@iblai/data-layer 1.39.0 → 1.41.0

package/dist/index.js

@@ -42242,7 +42242,10 @@ const CREDENTIALS_CUSTOM_ENDPOINTS = {
 
 const credentialsCustomApiSlice = react.createApi({
     reducerPath: CREDENTIALS_CUSTOM_REDUCER_PATH,
-    baseQuery: iblFetchBaseQuery,
+    // The Secrets page hides a kind's rows on a 403 of its list and shows the
+    // retry notice on any other failure, which needs the status: RTK Query
+    // keeps only `{}` of a thrown `{ status, data }`.
+    baseQuery: withReturnedErrors(iblFetchBaseQuery),
     tagTypes: [
         'IntegrationCredentialsSchema',
         'CredentialsSchema',
@@ -42262,6 +42265,23 @@ const credentialsCustomApiSlice = react.createApi({
                 }),
             }),
             invalidatesTags: ['MaskedIntegrationCredentials'],
+            // The Secrets screens read the admin list and the VM secrets, and the
+            // backend deletes the secrets that read this credential with it. The
+            // slices are imported lazily: api-slice.ts imports this file.
+            async onQueryStarted(_args, { queryFulfilled, dispatch }) {
+                try {
+                    await queryFulfilled;
+                    const [{ credentialsApiSlice }, { virtualMachineApiSlice }] = await Promise.all([
+                        Promise.resolve().then(function () { return apiSlice$1; }),
+                        Promise.resolve().then(function () { return apiSlice; }),
+                    ]);
+                    dispatch(credentialsApiSlice.util.invalidateTags(['IntegrationCredentials']));
+                    dispatch(virtualMachineApiSlice.util.invalidateTags(['VirtualMachineSecrets']));
+                }
+                catch (_a) {
+                    // Only a successful delete invalidates.
+                }
+            },
         }),
         deleteCredential: builder.mutation({
             query: ({ org, name, platform_key, model_name }) => ({
@@ -42331,7 +42351,7 @@ const { useDeleteIntegrationCredentialMutation, useDeleteCredentialMutation, use
 const credentialsApiSlice = react.createApi({
     reducerPath: 'credentialsApiSlice',
     baseQuery: iblFakeBaseQuery,
-    tagTypes: ['Credentials', 'ProviderConfig', 'ExternalMapping'],
+    tagTypes: ['Credentials', 'ProviderConfig', 'ExternalMapping', 'IntegrationCredentials'],
     endpoints: (builder) => ({
         getCredentials: builder.query({
             ...buildEndpointFromService(exports.SERVICES.DM, async (args) => {
@@ -42431,11 +42451,15 @@ const credentialsApiSlice = react.createApi({
         createCallCredentials: builder.mutation({
             ...buildEndpointFromAxdService(AiMentorService.aiMentorOrgsUsersMentorsCreateCallCredentialsCreate),
         }),
+        // The admin list (ids + service_info), which the Secrets screens join
+        // with the VM secrets that read a credential.
         getIntegrationCredentials: builder.query({
             ...buildEndpointFromDmService(AiAccountService.aiAccountOrgsIntegrationCredentialRetrieve),
+            providesTags: ['IntegrationCredentials'],
         }),
         createIntegrationCredential: builder.mutation({
             ...buildEndpointFromDmService(AiAccountService.aiAccountOrgsIntegrationCredentialCreate),
+            invalidatesTags: ['IntegrationCredentials'],
             async onQueryStarted(_args, { queryFulfilled, dispatch }) {
                 try {
                     await queryFulfilled;
@@ -42448,9 +42472,42 @@ const credentialsApiSlice = react.createApi({
         }),
         createLLMCredential: builder.mutation({
             ...buildEndpointFromDmService(AiAccountService.aiAccountOrgsCredentialCreate),
+            async onQueryStarted(_args, { queryFulfilled, dispatch }) {
+                try {
+                    await queryFulfilled;
+                    dispatch(credentialsCustomApiSlice.util.invalidateTags(['MaskedLLMCredentials']));
+                }
+                catch (_a) {
+                    // Swallow — invalidation should only happen on success.
+                }
+            },
+        }),
+        // PATCH `/credential/` replaces the whole value for every provider but
+        // Azure OpenAI, whose per-model values the backend merges.
+        updateLLMCredential: builder.mutation({
+            ...buildEndpointFromDmService(AiAccountService.aiAccountOrgsCredentialPartialUpdate),
+            async onQueryStarted(_args, { queryFulfilled, dispatch }) {
+                try {
+                    await queryFulfilled;
+                    dispatch(credentialsCustomApiSlice.util.invalidateTags(['MaskedLLMCredentials']));
+                }
+                catch (_a) {
+                    // Swallow — invalidation should only happen on success.
+                }
+            },
         }),
         updateIntegrationCredential: builder.mutation({
             ...buildEndpointFromDmService(AiAccountService.aiAccountOrgsIntegrationCredentialPartialUpdate),
+            invalidatesTags: ['IntegrationCredentials'],
+            async onQueryStarted(_args, { queryFulfilled, dispatch }) {
+                try {
+                    await queryFulfilled;
+                    dispatch(credentialsCustomApiSlice.util.invalidateTags(['MaskedIntegrationCredentials']));
+                }
+                catch (_a) {
+                    // Swallow — invalidation should only happen on success.
+                }
+            },
         }),
         getConnectedServiceAuthUrl: builder.query({
             queryFn: async (queryParams, api, extraOptions) => {
@@ -42561,7 +42618,45 @@ const credentialsApiSlice = react.createApi({
         }),
     }),
 });
-const { useGetCredentialsQuery, useLazyGetCredentialsQuery, useGetUserCredentialsQuery, useLazyGetUserCredentialsQuery, useCreateCallCredentialsMutation, useGetIntegrationCredentialsQuery, useLazyGetIntegrationCredentialsQuery, useCreateIntegrationCredentialMutation, useUpdateIntegrationCredentialMutation, useGetLLMCredentialsQuery, useLazyGetLLMCredentialsQuery, useCreateLLMCredentialMutation, useGetConnectedServiceAuthUrlQuery, useLazyGetConnectedServiceAuthUrlQuery, useConnectedServicesCallbackQuery, useLazyConnectedServicesCallbackQuery, useGetUsersAsAssertionsQuery, useLazyGetUsersAsAssertionsQuery, useCreateCredentialAssertionMutation, useGetCredentialsListQuery, useLazyGetCredentialsListQuery, useCreateCredentialMutation, useUpdateCredentialMutation, useDeleteCourseCredentialMutation, useGetProviderConfigQuery, useLazyGetProviderConfigQuery, useCreateProviderConfigMutation, useDeleteProviderConfigMutation, useGetExternalMappingQuery, useLazyGetExternalMappingQuery, useCreateExternalMappingMutation, useDeleteExternalMappingMutation, } = credentialsApiSlice;
+const { useGetCredentialsQuery, useLazyGetCredentialsQuery, useGetUserCredentialsQuery, useLazyGetUserCredentialsQuery, useCreateCallCredentialsMutation, useGetIntegrationCredentialsQuery, useLazyGetIntegrationCredentialsQuery, useCreateIntegrationCredentialMutation, useUpdateIntegrationCredentialMutation, useGetLLMCredentialsQuery, useLazyGetLLMCredentialsQuery, useCreateLLMCredentialMutation, useUpdateLLMCredentialMutation, useGetConnectedServiceAuthUrlQuery, useLazyGetConnectedServiceAuthUrlQuery, useConnectedServicesCallbackQuery, useLazyConnectedServicesCallbackQuery, useGetUsersAsAssertionsQuery, useLazyGetUsersAsAssertionsQuery, useCreateCredentialAssertionMutation, useGetCredentialsListQuery, useLazyGetCredentialsListQuery, useCreateCredentialMutation, useUpdateCredentialMutation, useDeleteCourseCredentialMutation, useGetProviderConfigQuery, useLazyGetProviderConfigQuery, useCreateProviderConfigMutation, useDeleteProviderConfigMutation, useGetExternalMappingQuery, useLazyGetExternalMappingQuery, useCreateExternalMappingMutation, useDeleteExternalMappingMutation, } = credentialsApiSlice;
+
+var apiSlice$1 = /*#__PURE__*/Object.freeze({
+  __proto__: null,
+  credentialsApiSlice: credentialsApiSlice,
+  useConnectedServicesCallbackQuery: useConnectedServicesCallbackQuery,
+  useCreateCallCredentialsMutation: useCreateCallCredentialsMutation,
+  useCreateCredentialAssertionMutation: useCreateCredentialAssertionMutation,
+  useCreateCredentialMutation: useCreateCredentialMutation,
+  useCreateExternalMappingMutation: useCreateExternalMappingMutation,
+  useCreateIntegrationCredentialMutation: useCreateIntegrationCredentialMutation,
+  useCreateLLMCredentialMutation: useCreateLLMCredentialMutation,
+  useCreateProviderConfigMutation: useCreateProviderConfigMutation,
+  useDeleteCourseCredentialMutation: useDeleteCourseCredentialMutation,
+  useDeleteExternalMappingMutation: useDeleteExternalMappingMutation,
+  useDeleteProviderConfigMutation: useDeleteProviderConfigMutation,
+  useGetConnectedServiceAuthUrlQuery: useGetConnectedServiceAuthUrlQuery,
+  useGetCredentialsListQuery: useGetCredentialsListQuery,
+  useGetCredentialsQuery: useGetCredentialsQuery,
+  useGetExternalMappingQuery: useGetExternalMappingQuery,
+  useGetIntegrationCredentialsQuery: useGetIntegrationCredentialsQuery,
+  useGetLLMCredentialsQuery: useGetLLMCredentialsQuery,
+  useGetProviderConfigQuery: useGetProviderConfigQuery,
+  useGetUserCredentialsQuery: useGetUserCredentialsQuery,
+  useGetUsersAsAssertionsQuery: useGetUsersAsAssertionsQuery,
+  useLazyConnectedServicesCallbackQuery: useLazyConnectedServicesCallbackQuery,
+  useLazyGetConnectedServiceAuthUrlQuery: useLazyGetConnectedServiceAuthUrlQuery,
+  useLazyGetCredentialsListQuery: useLazyGetCredentialsListQuery,
+  useLazyGetCredentialsQuery: useLazyGetCredentialsQuery,
+  useLazyGetExternalMappingQuery: useLazyGetExternalMappingQuery,
+  useLazyGetIntegrationCredentialsQuery: useLazyGetIntegrationCredentialsQuery,
+  useLazyGetLLMCredentialsQuery: useLazyGetLLMCredentialsQuery,
+  useLazyGetProviderConfigQuery: useLazyGetProviderConfigQuery,
+  useLazyGetUserCredentialsQuery: useLazyGetUserCredentialsQuery,
+  useLazyGetUsersAsAssertionsQuery: useLazyGetUsersAsAssertionsQuery,
+  useUpdateCredentialMutation: useUpdateCredentialMutation,
+  useUpdateIntegrationCredentialMutation: useUpdateIntegrationCredentialMutation,
+  useUpdateLLMCredentialMutation: useUpdateLLMCredentialMutation
+});
 
 const chatPrivacyApiSlice = react.createApi({
     reducerPath: 'chatPrivacyApiSlice',
@@ -45616,6 +45711,110 @@ const moderationLogsApiSlice = react.createApi({
 const moderationLogsApiReducer = moderationLogsApiSlice.reducer;
 const { useGetModerationLogsQuery, useLazyGetModerationLogsQuery, useDeleteModerationLogMutation, } = moderationLogsApiSlice;
 
+const PRIVACY_FLAGS_REDUCER_PATH = 'privacyFlagsApiSlice';
+const PRIVACY_FLAGS_QUERY_KEYS = {
+    PRIVACY_FLAGS: 'PRIVACY_FLAGS',
+    PRIVACY_FLAG: 'PRIVACY_FLAG',
+};
+/** Guardrail that produced the detection. */
+const PRIVACY_FLAG_RAILS = ['pii', 'phi'];
+/** What the privacy router did with the detected content. */
+const PRIVACY_FLAG_ACTIONS = ['redact', 'mask', 'block', 'allow'];
+/** Where in the pipeline the detection happened. `file_*` sources carry file metadata. */
+const PRIVACY_FLAG_SOURCES = [
+    'text_prompt',
+    'file_text',
+    'file_image',
+    'file_pdf',
+    'llm_response',
+    'memory_retrieval',
+];
+const encode = (value) => encodeURIComponent(String(value));
+const PRIVACY_FLAGS_ENDPOINTS = {
+    LIST: {
+        service: exports.SERVICES.DM,
+        path: (org, userId) => `/api/ai-mentor/orgs/${encode(org)}/users/${encode(userId)}/privacy-flags/`,
+    },
+    RETRIEVE: {
+        service: exports.SERVICES.DM,
+        path: (org, userId, id) => `/api/ai-mentor/orgs/${encode(org)}/users/${encode(userId)}/privacy-flags/${encode(id)}/`,
+    },
+};
+
+/** Filter arg -> backend query key. */
+const QUERY_KEYS = {
+    mentor: 'mentor',
+    rail: 'rail',
+    actionTaken: 'action_taken',
+    source: 'source',
+    sessionId: 'session_id',
+    username: 'username',
+    startTime: 'start_time',
+    endTime: 'end_time',
+    search: 'search',
+    ordering: 'ordering',
+    page: 'page',
+    pageSize: 'page_size',
+};
+/** Builds the list query string, dropping empty filters. */
+const buildPrivacyFlagsQuery = (args) => {
+    const params = new URLSearchParams();
+    for (const [argKey, queryKey] of Object.entries(QUERY_KEYS)) {
+        const value = args[argKey];
+        if (value !== undefined && value !== null && value !== '') {
+            params.append(queryKey, String(value));
+        }
+    }
+    const query = params.toString();
+    return query ? `?${query}` : '';
+};
+/**
+ * GETs a DM path with the app's DM auth. Throws `{ status, body }` on non-2xx
+ * so `buildEndpointFromService` keeps the HTTP status (403 stays detectable
+ * and is never retried).
+ */
+const fetchDmJson = async (path) => {
+    const service = PRIVACY_FLAGS_ENDPOINTS.LIST.service;
+    const headers = await getHeaders(service);
+    const response = await fetch(`${getServiceUrl(service)}${path}`, {
+        method: 'GET',
+        headers: { Accept: 'application/json', ...(headers !== null && headers !== void 0 ? headers : {}) },
+        credentials: 'omit',
+    });
+    const text = await response.text();
+    let body = text;
+    try {
+        body = text ? JSON.parse(text) : null;
+    }
+    catch (_a) {
+        // Non-JSON body (e.g. an HTML error page) — keep the raw text.
+    }
+    if (!response.ok) {
+        throw { status: response.status, body };
+    }
+    return body;
+};
+const fetchPrivacyFlags = (args) => fetchDmJson(`${PRIVACY_FLAGS_ENDPOINTS.LIST.path(args.org, args.userId)}${buildPrivacyFlagsQuery(args)}`);
+const fetchPrivacyFlag = (args) => fetchDmJson(PRIVACY_FLAGS_ENDPOINTS.RETRIEVE.path(args.org, args.userId, args.id));
+const privacyFlagsApiSlice = react.createApi({
+    reducerPath: PRIVACY_FLAGS_REDUCER_PATH,
+    baseQuery: iblFakeBaseQuery,
+    tagTypes: [PRIVACY_FLAGS_QUERY_KEYS.PRIVACY_FLAGS, PRIVACY_FLAGS_QUERY_KEYS.PRIVACY_FLAG],
+    endpoints: (builder) => ({
+        getPrivacyFlags: builder.query({
+            ...buildEndpointFromService(PRIVACY_FLAGS_ENDPOINTS.LIST.service, fetchPrivacyFlags),
+            providesTags: [PRIVACY_FLAGS_QUERY_KEYS.PRIVACY_FLAGS],
+        }),
+        getPrivacyFlag: builder.query({
+            ...buildEndpointFromService(PRIVACY_FLAGS_ENDPOINTS.RETRIEVE.service, fetchPrivacyFlag),
+            providesTags: (_result, _error, args) => [
+                { type: PRIVACY_FLAGS_QUERY_KEYS.PRIVACY_FLAG, id: args.id },
+            ],
+        }),
+    }),
+});
+const { useGetPrivacyFlagsQuery, useLazyGetPrivacyFlagsQuery, useGetPrivacyFlagQuery, useLazyGetPrivacyFlagQuery, } = privacyFlagsApiSlice;
+
 /**
  * Privacy Router types and constants.
  *
@@ -49992,11 +50191,51 @@ const VIRTUAL_MACHINE_REJECTED_HOST_SUFFIXES = [
 ];
 /** `env_var` of a VM secret: a POSIX-style environment variable name. */
 const VIRTUAL_MACHINE_ENV_VAR_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** The backend caps `env_var` at 128 characters. */
+const VIRTUAL_MACHINE_ENV_VAR_MAX_LENGTH = 128;
+/**
+ * Variable names the UI refuses for a secret. The backend only checks the
+ * POSIX shape, but the sandbox sets `env_var` in the VM's environment, so a
+ * secret named PATH or LD_PRELOAD would break every command run there.
+ */
+const VIRTUAL_MACHINE_RESERVED_ENV_VARS = [
+    'PATH',
+    'HOME',
+    'USER',
+    'LOGNAME',
+    'SHELL',
+    'PWD',
+    'OLDPWD',
+    'TMPDIR',
+    'TERM',
+    'LANG',
+    'LANGUAGE',
+    'LC_ALL',
+    'LD_PRELOAD',
+    'LD_LIBRARY_PATH',
+    'PYTHONPATH',
+    'PYTHONHOME',
+    'NODE_OPTIONS',
+    'HTTP_PROXY',
+    'HTTPS_PROXY',
+    'NO_PROXY',
+];
+/** Prefixes the sandbox and ibl.ai keep for their own variables. */
+const VIRTUAL_MACHINE_RESERVED_ENV_VAR_PREFIXES = ['MSB_', 'IBLAI_'];
+/**
+ * The port a bare hostname gets in an allowlist. Secrets are only ever
+ * swapped into HTTPS requests, so `api.acme.com` means `api.acme.com:443`.
+ */
+const VIRTUAL_MACHINE_DEFAULT_HOST_PORT = 443;
 /** A network policy holds between 1 and 100 hosts. */
 const VIRTUAL_MACHINE_MAX_POLICY_HOSTS = 100;
 /** An agent may bind at most 20 VM secrets. */
 const VIRTUAL_MACHINE_MAX_SECRETS_PER_MENTOR = 20;
-/** A pasted secret value must be at least this long. */
+/**
+ * The backend's floor for a pasted secret value (its output scrubber blanks
+ * every occurrence of a bound value, so a very short one would blank too
+ * much). The UI no longer checks it; a refusal is shown under the Key field.
+ */
 const VIRTUAL_MACHINE_SECRET_VALUE_MIN_LENGTH = 8;
 /**
  * Default VM runtime billing: charged to the chatting user's credits, prorated
@@ -50016,12 +50255,14 @@ const VIRTUAL_MACHINE_DEFAULT_BILLING = {
  * Hand-written: these endpoints are newer than the pinned `@iblai/iblai-api`
  * release. Records are keyed in the body (PATCH) or the query string (DELETE),
  * never in the URL. A 403 on either list means the caller lacks the matching
- * `Ibl.Mentor/VirtualMachine…/list` permission — hosts hide the pages then.
+ * `Ibl.Mentor/VirtualMachine…/list` permission — hosts hide the pages then,
+ * which needs the status: the base query returns failures rather than throwing
+ * them, since RTK Query keeps only `{}` of a thrown `{ status, data }`.
  */
 const virtualMachineApiSlice = react.createApi({
     reducerPath: VIRTUAL_MACHINE_REDUCER_PATH,
     tagTypes: [VIRTUAL_MACHINE_QUERY_KEYS.NETWORK_POLICIES, VIRTUAL_MACHINE_QUERY_KEYS.SECRETS],
-    baseQuery: iblFetchBaseQuery,
+    baseQuery: withReturnedErrors(iblFetchBaseQuery),
     endpoints: (builder) => ({
         // ── Network policies ────────────────────────────────────────────────
         listVirtualMachineNetworkPolicies: builder.query({
@@ -50102,6 +50343,21 @@ const virtualMachineApiSlice = react.createApi({
 });
 const { useListVirtualMachineNetworkPoliciesQuery, useLazyListVirtualMachineNetworkPoliciesQuery, useCreateVirtualMachineNetworkPolicyMutation, useUpdateVirtualMachineNetworkPolicyMutation, useDeleteVirtualMachineNetworkPolicyMutation, useListVirtualMachineSecretsQuery, useLazyListVirtualMachineSecretsQuery, useCreateVirtualMachineSecretMutation, useUpdateVirtualMachineSecretMutation, useDeleteVirtualMachineSecretMutation, } = virtualMachineApiSlice;
 
+var apiSlice = /*#__PURE__*/Object.freeze({
+  __proto__: null,
+  useCreateVirtualMachineNetworkPolicyMutation: useCreateVirtualMachineNetworkPolicyMutation,
+  useCreateVirtualMachineSecretMutation: useCreateVirtualMachineSecretMutation,
+  useDeleteVirtualMachineNetworkPolicyMutation: useDeleteVirtualMachineNetworkPolicyMutation,
+  useDeleteVirtualMachineSecretMutation: useDeleteVirtualMachineSecretMutation,
+  useLazyListVirtualMachineNetworkPoliciesQuery: useLazyListVirtualMachineNetworkPoliciesQuery,
+  useLazyListVirtualMachineSecretsQuery: useLazyListVirtualMachineSecretsQuery,
+  useListVirtualMachineNetworkPoliciesQuery: useListVirtualMachineNetworkPoliciesQuery,
+  useListVirtualMachineSecretsQuery: useListVirtualMachineSecretsQuery,
+  useUpdateVirtualMachineNetworkPolicyMutation: useUpdateVirtualMachineNetworkPolicyMutation,
+  useUpdateVirtualMachineSecretMutation: useUpdateVirtualMachineSecretMutation,
+  virtualMachineApiSlice: virtualMachineApiSlice
+});
+
 /**
  * Normalise a `host:port` entry the way the backend stores it: trimmed and
  * lowercased.
@@ -50109,13 +50365,78 @@ const { useListVirtualMachineNetworkPoliciesQuery, useLazyListVirtualMachineNetw
 function normalizeHostPort(value) {
     return value.trim().toLowerCase();
 }
+const SCHEME_PORTS = { 'https:': 443, 'http:': 80 };
+// A loop rather than `/x+$/`, which takes quadratic time on a long run of x
+// that does not reach the end (CodeQL js/polynomial-redos).
+function trimChar(value, char, { start = false } = {}) {
+    let from = 0;
+    let to = value.length;
+    if (start)
+        while (from < to && value[from] === char)
+            from += 1;
+    while (to > from && value[to - 1] === char)
+        to -= 1;
+    return value.slice(from, to);
+}
+/**
+ * Turn what a person typed or pasted into the `host:port` the backend stores.
+ * People paste the address from a service's instructions, so a whole URL
+ * (`https://api.acme.com/v1/keys`) is reduced to its host, with the scheme's
+ * port unless the URL names one; `api.acme.com/v1` loses its path; a trailing
+ * dot goes. Anything unparseable comes back trimmed and lowercased so
+ * `validateHostPort` can explain it.
+ */
+function normalizeHostInput(value, options = {}) {
+    let entry = normalizeHostPort(value);
+    if (entry.length === 0)
+        return entry;
+    let port = null;
+    if (entry.includes('://')) {
+        try {
+            const url = new URL(entry);
+            if (!url.hostname)
+                return entry;
+            port = url.port || (SCHEME_PORTS[url.protocol] ? String(SCHEME_PORTS[url.protocol]) : null);
+            entry = url.hostname;
+        }
+        catch (_a) {
+            return entry;
+        }
+    }
+    else {
+        const pathStart = entry.search(/[/?#]/);
+        if (pathStart !== -1)
+            entry = entry.slice(0, pathStart);
+    }
+    if (port === null) {
+        const separator = entry.lastIndexOf(':');
+        if (separator !== -1) {
+            port = entry.slice(separator + 1);
+            entry = entry.slice(0, separator);
+        }
+    }
+    entry = trimChar(entry, '.');
+    if (entry.length === 0)
+        return entry;
+    if (port)
+        return `${entry}:${port}`;
+    return options.defaultPort !== undefined ? `${entry}:${options.defaultPort}` : entry;
+}
 /** Split a pasted or typed string into candidate `host:port` entries. */
-function splitHostPortInput(value) {
+function splitHostPortInput(value, options = {}) {
     return value
         .split(/[\s,;]+/)
-        .map(normalizeHostPort)
+        .map((entry) => normalizeHostInput(entry, options))
         .filter((entry) => entry.length > 0);
 }
+/**
+ * The `host:port` a person reads: the standard HTTPS port is implied, so
+ * `api.acme.com:443` shows as `api.acme.com`; any other port stays visible.
+ * The stored and compared form is never changed by this.
+ */
+function formatHostPort(entry) {
+    return entry.endsWith(':443') ? entry.slice(0, -4) : entry;
+}
 const IPV4_PATTERN = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
 /** Whether the host part is an IPv4 literal (the `host:port` grammar admits no IPv6). */
 function isIpAddressHost(host) {
@@ -50271,6 +50592,75 @@ function findUncoveredSecretHosts(secrets, allowedHosts) {
     }
     return uncovered;
 }
+/** Whether a variable name is one the VM itself relies on (see the reserved list). */
+function isReservedEnvVar(name) {
+    const upper = name.toUpperCase();
+    if (VIRTUAL_MACHINE_RESERVED_ENV_VARS.includes(upper))
+        return true;
+    return VIRTUAL_MACHINE_RESERVED_ENV_VAR_PREFIXES.some((prefix) => upper.startsWith(prefix));
+}
+const ENV_VAR_WORDS = ['KEY', 'TOKEN', 'SECRET', 'PASSWORD'];
+const ENV_VAR_FALLBACK = 'SECRET';
+/** Leaves room for a `_NN` suffix under the backend's 128-character cap. */
+const ENV_VAR_DERIVED_MAX_LENGTH = VIRTUAL_MACHINE_ENV_VAR_MAX_LENGTH - 8;
+/**
+ * The variable name a secret gets from its display name, so a person never
+ * has to invent one: "Acme API key" → `ACME_API_KEY`, "Clé Stripe" →
+ * `CLE_STRIPE_KEY`. Accents are folded, every other run of characters becomes
+ * an underscore, a leading digit gets `KEY_` in front, a name without
+ * KEY/TOKEN/SECRET/PASSWORD gets `_KEY` (which also keeps "Path" from
+ * becoming the VM's PATH), nothing derivable falls back to `SECRET`, and a
+ * clash with `taken` gets `_2`, `_3`, …
+ */
+function deriveSecretEnvVar(name, options = {}) {
+    var _a;
+    let base = trimChar(name
+        .normalize('NFKD')
+        .replace(/[\u0300-\u036f]/g, '')
+        .toUpperCase()
+        .replace(/[^A-Z0-9]+/g, '_'), '_', { start: true }).replace(/_{2,}/g, '_');
+    if (base.length === 0)
+        base = ENV_VAR_FALLBACK;
+    if (/^[0-9]/.test(base))
+        base = `KEY_${base}`;
+    if (!ENV_VAR_WORDS.some((word) => base.split('_').includes(word)))
+        base = `${base}_KEY`;
+    if (isReservedEnvVar(base))
+        base = `KEY_${base}`;
+    base = trimChar(base.slice(0, ENV_VAR_DERIVED_MAX_LENGTH), '_');
+    const taken = new Set(((_a = options.taken) !== null && _a !== void 0 ? _a : []).map((entry) => entry.toUpperCase()));
+    if (!taken.has(base))
+        return base;
+    for (let suffix = 2;; suffix += 1) {
+        const candidate = `${base}_${suffix}`;
+        if (!taken.has(candidate))
+            return candidate;
+    }
+}
+function validateSecretEnvVar(value, options = {}) {
+    var _a;
+    const entry = value.trim();
+    if (entry.length === 0)
+        return 'required';
+    if (!VIRTUAL_MACHINE_ENV_VAR_PATTERN.test(entry))
+        return 'format';
+    if (entry.length > VIRTUAL_MACHINE_ENV_VAR_MAX_LENGTH)
+        return 'too_long';
+    if (isReservedEnvVar(entry))
+        return 'reserved';
+    const upper = entry.toUpperCase();
+    if (((_a = options.taken) !== null && _a !== void 0 ? _a : []).some((taken) => taken.toUpperCase() === upper))
+        return 'taken';
+    return null;
+}
+/**
+ * The backend refuses a duplicate variable with a plain-string 400
+ * (`"ACME_KEY already exists for this organization."`), not a field error,
+ * so the form has to recognise it to put the message under the right field.
+ */
+function isSecretEnvVarTakenMessage(message) {
+    return /already exists/i.test(message !== null && message !== void 0 ? message : '');
+}
 
 const mentorReducer = {
     [mentorApiSlice.reducerPath]: mentorApiSlice.reducer,
@@ -50320,6 +50710,7 @@ const mentorReducer = {
     [billingCustomSlice.reducerPath]: billingCustomSlice.reducer,
     [retirementApiSlice.reducerPath]: retirementApiSlice.reducer,
     [auditLogsApiSlice.reducerPath]: auditLogsApiSlice.reducer,
+    [privacyFlagsApiSlice.reducerPath]: privacyFlagsApiSlice.reducer,
     [monetizationApiSlice.reducerPath]: monetizationApiSlice.reducer,
     [coursesApiSlice.reducerPath]: coursesApiSlice.reducer,
     [courseMetadataApiSlice.reducerPath]: courseMetadataApiSlice.reducer,
@@ -50387,6 +50778,7 @@ const mentorMiddleware = [
     billingCustomSlice.middleware,
     retirementApiSlice.middleware,
     auditLogsApiSlice.middleware,
+    privacyFlagsApiSlice.middleware,
     monetizationApiSlice.middleware,
     coursesApiSlice.middleware,
     courseMetadataApiSlice.middleware,
@@ -50602,6 +50994,12 @@ exports.PLATFORM_MEMBERSHIP_TAG = PLATFORM_MEMBERSHIP_TAG;
 exports.PRIVACY_ACTIONS = PRIVACY_ACTIONS;
 exports.PRIVACY_BLOCKED_ERROR_KIND = PRIVACY_BLOCKED_ERROR_KIND;
 exports.PRIVACY_ENTITY_TYPES = PRIVACY_ENTITY_TYPES;
+exports.PRIVACY_FLAGS_ENDPOINTS = PRIVACY_FLAGS_ENDPOINTS;
+exports.PRIVACY_FLAGS_QUERY_KEYS = PRIVACY_FLAGS_QUERY_KEYS;
+exports.PRIVACY_FLAGS_REDUCER_PATH = PRIVACY_FLAGS_REDUCER_PATH;
+exports.PRIVACY_FLAG_ACTIONS = PRIVACY_FLAG_ACTIONS;
+exports.PRIVACY_FLAG_RAILS = PRIVACY_FLAG_RAILS;
+exports.PRIVACY_FLAG_SOURCES = PRIVACY_FLAG_SOURCES;
 exports.PRIVACY_TARGET_SYSTEM = PRIVACY_TARGET_SYSTEM;
 exports.PROJECTS_CUSTOM_ENDPOINTS = PROJECTS_CUSTOM_ENDPOINTS;
 exports.PROJECTS_CUSTOM_REDUCER_PATH = PROJECTS_CUSTOM_REDUCER_PATH;
@@ -50637,8 +51035,10 @@ exports.USER_PROGRESS_DATA_POINTS = USER_PROGRESS_DATA_POINTS;
 exports.USER_PROGRESS_SUMMARY_TYPE = USER_PROGRESS_SUMMARY_TYPE;
 exports.VERCEL_SPA = VERCEL_SPA;
 exports.VIRTUAL_MACHINE_DEFAULT_BILLING = VIRTUAL_MACHINE_DEFAULT_BILLING;
+exports.VIRTUAL_MACHINE_DEFAULT_HOST_PORT = VIRTUAL_MACHINE_DEFAULT_HOST_PORT;
 exports.VIRTUAL_MACHINE_EGRESS_PROFILES = VIRTUAL_MACHINE_EGRESS_PROFILES;
 exports.VIRTUAL_MACHINE_ENDPOINTS = VIRTUAL_MACHINE_ENDPOINTS;
+exports.VIRTUAL_MACHINE_ENV_VAR_MAX_LENGTH = VIRTUAL_MACHINE_ENV_VAR_MAX_LENGTH;
 exports.VIRTUAL_MACHINE_ENV_VAR_PATTERN = VIRTUAL_MACHINE_ENV_VAR_PATTERN;
 exports.VIRTUAL_MACHINE_HOST_PORT_PATTERN = VIRTUAL_MACHINE_HOST_PORT_PATTERN;
 exports.VIRTUAL_MACHINE_MAX_POLICY_HOSTS = VIRTUAL_MACHINE_MAX_POLICY_HOSTS;
@@ -50648,6 +51048,8 @@ exports.VIRTUAL_MACHINE_QUERY_KEYS = VIRTUAL_MACHINE_QUERY_KEYS;
 exports.VIRTUAL_MACHINE_REDUCER_PATH = VIRTUAL_MACHINE_REDUCER_PATH;
 exports.VIRTUAL_MACHINE_REJECTED_HOSTS = VIRTUAL_MACHINE_REJECTED_HOSTS;
 exports.VIRTUAL_MACHINE_REJECTED_HOST_SUFFIXES = VIRTUAL_MACHINE_REJECTED_HOST_SUFFIXES;
+exports.VIRTUAL_MACHINE_RESERVED_ENV_VARS = VIRTUAL_MACHINE_RESERVED_ENV_VARS;
+exports.VIRTUAL_MACHINE_RESERVED_ENV_VAR_PREFIXES = VIRTUAL_MACHINE_RESERVED_ENV_VAR_PREFIXES;
 exports.VIRTUAL_MACHINE_SECRET_VALUE_MIN_LENGTH = VIRTUAL_MACHINE_SECRET_VALUE_MIN_LENGTH;
 exports.WATCHED_GROUPS_ENDPOINTS = WATCHED_GROUPS_ENDPOINTS;
 exports.WATCHED_GROUPS_QUERY_KEYS = WATCHED_GROUPS_QUERY_KEYS;
@@ -50673,6 +51075,7 @@ exports.billingCustomSlice = billingCustomSlice;
 exports.buildGlobalSearchUrl = buildGlobalSearchUrl;
 exports.buildLearnerCompletionUrl = buildLearnerCompletionUrl;
 exports.buildPinnedMessagesUrl = buildPinnedMessagesUrl;
+exports.buildPrivacyFlagsQuery = buildPrivacyFlagsQuery;
 exports.buildRecentMessagesUrl = buildRecentMessagesUrl;
 exports.buildSessionRetrieveUrl = buildSessionRetrieveUrl;
 exports.buildSharedSessionRetrieveUrl = buildSharedSessionRetrieveUrl;
@@ -50697,6 +51100,7 @@ exports.credentialsCustomApiSlice = credentialsCustomApiSlice;
 exports.customAiSearchApiSlice = customAiSearchApiSlice;
 exports.customDomainApiSlice = customDomainApiSlice;
 exports.datasetsApiSlice = datasetsApiSlice;
+exports.deriveSecretEnvVar = deriveSecretEnvVar;
 exports.disclaimersApiSlice = disclaimersApiSlice;
 exports.edxProctoringApiSlice = edxProctoringApiSlice;
 exports.edxSsoApiSlice = edxSsoApiSlice;
@@ -50707,6 +51111,8 @@ exports.fakeBaseQueryWithLogging = fakeBaseQueryWithLogging;
 exports.featureTags = featureTags;
 exports.fetchLatestMentorSessionId = fetchLatestMentorSessionId;
 exports.fetchLearnerCompletion = fetchLearnerCompletion;
+exports.fetchPrivacyFlag = fetchPrivacyFlag;
+exports.fetchPrivacyFlags = fetchPrivacyFlags;
 exports.fetchUserLlmUsage = fetchUserLlmUsage;
 exports.filterCourseUserRoles = filterCourseUserRoles;
 exports.filterGlobalUserRoles = filterGlobalUserRoles;
@@ -50715,6 +51121,7 @@ exports.filterSlashSkills = filterSlashSkills;
 exports.findResumeBlock = findResumeBlock;
 exports.findUncoveredSecretHosts = findUncoveredSecretHosts;
 exports.flattenOutline = flattenOutline;
+exports.formatHostPort = formatHostPort;
 exports.getNextRecentMessagesPageParam = getNextRecentMessagesPageParam;
 exports.getSections = getSections;
 exports.getSpendCapExceededError = getSpendCapExceededError;
@@ -50731,6 +51138,8 @@ exports.isPoliciesResponse = isPoliciesResponse;
 exports.isPrivacyBlockedError = isPrivacyBlockedError;
 exports.isRejectedHostname = isRejectedHostname;
 exports.isRejectedIpAddress = isRejectedIpAddress;
+exports.isReservedEnvVar = isReservedEnvVar;
+exports.isSecretEnvVarTakenMessage = isSecretEnvVarTakenMessage;
 exports.isSpendCapExceededErrorBody = isSpendCapExceededErrorBody;
 exports.isUserLlmUsageEmpty = isUserLlmUsageEmpty;
 exports.isValidHostPort = isValidHostPort;
@@ -50748,6 +51157,7 @@ exports.mentorReducer = mentorReducer;
 exports.moderationLogsApiReducer = moderationLogsApiReducer;
 exports.moderationLogsApiSlice = moderationLogsApiSlice;
 exports.monetizationApiSlice = monetizationApiSlice;
+exports.normalizeHostInput = normalizeHostInput;
 exports.normalizeHostPort = normalizeHostPort;
 exports.normalizeLearnerCompletionError = normalizeLearnerCompletionError;
 exports.normalizeOutline = normalizeOutline;
@@ -50759,6 +51169,7 @@ exports.periodicAgentsApiSlice = periodicAgentsApiSlice;
 exports.platformApiReducer = platformApiReducer;
 exports.platformApiSlice = platformApiSlice;
 exports.platformCustomApiSlice = platformCustomApiSlice;
+exports.privacyFlagsApiSlice = privacyFlagsApiSlice;
 exports.projectsApiSlice = projectsApiSlice;
 exports.promptsApiSlice = promptsApiSlice;
 exports.readMeasure = readMeasure;
@@ -51127,6 +51538,8 @@ exports.useGetPlatformImageAssetsListQuery = useGetPlatformImageAssetsListQuery;
 exports.useGetPlatformInfoQuery = useGetPlatformInfoQuery;
 exports.useGetPlatformMembershipQuery = useGetPlatformMembershipQuery;
 exports.useGetPlatformUserGroupDetailsQuery = useGetPlatformUserGroupDetailsQuery;
+exports.useGetPrivacyFlagQuery = useGetPrivacyFlagQuery;
+exports.useGetPrivacyFlagsQuery = useGetPrivacyFlagsQuery;
 exports.useGetProgramCompletionQuery = useGetProgramCompletionQuery;
 exports.useGetProgramListQuery = useGetProgramListQuery;
 exports.useGetPromptCategoriesQuery = useGetPromptCategoriesQuery;
@@ -51378,6 +51791,8 @@ exports.useLazyGetPinnedMessagesQuery = useLazyGetPinnedMessagesQuery;
 exports.useLazyGetPlatformAuditLogsQuery = useLazyGetPlatformAuditLogsQuery;
 exports.useLazyGetPlatformInfoQuery = useLazyGetPlatformInfoQuery;
 exports.useLazyGetPlatformMembershipQuery = useLazyGetPlatformMembershipQuery;
+exports.useLazyGetPrivacyFlagQuery = useLazyGetPrivacyFlagQuery;
+exports.useLazyGetPrivacyFlagsQuery = useLazyGetPrivacyFlagsQuery;
 exports.useLazyGetProgramCompletionQuery = useLazyGetProgramCompletionQuery;
 exports.useLazyGetProgramListQuery = useLazyGetProgramListQuery;
 exports.useLazyGetPromptCategoriesQuery = useLazyGetPromptCategoriesQuery;
@@ -51595,6 +52010,7 @@ exports.useUpdateGlobalMemoryMutation = useUpdateGlobalMemoryMutation;
 exports.useUpdateGraderCriterionMutation = useUpdateGraderCriterionMutation;
 exports.useUpdateHostingDomainMutation = useUpdateHostingDomainMutation;
 exports.useUpdateIntegrationCredentialMutation = useUpdateIntegrationCredentialMutation;
+exports.useUpdateLLMCredentialMutation = useUpdateLLMCredentialMutation;
 exports.useUpdateLtiKeyMutation = useUpdateLtiKeyMutation;
 exports.useUpdateLtiMentorMutation = useUpdateLtiMentorMutation;
 exports.useUpdateLtiToolMutation = useUpdateLtiToolMutation;
@@ -51681,6 +52097,7 @@ exports.userInvitationsApiSlice = userInvitationsApiSlice;
 exports.userLlmUsageApiSlice = userLlmUsageApiSlice;
 exports.validateHostPort = validateHostPort;
 exports.validateLearnerCompletionArgs = validateLearnerCompletionArgs;
+exports.validateSecretEnvVar = validateSecretEnvVar;
 exports.validateUserLlmUsageParams = validateUserLlmUsageParams;
 exports.virtualMachineApiSlice = virtualMachineApiSlice;
 exports.watchedGroupsApiSlice = watchedGroupsApiSlice;