECRET_VALUE_MIN_LENGTH = VIRTUAL_MACHINE_SECRET_VALUE_MIN_LENGTH;
 exports.WATCHED_GROUPS_ENDPOINTS = WATCHED_GROUPS_ENDPOINTS;
 exports.WATCHED_GROUPS_QUERY_KEYS = WATCHED_GROUPS_QUERY_KEYS;
 exports.WATCHED_GROUPS_REDUCER_PATH = WATCHED_GROUPS_REDUCER_PATH;
@@ -49516,6 +49887,7 @@ exports.edxProctoringApiSlice = edxProctoringApiSlice;
 exports.edxSsoApiSlice = edxSsoApiSlice;
 exports.evalTotalPages = evalTotalPages;
 exports.evaluationsApiSlice = evaluationsApiSlice;
+exports.extractBoundMentorIds = extractBoundMentorIds;
 exports.fakeBaseQueryWithLogging = fakeBaseQueryWithLogging;
 exports.featureTags = featureTags;
 exports.fetchLearnerCompletion = fetchLearnerCompletion;
@@ -49525,20 +49897,28 @@ exports.filterGlobalUserRoles = filterGlobalUserRoles;
 exports.filterOrgUserRoles = filterOrgUserRoles;
 exports.filterSlashSkills = filterSlashSkills;
 exports.findResumeBlock = findResumeBlock;
+exports.findUncoveredSecretHosts = findUncoveredSecretHosts;
 exports.flattenOutline = flattenOutline;
 exports.getNextRecentMessagesPageParam = getNextRecentMessagesPageParam;
 exports.getSections = getSections;
 exports.getSpendCapExceededError = getSpendCapExceededError;
 exports.getUserRoleScope = getUserRoleScope;
+exports.getVirtualMachineApiError = getVirtualMachineApiError;
+exports.getVirtualMachineErrorStatus = getVirtualMachineErrorStatus;
 exports.gradingApiSlice = gradingApiSlice;
 exports.hostingApiSlice = hostingApiSlice;
 exports.iblFakeBaseQuery = iblFakeBaseQuery;
 exports.initializeDataLayer = initializeDataLayer;
 exports.isBaseAgentMentor = isBaseAgentMentor;
+exports.isIpAddressHost = isIpAddressHost;
 exports.isPoliciesResponse = isPoliciesResponse;
 exports.isPrivacyBlockedError = isPrivacyBlockedError;
+exports.isRejectedHostname = isRejectedHostname;
+exports.isRejectedIpAddress = isRejectedIpAddress;
 exports.isSpendCapExceededErrorBody = isSpendCapExceededErrorBody;
 exports.isUserLlmUsageEmpty = isUserLlmUsageEmpty;
+exports.isValidHostPort = isValidHostPort;
+exports.isVirtualMachineEgressNetworked = isVirtualMachineEgressNetworked;
 exports.llmsApiSlice = llmsApiSlice;
 exports.mcpApiSlice = mcpApiSlice;
 exports.memoryApiSlice = memoryApiSlice;
@@ -49551,6 +49931,7 @@ exports.mentorReducer = mentorReducer;
 exports.moderationLogsApiReducer = moderationLogsApiReducer;
 exports.moderationLogsApiSlice = moderationLogsApiSlice;
 exports.monetizationApiSlice = monetizationApiSlice;
+exports.normalizeHostPort = normalizeHostPort;
 exports.normalizeLearnerCompletionError = normalizeLearnerCompletionError;
 exports.normalizeOutline = normalizeOutline;
 exports.normalizeUserLlmUsageError = normalizeUserLlmUsageError;
@@ -49573,6 +49954,7 @@ exports.skillsApiSlice = skillsApiSlice;
 exports.skillsMiddleware = skillsMiddleware;
 exports.skillsReducer = skillsReducer;
 exports.spendCapsApiSlice = spendCapsApiSlice;
+exports.splitHostPortInput = splitHostPortInput;
 exports.stripeApiSlice = stripeApiSlice;
 exports.studioAuthoringApiSlice = studioAuthoringApiSlice;
 exports.supportTicketsApiSlice = supportTicketsApiSlice;
@@ -49680,6 +50062,8 @@ exports.useCreateUserInstitutionMutation = useCreateUserInstitutionMutation;
 exports.useCreateUserInvitationMutation = useCreateUserInvitationMutation;
 exports.useCreateUserProjectMutation = useCreateUserProjectMutation;
 exports.useCreateUserResumeMutation = useCreateUserResumeMutation;
+exports.useCreateVirtualMachineNetworkPolicyMutation = useCreateVirtualMachineNetworkPolicyMutation;
+exports.useCreateVirtualMachineSecretMutation = useCreateVirtualMachineSecretMutation;
 exports.useCreateWatchedGroupMutation = useCreateWatchedGroupMutation;
 exports.useCreateWorkflowMutation = useCreateWorkflowMutation;
 exports.useDeactivateWorkflowMutation = useDeactivateWorkflowMutation;
@@ -49738,6 +50122,8 @@ exports.useDeleteUserEducationMutation = useDeleteUserEducationMutation;
 exports.useDeleteUserExperienceMutation = useDeleteUserExperienceMutation;
 exports.useDeleteUserProjectMutation = useDeleteUserProjectMutation;
 exports.useDeleteUserSpendCapMutation = useDeleteUserSpendCapMutation;
+exports.useDeleteVirtualMachineNetworkPolicyMutation = useDeleteVirtualMachineNetworkPolicyMutation;
+exports.useDeleteVirtualMachineSecretMutation = useDeleteVirtualMachineSecretMutation;
 exports.useDeleteWatchedGroupMutation = useDeleteWatchedGroupMutation;
 exports.useDeleteWatcherMutation = useDeleteWatcherMutation;
 exports.useDeleteWorkflowMutation = useDeleteWorkflowMutation;
@@ -50264,6 +50650,8 @@ exports.useLazyListOwnApplicationsQuery = useLazyListOwnApplicationsQuery;
 exports.useLazyListPaywallsQuery = useLazyListPaywallsQuery;
 exports.useLazyListPricesQuery = useLazyListPricesQuery;
 exports.useLazyListSubscribersQuery = useLazyListSubscribersQuery;
+exports.useLazyListVirtualMachineNetworkPoliciesQuery = useLazyListVirtualMachineNetworkPoliciesQuery;
+exports.useLazyListVirtualMachineSecretsQuery = useLazyListVirtualMachineSecretsQuery;
 exports.useLazyPlatformUserGroupsQuery = useLazyPlatformUserGroupsQuery;
 exports.useLazyPlatformUsersQuery = useLazyPlatformUsersQuery;
 exports.useLazyRefreshJwtTokenQuery = useLazyRefreshJwtTokenQuery;
@@ -50289,6 +50677,8 @@ exports.useListOwnApplicationsQuery = useListOwnApplicationsQuery;
 exports.useListPaywallsQuery = useListPaywallsQuery;
 exports.useListPricesQuery = useListPricesQuery;
 exports.useListSubscribersQuery = useListSubscribersQuery;
+exports.useListVirtualMachineNetworkPoliciesQuery = useListVirtualMachineNetworkPoliciesQuery;
+exports.useListVirtualMachineSecretsQuery = useListVirtualMachineSecretsQuery;
 exports.useMarkAllAsReadMutation = useMarkAllAsReadMutation;
 exports.useOauthFindMutation = useOauthFindMutation;
 exports.useOverrideGradeResultMutation = useOverrideGradeResultMutation;
@@ -50405,6 +50795,8 @@ exports.useUpdateUserProjectMutation = useUpdateUserProjectMutation;
 exports.useUpdateUserRoleMutation = useUpdateUserRoleMutation;
 exports.useUpdateUserStatusMutation = useUpdateUserStatusMutation;
 exports.useUpdateUserTrialStatusMutation = useUpdateUserTrialStatusMutation;
+exports.useUpdateVirtualMachineNetworkPolicyMutation = useUpdateVirtualMachineNetworkPolicyMutation;
+exports.useUpdateVirtualMachineSecretMutation = useUpdateVirtualMachineSecretMutation;
 exports.useUpdateWatchedGroupMutation = useUpdateWatchedGroupMutation;
 exports.useUpdateWatcherMutation = useUpdateWatcherMutation;
 exports.useUpdateWorkflowMutation = useUpdateWorkflowMutation;
@@ -50437,8 +50829,10 @@ exports.userApiSlice = userApiSlice;
 exports.userChatHistoryApiSlice = userChatHistoryApiSlice;
 exports.userInvitationsApiSlice = userInvitationsApiSlice;
 exports.userLlmUsageApiSlice = userLlmUsageApiSlice;
+exports.validateHostPort = validateHostPort;
 exports.validateLearnerCompletionArgs = validateLearnerCompletionArgs;
 exports.validateUserLlmUsageParams = validateUserLlmUsageParams;
+exports.virtualMachineApiSlice = virtualMachineApiSlice;
 exports.watchedGroupsApiSlice = watchedGroupsApiSlice;
 exports.workflowsApiSlice = workflowsApiSlice;
 //# sourceMappingURL=index.js.map