@iblai/data-layer 1.39.0 → 1.40.0

package/dist/src/features/virtual-machine/__tests__/api-slice.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/features/virtual-machine/__tests__/utils.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/features/virtual-machine/api-slice.d.ts

@@ -7,7 +7,9 @@ import type { CreateVirtualMachineNetworkPolicyArgs, CreateVirtualMachineSecretA
  * Hand-written: these endpoints are newer than the pinned `@iblai/iblai-api`
  * release. Records are keyed in the body (PATCH) or the query string (DELETE),
  * never in the URL. A 403 on either list means the caller lacks the matching
- * `Ibl.Mentor/VirtualMachine…/list` permission — hosts hide the pages then.
+ * `Ibl.Mentor/VirtualMachine…/list` permission — hosts hide the pages then,
+ * which needs the status: the base query returns failures rather than throwing
+ * them, since RTK Query keeps only `{}` of a thrown `{ status, data }`.
  */
 export declare const virtualMachineApiSlice: import("@reduxjs/toolkit/query").Api<import("@reduxjs/toolkit/query").BaseQueryFn<import("@data-layer/features/utils").CustomQueryArgs, unknown, import("@data-layer/features/utils").ExtendedFetchBaseQueryError, Record<string, unknown>, import("@reduxjs/toolkit/query").FetchBaseQueryMeta>, {
     listVirtualMachineNetworkPolicies: import("@reduxjs/toolkit/query").QueryDefinition<ListVirtualMachineNetworkPoliciesArgs, import("@reduxjs/toolkit/query").BaseQueryFn<import("@data-layer/features/utils").CustomQueryArgs, unknown, import("@data-layer/features/utils").ExtendedFetchBaseQueryError, Record<string, unknown>, import("@reduxjs/toolkit/query").FetchBaseQueryMeta>, "VirtualMachineNetworkPolicies" | "VirtualMachineSecrets", VirtualMachineNetworkPolicy[], "virtualMachineApiSlice", unknown>;
@@ -81,7 +83,7 @@ export declare const useListVirtualMachineNetworkPoliciesQuery: <R extends Recor
     isError: false;
 }, "error">>)>> & {
     status: import("@reduxjs/toolkit/query").QueryStatus;
-}>(arg: typeof import("@reduxjs/toolkit/query").skipToken | ListVirtualMachineNetworkPoliciesArgs, options?: (import("@reduxjs/toolkit/query").SubscriptionOptions & {
+}>(arg: ListVirtualMachineNetworkPoliciesArgs | typeof import("@reduxjs/toolkit/query").skipToken, options?: (import("@reduxjs/toolkit/query").SubscriptionOptions & {
     skip?: boolean;
     refetchOnMountOrArgChange?: boolean | number;
 } & {
@@ -824,7 +826,7 @@ export declare const useListVirtualMachineNetworkPoliciesQuery: <R extends Recor
     isError: false;
 }, "error">>)>> & {
     status: import("@reduxjs/toolkit/query").QueryStatus;
-}>(arg: typeof import("@reduxjs/toolkit/query").skipToken | ListVirtualMachineSecretsArgs, options?: (import("@reduxjs/toolkit/query").SubscriptionOptions & {
+}>(arg: ListVirtualMachineSecretsArgs | typeof import("@reduxjs/toolkit/query").skipToken, options?: (import("@reduxjs/toolkit/query").SubscriptionOptions & {
     skip?: boolean;
     refetchOnMountOrArgChange?: boolean | number;
 } & {

package/dist/src/features/virtual-machine/constants.d.ts

@@ -46,11 +46,30 @@ export declare const VIRTUAL_MACHINE_REJECTED_HOSTS: readonly ["localhost", "met
 export declare const VIRTUAL_MACHINE_REJECTED_HOST_SUFFIXES: readonly [".local", ".internal", ".localhost"];
 /** `env_var` of a VM secret: a POSIX-style environment variable name. */
 export declare const VIRTUAL_MACHINE_ENV_VAR_PATTERN: RegExp;
+/** The backend caps `env_var` at 128 characters. */
+export declare const VIRTUAL_MACHINE_ENV_VAR_MAX_LENGTH = 128;
+/**
+ * Variable names the UI refuses for a secret. The backend only checks the
+ * POSIX shape, but the sandbox sets `env_var` in the VM's environment, so a
+ * secret named PATH or LD_PRELOAD would break every command run there.
+ */
+export declare const VIRTUAL_MACHINE_RESERVED_ENV_VARS: readonly ["PATH", "HOME", "USER", "LOGNAME", "SHELL", "PWD", "OLDPWD", "TMPDIR", "TERM", "LANG", "LANGUAGE", "LC_ALL", "LD_PRELOAD", "LD_LIBRARY_PATH", "PYTHONPATH", "PYTHONHOME", "NODE_OPTIONS", "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY"];
+/** Prefixes the sandbox and ibl.ai keep for their own variables. */
+export declare const VIRTUAL_MACHINE_RESERVED_ENV_VAR_PREFIXES: readonly ["MSB_", "IBLAI_"];
+/**
+ * The port a bare hostname gets in an allowlist. Secrets are only ever
+ * swapped into HTTPS requests, so `api.acme.com` means `api.acme.com:443`.
+ */
+export declare const VIRTUAL_MACHINE_DEFAULT_HOST_PORT = 443;
 /** A network policy holds between 1 and 100 hosts. */
 export declare const VIRTUAL_MACHINE_MAX_POLICY_HOSTS = 100;
 /** An agent may bind at most 20 VM secrets. */
 export declare const VIRTUAL_MACHINE_MAX_SECRETS_PER_MENTOR = 20;
-/** A pasted secret value must be at least this long. */
+/**
+ * The backend's floor for a pasted secret value (its output scrubber blanks
+ * every occurrence of a bound value, so a very short one would blank too
+ * much). The UI no longer checks it; a refusal is shown under the Key field.
+ */
 export declare const VIRTUAL_MACHINE_SECRET_VALUE_MIN_LENGTH = 8;
 /**
  * Default VM runtime billing: charged to the chatting user's credits, prorated

package/dist/src/features/virtual-machine/types.d.ts

@@ -69,7 +69,7 @@ export interface VirtualMachineSecret {
     updated_at: string;
 }
 /**
- * Create with **either** `value` (a pasted key, min 8 characters) **or**
+ * Create with **either** `value` (a pasted key; the backend refuses fewer than 8 characters) **or**
  * `source_credential_id` + `source_field` (read from an integration
  * credential at run time), never both.
  */

package/dist/src/features/virtual-machine/utils.d.ts

@@ -4,8 +4,31 @@ import type { VirtualMachineApiError, VirtualMachineEgress, VirtualMachineHostPo
  * lowercased.
  */
 export declare function normalizeHostPort(value: string): string;
+export interface HostInputOptions {
+    /**
+     * Port appended to an entry that names none (`api.acme.com` →
+     * `api.acme.com:443`). An explicit port, or the one a pasted URL's scheme
+     * implies, is kept.
+     */
+    defaultPort?: number;
+}
+/**
+ * Turn what a person typed or pasted into the `host:port` the backend stores.
+ * People paste the address from a service's instructions, so a whole URL
+ * (`https://api.acme.com/v1/keys`) is reduced to its host, with the scheme's
+ * port unless the URL names one; `api.acme.com/v1` loses its path; a trailing
+ * dot goes. Anything unparseable comes back trimmed and lowercased so
+ * `validateHostPort` can explain it.
+ */
+export declare function normalizeHostInput(value: string, options?: HostInputOptions): string;
 /** Split a pasted or typed string into candidate `host:port` entries. */
-export declare function splitHostPortInput(value: string): string[];
+export declare function splitHostPortInput(value: string, options?: HostInputOptions): string[];
+/**
+ * The `host:port` a person reads: the standard HTTPS port is implied, so
+ * `api.acme.com:443` shows as `api.acme.com`; any other port stays visible.
+ * The stored and compared form is never changed by this.
+ */
+export declare function formatHostPort(entry: string): string;
 /** Whether the host part is an IPv4 literal (the `host:port` grammar admits no IPv6). */
 export declare function isIpAddressHost(host: string): boolean;
 /**
@@ -53,3 +76,28 @@ export declare function findUncoveredSecretHosts(secrets: ReadonlyArray<{
     env_var: string;
     allow_hosts: string[];
 }>, allowedHosts: ReadonlyArray<string>): VirtualMachineUncoveredSecretHosts[];
+/** Whether a variable name is one the VM itself relies on (see the reserved list). */
+export declare function isReservedEnvVar(name: string): boolean;
+export interface DeriveSecretEnvVarOptions {
+    /** Variables already used by the org's secrets; the result is made unique against them. */
+    taken?: ReadonlyArray<string>;
+}
+/**
+ * The variable name a secret gets from its display name, so a person never
+ * has to invent one: "Acme API key" → `ACME_API_KEY`, "Clé Stripe" →
+ * `CLE_STRIPE_KEY`. Accents are folded, every other run of characters becomes
+ * an underscore, a leading digit gets `KEY_` in front, a name without
+ * KEY/TOKEN/SECRET/PASSWORD gets `_KEY` (which also keeps "Path" from
+ * becoming the VM's PATH), nothing derivable falls back to `SECRET`, and a
+ * clash with `taken` gets `_2`, `_3`, …
+ */
+export declare function deriveSecretEnvVar(name: string, options?: DeriveSecretEnvVarOptions): string;
+/** Why a typed variable name is refused, or `null` when it is fine. */
+export type SecretEnvVarIssue = 'required' | 'format' | 'reserved' | 'taken' | 'too_long';
+export declare function validateSecretEnvVar(value: string, options?: DeriveSecretEnvVarOptions): SecretEnvVarIssue | null;
+/**
+ * The backend refuses a duplicate variable with a plain-string 400
+ * (`"ACME_KEY already exists for this organization."`), not a field error,
+ * so the form has to recognise it to put the message under the right field.
+ */
+export declare function isSecretEnvVarTakenMessage(message: string | null | undefined): boolean;