@iblai/data-layer 1.38.2 → 1.40.0

package/dist/index.js

@@ -42242,7 +42242,10 @@ const CREDENTIALS_CUSTOM_ENDPOINTS = {
 
 const credentialsCustomApiSlice = react.createApi({
     reducerPath: CREDENTIALS_CUSTOM_REDUCER_PATH,
-    baseQuery: iblFetchBaseQuery,
+    // The Secrets page hides a kind's rows on a 403 of its list and shows the
+    // retry notice on any other failure, which needs the status: RTK Query
+    // keeps only `{}` of a thrown `{ status, data }`.
+    baseQuery: withReturnedErrors(iblFetchBaseQuery),
     tagTypes: [
         'IntegrationCredentialsSchema',
         'CredentialsSchema',
@@ -42262,6 +42265,23 @@ const credentialsCustomApiSlice = react.createApi({
                 }),
             }),
             invalidatesTags: ['MaskedIntegrationCredentials'],
+            // The Secrets screens read the admin list and the VM secrets, and the
+            // backend deletes the secrets that read this credential with it. The
+            // slices are imported lazily: api-slice.ts imports this file.
+            async onQueryStarted(_args, { queryFulfilled, dispatch }) {
+                try {
+                    await queryFulfilled;
+                    const [{ credentialsApiSlice }, { virtualMachineApiSlice }] = await Promise.all([
+                        Promise.resolve().then(function () { return apiSlice$1; }),
+                        Promise.resolve().then(function () { return apiSlice; }),
+                    ]);
+                    dispatch(credentialsApiSlice.util.invalidateTags(['IntegrationCredentials']));
+                    dispatch(virtualMachineApiSlice.util.invalidateTags(['VirtualMachineSecrets']));
+                }
+                catch (_a) {
+                    // Only a successful delete invalidates.
+                }
+            },
         }),
         deleteCredential: builder.mutation({
             query: ({ org, name, platform_key, model_name }) => ({
@@ -42331,7 +42351,7 @@ const { useDeleteIntegrationCredentialMutation, useDeleteCredentialMutation, use
 const credentialsApiSlice = react.createApi({
     reducerPath: 'credentialsApiSlice',
     baseQuery: iblFakeBaseQuery,
-    tagTypes: ['Credentials', 'ProviderConfig', 'ExternalMapping'],
+    tagTypes: ['Credentials', 'ProviderConfig', 'ExternalMapping', 'IntegrationCredentials'],
     endpoints: (builder) => ({
         getCredentials: builder.query({
             ...buildEndpointFromService(exports.SERVICES.DM, async (args) => {
@@ -42431,11 +42451,15 @@ const credentialsApiSlice = react.createApi({
         createCallCredentials: builder.mutation({
             ...buildEndpointFromAxdService(AiMentorService.aiMentorOrgsUsersMentorsCreateCallCredentialsCreate),
         }),
+        // The admin list (ids + service_info), which the Secrets screens join
+        // with the VM secrets that read a credential.
         getIntegrationCredentials: builder.query({
             ...buildEndpointFromDmService(AiAccountService.aiAccountOrgsIntegrationCredentialRetrieve),
+            providesTags: ['IntegrationCredentials'],
         }),
         createIntegrationCredential: builder.mutation({
             ...buildEndpointFromDmService(AiAccountService.aiAccountOrgsIntegrationCredentialCreate),
+            invalidatesTags: ['IntegrationCredentials'],
             async onQueryStarted(_args, { queryFulfilled, dispatch }) {
                 try {
                     await queryFulfilled;
@@ -42448,9 +42472,42 @@ const credentialsApiSlice = react.createApi({
         }),
         createLLMCredential: builder.mutation({
             ...buildEndpointFromDmService(AiAccountService.aiAccountOrgsCredentialCreate),
+            async onQueryStarted(_args, { queryFulfilled, dispatch }) {
+                try {
+                    await queryFulfilled;
+                    dispatch(credentialsCustomApiSlice.util.invalidateTags(['MaskedLLMCredentials']));
+                }
+                catch (_a) {
+                    // Swallow — invalidation should only happen on success.
+                }
+            },
+        }),
+        // PATCH `/credential/` replaces the whole value for every provider but
+        // Azure OpenAI, whose per-model values the backend merges.
+        updateLLMCredential: builder.mutation({
+            ...buildEndpointFromDmService(AiAccountService.aiAccountOrgsCredentialPartialUpdate),
+            async onQueryStarted(_args, { queryFulfilled, dispatch }) {
+                try {
+                    await queryFulfilled;
+                    dispatch(credentialsCustomApiSlice.util.invalidateTags(['MaskedLLMCredentials']));
+                }
+                catch (_a) {
+                    // Swallow — invalidation should only happen on success.
+                }
+            },
         }),
         updateIntegrationCredential: builder.mutation({
             ...buildEndpointFromDmService(AiAccountService.aiAccountOrgsIntegrationCredentialPartialUpdate),
+            invalidatesTags: ['IntegrationCredentials'],
+            async onQueryStarted(_args, { queryFulfilled, dispatch }) {
+                try {
+                    await queryFulfilled;
+                    dispatch(credentialsCustomApiSlice.util.invalidateTags(['MaskedIntegrationCredentials']));
+                }
+                catch (_a) {
+                    // Swallow — invalidation should only happen on success.
+                }
+            },
         }),
         getConnectedServiceAuthUrl: builder.query({
             queryFn: async (queryParams, api, extraOptions) => {
@@ -42561,7 +42618,45 @@ const credentialsApiSlice = react.createApi({
         }),
     }),
 });
-const { useGetCredentialsQuery, useLazyGetCredentialsQuery, useGetUserCredentialsQuery, useLazyGetUserCredentialsQuery, useCreateCallCredentialsMutation, useGetIntegrationCredentialsQuery, useLazyGetIntegrationCredentialsQuery, useCreateIntegrationCredentialMutation, useUpdateIntegrationCredentialMutation, useGetLLMCredentialsQuery, useLazyGetLLMCredentialsQuery, useCreateLLMCredentialMutation, useGetConnectedServiceAuthUrlQuery, useLazyGetConnectedServiceAuthUrlQuery, useConnectedServicesCallbackQuery, useLazyConnectedServicesCallbackQuery, useGetUsersAsAssertionsQuery, useLazyGetUsersAsAssertionsQuery, useCreateCredentialAssertionMutation, useGetCredentialsListQuery, useLazyGetCredentialsListQuery, useCreateCredentialMutation, useUpdateCredentialMutation, useDeleteCourseCredentialMutation, useGetProviderConfigQuery, useLazyGetProviderConfigQuery, useCreateProviderConfigMutation, useDeleteProviderConfigMutation, useGetExternalMappingQuery, useLazyGetExternalMappingQuery, useCreateExternalMappingMutation, useDeleteExternalMappingMutation, } = credentialsApiSlice;
+const { useGetCredentialsQuery, useLazyGetCredentialsQuery, useGetUserCredentialsQuery, useLazyGetUserCredentialsQuery, useCreateCallCredentialsMutation, useGetIntegrationCredentialsQuery, useLazyGetIntegrationCredentialsQuery, useCreateIntegrationCredentialMutation, useUpdateIntegrationCredentialMutation, useGetLLMCredentialsQuery, useLazyGetLLMCredentialsQuery, useCreateLLMCredentialMutation, useUpdateLLMCredentialMutation, useGetConnectedServiceAuthUrlQuery, useLazyGetConnectedServiceAuthUrlQuery, useConnectedServicesCallbackQuery, useLazyConnectedServicesCallbackQuery, useGetUsersAsAssertionsQuery, useLazyGetUsersAsAssertionsQuery, useCreateCredentialAssertionMutation, useGetCredentialsListQuery, useLazyGetCredentialsListQuery, useCreateCredentialMutation, useUpdateCredentialMutation, useDeleteCourseCredentialMutation, useGetProviderConfigQuery, useLazyGetProviderConfigQuery, useCreateProviderConfigMutation, useDeleteProviderConfigMutation, useGetExternalMappingQuery, useLazyGetExternalMappingQuery, useCreateExternalMappingMutation, useDeleteExternalMappingMutation, } = credentialsApiSlice;
+
+var apiSlice$1 = /*#__PURE__*/Object.freeze({
+  __proto__: null,
+  credentialsApiSlice: credentialsApiSlice,
+  useConnectedServicesCallbackQuery: useConnectedServicesCallbackQuery,
+  useCreateCallCredentialsMutation: useCreateCallCredentialsMutation,
+  useCreateCredentialAssertionMutation: useCreateCredentialAssertionMutation,
+  useCreateCredentialMutation: useCreateCredentialMutation,
+  useCreateExternalMappingMutation: useCreateExternalMappingMutation,
+  useCreateIntegrationCredentialMutation: useCreateIntegrationCredentialMutation,
+  useCreateLLMCredentialMutation: useCreateLLMCredentialMutation,
+  useCreateProviderConfigMutation: useCreateProviderConfigMutation,
+  useDeleteCourseCredentialMutation: useDeleteCourseCredentialMutation,
+  useDeleteExternalMappingMutation: useDeleteExternalMappingMutation,
+  useDeleteProviderConfigMutation: useDeleteProviderConfigMutation,
+  useGetConnectedServiceAuthUrlQuery: useGetConnectedServiceAuthUrlQuery,
+  useGetCredentialsListQuery: useGetCredentialsListQuery,
+  useGetCredentialsQuery: useGetCredentialsQuery,
+  useGetExternalMappingQuery: useGetExternalMappingQuery,
+  useGetIntegrationCredentialsQuery: useGetIntegrationCredentialsQuery,
+  useGetLLMCredentialsQuery: useGetLLMCredentialsQuery,
+  useGetProviderConfigQuery: useGetProviderConfigQuery,
+  useGetUserCredentialsQuery: useGetUserCredentialsQuery,
+  useGetUsersAsAssertionsQuery: useGetUsersAsAssertionsQuery,
+  useLazyConnectedServicesCallbackQuery: useLazyConnectedServicesCallbackQuery,
+  useLazyGetConnectedServiceAuthUrlQuery: useLazyGetConnectedServiceAuthUrlQuery,
+  useLazyGetCredentialsListQuery: useLazyGetCredentialsListQuery,
+  useLazyGetCredentialsQuery: useLazyGetCredentialsQuery,
+  useLazyGetExternalMappingQuery: useLazyGetExternalMappingQuery,
+  useLazyGetIntegrationCredentialsQuery: useLazyGetIntegrationCredentialsQuery,
+  useLazyGetLLMCredentialsQuery: useLazyGetLLMCredentialsQuery,
+  useLazyGetProviderConfigQuery: useLazyGetProviderConfigQuery,
+  useLazyGetUserCredentialsQuery: useLazyGetUserCredentialsQuery,
+  useLazyGetUsersAsAssertionsQuery: useLazyGetUsersAsAssertionsQuery,
+  useUpdateCredentialMutation: useUpdateCredentialMutation,
+  useUpdateIntegrationCredentialMutation: useUpdateIntegrationCredentialMutation,
+  useUpdateLLMCredentialMutation: useUpdateLLMCredentialMutation
+});
 
 const chatPrivacyApiSlice = react.createApi({
     reducerPath: 'chatPrivacyApiSlice',
@@ -48182,6 +48277,45 @@ const getSpendCapExceededError = (error) => {
     return null;
 };
 
+// Backend contract: iblai-dm-pro#3150 (iblai-platform#2766). The endpoint is
+// mounted at the DM root, not under /api/ai-mentor/, and scopes its answer to
+// the tenant named in the `iblai-org` header.
+const AGENT_SETTINGS_REDUCER_PATH = 'agentSettingsApiSlice';
+const AGENT_SETTINGS_FIELD_PERMISSIONS_PATH = '/v1/agents/settings/field-permissions';
+const IBLAI_ORG_HEADER = 'iblai-org';
+const AGENT_SETTINGS_QUERY_KEYS = {
+    FIELD_PERMISSIONS: 'AGENT_SETTINGS_FIELD_PERMISSIONS',
+};
+
+const agentSettingsApiSlice = react.createApi({
+    reducerPath: AGENT_SETTINGS_REDUCER_PATH,
+    tagTypes: [AGENT_SETTINGS_QUERY_KEYS.FIELD_PERMISSIONS],
+    baseQuery: iblFetchBaseQuery,
+    endpoints: (builder) => ({
+        /**
+         * Which create-agent fields the caller may write. A 403 means they may not
+         * create agents at all and a 404 an older backend; both are returned as
+         * `{ error }` so the form can fail open on them instead of logging out.
+         */
+        getAgentSettingsFieldPermissions: builder.query({
+            query: ({ org }) => ({
+                url: AGENT_SETTINGS_FIELD_PERMISSIONS_PATH,
+                service: exports.SERVICES.DM,
+                method: 'GET',
+                headers: { [IBLAI_ORG_HEADER]: org },
+                returnErrorStatuses: [403, 404],
+            }),
+            // The answer is advisory (the form fails open without it), so a failure
+            // frees the form at once instead of holding it through three retries.
+            extraOptions: { maxRetries: 0 },
+            providesTags: (_result, _error, { org }) => [
+                { type: AGENT_SETTINGS_QUERY_KEYS.FIELD_PERMISSIONS, id: org },
+            ],
+        }),
+    }),
+});
+const { useGetAgentSettingsFieldPermissionsQuery, useLazyGetAgentSettingsFieldPermissionsQuery, } = agentSettingsApiSlice;
+
 exports.recommendationPromptTypeEnum = void 0;
 (function (recommendationPromptTypeEnum) {
     recommendationPromptTypeEnum["mentors"] = "mentors";
@@ -49953,11 +50087,51 @@ const VIRTUAL_MACHINE_REJECTED_HOST_SUFFIXES = [
 ];
 /** `env_var` of a VM secret: a POSIX-style environment variable name. */
 const VIRTUAL_MACHINE_ENV_VAR_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** The backend caps `env_var` at 128 characters. */
+const VIRTUAL_MACHINE_ENV_VAR_MAX_LENGTH = 128;
+/**
+ * Variable names the UI refuses for a secret. The backend only checks the
+ * POSIX shape, but the sandbox sets `env_var` in the VM's environment, so a
+ * secret named PATH or LD_PRELOAD would break every command run there.
+ */
+const VIRTUAL_MACHINE_RESERVED_ENV_VARS = [
+    'PATH',
+    'HOME',
+    'USER',
+    'LOGNAME',
+    'SHELL',
+    'PWD',
+    'OLDPWD',
+    'TMPDIR',
+    'TERM',
+    'LANG',
+    'LANGUAGE',
+    'LC_ALL',
+    'LD_PRELOAD',
+    'LD_LIBRARY_PATH',
+    'PYTHONPATH',
+    'PYTHONHOME',
+    'NODE_OPTIONS',
+    'HTTP_PROXY',
+    'HTTPS_PROXY',
+    'NO_PROXY',
+];
+/** Prefixes the sandbox and ibl.ai keep for their own variables. */
+const VIRTUAL_MACHINE_RESERVED_ENV_VAR_PREFIXES = ['MSB_', 'IBLAI_'];
+/**
+ * The port a bare hostname gets in an allowlist. Secrets are only ever
+ * swapped into HTTPS requests, so `api.acme.com` means `api.acme.com:443`.
+ */
+const VIRTUAL_MACHINE_DEFAULT_HOST_PORT = 443;
 /** A network policy holds between 1 and 100 hosts. */
 const VIRTUAL_MACHINE_MAX_POLICY_HOSTS = 100;
 /** An agent may bind at most 20 VM secrets. */
 const VIRTUAL_MACHINE_MAX_SECRETS_PER_MENTOR = 20;
-/** A pasted secret value must be at least this long. */
+/**
+ * The backend's floor for a pasted secret value (its output scrubber blanks
+ * every occurrence of a bound value, so a very short one would blank too
+ * much). The UI no longer checks it; a refusal is shown under the Key field.
+ */
 const VIRTUAL_MACHINE_SECRET_VALUE_MIN_LENGTH = 8;
 /**
  * Default VM runtime billing: charged to the chatting user's credits, prorated
@@ -49977,12 +50151,14 @@ const VIRTUAL_MACHINE_DEFAULT_BILLING = {
  * Hand-written: these endpoints are newer than the pinned `@iblai/iblai-api`
  * release. Records are keyed in the body (PATCH) or the query string (DELETE),
  * never in the URL. A 403 on either list means the caller lacks the matching
- * `Ibl.Mentor/VirtualMachine…/list` permission — hosts hide the pages then.
+ * `Ibl.Mentor/VirtualMachine…/list` permission — hosts hide the pages then,
+ * which needs the status: the base query returns failures rather than throwing
+ * them, since RTK Query keeps only `{}` of a thrown `{ status, data }`.
  */
 const virtualMachineApiSlice = react.createApi({
     reducerPath: VIRTUAL_MACHINE_REDUCER_PATH,
     tagTypes: [VIRTUAL_MACHINE_QUERY_KEYS.NETWORK_POLICIES, VIRTUAL_MACHINE_QUERY_KEYS.SECRETS],
-    baseQuery: iblFetchBaseQuery,
+    baseQuery: withReturnedErrors(iblFetchBaseQuery),
     endpoints: (builder) => ({
         // ── Network policies ────────────────────────────────────────────────
         listVirtualMachineNetworkPolicies: builder.query({
@@ -50063,6 +50239,21 @@ const virtualMachineApiSlice = react.createApi({
 });
 const { useListVirtualMachineNetworkPoliciesQuery, useLazyListVirtualMachineNetworkPoliciesQuery, useCreateVirtualMachineNetworkPolicyMutation, useUpdateVirtualMachineNetworkPolicyMutation, useDeleteVirtualMachineNetworkPolicyMutation, useListVirtualMachineSecretsQuery, useLazyListVirtualMachineSecretsQuery, useCreateVirtualMachineSecretMutation, useUpdateVirtualMachineSecretMutation, useDeleteVirtualMachineSecretMutation, } = virtualMachineApiSlice;
 
+var apiSlice = /*#__PURE__*/Object.freeze({
+  __proto__: null,
+  useCreateVirtualMachineNetworkPolicyMutation: useCreateVirtualMachineNetworkPolicyMutation,
+  useCreateVirtualMachineSecretMutation: useCreateVirtualMachineSecretMutation,
+  useDeleteVirtualMachineNetworkPolicyMutation: useDeleteVirtualMachineNetworkPolicyMutation,
+  useDeleteVirtualMachineSecretMutation: useDeleteVirtualMachineSecretMutation,
+  useLazyListVirtualMachineNetworkPoliciesQuery: useLazyListVirtualMachineNetworkPoliciesQuery,
+  useLazyListVirtualMachineSecretsQuery: useLazyListVirtualMachineSecretsQuery,
+  useListVirtualMachineNetworkPoliciesQuery: useListVirtualMachineNetworkPoliciesQuery,
+  useListVirtualMachineSecretsQuery: useListVirtualMachineSecretsQuery,
+  useUpdateVirtualMachineNetworkPolicyMutation: useUpdateVirtualMachineNetworkPolicyMutation,
+  useUpdateVirtualMachineSecretMutation: useUpdateVirtualMachineSecretMutation,
+  virtualMachineApiSlice: virtualMachineApiSlice
+});
+
 /**
  * Normalise a `host:port` entry the way the backend stores it: trimmed and
  * lowercased.
@@ -50070,13 +50261,78 @@ const { useListVirtualMachineNetworkPoliciesQuery, useLazyListVirtualMachineNetw
 function normalizeHostPort(value) {
     return value.trim().toLowerCase();
 }
+const SCHEME_PORTS = { 'https:': 443, 'http:': 80 };
+// A loop rather than `/x+$/`, which takes quadratic time on a long run of x
+// that does not reach the end (CodeQL js/polynomial-redos).
+function trimChar(value, char, { start = false } = {}) {
+    let from = 0;
+    let to = value.length;
+    if (start)
+        while (from < to && value[from] === char)
+            from += 1;
+    while (to > from && value[to - 1] === char)
+        to -= 1;
+    return value.slice(from, to);
+}
+/**
+ * Turn what a person typed or pasted into the `host:port` the backend stores.
+ * People paste the address from a service's instructions, so a whole URL
+ * (`https://api.acme.com/v1/keys`) is reduced to its host, with the scheme's
+ * port unless the URL names one; `api.acme.com/v1` loses its path; a trailing
+ * dot goes. Anything unparseable comes back trimmed and lowercased so
+ * `validateHostPort` can explain it.
+ */
+function normalizeHostInput(value, options = {}) {
+    let entry = normalizeHostPort(value);
+    if (entry.length === 0)
+        return entry;
+    let port = null;
+    if (entry.includes('://')) {
+        try {
+            const url = new URL(entry);
+            if (!url.hostname)
+                return entry;
+            port = url.port || (SCHEME_PORTS[url.protocol] ? String(SCHEME_PORTS[url.protocol]) : null);
+            entry = url.hostname;
+        }
+        catch (_a) {
+            return entry;
+        }
+    }
+    else {
+        const pathStart = entry.search(/[/?#]/);
+        if (pathStart !== -1)
+            entry = entry.slice(0, pathStart);
+    }
+    if (port === null) {
+        const separator = entry.lastIndexOf(':');
+        if (separator !== -1) {
+            port = entry.slice(separator + 1);
+            entry = entry.slice(0, separator);
+        }
+    }
+    entry = trimChar(entry, '.');
+    if (entry.length === 0)
+        return entry;
+    if (port)
+        return `${entry}:${port}`;
+    return options.defaultPort !== undefined ? `${entry}:${options.defaultPort}` : entry;
+}
 /** Split a pasted or typed string into candidate `host:port` entries. */
-function splitHostPortInput(value) {
+function splitHostPortInput(value, options = {}) {
     return value
         .split(/[\s,;]+/)
-        .map(normalizeHostPort)
+        .map((entry) => normalizeHostInput(entry, options))
         .filter((entry) => entry.length > 0);
 }
+/**
+ * The `host:port` a person reads: the standard HTTPS port is implied, so
+ * `api.acme.com:443` shows as `api.acme.com`; any other port stays visible.
+ * The stored and compared form is never changed by this.
+ */
+function formatHostPort(entry) {
+    return entry.endsWith(':443') ? entry.slice(0, -4) : entry;
+}
 const IPV4_PATTERN = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
 /** Whether the host part is an IPv4 literal (the `host:port` grammar admits no IPv6). */
 function isIpAddressHost(host) {
@@ -50232,6 +50488,75 @@ function findUncoveredSecretHosts(secrets, allowedHosts) {
     }
     return uncovered;
 }
+/** Whether a variable name is one the VM itself relies on (see the reserved list). */
+function isReservedEnvVar(name) {
+    const upper = name.toUpperCase();
+    if (VIRTUAL_MACHINE_RESERVED_ENV_VARS.includes(upper))
+        return true;
+    return VIRTUAL_MACHINE_RESERVED_ENV_VAR_PREFIXES.some((prefix) => upper.startsWith(prefix));
+}
+const ENV_VAR_WORDS = ['KEY', 'TOKEN', 'SECRET', 'PASSWORD'];
+const ENV_VAR_FALLBACK = 'SECRET';
+/** Leaves room for a `_NN` suffix under the backend's 128-character cap. */
+const ENV_VAR_DERIVED_MAX_LENGTH = VIRTUAL_MACHINE_ENV_VAR_MAX_LENGTH - 8;
+/**
+ * The variable name a secret gets from its display name, so a person never
+ * has to invent one: "Acme API key" → `ACME_API_KEY`, "Clé Stripe" →
+ * `CLE_STRIPE_KEY`. Accents are folded, every other run of characters becomes
+ * an underscore, a leading digit gets `KEY_` in front, a name without
+ * KEY/TOKEN/SECRET/PASSWORD gets `_KEY` (which also keeps "Path" from
+ * becoming the VM's PATH), nothing derivable falls back to `SECRET`, and a
+ * clash with `taken` gets `_2`, `_3`, …
+ */
+function deriveSecretEnvVar(name, options = {}) {
+    var _a;
+    let base = trimChar(name
+        .normalize('NFKD')
+        .replace(/[\u0300-\u036f]/g, '')
+        .toUpperCase()
+        .replace(/[^A-Z0-9]+/g, '_'), '_', { start: true }).replace(/_{2,}/g, '_');
+    if (base.length === 0)
+        base = ENV_VAR_FALLBACK;
+    if (/^[0-9]/.test(base))
+        base = `KEY_${base}`;
+    if (!ENV_VAR_WORDS.some((word) => base.split('_').includes(word)))
+        base = `${base}_KEY`;
+    if (isReservedEnvVar(base))
+        base = `KEY_${base}`;
+    base = trimChar(base.slice(0, ENV_VAR_DERIVED_MAX_LENGTH), '_');
+    const taken = new Set(((_a = options.taken) !== null && _a !== void 0 ? _a : []).map((entry) => entry.toUpperCase()));
+    if (!taken.has(base))
+        return base;
+    for (let suffix = 2;; suffix += 1) {
+        const candidate = `${base}_${suffix}`;
+        if (!taken.has(candidate))
+            return candidate;
+    }
+}
+function validateSecretEnvVar(value, options = {}) {
+    var _a;
+    const entry = value.trim();
+    if (entry.length === 0)
+        return 'required';
+    if (!VIRTUAL_MACHINE_ENV_VAR_PATTERN.test(entry))
+        return 'format';
+    if (entry.length > VIRTUAL_MACHINE_ENV_VAR_MAX_LENGTH)
+        return 'too_long';
+    if (isReservedEnvVar(entry))
+        return 'reserved';
+    const upper = entry.toUpperCase();
+    if (((_a = options.taken) !== null && _a !== void 0 ? _a : []).some((taken) => taken.toUpperCase() === upper))
+        return 'taken';
+    return null;
+}
+/**
+ * The backend refuses a duplicate variable with a plain-string 400
+ * (`"ACME_KEY already exists for this organization."`), not a field error,
+ * so the form has to recognise it to put the message under the right field.
+ */
+function isSecretEnvVarTakenMessage(message) {
+    return /already exists/i.test(message !== null && message !== void 0 ? message : '');
+}
 
 const mentorReducer = {
     [mentorApiSlice.reducerPath]: mentorApiSlice.reducer,
@@ -50295,6 +50620,7 @@ const mentorReducer = {
     [supportTicketsApiSlice.reducerPath]: supportTicketsApiSlice.reducer,
     [gradingApiSlice.reducerPath]: gradingApiSlice.reducer,
     [spendCapsApiSlice.reducerPath]: spendCapsApiSlice.reducer,
+    [agentSettingsApiSlice.reducerPath]: agentSettingsApiSlice.reducer,
     [userChatHistoryApiSlice.reducerPath]: userChatHistoryApiSlice.reducer,
     [virtualMachineApiSlice.reducerPath]: virtualMachineApiSlice.reducer,
     [userLlmUsageApiSlice.reducerPath]: userLlmUsageApiSlice.reducer,
@@ -50361,6 +50687,7 @@ const mentorMiddleware = [
     supportTicketsApiSlice.middleware,
     gradingApiSlice.middleware,
     spendCapsApiSlice.middleware,
+    agentSettingsApiSlice.middleware,
     userChatHistoryApiSlice.middleware,
     virtualMachineApiSlice.middleware,
     userLlmUsageApiSlice.middleware,
@@ -50408,6 +50735,7 @@ const skillsReducer = {
     [studioAuthoringApiSlice.reducerPath]: studioAuthoringApiSlice.reducer,
     [watchedGroupsApiSlice.reducerPath]: watchedGroupsApiSlice.reducer,
     [spendCapsApiSlice.reducerPath]: spendCapsApiSlice.reducer,
+    [agentSettingsApiSlice.reducerPath]: agentSettingsApiSlice.reducer,
     [chatPrivacyApiSlice.reducerPath]: chatPrivacyApiSlice.reducer,
     [agentSkillsApiSlice.reducerPath]: agentSkillsApiSlice.reducer,
     [userChatHistoryApiSlice.reducerPath]: userChatHistoryApiSlice.reducer,
@@ -50457,6 +50785,7 @@ const skillsMiddleware = [
     studioAuthoringApiSlice.middleware,
     watchedGroupsApiSlice.middleware,
     spendCapsApiSlice.middleware,
+    agentSettingsApiSlice.middleware,
     chatPrivacyApiSlice.middleware,
     agentSkillsApiSlice.middleware,
     userChatHistoryApiSlice.middleware,
@@ -50479,6 +50808,9 @@ const initializeDataLayer = (dmUrl, lmsUrl, legacyLmsUrl, storageService, httpEr
     Config.edxProxyEnabled = (_a = options === null || options === void 0 ? void 0 : options.edxProxy) !== null && _a !== void 0 ? _a : false;
 };
 
+exports.AGENT_SETTINGS_FIELD_PERMISSIONS_PATH = AGENT_SETTINGS_FIELD_PERMISSIONS_PATH;
+exports.AGENT_SETTINGS_QUERY_KEYS = AGENT_SETTINGS_QUERY_KEYS;
+exports.AGENT_SETTINGS_REDUCER_PATH = AGENT_SETTINGS_REDUCER_PATH;
 exports.AGENT_SKILLS_ENDPOINTS = AGENT_SKILLS_ENDPOINTS;
 exports.AGENT_SKILLS_REDUCER_PATH = AGENT_SKILLS_REDUCER_PATH;
 exports.AGENT_SKILLS_TAG_TYPES = AGENT_SKILLS_TAG_TYPES;
@@ -50526,6 +50858,7 @@ exports.GRADING_REDUCER_PATH = GRADING_REDUCER_PATH;
 exports.HOSTING_ENDPOINTS = HOSTING_ENDPOINTS;
 exports.HOSTING_QUERY_KEYS = HOSTING_QUERY_KEYS;
 exports.HOSTING_REDUCER_PATH = HOSTING_REDUCER_PATH;
+exports.IBLAI_ORG_HEADER = IBLAI_ORG_HEADER;
 exports.IblDataLayer = IblDataLayer;
 exports.LEARNER_COMPLETION_PATH = LEARNER_COMPLETION_PATH;
 exports.LOGO_ENDPOINTS = LOGO_ENDPOINTS;
@@ -50590,8 +50923,10 @@ exports.USER_PROGRESS_DATA_POINTS = USER_PROGRESS_DATA_POINTS;
 exports.USER_PROGRESS_SUMMARY_TYPE = USER_PROGRESS_SUMMARY_TYPE;
 exports.VERCEL_SPA = VERCEL_SPA;
 exports.VIRTUAL_MACHINE_DEFAULT_BILLING = VIRTUAL_MACHINE_DEFAULT_BILLING;
+exports.VIRTUAL_MACHINE_DEFAULT_HOST_PORT = VIRTUAL_MACHINE_DEFAULT_HOST_PORT;
 exports.VIRTUAL_MACHINE_EGRESS_PROFILES = VIRTUAL_MACHINE_EGRESS_PROFILES;
 exports.VIRTUAL_MACHINE_ENDPOINTS = VIRTUAL_MACHINE_ENDPOINTS;
+exports.VIRTUAL_MACHINE_ENV_VAR_MAX_LENGTH = VIRTUAL_MACHINE_ENV_VAR_MAX_LENGTH;
 exports.VIRTUAL_MACHINE_ENV_VAR_PATTERN = VIRTUAL_MACHINE_ENV_VAR_PATTERN;
 exports.VIRTUAL_MACHINE_HOST_PORT_PATTERN = VIRTUAL_MACHINE_HOST_PORT_PATTERN;
 exports.VIRTUAL_MACHINE_MAX_POLICY_HOSTS = VIRTUAL_MACHINE_MAX_POLICY_HOSTS;
@@ -50601,6 +50936,8 @@ exports.VIRTUAL_MACHINE_QUERY_KEYS = VIRTUAL_MACHINE_QUERY_KEYS;
 exports.VIRTUAL_MACHINE_REDUCER_PATH = VIRTUAL_MACHINE_REDUCER_PATH;
 exports.VIRTUAL_MACHINE_REJECTED_HOSTS = VIRTUAL_MACHINE_REJECTED_HOSTS;
 exports.VIRTUAL_MACHINE_REJECTED_HOST_SUFFIXES = VIRTUAL_MACHINE_REJECTED_HOST_SUFFIXES;
+exports.VIRTUAL_MACHINE_RESERVED_ENV_VARS = VIRTUAL_MACHINE_RESERVED_ENV_VARS;
+exports.VIRTUAL_MACHINE_RESERVED_ENV_VAR_PREFIXES = VIRTUAL_MACHINE_RESERVED_ENV_VAR_PREFIXES;
 exports.VIRTUAL_MACHINE_SECRET_VALUE_MIN_LENGTH = VIRTUAL_MACHINE_SECRET_VALUE_MIN_LENGTH;
 exports.WATCHED_GROUPS_ENDPOINTS = WATCHED_GROUPS_ENDPOINTS;
 exports.WATCHED_GROUPS_QUERY_KEYS = WATCHED_GROUPS_QUERY_KEYS;
@@ -50610,6 +50947,7 @@ exports.WATCHER_NOTIFICATION_EVENT_LABELS = WATCHER_NOTIFICATION_EVENT_LABELS;
 exports.WORKFLOWS_ENDPOINTS = WORKFLOWS_ENDPOINTS;
 exports.WORKFLOWS_QUERY_KEYS = WORKFLOWS_QUERY_KEYS;
 exports.WORKFLOWS_REDUCER_PATH = WORKFLOWS_REDUCER_PATH;
+exports.agentSettingsApiSlice = agentSettingsApiSlice;
 exports.agentSkillsApiSlice = agentSkillsApiSlice;
 exports.analyticsApiSlice = analyticsApiSlice;
 exports.apiKeysApiReducer = apiKeysApiReducer;
@@ -50649,6 +50987,7 @@ exports.credentialsCustomApiSlice = credentialsCustomApiSlice;
 exports.customAiSearchApiSlice = customAiSearchApiSlice;
 exports.customDomainApiSlice = customDomainApiSlice;
 exports.datasetsApiSlice = datasetsApiSlice;
+exports.deriveSecretEnvVar = deriveSecretEnvVar;
 exports.disclaimersApiSlice = disclaimersApiSlice;
 exports.edxProctoringApiSlice = edxProctoringApiSlice;
 exports.edxSsoApiSlice = edxSsoApiSlice;
@@ -50667,6 +51006,7 @@ exports.filterSlashSkills = filterSlashSkills;
 exports.findResumeBlock = findResumeBlock;
 exports.findUncoveredSecretHosts = findUncoveredSecretHosts;
 exports.flattenOutline = flattenOutline;
+exports.formatHostPort = formatHostPort;
 exports.getNextRecentMessagesPageParam = getNextRecentMessagesPageParam;
 exports.getSections = getSections;
 exports.getSpendCapExceededError = getSpendCapExceededError;
@@ -50683,6 +51023,8 @@ exports.isPoliciesResponse = isPoliciesResponse;
 exports.isPrivacyBlockedError = isPrivacyBlockedError;
 exports.isRejectedHostname = isRejectedHostname;
 exports.isRejectedIpAddress = isRejectedIpAddress;
+exports.isReservedEnvVar = isReservedEnvVar;
+exports.isSecretEnvVarTakenMessage = isSecretEnvVarTakenMessage;
 exports.isSpendCapExceededErrorBody = isSpendCapExceededErrorBody;
 exports.isUserLlmUsageEmpty = isUserLlmUsageEmpty;
 exports.isValidHostPort = isValidHostPort;
@@ -50700,6 +51042,7 @@ exports.mentorReducer = mentorReducer;
 exports.moderationLogsApiReducer = moderationLogsApiReducer;
 exports.moderationLogsApiSlice = moderationLogsApiSlice;
 exports.monetizationApiSlice = monetizationApiSlice;
+exports.normalizeHostInput = normalizeHostInput;
 exports.normalizeHostPort = normalizeHostPort;
 exports.normalizeLearnerCompletionError = normalizeLearnerCompletionError;
 exports.normalizeOutline = normalizeOutline;
@@ -50921,6 +51264,7 @@ exports.useGetAdminProjectDetailsQuery = useGetAdminProjectDetailsQuery;
 exports.useGetAdminProjectsQuery = useGetAdminProjectsQuery;
 exports.useGetAgentConfigQuery = useGetAgentConfigQuery;
 exports.useGetAgentCostQuery = useGetAgentCostQuery;
+exports.useGetAgentSettingsFieldPermissionsQuery = useGetAgentSettingsFieldPermissionsQuery;
 exports.useGetAgentSkillQuery = useGetAgentSkillQuery;
 exports.useGetAgentSkillResourceQuery = useGetAgentSkillResourceQuery;
 exports.useGetAgentSkillResourcesQuery = useGetAgentSkillResourcesQuery;
@@ -51213,6 +51557,7 @@ exports.useLazyGetAccountBillingInfoQuery = useLazyGetAccountBillingInfoQuery;
 exports.useLazyGetAdminProjectDetailsQuery = useLazyGetAdminProjectDetailsQuery;
 exports.useLazyGetAdminProjectsQuery = useLazyGetAdminProjectsQuery;
 exports.useLazyGetAgentConfigQuery = useLazyGetAgentConfigQuery;
+exports.useLazyGetAgentSettingsFieldPermissionsQuery = useLazyGetAgentSettingsFieldPermissionsQuery;
 exports.useLazyGetAgentSkillResourcesQuery = useLazyGetAgentSkillResourcesQuery;
 exports.useLazyGetAgentSkillsQuery = useLazyGetAgentSkillsQuery;
 exports.useLazyGetAgentSpendCapQuery = useLazyGetAgentSpendCapQuery;
@@ -51545,6 +51890,7 @@ exports.useUpdateGlobalMemoryMutation = useUpdateGlobalMemoryMutation;
 exports.useUpdateGraderCriterionMutation = useUpdateGraderCriterionMutation;
 exports.useUpdateHostingDomainMutation = useUpdateHostingDomainMutation;
 exports.useUpdateIntegrationCredentialMutation = useUpdateIntegrationCredentialMutation;
+exports.useUpdateLLMCredentialMutation = useUpdateLLMCredentialMutation;
 exports.useUpdateLtiKeyMutation = useUpdateLtiKeyMutation;
 exports.useUpdateLtiMentorMutation = useUpdateLtiMentorMutation;
 exports.useUpdateLtiToolMutation = useUpdateLtiToolMutation;
@@ -51631,6 +51977,7 @@ exports.userInvitationsApiSlice = userInvitationsApiSlice;
 exports.userLlmUsageApiSlice = userLlmUsageApiSlice;
 exports.validateHostPort = validateHostPort;
 exports.validateLearnerCompletionArgs = validateLearnerCompletionArgs;
+exports.validateSecretEnvVar = validateSecretEnvVar;
 exports.validateUserLlmUsageParams = validateUserLlmUsageParams;
 exports.virtualMachineApiSlice = virtualMachineApiSlice;
 exports.watchedGroupsApiSlice = watchedGroupsApiSlice;