@iblai/iblai-js 2.22.0 → 2.23.1

package/dist/web-containers/source/index.esm.js

@@ -1,7 +1,7 @@
 import * as React from 'react';
 import React__default, { useRef, useEffect, useMemo, useCallback, useState, createContext, useContext, forwardRef, createElement as createElement$1, useLayoutEffect, useReducer, useImperativeHandle, isValidElement, Children, PureComponent, cloneElement, Component, Fragment as Fragment$2, useId as useId$2, useDebugValue, lazy, Suspense } from 'react';
 import * as dataLayer from '@iblai/data-layer';
-import { useGetLlmsQuery, useCreateSessionIdMutation, useTimeTrackingMutation, useGetUserMetadataQuery, useGetUserMetadataEdxQuery, useGetUserProfileSummaryQuery, useUpdateUserMetadataMutation, useUpdateUserMetadataEdxMutation, useUploadProfileImageMutation, useResetPasswordMutation, useSelfRetireMutation, useCreateUserInstitutionMutation, useGetUserInstitutionsQuery, useCreateUserEducationMutation, useUpdateUserEducationMutation, useDeleteUserEducationMutation, useGetUserEducationQuery, useCreateUserCompanyMutation, useGetUserCompaniesQuery, useCreateUserExperienceMutation, useUpdateUserExperienceMutation, useDeleteUserExperienceMutation, useGetUserExperienceQuery, useGetUserResumeQuery, useCreateUserResumeMutation, useGetMySubscriptionsQuery, useGetItemSubscriptionQuery, useCancelSubscriptionMutation, useGetLearnerCourseOutlineQuery, getSections, findResumeBlock, flattenOutline, normalizeLearnerCompletionError, useGetLearnerDetailsQuery, useGetUserEnrolledCoursesQuery, useGetUserEnrolledProgramsQuery, useGetUserCatalogPathwaysQuery, useGetUsersAsAssertionsQuery, useGetUserEarnedSkillsQuery, useGetUserReportedSkillsQuery, useGetUserDesiredSkillsQuery, useCreateGlobalMemoryMutation, useUpdateGlobalMemoryMutation, useUpdateMentorMemoryMutation, useGetMemsearchStatusQuery, useGetUserMemorySettingsQuery, useUpdateUserMemorySettingsMutation, useGetGlobalMemoriesQuery, useGetAllMentorMemoriesQuery, useDeleteGlobalMemoryMutation, useDeleteMentorMemoryMutation, useGetAiSearchMentorsQuery, useGetUserChatHistoryReportsQuery, USER_CHAT_HISTORY_REPORT_ACTIVE_STATES, useCreateUserChatHistoryReportMutation, useLazyGetDownloadReportFromURLQuery, useGetUserChatHistoryReportStatusQuery, userChatHistoryApiSlice, USER_CHAT_HISTORY_QUERY_KEYS, useGetUserChatHistoryQuery, useGetUserChatHistoryFilterQuery, useGetMentorsQuery, useGetUserChatHistorySessionQuery, useUserLlmUsageSummary, useUserLlmSpendOverTime, useUserLlmCostByModel, useUserLlmCostByService, useUserLlmRecentActivity, USER_LLM_RECENT_ACTIVITY_PAGE_SIZE, useUserLlmTraceObservations, useInviteUserMutation, usePlatformInvitationsQuery, useCreateCatalogInvitationCourseBulkMutation, useGetCatalogInvitationsCourseQuery, useLazyPlatformUsersQuery, useLazyPlatformUserGroupsQuery, useGetPersonnalizedSearchQuery, useCreateCatalogInvitationProgramBulkMutation, useGetCatalogInvitationsProgramQuery, useGetVectorDocumentsQuery, useUpdateUserRoleMutation, useUpdateUserStatusMutation, useUpdatePlatformUserRoleWithPoliciesMutation, usePlatformUsersQuery, useGetAccessibleUsersQuery, isPoliciesResponse, platformApiSlice, featureTags, useLazyGetRbacTeamsAccessListQuery, useCreateRbacTeamsAccessMutation, useGetRbacGroupsQuery, usePlatformUserGroupsQuery, useCreateRbacGroupMutation, useUpdateRbacGroupMutation, useDeleteRbacGroupMutation, useCreatePlatformUserGroupMutation, useUpdatePlatformUserGroupMutation, useDeletePlatformUserGroupMutation, useGetRbacGroupDetailsQuery, useGetPlatformUserGroupDetailsQuery, useGetRbacPermissionsMutation, useGetRbacRolesQuery, useCreateRbacRoleMutation, useUpdateRbacRoleMutation, useDeleteRbacRoleMutation, useGetRbacRoleDetailsQuery, useGetRbacActionsDefinitionQuery, useGetRbacResourceDiscoveryQuery, useGetRbacResourceListQuery, useGetRbacPoliciesQuery, useCreateRbacPolicyMutation, useUpdateRbacPolicyMutation, useDeleteRbacPolicyMutation, useGetRbacPolicyDetailsQuery, useGetWatchedGroupsQuery, useCreateWatchedGroupMutation, useUpdateWatchedGroupMutation, useDeleteWatchedGroupMutation, useAddWatchedUserMutation, useRemoveWatchedUserMutation, useAddWatcherMutation, useUpdateWatcherMutation, useDeleteWatcherMutation, useGetWatchedUsersQuery, useGetWatchersQuery, WATCHER_NOTIFICATION_EVENTS, WATCHER_NOTIFICATION_EVENT_LABELS, useGetApplicationFormsQuery, useGetApplicationFormDetailQuery, useCreateApplicationFormMutation, useUpdateApplicationFormMutation, useGetApplicationAdminDetailQuery, useInviteApplicationCandidateMutation, useLazyGetApplicationAttachmentFileQuery, useCreateApplicationWaiverMutation, useDeleteApplicationWaiverMutation, useSubmitApplicationOverrideMutation, useUpdateApplicationPlacementMutation, useDeleteApplicationCourseAssignmentMutation, useCreateApplicationNoteMutation, useUpdateApplicationNoteMutation, useDeleteApplicationNoteMutation, useTransitionApplicationMutation, useLinkApplicationCandidateMutation, useCreateApplicationPlacementsMutation, useGetCustomMentorsQuery, useCreateApplicationCourseAssignmentsMutation, useGetApplicationBlocksQuery, useDeleteApplicationBlockMutation, useGetApplicationsPipelineStatsQuery, useGetApplicationsPipelineQuery, useGetTenantMetadataQuery, useUpdateTenantMetadataMutation, useLazyGetTenantMetadataQuery, useDeleteApiKeyMutation, useGetApiKeyQuery, useGetApiKeyFieldPermissionsQuery, useUpdateApiKeyMutation, useGetApiKeysQuery, unwrapApiTokenList, useCreateApiKeyMutation, useCreateLLMCredentialMutation, useGetCredentialsSchemaQuery, useGetMaskedLLMCredentialsQuery, useDeleteIntegrationCredentialMutation, useDeleteCredentialMutation, useCreateIntegrationCredentialMutation, useGetIntegrationCredentialsSchemaQuery, useGetMaskedIntegrationCredentialsQuery, useGetAccountBillingInfoQuery, useUpdateAutoRechargeInfoMutation, useTriggerAutoRechargeMutation, useGetAgentSpendCapQuery, useGetTenantSpendCapQuery, useListAgentUserSpendCapsQuery, useUpsertAgentSpendCapMutation, useDeleteAgentSpendCapMutation, useUpsertTenantSpendCapMutation, useDeleteTenantSpendCapMutation, useUpsertUserSpendCapMutation, useDeleteUserSpendCapMutation, useGetLlmUsageMetricsQuery, useListAgentSpendCapsQuery, useGetCreditTransactionsQuery, useCreateStripeCustomerPortalMutation, useSetPlatformConfigurationsMutation, useGetPlatformConfigurationsQuery, useUpdatePlatformMembershipMutation, useGetPlatformMembershipQuery, VERCEL_SPA, useGetCustomDomainsQuery, useGetHostingProjectsQuery, useCreateCustomDomainMutation, useDeleteCustomDomainMutation, useCreateHostingProjectDomainMutation, useUpdateHostingDomainMutation, useDeleteHostingDomainMutation, useGetStudentMentorCreationStatusQuery, useSetStudentMentorCreationStatusMutation, coreApiSlice, recommendationPromptTypeEnum, useGetRecommendedPromptsListQuery, useCreateRecommendedPromptMutation, useUpdateRecommendedPromptMutation, useDeleteRecommendedPromptMutation, useLazyGetPublicPlatformImageAssetFileUrlQuery, useCreatePlatformImageAssetMutation, useGetProviderConfigQuery, useCreateProviderConfigMutation, useDeleteProviderConfigMutation, useGetExternalMappingQuery, useGetCredentialsListQuery, useCreateExternalMappingMutation, useDeleteExternalMappingMutation, useGetMemsearchConfigQuery, useUpdateMemsearchConfigMutation, useGetStripeConnectStatusQuery, useStartStripeConnectOnboardingMutation, useLazyGetStripeConnectDashboardQuery, useListPaywallsQuery, useListPricesQuery, useCreatePriceMutation, useUpdatePriceMutation, useDeletePriceMutation, useGetPaywallConfigQuery, useEnablePaywallMutation, useUpdatePaywallMutation, useGetMentorMemoriesListQuery, useGetMemoryCategoriesAdminQuery, useCreateMentorMemoryMutation, useGetNotificationsCountQuery, useLazyGetNotificationsQuery, useMarkAllAsReadMutation, useCreateNotificationPreviewMutation, useSendNotificationMutation, USER_PROGRESS_DATA_POINTS, useResetTemplateMutation, useSendTestTemplateEmailMutation, useUpdateTemplateMutation, useGetTemplateDetailsQuery, USER_PROGRESS_SUMMARY_TYPE, useGetTemplatesQuery, useLazyGetTemplateDetailsQuery, useToggleTemplateMutation, useGetLlmUsageTracesQuery, useGetLlmUsageObservationsQuery, useGetTopicsStatsQuery, useGetUsersStatsQuery, useGetSessionStatsQuery, useGetTopicsDetailsStatsQuery, useGetTranscriptsConversationHeadlineQuery, useGetAccessTimeHeatmapQuery, useGetUserDetailsStatsQuery, useGetAverageRatingQuery, useGetModelCostsQuery, useGetPerUserCostsQuery, useGetTenantCostQuery, useGetAgentCostQuery, useGetTranscriptsMessagesDetailsQuery, useGetTranscriptsMessagesQuery, useGetReportDetailQuery, useGetMentorPublicSettingsQuery, useGetReportsQuery, useCreateReportMutation, useGetContentAnalyticsQuery, useGetContentAnalyticsDetailsQuery, useGetRevenueQuery, useListSubscribersQuery, useGetAuditLogsQuery, useGetPlatformAuditLogsQuery, PLATFORM_AUDIT_EVENT_TYPES, PLATFORM_AUDIT_ACTION_CODES, useGetMentorMemoriesQuery, useLazyGetCourseMetaDataQuery, useLazyGetCourseCompletionOutlinesQuery, useLazyGetCourseEligibilityQuery, useLazyGetUserEnrolledCoursesQuery, useLazyGetUserAssignedCoursesQuery, useLazyGetUserCredentialsQuery, useLazyGetOverTimeActivityQuery, useLazyGetCatalogSearchQuery, useCreateOrUpdateUserReportedSkillMutation, useCreateOrUpdateUserDesiredSkillMutation, useLazyGetPathwayListQuery, useLazyGetUserAssignedPathwaysQuery, useLazyGetUserEnrolledPathwaysQuery, useLazyGetPathwayCompletionQuery, useLazyGetProgramListQuery, useLazyGetProgramCompletionQuery, useLazyGetUserEnrolledProgramsQuery, useLazyGetAssignedProgramsQuery, useLazyGetUserSkillsPointsQuery, useLazyGetUserReportedSkillsQuery, useLazyGetUserDesiredSkillsQuery, useLazyGetUserCatalogPathwaysQuery, useLazyGetPerLearnerInfoQuery, useLazyGetEdxSSOTokenQuery, useCreateCourseEnrollmentMutation, useCreateStripeCheckoutSessionMutation, useLazyGetCourseProgressQuery, useLazyGetCourseCompletionQuery, useLazyGetPersonnalizedSearchQuery, useUpdateExamAttemptMutation, useStartExamMutation, useLazyGetExamInfoQuery, useGetMentorSettingsQuery, useEditMentorMutation, useGetClawMentorConfigQuery, useGetClawInstancesQuery, useGetAgentConfigQuery, useUpdateClawMentorConfigMutation, useCreateClawMentorConfigMutation, useDeleteClawMentorConfigMutation, usePushClawConfigMutation, useCreateClawInstanceMutation, useDeleteClawInstanceMutation, useUpdateAgentConfigMutation, useHealthCheckClawInstanceMutation, useTestConnectivityClawInstanceMutation, useUpdateClawInstanceMutation, useGetAgentSkillResourcesQuery, useCreateAgentSkillResourceMutation, useUpdateAgentSkillResourceMutation, useUploadAgentSkillResourceAssetMutation, useDeleteAgentSkillResourceMutation, useGetMentorSkillAssignmentsQuery, useGetAgentSkillsQuery, useCreateMentorSkillAssignmentMutation, useUpdateMentorSkillAssignmentMutation, useDeleteMentorSkillAssignmentMutation, useCreateAgentSkillMutation, useUpdateAgentSkillMutation, useDeleteAgentSkillMutation, filterSlashSkills, useGetMentorSkillAssignmentsInfiniteQuery, MENTOR_SKILL_ASSIGNMENTS_PAGE_SIZE, useCreateCheckoutMutation, useGetUserProjectsQuery, useUpdateUserProjectMutation, useGetTrainingDocumentsQuery, useLazyGetConnectedServiceAuthUrlQuery, useCreateUserProjectMutation, useDeleteUserProjectMutation, useGetUserProjectDetailsQuery, useEditTrainingDocumentMutation, useAddTrainingDocumentMutation, useLazyGetCredentialsQuery, useGetMentorCategoriesQuery, useCreateMentorMutation, useUpdateUserPlatformMetadataMutation, useGetApplicationStatusQuery, useListOwnApplicationsQuery, useGetApplicationFormQuery, useWithdrawApplicationMutation, useRenewApplicationMutation, useCreateApplicationDraftMutation, useSubmitApplicationMutation, useUpdateApplicationMutation, useUploadApplicationAttachmentMutation, useDeleteApplicationAttachmentMutation, useCreateMemoryCategoryMutation, useUpdateMemoryCategoryMutation, useDeleteMemoryCategoryMutation, useGetPromptCategoriesQuery, useCreatePromptMutation, useDeletePromptMutation, useGetPromptsSearchQuery, useUpdatePromptMutation, useDeleteTrainingDocumentMutation, useGetTrainingDocumentRetrainScheduleQuery, useCreateTrainingDocumentRetrainScheduleMutation } from '@iblai/data-layer';
+import { useGetCredentialsSchemaQuery, useGetLlmsQuery, useCreateSessionIdMutation, useTimeTrackingMutation, useGetUserMetadataQuery, useGetUserMetadataEdxQuery, useGetUserProfileSummaryQuery, useUpdateUserMetadataMutation, useUpdateUserMetadataEdxMutation, useUploadProfileImageMutation, useResetPasswordMutation, useSelfRetireMutation, useCreateUserInstitutionMutation, useGetUserInstitutionsQuery, useCreateUserEducationMutation, useUpdateUserEducationMutation, useDeleteUserEducationMutation, useGetUserEducationQuery, useCreateUserCompanyMutation, useGetUserCompaniesQuery, useCreateUserExperienceMutation, useUpdateUserExperienceMutation, useDeleteUserExperienceMutation, useGetUserExperienceQuery, useGetUserResumeQuery, useCreateUserResumeMutation, useGetMySubscriptionsQuery, useGetItemSubscriptionQuery, useCancelSubscriptionMutation, useGetLearnerCourseOutlineQuery, getSections, findResumeBlock, flattenOutline, normalizeLearnerCompletionError, useGetLearnerDetailsQuery, useGetUserEnrolledCoursesQuery, useGetUserEnrolledProgramsQuery, useGetUserCatalogPathwaysQuery, useGetUsersAsAssertionsQuery, useGetUserEarnedSkillsQuery, useGetUserReportedSkillsQuery, useGetUserDesiredSkillsQuery, useCreateGlobalMemoryMutation, useUpdateGlobalMemoryMutation, useUpdateMentorMemoryMutation, useGetMemsearchStatusQuery, useGetUserMemorySettingsQuery, useUpdateUserMemorySettingsMutation, useGetGlobalMemoriesQuery, useGetAllMentorMemoriesQuery, useDeleteGlobalMemoryMutation, useDeleteMentorMemoryMutation, useGetAiSearchMentorsQuery, useGetUserChatHistoryReportsQuery, USER_CHAT_HISTORY_REPORT_ACTIVE_STATES, useCreateUserChatHistoryReportMutation, useLazyGetDownloadReportFromURLQuery, useGetUserChatHistoryReportStatusQuery, userChatHistoryApiSlice, USER_CHAT_HISTORY_QUERY_KEYS, useGetUserChatHistoryQuery, useGetUserChatHistoryFilterQuery, useGetMentorsQuery, useGetUserChatHistorySessionQuery, useUserLlmUsageSummary, useUserLlmSpendOverTime, useUserLlmCostByModel, useUserLlmCostByService, useUserLlmRecentActivity, USER_LLM_RECENT_ACTIVITY_PAGE_SIZE, useUserLlmTraceObservations, useInviteUserMutation, usePlatformInvitationsQuery, useCreateCatalogInvitationCourseBulkMutation, useGetCatalogInvitationsCourseQuery, useLazyPlatformUsersQuery, useLazyPlatformUserGroupsQuery, useGetPersonnalizedSearchQuery, useCreateCatalogInvitationProgramBulkMutation, useGetCatalogInvitationsProgramQuery, useGetVectorDocumentsQuery, useUpdateUserRoleMutation, useUpdateUserStatusMutation, useUpdatePlatformUserRoleWithPoliciesMutation, usePlatformUsersQuery, useGetAccessibleUsersQuery, isPoliciesResponse, platformApiSlice, featureTags, useLazyGetRbacTeamsAccessListQuery, useCreateRbacTeamsAccessMutation, useGetRbacGroupsQuery, usePlatformUserGroupsQuery, useCreateRbacGroupMutation, useUpdateRbacGroupMutation, useDeleteRbacGroupMutation, useCreatePlatformUserGroupMutation, useUpdatePlatformUserGroupMutation, useDeletePlatformUserGroupMutation, useGetRbacGroupDetailsQuery, useGetPlatformUserGroupDetailsQuery, useGetRbacPermissionsMutation, useGetRbacRolesQuery, useCreateRbacRoleMutation, useUpdateRbacRoleMutation, useDeleteRbacRoleMutation, useGetRbacRoleDetailsQuery, useGetRbacActionsDefinitionQuery, useGetRbacResourceDiscoveryQuery, useGetRbacResourceListQuery, useGetRbacPoliciesQuery, useCreateRbacPolicyMutation, useUpdateRbacPolicyMutation, useDeleteRbacPolicyMutation, useGetRbacPolicyDetailsQuery, useGetWatchedGroupsQuery, useCreateWatchedGroupMutation, useUpdateWatchedGroupMutation, useDeleteWatchedGroupMutation, useAddWatchedUserMutation, useRemoveWatchedUserMutation, useAddWatcherMutation, useUpdateWatcherMutation, useDeleteWatcherMutation, useGetWatchedUsersQuery, useGetWatchersQuery, WATCHER_NOTIFICATION_EVENTS, WATCHER_NOTIFICATION_EVENT_LABELS, useGetApplicationFormsQuery, useGetApplicationFormDetailQuery, useCreateApplicationFormMutation, useUpdateApplicationFormMutation, useGetApplicationAdminDetailQuery, useInviteApplicationCandidateMutation, useLazyGetApplicationAttachmentFileQuery, useCreateApplicationWaiverMutation, useDeleteApplicationWaiverMutation, useSubmitApplicationOverrideMutation, useUpdateApplicationPlacementMutation, useDeleteApplicationCourseAssignmentMutation, useCreateApplicationNoteMutation, useUpdateApplicationNoteMutation, useDeleteApplicationNoteMutation, useTransitionApplicationMutation, useLinkApplicationCandidateMutation, useCreateApplicationPlacementsMutation, useGetCustomMentorsQuery, useCreateApplicationCourseAssignmentsMutation, useGetApplicationBlocksQuery, useDeleteApplicationBlockMutation, useGetApplicationsPipelineStatsQuery, useGetApplicationsPipelineQuery, useGetTenantMetadataQuery, useUpdateTenantMetadataMutation, useLazyGetTenantMetadataQuery, useDeleteApiKeyMutation, useGetApiKeyQuery, useGetApiKeyFieldPermissionsQuery, useUpdateApiKeyMutation, useGetApiKeysQuery, unwrapApiTokenList, useCreateApiKeyMutation, useCreateLLMCredentialMutation, useGetMaskedLLMCredentialsQuery, useDeleteIntegrationCredentialMutation, useDeleteCredentialMutation, useCreateIntegrationCredentialMutation, useGetIntegrationCredentialsSchemaQuery, useGetMaskedIntegrationCredentialsQuery, useGetAccountBillingInfoQuery, useUpdateAutoRechargeInfoMutation, useTriggerAutoRechargeMutation, useGetAgentSpendCapQuery, useGetTenantSpendCapQuery, useListAgentUserSpendCapsQuery, useUpsertAgentSpendCapMutation, useDeleteAgentSpendCapMutation, useUpsertTenantSpendCapMutation, useDeleteTenantSpendCapMutation, useUpsertUserSpendCapMutation, useDeleteUserSpendCapMutation, useGetLlmUsageMetricsQuery, useListAgentSpendCapsQuery, useGetCreditTransactionsQuery, useCreateStripeCustomerPortalMutation, useSetPlatformConfigurationsMutation, useGetPlatformConfigurationsQuery, useUpdatePlatformMembershipMutation, useGetPlatformMembershipQuery, VERCEL_SPA, useGetCustomDomainsQuery, useGetHostingProjectsQuery, useCreateCustomDomainMutation, useDeleteCustomDomainMutation, useCreateHostingProjectDomainMutation, useUpdateHostingDomainMutation, useDeleteHostingDomainMutation, useGetStudentMentorCreationStatusQuery, useSetStudentMentorCreationStatusMutation, coreApiSlice, recommendationPromptTypeEnum, useGetRecommendedPromptsListQuery, useCreateRecommendedPromptMutation, useUpdateRecommendedPromptMutation, useDeleteRecommendedPromptMutation, useLazyGetPublicPlatformImageAssetFileUrlQuery, useCreatePlatformImageAssetMutation, useGetProviderConfigQuery, useCreateProviderConfigMutation, useDeleteProviderConfigMutation, useGetExternalMappingQuery, useGetCredentialsListQuery, useCreateExternalMappingMutation, useDeleteExternalMappingMutation, useGetMemsearchConfigQuery, useUpdateMemsearchConfigMutation, useGetStripeConnectStatusQuery, useStartStripeConnectOnboardingMutation, useLazyGetStripeConnectDashboardQuery, useListPaywallsQuery, useListPricesQuery, useCreatePriceMutation, useUpdatePriceMutation, useDeletePriceMutation, useGetPaywallConfigQuery, useEnablePaywallMutation, useUpdatePaywallMutation, useGetMentorMemoriesListQuery, useGetMemoryCategoriesAdminQuery, useCreateMentorMemoryMutation, splitHostPortInput, validateHostPort, useCreateVirtualMachineNetworkPolicyMutation, useUpdateVirtualMachineNetworkPolicyMutation, VIRTUAL_MACHINE_MAX_POLICY_HOSTS, getVirtualMachineApiError, useDeleteVirtualMachineNetworkPolicyMutation, extractBoundMentorIds, useCreateVirtualMachineSecretMutation, useUpdateVirtualMachineSecretMutation, VIRTUAL_MACHINE_SECRET_VALUE_MIN_LENGTH, VIRTUAL_MACHINE_ENV_VAR_PATTERN, useDeleteVirtualMachineSecretMutation, useGetIntegrationCredentialsQuery, useListVirtualMachineNetworkPoliciesQuery, useListVirtualMachineSecretsQuery, getVirtualMachineErrorStatus, useGetNotificationsCountQuery, useLazyGetNotificationsQuery, useMarkAllAsReadMutation, useCreateNotificationPreviewMutation, useSendNotificationMutation, USER_PROGRESS_DATA_POINTS, useResetTemplateMutation, useSendTestTemplateEmailMutation, useUpdateTemplateMutation, useGetTemplateDetailsQuery, USER_PROGRESS_SUMMARY_TYPE, useGetTemplatesQuery, useLazyGetTemplateDetailsQuery, useToggleTemplateMutation, useGetLlmUsageTracesQuery, useGetLlmUsageObservationsQuery, useGetTopicsStatsQuery, useGetUsersStatsQuery, useGetSessionStatsQuery, useGetTopicsDetailsStatsQuery, useGetTranscriptsConversationHeadlineQuery, useGetAccessTimeHeatmapQuery, useGetUserDetailsStatsQuery, useGetAverageRatingQuery, useGetModelCostsQuery, useGetPerUserCostsQuery, useGetTenantCostQuery, useGetAgentCostQuery, useGetTranscriptsMessagesDetailsQuery, useGetTranscriptsMessagesQuery, useGetReportDetailQuery, useGetMentorPublicSettingsQuery, useGetReportsQuery, useCreateReportMutation, useGetContentAnalyticsQuery, useGetContentAnalyticsDetailsQuery, useGetRevenueQuery, useListSubscribersQuery, useGetAuditLogsQuery, useGetPlatformAuditLogsQuery, PLATFORM_AUDIT_EVENT_TYPES, PLATFORM_AUDIT_ACTION_CODES, useGetMentorMemoriesQuery, useLazyGetCourseMetaDataQuery, useLazyGetCourseCompletionOutlinesQuery, useLazyGetCourseEligibilityQuery, useLazyGetUserEnrolledCoursesQuery, useLazyGetUserAssignedCoursesQuery, useLazyGetUserCredentialsQuery, useLazyGetOverTimeActivityQuery, useLazyGetCatalogSearchQuery, useCreateOrUpdateUserReportedSkillMutation, useCreateOrUpdateUserDesiredSkillMutation, useLazyGetPathwayListQuery, useLazyGetUserAssignedPathwaysQuery, useLazyGetUserEnrolledPathwaysQuery, useLazyGetPathwayCompletionQuery, useLazyGetProgramListQuery, useLazyGetProgramCompletionQuery, useLazyGetUserEnrolledProgramsQuery, useLazyGetAssignedProgramsQuery, useLazyGetUserSkillsPointsQuery, useLazyGetUserReportedSkillsQuery, useLazyGetUserDesiredSkillsQuery, useLazyGetUserCatalogPathwaysQuery, useLazyGetPerLearnerInfoQuery, useLazyGetEdxSSOTokenQuery, useCreateCourseEnrollmentMutation, useCreateStripeCheckoutSessionMutation, useLazyGetCourseProgressQuery, useLazyGetCourseCompletionQuery, useLazyGetPersonnalizedSearchQuery, useUpdateExamAttemptMutation, useStartExamMutation, useLazyGetExamInfoQuery, useGetMentorSettingsQuery, useEditMentorMutation, isVirtualMachineEgressNetworked, findUncoveredSecretHosts, VIRTUAL_MACHINE_MAX_SECRETS_PER_MENTOR, VIRTUAL_MACHINE_DEFAULT_BILLING, VIRTUAL_MACHINE_EGRESS_PROFILES, useGetClawMentorConfigQuery, useGetClawInstancesQuery, useGetAgentConfigQuery, useUpdateClawMentorConfigMutation, useCreateClawMentorConfigMutation, useDeleteClawMentorConfigMutation, usePushClawConfigMutation, useCreateClawInstanceMutation, useDeleteClawInstanceMutation, useUpdateAgentConfigMutation, useHealthCheckClawInstanceMutation, useTestConnectivityClawInstanceMutation, useUpdateClawInstanceMutation, useGetAgentSkillResourcesQuery, useCreateAgentSkillResourceMutation, useUpdateAgentSkillResourceMutation, useUploadAgentSkillResourceAssetMutation, useDeleteAgentSkillResourceMutation, useGetMentorSkillAssignmentsQuery, useGetAgentSkillsQuery, useCreateMentorSkillAssignmentMutation, useUpdateMentorSkillAssignmentMutation, useDeleteMentorSkillAssignmentMutation, useCreateAgentSkillMutation, useUpdateAgentSkillMutation, useDeleteAgentSkillMutation, filterSlashSkills, useGetMentorSkillAssignmentsInfiniteQuery, MENTOR_SKILL_ASSIGNMENTS_PAGE_SIZE, useCreateCheckoutMutation, useGetUserProjectsQuery, useUpdateUserProjectMutation, useGetTrainingDocumentsQuery, useLazyGetConnectedServiceAuthUrlQuery, useCreateUserProjectMutation, useDeleteUserProjectMutation, useGetUserProjectDetailsQuery, useEditTrainingDocumentMutation, useAddTrainingDocumentMutation, useLazyGetCredentialsQuery, useGetMentorCategoriesQuery, useCreateMentorMutation, useUpdateUserPlatformMetadataMutation, useGetApplicationStatusQuery, useListOwnApplicationsQuery, useGetApplicationFormQuery, useWithdrawApplicationMutation, useRenewApplicationMutation, useCreateApplicationDraftMutation, useSubmitApplicationMutation, useUpdateApplicationMutation, useUploadApplicationAttachmentMutation, useDeleteApplicationAttachmentMutation, useCreateMemoryCategoryMutation, useUpdateMemoryCategoryMutation, useDeleteMemoryCategoryMutation, useGetPromptCategoriesQuery, useCreatePromptMutation, useDeletePromptMutation, useGetPromptsSearchQuery, useUpdatePromptMutation, useDeleteTrainingDocumentMutation, useGetTrainingDocumentRetrainScheduleQuery, useCreateTrainingDocumentRetrainScheduleMutation } from '@iblai/data-layer';
 import { useDispatch, useSelector } from 'react-redux';
 import { selectSessionId, selectActiveChatMessages, useCachedSessionId, chatActions, LOCAL_STORAGE_KEYS, TimeTracker, selectRbacPermissions, useCurrentTenant, canViewOtherUsersChatHistory, isPureWatcher, getInitials, useTenantMetadata, useUsername, selectStreaming, isLoggedIn, TOOL_NAME_MAP, WRITE_TODOS_TOOL, WithPermissions, canWriteField, useStripeUpgrade, openExternalUrl, CHAT_AREA_SIZE, isAlphaNumeric32, checkRbacPermission, getTimeAgo, REQUIRED_ACTIONS_FOR_GROUPS, getVisibleAnalyticsTabs, canViewMonetizationAnalytics, getUserName as getUserName$2, formatRelativeTime as formatRelativeTime$2, ANONYMOUS_USERNAME, combineCSVData, WATCHER_HIDDEN_REPORTS, canViewPlatformAuditLogs, redirectToAuthSpaJoinTenant, redirectToAuthSpa, getAuthSpaJoinUrl, useOS, selectNumberOfActiveChatMessages, TOOLS, hasRemoteAiConfig, isSafariBrowser, useShowAttachment, useShowVoiceCall, useShowVoiceRecorder, useMentorSettings, selectShowingSharedChat, useShowFreeTrialDialog, useEmbedMode, chatInputSliceSelectors, useResponsive, useAccessingPublicRoute, useVisitingTenant, useModelFileUploadCapabilities, useChatFileUpload, useVoiceChat, selectAttachedFiles, MENTOR_CHAT_DOCUMENTS_EXTENSIONS, chatInputSliceActions, removeFile, WithFormPermissions, MENTOR_VISIBILITY } from '@iblai/web-utils';
 import { toast } from 'sonner';
@@ -266,6 +266,34 @@ function useLlmDisplayName({ llmName, llmConfig, org, userId, mentorId, }) {
     }, [skip, providers, llmName]);
     return (_a = fromConfig !== null && fromConfig !== void 0 ? fromConfig : fromCatalogue) !== null && _a !== void 0 ? _a : getLLMModelDisplayName(llmName);
 }
+/**
+ * A resolver from an LLM provider's display name (what the mentor-search
+ * `llm_providers` facet carries, e.g. `OpenAI`, `Microsoft`) to the logo the
+ * tenant's credentials schema publishes for it, matched on
+ * `service_info.display_name`. Resolves to `null` when disabled, still
+ * loading, or when no schema row carries that name.
+ *
+ * Moved here from the mentorai app's `use-llm-provider-details` so every host
+ * shares one copy; the app keeps its own until its next SDK bump.
+ */
+function useCredentialsSchemaLogos({ org, enabled }) {
+    const { data: schemas } = useGetCredentialsSchemaQuery({ org: org !== null && org !== void 0 ? org : '' }, { skip: !org || !enabled });
+    // First row wins on a duplicate display name, as `Array.find` would.
+    const logosByDisplayName = useMemo(() => {
+        var _a, _b;
+        const byName = new Map();
+        if (!Array.isArray(schemas))
+            return byName;
+        for (const schema of schemas) {
+            const displayName = (_a = schema === null || schema === void 0 ? void 0 : schema.service_info) === null || _a === void 0 ? void 0 : _a.display_name;
+            const logo = (_b = schema === null || schema === void 0 ? void 0 : schema.service_info) === null || _b === void 0 ? void 0 : _b.logo;
+            if (displayName && logo && !byName.has(displayName))
+                byName.set(displayName, logo);
+        }
+        return byName;
+    }, [schemas]);
+    return useCallback((displayName) => (displayName && logosByDisplayName.get(displayName)) || null, [logosByDisplayName]);
+}
 
 var _a;
 const dl$1 = dataLayer;
@@ -3836,7 +3864,9 @@ var datasetsTabAddResourceModal$3 = {
 	title: "Add Resources",
 	description: "Add knowledge to help your agent provide more relevant insights. Others with edit access can reuse these sources for more topics.",
 	googleDrivePickerError: "Google Drive Picker Error",
-	forceClosePicker: "Force Close Picker"
+	forceClosePicker: "Force Close Picker",
+	notConfigured: "Not configured for this tenant",
+	scrollRegionAriaLabel: "Resource types"
 };
 var datasetsTabDatasetItem$3 = {
 	scheduleRetrain: "Schedule retrain",
@@ -5213,7 +5243,9 @@ var profileAccount$3 = {
 	groupSystem: "System",
 	ariaSettingsNav: "Organization settings",
 	ariaSettingsNavMobile: "Organization settings (mobile)",
-	groupFinance: "Finance"
+	groupFinance: "Finance",
+	tabVirtualMachine: "Virtual Machine",
+	descVirtualMachine: "Manage the network policies and secrets available to agents' virtual machines."
 };
 var profileAddCreditsModal$3 = {
 	title: "Add Credits",
@@ -5754,7 +5786,11 @@ var resourceModalGithubFileUploadModal$3 = {
 	errorAddingDocument: "Error adding training document",
 	githubRepoUrlPlaceholder: "Github Repo URL",
 	selectBranchPlaceholder: "Select Branch",
-	submit: "Submit"
+	submit: "Submit",
+	description: "Add a GitHub repository and pick a branch to train your agent on.",
+	scrollRegionAriaLabel: "Repository details",
+	repoUrlLabel: "Repository URL",
+	branchLabel: "Branch"
 };
 var resourceModalLocalFileUploadModal$3 = {
 	fileNotFound: "File not found",
@@ -5768,7 +5804,9 @@ var resourceModalLocalFileUploadModal$3 = {
 	descriptionOptional: "Description (optional)",
 	descriptionPlaceholder: "Add a description for this image...",
 	submitting: "Submitting",
-	submit: "Submit"
+	submit: "Submit",
+	description: "Upload a file to train your agent on its contents.",
+	scrollRegionAriaLabel: "File upload"
 };
 var resourceModalUrlUploadModal$3 = {
 	urlPlaceholder: "URL",
@@ -5777,11 +5815,15 @@ var resourceModalUrlUploadModal$3 = {
 	invalidYoutubeUrl: "Invalid YouTube URL",
 	invalidBlackboardUrl: "Invalid Blackboard URL",
 	invalidUrl: "Invalid URL",
-	submit: "Submit"
+	submit: "Submit",
+	description: "Add a link to train your agent on its content.",
+	scrollRegionAriaLabel: "Link details",
+	urlLabel: "URL"
 };
 var resourceModalWebsiteCrawlModal$3 = {
-	title: "Web Crawler Configuration",
 	description: "Configure your web crawler settings and URL patterns",
+	infoBox: "Crawl a website and train your agent on its pages. Set how deep to follow links, how many pages to fetch, and which URLs to include.",
+	scrollRegionAriaLabel: "Web crawler settings",
 	formAriaLabel: "Web crawler configuration form",
 	urlRequired: "URL is required",
 	invalidUrl: "Invalid URL",
@@ -5796,6 +5838,9 @@ var resourceModalWebsiteCrawlModal$3 = {
 	selectPatternTypeAriaLabel: "Select pattern type",
 	globPattern: "Glob Pattern",
 	regularExpression: "Regular Expression",
+	userAgentLabel: "User-Agent (optional)",
+	userAgentPlaceholder: "Iblai-bot/1.0 (+https://ibl.ai/bot)",
+	userAgentHelpText: "Optional. Overrides the default crawler User-Agent for every request. Leave blank to use the default.",
 	crawlerMatchPatternsLabel: "Crawler Match Patterns",
 	globPlaceholder: "https://example.com/",
 	regexPlaceholder: "(http|https)://www.example.com/(.*)",
@@ -7000,8 +7045,8 @@ var uiSidebar$3 = {
 var userProfileDropdownIndex$3 = {
 	profile: "Profile",
 	account: "Account",
-	learner: "Learner",
-	instructor: "Instructor",
+	learner: "User",
+	instructor: "Admin",
 	help: "Help",
 	logOut: "Log Out",
 	moreOptions: "More options"
@@ -8538,6 +8583,177 @@ var profileLlmUsage$3 = {
 	tryAgain: "Try again",
 	scopeUser: "Usage for {username}"
 };
+var virtualMachineHostInput$3 = {
+	listLabel: "Allowed Hosts",
+	removeHost: "Remove {host}",
+	placeholder: "api.example.com:443",
+	hint: "Type host:port and press Enter, or paste a list.",
+	errorFormat: "{entry} must be host:port, for example api.example.com:443 — no scheme, path or wildcard.",
+	errorPort: "{entry}: the port must be between 1 and 65535.",
+	errorRejectedHost: "{entry}: this host is reserved and cannot be allowed.",
+	errorIpNotAllowed: "{entry}: use a hostname here, not an IP address.",
+	errorDuplicate: "{entry} is already in the list.",
+	errorMax: "You can add at most {max} hosts."
+};
+var virtualMachineAdminTab$3 = {
+	infoBox: "Agents with Virtual Machine Shell run code in an isolated Linux VM that has no network access by default. Network policies are reusable lists of the host:port destinations a VM may reach, and VM secrets are keys the VM can use but never read. Pick them for an agent from its Sandbox settings.",
+	tabsAriaLabel: "Virtual machine sections",
+	tabNetworkPolicies: "Network Policies",
+	tabSecrets: "Secrets",
+	forbidden: "You do not have permission to manage virtual machine network policies or secrets."
+};
+var virtualMachineNetworkPolicies$3 = {
+	newPolicy: "New Policy",
+	loadFailed: "Network policies could not be loaded. Try again in a moment.",
+	colName: "Name",
+	colHosts: "Allowed Hosts",
+	colDescription: "Description",
+	colUpdated: "Updated",
+	colActions: "Actions",
+	hostsListAriaLabel: "Hosts allowed by {name}",
+	moreHosts: "+{count} more",
+	editAriaLabel: "Edit policy {name}",
+	deleteAriaLabel: "Delete policy {name}",
+	empty: "No network policies yet. Create one to let an agent's VM reach specific hosts.",
+	createTitle: "New Network Policy",
+	editTitle: "Edit Network Policy",
+	dialogDescription: "The host:port destinations a VM may reach under this policy. HTTPS is port 443.",
+	fieldName: "Name",
+	namePlaceholder: "e.g. Acme APIs",
+	fieldHosts: "Allowed Hosts",
+	hostsHint: "Type host:port and press Enter, or paste a list. Up to {max} entries; IP addresses are allowed.",
+	removedHostsWarning: "You are removing {hosts}. If an agent uses this policy and has a secret that is sent to one of these hosts, that secret will stop working.",
+	fieldDescription: "Description (Optional)",
+	descriptionPlaceholder: "What this policy is for",
+	cancel: "Cancel",
+	saveChanges: "Save Changes",
+	createPolicy: "Create Policy",
+	errorNameRequired: "Give the policy a name.",
+	errorHostsRequired: "Add at least one host.",
+	created: "Network policy created",
+	updated: "Network policy updated",
+	deleted: "Network policy deleted",
+	saveFailed: "The policy could not be saved. Try again.",
+	forbiddenWrite: "You do not have permission to change network policies.",
+	forbiddenDelete: "You do not have permission to delete network policies.",
+	deleteTitle: "Delete Network Policy",
+	deleteConfirm: "Delete {name}? Agents set to the Custom profile can only use policies that still exist.",
+	deleteBlockedInUse: "This policy is still used by the following agents. Move them to another policy or profile first.",
+	deleteFailed: "The policy could not be deleted. Try again.",
+	"delete": "Delete"
+};
+var virtualMachineSecrets$3 = {
+	newSecret: "New Secret",
+	loadFailed: "VM secrets could not be loaded. Try again in a moment.",
+	colName: "Name",
+	colEnvVar: "Variable",
+	colHosts: "Allowed Hosts",
+	colSource: "Source",
+	colUpdated: "Updated",
+	colActions: "Actions",
+	hostsListAriaLabel: "Hosts {name} is sent to",
+	moreHosts: "+{count} more",
+	sourceStored: "Stored Value",
+	sourceFromCredential: "Credential {credential} · {field}",
+	editAriaLabel: "Edit secret {name}",
+	deleteAriaLabel: "Delete secret {name}",
+	empty: "No VM secrets yet. Create one to let an agent call an API with your organization's key without ever seeing it.",
+	createTitle: "New VM Secret",
+	editTitle: "Edit VM Secret",
+	dialogDescription: "The value is never shown again after you save it.",
+	fieldName: "Name",
+	namePlaceholder: "e.g. Acme API key",
+	fieldEnvVar: "Environment Variable",
+	envVarPlaceholder: "e.g. ACME_KEY",
+	envVarHelp: "Letters, digits and underscores; cannot start with a digit.",
+	envVarReadOnlyHelp: "Cannot be renamed. Delete this secret and create a new one instead.",
+	fieldHosts: "Allowed Hosts",
+	hostsHint: "Only these hosts receive the real key, so keep it to the narrowest host that needs it. Type host:port and press Enter.",
+	fieldSource: "Value Source",
+	sourceValue: "Enter a Value",
+	sourceValueDescription: "Stored encrypted and never shown again.",
+	sourceCredential: "Use an Integration Credential",
+	sourceCredentialDescription: "Reads one field of a saved credential and follows rotations automatically.",
+	fieldValue: "Value",
+	valuePlaceholder: "Paste the key",
+	valueKeepPlaceholder: "Leave blank to keep the current value",
+	valueHelp: "At least {min} characters.",
+	valueKeepHelp: "Leave blank to keep the current value.",
+	fieldCredential: "Integration Credential",
+	credentialPlaceholder: "Choose a credential",
+	noCredentials: "Your organization has no integration credentials yet. Add one under Integrations, or enter a value instead.",
+	fieldCredentialField: "Credential Field",
+	credentialFieldPlaceholder: "Choose a field",
+	credentialNoFields: "This credential has no fields to read from.",
+	cancel: "Cancel",
+	saveChanges: "Save Changes",
+	createSecret: "Create Secret",
+	errorNameRequired: "Give the secret a name.",
+	errorEnvVarRequired: "Enter the environment variable name.",
+	errorEnvVarFormat: "Use letters, digits and underscores only, and do not start with a digit.",
+	errorHostsRequired: "Add at least one host.",
+	errorValueRequired: "Enter the value.",
+	errorValueTooShort: "The value must be at least {min} characters.",
+	errorValueMasked: "This looks like a masked value. Paste the real key.",
+	errorCredentialRequired: "Choose a credential.",
+	errorFieldRequired: "Choose the credential field.",
+	created: "VM secret created",
+	updated: "VM secret updated",
+	deleted: "VM secret deleted",
+	saveFailed: "The secret could not be saved. Try again.",
+	forbiddenWrite: "You do not have permission to change VM secrets.",
+	forbiddenDelete: "You do not have permission to delete VM secrets.",
+	deleteTitle: "Delete VM Secret",
+	deleteConfirm: "Delete {envVar}? It will also be removed from every agent that uses it.",
+	deleteFailed: "The secret could not be deleted. Try again.",
+	"delete": "Delete"
+};
+var virtualMachineNetworkSection$3 = {
+	title: "Network Access",
+	description: "Decide what this agent's virtual machine can reach and which credentials it can use.",
+	billingNotice: "Virtual machine time is billed to the chatting user's credits: ${usd} per {minutes} minutes by default, prorated per second. Your organization's rate may differ.",
+	egressLabel: "Egress Profile",
+	egressHelp: "How much of the network the VM gets.",
+	egressNoneLabel: "No Network",
+	egressNoneDescription: "The VM cannot reach anything.",
+	egressRegistriesLabel: "Package Registries",
+	egressRegistriesDescription: "PyPI, npm, apt and apk only, for installing packages.",
+	egressPublicLabel: "Public Internet",
+	egressPublicDescription: "Any public host. Private networks, localhost and cloud metadata stay blocked.",
+	egressCustomLabel: "Custom Allowlist",
+	egressCustomDescription: "Only the hosts in the network policy you pick below.",
+	policyLabel: "Network Policy",
+	policiesForbidden: "You do not have permission to view network policies, so this profile cannot be configured from here.",
+	noPolicies: "No network policies yet",
+	policyPlaceholder: "Choose a policy",
+	createPolicy: "Create Policy",
+	editPolicy: "Edit Policy",
+	managePolicies: "Manage Policies",
+	manageSecrets: "Manage Secrets",
+	policyRequired: "The Custom profile needs a network policy.",
+	policyHosts: "Hosts this policy allows:",
+	secretsLabel: "Secrets",
+	secretsHelp: "Keys the VM can use but never read. Up to {max} per agent.",
+	noSecrets: "Your organization has no VM secrets yet. Use Manage Secrets to create one.",
+	secretsCapReached: "This agent has the maximum of {max} secrets.",
+	uncoveredTitle: "Some secrets are sent to hosts this policy does not allow:",
+	uncoveredItem: "{envVar} needs {hosts}, which {policy} doesn't allow.",
+	addHostsAndSave: "Add Hosts to {policy} and Save",
+	saved: "Network settings saved",
+	saveFailed: "The network settings could not be saved. Try again.",
+	forbiddenSave: "You do not have permission to change these settings.",
+	policyHostsAdded: "Hosts added to {policy}",
+	policyUpdateFailed: "The policy could not be updated, so the settings were not saved.",
+	policyUpdateForbidden: "You do not have permission to change network policies, so the settings were not saved.",
+	discard: "Discard",
+	save: "Save Changes",
+	narrowTitle: "Unbind Secrets?",
+	narrowDescription: "{profile} gives the VM no access to the hosts these secrets need, so saving will unbind {count, plural, one {# secret} other {# secrets}} from this agent.",
+	cancel: "Cancel",
+	narrowConfirm: "Unbind and Save",
+	manageTitle: "Virtual Machine Settings",
+	manageDescription: "Network policies and VM secrets are shared by every agent in your organization."
+};
 var en = {
 	accessTabAddAccess: accessTabAddAccess$3,
 	accessTabLabels: accessTabLabels$3,
@@ -8823,7 +9039,12 @@ var en = {
 	analyticsCostTabs: analyticsCostTabs$3,
 	analyticsLlmUsage: analyticsLlmUsage$3,
 	analyticsTraces: analyticsTraces$3,
-	profileLlmUsage: profileLlmUsage$3
+	profileLlmUsage: profileLlmUsage$3,
+	virtualMachineHostInput: virtualMachineHostInput$3,
+	virtualMachineAdminTab: virtualMachineAdminTab$3,
+	virtualMachineNetworkPolicies: virtualMachineNetworkPolicies$3,
+	virtualMachineSecrets: virtualMachineSecrets$3,
+	virtualMachineNetworkSection: virtualMachineNetworkSection$3
 };
 
 var accessTabAddAccess$2 = {
@@ -11325,7 +11546,9 @@ var datasetsTabAddResourceModal$2 = {
 	title: "Ajouter des ressources",
 	description: "Ajoutez des connaissances pour aider votre agent à fournir des informations plus pertinentes. Les autres utilisateurs avec accès en modification peuvent réutiliser ces sources pour d'autres sujets.",
 	googleDrivePickerError: "Erreur du sélecteur Google Drive",
-	forceClosePicker: "Forcer la fermeture du sélecteur"
+	forceClosePicker: "Forcer la fermeture du sélecteur",
+	notConfigured: "Non configuré pour ce locataire",
+	scrollRegionAriaLabel: "Types de ressources"
 };
 var datasetsTabDatasetItem$2 = {
 	scheduleRetrain: "Planifier le réentraînement",
@@ -12702,7 +12925,9 @@ var profileAccount$2 = {
 	groupSystem: "Système",
 	ariaSettingsNav: "Paramètres de l'organisation",
 	ariaSettingsNavMobile: "Paramètres de l'organisation (mobile)",
-	groupFinance: "Finance"
+	groupFinance: "Finance",
+	tabVirtualMachine: "Machine virtuelle",
+	descVirtualMachine: "Gérez les politiques réseau et les secrets disponibles pour les machines virtuelles des agents."
 };
 var profileAddCreditsModal$2 = {
 	title: "Ajouter des crédits",
@@ -13243,7 +13468,11 @@ var resourceModalGithubFileUploadModal$2 = {
 	errorAddingDocument: "Erreur lors de l'ajout du document d'entraînement",
 	githubRepoUrlPlaceholder: "URL du dépôt GitHub",
 	selectBranchPlaceholder: "Sélectionner une branche",
-	submit: "Soumettre"
+	submit: "Soumettre",
+	description: "Ajoutez un dépôt GitHub et choisissez une branche pour entraîner votre agent.",
+	scrollRegionAriaLabel: "Détails du dépôt",
+	repoUrlLabel: "URL du dépôt",
+	branchLabel: "Branche"
 };
 var resourceModalLocalFileUploadModal$2 = {
 	fileNotFound: "Fichier introuvable",
@@ -13257,7 +13486,9 @@ var resourceModalLocalFileUploadModal$2 = {
 	descriptionOptional: "Description (facultative)",
 	descriptionPlaceholder: "Ajoutez une description pour cette image...",
 	submitting: "Envoi en cours",
-	submit: "Soumettre"
+	submit: "Soumettre",
+	description: "Importez un fichier pour entraîner votre agent sur son contenu.",
+	scrollRegionAriaLabel: "Import de fichier"
 };
 var resourceModalUrlUploadModal$2 = {
 	urlPlaceholder: "URL",
@@ -13266,11 +13497,15 @@ var resourceModalUrlUploadModal$2 = {
 	invalidYoutubeUrl: "URL YouTube invalide",
 	invalidBlackboardUrl: "URL Blackboard invalide",
 	invalidUrl: "URL invalide",
-	submit: "Soumettre"
+	submit: "Soumettre",
+	description: "Ajoutez un lien pour entraîner votre agent sur son contenu.",
+	scrollRegionAriaLabel: "Détails du lien",
+	urlLabel: "URL"
 };
 var resourceModalWebsiteCrawlModal$2 = {
-	title: "Configuration du robot d'exploration web",
 	description: "Configurez les paramètres et les modèles d'URL de votre robot d'exploration web",
+	infoBox: "Explorez un site web et entraînez votre agent sur ses pages. Définissez la profondeur des liens, le nombre de pages à récupérer et les URL à inclure.",
+	scrollRegionAriaLabel: "Paramètres du robot d'exploration",
 	formAriaLabel: "Formulaire de configuration du robot d'exploration web",
 	urlRequired: "L'URL est requise",
 	invalidUrl: "URL invalide",
@@ -13285,6 +13520,9 @@ var resourceModalWebsiteCrawlModal$2 = {
 	selectPatternTypeAriaLabel: "Sélectionner le type de modèle",
 	globPattern: "Modèle Glob",
 	regularExpression: "Expression régulière",
+	userAgentLabel: "User-Agent (facultatif)",
+	userAgentPlaceholder: "Iblai-bot/1.0 (+https://ibl.ai/bot)",
+	userAgentHelpText: "Facultatif. Remplace le User-Agent par défaut du robot d'exploration pour chaque requête. Laissez vide pour utiliser celui par défaut.",
 	crawlerMatchPatternsLabel: "Modèles de correspondance du robot",
 	globPlaceholder: "https://example.com/",
 	regexPlaceholder: "(http|https)://www.example.com/(.*)",
@@ -14489,8 +14727,8 @@ var uiSidebar$2 = {
 var userProfileDropdownIndex$2 = {
 	profile: "Profil",
 	account: "Compte",
-	learner: "Apprenant",
-	instructor: "Instructeur",
+	learner: "Utilisateur",
+	instructor: "Administrateur",
 	help: "Aide",
 	logOut: "Se déconnecter",
 	moreOptions: "Plus d'options"
@@ -15861,6 +16099,177 @@ var profileLlmUsage$2 = {
 	tryAgain: "Réessayer",
 	scopeUser: "Utilisation de {username}"
 };
+var virtualMachineHostInput$2 = {
+	listLabel: "Hôtes autorisés",
+	removeHost: "Retirer {host}",
+	placeholder: "api.exemple.com:443",
+	hint: "Saisissez hôte:port et appuyez sur Entrée, ou collez une liste.",
+	errorFormat: "{entry} doit être au format hôte:port, par exemple api.exemple.com:443, sans schéma, chemin ni joker.",
+	errorPort: "{entry} : le port doit être compris entre 1 et 65535.",
+	errorRejectedHost: "{entry} : cet hôte est réservé et ne peut pas être autorisé.",
+	errorIpNotAllowed: "{entry} : utilisez ici un nom d'hôte, pas une adresse IP.",
+	errorDuplicate: "{entry} figure déjà dans la liste.",
+	errorMax: "Vous pouvez ajouter au plus {max} hôtes."
+};
+var virtualMachineAdminTab$2 = {
+	infoBox: "Les agents dotés du Shell de machine virtuelle exécutent du code dans une VM Linux isolée, sans accès réseau par défaut. Les politiques réseau sont des listes réutilisables de destinations hôte:port qu'une VM peut joindre, et les secrets de VM sont des clés que la VM peut utiliser sans jamais les lire. Sélectionnez-les pour un agent depuis ses paramètres Sandbox.",
+	tabsAriaLabel: "Sections de la machine virtuelle",
+	tabNetworkPolicies: "Politiques réseau",
+	tabSecrets: "Secrets",
+	forbidden: "Vous n'avez pas l'autorisation de gérer les politiques réseau ni les secrets des machines virtuelles."
+};
+var virtualMachineNetworkPolicies$2 = {
+	newPolicy: "Nouvelle politique",
+	loadFailed: "Impossible de charger les politiques réseau. Réessayez dans un instant.",
+	colName: "Nom",
+	colHosts: "Hôtes autorisés",
+	colDescription: "Description",
+	colUpdated: "Mise à jour",
+	colActions: "Actions",
+	hostsListAriaLabel: "Hôtes autorisés par {name}",
+	moreHosts: "+{count} de plus",
+	editAriaLabel: "Modifier la politique {name}",
+	deleteAriaLabel: "Supprimer la politique {name}",
+	empty: "Aucune politique réseau pour l'instant. Créez-en une pour que la VM d'un agent puisse joindre des hôtes précis.",
+	createTitle: "Nouvelle politique réseau",
+	editTitle: "Modifier la politique réseau",
+	dialogDescription: "Les destinations hôte:port qu'une VM peut joindre avec cette politique. HTTPS correspond au port 443.",
+	fieldName: "Nom",
+	namePlaceholder: "p. ex. API Acme",
+	fieldHosts: "Hôtes autorisés",
+	hostsHint: "Saisissez hôte:port et appuyez sur Entrée, ou collez une liste. Jusqu'à {max} entrées ; les adresses IP sont acceptées.",
+	removedHostsWarning: "Vous retirez {hosts}. Si un agent utilise cette politique et possède un secret envoyé à l'un de ces hôtes, ce secret cessera de fonctionner.",
+	fieldDescription: "Description (facultatif)",
+	descriptionPlaceholder: "À quoi sert cette politique",
+	cancel: "Annuler",
+	saveChanges: "Enregistrer les modifications",
+	createPolicy: "Créer la politique",
+	errorNameRequired: "Donnez un nom à la politique.",
+	errorHostsRequired: "Ajoutez au moins un hôte.",
+	created: "Politique réseau créée",
+	updated: "Politique réseau mise à jour",
+	deleted: "Politique réseau supprimée",
+	saveFailed: "La politique n'a pas pu être enregistrée. Réessayez.",
+	forbiddenWrite: "Vous n'avez pas l'autorisation de modifier les politiques réseau.",
+	forbiddenDelete: "Vous n'avez pas l'autorisation de supprimer les politiques réseau.",
+	deleteTitle: "Supprimer la politique réseau",
+	deleteConfirm: "Supprimer {name} ? Les agents en profil Personnalisé ne peuvent utiliser que des politiques existantes.",
+	deleteBlockedInUse: "Cette politique est encore utilisée par les agents suivants. Passez-les d'abord sur une autre politique ou un autre profil.",
+	deleteFailed: "La politique n'a pas pu être supprimée. Réessayez.",
+	"delete": "Supprimer"
+};
+var virtualMachineSecrets$2 = {
+	newSecret: "Nouveau secret",
+	loadFailed: "Impossible de charger les secrets de VM. Réessayez dans un instant.",
+	colName: "Nom",
+	colEnvVar: "Variable",
+	colHosts: "Hôtes autorisés",
+	colSource: "Source",
+	colUpdated: "Mis à jour",
+	colActions: "Actions",
+	hostsListAriaLabel: "Hôtes auxquels {name} est envoyé",
+	moreHosts: "+{count} de plus",
+	sourceStored: "Valeur enregistrée",
+	sourceFromCredential: "Identifiant {credential} · {field}",
+	editAriaLabel: "Modifier le secret {name}",
+	deleteAriaLabel: "Supprimer le secret {name}",
+	empty: "Aucun secret de VM pour l'instant. Créez-en un pour qu'un agent appelle une API avec la clé de votre organisation sans jamais la voir.",
+	createTitle: "Nouveau secret de VM",
+	editTitle: "Modifier le secret de VM",
+	dialogDescription: "La valeur n'est plus jamais affichée après l'enregistrement.",
+	fieldName: "Nom",
+	namePlaceholder: "p. ex. Clé API Acme",
+	fieldEnvVar: "Variable d'environnement",
+	envVarPlaceholder: "p. ex. ACME_KEY",
+	envVarHelp: "Lettres, chiffres et tirets bas ; ne peut pas commencer par un chiffre.",
+	envVarReadOnlyHelp: "Ne peut pas être renommée. Supprimez ce secret et créez-en un nouveau.",
+	fieldHosts: "Hôtes autorisés",
+	hostsHint: "Seuls ces hôtes reçoivent la vraie clé ; limitez la liste à l'hôte le plus précis qui en a besoin. Saisissez hôte:port et appuyez sur Entrée.",
+	fieldSource: "Source de la valeur",
+	sourceValue: "Saisir une valeur",
+	sourceValueDescription: "Stockée chiffrée et jamais réaffichée.",
+	sourceCredential: "Utiliser un identifiant d'intégration",
+	sourceCredentialDescription: "Lit un champ d'un identifiant enregistré et suit automatiquement les rotations.",
+	fieldValue: "Valeur",
+	valuePlaceholder: "Collez la clé",
+	valueKeepPlaceholder: "Laissez vide pour conserver la valeur actuelle",
+	valueHelp: "Au moins {min} caractères.",
+	valueKeepHelp: "Laissez vide pour conserver la valeur actuelle.",
+	fieldCredential: "Identifiant d'intégration",
+	credentialPlaceholder: "Choisissez un identifiant",
+	noCredentials: "Votre organisation n'a pas encore d'identifiants d'intégration. Ajoutez-en un dans Intégrations, ou saisissez une valeur.",
+	fieldCredentialField: "Champ de l'identifiant",
+	credentialFieldPlaceholder: "Choisissez un champ",
+	credentialNoFields: "Cet identifiant n'a aucun champ à lire.",
+	cancel: "Annuler",
+	saveChanges: "Enregistrer les modifications",
+	createSecret: "Créer le secret",
+	errorNameRequired: "Donnez un nom au secret.",
+	errorEnvVarRequired: "Saisissez le nom de la variable d'environnement.",
+	errorEnvVarFormat: "Utilisez uniquement des lettres, des chiffres et des tirets bas, sans commencer par un chiffre.",
+	errorHostsRequired: "Ajoutez au moins un hôte.",
+	errorValueRequired: "Saisissez la valeur.",
+	errorValueTooShort: "La valeur doit contenir au moins {min} caractères.",
+	errorValueMasked: "Cela ressemble à une valeur masquée. Collez la vraie clé.",
+	errorCredentialRequired: "Choisissez un identifiant.",
+	errorFieldRequired: "Choisissez le champ de l'identifiant.",
+	created: "Secret de VM créé",
+	updated: "Secret de VM mis à jour",
+	deleted: "Secret de VM supprimé",
+	saveFailed: "Le secret n'a pas pu être enregistré. Réessayez.",
+	forbiddenWrite: "Vous n'avez pas l'autorisation de modifier les secrets de VM.",
+	forbiddenDelete: "Vous n'avez pas l'autorisation de supprimer les secrets de VM.",
+	deleteTitle: "Supprimer le secret de VM",
+	deleteConfirm: "Supprimer {envVar} ? Il sera aussi retiré de tous les agents qui l'utilisent.",
+	deleteFailed: "Le secret n'a pas pu être supprimé. Réessayez.",
+	"delete": "Supprimer"
+};
+var virtualMachineNetworkSection$2 = {
+	title: "Accès réseau",
+	description: "Décidez ce que la machine virtuelle de cet agent peut joindre et quels identifiants elle peut utiliser.",
+	billingNotice: "Le temps de machine virtuelle est facturé sur les crédits de l'utilisateur qui discute : ${usd} par {minutes} minutes par défaut, au prorata de la seconde. Le tarif de votre organisation peut différer.",
+	egressLabel: "Profil de sortie",
+	egressHelp: "Quelle part du réseau la VM obtient.",
+	egressNoneLabel: "Aucun réseau",
+	egressNoneDescription: "La VM ne peut rien joindre.",
+	egressRegistriesLabel: "Registres de paquets",
+	egressRegistriesDescription: "PyPI, npm, apt et apk uniquement, pour installer des paquets.",
+	egressPublicLabel: "Internet public",
+	egressPublicDescription: "Tout hôte public. Les réseaux privés, localhost et les métadonnées cloud restent bloqués.",
+	egressCustomLabel: "Liste personnalisée",
+	egressCustomDescription: "Uniquement les hôtes de la politique réseau choisie ci-dessous.",
+	policyLabel: "Politique réseau",
+	policiesForbidden: "Vous n'avez pas l'autorisation de voir les politiques réseau, ce profil ne peut donc pas être configuré d'ici.",
+	noPolicies: "Aucune politique réseau pour l'instant",
+	policyPlaceholder: "Choisissez une politique",
+	createPolicy: "Créer une politique",
+	editPolicy: "Modifier la politique",
+	managePolicies: "Gérer les politiques",
+	manageSecrets: "Gérer les secrets",
+	policyRequired: "Le profil Personnalisé nécessite une politique réseau.",
+	policyHosts: "Hôtes autorisés par cette politique :",
+	secretsLabel: "Secrets",
+	secretsHelp: "Clés que la VM peut utiliser sans jamais les lire. Jusqu'à {max} par agent.",
+	noSecrets: "Votre organisation n'a pas encore de secrets de VM. Utilisez Gérer les secrets pour en créer un.",
+	secretsCapReached: "Cet agent a atteint le maximum de {max} secrets.",
+	uncoveredTitle: "Certains secrets sont envoyés à des hôtes que cette politique n'autorise pas :",
+	uncoveredItem: "{envVar} a besoin de {hosts}, que {policy} n'autorise pas.",
+	addHostsAndSave: "Ajouter les hôtes à {policy} et enregistrer",
+	saved: "Paramètres réseau enregistrés",
+	saveFailed: "Les paramètres réseau n'ont pas pu être enregistrés. Réessayez.",
+	forbiddenSave: "Vous n'avez pas l'autorisation de modifier ces paramètres.",
+	policyHostsAdded: "Hôtes ajoutés à {policy}",
+	policyUpdateFailed: "La politique n'a pas pu être mise à jour, les paramètres n'ont donc pas été enregistrés.",
+	policyUpdateForbidden: "Vous n'avez pas l'autorisation de modifier les politiques réseau, les paramètres n'ont donc pas été enregistrés.",
+	discard: "Annuler les modifications",
+	save: "Enregistrer les modifications",
+	narrowTitle: "Détacher les secrets ?",
+	narrowDescription: "{profile} ne donne à la VM aucun accès aux hôtes dont ces secrets ont besoin ; l'enregistrement détachera donc {count, plural, one {# secret} other {# secrets}} de cet agent.",
+	cancel: "Annuler",
+	narrowConfirm: "Détacher et enregistrer",
+	manageTitle: "Paramètres de la machine virtuelle",
+	manageDescription: "Les politiques réseau et les secrets de VM sont partagés par tous les agents de votre organisation."
+};
 var fr = {
 	accessTabAddAccess: accessTabAddAccess$2,
 	accessTabLabels: accessTabLabels$2,
@@ -16146,7 +16555,12 @@ var fr = {
 	analyticsCostTabs: analyticsCostTabs$2,
 	analyticsLlmUsage: analyticsLlmUsage$2,
 	analyticsTraces: analyticsTraces$2,
-	profileLlmUsage: profileLlmUsage$2
+	profileLlmUsage: profileLlmUsage$2,
+	virtualMachineHostInput: virtualMachineHostInput$2,
+	virtualMachineAdminTab: virtualMachineAdminTab$2,
+	virtualMachineNetworkPolicies: virtualMachineNetworkPolicies$2,
+	virtualMachineSecrets: virtualMachineSecrets$2,
+	virtualMachineNetworkSection: virtualMachineNetworkSection$2
 };
 
 var accessTabAddAccess$1 = {
@@ -18648,7 +19062,9 @@ var datasetsTabAddResourceModal$1 = {
 	title: "Agregar recursos",
 	description: "Agregue conocimiento para ayudar a su agente a proporcionar información más relevante. Otros usuarios con acceso de edición pueden reutilizar estas fuentes para más temas.",
 	googleDrivePickerError: "Error del selector de Google Drive",
-	forceClosePicker: "Forzar cierre del selector"
+	forceClosePicker: "Forzar cierre del selector",
+	notConfigured: "No configurado para este inquilino",
+	scrollRegionAriaLabel: "Tipos de recursos"
 };
 var datasetsTabDatasetItem$1 = {
 	scheduleRetrain: "Programar reentrenamiento",
@@ -20025,7 +20441,9 @@ var profileAccount$1 = {
 	groupSystem: "Sistema",
 	ariaSettingsNav: "Configuración de la organización",
 	ariaSettingsNavMobile: "Configuración de la organización (móvil)",
-	groupFinance: "Finanzas"
+	groupFinance: "Finanzas",
+	tabVirtualMachine: "Máquina virtual",
+	descVirtualMachine: "Gestiona las políticas de red y los secretos disponibles para las máquinas virtuales de los agentes."
 };
 var profileAddCreditsModal$1 = {
 	title: "Agregar créditos",
@@ -20566,7 +20984,11 @@ var resourceModalGithubFileUploadModal$1 = {
 	errorAddingDocument: "Error al agregar el documento de entrenamiento",
 	githubRepoUrlPlaceholder: "URL del repositorio de GitHub",
 	selectBranchPlaceholder: "Seleccionar rama",
-	submit: "Enviar"
+	submit: "Enviar",
+	description: "Agrega un repositorio de GitHub y elige una rama para entrenar a tu agente.",
+	scrollRegionAriaLabel: "Detalles del repositorio",
+	repoUrlLabel: "URL del repositorio",
+	branchLabel: "Rama"
 };
 var resourceModalLocalFileUploadModal$1 = {
 	fileNotFound: "Archivo no encontrado",
@@ -20580,7 +21002,9 @@ var resourceModalLocalFileUploadModal$1 = {
 	descriptionOptional: "Descripción (opcional)",
 	descriptionPlaceholder: "Añade una descripción para esta imagen...",
 	submitting: "Enviando",
-	submit: "Enviar"
+	submit: "Enviar",
+	description: "Sube un archivo para entrenar a tu agente con su contenido.",
+	scrollRegionAriaLabel: "Carga de archivo"
 };
 var resourceModalUrlUploadModal$1 = {
 	urlPlaceholder: "URL",
@@ -20589,11 +21013,15 @@ var resourceModalUrlUploadModal$1 = {
 	invalidYoutubeUrl: "URL de YouTube no válida",
 	invalidBlackboardUrl: "URL de Blackboard no válida",
 	invalidUrl: "URL no válida",
-	submit: "Enviar"
+	submit: "Enviar",
+	description: "Agrega un enlace para entrenar a tu agente con su contenido.",
+	scrollRegionAriaLabel: "Detalles del enlace",
+	urlLabel: "URL"
 };
 var resourceModalWebsiteCrawlModal$1 = {
-	title: "Configuración del rastreador web",
 	description: "Configure los ajustes de su rastreador web y los patrones de URL",
+	infoBox: "Rastrea un sitio web y entrena a tu agente con sus páginas. Define la profundidad de los enlaces, cuántas páginas obtener y qué URL incluir.",
+	scrollRegionAriaLabel: "Configuración del rastreador web",
 	formAriaLabel: "Formulario de configuración del rastreador web",
 	urlRequired: "La URL es obligatoria",
 	invalidUrl: "URL no válida",
@@ -20608,6 +21036,9 @@ var resourceModalWebsiteCrawlModal$1 = {
 	selectPatternTypeAriaLabel: "Seleccionar tipo de patrón",
 	globPattern: "Patrón Glob",
 	regularExpression: "Expresión regular",
+	userAgentLabel: "User-Agent (opcional)",
+	userAgentPlaceholder: "Iblai-bot/1.0 (+https://ibl.ai/bot)",
+	userAgentHelpText: "Opcional. Sustituye el User-Agent predeterminado del rastreador en cada solicitud. Déjalo en blanco para usar el predeterminado.",
 	crawlerMatchPatternsLabel: "Patrones de coincidencia del rastreador",
 	globPlaceholder: "https://example.com/",
 	regexPlaceholder: "(http|https)://www.example.com/(.*)",
@@ -21812,8 +22243,8 @@ var uiSidebar$1 = {
 var userProfileDropdownIndex$1 = {
 	profile: "Perfil",
 	account: "Cuenta",
-	learner: "Estudiante",
-	instructor: "Instructor",
+	learner: "Usuario",
+	instructor: "Administrador",
 	help: "Ayuda",
 	logOut: "Cerrar sesión",
 	moreOptions: "Más opciones"
@@ -23184,6 +23615,177 @@ var profileLlmUsage$1 = {
 	tryAgain: "Intentar de nuevo",
 	scopeUser: "Uso de {username}"
 };
+var virtualMachineHostInput$1 = {
+	listLabel: "Hosts permitidos",
+	removeHost: "Quitar {host}",
+	placeholder: "api.ejemplo.com:443",
+	hint: "Escribe host:puerto y pulsa Intro, o pega una lista.",
+	errorFormat: "{entry} debe tener el formato host:puerto, por ejemplo api.ejemplo.com:443, sin esquema, ruta ni comodín.",
+	errorPort: "{entry}: el puerto debe estar entre 1 y 65535.",
+	errorRejectedHost: "{entry}: este host está reservado y no se puede permitir.",
+	errorIpNotAllowed: "{entry}: usa aquí un nombre de host, no una dirección IP.",
+	errorDuplicate: "{entry} ya está en la lista.",
+	errorMax: "Puedes añadir como máximo {max} hosts."
+};
+var virtualMachineAdminTab$1 = {
+	infoBox: "Los agentes con Shell de máquina virtual ejecutan código en una VM Linux aislada que, por defecto, no tiene acceso a la red. Las políticas de red son listas reutilizables de destinos host:puerto a los que una VM puede llegar, y los secretos de VM son claves que la VM puede usar pero nunca leer. Elígelos para un agente desde su configuración de Sandbox.",
+	tabsAriaLabel: "Secciones de máquina virtual",
+	tabNetworkPolicies: "Políticas de red",
+	tabSecrets: "Secretos",
+	forbidden: "No tienes permiso para gestionar las políticas de red ni los secretos de las máquinas virtuales."
+};
+var virtualMachineNetworkPolicies$1 = {
+	newPolicy: "Nueva política",
+	loadFailed: "No se pudieron cargar las políticas de red. Inténtalo de nuevo en un momento.",
+	colName: "Nombre",
+	colHosts: "Hosts permitidos",
+	colDescription: "Descripción",
+	colUpdated: "Actualizada",
+	colActions: "Acciones",
+	hostsListAriaLabel: "Hosts permitidos por {name}",
+	moreHosts: "+{count} más",
+	editAriaLabel: "Editar la política {name}",
+	deleteAriaLabel: "Eliminar la política {name}",
+	empty: "Todavía no hay políticas de red. Crea una para que la VM de un agente pueda llegar a hosts concretos.",
+	createTitle: "Nueva política de red",
+	editTitle: "Editar política de red",
+	dialogDescription: "Los destinos host:puerto a los que una VM puede llegar con esta política. HTTPS es el puerto 443.",
+	fieldName: "Nombre",
+	namePlaceholder: "p. ej. APIs de Acme",
+	fieldHosts: "Hosts permitidos",
+	hostsHint: "Escribe host:puerto y pulsa Intro, o pega una lista. Hasta {max} entradas; se admiten direcciones IP.",
+	removedHostsWarning: "Vas a quitar {hosts}. Si un agente usa esta política y tiene un secreto que se envía a uno de estos hosts, ese secreto dejará de funcionar.",
+	fieldDescription: "Descripción (opcional)",
+	descriptionPlaceholder: "Para qué sirve esta política",
+	cancel: "Cancelar",
+	saveChanges: "Guardar cambios",
+	createPolicy: "Crear política",
+	errorNameRequired: "Dale un nombre a la política.",
+	errorHostsRequired: "Añade al menos un host.",
+	created: "Política de red creada",
+	updated: "Política de red actualizada",
+	deleted: "Política de red eliminada",
+	saveFailed: "No se pudo guardar la política. Inténtalo de nuevo.",
+	forbiddenWrite: "No tienes permiso para modificar políticas de red.",
+	forbiddenDelete: "No tienes permiso para eliminar políticas de red.",
+	deleteTitle: "Eliminar política de red",
+	deleteConfirm: "¿Eliminar {name}? Los agentes con el perfil Personalizado solo pueden usar políticas que sigan existiendo.",
+	deleteBlockedInUse: "Esta política todavía la usan los siguientes agentes. Cámbialos antes a otra política o perfil.",
+	deleteFailed: "No se pudo eliminar la política. Inténtalo de nuevo.",
+	"delete": "Eliminar"
+};
+var virtualMachineSecrets$1 = {
+	newSecret: "Nuevo secreto",
+	loadFailed: "No se pudieron cargar los secretos de VM. Inténtalo de nuevo en un momento.",
+	colName: "Nombre",
+	colEnvVar: "Variable",
+	colHosts: "Hosts permitidos",
+	colSource: "Origen",
+	colUpdated: "Actualizado",
+	colActions: "Acciones",
+	hostsListAriaLabel: "Hosts a los que se envía {name}",
+	moreHosts: "+{count} más",
+	sourceStored: "Valor guardado",
+	sourceFromCredential: "Credencial {credential} · {field}",
+	editAriaLabel: "Editar el secreto {name}",
+	deleteAriaLabel: "Eliminar el secreto {name}",
+	empty: "Todavía no hay secretos de VM. Crea uno para que un agente llame a una API con la clave de tu organización sin verla nunca.",
+	createTitle: "Nuevo secreto de VM",
+	editTitle: "Editar secreto de VM",
+	dialogDescription: "El valor no vuelve a mostrarse después de guardarlo.",
+	fieldName: "Nombre",
+	namePlaceholder: "p. ej. Clave de la API de Acme",
+	fieldEnvVar: "Variable de entorno",
+	envVarPlaceholder: "p. ej. ACME_KEY",
+	envVarHelp: "Letras, dígitos y guiones bajos; no puede empezar por un dígito.",
+	envVarReadOnlyHelp: "No se puede renombrar. Elimina este secreto y crea uno nuevo.",
+	fieldHosts: "Hosts permitidos",
+	hostsHint: "Solo estos hosts reciben la clave real; limita la lista al host más concreto que la necesite. Escribe host:puerto y pulsa Intro.",
+	fieldSource: "Origen del valor",
+	sourceValue: "Introducir un valor",
+	sourceValueDescription: "Se guarda cifrada y no vuelve a mostrarse.",
+	sourceCredential: "Usar una credencial de integración",
+	sourceCredentialDescription: "Lee un campo de una credencial guardada y sigue las rotaciones automáticamente.",
+	fieldValue: "Valor",
+	valuePlaceholder: "Pega la clave",
+	valueKeepPlaceholder: "Déjalo en blanco para conservar el valor actual",
+	valueHelp: "Al menos {min} caracteres.",
+	valueKeepHelp: "Déjalo en blanco para conservar el valor actual.",
+	fieldCredential: "Credencial de integración",
+	credentialPlaceholder: "Elige una credencial",
+	noCredentials: "Tu organización todavía no tiene credenciales de integración. Añade una en Integraciones o introduce un valor.",
+	fieldCredentialField: "Campo de la credencial",
+	credentialFieldPlaceholder: "Elige un campo",
+	credentialNoFields: "Esta credencial no tiene campos de los que leer.",
+	cancel: "Cancelar",
+	saveChanges: "Guardar cambios",
+	createSecret: "Crear secreto",
+	errorNameRequired: "Dale un nombre al secreto.",
+	errorEnvVarRequired: "Introduce el nombre de la variable de entorno.",
+	errorEnvVarFormat: "Usa solo letras, dígitos y guiones bajos, y no empieces por un dígito.",
+	errorHostsRequired: "Añade al menos un host.",
+	errorValueRequired: "Introduce el valor.",
+	errorValueTooShort: "El valor debe tener al menos {min} caracteres.",
+	errorValueMasked: "Parece un valor enmascarado. Pega la clave real.",
+	errorCredentialRequired: "Elige una credencial.",
+	errorFieldRequired: "Elige el campo de la credencial.",
+	created: "Secreto de VM creado",
+	updated: "Secreto de VM actualizado",
+	deleted: "Secreto de VM eliminado",
+	saveFailed: "No se pudo guardar el secreto. Inténtalo de nuevo.",
+	forbiddenWrite: "No tienes permiso para modificar secretos de VM.",
+	forbiddenDelete: "No tienes permiso para eliminar secretos de VM.",
+	deleteTitle: "Eliminar secreto de VM",
+	deleteConfirm: "¿Eliminar {envVar}? También se quitará de todos los agentes que lo usan.",
+	deleteFailed: "No se pudo eliminar el secreto. Inténtalo de nuevo.",
+	"delete": "Eliminar"
+};
+var virtualMachineNetworkSection$1 = {
+	title: "Acceso a la red",
+	description: "Decide a qué puede llegar la máquina virtual de este agente y qué credenciales puede usar.",
+	billingNotice: "El tiempo de máquina virtual se cobra de los créditos del usuario que chatea: ${usd} por cada {minutes} minutos por defecto, prorrateado por segundo. La tarifa de tu organización puede ser distinta.",
+	egressLabel: "Perfil de salida",
+	egressHelp: "Cuánta red recibe la VM.",
+	egressNoneLabel: "Sin red",
+	egressNoneDescription: "La VM no puede llegar a nada.",
+	egressRegistriesLabel: "Registros de paquetes",
+	egressRegistriesDescription: "Solo PyPI, npm, apt y apk, para instalar paquetes.",
+	egressPublicLabel: "Internet público",
+	egressPublicDescription: "Cualquier host público. Las redes privadas, localhost y los metadatos de la nube siguen bloqueados.",
+	egressCustomLabel: "Lista personalizada",
+	egressCustomDescription: "Solo los hosts de la política de red que elijas abajo.",
+	policyLabel: "Política de red",
+	policiesForbidden: "No tienes permiso para ver las políticas de red, así que este perfil no se puede configurar desde aquí.",
+	noPolicies: "Todavía no hay políticas de red",
+	policyPlaceholder: "Elige una política",
+	createPolicy: "Crear política",
+	editPolicy: "Editar política",
+	managePolicies: "Gestionar políticas",
+	manageSecrets: "Gestionar secretos",
+	policyRequired: "El perfil Personalizado necesita una política de red.",
+	policyHosts: "Hosts que permite esta política:",
+	secretsLabel: "Secretos",
+	secretsHelp: "Claves que la VM puede usar pero nunca leer. Hasta {max} por agente.",
+	noSecrets: "Tu organización todavía no tiene secretos de VM. Usa Gestionar secretos para crear uno.",
+	secretsCapReached: "Este agente tiene el máximo de {max} secretos.",
+	uncoveredTitle: "Algunos secretos se envían a hosts que esta política no permite:",
+	uncoveredItem: "{envVar} necesita {hosts}, y {policy} no lo permite.",
+	addHostsAndSave: "Añadir hosts a {policy} y guardar",
+	saved: "Configuración de red guardada",
+	saveFailed: "No se pudo guardar la configuración de red. Inténtalo de nuevo.",
+	forbiddenSave: "No tienes permiso para cambiar esta configuración.",
+	policyHostsAdded: "Hosts añadidos a {policy}",
+	policyUpdateFailed: "No se pudo actualizar la política, así que la configuración no se guardó.",
+	policyUpdateForbidden: "No tienes permiso para modificar políticas de red, así que la configuración no se guardó.",
+	discard: "Descartar",
+	save: "Guardar cambios",
+	narrowTitle: "¿Desvincular los secretos?",
+	narrowDescription: "{profile} no da a la VM acceso a los hosts que necesitan estos secretos, así que al guardar se {count, plural, one {desvinculará # secreto} other {desvincularán # secretos}} de este agente.",
+	cancel: "Cancelar",
+	narrowConfirm: "Desvincular y guardar",
+	manageTitle: "Configuración de la máquina virtual",
+	manageDescription: "Las políticas de red y los secretos de VM son compartidos por todos los agentes de tu organización."
+};
 var es = {
 	accessTabAddAccess: accessTabAddAccess$1,
 	accessTabLabels: accessTabLabels$1,
@@ -23469,7 +24071,12 @@ var es = {
 	analyticsCostTabs: analyticsCostTabs$1,
 	analyticsLlmUsage: analyticsLlmUsage$1,
 	analyticsTraces: analyticsTraces$1,
-	profileLlmUsage: profileLlmUsage$1
+	profileLlmUsage: profileLlmUsage$1,
+	virtualMachineHostInput: virtualMachineHostInput$1,
+	virtualMachineAdminTab: virtualMachineAdminTab$1,
+	virtualMachineNetworkPolicies: virtualMachineNetworkPolicies$1,
+	virtualMachineSecrets: virtualMachineSecrets$1,
+	virtualMachineNetworkSection: virtualMachineNetworkSection$1
 };
 
 var accessTabAddAccess = {
@@ -25971,7 +26578,9 @@ var datasetsTabAddResourceModal = {
 	title: "添加资源",
 	description: "添加知识以帮助您的代理提供更相关的见解。其他具有编辑权限的用户可以为更多主题重复使用这些来源。",
 	googleDrivePickerError: "Google Drive 选择器错误",
-	forceClosePicker: "强制关闭选择器"
+	forceClosePicker: "强制关闭选择器",
+	notConfigured: "未为此租户配置",
+	scrollRegionAriaLabel: "资源类型"
 };
 var datasetsTabDatasetItem = {
 	scheduleRetrain: "安排重新训练",
@@ -27348,7 +27957,9 @@ var profileAccount = {
 	groupSystem: "系统",
 	ariaSettingsNav: "组织设置",
 	ariaSettingsNavMobile: "组织设置（移动端）",
-	groupFinance: "财务"
+	groupFinance: "财务",
+	tabVirtualMachine: "虚拟机",
+	descVirtualMachine: "管理可供智能体虚拟机使用的网络策略和密钥。"
 };
 var profileAddCreditsModal = {
 	title: "添加积分",
@@ -27889,7 +28500,11 @@ var resourceModalGithubFileUploadModal = {
 	errorAddingDocument: "添加训练文档时出错",
 	githubRepoUrlPlaceholder: "GitHub 仓库 URL",
 	selectBranchPlaceholder: "选择分支",
-	submit: "提交"
+	submit: "提交",
+	description: "添加 GitHub 仓库并选择分支来训练您的智能体。",
+	scrollRegionAriaLabel: "仓库详情",
+	repoUrlLabel: "仓库 URL",
+	branchLabel: "分支"
 };
 var resourceModalLocalFileUploadModal = {
 	fileNotFound: "未找到文件",
@@ -27903,7 +28518,9 @@ var resourceModalLocalFileUploadModal = {
 	descriptionOptional: "描述（可选）",
 	descriptionPlaceholder: "为此图片添加描述...",
 	submitting: "提交中",
-	submit: "提交"
+	submit: "提交",
+	description: "上传文件，用其内容训练您的智能体。",
+	scrollRegionAriaLabel: "文件上传"
 };
 var resourceModalUrlUploadModal = {
 	urlPlaceholder: "URL",
@@ -27912,11 +28529,15 @@ var resourceModalUrlUploadModal = {
 	invalidYoutubeUrl: "无效的 YouTube URL",
 	invalidBlackboardUrl: "无效的 Blackboard URL",
 	invalidUrl: "无效的 URL",
-	submit: "提交"
+	submit: "提交",
+	description: "添加链接，用其内容训练您的智能体。",
+	scrollRegionAriaLabel: "链接详情",
+	urlLabel: "URL"
 };
 var resourceModalWebsiteCrawlModal = {
-	title: "网络爬虫配置",
 	description: "配置您的网络爬虫设置和 URL 模式",
+	infoBox: "抓取网站并用其页面训练您的智能体。设置链接跟踪深度、抓取页面数量以及要包含的网址。",
+	scrollRegionAriaLabel: "网络爬虫设置",
 	formAriaLabel: "网络爬虫配置表单",
 	urlRequired: "URL 为必填项",
 	invalidUrl: "无效的 URL",
@@ -27931,6 +28552,9 @@ var resourceModalWebsiteCrawlModal = {
 	selectPatternTypeAriaLabel: "选择模式类型",
 	globPattern: "Glob 模式",
 	regularExpression: "正则表达式",
+	userAgentLabel: "User-Agent(可选)",
+	userAgentPlaceholder: "Iblai-bot/1.0 (+https://ibl.ai/bot)",
+	userAgentHelpText: "可选。为每个请求覆盖默认的抓取工具 User-Agent。留空则使用默认值。",
 	crawlerMatchPatternsLabel: "爬虫匹配模式",
 	globPlaceholder: "https://example.com/",
 	regexPlaceholder: "(http|https)://www.example.com/(.*)",
@@ -29135,8 +29759,8 @@ var uiSidebar = {
 var userProfileDropdownIndex = {
 	profile: "个人资料",
 	account: "账户",
-	learner: "学习者",
-	instructor: "讲师",
+	learner: "用户",
+	instructor: "管理员",
 	help: "帮助",
 	logOut: "退出登录",
 	moreOptions: "更多选项"
@@ -30507,6 +31131,177 @@ var profileLlmUsage = {
 	tryAgain: "重试",
 	scopeUser: "{username} 的用量"
 };
+var virtualMachineHostInput = {
+	listLabel: "允许的主机",
+	removeHost: "移除 {host}",
+	placeholder: "api.example.com:443",
+	hint: "输入 host:port 并按 Enter，或粘贴列表。",
+	errorFormat: "{entry} 必须为 host:port 格式，例如 api.example.com:443，不能包含协议、路径或通配符。",
+	errorPort: "{entry}：端口必须在 1 到 65535 之间。",
+	errorRejectedHost: "{entry}：此主机为保留主机，不能加入允许列表。",
+	errorIpNotAllowed: "{entry}：此处请使用主机名，而不是 IP 地址。",
+	errorDuplicate: "{entry} 已在列表中。",
+	errorMax: "最多只能添加 {max} 个主机。"
+};
+var virtualMachineAdminTab = {
+	infoBox: "启用了虚拟机 Shell 的智能体会在隔离的 Linux 虚拟机中运行代码，默认没有网络访问权限。网络策略是可复用的 host:port 目标列表，规定虚拟机可以访问的地址；虚拟机密钥是虚拟机可以使用但永远无法读取的密钥。请在智能体的沙箱设置中为其选择。",
+	tabsAriaLabel: "虚拟机设置分区",
+	tabNetworkPolicies: "网络策略",
+	tabSecrets: "密钥",
+	forbidden: "您没有权限管理虚拟机的网络策略或密钥。"
+};
+var virtualMachineNetworkPolicies = {
+	newPolicy: "新建策略",
+	loadFailed: "无法加载网络策略，请稍后重试。",
+	colName: "名称",
+	colHosts: "允许的主机",
+	colDescription: "描述",
+	colUpdated: "更新时间",
+	colActions: "操作",
+	hostsListAriaLabel: "{name} 允许的主机",
+	moreHosts: "还有 {count} 个",
+	editAriaLabel: "编辑策略 {name}",
+	deleteAriaLabel: "删除策略 {name}",
+	empty: "还没有网络策略。创建一个策略，让智能体的虚拟机可以访问指定主机。",
+	createTitle: "新建网络策略",
+	editTitle: "编辑网络策略",
+	dialogDescription: "此策略下虚拟机可以访问的 host:port 目标。HTTPS 使用 443 端口。",
+	fieldName: "名称",
+	namePlaceholder: "例如：Acme API",
+	fieldHosts: "允许的主机",
+	hostsHint: "输入 host:port 并按 Enter，或粘贴列表。最多 {max} 条；允许使用 IP 地址。",
+	removedHostsWarning: "您正在移除 {hosts}。如果某个智能体使用此策略，并且有密钥会发送到这些主机之一，该密钥将无法再使用。",
+	fieldDescription: "描述（可选）",
+	descriptionPlaceholder: "此策略的用途",
+	cancel: "取消",
+	saveChanges: "保存更改",
+	createPolicy: "创建策略",
+	errorNameRequired: "请为策略输入名称。",
+	errorHostsRequired: "请至少添加一个主机。",
+	created: "网络策略已创建",
+	updated: "网络策略已更新",
+	deleted: "网络策略已删除",
+	saveFailed: "无法保存策略，请重试。",
+	forbiddenWrite: "您没有权限修改网络策略。",
+	forbiddenDelete: "您没有权限删除网络策略。",
+	deleteTitle: "删除网络策略",
+	deleteConfirm: "确定删除 {name} 吗？设为“自定义”配置的智能体只能使用仍然存在的策略。",
+	deleteBlockedInUse: "以下智能体仍在使用此策略。请先将它们改为其他策略或配置。",
+	deleteFailed: "无法删除策略，请重试。",
+	"delete": "删除"
+};
+var virtualMachineSecrets = {
+	newSecret: "新建密钥",
+	loadFailed: "无法加载虚拟机密钥，请稍后重试。",
+	colName: "名称",
+	colEnvVar: "变量",
+	colHosts: "允许的主机",
+	colSource: "来源",
+	colUpdated: "更新时间",
+	colActions: "操作",
+	hostsListAriaLabel: "{name} 发送至的主机",
+	moreHosts: "还有 {count} 个",
+	sourceStored: "已存储的值",
+	sourceFromCredential: "凭据 {credential} · {field}",
+	editAriaLabel: "编辑密钥 {name}",
+	deleteAriaLabel: "删除密钥 {name}",
+	empty: "还没有虚拟机密钥。创建一个密钥，让智能体无需看到组织的密钥即可调用 API。",
+	createTitle: "新建虚拟机密钥",
+	editTitle: "编辑虚拟机密钥",
+	dialogDescription: "保存后，该值不会再显示。",
+	fieldName: "名称",
+	namePlaceholder: "例如：Acme API 密钥",
+	fieldEnvVar: "环境变量",
+	envVarPlaceholder: "例如：ACME_KEY",
+	envVarHelp: "只能包含字母、数字和下划线，且不能以数字开头。",
+	envVarReadOnlyHelp: "无法重命名。请删除此密钥并新建一个。",
+	fieldHosts: "允许的主机",
+	hostsHint: "只有这些主机会收到真实密钥，请仅填写需要它的最小范围主机。输入 host:port 并按 Enter。",
+	fieldSource: "值的来源",
+	sourceValue: "输入一个值",
+	sourceValueDescription: "加密存储，之后不再显示。",
+	sourceCredential: "使用集成凭据",
+	sourceCredentialDescription: "读取已保存凭据中的一个字段，并自动跟随凭据轮换。",
+	fieldValue: "值",
+	valuePlaceholder: "粘贴密钥",
+	valueKeepPlaceholder: "留空以保留当前值",
+	valueHelp: "至少 {min} 个字符。",
+	valueKeepHelp: "留空以保留当前值。",
+	fieldCredential: "集成凭据",
+	credentialPlaceholder: "选择一个凭据",
+	noCredentials: "您的组织还没有集成凭据。请在“集成”中添加，或改为输入一个值。",
+	fieldCredentialField: "凭据字段",
+	credentialFieldPlaceholder: "选择一个字段",
+	credentialNoFields: "此凭据没有可读取的字段。",
+	cancel: "取消",
+	saveChanges: "保存更改",
+	createSecret: "创建密钥",
+	errorNameRequired: "请为密钥输入名称。",
+	errorEnvVarRequired: "请输入环境变量名。",
+	errorEnvVarFormat: "只能使用字母、数字和下划线，且不能以数字开头。",
+	errorHostsRequired: "请至少添加一个主机。",
+	errorValueRequired: "请输入值。",
+	errorValueTooShort: "值至少需要 {min} 个字符。",
+	errorValueMasked: "这看起来是打码后的值，请粘贴真实密钥。",
+	errorCredentialRequired: "请选择一个凭据。",
+	errorFieldRequired: "请选择凭据字段。",
+	created: "虚拟机密钥已创建",
+	updated: "虚拟机密钥已更新",
+	deleted: "虚拟机密钥已删除",
+	saveFailed: "无法保存密钥，请重试。",
+	forbiddenWrite: "您没有权限修改虚拟机密钥。",
+	forbiddenDelete: "您没有权限删除虚拟机密钥。",
+	deleteTitle: "删除虚拟机密钥",
+	deleteConfirm: "确定删除 {envVar} 吗？它也会从所有使用它的智能体中移除。",
+	deleteFailed: "无法删除密钥，请重试。",
+	"delete": "删除"
+};
+var virtualMachineNetworkSection = {
+	title: "网络访问",
+	description: "决定此智能体的虚拟机可以访问哪些地址，以及可以使用哪些凭据。",
+	billingNotice: "虚拟机使用时长按聊天用户的积分计费：默认每 {minutes} 分钟 ${usd}，按秒计算。您所在组织的费率可能不同。",
+	egressLabel: "出站配置",
+	egressHelp: "虚拟机可获得的网络访问范围。",
+	egressNoneLabel: "无网络",
+	egressNoneDescription: "虚拟机无法访问任何地址。",
+	egressRegistriesLabel: "软件包仓库",
+	egressRegistriesDescription: "仅限 PyPI、npm、apt 和 apk，用于安装软件包。",
+	egressPublicLabel: "公共互联网",
+	egressPublicDescription: "任何公共主机。私有网络、localhost 和云元数据仍被阻止。",
+	egressCustomLabel: "自定义允许列表",
+	egressCustomDescription: "仅限下方所选网络策略中的主机。",
+	policyLabel: "网络策略",
+	policiesForbidden: "您没有权限查看网络策略，因此无法在此处配置该选项。",
+	noPolicies: "还没有网络策略",
+	policyPlaceholder: "选择一个策略",
+	createPolicy: "创建策略",
+	editPolicy: "编辑策略",
+	managePolicies: "管理策略",
+	manageSecrets: "管理密钥",
+	policyRequired: "“自定义”配置需要一个网络策略。",
+	policyHosts: "此策略允许的主机：",
+	secretsLabel: "密钥",
+	secretsHelp: "虚拟机可以使用但永远无法读取的密钥。每个智能体最多 {max} 个。",
+	noSecrets: "您的组织还没有虚拟机密钥。请使用“管理密钥”创建一个。",
+	secretsCapReached: "此智能体已达到 {max} 个密钥的上限。",
+	uncoveredTitle: "部分密钥会发送到此策略不允许的主机：",
+	uncoveredItem: "{envVar} 需要 {hosts}，但 {policy} 不允许。",
+	addHostsAndSave: "将主机添加到 {policy} 并保存",
+	saved: "网络设置已保存",
+	saveFailed: "无法保存网络设置，请重试。",
+	forbiddenSave: "您没有权限修改这些设置。",
+	policyHostsAdded: "主机已添加到 {policy}",
+	policyUpdateFailed: "无法更新策略，因此设置未保存。",
+	policyUpdateForbidden: "您没有权限修改网络策略，因此设置未保存。",
+	discard: "放弃更改",
+	save: "保存更改",
+	narrowTitle: "解除密钥绑定？",
+	narrowDescription: "{profile} 不允许虚拟机访问这些密钥所需的主机，因此保存后将从此智能体解除 {count, plural, one {# 个密钥} other {# 个密钥}} 的绑定。",
+	cancel: "取消",
+	narrowConfirm: "解除绑定并保存",
+	manageTitle: "虚拟机设置",
+	manageDescription: "网络策略和虚拟机密钥由您组织中的所有智能体共享。"
+};
 var zh = {
 	accessTabAddAccess: accessTabAddAccess,
 	accessTabLabels: accessTabLabels,
@@ -30792,7 +31587,12 @@ var zh = {
 	analyticsCostTabs: analyticsCostTabs,
 	analyticsLlmUsage: analyticsLlmUsage,
 	analyticsTraces: analyticsTraces,
-	profileLlmUsage: profileLlmUsage
+	profileLlmUsage: profileLlmUsage,
+	virtualMachineHostInput: virtualMachineHostInput,
+	virtualMachineAdminTab: virtualMachineAdminTab,
+	virtualMachineNetworkPolicies: virtualMachineNetworkPolicies,
+	virtualMachineSecrets: virtualMachineSecrets,
+	virtualMachineNetworkSection: virtualMachineNetworkSection
 };
 
 /**
@@ -200298,6 +201098,686 @@ function MemoryAdminTab({ tenantKey, username }) {
     return (jsxs(Tabs, { defaultValue: "global-memories", "aria-label": t('memoryAdminTab.tabsAriaLabel'), children: [jsxs(TabsList, { "aria-label": t('memoryAdminTab.tabsAriaLabel'), className: "max-w-full overflow-x-auto justify-start px-1", children: [jsx(TabsTrigger, { "data-testid": "memory-admin-sub-tab-global", value: "global-memories", children: t('memoryAdminTab.tabGlobalMemories') }), jsx(TabsTrigger, { "data-testid": "memory-admin-sub-tab-agent", value: "agent-memories", children: t('memoryAdminTab.tabAgentMemories') })] }), jsx(TabsContent, { className: "mt-4", value: "global-memories", children: jsx(GlobalMemoriesSection, { tenantKey: tenantKey, username: username }) }), jsx(TabsContent, { className: "mt-4", value: "agent-memories", children: jsx(AgentMemoriesSection, { tenantKey: tenantKey, username: username }) })] }));
 }
 
+const ISSUE_KEYS = {
+    format: 'virtualMachineHostInput.errorFormat',
+    port: 'virtualMachineHostInput.errorPort',
+    rejected_host: 'virtualMachineHostInput.errorRejectedHost',
+    ip_not_allowed: 'virtualMachineHostInput.errorIpNotAllowed',
+};
+/**
+ * A chip (tag) input for `host:port` allowlists. Entries are added with Enter,
+ * comma or space, or by pasting a list; each is checked client-side
+ * (`validateHostPort`) before it becomes a chip, and invalid ones stay in the
+ * box with the reason announced through a polite live region. Backspace on an
+ * empty box removes the last chip; every chip has a labelled remove button so
+ * the whole control works from the keyboard.
+ */
+function HostPortChipInput({ id, value, onChange, allowIpAddresses = false, maxEntries, disabled = false, placeholder, describedBy, error, listLabel, hint, testId, }) {
+    var _a;
+    const t = useT();
+    const generatedId = useId$2();
+    const hintId = `${generatedId}-hint`;
+    const errorId = `${generatedId}-error`;
+    const [draft, setDraft] = useState('');
+    const [localError, setLocalError] = useState(null);
+    const message = (_a = localError !== null && localError !== void 0 ? localError : error) !== null && _a !== void 0 ? _a : null;
+    /**
+     * Turn the typed / pasted text into chips. Valid entries are appended;
+     * whatever failed stays in the box, with the first problem explained.
+     */
+    const commit = (text) => {
+        const entries = splitHostPortInput(text);
+        if (entries.length === 0) {
+            setDraft('');
+            return;
+        }
+        const next = [...value];
+        const leftover = [];
+        let problem = null;
+        for (const entry of entries) {
+            if (next.includes(entry)) {
+                problem !== null && problem !== void 0 ? problem : (problem = t('virtualMachineHostInput.errorDuplicate', { entry }));
+                continue;
+            }
+            const issue = validateHostPort(entry, { allowIpAddresses });
+            if (issue) {
+                problem !== null && problem !== void 0 ? problem : (problem = t(ISSUE_KEYS[issue], { entry }));
+                leftover.push(entry);
+                continue;
+            }
+            if (maxEntries !== undefined && next.length >= maxEntries) {
+                problem !== null && problem !== void 0 ? problem : (problem = t('virtualMachineHostInput.errorMax', { max: maxEntries }));
+                leftover.push(entry);
+                continue;
+            }
+            next.push(entry);
+        }
+        if (next.length !== value.length)
+            onChange(next);
+        setDraft(leftover.join(' '));
+        setLocalError(problem);
+    };
+    const remove = (host) => {
+        onChange(value.filter((entry) => entry !== host));
+    };
+    const handleKeyDown = (event) => {
+        if (event.key === 'Enter' || event.key === ',' || event.key === ' ') {
+            event.preventDefault();
+            commit(draft);
+        }
+        else if (event.key === 'Backspace' && draft === '' && value.length > 0) {
+            event.preventDefault();
+            remove(value[value.length - 1]);
+        }
+        else if (event.key === 'Escape' && (draft !== '' || localError)) {
+            event.preventDefault();
+            setDraft('');
+            setLocalError(null);
+        }
+    };
+    const handlePaste = (event) => {
+        const pasted = event.clipboardData.getData('text');
+        if (!pasted)
+            return;
+        event.preventDefault();
+        commit(`${draft} ${pasted}`);
+    };
+    return (jsxs("div", { className: "space-y-2", "data-testid": testId, children: [value.length > 0 && (jsx("ul", { role: "list", "aria-label": listLabel !== null && listLabel !== void 0 ? listLabel : t('virtualMachineHostInput.listLabel'), className: "flex flex-wrap gap-2", children: value.map((host) => (jsxs("li", { className: "inline-flex items-center gap-1 rounded-md border border-gray-200 bg-gray-50 py-0.5 pr-1 pl-2 font-mono text-xs text-gray-700", children: [jsx("span", { children: host }), !disabled && (jsx("button", { type: "button", onClick: () => remove(host), "aria-label": t('virtualMachineHostInput.removeHost', { host }), className: "cursor-pointer rounded p-0.5 text-gray-400 hover:text-gray-700 focus:outline-none focus-visible:ring-2 focus-visible:ring-blue-500", children: jsx(X$1, { className: "h-3 w-3", "aria-hidden": "true" }) }))] }, host))) })), jsx(Input, { id: id, type: "text", value: draft, disabled: disabled, placeholder: placeholder !== null && placeholder !== void 0 ? placeholder : t('virtualMachineHostInput.placeholder'), autoComplete: "off", autoCapitalize: "off", spellCheck: false, onChange: (event) => {
+                    setDraft(event.target.value);
+                    if (localError)
+                        setLocalError(null);
+                }, onKeyDown: handleKeyDown, onPaste: handlePaste, onBlur: () => {
+                    if (draft.trim())
+                        commit(draft);
+                }, "aria-invalid": message ? true : undefined, "aria-describedby": [describedBy, hintId, errorId].filter(Boolean).join(' ') }), jsx("p", { id: hintId, className: "text-xs text-gray-500", children: hint !== null && hint !== void 0 ? hint : t('virtualMachineHostInput.hint') }), jsx("p", { id: errorId, "aria-live": "polite", className: cn(message ? 'text-xs text-red-600' : 'sr-only'), children: message })] }));
+}
+
+const NAME_MAX_LENGTH$1 = 255;
+/**
+ * Create / edit form for a virtual-machine network policy: a name (unique in
+ * the org), 1–100 `host:port` entries and an optional description. Backend
+ * 400s land next to the matching field or, for a plain-string `error`, as a
+ * form-level message. On edit, only the fields that changed are sent
+ * (`allowed_hosts` always replaces the whole list), and removing a host warns
+ * that a bound secret which needs it would stop working — the backend does
+ * not block that edit.
+ */
+function NetworkPolicyDialog({ open, onOpenChange, tenantKey, policy = null, onSaved, }) {
+    const t = useT();
+    const baseId = useId$2();
+    const nameId = `${baseId}-name`;
+    const hostsId = `${baseId}-hosts`;
+    const descriptionId = `${baseId}-description`;
+    const [createPolicy, { isLoading: isCreating }] = useCreateVirtualMachineNetworkPolicyMutation();
+    const [updatePolicy, { isLoading: isUpdating }] = useUpdateVirtualMachineNetworkPolicyMutation();
+    const isSaving = isCreating || isUpdating;
+    const [name, setName] = useState('');
+    const [hosts, setHosts] = useState([]);
+    const [description, setDescription] = useState('');
+    const [fieldErrors, setFieldErrors] = useState({});
+    const [formError, setFormError] = useState(null);
+    // Start from the policy being edited (or blank) every time the dialog opens.
+    useEffect(() => {
+        var _a, _b, _c;
+        if (!open)
+            return;
+        setName((_a = policy === null || policy === void 0 ? void 0 : policy.name) !== null && _a !== void 0 ? _a : '');
+        setHosts((_b = policy === null || policy === void 0 ? void 0 : policy.allowed_hosts) !== null && _b !== void 0 ? _b : []);
+        setDescription((_c = policy === null || policy === void 0 ? void 0 : policy.description) !== null && _c !== void 0 ? _c : '');
+        setFieldErrors({});
+        setFormError(null);
+    }, [open, policy]);
+    const isEdit = policy !== null;
+    const removedHosts = isEdit ? policy.allowed_hosts.filter((host) => !hosts.includes(host)) : [];
+    const handleSubmit = async (event) => {
+        var _a;
+        event.preventDefault();
+        const trimmedName = name.trim();
+        const trimmedDescription = description.trim();
+        const clientErrors = {};
+        if (!trimmedName)
+            clientErrors.name = t('virtualMachineNetworkPolicies.errorNameRequired');
+        if (hosts.length === 0) {
+            clientErrors.allowed_hosts = t('virtualMachineNetworkPolicies.errorHostsRequired');
+        }
+        setFieldErrors(clientErrors);
+        setFormError(null);
+        if (Object.keys(clientErrors).length > 0)
+            return;
+        try {
+            let saved;
+            if (isEdit) {
+                const body = { id: policy.id };
+                if (trimmedName !== policy.name)
+                    body.name = trimmedName;
+                if (hosts.length !== policy.allowed_hosts.length ||
+                    hosts.some((host, index) => host !== policy.allowed_hosts[index])) {
+                    body.allowed_hosts = hosts;
+                }
+                if (trimmedDescription !== ((_a = policy.description) !== null && _a !== void 0 ? _a : ''))
+                    body.description = trimmedDescription;
+                if (Object.keys(body).length === 1) {
+                    onOpenChange(false);
+                    return;
+                }
+                saved = await updatePolicy({ org: tenantKey, body }).unwrap();
+                toast.success(t('virtualMachineNetworkPolicies.updated'));
+            }
+            else {
+                saved = await createPolicy({
+                    org: tenantKey,
+                    body: { name: trimmedName, allowed_hosts: hosts, description: trimmedDescription },
+                }).unwrap();
+                toast.success(t('virtualMachineNetworkPolicies.created'));
+            }
+            onSaved === null || onSaved === void 0 ? void 0 : onSaved(saved);
+            onOpenChange(false);
+        }
+        catch (error) {
+            const parsed = getVirtualMachineApiError(error);
+            if (parsed.status === 403) {
+                setFormError(t('virtualMachineNetworkPolicies.forbiddenWrite'));
+                return;
+            }
+            const nextErrors = {};
+            let unmatched = [];
+            for (const [field, messages] of Object.entries(parsed.fieldErrors)) {
+                if (field === 'name' || field === 'allowed_hosts' || field === 'description') {
+                    nextErrors[field] = messages.join(' ');
+                }
+                else {
+                    unmatched = unmatched.concat(messages);
+                }
+            }
+            setFieldErrors(nextErrors);
+            const message = [parsed.message, ...unmatched].filter(Boolean).join(' ');
+            if (message) {
+                setFormError(message);
+            }
+            else if (Object.keys(nextErrors).length === 0) {
+                setFormError(t('virtualMachineNetworkPolicies.saveFailed'));
+            }
+        }
+    };
+    return (jsx(Dialog, { open: open, onOpenChange: (next) => !isSaving && onOpenChange(next), children: jsxs(DialogContent, { className: "max-h-[90vh] w-full max-w-lg overflow-y-auto", "data-testid": "network-policy-dialog", children: [jsxs(DialogHeader, { children: [jsx(DialogTitle, { className: "ibl-dialog-title", children: isEdit
+                                ? t('virtualMachineNetworkPolicies.editTitle')
+                                : t('virtualMachineNetworkPolicies.createTitle') }), jsx(DialogDescription, { children: t('virtualMachineNetworkPolicies.dialogDescription') })] }), jsxs("form", { onSubmit: handleSubmit, noValidate: true, className: "mt-1 grid gap-5", children: [formError && (jsx("div", { role: "alert", "data-testid": "network-policy-form-error", className: "rounded-md border border-red-200 bg-red-50 px-3 py-2 text-sm text-red-700", children: formError })), jsxs("div", { className: "space-y-1.5", children: [jsx(Label$2, { htmlFor: nameId, className: "flex items-center text-sm font-medium text-[#646464]", children: t('virtualMachineNetworkPolicies.fieldName') }), jsx(Input, { id: nameId, value: name, maxLength: NAME_MAX_LENGTH$1, onChange: (event) => setName(event.target.value), placeholder: t('virtualMachineNetworkPolicies.namePlaceholder'), "aria-invalid": fieldErrors.name ? true : undefined, "aria-describedby": fieldErrors.name ? `${nameId}-error` : undefined, required: true }), fieldErrors.name && (jsx("p", { id: `${nameId}-error`, role: "alert", className: "text-xs text-red-600", children: fieldErrors.name }))] }), jsxs("div", { className: "space-y-1.5", children: [jsx(Label$2, { htmlFor: hostsId, className: "flex items-center text-sm font-medium text-[#646464]", children: t('virtualMachineNetworkPolicies.fieldHosts') }), jsx(HostPortChipInput, { id: hostsId, value: hosts, onChange: setHosts, allowIpAddresses: true, maxEntries: VIRTUAL_MACHINE_MAX_POLICY_HOSTS, hint: t('virtualMachineNetworkPolicies.hostsHint', {
+                                        max: VIRTUAL_MACHINE_MAX_POLICY_HOSTS,
+                                    }), error: fieldErrors.allowed_hosts, testId: "network-policy-hosts" }), removedHosts.length > 0 && (jsxs("div", { role: "status", "data-testid": "network-policy-removed-hosts-warning", className: "flex items-start gap-2 rounded-md border border-amber-200 bg-amber-50 px-3 py-2 text-xs text-amber-800", children: [jsx(TriangleAlert, { className: "mt-0.5 h-4 w-4 shrink-0", "aria-hidden": "true" }), jsx("span", { children: t('virtualMachineNetworkPolicies.removedHostsWarning', {
+                                                hosts: removedHosts.join(', '),
+                                            }) })] }))] }), jsxs("div", { className: "space-y-1.5", children: [jsx(Label$2, { htmlFor: descriptionId, className: "flex items-center text-sm font-medium text-[#646464]", children: t('virtualMachineNetworkPolicies.fieldDescription') }), jsx(Textarea, { id: descriptionId, value: description, rows: 2, onChange: (event) => setDescription(event.target.value), placeholder: t('virtualMachineNetworkPolicies.descriptionPlaceholder'), "aria-invalid": fieldErrors.description ? true : undefined, "aria-describedby": fieldErrors.description ? `${descriptionId}-error` : undefined }), fieldErrors.description && (jsx("p", { id: `${descriptionId}-error`, role: "alert", className: "text-xs text-red-600", children: fieldErrors.description }))] }), jsxs(DialogFooter, { children: [jsx(Button$1, { type: "button", variant: "outline", onClick: () => onOpenChange(false), disabled: isSaving, children: t('virtualMachineNetworkPolicies.cancel') }), jsxs(Button$1, { type: "submit", disabled: isSaving, "data-testid": "network-policy-save", className: "bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: [isSaving && jsx(LoaderCircle, { className: "h-4 w-4 animate-spin", "aria-hidden": "true" }), isEdit
+                                            ? t('virtualMachineNetworkPolicies.saveChanges')
+                                            : t('virtualMachineNetworkPolicies.createPolicy')] })] })] })] }) }));
+}
+
+const HOST_PREVIEW_COUNT$1 = 3;
+/** Placeholder swapped for the inline record in the delete sentence. */
+const RECORD_SLOT$1 = '__record__';
+const MENTOR_LOOKUP_LIMIT = 100;
+/** "3 days ago" for a backend timestamp, or a dash when it is unusable. */
+function relativeTime$1(value) {
+    const date = new Date(value);
+    return Number.isNaN(date.getTime()) ? '—' : formatDistanceToNow(date, { addSuffix: true });
+}
+/**
+ * Network policies table with create / edit / delete. Deleting a policy an
+ * agent still uses is refused by the backend; the refusal names the agents,
+ * which are listed (by name where the tenant agent list resolves them, else
+ * by id) so the admin knows what to move off it first.
+ */
+function NetworkPoliciesSection({ tenantKey, username, policies, isLoading, isError, }) {
+    var _a;
+    const t = useT();
+    const [dialogOpen, setDialogOpen] = useState(false);
+    const [editingPolicy, setEditingPolicy] = useState(null);
+    const [deletingPolicy, setDeletingPolicy] = useState(null);
+    const [deleteFailure, setDeleteFailure] = useState(null);
+    const [deletePolicy, { isLoading: isDeleting }] = useDeleteVirtualMachineNetworkPolicyMutation();
+    const boundMentorIds = (_a = deleteFailure === null || deleteFailure === void 0 ? void 0 : deleteFailure.boundMentorIds) !== null && _a !== void 0 ? _a : [];
+    // Best-effort names for the agents named in a refused delete.
+    const { data: mentorsData } = useGetMentorsQuery({ org: tenantKey, username: username !== null && username !== void 0 ? username : '', limit: MENTOR_LOOKUP_LIMIT }, { skip: !username || boundMentorIds.length === 0 });
+    const mentorNames = useMemo(() => {
+        const names = new Map();
+        const results = mentorsData === null || mentorsData === void 0 ? void 0 : mentorsData.results;
+        for (const mentor of results !== null && results !== void 0 ? results : []) {
+            if (mentor.unique_id && mentor.name)
+                names.set(mentor.unique_id, mentor.name);
+        }
+        return names;
+    }, [mentorsData]);
+    // The translated sentence with the policy name rendered inline, whatever the word order.
+    const [deleteConfirmBefore, deleteConfirmAfter] = t('virtualMachineNetworkPolicies.deleteConfirm', {
+        name: RECORD_SLOT$1,
+    }).split(RECORD_SLOT$1);
+    const openCreate = () => {
+        setEditingPolicy(null);
+        setDialogOpen(true);
+    };
+    const openEdit = (policy) => {
+        setEditingPolicy(policy);
+        setDialogOpen(true);
+    };
+    const openDelete = (policy) => {
+        setDeleteFailure(null);
+        setDeletingPolicy(policy);
+    };
+    const handleDelete = async (policy) => {
+        var _a;
+        try {
+            await deletePolicy({ org: tenantKey, id: policy.id }).unwrap();
+            toast.success(t('virtualMachineNetworkPolicies.deleted'));
+            setDeletingPolicy(null);
+        }
+        catch (error) {
+            const parsed = getVirtualMachineApiError(error);
+            const boundIds = extractBoundMentorIds(parsed.message);
+            setDeleteFailure({
+                message: parsed.status === 403
+                    ? t('virtualMachineNetworkPolicies.forbiddenDelete')
+                    : boundIds.length > 0
+                        ? t('virtualMachineNetworkPolicies.deleteBlockedInUse')
+                        : ((_a = parsed.message) !== null && _a !== void 0 ? _a : t('virtualMachineNetworkPolicies.deleteFailed')),
+                boundMentorIds: boundIds,
+            });
+        }
+    };
+    return (jsxs("div", { "data-testid": "vm-network-policies-section", className: "space-y-4", children: [jsx("div", { className: "flex justify-end", children: jsxs(Button$1, { size: "sm", onClick: openCreate, "data-testid": "vm-network-policy-new", className: "cursor-pointer bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: [jsx(Plus, { className: "h-4 w-4", "aria-hidden": "true" }), t('virtualMachineNetworkPolicies.newPolicy')] }) }), isLoading ? (jsx("div", { className: "flex h-40 items-center justify-center", children: jsx(Spinner, {}) })) : isError ? (jsx("div", { role: "alert", className: "rounded-lg border border-red-200 bg-red-50 px-6 py-6 text-center text-sm text-red-700", children: t('virtualMachineNetworkPolicies.loadFailed') })) : (jsx("div", { className: "overflow-x-auto rounded-lg border border-gray-200 bg-white dark:border-gray-700 dark:bg-gray-800", children: jsxs("table", { className: "w-full text-sm", children: [jsx("thead", { className: "border-b border-gray-200 bg-gray-50 dark:border-gray-600 dark:bg-gray-700", children: jsxs("tr", { children: [jsx("th", { className: "px-6 py-3 text-left font-medium text-gray-500 dark:text-gray-400", children: t('virtualMachineNetworkPolicies.colName') }), jsx("th", { className: "px-6 py-3 text-left font-medium text-gray-500 dark:text-gray-400", children: t('virtualMachineNetworkPolicies.colHosts') }), jsx("th", { className: "px-6 py-3 text-left font-medium text-gray-500 dark:text-gray-400", children: t('virtualMachineNetworkPolicies.colDescription') }), jsx("th", { className: "px-6 py-3 text-left font-medium whitespace-nowrap text-gray-500 dark:text-gray-400", children: t('virtualMachineNetworkPolicies.colUpdated') }), jsx("th", { className: "px-6 py-3 text-right font-medium text-gray-500 dark:text-gray-400", children: t('virtualMachineNetworkPolicies.colActions') })] }) }), jsxs("tbody", { className: "divide-y divide-gray-200 dark:divide-gray-600", children: [policies.map((policy) => {
+                                    const preview = policy.allowed_hosts.slice(0, HOST_PREVIEW_COUNT$1);
+                                    const remaining = policy.allowed_hosts.length - preview.length;
+                                    return (jsxs("tr", { "data-testid": `vm-network-policy-row-${policy.id}`, children: [jsx("td", { className: "px-6 py-4 font-medium text-gray-900 dark:text-gray-100", children: policy.name }), jsx("td", { className: "px-6 py-4", children: jsxs("ul", { role: "list", "aria-label": t('virtualMachineNetworkPolicies.hostsListAriaLabel', {
+                                                        name: policy.name,
+                                                    }), className: "flex flex-wrap gap-1", children: [preview.map((host) => (jsx("li", { className: "rounded-md border border-gray-200 bg-gray-50 px-2 py-0.5 font-mono text-xs text-gray-700", children: host }, host))), remaining > 0 && (jsx("li", { className: "px-1 py-0.5 text-xs text-gray-500", children: t('virtualMachineNetworkPolicies.moreHosts', { count: remaining }) }))] }) }), jsx("td", { className: "max-w-0 px-6 py-4 text-gray-600 dark:text-gray-300", children: jsx("div", { className: "truncate", children: policy.description || '—' }) }), jsx("td", { className: "px-6 py-4 whitespace-nowrap text-gray-600 dark:text-gray-300", children: relativeTime$1(policy.updated_at) }), jsx("td", { className: "px-6 py-4", children: jsxs("div", { className: "flex justify-end gap-1", children: [jsx(Button$1, { variant: "ghost", size: "sm", onClick: () => openEdit(policy), "aria-label": t('virtualMachineNetworkPolicies.editAriaLabel', {
+                                                                name: policy.name,
+                                                            }), "data-testid": `vm-network-policy-edit-${policy.id}`, children: jsx(Pencil, { className: "h-4 w-4", "aria-hidden": "true" }) }), jsx(Button$1, { variant: "ghost", size: "sm", onClick: () => openDelete(policy), "aria-label": t('virtualMachineNetworkPolicies.deleteAriaLabel', {
+                                                                name: policy.name,
+                                                            }), "data-testid": `vm-network-policy-delete-${policy.id}`, className: "text-red-600 hover:text-red-700", children: jsx(Trash2, { className: "h-4 w-4", "aria-hidden": "true" }) })] }) })] }, policy.id));
+                                }), policies.length === 0 && (jsx("tr", { children: jsx("td", { colSpan: 5, className: "px-6 py-8 text-center text-gray-500 dark:text-gray-400", children: t('virtualMachineNetworkPolicies.empty') }) }))] })] }) })), jsx(NetworkPolicyDialog, { open: dialogOpen, onOpenChange: setDialogOpen, tenantKey: tenantKey, policy: editingPolicy }), jsx(Dialog, { open: deletingPolicy !== null, onOpenChange: (open) => {
+                    if (!open && !isDeleting) {
+                        setDeletingPolicy(null);
+                        setDeleteFailure(null);
+                    }
+                }, children: jsxs(DialogContent, { className: "max-w-md", "data-testid": "vm-network-policy-delete-dialog", children: [jsx(DialogHeader, { children: jsx(DialogTitle, { children: t('virtualMachineNetworkPolicies.deleteTitle') }) }), jsxs(DialogDescription, { className: "text-gray-600", children: [deleteConfirmBefore, jsx("span", { className: "font-medium text-gray-900", children: deletingPolicy === null || deletingPolicy === void 0 ? void 0 : deletingPolicy.name }), deleteConfirmAfter] }), deleteFailure && (jsxs("div", { role: "alert", "data-testid": "vm-network-policy-delete-error", className: "space-y-2 rounded-md border border-red-200 bg-red-50 px-3 py-2 text-sm text-red-700", children: [jsx("p", { children: deleteFailure.message }), boundMentorIds.length > 0 && (jsx("ul", { role: "list", className: "list-disc space-y-0.5 pl-5", children: boundMentorIds.map((id) => {
+                                        var _a;
+                                        return (jsx("li", { children: (_a = mentorNames.get(id)) !== null && _a !== void 0 ? _a : id }, id));
+                                    }) }))] })), jsxs(DialogFooter, { className: "pt-2", children: [jsx(Button$1, { type: "button", variant: "outline", disabled: isDeleting, onClick: () => {
+                                        setDeletingPolicy(null);
+                                        setDeleteFailure(null);
+                                    }, children: t('virtualMachineNetworkPolicies.cancel') }), boundMentorIds.length === 0 && deletingPolicy && (jsxs(Button$1, { type: "button", onClick: () => void handleDelete(deletingPolicy), disabled: isDeleting, "data-testid": "vm-network-policy-delete-confirm", className: "cursor-pointer bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: [isDeleting && jsx(LoaderCircle, { className: "h-4 w-4 animate-spin", "aria-hidden": "true" }), t('virtualMachineNetworkPolicies.delete')] }))] })] }) })] }));
+}
+
+function fieldKeys(value) {
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+        return Object.keys(value);
+    }
+    // Some serialisers hand the masked value back as a JSON string.
+    if (typeof value === 'string') {
+        try {
+            return fieldKeys(JSON.parse(value));
+        }
+        catch (_a) {
+            return [];
+        }
+    }
+    return [];
+}
+/**
+ * Normalise the integration-credential list response into picker options.
+ * Tolerates a bare array or a `{ results }` / `{ data }` wrapper, and drops
+ * rows without a numeric id.
+ */
+function toIntegrationCredentialOptions(data) {
+    var _a, _b;
+    const rows = Array.isArray(data)
+        ? data
+        : data && typeof data === 'object'
+            ? ((_b = (_a = data.results) !== null && _a !== void 0 ? _a : data.data) !== null && _b !== void 0 ? _b : [])
+            : [];
+    const options = [];
+    for (const row of rows) {
+        if (!row || typeof row !== 'object')
+            continue;
+        const { id, name, value } = row;
+        if (typeof id !== 'number')
+            continue;
+        options.push({
+            id,
+            name: typeof name === 'string' && name ? name : String(id),
+            fields: fieldKeys(value),
+        });
+    }
+    return options.sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/**
+ * Radio items in the virtual-machine forms use the same blue as the sandbox
+ * switches (`data-[state=checked]:bg-blue-500`) so the selected option reads
+ * as "on" like the toggles around it. The indicator is an inner svg, hence the
+ * descendant variants.
+ */
+const BLUE_RADIO_ITEM_CLASS = 'mt-0.5 border-gray-300 text-blue-500 data-[state=checked]:border-blue-500 [&_svg]:fill-blue-500 [&_svg]:text-blue-500';
+/** Checkboxes beside those radios: the same grey border while unchecked, the same blue when checked. */
+const BLUE_CHECKBOX_CLASS = 'mt-0.5 border-gray-300 data-[state=checked]:border-blue-500';
+
+const FIELD_NAMES = [
+    'name',
+    'env_var',
+    'allow_hosts',
+    'value',
+    'source_credential_id',
+    'source_field',
+];
+const NAME_MAX_LENGTH = 255;
+const ENV_VAR_MAX_LENGTH = 128;
+/** Values that look masked (`sk-****`) are rejected by the backend too. */
+const MASKED_VALUE_PATTERN = /\*{3,}/;
+/**
+ * Create / edit form for a VM secret. A secret gets its value in one of two
+ * ways, offered as a choice: the admin pastes a key (stored, min 8
+ * characters), or the secret points at one field of an integration
+ * credential the org already saved and reads it at run time. No endpoint ever
+ * returns the value, so the field is never prefilled — on edit it stays blank
+ * to keep the current value — and `env_var` is read-only once created (delete
+ * and recreate to rename). Backend 400s land next to the matching field or as
+ * a form-level message.
+ */
+function VmSecretDialog({ open, onOpenChange, tenantKey, secret = null, credentials, onSaved, }) {
+    var _a;
+    const t = useT();
+    const baseId = useId$2();
+    const ids = {
+        name: `${baseId}-name`,
+        envVar: `${baseId}-env-var`,
+        envVarHelp: `${baseId}-env-var-help`,
+        hosts: `${baseId}-hosts`,
+        source: `${baseId}-source`,
+        sourceValue: `${baseId}-source-value`,
+        sourceCredential: `${baseId}-source-credential`,
+        value: `${baseId}-value`,
+        valueHelp: `${baseId}-value-help`,
+        credential: `${baseId}-credential`,
+        credentialLabel: `${baseId}-credential-label`,
+        field: `${baseId}-field`,
+        fieldLabel: `${baseId}-field-label`,
+    };
+    const [createSecret, { isLoading: isCreating }] = useCreateVirtualMachineSecretMutation();
+    const [updateSecret, { isLoading: isUpdating }] = useUpdateVirtualMachineSecretMutation();
+    const isSaving = isCreating || isUpdating;
+    const [name, setName] = useState('');
+    const [envVar, setEnvVar] = useState('');
+    const [hosts, setHosts] = useState([]);
+    const [source, setSource] = useState('value');
+    const [value, setValue] = useState('');
+    const [credentialId, setCredentialId] = useState('');
+    const [field, setField] = useState('');
+    const [fieldErrors, setFieldErrors] = useState({});
+    const [formError, setFormError] = useState(null);
+    // Start from the secret being edited (or blank) every time the dialog
+    // opens. The value is deliberately never prefilled.
+    useEffect(() => {
+        var _a, _b, _c, _d;
+        if (!open)
+            return;
+        setName((_a = secret === null || secret === void 0 ? void 0 : secret.name) !== null && _a !== void 0 ? _a : '');
+        setEnvVar((_b = secret === null || secret === void 0 ? void 0 : secret.env_var) !== null && _b !== void 0 ? _b : '');
+        setHosts((_c = secret === null || secret === void 0 ? void 0 : secret.allow_hosts) !== null && _c !== void 0 ? _c : []);
+        const linked = (secret === null || secret === void 0 ? void 0 : secret.source_credential_id) != null;
+        setSource(linked ? 'credential' : 'value');
+        setValue('');
+        setCredentialId(linked ? String(secret.source_credential_id) : '');
+        setField(linked ? ((_d = secret.source_field) !== null && _d !== void 0 ? _d : '') : '');
+        setFieldErrors({});
+        setFormError(null);
+    }, [open, secret]);
+    const isEdit = secret !== null;
+    const selectedCredential = credentials.find((option) => String(option.id) === credentialId);
+    const credentialFields = (_a = selectedCredential === null || selectedCredential === void 0 ? void 0 : selectedCredential.fields) !== null && _a !== void 0 ? _a : [];
+    const handleSubmit = async (event) => {
+        event.preventDefault();
+        const trimmedName = name.trim();
+        const trimmedEnvVar = envVar.trim();
+        const clientErrors = {};
+        if (!trimmedName)
+            clientErrors.name = t('virtualMachineSecrets.errorNameRequired');
+        if (!isEdit) {
+            if (!trimmedEnvVar) {
+                clientErrors.env_var = t('virtualMachineSecrets.errorEnvVarRequired');
+            }
+            else if (!VIRTUAL_MACHINE_ENV_VAR_PATTERN.test(trimmedEnvVar)) {
+                clientErrors.env_var = t('virtualMachineSecrets.errorEnvVarFormat');
+            }
+        }
+        if (hosts.length === 0)
+            clientErrors.allow_hosts = t('virtualMachineSecrets.errorHostsRequired');
+        if (source === 'value') {
+            if (!isEdit && !value) {
+                clientErrors.value = t('virtualMachineSecrets.errorValueRequired');
+            }
+            else if (value && value.length < VIRTUAL_MACHINE_SECRET_VALUE_MIN_LENGTH) {
+                clientErrors.value = t('virtualMachineSecrets.errorValueTooShort', {
+                    min: VIRTUAL_MACHINE_SECRET_VALUE_MIN_LENGTH,
+                });
+            }
+            else if (value && MASKED_VALUE_PATTERN.test(value)) {
+                clientErrors.value = t('virtualMachineSecrets.errorValueMasked');
+            }
+        }
+        else {
+            if (!credentialId) {
+                clientErrors.source_credential_id = t('virtualMachineSecrets.errorCredentialRequired');
+            }
+            if (!field)
+                clientErrors.source_field = t('virtualMachineSecrets.errorFieldRequired');
+        }
+        setFieldErrors(clientErrors);
+        setFormError(null);
+        if (Object.keys(clientErrors).length > 0)
+            return;
+        try {
+            let saved;
+            if (isEdit) {
+                const body = { env_var: secret.env_var };
+                if (trimmedName !== secret.name)
+                    body.name = trimmedName;
+                if (hosts.length !== secret.allow_hosts.length ||
+                    hosts.some((host, index) => host !== secret.allow_hosts[index])) {
+                    body.allow_hosts = hosts;
+                }
+                if (source === 'value') {
+                    // A blank value keeps the stored one; a new value replaces it (and
+                    // drops any credential link on the backend).
+                    if (value)
+                        body.value = value;
+                }
+                else if (Number(credentialId) !== secret.source_credential_id ||
+                    field !== secret.source_field) {
+                    body.source_credential_id = Number(credentialId);
+                    body.source_field = field;
+                }
+                if (Object.keys(body).length === 1) {
+                    onOpenChange(false);
+                    return;
+                }
+                saved = await updateSecret({ org: tenantKey, body }).unwrap();
+                toast.success(t('virtualMachineSecrets.updated'));
+            }
+            else {
+                const body = {
+                    name: trimmedName,
+                    env_var: trimmedEnvVar,
+                    allow_hosts: hosts,
+                    ...(source === 'value'
+                        ? { value }
+                        : { source_credential_id: Number(credentialId), source_field: field }),
+                };
+                saved = await createSecret({ org: tenantKey, body }).unwrap();
+                toast.success(t('virtualMachineSecrets.created'));
+            }
+            onSaved === null || onSaved === void 0 ? void 0 : onSaved(saved);
+            onOpenChange(false);
+        }
+        catch (error) {
+            const parsed = getVirtualMachineApiError(error);
+            if (parsed.status === 403) {
+                setFormError(t('virtualMachineSecrets.forbiddenWrite'));
+                return;
+            }
+            const nextErrors = {};
+            let unmatched = [];
+            for (const [key, messages] of Object.entries(parsed.fieldErrors)) {
+                if (FIELD_NAMES.includes(key)) {
+                    nextErrors[key] = messages.join(' ');
+                }
+                else {
+                    unmatched = unmatched.concat(messages);
+                }
+            }
+            setFieldErrors(nextErrors);
+            const message = [parsed.message, ...unmatched].filter(Boolean).join(' ');
+            if (message) {
+                setFormError(message);
+            }
+            else if (Object.keys(nextErrors).length === 0) {
+                setFormError(t('virtualMachineSecrets.saveFailed'));
+            }
+        }
+    };
+    const fieldError = (key, id) => fieldErrors[key] ? (jsx("p", { id: `${id}-error`, role: "alert", className: "text-xs text-red-600", children: fieldErrors[key] })) : null;
+    return (jsx(Dialog, { open: open, onOpenChange: (next) => !isSaving && onOpenChange(next), children: jsxs(DialogContent, { className: "max-h-[90vh] w-full max-w-lg overflow-y-auto", "data-testid": "vm-secret-dialog", children: [jsxs(DialogHeader, { children: [jsx(DialogTitle, { className: "ibl-dialog-title", children: isEdit ? t('virtualMachineSecrets.editTitle') : t('virtualMachineSecrets.createTitle') }), jsx(DialogDescription, { children: t('virtualMachineSecrets.dialogDescription') })] }), jsxs("form", { onSubmit: handleSubmit, noValidate: true, className: "mt-1 grid gap-5", children: [formError && (jsx("div", { role: "alert", "data-testid": "vm-secret-form-error", className: "rounded-md border border-red-200 bg-red-50 px-3 py-2 text-sm text-red-700", children: formError })), jsxs("div", { className: "space-y-1.5", children: [jsx(Label$2, { htmlFor: ids.name, className: "flex items-center text-sm font-medium text-[#646464]", children: t('virtualMachineSecrets.fieldName') }), jsx(Input, { id: ids.name, value: name, maxLength: NAME_MAX_LENGTH, onChange: (event) => setName(event.target.value), placeholder: t('virtualMachineSecrets.namePlaceholder'), "aria-invalid": fieldErrors.name ? true : undefined, "aria-describedby": fieldErrors.name ? `${ids.name}-error` : undefined, required: true }), fieldError('name', ids.name)] }), jsxs("div", { className: "space-y-1.5", children: [jsx(Label$2, { htmlFor: ids.envVar, className: "flex items-center text-sm font-medium text-[#646464]", children: t('virtualMachineSecrets.fieldEnvVar') }), jsx(Input, { id: ids.envVar, value: envVar, maxLength: ENV_VAR_MAX_LENGTH, readOnly: isEdit, disabled: isEdit, onChange: (event) => setEnvVar(event.target.value), placeholder: t('virtualMachineSecrets.envVarPlaceholder'), autoCapitalize: "characters", autoComplete: "off", spellCheck: false, className: "font-mono", "aria-invalid": fieldErrors.env_var ? true : undefined, "aria-describedby": [ids.envVarHelp, fieldErrors.env_var ? `${ids.envVar}-error` : '']
+                                        .filter(Boolean)
+                                        .join(' '), required: !isEdit }), jsx("p", { id: ids.envVarHelp, className: "text-xs text-gray-500", children: isEdit
+                                        ? t('virtualMachineSecrets.envVarReadOnlyHelp')
+                                        : t('virtualMachineSecrets.envVarHelp') }), fieldError('env_var', ids.envVar)] }), jsxs("div", { className: "space-y-1.5", children: [jsx(Label$2, { htmlFor: ids.hosts, className: "flex items-center text-sm font-medium text-[#646464]", children: t('virtualMachineSecrets.fieldHosts') }), jsx(HostPortChipInput, { id: ids.hosts, value: hosts, onChange: setHosts, hint: t('virtualMachineSecrets.hostsHint'), error: fieldErrors.allow_hosts, testId: "vm-secret-hosts" })] }), jsxs("fieldset", { className: "space-y-3", children: [jsx("legend", { id: ids.source, className: "flex items-center text-sm font-medium text-[#646464]", children: t('virtualMachineSecrets.fieldSource') }), jsxs(RadioGroup, { value: source, onValueChange: (next) => setSource(next), "aria-labelledby": ids.source, className: "gap-3", children: [jsxs("div", { className: "flex items-start gap-3", children: [jsx(RadioGroupItem, { value: "value", id: ids.sourceValue, "data-testid": "vm-secret-source-value", className: BLUE_RADIO_ITEM_CLASS }), jsxs(Label$2, { htmlFor: ids.sourceValue, className: "flex flex-col gap-1 font-normal", children: [jsx("span", { className: "text-[13px] font-medium text-[#646464]", children: t('virtualMachineSecrets.sourceValue') }), jsx("span", { className: "text-xs text-gray-500", children: t('virtualMachineSecrets.sourceValueDescription') })] })] }), jsxs("div", { className: "flex items-start gap-3", children: [jsx(RadioGroupItem, { value: "credential", id: ids.sourceCredential, "data-testid": "vm-secret-source-credential", className: BLUE_RADIO_ITEM_CLASS }), jsxs(Label$2, { htmlFor: ids.sourceCredential, className: "flex flex-col gap-1 font-normal", children: [jsx("span", { className: "text-[13px] font-medium text-[#646464]", children: t('virtualMachineSecrets.sourceCredential') }), jsx("span", { className: "text-xs text-gray-500", children: t('virtualMachineSecrets.sourceCredentialDescription') })] })] })] })] }), source === 'value' ? (jsxs("div", { className: "space-y-1.5", children: [jsx(Label$2, { htmlFor: ids.value, className: "flex items-center text-sm font-medium text-[#646464]", children: t('virtualMachineSecrets.fieldValue') }), jsx(Input, { id: ids.value, type: "password", value: value, onChange: (event) => setValue(event.target.value), placeholder: isEdit
+                                        ? t('virtualMachineSecrets.valueKeepPlaceholder')
+                                        : t('virtualMachineSecrets.valuePlaceholder'), autoComplete: "new-password", spellCheck: false, "aria-invalid": fieldErrors.value ? true : undefined, "aria-describedby": [ids.valueHelp, fieldErrors.value ? `${ids.value}-error` : '']
+                                        .filter(Boolean)
+                                        .join(' '), required: !isEdit, "data-testid": "vm-secret-value" }), jsx("p", { id: ids.valueHelp, className: "text-xs text-gray-500", children: isEdit
+                                        ? t('virtualMachineSecrets.valueKeepHelp')
+                                        : t('virtualMachineSecrets.valueHelp', {
+                                            min: VIRTUAL_MACHINE_SECRET_VALUE_MIN_LENGTH,
+                                        }) }), fieldError('value', ids.value)] })) : (jsxs("div", { className: "space-y-4", children: [jsxs("div", { className: "space-y-1.5", children: [jsx(Label$2, { id: ids.credentialLabel, htmlFor: ids.credential, className: "flex items-center text-sm font-medium text-[#646464]", children: t('virtualMachineSecrets.fieldCredential') }), credentials.length === 0 ? (jsx("p", { className: "text-xs text-gray-500", "data-testid": "vm-secret-no-credentials", children: t('virtualMachineSecrets.noCredentials') })) : (jsxs(Select$1, { value: credentialId, onValueChange: (next) => {
+                                                setCredentialId(next);
+                                                setField('');
+                                            }, children: [jsx(SelectTrigger, { id: ids.credential, "aria-labelledby": ids.credentialLabel, "aria-invalid": fieldErrors.source_credential_id ? true : undefined, "data-testid": "vm-secret-credential-select", children: jsx(SelectValue, { placeholder: t('virtualMachineSecrets.credentialPlaceholder') }) }), jsx(SelectContent, { children: credentials.map((option) => (jsx(SelectItem, { value: String(option.id), children: option.name }, option.id))) })] })), fieldError('source_credential_id', ids.credential)] }), jsxs("div", { className: "space-y-1.5", children: [jsx(Label$2, { id: ids.fieldLabel, htmlFor: ids.field, className: "flex items-center text-sm font-medium text-[#646464]", children: t('virtualMachineSecrets.fieldCredentialField') }), jsxs(Select$1, { value: field, onValueChange: setField, disabled: !selectedCredential || credentialFields.length === 0, children: [jsx(SelectTrigger, { id: ids.field, "aria-labelledby": ids.fieldLabel, "aria-invalid": fieldErrors.source_field ? true : undefined, "data-testid": "vm-secret-field-select", children: jsx(SelectValue, { placeholder: t('virtualMachineSecrets.credentialFieldPlaceholder') }) }), jsx(SelectContent, { children: credentialFields.map((key) => (jsx(SelectItem, { value: key, children: key }, key))) })] }), selectedCredential && credentialFields.length === 0 && (jsx("p", { className: "text-xs text-gray-500", children: t('virtualMachineSecrets.credentialNoFields') })), fieldError('source_field', ids.field)] })] })), jsxs(DialogFooter, { children: [jsx(Button$1, { type: "button", variant: "outline", onClick: () => onOpenChange(false), disabled: isSaving, children: t('virtualMachineSecrets.cancel') }), jsxs(Button$1, { type: "submit", disabled: isSaving, "data-testid": "vm-secret-save", className: "bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: [isSaving && jsx(LoaderCircle, { className: "h-4 w-4 animate-spin", "aria-hidden": "true" }), isEdit
+                                            ? t('virtualMachineSecrets.saveChanges')
+                                            : t('virtualMachineSecrets.createSecret')] })] })] })] }) }));
+}
+
+const HOST_PREVIEW_COUNT = 3;
+/** Placeholder swapped for the inline variable in the delete sentence. */
+const RECORD_SLOT = '__record__';
+/** "3 days ago" for a backend timestamp, or a dash when it is unusable. */
+function relativeTime(value) {
+    const date = new Date(value);
+    return Number.isNaN(date.getTime()) ? '—' : formatDistanceToNow(date, { addSuffix: true });
+}
+/**
+ * VM secrets table with create / edit / delete. A value is never displayed
+ * — the Source column only says whether the secret holds a stored value or
+ * follows an integration credential's field. Deleting a secret also unbinds
+ * it from every agent that uses it, which the confirmation spells out.
+ */
+function VmSecretsSection({ tenantKey, secrets, isLoading, isError, }) {
+    const t = useT();
+    const [dialogOpen, setDialogOpen] = useState(false);
+    const [editingSecret, setEditingSecret] = useState(null);
+    const [deletingSecret, setDeletingSecret] = useState(null);
+    const [deleteError, setDeleteError] = useState(null);
+    const [deleteSecret, { isLoading: isDeleting }] = useDeleteVirtualMachineSecretMutation();
+    // The org's integration credentials feed the "use an existing credential"
+    // source in the form and name the credential in the Source column.
+    const { data: credentialsData } = useGetIntegrationCredentialsQuery({ org: tenantKey });
+    const credentials = useMemo(() => toIntegrationCredentialOptions(credentialsData), [credentialsData]);
+    const credentialNames = useMemo(() => new Map(credentials.map((option) => [option.id, option.name])), [credentials]);
+    const sourceLabel = (secret) => {
+        var _a;
+        if (secret.source_credential_id == null)
+            return t('virtualMachineSecrets.sourceStored');
+        const credentialName = (_a = credentialNames.get(secret.source_credential_id)) !== null && _a !== void 0 ? _a : `#${secret.source_credential_id}`;
+        return t('virtualMachineSecrets.sourceFromCredential', {
+            credential: credentialName,
+            field: secret.source_field,
+        });
+    };
+    // The translated sentence with the variable rendered as the table's code chip.
+    const [deleteConfirmBefore, deleteConfirmAfter] = t('virtualMachineSecrets.deleteConfirm', {
+        envVar: RECORD_SLOT,
+    }).split(RECORD_SLOT);
+    const openCreate = () => {
+        setEditingSecret(null);
+        setDialogOpen(true);
+    };
+    const openEdit = (secret) => {
+        setEditingSecret(secret);
+        setDialogOpen(true);
+    };
+    const openDelete = (secret) => {
+        setDeleteError(null);
+        setDeletingSecret(secret);
+    };
+    const handleDelete = async (secret) => {
+        var _a;
+        try {
+            await deleteSecret({ org: tenantKey, envVar: secret.env_var }).unwrap();
+            toast.success(t('virtualMachineSecrets.deleted'));
+            setDeletingSecret(null);
+        }
+        catch (error) {
+            const parsed = getVirtualMachineApiError(error);
+            setDeleteError(parsed.status === 403
+                ? t('virtualMachineSecrets.forbiddenDelete')
+                : ((_a = parsed.message) !== null && _a !== void 0 ? _a : t('virtualMachineSecrets.deleteFailed')));
+        }
+    };
+    return (jsxs("div", { "data-testid": "vm-secrets-section", className: "space-y-4", children: [jsx("div", { className: "flex justify-end", children: jsxs(Button$1, { size: "sm", onClick: openCreate, "data-testid": "vm-secret-new", className: "cursor-pointer bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: [jsx(Plus, { className: "h-4 w-4", "aria-hidden": "true" }), t('virtualMachineSecrets.newSecret')] }) }), isLoading ? (jsx("div", { className: "flex h-40 items-center justify-center", children: jsx(Spinner, {}) })) : isError ? (jsx("div", { role: "alert", className: "rounded-lg border border-red-200 bg-red-50 px-6 py-6 text-center text-sm text-red-700", children: t('virtualMachineSecrets.loadFailed') })) : (jsx("div", { className: "overflow-x-auto rounded-lg border border-gray-200 bg-white dark:border-gray-700 dark:bg-gray-800", children: jsxs("table", { className: "w-full text-sm", children: [jsx("thead", { className: "border-b border-gray-200 bg-gray-50 dark:border-gray-600 dark:bg-gray-700", children: jsxs("tr", { children: [jsx("th", { className: "px-6 py-3 text-left font-medium text-gray-500 dark:text-gray-400", children: t('virtualMachineSecrets.colName') }), jsx("th", { className: "px-6 py-3 text-left font-medium whitespace-nowrap text-gray-500 dark:text-gray-400", children: t('virtualMachineSecrets.colEnvVar') }), jsx("th", { className: "px-6 py-3 text-left font-medium text-gray-500 dark:text-gray-400", children: t('virtualMachineSecrets.colHosts') }), jsx("th", { className: "px-6 py-3 text-left font-medium text-gray-500 dark:text-gray-400", children: t('virtualMachineSecrets.colSource') }), jsx("th", { className: "px-6 py-3 text-left font-medium whitespace-nowrap text-gray-500 dark:text-gray-400", children: t('virtualMachineSecrets.colUpdated') }), jsx("th", { className: "px-6 py-3 text-right font-medium text-gray-500 dark:text-gray-400", children: t('virtualMachineSecrets.colActions') })] }) }), jsxs("tbody", { className: "divide-y divide-gray-200 dark:divide-gray-600", children: [secrets.map((secret) => {
+                                    const preview = secret.allow_hosts.slice(0, HOST_PREVIEW_COUNT);
+                                    const remaining = secret.allow_hosts.length - preview.length;
+                                    return (jsxs("tr", { "data-testid": `vm-secret-row-${secret.env_var}`, children: [jsx("td", { className: "px-6 py-4 font-medium text-gray-900 dark:text-gray-100", children: secret.name }), jsx("td", { className: "px-6 py-4", children: jsx("code", { className: "rounded bg-gray-100 px-1.5 py-0.5 font-mono text-xs text-gray-800", children: secret.env_var }) }), jsx("td", { className: "px-6 py-4", children: jsxs("ul", { role: "list", "aria-label": t('virtualMachineSecrets.hostsListAriaLabel', {
+                                                        name: secret.name,
+                                                    }), className: "flex flex-wrap gap-1", children: [preview.map((host) => (jsx("li", { className: "rounded-md border border-gray-200 bg-gray-50 px-2 py-0.5 font-mono text-xs text-gray-700", children: host }, host))), remaining > 0 && (jsx("li", { className: "px-1 py-0.5 text-xs text-gray-500", children: t('virtualMachineSecrets.moreHosts', { count: remaining }) }))] }) }), jsx("td", { className: "px-6 py-4 text-gray-600 dark:text-gray-300", children: sourceLabel(secret) }), jsx("td", { className: "px-6 py-4 whitespace-nowrap text-gray-600 dark:text-gray-300", children: relativeTime(secret.updated_at) }), jsx("td", { className: "px-6 py-4", children: jsxs("div", { className: "flex justify-end gap-1", children: [jsx(Button$1, { variant: "ghost", size: "sm", onClick: () => openEdit(secret), "aria-label": t('virtualMachineSecrets.editAriaLabel', {
+                                                                name: secret.name,
+                                                            }), "data-testid": `vm-secret-edit-${secret.env_var}`, children: jsx(Pencil, { className: "h-4 w-4", "aria-hidden": "true" }) }), jsx(Button$1, { variant: "ghost", size: "sm", onClick: () => openDelete(secret), "aria-label": t('virtualMachineSecrets.deleteAriaLabel', {
+                                                                name: secret.name,
+                                                            }), "data-testid": `vm-secret-delete-${secret.env_var}`, className: "text-red-600 hover:text-red-700", children: jsx(Trash2, { className: "h-4 w-4", "aria-hidden": "true" }) })] }) })] }, secret.id));
+                                }), secrets.length === 0 && (jsx("tr", { children: jsx("td", { colSpan: 6, className: "px-6 py-8 text-center text-gray-500 dark:text-gray-400", children: t('virtualMachineSecrets.empty') }) }))] })] }) })), jsx(VmSecretDialog, { open: dialogOpen, onOpenChange: setDialogOpen, tenantKey: tenantKey, secret: editingSecret, credentials: credentials }), jsx(Dialog, { open: deletingSecret !== null, onOpenChange: (open) => {
+                    if (!open && !isDeleting) {
+                        setDeletingSecret(null);
+                        setDeleteError(null);
+                    }
+                }, children: jsxs(DialogContent, { className: "max-w-md", "data-testid": "vm-secret-delete-dialog", children: [jsx(DialogHeader, { children: jsx(DialogTitle, { children: t('virtualMachineSecrets.deleteTitle') }) }), jsxs(DialogDescription, { className: "text-gray-600", children: [deleteConfirmBefore, jsx("code", { className: "rounded bg-gray-100 px-1.5 py-0.5 font-mono text-xs text-gray-800", children: deletingSecret === null || deletingSecret === void 0 ? void 0 : deletingSecret.env_var }), deleteConfirmAfter] }), deleteError && (jsx("div", { role: "alert", "data-testid": "vm-secret-delete-error", className: "rounded-md border border-red-200 bg-red-50 px-3 py-2 text-sm text-red-700", children: deleteError })), jsxs(DialogFooter, { className: "pt-2", children: [jsx(Button$1, { type: "button", variant: "outline", disabled: isDeleting, onClick: () => {
+                                        setDeletingSecret(null);
+                                        setDeleteError(null);
+                                    }, children: t('virtualMachineSecrets.cancel') }), jsxs(Button$1, { type: "button", onClick: () => {
+                                        if (deletingSecret)
+                                            void handleDelete(deletingSecret);
+                                    }, disabled: isDeleting, "data-testid": "vm-secret-delete-confirm", className: "cursor-pointer bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: [isDeleting && jsx(LoaderCircle, { className: "h-4 w-4 animate-spin", "aria-hidden": "true" }), t('virtualMachineSecrets.delete')] })] })] }) })] }));
+}
+
+/**
+ * Tenant-settings **Virtual Machine** tab. Org admins manage the two records
+ * that decide what an agent's Virtual Machine Shell can reach: reusable
+ * `host:port` network policies (bound under the `custom` egress profile) and
+ * VM secrets the VM can use but never read. Each section is hidden when its
+ * list call answers 403; when both do, a single permission notice remains.
+ */
+function VirtualMachineAdminTab({ tenantKey, username, defaultTab = 'network-policies', }) {
+    var _a, _b;
+    const t = useT();
+    const policiesQuery = useListVirtualMachineNetworkPoliciesQuery({ org: tenantKey });
+    const secretsQuery = useListVirtualMachineSecretsQuery({ org: tenantKey });
+    const policiesForbidden = getVirtualMachineErrorStatus(policiesQuery.error) === 403;
+    const secretsForbidden = getVirtualMachineErrorStatus(secretsQuery.error) === 403;
+    if (policiesQuery.isLoading && secretsQuery.isLoading) {
+        return (jsxs("div", { className: "space-y-6", "data-testid": "vm-admin-loading", children: [jsx(Skeleton, { className: "h-10 w-full max-w-sm rounded-lg" }), jsx(Skeleton, { className: "h-40 w-full rounded-lg" })] }));
+    }
+    if (policiesForbidden && secretsForbidden) {
+        return (jsx("div", { className: "max-w-2xl", children: jsx("div", { className: "rounded-lg border px-6 py-8 text-center", style: { borderColor: 'oklch(.922 0 0)' }, "data-testid": "vm-admin-forbidden", children: jsx("p", { className: "text-sm text-gray-500", children: t('virtualMachineAdminTab.forbidden') }) }) }));
+    }
+    const initialTab = (defaultTab === 'secrets' && !secretsForbidden) || policiesForbidden
+        ? 'secrets'
+        : 'network-policies';
+    return (jsxs("div", { className: "space-y-4", children: [jsx("div", { className: "rounded-md border border-gray-200 bg-gray-50 p-3 text-xs text-gray-600", "data-testid": "vm-admin-info-box", children: t('virtualMachineAdminTab.infoBox') }), jsxs(Tabs, { defaultValue: initialTab, "aria-label": t('virtualMachineAdminTab.tabsAriaLabel'), children: [jsxs(TabsList, { "aria-label": t('virtualMachineAdminTab.tabsAriaLabel'), className: "max-w-full justify-start overflow-x-auto px-1", children: [!policiesForbidden && (jsx(TabsTrigger, { "data-testid": "vm-admin-sub-tab-policies", value: "network-policies", children: t('virtualMachineAdminTab.tabNetworkPolicies') })), !secretsForbidden && (jsx(TabsTrigger, { "data-testid": "vm-admin-sub-tab-secrets", value: "secrets", children: t('virtualMachineAdminTab.tabSecrets') }))] }), !policiesForbidden && (jsx(TabsContent, { className: "mt-4", value: "network-policies", children: jsx(NetworkPoliciesSection, { tenantKey: tenantKey, username: username, policies: (_a = policiesQuery.data) !== null && _a !== void 0 ? _a : [], isLoading: policiesQuery.isLoading, isError: policiesQuery.isError }) })), !secretsForbidden && (jsx(TabsContent, { className: "mt-4", value: "secrets", children: jsx(VmSecretsSection, { tenantKey: tenantKey, secrets: (_b = secretsQuery.data) !== null && _b !== void 0 ? _b : [], isLoading: secretsQuery.isLoading, isError: secretsQuery.isError }) }))] })] }));
+}
+
 // ::- Persistent data structure representing an ordered mapping from
 // strings to values, with some convenient update methods.
 function OrderedMap(content) {
@@ -240453,6 +241933,264 @@ function LLMProviderModal({ isOpen, onClose, onSelect, llmProvider, isSelecting,
                 }) })] }));
 }
 
+/** Copy for each egress profile, in the order the backend lists them. */
+const EGRESS_COPY = {
+    none: {
+        label: 'virtualMachineNetworkSection.egressNoneLabel',
+        description: 'virtualMachineNetworkSection.egressNoneDescription',
+    },
+    registries: {
+        label: 'virtualMachineNetworkSection.egressRegistriesLabel',
+        description: 'virtualMachineNetworkSection.egressRegistriesDescription',
+    },
+    public: {
+        label: 'virtualMachineNetworkSection.egressPublicLabel',
+        description: 'virtualMachineNetworkSection.egressPublicDescription',
+    },
+    custom: {
+        label: 'virtualMachineNetworkSection.egressCustomLabel',
+        description: 'virtualMachineNetworkSection.egressCustomDescription',
+    },
+};
+const sameIdSet = (a, b) => a.length === b.length && a.every((id) => b.includes(id));
+/**
+ * The Virtual Machine Shell network settings of an agent: the egress profile
+ * (a labelled radio group), the network policy picker (only under Custom,
+ * required, with a "Create policy" shortcut) and the secrets multi-select
+ * (only under Public or Custom, capped at 20), plus the billing notice.
+ *
+ * Mirrors the backend's rules before saving: Custom needs a policy; secrets
+ * need a networked profile, so narrowing to None or Registries asks to
+ * confirm and unbinds them in the same request; under Custom every host a
+ * bound secret needs must be in the policy, and the missing ones can be
+ * added to the policy (PATCH) right before the save. Backend 400s land next
+ * to the matching control or as a form-level message. The secrets control is
+ * hidden when the secrets list answers 403.
+ */
+function VirtualMachineNetworkSection({ platformKey, mentorUniqueId, username, }) {
+    var _a, _b, _c, _d;
+    const t = useT();
+    const baseId = useId$2();
+    const ids = {
+        egressLabel: `${baseId}-egress-label`,
+        egressHelp: `${baseId}-egress-help`,
+        policyLabel: `${baseId}-policy-label`,
+        policySelect: `${baseId}-policy-select`,
+        secretsLabel: `${baseId}-secrets-label`,
+        secretsHelp: `${baseId}-secrets-help`,
+    };
+    const { data: settingsData, isLoading: isLoadingSettings } = useGetMentorSettingsQuery({ mentor: mentorUniqueId, org: platformKey }, { skip: !platformKey || !mentorUniqueId });
+    const [editMentor, { isLoading: isSaving }] = useEditMentorMutation();
+    const [updatePolicy, { isLoading: isUpdatingPolicy }] = useUpdateVirtualMachineNetworkPolicyMutation();
+    const policiesQuery = useListVirtualMachineNetworkPoliciesQuery({ org: platformKey });
+    const secretsQuery = useListVirtualMachineSecretsQuery({ org: platformKey });
+    const policiesForbidden = getVirtualMachineErrorStatus(policiesQuery.error) === 403;
+    const secretsForbidden = getVirtualMachineErrorStatus(secretsQuery.error) === 403;
+    // What the server holds. The installed MentorSettings type predates these
+    // fields, so the response is read through the typed slice.
+    const settings = settingsData;
+    const server = useMemo(() => {
+        var _a, _b, _c;
+        return ({
+            egress: ((_a = settings === null || settings === void 0 ? void 0 : settings.virtual_machine_egress) !== null && _a !== void 0 ? _a : 'none'),
+            policy: (_b = settings === null || settings === void 0 ? void 0 : settings.virtual_machine_network_policy) !== null && _b !== void 0 ? _b : null,
+            secrets: (_c = settings === null || settings === void 0 ? void 0 : settings.virtual_machine_secrets) !== null && _c !== void 0 ? _c : [],
+        });
+    }, [settings]);
+    const serverPolicyId = (_b = (_a = server.policy) === null || _a === void 0 ? void 0 : _a.id) !== null && _b !== void 0 ? _b : null;
+    const serverSecretIds = useMemo(() => server.secrets.map((secret) => secret.id), [server]);
+    const [egress, setEgress] = useState(server.egress);
+    const [policyId, setPolicyId] = useState(serverPolicyId);
+    const [secretIds, setSecretIds] = useState(serverSecretIds);
+    const [fieldErrors, setFieldErrors] = useState({});
+    const [formError, setFormError] = useState(null);
+    const [policyDialogOpen, setPolicyDialogOpen] = useState(false);
+    // `null` creates a new policy; a policy edits it in place.
+    const [policyDialogPolicy, setPolicyDialogPolicy] = useState(null);
+    const [confirmNarrowOpen, setConfirmNarrowOpen] = useState(false);
+    // The org's policies + secrets admin UI, opened in place so the admin never
+    // has to leave the agent settings to create what they need here.
+    const [manageTab, setManageTab] = useState(null);
+    const resetDraft = () => {
+        setEgress(server.egress);
+        setPolicyId(serverPolicyId);
+        setSecretIds(serverSecretIds);
+        setFieldErrors({});
+        setFormError(null);
+    };
+    // Re-seed the draft whenever the saved settings change (after a save, or
+    // when another admin's change is refetched).
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    useEffect(resetDraft, [server, serverPolicyId, serverSecretIds]);
+    // The bound policy / secrets may be missing from the org lists (the list
+    // may be forbidden, or the settings refetch may lag) — fold the refs the
+    // settings carry into the options so the selection still renders.
+    const policyOptions = useMemo(() => {
+        var _a;
+        const policies = (_a = policiesQuery.data) !== null && _a !== void 0 ? _a : [];
+        if (server.policy && !policies.some((policy) => { var _a; return policy.id === ((_a = server.policy) === null || _a === void 0 ? void 0 : _a.id); })) {
+            return [...policies, { ...server.policy, description: '', created_at: '', updated_at: '' }];
+        }
+        return policies;
+    }, [policiesQuery.data, server.policy]);
+    const secretOptions = useMemo(() => {
+        var _a;
+        const known = new Map();
+        for (const secret of (_a = secretsQuery.data) !== null && _a !== void 0 ? _a : [])
+            known.set(secret.id, secret);
+        for (const ref of server.secrets) {
+            if (!known.has(ref.id)) {
+                known.set(ref.id, { ...ref, source_field: '', created_at: '', updated_at: '' });
+            }
+        }
+        return [...known.values()].sort((a, b) => a.env_var.localeCompare(b.env_var));
+    }, [secretsQuery.data, server.secrets]);
+    const selectedPolicy = (_c = policyOptions.find((policy) => policy.id === policyId)) !== null && _c !== void 0 ? _c : null;
+    const selectedSecrets = secretOptions.filter((secret) => secretIds.includes(secret.id));
+    const isNetworked = isVirtualMachineEgressNetworked(egress);
+    const uncovered = egress === 'custom' && selectedPolicy
+        ? findUncoveredSecretHosts(selectedSecrets, selectedPolicy.allowed_hosts)
+        : [];
+    /** Only the keys that differ from the server, as the PUT partial update expects. */
+    const buildPayload = () => {
+        const payload = {};
+        if (egress !== server.egress)
+            payload.virtual_machine_egress = egress;
+        if (egress === 'custom') {
+            if (policyId !== serverPolicyId || egress !== server.egress) {
+                payload.virtual_machine_network_policy_id = policyId;
+            }
+        }
+        else if (server.egress === 'custom' && serverPolicyId !== null) {
+            payload.virtual_machine_network_policy_id = null;
+        }
+        if (isNetworked) {
+            if (!sameIdSet(secretIds, serverSecretIds))
+                payload.virtual_machine_secret_ids = secretIds;
+        }
+        else if (serverSecretIds.length > 0) {
+            payload.virtual_machine_secret_ids = [];
+        }
+        return payload;
+    };
+    const isDirty = Object.keys(buildPayload()).length > 0;
+    const policyMissing = egress === 'custom' && policyId === null;
+    const isValid = !policyMissing && uncovered.length === 0;
+    const isBusy = isSaving || isUpdatingPolicy;
+    const persist = async (payload) => {
+        setFieldErrors({});
+        setFormError(null);
+        try {
+            await editMentor({
+                mentor: mentorUniqueId,
+                org: platformKey,
+                // @ts-expect-error userId is accepted at runtime (the pinned client's type omits it)
+                userId: username,
+                // The installed MentorSettingsRequest type predates the network fields.
+                formData: payload,
+            }).unwrap();
+            toast.success(t('virtualMachineNetworkSection.saved'));
+        }
+        catch (error) {
+            const parsed = getVirtualMachineApiError(error);
+            if (parsed.status === 403) {
+                setFormError(t('virtualMachineNetworkSection.forbiddenSave'));
+                return;
+            }
+            const nextErrors = {};
+            let unmatched = [];
+            for (const [field, messages] of Object.entries(parsed.fieldErrors)) {
+                const joined = messages.join(' ');
+                if (field === 'virtual_machine_egress')
+                    nextErrors.egress = joined;
+                else if (field === 'virtual_machine_network_policy_id')
+                    nextErrors.policy = joined;
+                else if (field === 'virtual_machine_secret_ids')
+                    nextErrors.secrets = joined;
+                else
+                    unmatched = unmatched.concat(messages);
+            }
+            setFieldErrors(nextErrors);
+            const message = [parsed.message, ...unmatched].filter(Boolean).join(' ');
+            if (message)
+                setFormError(message);
+            else if (Object.keys(nextErrors).length === 0) {
+                setFormError(t('virtualMachineNetworkSection.saveFailed'));
+            }
+        }
+    };
+    const handleSave = () => {
+        // Narrowing the profile while secrets are bound: confirm, then unbind
+        // them in the same request (the backend refuses otherwise).
+        if (!isNetworked && serverSecretIds.length > 0) {
+            setConfirmNarrowOpen(true);
+            return;
+        }
+        void persist(buildPayload());
+    };
+    const handleConfirmNarrow = () => {
+        setConfirmNarrowOpen(false);
+        void persist({ ...buildPayload(), virtual_machine_secret_ids: [] });
+    };
+    /** Add every uncovered host to the selected policy, then save the settings. */
+    const handleAddHostsAndSave = async (policy) => {
+        var _a;
+        const missing = uncovered.flatMap((entry) => entry.hosts);
+        const allowedHosts = Array.from(new Set([...policy.allowed_hosts, ...missing]));
+        setFormError(null);
+        try {
+            await updatePolicy({
+                org: platformKey,
+                body: { id: policy.id, allowed_hosts: allowedHosts },
+            }).unwrap();
+            toast.success(t('virtualMachineNetworkSection.policyHostsAdded', { policy: policy.name }));
+        }
+        catch (error) {
+            const parsed = getVirtualMachineApiError(error);
+            setFormError(parsed.status === 403
+                ? t('virtualMachineNetworkSection.policyUpdateForbidden')
+                : ((_a = parsed.message) !== null && _a !== void 0 ? _a : t('virtualMachineNetworkSection.policyUpdateFailed')));
+            return;
+        }
+        await persist(buildPayload());
+    };
+    const openPolicyDialog = (policy) => {
+        setPolicyDialogPolicy(policy);
+        setPolicyDialogOpen(true);
+    };
+    const toggleSecret = (id, checked) => {
+        setSecretIds((current) => checked ? Array.from(new Set([...current, id])) : current.filter((x) => x !== id));
+    };
+    if (isLoadingSettings || policiesQuery.isLoading || secretsQuery.isLoading) {
+        return (jsxs("div", { className: "space-y-3 rounded-lg border p-6", "data-testid": "vm-network-section-loading", children: [jsx(Skeleton, { className: "h-5 w-48 rounded" }), jsx(Skeleton, { className: "h-24 w-full rounded-lg" })] }));
+    }
+    const capReached = secretIds.length >= VIRTUAL_MACHINE_MAX_SECRETS_PER_MENTOR;
+    return (jsxs("div", { className: "rounded-lg border p-6", "data-testid": "vm-network-section", children: [jsxs("div", { className: "mb-4", children: [jsx("h4", { className: "text-base font-semibold text-gray-900", children: t('virtualMachineNetworkSection.title') }), jsx("p", { className: "mt-1 text-sm text-gray-500", children: t('virtualMachineNetworkSection.description') })] }), jsx("div", { role: "note", "data-testid": "vm-billing-notice", className: "mb-5 rounded-md border border-gray-200 bg-gray-50 p-3 text-xs text-gray-600", children: t('virtualMachineNetworkSection.billingNotice', {
+                    usd: VIRTUAL_MACHINE_DEFAULT_BILLING.usd,
+                    minutes: VIRTUAL_MACHINE_DEFAULT_BILLING.minutes,
+                }) }), jsxs("div", { className: "space-y-6", children: [jsxs("fieldset", { className: "space-y-2", children: [jsx("legend", { id: ids.egressLabel, className: "text-base font-semibold text-gray-900", children: t('virtualMachineNetworkSection.egressLabel') }), jsx("p", { id: ids.egressHelp, className: "text-sm text-gray-500", children: t('virtualMachineNetworkSection.egressHelp') }), jsx(RadioGroup, { value: egress, onValueChange: (next) => setEgress(next), "aria-labelledby": ids.egressLabel, "aria-describedby": ids.egressHelp, "aria-invalid": fieldErrors.egress ? true : undefined, disabled: isBusy, className: "gap-2", "data-testid": "vm-egress-group", children: VIRTUAL_MACHINE_EGRESS_PROFILES.map((profile) => {
+                                    const itemId = `${baseId}-egress-${profile}`;
+                                    return (jsxs("div", { className: "flex items-start gap-2 rounded-lg border border-gray-200 p-3", children: [jsx(RadioGroupItem, { value: profile, id: itemId, "data-testid": `vm-egress-${profile}`, className: BLUE_RADIO_ITEM_CLASS }), jsxs(Label$2, { htmlFor: itemId, className: "flex cursor-pointer flex-col gap-0.5 font-normal", children: [jsx("span", { className: "font-medium text-gray-900", children: t(EGRESS_COPY[profile].label) }), jsx("span", { className: "text-xs text-gray-500", children: t(EGRESS_COPY[profile].description) })] })] }, profile));
+                                }) }), fieldErrors.egress && (jsx("p", { role: "alert", className: "text-xs text-red-600", children: fieldErrors.egress }))] }), egress === 'custom' && (jsxs("div", { className: "space-y-2", "data-testid": "vm-policy-picker", children: [jsxs("div", { className: "flex items-center justify-between gap-2", children: [jsx(Label$2, { id: ids.policyLabel, htmlFor: ids.policySelect, className: "text-base leading-9 font-semibold text-gray-900", children: t('virtualMachineNetworkSection.policyLabel') }), !policiesForbidden && (jsxs("div", { className: "flex flex-wrap items-center justify-end gap-2", children: [jsxs(Button$1, { type: "button", variant: "outline", size: "sm", onClick: () => openPolicyDialog(null), disabled: isBusy, "data-testid": "vm-policy-create", children: [jsx(Plus, { className: "h-4 w-4", "aria-hidden": "true" }), t('virtualMachineNetworkSection.createPolicy')] }), jsxs(Button$1, { type: "button", variant: "outline", size: "sm", onClick: () => setManageTab('network-policies'), disabled: isBusy, "data-testid": "vm-manage-policies", children: [jsx(Settings, { className: "h-4 w-4", "aria-hidden": "true" }), t('virtualMachineNetworkSection.managePolicies')] })] }))] }), policiesForbidden ? (jsx("p", { className: "text-xs text-gray-500", "data-testid": "vm-policies-forbidden", children: t('virtualMachineNetworkSection.policiesForbidden') })) : (jsxs("div", { className: "flex flex-wrap items-center gap-2", children: [jsxs(Select$1, { value: policyId !== null ? String(policyId) : '', onValueChange: (next) => setPolicyId(Number(next)), disabled: isBusy || policyOptions.length === 0, children: [jsx(SelectTrigger, { id: ids.policySelect, "aria-labelledby": ids.policyLabel, "aria-invalid": policyMissing || fieldErrors.policy ? true : undefined, "data-testid": "vm-policy-select", className: "sm:w-80", children: jsx(SelectValue, { placeholder: policyOptions.length === 0
+                                                        ? t('virtualMachineNetworkSection.noPolicies')
+                                                        : t('virtualMachineNetworkSection.policyPlaceholder') }) }), jsx(SelectContent, { children: policyOptions.map((policy) => (jsx(SelectItem, { value: String(policy.id), children: policy.name }, policy.id))) })] }), selectedPolicy && (jsxs(Button$1, { type: "button", variant: "outline", size: "sm", onClick: () => openPolicyDialog(selectedPolicy), disabled: isBusy, "data-testid": "vm-policy-edit", children: [jsx(Pencil, { className: "h-4 w-4", "aria-hidden": "true" }), t('virtualMachineNetworkSection.editPolicy')] }))] })), jsx("p", { "aria-live": "polite", className: policyMissing || fieldErrors.policy ? 'text-xs text-red-600' : 'sr-only', children: (_d = fieldErrors.policy) !== null && _d !== void 0 ? _d : (policyMissing ? t('virtualMachineNetworkSection.policyRequired') : '') }), selectedPolicy && (jsxs("div", { className: "text-xs text-gray-500", "data-testid": "vm-policy-hosts", children: [jsx("span", { children: t('virtualMachineNetworkSection.policyHosts') }), jsx("ul", { role: "list", className: "mt-1 flex flex-wrap gap-1", children: selectedPolicy.allowed_hosts.map((host) => (jsx("li", { className: "rounded-md border border-gray-200 bg-gray-50 px-2 py-0.5 font-mono text-xs text-gray-700", children: host }, host))) })] }))] })), isNetworked && !secretsForbidden && (jsxs("div", { className: "space-y-2", "data-testid": "vm-secrets-picker", children: [jsxs("div", { className: "flex items-center justify-between gap-2", children: [jsx("span", { id: ids.secretsLabel, className: "text-base leading-9 font-semibold text-gray-900", children: t('virtualMachineNetworkSection.secretsLabel') }), jsxs(Button$1, { type: "button", variant: "outline", size: "sm", onClick: () => setManageTab('secrets'), disabled: isBusy, "data-testid": "vm-manage-secrets", children: [jsx(Settings, { className: "h-4 w-4", "aria-hidden": "true" }), t('virtualMachineNetworkSection.manageSecrets')] })] }), jsx("p", { id: ids.secretsHelp, className: "text-sm text-gray-500", children: t('virtualMachineNetworkSection.secretsHelp', {
+                                    max: VIRTUAL_MACHINE_MAX_SECRETS_PER_MENTOR,
+                                }) }), secretOptions.length === 0 ? (jsx("p", { className: "text-xs text-gray-500", "data-testid": "vm-no-secrets", children: t('virtualMachineNetworkSection.noSecrets') })) : (jsx("div", { role: "group", "aria-labelledby": ids.secretsLabel, "aria-describedby": ids.secretsHelp, className: "space-y-2", children: secretOptions.map((secret) => {
+                                    const itemId = `${baseId}-secret-${secret.id}`;
+                                    const checked = secretIds.includes(secret.id);
+                                    return (jsxs("div", { className: "flex items-start gap-2 rounded-lg border border-gray-200 p-3", children: [jsx(Checkbox, { id: itemId, checked: checked, disabled: isBusy || (!checked && capReached), onCheckedChange: (next) => toggleSecret(secret.id, next === true), "data-testid": `vm-secret-option-${secret.env_var}`, className: BLUE_CHECKBOX_CLASS }), jsxs(Label$2, { htmlFor: itemId, className: "flex cursor-pointer flex-col gap-0.5 font-normal", children: [jsxs("span", { className: "text-gray-900", children: [jsx("span", { className: "font-medium", children: secret.name }), ' ', jsx("code", { className: "rounded bg-gray-100 px-1 py-0.5 font-mono text-xs", children: secret.env_var })] }), jsx("span", { className: "text-xs text-gray-500", children: secret.allow_hosts.join(', ') })] })] }, secret.id));
+                                }) })), capReached && (jsx("p", { role: "status", className: "text-xs text-gray-500", "data-testid": "vm-secrets-cap", children: t('virtualMachineNetworkSection.secretsCapReached', {
+                                    max: VIRTUAL_MACHINE_MAX_SECRETS_PER_MENTOR,
+                                }) })), fieldErrors.secrets && (jsx("p", { role: "alert", className: "text-xs text-red-600", children: fieldErrors.secrets }))] })), uncovered.length > 0 && selectedPolicy && (jsxs("div", { role: "alert", "data-testid": "vm-uncovered-hosts", className: "space-y-2 rounded-md border border-amber-200 bg-amber-50 p-3 text-xs text-amber-800", children: [jsxs("div", { className: "flex items-start gap-2", children: [jsx(TriangleAlert, { className: "mt-0.5 h-4 w-4 shrink-0", "aria-hidden": "true" }), jsxs("div", { children: [jsx("p", { className: "font-medium", children: t('virtualMachineNetworkSection.uncoveredTitle') }), jsx("ul", { role: "list", className: "mt-1 list-disc space-y-0.5 pl-5", children: uncovered.map((entry) => (jsx("li", { children: t('virtualMachineNetworkSection.uncoveredItem', {
+                                                        envVar: entry.envVar,
+                                                        hosts: entry.hosts.join(', '),
+                                                        policy: selectedPolicy.name,
+                                                    }) }, entry.envVar))) })] })] }), !policiesForbidden && (jsxs(Button$1, { type: "button", variant: "outline", size: "sm", onClick: () => void handleAddHostsAndSave(selectedPolicy), disabled: isBusy, "data-testid": "vm-add-hosts-and-save", children: [isUpdatingPolicy && (jsx(LoaderCircle, { className: "h-4 w-4 animate-spin", "aria-hidden": "true" })), t('virtualMachineNetworkSection.addHostsAndSave', { policy: selectedPolicy.name })] }))] })), formError && (jsx("div", { role: "alert", "data-testid": "vm-network-form-error", className: "rounded-md border border-red-200 bg-red-50 px-3 py-2 text-sm text-red-700", children: formError })), jsxs("div", { className: "flex items-center justify-end gap-2", children: [jsx(Button$1, { type: "button", variant: "outline", size: "sm", onClick: resetDraft, disabled: !isDirty || isBusy, "data-testid": "vm-network-discard", children: t('virtualMachineNetworkSection.discard') }), jsxs(Button$1, { type: "button", size: "sm", onClick: handleSave, disabled: !isDirty || !isValid || isBusy, "data-testid": "vm-network-save", className: "cursor-pointer bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: [isSaving && jsx(LoaderCircle, { className: "h-4 w-4 animate-spin", "aria-hidden": "true" }), t('virtualMachineNetworkSection.save')] })] })] }), jsx(NetworkPolicyDialog, { open: policyDialogOpen, onOpenChange: setPolicyDialogOpen, tenantKey: platformKey, policy: policyDialogPolicy, onSaved: (policy) => setPolicyId(policy.id) }), jsx(Dialog, { open: manageTab !== null, onOpenChange: (open) => !open && setManageTab(null), children: jsxs(DialogContent, { className: "max-h-[90vh] w-full max-w-5xl overflow-y-auto", "data-testid": "vm-manage-dialog", children: [jsxs(DialogHeader, { children: [jsx(DialogTitle, { children: t('virtualMachineNetworkSection.manageTitle') }), jsx(DialogDescription, { children: t('virtualMachineNetworkSection.manageDescription') })] }), jsx(VirtualMachineAdminTab, { tenantKey: platformKey, username: username, defaultTab: manageTab !== null && manageTab !== void 0 ? manageTab : 'network-policies' })] }) }), jsx(Dialog, { open: confirmNarrowOpen, onOpenChange: setConfirmNarrowOpen, children: jsxs(DialogContent, { className: "max-w-md", "data-testid": "vm-narrow-confirm", children: [jsx(DialogHeader, { children: jsx(DialogTitle, { children: t('virtualMachineNetworkSection.narrowTitle') }) }), jsx(DialogDescription, { className: "text-gray-600", children: t('virtualMachineNetworkSection.narrowDescription', {
+                                profile: t(EGRESS_COPY[egress].label),
+                                count: serverSecretIds.length,
+                            }) }), jsxs(DialogFooter, { className: "pt-2", children: [jsx(Button$1, { type: "button", variant: "outline", onClick: () => setConfirmNarrowOpen(false), children: t('virtualMachineNetworkSection.cancel') }), jsx(Button$1, { type: "button", onClick: handleConfirmNarrow, "data-testid": "vm-narrow-confirm-action", className: "cursor-pointer bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: t('virtualMachineNetworkSection.narrowConfirm') })] })] }) })] }));
+}
+
 const HEALTHY_HEALTH_VALUES = new Set(['healthy', 'ok', 'pass', 'success']);
 const HEALTHY_STATUS_VALUES = new Set(['active', 'running', 'connected', 'ok', 'ready']);
 /** True when the instance's status is set and not one of the healthy values.
@@ -240944,7 +242682,7 @@ function SandboxConfig({ platformKey, mentorUniqueId, username }) {
                     llm_name: currentModel.llmName,
                     llm_provider: currentModel.provider,
                 }, llms: availableLLMProviders }))] })) : null;
-    return (jsxs("div", { className: "space-y-6", children: [sandboxKindsSection, clawEnabled && (mentorConfig ? connectedSection : notConnectedSection)] }));
+    return (jsxs("div", { className: "space-y-6", children: [sandboxKindsSection, sandboxFlags.enable_virtual_machine && (jsx(VirtualMachineNetworkSection, { platformKey: platformKey, mentorUniqueId: mentorUniqueId, username: resolvedUsername })), clawEnabled && (mentorConfig ? connectedSection : notConnectedSection)] }));
 }
 // ── Edit Instance Dialog ─────────────────────────────────────────────────────
 function EditInstanceDialog({ instance, org, onClose, onSaved, }) {
@@ -244213,7 +245951,7 @@ const ProjectFilesModal$1 = lazy(() => Promise.resolve().then(function () { retu
 const AddMentorToProjectModal$1 = lazy(() => Promise.resolve().then(function () { return addMentorToProjectModal; }).then((mod) => ({
     default: mod.AddMentorToProjectModal,
 })));
-function ProjectLandingPage({ project, sessionId, onSubmit, onScreenSharingClick, isScreenSharingModalOpen, onPhoneCallClick, stopGenerating, tenantKey, username, enableSafetyDisclaimer, enableWebBrowsing, isStreaming, updateSessionTools, setSessionTools, activeTools, screenSharing, deepResearch, studyMode, imageGeneration, codeInterpreter, promptsIsEnabled, isPreviewMode, setMessage, mentorId, mentorUniqueId, projectId, googleSlidesIsEnabled, googleDocumentIsEnabled, artifactsEnabled, userIsStudent, isPublicRoute, navigateToProject, showExploreMentors = false, }) {
+function ProjectLandingPage({ project, sessionId, onSubmit, onScreenSharingClick, isScreenSharingModalOpen, onPhoneCallClick, stopGenerating, tenantKey, username, enableSafetyDisclaimer, enableWebBrowsing, isStreaming, updateSessionTools, setSessionTools, activeTools, screenSharing, deepResearch, studyMode, imageGeneration, codeInterpreter, promptsIsEnabled, isPreviewMode, setMessage, mentorId, mentorUniqueId, projectId, googleSlidesIsEnabled, googleDocumentIsEnabled, artifactsEnabled, userIsStudent, isPublicRoute, navigateToProject, showExploreMentors = false, disabledResourceTypes, maxUploadSizeMb, dropboxExtensions, }) {
     var _a;
     const [isInstructionsModalOpen, setIsInstructionsModalOpen] = useState(false);
     const [isFilesModalOpen, setIsFilesModalOpen] = useState(false);
@@ -244226,7 +245964,7 @@ function ProjectLandingPage({ project, sessionId, onSubmit, onScreenSharingClick
                                             name: mentor.name,
                                             avatar: mentor.profile_image,
                                             description: mentor.description,
-                                        })), onAddMentorClick: () => setIsAddMentorModalOpen(true), showTitle: true, tenantKey: tenantKey, mentorId: mentorId, projectId: projectId, username: username, navigateToProject: navigateToProject }))] })] })] }), isInstructionsModalOpen && (jsx(Suspense, { fallback: null, children: jsx(ProjectInstructionsModal$1, { isOpen: isInstructionsModalOpen, onClose: () => setIsInstructionsModalOpen(false), tenantKey: tenantKey, projectId: projectId, username: username }) })), isFilesModalOpen && (jsx(Suspense, { fallback: null, children: jsx(ProjectFilesModal$1, { isOpen: isFilesModalOpen, onClose: () => setIsFilesModalOpen(false), tenantKey: tenantKey, mentorId: mentorId, username: username }) })), isAddMentorModalOpen && (jsx(Suspense, { fallback: null, children: jsx(AddMentorToProjectModal$1, { isOpen: isAddMentorModalOpen, onClose: () => setIsAddMentorModalOpen(false), projectName: project.name, tenantKey: tenantKey, projectId: projectId, username: username, isPublicRoute: isPublicRoute }) }))] }));
+                                        })), onAddMentorClick: () => setIsAddMentorModalOpen(true), showTitle: true, tenantKey: tenantKey, mentorId: mentorId, projectId: projectId, username: username, navigateToProject: navigateToProject }))] })] })] }), isInstructionsModalOpen && (jsx(Suspense, { fallback: null, children: jsx(ProjectInstructionsModal$1, { isOpen: isInstructionsModalOpen, onClose: () => setIsInstructionsModalOpen(false), tenantKey: tenantKey, projectId: projectId, username: username }) })), isFilesModalOpen && (jsx(Suspense, { fallback: null, children: jsx(ProjectFilesModal$1, { isOpen: isFilesModalOpen, onClose: () => setIsFilesModalOpen(false), tenantKey: tenantKey, mentorId: mentorId, username: username, disabledResourceTypes: disabledResourceTypes, maxUploadSizeMb: maxUploadSizeMb, dropboxExtensions: dropboxExtensions }) })), isAddMentorModalOpen && (jsx(Suspense, { fallback: null, children: jsx(AddMentorToProjectModal$1, { isOpen: isAddMentorModalOpen, onClose: () => setIsAddMentorModalOpen(false), projectName: project.name, tenantKey: tenantKey, projectId: projectId, username: username, isPublicRoute: isPublicRoute }) }))] }));
 }
 
 function MinimumMentorAlert({ open, onOpenChange }) {
@@ -244499,8 +246237,9 @@ const TrainOrDeleteModal$1 = dynamic(() => Promise.resolve().then(function () {
  */
 function isCrawlableDocType(documentType) {
     const docType = documentType === null || documentType === void 0 ? void 0 : documentType.toLowerCase();
-    // Uploaded documents (local files like PDF, DOCX, etc.)
-    const uploadedFileTypes = ['file'];
+    // Uploaded documents: generic local files ('file') plus the local resource
+    // types that send their own fileType as the document type.
+    const uploadedFileTypes = ['file', 'image', 'audio', 'video', 'zip'];
     if (uploadedFileTypes.some((type) => docType === null || docType === void 0 ? void 0 : docType.includes(type))) {
         return false;
     }
@@ -244511,6 +246250,12 @@ function isCrawlableDocType(documentType) {
     }
     return true;
 }
+/**
+ * The crawler User-Agent override only applies to web crawler documents.
+ */
+function isWebCrawlerDocType(documentType) {
+    return !!(documentType === null || documentType === void 0 ? void 0 : documentType.toLowerCase().includes('webcrawler'));
+}
 function DatasetItem({ dataset, onSelect, isSelected, labels }) {
     var _a, _b, _c, _d, _e;
     const t = useT();
@@ -244587,7 +246332,7 @@ function DatasetItem({ dataset, onSelect, isSelected, labels }) {
                                     }
                                 }, className: "text-gray-500 hover:text-gray-700", disabled: isEditTrainingDocumentLoading || disabled, children: dataset.access === 'private' ? (jsxs(Fragment$1, { children: [jsx(EyeOff, { className: "h-4 w-4" }), jsx("span", { className: "sr-only", children: t('datasetsTabDatasetItem.makePublic') })] })) : (jsxs(Fragment$1, { children: [jsx(Eye, { className: "h-4 w-4" }), jsx("span", { className: "sr-only", children: t('datasetsTabDatasetItem.makePrivate') })] })) })) }) }), jsx(TableCell, { className: "p-3 whitespace-nowrap", children: jsx(WithFormPermissions, { name: "is_trained", 
                             // @ts-ignore
-                            permissions: (_e = dataset === null || dataset === void 0 ? void 0 : dataset.permissions) === null || _e === void 0 ? void 0 : _e.field, children: ({ disabled }) => (jsx(TrainingStatusSwitch, { is_trained: dataset.is_trained, url: dataset.url, disabled: disabled, training_status: dataset.training_status, handleEditTrainingDocument: handleEditTrainingDocument, onUntrainSuccess: () => setIsDeleteDatasetModalOpen(true), onTrainRequest: () => setIsTrainOrDeleteModalOpen(true) })) }) })] }, dataset.id), isDeleteDatasetModalOpen && (jsx(DeleteDatasetModal$1, { isOpen: isDeleteDatasetModalOpen, onClose: () => setIsDeleteDatasetModalOpen(false), dataset: dataset, labels: labels })), isRetrainScheduleModalOpen && (jsx(RetrainScheduleModal$1, { isOpen: isRetrainScheduleModalOpen, onClose: () => setIsRetrainScheduleModalOpen(false), dataset: dataset, labels: labels })), isTrainOrDeleteModalOpen && (jsx(TrainOrDeleteModal$1, { isOpen: isTrainOrDeleteModalOpen, onClose: () => setIsTrainOrDeleteModalOpen(false), onTrain: handleTrainDataset, onDelete: handleDeleteFromTrainModal, showUserAgentField: isCrawlableDocType(dataset.document_type), isLoading: isEditTrainingDocumentLoading, labels: labels }))] }));
+                            permissions: (_e = dataset === null || dataset === void 0 ? void 0 : dataset.permissions) === null || _e === void 0 ? void 0 : _e.field, children: ({ disabled }) => (jsx(TrainingStatusSwitch, { is_trained: dataset.is_trained, url: dataset.url, disabled: disabled, training_status: dataset.training_status, handleEditTrainingDocument: handleEditTrainingDocument, onUntrainSuccess: () => setIsDeleteDatasetModalOpen(true), onTrainRequest: () => setIsTrainOrDeleteModalOpen(true) })) }) })] }, dataset.id), isDeleteDatasetModalOpen && (jsx(DeleteDatasetModal$1, { isOpen: isDeleteDatasetModalOpen, onClose: () => setIsDeleteDatasetModalOpen(false), dataset: dataset, labels: labels })), isRetrainScheduleModalOpen && (jsx(RetrainScheduleModal$1, { isOpen: isRetrainScheduleModalOpen, onClose: () => setIsRetrainScheduleModalOpen(false), dataset: dataset, labels: labels })), isTrainOrDeleteModalOpen && (jsx(TrainOrDeleteModal$1, { isOpen: isTrainOrDeleteModalOpen, onClose: () => setIsTrainOrDeleteModalOpen(false), onTrain: handleTrainDataset, onDelete: handleDeleteFromTrainModal, showUserAgentField: isWebCrawlerDocType(dataset.document_type), isLoading: isEditTrainingDocumentLoading, labels: labels }))] }));
 }
 function TrainingStatusSwitch({ is_trained, url, training_status, disabled, handleEditTrainingDocument, onUntrainSuccess, onTrainRequest, }) {
     const t = useT();
@@ -244854,6 +246599,15 @@ const resourceTypes = [
         accept: 'text/plain',
         icon: (jsxs("svg", { width: "24", height: "24", viewBox: "0 0 24 24", fill: "none", xmlns: "http://www.w3.org/2000/svg", children: [jsx("rect", { width: "24", height: "24", rx: "4", fill: "url(#paint0_linear_text)" }), jsx("path", { d: "M7 7H17V9H13V17H11V9H7V7Z", fill: "white" }), jsx("defs", { children: jsxs("linearGradient", { id: "paint0_linear_text", x1: "0", y1: "0", x2: "24", y2: "24", gradientUnits: "userSpaceOnUse", children: [jsx("stop", { stopColor: "#4F46E5" }), jsx("stop", { offset: "1", stopColor: "#06B6D4" })] }) })] })),
     },
+    {
+        id: 'markdown',
+        name: 'Markdown',
+        bgColor: 'bg-blue-100',
+        isActive: true,
+        type: 'local',
+        accept: 'text/markdown,.md,.markdown',
+        icon: (jsxs("svg", { width: "24", height: "24", viewBox: "0 0 24 24", fill: "none", xmlns: "http://www.w3.org/2000/svg", "aria-hidden": "true", children: [jsx("rect", { width: "24", height: "24", rx: "4", fill: "#1F2937" }), jsx("path", { d: "M4 16V8h2l2 3 2-3h2v8H9.5v-4.6L8 13.7l-1.5-2.3V16H4Zm11.5 0L13 13h1.75V8h1.5v5H18l-2.5 3Z", fill: "white" })] })),
+    },
     {
         id: 'audio',
         name: 'Audio',
@@ -244915,6 +246669,26 @@ const resourceTypes = [
     },
 ];
 
+/**
+ * Shared chrome for the Add Resources picker and every per-type resource
+ * dialog, mirroring the Datasets tab: a fixed header (title + description bar
+ * with a divider), a body that scrolls on its own (`ResourceDialogBody`), and
+ * an optional fixed footer (`ResourceDialogFooter`).
+ */
+function ResourceDialogContent({ title, description, className, children, }) {
+    return (jsxs(DialogContent, { className: cn('flex max-h-[80vh] w-full max-w-lg flex-col gap-0 overflow-hidden p-0', className), children: [jsxs(DialogHeader, { className: "flex-shrink-0 space-y-1 border-b border-gray-200 bg-white px-4 pt-4 pr-10 pb-3 text-left", children: [jsx(DialogTitle, { className: "text-muted-foreground text-base", children: title }), jsx(DialogDescription, { className: "text-xs text-gray-600", children: description })] }), children] }));
+}
+/** The only scrolling part of a resource dialog; focusable so keyboard users can scroll it. */
+function ResourceDialogBody({ label, children }) {
+    return (jsx("div", { className: "min-h-0 flex-1 space-y-4 overflow-x-hidden overflow-y-auto p-4", tabIndex: 0, role: "region", "aria-label": label, children: children }));
+}
+/** Actions pinned below the scroll region so they stay visible. */
+function ResourceDialogFooter({ children }) {
+    return (jsx("div", { className: "flex flex-shrink-0 justify-end border-t border-gray-200 bg-white px-4 py-3", children: children }));
+}
+/** Submit button styling shared by every resource dialog footer. */
+const RESOURCE_SUBMIT_BUTTON_CLASS = 'bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-sm text-white hover:text-white hover:opacity-90';
+
 /**
  * Spend-cap blocks (HTTP 429) carry the machine code in `error`/`error_code`
  * and a friendly, learner-safe sentence in `message`. Detection keys on
@@ -245009,7 +246783,7 @@ function GithubFileUploadModal() {
     const { branches, error, isLoading } = useGithubRepoDetails(debouncedGithubUrl, tenantKey);
     const isLoadingDisabled = !githubUrl || isLoading || isAddTrainingDocumentLoading;
     const isDisabled = isLoadingDisabled || !branch;
-    return (jsxs("div", { className: "flex flex-col space-y-4", children: [jsx(Input, { type: "url", placeholder: t('resourceModalGithubFileUploadModal.githubRepoUrlPlaceholder'), value: githubUrl, onChange: (e) => setGithubUrl(e.target.value), autoComplete: "url", disabled: isAddTrainingDocumentLoading }), jsx("p", { className: "text-xs font-light text-red-500", children: error }), jsxs(Select$1, { value: branch, onValueChange: (value) => setBranch(value), disabled: isLoadingDisabled, children: [jsx(SelectTrigger, { className: "w-full rounded-md border p-2", children: jsx(SelectValue, { placeholder: t('resourceModalGithubFileUploadModal.selectBranchPlaceholder') }) }), jsx(SelectContent, { children: branches.map((b) => (jsx(SelectItem, { value: b, children: b }, b))) })] }), jsx("div", { className: "flex justify-end", children: jsx(Button$1, { onClick: handleSubmit, disabled: isDisabled, className: `${githubUrl ? 'bg-gradient-to-r from-blue-600 to-blue-400 text-white' : 'bg-gray-100 text-gray-500'} hover:opacity-90`, children: t('resourceModalGithubFileUploadModal.submit') }) })] }));
+    return (jsxs(Fragment$1, { children: [jsxs(ResourceDialogBody, { label: t('resourceModalGithubFileUploadModal.scrollRegionAriaLabel'), children: [jsxs("div", { className: "grid gap-2", children: [jsx(Label$2, { htmlFor: "github-repo-url", children: t('resourceModalGithubFileUploadModal.repoUrlLabel') }), jsx(Input, { id: "github-repo-url", type: "url", placeholder: t('resourceModalGithubFileUploadModal.githubRepoUrlPlaceholder'), value: githubUrl, onChange: (e) => setGithubUrl(e.target.value), autoComplete: "url", disabled: isAddTrainingDocumentLoading, "aria-describedby": error ? 'github-repo-url-error' : undefined, "aria-invalid": !!error }), error ? (jsx("p", { id: "github-repo-url-error", className: "text-destructive -mt-1 text-xs", role: "alert", children: error })) : null] }), jsxs("div", { className: "grid gap-2", children: [jsx(Label$2, { htmlFor: "github-branch", children: t('resourceModalGithubFileUploadModal.branchLabel') }), jsxs(Select$1, { value: branch, onValueChange: (value) => setBranch(value), disabled: isLoadingDisabled, children: [jsx(SelectTrigger, { id: "github-branch", className: "w-full", children: jsx(SelectValue, { placeholder: t('resourceModalGithubFileUploadModal.selectBranchPlaceholder') }) }), jsx(SelectContent, { children: branches.map((b) => (jsx(SelectItem, { value: b, children: b }, b))) })] })] })] }), jsx(ResourceDialogFooter, { children: jsx(Button$1, { onClick: handleSubmit, disabled: isDisabled, className: RESOURCE_SUBMIT_BUTTON_CLASS, children: t('resourceModalGithubFileUploadModal.submit') }) })] }));
 }
 
 /**
@@ -245129,18 +246903,18 @@ function LocalFileUploadModal({ resource, maxFileSizeMB = DEFAULT_MAX_FILE_SIZE_
             handleUploadFile();
         }
     };
-    return (jsxs("div", { className: "flex flex-col items-center", children: [jsxs("div", { className: `w-full max-w-sm border-2 border-dashed ${isDraggingFile
-                    ? 'border-blue-400 bg-blue-50/50 backdrop-blur-sm'
-                    : 'border-gray-300 bg-gray-50'} flex flex-col items-center justify-center rounded-lg p-8 transition-all duration-200 ${!isDraggingFile && 'hover:bg-gray-100'}`, onDragOver: handleDragOver, onDragEnter: handleDragEnter, onDragLeave: handleDragLeave, onDrop: handleDrop, children: [jsx("div", { className: "mb-4 rounded-full bg-blue-100 p-3", children: jsx(Upload, { className: "h-8 w-8 text-blue-600" }) }), jsx("h3", { className: "mb-1 text-lg font-medium text-gray-700", children: t('resourceModalLocalFileUploadModal.dragAndDrop') }), jsx("p", { className: "mb-4 text-sm text-gray-500", children: t('resourceModalLocalFileUploadModal.or') }), jsxs("label", { htmlFor: "file-upload", className: "cursor-pointer", children: [jsx("div", { className: "rounded-md bg-gradient-to-r from-blue-600 to-blue-400 px-4 py-2 font-medium text-white transition-colors hover:opacity-90", children: t('resourceModalLocalFileUploadModal.browseFiles') }), jsx("input", { id: "file-upload", type: "file", accept: resource.accept, className: "hidden", ref: fileInputRef, onChange: handleFileChange })] }), jsx("p", { className: "mt-4 text-xs text-gray-500", children: t('resourceModalLocalFileUploadModal.maximumFileSize', {
-                            value: maxFileSize.value,
-                            unit: maxFileSize.unit,
-                        }) }), file && (jsxs(Fragment$1, { children: [jsx("div", { className: "mt-4 flex w-full items-center rounded-md border border-gray-200 bg-white p-3", children: jsxs("div", { className: "flex w-full items-center", children: [jsx("div", { className: "mr-3 flex-shrink-0 rounded-md bg-blue-100 p-2", children: jsxs("svg", { width: "20", height: "20", viewBox: "0 0 24 24", fill: "none", xmlns: "http://www.w3.org/2000/svg", children: [jsx("path", { d: "M14 2H6C4.9 2 4 2.9 4 4V20C4 21.1 4.9 22 6 22H18C19.1 22 20 21.1 20 20V8L14 2Z", fill: "#4285F4" }), jsx("path", { d: "M14 2V8H20L14 2Z", fill: "#A1C2FA" })] }) }), jsxs("div", { className: "isolate z-50 min-w-0 flex-1 overflow-hidden", children: [jsx("p", { className: "truncate text-sm font-medium", children: file.name }), jsxs("p", { className: "text-xs text-gray-500", children: [convertFromBytes(file.size).value, " ", convertFromBytes(file.size).unit] })] }), jsx("button", { onClick: () => {
-                                                setFile(null);
-                                                setDescription('');
-                                                if (fileInputRef.current) {
-                                                    fileInputRef.current.value = '';
-                                                }
-                                            }, className: "ml-2 flex-shrink-0 rounded-full p-1 transition-colors hover:bg-gray-100", children: jsx(X$1, { className: "h-4 w-4 text-gray-500" }) })] }) }), isImageFile(file) && (jsxs("div", { className: "mt-3 w-full", children: [jsx("label", { htmlFor: "image-description", className: "mb-1 block text-sm font-medium text-gray-700", children: t('resourceModalLocalFileUploadModal.descriptionOptional') }), jsx(Textarea, { id: "image-description", value: description, onChange: (e) => setDescription(e.target.value), placeholder: t('resourceModalLocalFileUploadModal.descriptionPlaceholder'), className: "resize-none", rows: 3 })] }))] }))] }), jsx("div", { className: "mt-4 flex w-full justify-end", children: jsx(Button$1, { onClick: handleSubmit, disabled: !file || isDisabled, className: `${file ? 'bg-gradient-to-r from-blue-600 to-blue-400 text-white' : 'bg-gray-100 text-gray-500'} hover:opacity-90`, children: isAddTrainingDocumentLoading ? (jsxs(Fragment$1, { children: [jsx(LoaderCircle, { className: "h-4 w-4 animate-spin" }), ' ', t('resourceModalLocalFileUploadModal.submitting')] })) : (jsx(Fragment$1, { children: t('resourceModalLocalFileUploadModal.submit') })) }) })] }));
+    return (jsxs(Fragment$1, { children: [jsx(ResourceDialogBody, { label: t('resourceModalLocalFileUploadModal.scrollRegionAriaLabel'), children: jsxs("div", { className: `w-full border-2 border-dashed ${isDraggingFile
+                        ? 'border-blue-400 bg-blue-50/50 backdrop-blur-sm'
+                        : 'border-gray-300 bg-gray-50'} flex flex-col items-center justify-center rounded-lg p-8 transition-all duration-200 ${!isDraggingFile && 'hover:bg-gray-100'}`, onDragOver: handleDragOver, onDragEnter: handleDragEnter, onDragLeave: handleDragLeave, onDrop: handleDrop, children: [jsx("div", { className: "mb-4 rounded-full bg-blue-100 p-3", children: jsx(Upload, { className: "h-8 w-8 text-blue-600" }) }), jsx("h3", { className: "mb-1 text-lg font-medium text-gray-700", children: t('resourceModalLocalFileUploadModal.dragAndDrop') }), jsx("p", { className: "mb-4 text-sm text-gray-500", children: t('resourceModalLocalFileUploadModal.or') }), jsxs("label", { htmlFor: "file-upload", className: "cursor-pointer", children: [jsx("div", { className: "rounded-md bg-gradient-to-r from-blue-600 to-blue-400 px-4 py-2 font-medium text-white transition-colors hover:opacity-90", children: t('resourceModalLocalFileUploadModal.browseFiles') }), jsx("input", { id: "file-upload", type: "file", accept: resource.accept, className: "hidden", ref: fileInputRef, onChange: handleFileChange })] }), jsx("p", { className: "mt-4 text-xs text-gray-500", children: t('resourceModalLocalFileUploadModal.maximumFileSize', {
+                                value: maxFileSize.value,
+                                unit: maxFileSize.unit,
+                            }) }), file && (jsxs(Fragment$1, { children: [jsx("div", { className: "mt-4 flex w-full items-center rounded-md border border-gray-200 bg-white p-3", children: jsxs("div", { className: "flex w-full items-center", children: [jsx("div", { className: "mr-3 flex-shrink-0 rounded-md bg-blue-100 p-2", children: jsxs("svg", { width: "20", height: "20", viewBox: "0 0 24 24", fill: "none", xmlns: "http://www.w3.org/2000/svg", children: [jsx("path", { d: "M14 2H6C4.9 2 4 2.9 4 4V20C4 21.1 4.9 22 6 22H18C19.1 22 20 21.1 20 20V8L14 2Z", fill: "#4285F4" }), jsx("path", { d: "M14 2V8H20L14 2Z", fill: "#A1C2FA" })] }) }), jsxs("div", { className: "isolate z-50 min-w-0 flex-1 overflow-hidden", children: [jsx("p", { className: "truncate text-sm font-medium", children: file.name }), jsxs("p", { className: "text-xs text-gray-500", children: [convertFromBytes(file.size).value, " ", convertFromBytes(file.size).unit] })] }), jsx("button", { onClick: () => {
+                                                    setFile(null);
+                                                    setDescription('');
+                                                    if (fileInputRef.current) {
+                                                        fileInputRef.current.value = '';
+                                                    }
+                                                }, className: "ml-2 flex-shrink-0 rounded-full p-1 transition-colors hover:bg-gray-100", children: jsx(X$1, { className: "h-4 w-4 text-gray-500" }) })] }) }), isImageFile(file) && (jsxs("div", { className: "mt-3 grid w-full gap-2", children: [jsx(Label$2, { htmlFor: "image-description", children: t('resourceModalLocalFileUploadModal.descriptionOptional') }), jsx(Textarea, { id: "image-description", value: description, onChange: (e) => setDescription(e.target.value), placeholder: t('resourceModalLocalFileUploadModal.descriptionPlaceholder'), className: "resize-none", rows: 3 })] }))] }))] }) }), jsx(ResourceDialogFooter, { children: jsx(Button$1, { onClick: handleSubmit, disabled: !file || isDisabled, className: RESOURCE_SUBMIT_BUTTON_CLASS, children: isAddTrainingDocumentLoading ? (jsxs(Fragment$1, { children: [jsx(LoaderCircle, { className: "h-4 w-4 animate-spin" }), ' ', t('resourceModalLocalFileUploadModal.submitting')] })) : (jsx(Fragment$1, { children: t('resourceModalLocalFileUploadModal.submit') })) }) })] }));
 }
 
 function UrlUploadModal({ resource }) {
@@ -245209,9 +246983,7 @@ function UrlUploadModal({ resource }) {
             handleSubmitUrl();
         }
     };
-    return (jsxs("div", { className: "flex flex-col space-y-4", children: [jsx(Input, { type: "url", placeholder: t('resourceModalUrlUploadModal.urlPlaceholder'), value: url, onChange: handleUrlChange, autoComplete: "url" }), jsx("div", { className: "flex justify-end", children: jsx(Button$1, { onClick: handleSubmit, disabled: !url || isDisabled, className: cn('cursor-pointer hover:opacity-90', url
-                        ? 'bg-gradient-to-r from-blue-600 to-blue-400 text-white'
-                        : 'bg-gray-100 text-gray-500'), children: t('resourceModalUrlUploadModal.submit') }) })] }));
+    return (jsxs(Fragment$1, { children: [jsx(ResourceDialogBody, { label: t('resourceModalUrlUploadModal.scrollRegionAriaLabel'), children: jsxs("div", { className: "grid gap-2", children: [jsx(Label$2, { htmlFor: "resource-url", children: t('resourceModalUrlUploadModal.urlLabel') }), jsx(Input, { id: "resource-url", type: "url", placeholder: t('resourceModalUrlUploadModal.urlPlaceholder'), value: url, onChange: handleUrlChange, autoComplete: "url" })] }) }), jsx(ResourceDialogFooter, { children: jsx(Button$1, { onClick: handleSubmit, disabled: !url || isDisabled, className: RESOURCE_SUBMIT_BUTTON_CLASS, children: t('resourceModalUrlUploadModal.submit') }) })] }));
 }
 
 function useWebsiteCrawlerResource(resource) {
@@ -245236,9 +247008,11 @@ function useWebsiteCrawlerResource(resource) {
             crawler_match_patterns: [],
             crawler_pattern_type: 'glob',
             temp_crawler_match_patterns: '',
+            crawler_user_agent: '',
         },
         onSubmit: async ({ value }) => {
             try {
+                const crawlerUserAgent = value.crawler_user_agent.trim();
                 await addTrainingDocument({
                     org: tenantKey,
                     formData: {
@@ -245250,6 +247024,11 @@ function useWebsiteCrawlerResource(resource) {
                         crawler_match_patterns: crawlerMatchPatterns,
                         //@ts-expect-error crawler_pattern_type may not be on the typed args but is accepted by the API
                         crawler_pattern_type: value.crawler_pattern_type,
+                        // Per-document User-Agent override; sent only when set so the
+                        // backend default applies otherwise.
+                        ...(crawlerUserAgent
+                            ? { crawler_extra_headers: { 'User-Agent': crawlerUserAgent } }
+                            : {}),
                     },
                     userId: username !== null && username !== void 0 ? username : '',
                 }).unwrap();
@@ -245276,30 +247055,30 @@ function useWebsiteCrawlerResource(resource) {
 function WebsiteCrawlModal({ resource }) {
     const t = useT();
     const { form, handleCheckUrlIsValid, crawlerMatchPatterns, setCrawlerMatchPatterns } = useWebsiteCrawlerResource(resource);
-    return (jsxs(Card$1, { className: "mx-auto w-full max-w-2xl", role: "dialog", "aria-labelledby": "crawler-title", "aria-describedby": "crawler-description", children: [jsxs(CardHeader, { children: [jsx(CardTitle, { id: "crawler-title", className: "text-md font-semibold text-gray-600", children: t('resourceModalWebsiteCrawlModal.title') }), jsx("p", { id: "crawler-description", className: "text-muted-foreground text-sm", children: t('resourceModalWebsiteCrawlModal.description') })] }), jsx(CardContent, { children: jsx("form", { className: "space-y-4", onSubmit: (e) => {
-                        e.preventDefault();
-                        e.stopPropagation();
-                        form.handleSubmit();
-                    }, "aria-label": t('resourceModalWebsiteCrawlModal.formAriaLabel'), children: jsxs(Fragment$1, { children: [jsx(form.Field, { name: "url", validators: {
+    return (jsxs("form", { className: "flex min-h-0 flex-1 flex-col", onSubmit: (e) => {
+            e.preventDefault();
+            e.stopPropagation();
+            form.handleSubmit();
+        }, "aria-label": t('resourceModalWebsiteCrawlModal.formAriaLabel'), children: [jsxs(ResourceDialogBody, { label: t('resourceModalWebsiteCrawlModal.scrollRegionAriaLabel'), children: [jsx("div", { className: "rounded-md border border-gray-200 bg-gray-50 p-3 text-xs text-gray-600", children: t('resourceModalWebsiteCrawlModal.infoBox') }), jsxs(Fragment$1, { children: [jsx(form.Field, { name: "url", validators: {
                                     onChange: ({ value }) => (!value && t('resourceModalWebsiteCrawlModal.urlRequired')) ||
                                         (!handleCheckUrlIsValid(value) && t('resourceModalWebsiteCrawlModal.invalidUrl')),
                                 }, children: (field) => {
                                     var _a, _b, _c;
-                                    return (jsxs("div", { className: "grid gap-2", children: [jsx(Label$2, { htmlFor: field.name, children: t('resourceModalWebsiteCrawlModal.urlLabel') }), jsx(Input, { id: field.name, type: "url", value: field.state.value, onChange: (e) => field.handleChange(e.target.value), placeholder: t('resourceModalWebsiteCrawlModal.urlPlaceholder'), "aria-describedby": ((_a = field.state.meta.errors) === null || _a === void 0 ? void 0 : _a.length) ? `${field.name}-error` : undefined, "aria-invalid": !!((_b = field.state.meta.errors) === null || _b === void 0 ? void 0 : _b.length), "aria-required": "true" }), ((_c = field.state.meta.errors) === null || _c === void 0 ? void 0 : _c.length) ? (jsx("p", { id: `${field.name}-error`, className: "text-destructive mb-2 text-sm", role: "alert", children: field.state.meta.errors })) : null] }));
+                                    return (jsxs("div", { className: "grid gap-2", children: [jsx(Label$2, { htmlFor: field.name, children: t('resourceModalWebsiteCrawlModal.urlLabel') }), jsx(Input, { id: field.name, type: "url", value: field.state.value, onChange: (e) => field.handleChange(e.target.value), placeholder: t('resourceModalWebsiteCrawlModal.urlPlaceholder'), "aria-describedby": ((_a = field.state.meta.errors) === null || _a === void 0 ? void 0 : _a.length) ? `${field.name}-error` : undefined, "aria-invalid": !!((_b = field.state.meta.errors) === null || _b === void 0 ? void 0 : _b.length), "aria-required": "true" }), ((_c = field.state.meta.errors) === null || _c === void 0 ? void 0 : _c.length) ? (jsx("p", { id: `${field.name}-error`, className: "text-destructive -mt-1 text-xs", role: "alert", children: field.state.meta.errors })) : null] }));
                                 } }), jsxs("div", { className: "grid grid-cols-2 gap-4", children: [jsx(form.Field, { name: "crawler_max_depth", validators: {
                                             onChange: ({ value }) => (!value && t('resourceModalWebsiteCrawlModal.fieldRequired')) ||
                                                 (value < 1 && t('resourceModalWebsiteCrawlModal.mustBeGreaterThanZero')) ||
                                                 (value > 10000 && t('resourceModalWebsiteCrawlModal.mustBeLessThan10000')),
                                         }, children: (field) => {
                                             var _a, _b, _c;
-                                            return (jsxs("div", { className: "grid gap-2", children: [jsx(Label$2, { htmlFor: field.name, children: t('resourceModalWebsiteCrawlModal.maxCrawlDepthLabel') }), jsx(Input, { id: field.name, type: "number", min: "1", max: "10000", value: field.state.value, onChange: (e) => field.handleChange(Number.parseInt(e.target.value)), "aria-describedby": ((_a = field.state.meta.errors) === null || _a === void 0 ? void 0 : _a.length) ? `${field.name}-error` : undefined, "aria-invalid": !!((_b = field.state.meta.errors) === null || _b === void 0 ? void 0 : _b.length), "aria-required": "true" }), ((_c = field.state.meta.errors) === null || _c === void 0 ? void 0 : _c.length) ? (jsx("p", { id: `${field.name}-error`, className: "text-destructive mb-2 text-sm", role: "alert", children: field.state.meta.errors })) : null] }));
+                                            return (jsxs("div", { className: "grid gap-2", children: [jsx(Label$2, { htmlFor: field.name, children: t('resourceModalWebsiteCrawlModal.maxCrawlDepthLabel') }), jsx(Input, { id: field.name, type: "number", min: "1", max: "10000", value: field.state.value, onChange: (e) => field.handleChange(Number.parseInt(e.target.value)), "aria-describedby": ((_a = field.state.meta.errors) === null || _a === void 0 ? void 0 : _a.length) ? `${field.name}-error` : undefined, "aria-invalid": !!((_b = field.state.meta.errors) === null || _b === void 0 ? void 0 : _b.length), "aria-required": "true" }), ((_c = field.state.meta.errors) === null || _c === void 0 ? void 0 : _c.length) ? (jsx("p", { id: `${field.name}-error`, className: "text-destructive -mt-1 text-xs", role: "alert", children: field.state.meta.errors })) : null] }));
                                         } }), jsx(form.Field, { name: "crawler_max_pages_limit", validators: {
                                             onChange: ({ value }) => (!value && t('resourceModalWebsiteCrawlModal.fieldRequired')) ||
                                                 (value < 1 && t('resourceModalWebsiteCrawlModal.mustBeGreaterThanZero')),
                                         }, children: (field) => {
                                             var _a, _b, _c;
-                                            return (jsxs("div", { className: "grid gap-2", children: [jsx(Label$2, { htmlFor: field.name, children: t('resourceModalWebsiteCrawlModal.maxPagesLimitLabel') }), jsx(Input, { id: field.name, type: "number", min: "1", value: field.state.value, onChange: (e) => field.handleChange(Number.parseInt(e.target.value)), "aria-describedby": ((_a = field.state.meta.errors) === null || _a === void 0 ? void 0 : _a.length) ? `${field.name}-error` : undefined, "aria-invalid": !!((_b = field.state.meta.errors) === null || _b === void 0 ? void 0 : _b.length), "aria-required": "true" }), ((_c = field.state.meta.errors) === null || _c === void 0 ? void 0 : _c.length) ? (jsx("p", { id: `${field.name}-error`, className: "text-destructive mb-2 text-sm", role: "alert", children: field.state.meta.errors })) : null] }));
-                                        } })] }), jsx(form.Field, { name: "crawler_pattern_type", children: (field) => (jsxs("div", { className: "grid gap-2", children: [jsx(Label$2, { htmlFor: "pattern-type", children: t('resourceModalWebsiteCrawlModal.patternTypeLabel') }), jsxs(Select$1, { value: field.state.value, onValueChange: (value) => field.handleChange(value), children: [jsx(SelectTrigger, { id: "pattern-type", "aria-label": t('resourceModalWebsiteCrawlModal.selectPatternTypeAriaLabel'), children: jsx(SelectValue, {}) }), jsxs(SelectContent, { children: [jsx(SelectItem, { value: "glob", children: t('resourceModalWebsiteCrawlModal.globPattern') }), jsx(SelectItem, { value: "regex", children: t('resourceModalWebsiteCrawlModal.regularExpression') })] })] })] })) }), jsx(form.Subscribe, { selector: (state) => [
+                                            return (jsxs("div", { className: "grid gap-2", children: [jsx(Label$2, { htmlFor: field.name, children: t('resourceModalWebsiteCrawlModal.maxPagesLimitLabel') }), jsx(Input, { id: field.name, type: "number", min: "1", value: field.state.value, onChange: (e) => field.handleChange(Number.parseInt(e.target.value)), "aria-describedby": ((_a = field.state.meta.errors) === null || _a === void 0 ? void 0 : _a.length) ? `${field.name}-error` : undefined, "aria-invalid": !!((_b = field.state.meta.errors) === null || _b === void 0 ? void 0 : _b.length), "aria-required": "true" }), ((_c = field.state.meta.errors) === null || _c === void 0 ? void 0 : _c.length) ? (jsx("p", { id: `${field.name}-error`, className: "text-destructive -mt-1 text-xs", role: "alert", children: field.state.meta.errors })) : null] }));
+                                        } })] }), jsx(form.Field, { name: "crawler_pattern_type", children: (field) => (jsxs("div", { className: "grid gap-2", children: [jsx(Label$2, { htmlFor: "pattern-type", children: t('resourceModalWebsiteCrawlModal.patternTypeLabel') }), jsxs(Select$1, { value: field.state.value, onValueChange: (value) => field.handleChange(value), children: [jsx(SelectTrigger, { id: "pattern-type", "aria-label": t('resourceModalWebsiteCrawlModal.selectPatternTypeAriaLabel'), children: jsx(SelectValue, {}) }), jsxs(SelectContent, { children: [jsx(SelectItem, { value: "glob", children: t('resourceModalWebsiteCrawlModal.globPattern') }), jsx(SelectItem, { value: "regex", children: t('resourceModalWebsiteCrawlModal.regularExpression') })] })] })] })) }), jsx(form.Field, { name: "crawler_user_agent", children: (field) => (jsxs("div", { className: "grid gap-2", children: [jsx(Label$2, { htmlFor: field.name, children: t('resourceModalWebsiteCrawlModal.userAgentLabel') }), jsx(Input, { id: field.name, type: "text", value: field.state.value, onChange: (e) => field.handleChange(e.target.value), placeholder: t('resourceModalWebsiteCrawlModal.userAgentPlaceholder'), "aria-describedby": "user-agent-help" }), jsx("p", { id: "user-agent-help", className: "text-muted-foreground -mt-1 text-xs", children: t('resourceModalWebsiteCrawlModal.userAgentHelpText') })] })) }), jsx(form.Subscribe, { selector: (state) => [
                                     state.values.temp_crawler_match_patterns,
                                     state.values.crawler_pattern_type,
                                 ], children: ([tempCrawlerMatchPatterns, crawlerPatternType]) => (jsx(form.Field, { name: "temp_crawler_match_patterns", validators: {
@@ -245330,14 +247109,24 @@ function WebsiteCrawlModal({ resource }) {
                                                                             ]);
                                                                             field.handleChange('');
                                                                         }
-                                                                    }, disabled: !String(tempCrawlerMatchPatterns).trim(), size: "sm", "aria-label": t('resourceModalWebsiteCrawlModal.addPatternAriaLabel'), children: jsx(Plus, { className: "h-4 w-4" }) })] }), ((_c = field.state.meta.errors) === null || _c === void 0 ? void 0 : _c.length) ? (jsx("p", { id: "pattern-error", className: "text-destructive mb-2 text-sm", role: "alert", children: field.state.meta.errors })) : null, jsx("p", { id: "pattern-help", className: "text-muted-foreground text-sm", children: t('resourceModalWebsiteCrawlModal.patternHelpText') }), jsx("div", { className: "bg-muted/50 flex min-h-[2rem] flex-wrap gap-2 rounded-md border p-2", role: "list", "aria-label": t('resourceModalWebsiteCrawlModal.addedPatternsAriaLabel'), children: crawlerMatchPatterns.length === 0 ? (jsx("span", { className: "text-muted-foreground text-sm", children: t('resourceModalWebsiteCrawlModal.noPatternsAdded') })) : (crawlerMatchPatterns.map((pattern, index) => (jsxs(Badge, { variant: "secondary", className: "flex items-center gap-1", children: [jsx("span", { className: "text-xs", children: pattern }), jsx("button", { type: "button", onClick: () => setCrawlerMatchPatterns(crawlerMatchPatterns.filter((p) => p !== pattern)), className: "hover:bg-destructive/20 ml-1 rounded-full p-0.5", "aria-label": t('resourceModalWebsiteCrawlModal.removePatternAriaLabel', { pattern }), children: jsx(X$1, { className: "h-3 w-3" }) })] }, index)))) })] })] }));
-                                    } })) }), jsx(form.Subscribe, { selector: (state) => [state.isSubmitting], children: ([isSubmitting]) => (jsxs("div", { className: "flex gap-3 pt-4", children: [jsx(Button$1, { type: "submit", className: "w-full bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-sm text-white hover:text-white hover:opacity-90", disabled: isSubmitting, "aria-describedby": isSubmitting ? 'submitting-status' : undefined, children: isSubmitting
-                                                ? t('resourceModalWebsiteCrawlModal.submitting')
-                                                : t('resourceModalWebsiteCrawlModal.submit') }), isSubmitting && (jsx("div", { id: "submitting-status", className: "sr-only", role: "status", "aria-live": "polite", children: t('resourceModalWebsiteCrawlModal.formBeingSubmitted') }))] })) })] }) }) })] }));
-}
-
-function ResourceModal({ resource, isOpen, onClose }) {
-    return (jsx(Dialog, { open: isOpen, onOpenChange: onClose, children: jsxs(DialogContent, { className: "w-full max-w-md", children: [jsx(DialogHeader, { children: jsx(DialogTitle, { className: "text-muted-foreground text-base", children: resource.name }) }), resource.type === 'github' && jsx(GithubFileUploadModal, {}), resource.type === 'local' && jsx(LocalFileUploadModal, { resource: resource }), resource.type === 'webcrawler' && jsx(WebsiteCrawlModal, { resource: resource }), resource.type === 'url' && jsx(UrlUploadModal, { resource: resource })] }) }));
+                                                                    }, disabled: !String(tempCrawlerMatchPatterns).trim(), size: "sm", "aria-label": t('resourceModalWebsiteCrawlModal.addPatternAriaLabel'), children: jsx(Plus, { className: "h-4 w-4" }) })] }), ((_c = field.state.meta.errors) === null || _c === void 0 ? void 0 : _c.length) ? (jsx("p", { id: "pattern-error", className: "text-destructive -mt-1 text-xs", role: "alert", children: field.state.meta.errors })) : null, jsx("p", { id: "pattern-help", className: "text-muted-foreground -mt-1 text-xs", children: t('resourceModalWebsiteCrawlModal.patternHelpText') }), jsx("div", { className: "bg-muted/50 flex min-h-[2rem] flex-wrap gap-2 rounded-md border p-2", role: "list", "aria-label": t('resourceModalWebsiteCrawlModal.addedPatternsAriaLabel'), children: crawlerMatchPatterns.length === 0 ? (jsx("span", { className: "text-muted-foreground text-xs", children: t('resourceModalWebsiteCrawlModal.noPatternsAdded') })) : (crawlerMatchPatterns.map((pattern, index) => (jsxs(Badge, { variant: "secondary", className: "flex items-center gap-1", children: [jsx("span", { className: "text-xs", children: pattern }), jsx("button", { type: "button", onClick: () => setCrawlerMatchPatterns(crawlerMatchPatterns.filter((p) => p !== pattern)), className: "hover:bg-destructive/20 ml-1 rounded-full p-0.5", "aria-label": t('resourceModalWebsiteCrawlModal.removePatternAriaLabel', { pattern }), children: jsx(X$1, { className: "h-3 w-3" }) })] }, index)))) })] })] }));
+                                    } })) })] })] }), jsx(form.Subscribe, { selector: (state) => [state.isSubmitting], children: ([isSubmitting]) => (jsxs(ResourceDialogFooter, { children: [jsx(Button$1, { type: "submit", className: RESOURCE_SUBMIT_BUTTON_CLASS, disabled: isSubmitting, "aria-describedby": isSubmitting ? 'submitting-status' : undefined, children: isSubmitting
+                                ? t('resourceModalWebsiteCrawlModal.submitting')
+                                : t('resourceModalWebsiteCrawlModal.submit') }), isSubmitting && (jsx("div", { id: "submitting-status", className: "sr-only", role: "status", "aria-live": "polite", children: t('resourceModalWebsiteCrawlModal.formBeingSubmitted') }))] })) })] }));
+}
+
+// `link` types open a cloud picker instead of this dialog; it maps to the
+// generic Add Resources copy only to keep the record total.
+const DESCRIPTION_KEYS = {
+    github: 'resourceModalGithubFileUploadModal.description',
+    local: 'resourceModalLocalFileUploadModal.description',
+    url: 'resourceModalUrlUploadModal.description',
+    webcrawler: 'resourceModalWebsiteCrawlModal.description',
+    link: 'datasetsTabAddResourceModal.description',
+};
+function ResourceModal({ resource, isOpen, onClose, maxFileSizeMB }) {
+    const t = useT();
+    return (jsx(Dialog, { open: isOpen, onOpenChange: onClose, children: jsxs(ResourceDialogContent, { title: resource.name, description: t(DESCRIPTION_KEYS[resource.type]), children: [resource.type === 'github' && jsx(GithubFileUploadModal, {}), resource.type === 'local' && (jsx(LocalFileUploadModal, { resource: resource, maxFileSizeMB: maxFileSizeMB })), resource.type === 'webcrawler' && jsx(WebsiteCrawlModal, { resource: resource }), resource.type === 'url' && jsx(UrlUploadModal, { resource: resource })] }) }));
 }
 
 var bundle = {exports: {}};
@@ -245350,6 +247139,8 @@ var bundle = {exports: {}};
 var bundleExports = bundle.exports;
 var GoogleDrivePicker = /*@__PURE__*/getDefaultExportFromCjs(bundleExports);
 
+/** Least-privilege scope: only files the user picks/creates via the picker. */
+const GOOGLE_DRIVE_SCOPES = ['https://www.googleapis.com/auth/drive.file'];
 const useGoogleDrivePicker = ({ tenantKey, mentorId }) => {
     const [authToken, setAuthToken] = React__default.useState(null);
     const [driveFiles, setDriveFiles] = React__default.useState([]);
@@ -245424,10 +247215,7 @@ const useGoogleDrivePicker = ({ tenantKey, mentorId }) => {
                         refresh_token: 'test-refresh token',
                         client_id: credentials.client_id,
                         token: authToken === null || authToken === void 0 ? void 0 : authToken.access_token,
-                        scopes: [
-                            'https://www.googleapis.com/auth/drive.metadata.readonly',
-                            'https://www.googleapis.com/auth/drive.readonly',
-                        ],
+                        scopes: GOOGLE_DRIVE_SCOPES,
                         token_type: authToken === null || authToken === void 0 ? void 0 : authToken.token_type,
                         expiry_date: new Date(Date.now() + ((authToken === null || authToken === void 0 ? void 0 : authToken.expires_in) || 0) * 1000).toISOString(),
                     },
@@ -245521,10 +247309,7 @@ const useGoogleDrivePicker = ({ tenantKey, mentorId }) => {
                 openPicker({
                     clientId: credentials.client_id,
                     developerKey: credentials.developer_key,
-                    customScopes: [
-                        'https://www.googleapis.com/auth/drive.metadata.readonly',
-                        'https://www.googleapis.com/auth/drive.readonly',
-                    ],
+                    customScopes: GOOGLE_DRIVE_SCOPES,
                     // @ts-expect-error - token accepts null to force fresh auth per google-drive-picker API
                     token: null, // Always start with null token to force fresh auth
                     showUploadView: true,
@@ -245612,6 +247397,8 @@ const useGoogleDrivePicker = ({ tenantKey, mentorId }) => {
         forceClosePickerModal,
         pickerError,
         resetPickerState,
+        credentialsLoaded: credentialLoaded,
+        isConfigured: Boolean(credentials.client_id),
     };
 };
 
@@ -245682,6 +247469,7 @@ function ieOnEnd (script, cb) {
 
 var loadScript = /*@__PURE__*/getDefaultExportFromCjs(loadScript$1);
 
+/** Default file types offered by the Dropbox chooser. Hosts override via `extensions`. */
 const DROPBOX_EXTENSIONS = [
     '.pdf',
     '.doc',
@@ -245693,6 +247481,12 @@ const DROPBOX_EXTENSIONS = [
     '.xlsx',
     '.ppt',
     '.pptx',
+    '.png',
+    '.jpeg',
+    '.jpg',
+    '.mp3',
+    '.wav',
+    '.m4a',
 ];
 const DROPBOX_SDK_URL = 'https://www.dropbox.com/static/api/2/dropins.js';
 const SCRIPT_ID = 'dropboxjs';
@@ -245701,6 +247495,7 @@ const useDropboxPicker = ({ tenantKey, mentorId, cancel = () => { }, linkType =
     const [dropboxReady, setDropboxReady] = useState(false);
     const [openChooser, setOpenChooser] = useState(false);
     const [appKey, setAppKey] = useState(null);
+    const [credentialsLoaded, setCredentialsLoaded] = useState(false);
     // Use RTK Query hooks
     const [getCredentials] = useLazyGetCredentialsQuery();
     const [addTrainingDocument] = useAddTrainingDocumentMutation();
@@ -245723,6 +247518,7 @@ const useDropboxPicker = ({ tenantKey, mentorId, cancel = () => { }, linkType =
                 catch (error) {
                     console.error(JSON.stringify({ tenant: tenantKey, error }));
                 }
+                setCredentialsLoaded(true);
             }
         };
         handleFetchAppKey();
@@ -245820,6 +247616,8 @@ const useDropboxPicker = ({ tenantKey, mentorId, cancel = () => { }, linkType =
         openChooser: onChoose,
         dropboxReady,
         appKey,
+        credentialsLoaded,
+        isConfigured: Boolean(appKey),
     };
 };
 
@@ -245829,6 +247627,7 @@ const useOneDrivePicker = ({ tenantKey, mentorId }) => {
     const [onedriveAppId, setOnedriveAppId] = useState(null);
     const [fullDomain, setFullDomain] = useState(null);
     const [isSDKLoaded, setIsSDKLoaded] = useState(false);
+    const [credentialsLoaded, setCredentialsLoaded] = useState(false);
     // Use RTK Query hooks
     const [getCredentials] = useLazyGetCredentialsQuery();
     const [addTrainingDocument] = useAddTrainingDocumentMutation();
@@ -245943,6 +247742,7 @@ const useOneDrivePicker = ({ tenantKey, mentorId }) => {
                 catch (error) {
                     console.error(JSON.stringify({ tenant: tenantKey, error }));
                 }
+                setCredentialsLoaded(true);
             }
         };
         handleFetchAppId();
@@ -246035,46 +247835,81 @@ const useOneDrivePicker = ({ tenantKey, mentorId }) => {
         pickOneDriveFile,
         onedriveAppId,
         isSDKLoaded,
+        credentialsLoaded,
+        isConfigured: Boolean(onedriveAppId),
     };
 };
 
-function AddResourceModal({ isOpen, onClose, disabledDatasets = [], }) {
+function AddResourceModal({ isOpen, onClose, disabledDatasets = [], maxFileSizeMB, dropboxExtensions, }) {
     const t = useT();
     const { tenantKey, mentorId } = useAgentSettings();
     const [selectedResource, setSelectedResource] = React__default.useState(null);
-    const { openChooser } = useDropboxPicker({
+    const dropbox = useDropboxPicker({
         autoShow: false,
         tenantKey,
         mentorId,
-    });
-    const { handlePickerOpen, loadGoogleApiScript, isPickerLoaded, forceClosePickerModal, pickerError, } = useGoogleDrivePicker({ tenantKey, mentorId });
-    const { pickOneDriveFile } = useOneDrivePicker({ tenantKey, mentorId });
-    return (jsxs(Fragment$1, { children: [jsx(Script, { src: "https://apis.google.com/js/api.js", onLoad: loadGoogleApiScript, strategy: "lazyOnload" }), jsx(Dialog, { open: isOpen, onOpenChange: onClose, children: jsxs(DialogContent, { className: "max-h-[90vh] overflow-y-auto sm:max-w-[800px]", children: [jsx(DialogHeader, { className: "flex flex-row items-center justify-between", children: jsx(DialogTitle, { children: t('datasetsTabAddResourceModal.title') }) }), jsx("div", { className: "pt-4", children: jsxs("div", { children: [jsx("p", { className: "mb-6 text-gray-600", children: t('datasetsTabAddResourceModal.description') }), pickerError && (jsx("div", { className: "mb-4 rounded-lg border border-red-200 bg-red-50 p-4", children: jsxs("div", { className: "flex items-center justify-between", children: [jsxs("div", { children: [jsx("h4", { className: "text-sm font-medium text-red-800", children: t('datasetsTabAddResourceModal.googleDrivePickerError') }), jsx("p", { className: "mt-1 text-sm text-red-600", children: pickerError })] }), jsx("button", { onClick: forceClosePickerModal, className: "ml-4 rounded bg-red-100 px-3 py-1 text-sm font-medium text-red-800 hover:bg-red-200", children: t('datasetsTabAddResourceModal.forceClosePicker') })] }) })), jsx("div", { className: "grid grid-cols-1 gap-4 md:grid-cols-2", children: resourceTypes.map((resource) => (jsxs("button", { className: cn('flex items-center rounded-lg border p-4 transition-colors duration-200 hover:bg-gray-50', resource.isActive && !disabledDatasets.includes(resource.id.toLowerCase())
-                                                ? 'cursor-pointer'
-                                                : 'cursor-not-allowed opacity-50'), onClick: () => {
-                                                if (resource.type !== 'link') {
-                                                    setSelectedResource(resource);
-                                                    return;
-                                                }
-                                                if (resource.name === 'Google Drive') {
-                                                    if (isPickerLoaded) {
-                                                        handlePickerOpen();
-                                                    }
-                                                    else {
-                                                        // Show loading state or toast
-                                                        console.log('Google Picker is still loading...');
-                                                    }
-                                                    return;
-                                                }
-                                                if (resource.name === 'Dropbox') {
-                                                    openChooser();
-                                                    return;
+        extensions: dropboxExtensions,
+    });
+    const { handlePickerOpen, loadGoogleApiScript, isPickerLoaded, forceClosePickerModal, pickerError, credentialsLoaded: googleCredentialsLoaded, isConfigured: googleIsConfigured, } = useGoogleDrivePicker({ tenantKey, mentorId });
+    const oneDrive = useOneDrivePicker({ tenantKey, mentorId });
+    // A cloud provider only works once the tenant has OAuth credentials for it
+    // (GET .../integration-credential/?name=<provider>). Without them the SDK is
+    // handed an empty client id and the click does nothing at all — no popup, no
+    // error — which reads as a broken button. Disable and say why instead.
+    // `loaded` gates on the lookup having finished so the buttons are not
+    // disabled during the in-flight fetch.
+    const cloudProviders = {
+        'google-drive': {
+            loaded: googleCredentialsLoaded,
+            configured: googleIsConfigured,
+        },
+        onedrive: {
+            loaded: oneDrive.credentialsLoaded,
+            configured: oneDrive.isConfigured,
+        },
+        dropbox: {
+            loaded: dropbox.credentialsLoaded,
+            configured: dropbox.isConfigured,
+        },
+    };
+    return (jsxs(Fragment$1, { children: [jsx(Script, { src: "https://apis.google.com/js/api.js", onLoad: loadGoogleApiScript, strategy: "lazyOnload" }), jsx(Dialog, { open: isOpen, onOpenChange: onClose, children: jsx(ResourceDialogContent, { title: t('datasetsTabAddResourceModal.title'), description: t('datasetsTabAddResourceModal.description'), className: "sm:max-w-[800px]", children: jsxs(ResourceDialogBody, { label: t('datasetsTabAddResourceModal.scrollRegionAriaLabel'), children: [pickerError && (jsx("div", { className: "rounded-lg border border-red-200 bg-red-50 p-4", children: jsxs("div", { className: "flex items-center justify-between", children: [jsxs("div", { children: [jsx("h4", { className: "text-sm font-medium text-red-800", children: t('datasetsTabAddResourceModal.googleDrivePickerError') }), jsx("p", { className: "mt-1 text-sm text-red-600", children: pickerError })] }), jsx("button", { onClick: forceClosePickerModal, className: "ml-4 rounded bg-red-100 px-3 py-1 text-sm font-medium text-red-800 hover:bg-red-200", children: t('datasetsTabAddResourceModal.forceClosePicker') })] }) })), jsx("div", { className: "grid grid-cols-1 gap-4 md:grid-cols-2", children: resourceTypes.map((resource) => {
+                                    const cloudProvider = cloudProviders[resource.id];
+                                    const notConfigured = cloudProvider
+                                        ? cloudProvider.loaded && !cloudProvider.configured
+                                        : false;
+                                    const isDisabled = !resource.isActive ||
+                                        disabledDatasets.includes(resource.id.toLowerCase()) ||
+                                        notConfigured;
+                                    return (jsxs("button", { title: notConfigured ? t('datasetsTabAddResourceModal.notConfigured') : undefined, className: cn('flex items-center rounded-lg border p-4 transition-colors duration-200 hover:bg-gray-50', !isDisabled ? 'cursor-pointer' : 'cursor-not-allowed opacity-50'), onClick: () => {
+                                            if (resource.type !== 'link') {
+                                                setSelectedResource(resource);
+                                                return;
+                                            }
+                                            if (resource.name === 'Google Drive') {
+                                                if (isPickerLoaded) {
+                                                    handlePickerOpen();
                                                 }
-                                                if (resource.name === 'Microsoft OneDrive') {
-                                                    pickOneDriveFile();
-                                                    return;
+                                                else {
+                                                    // Show loading state or toast
+                                                    console.log('Google Picker is still loading...');
                                                 }
-                                            }, disabled: !resource.isActive || disabledDatasets.includes(resource.id.toLowerCase()), children: [jsx("div", { className: "mr-3 flex h-10 w-10 items-center justify-center rounded-md bg-blue-100", children: resource.icon }), jsx("span", { className: "text-gray-700", children: resource.name })] }, resource.id))) })] }) })] }) }), selectedResource && (jsx(ResourceModal, { resource: selectedResource, isOpen: !!selectedResource, onClose: () => setSelectedResource(null) }))] }));
+                                                return;
+                                            }
+                                            if (resource.name === 'Dropbox') {
+                                                dropbox.openChooser();
+                                                return;
+                                            }
+                                            if (resource.name === 'Microsoft OneDrive') {
+                                                oneDrive.pickOneDriveFile();
+                                                return;
+                                            }
+                                        }, disabled: isDisabled, children: [jsx("div", { className: "mr-3 flex h-10 w-10 items-center justify-center rounded-md bg-blue-100", children: resource.icon }), jsxs("span", { className: "flex flex-col items-start text-left", children: [jsx("span", { className: "text-gray-700", children: resource.name }), notConfigured && (
+                                                    // aria-hidden: the same text is already the button's
+                                                    // `title`, so exposing it here too would append it to
+                                                    // the accessible name ("Dropbox Not configured for
+                                                    // this tenant") and break name-based lookups.
+                                                    jsx("span", { "aria-hidden": "true", className: "text-xs text-gray-500", children: t('datasetsTabAddResourceModal.notConfigured') }))] })] }, resource.id));
+                                }) })] }) }) }), selectedResource && (jsx(ResourceModal, { resource: selectedResource, isOpen: !!selectedResource, onClose: () => setSelectedResource(null), maxFileSizeMB: maxFileSizeMB }))] }));
 }
 
 // DatasetItemList requires a full labels object; without it the empty-state
@@ -246086,7 +247921,7 @@ const PROJECT_FILES_DATASET_LABELS = resolveDatasetsTabLabels({
 function ProjectFilesModal(props) {
     return (jsx(AgentSettingsProvider, { tenantKey: props.tenantKey, mentorId: props.mentorId, username: props.username, enableRBAC: false, children: jsx(ProjectFilesModalInner, { ...props }) }));
 }
-function ProjectFilesModalInner({ isOpen, onClose }) {
+function ProjectFilesModalInner({ isOpen, onClose, disabledResourceTypes, maxUploadSizeMb, dropboxExtensions, }) {
     var _a;
     const t = useT();
     const [showAddResourceModal, setShowAddResourceModal] = React__default.useState(false);
@@ -246101,7 +247936,7 @@ function ProjectFilesModalInner({ isOpen, onClose }) {
                                                     // @ts-expect-error - Type mismatch between RetrieverDocumentEmbedding[] and Dataset[], id property type difference
                                                     , { 
                                                         // @ts-expect-error - Type mismatch between RetrieverDocumentEmbedding[] and Dataset[], id property type difference
-                                                        datasets: (_a = datasets === null || datasets === void 0 ? void 0 : datasets.results) !== null && _a !== void 0 ? _a : [], labels: PROJECT_FILES_DATASET_LABELS })] })) }) }) }), jsx(IblPagination, { currentPage: currentPage, totalPages: totalPages, onPageChange: handlePageChange, disabled: isDatasetsFetching || isDatasetsLoading }), jsx(AddResourceModal, { isOpen: showAddResourceModal, onClose: () => closeAddResourceModal(), keepParentOpen: true }), isModalOpen && FreeTrialDialog && (jsx(FreeTrialDialog, { isOpen: isModalOpen, onClose: closeModal }))] }) })] }) }) }));
+                                                        datasets: (_a = datasets === null || datasets === void 0 ? void 0 : datasets.results) !== null && _a !== void 0 ? _a : [], labels: PROJECT_FILES_DATASET_LABELS })] })) }) }) }), jsx(IblPagination, { currentPage: currentPage, totalPages: totalPages, onPageChange: handlePageChange, disabled: isDatasetsFetching || isDatasetsLoading }), jsx(AddResourceModal, { isOpen: showAddResourceModal, onClose: () => closeAddResourceModal(), keepParentOpen: true, disabledDatasets: disabledResourceTypes, maxFileSizeMB: maxUploadSizeMb, dropboxExtensions: dropboxExtensions }), isModalOpen && FreeTrialDialog && (jsx(FreeTrialDialog, { isOpen: isModalOpen, onClose: closeModal }))] }) })] }) }) }));
 }
 
 var projectFilesModal = /*#__PURE__*/Object.freeze({
@@ -248735,5 +250570,5 @@ var trainOrDeleteModal = /*#__PURE__*/Object.freeze({
     TrainOrDeleteModal: TrainOrDeleteModal
 });
 
-export { ACCESS_COURSE_LABEL, ALL_CATEGORIES, AccessTimeHeatmap, AccessiblePaginate, AddMentorToProjectModal, AddSkillDialog, Admin, AdvancedTab, AgentConfigPrompts, AgentScopeLink, AgentSkills, AlertsTab, AnalyticsAgentPicker, AnalyticsAreaChart, AnalyticsAuditLogStats, AnalyticsBarChart, AnalyticsControlBar, AnalyticsCourseDetail, AnalyticsCourses, AnalyticsFinancialStats, AnalyticsGlobalFiltersProvider, AnalyticsLayout, AnalyticsLlmUsageStats, AnalyticsMemoryStats, AnalyticsMonetizationStats, AnalyticsNotice, AnalyticsOverview, AnalyticsPlatformAuditLog, AnalyticsProgramDetail, AnalyticsPrograms, AnalyticsReportDownload, AnalyticsReports, AnalyticsScopeProvider, AnalyticsSettingsProvider, AnalyticsTopicsStats, AnalyticsTraces, AnalyticsTranscriptsStats, AnalyticsUsersStats, AppleRestrictionModal, ApplyWizard, AuditLogChangesView, AuditLogJsonView, BUY_NOW_LABEL, BillingTab, CATALOGS, CHART_ORDINAL_RAMP, CHART_SERIES_COLORS, CHART_SINGLE_SERIES_COLOR, CREATE_AGENT_LABELS, CUA_DRIVER_REPO_URL, CUA_DRIVER_TAURI_COMMANDS, CUA_DRIVER_TAURI_EVENTS, CardInfoIcon, CategorizedDropdownMenu, ChartCardWrapper, ChartFiltersProvider, ChartLoading, ChartTooltipCard, ChatContext, ChatPrivacyToggle, ChatProvider, CompanyDialog, ConnectorManagementDialog, CopyButtonIcon, CourseAccessGuard, CourseCardSkeleton, CourseContentLoading, CourseOutline, CourseOutlineContext, CourseOutlineDrawer, CreateAgentForm, CreateAgentModal, CreateProjectModal, CreateWorkflowModal, CredentialBox, CredentialMiniBoxSkeleton, CredentialsList, CreditBalance, CustomDateRangePicker, CustomTooltip, DEFAULT_COWORK_REQUIRED_SIZE_GB, DEFAULT_LOCALE, DEFAULT_USER_IDENTITY_ORDER, DefaultEmptyBox, DeleteProjectModal, DeleteWorkflowModal, DiscoverContentCard, DiscoverFacetsFilter, DiscoverFilterDrawer, DocumentSidebar, DropdownMenu, DropdownMenuCheckboxItem, DropdownMenuContent, DropdownMenuGroup, DropdownMenuItem, DropdownMenuLabel, DropdownMenuPortal, DropdownMenuRadioGroup, DropdownMenuRadioItem, DropdownMenuSeparator, DropdownMenuShortcut, DropdownMenuSub, DropdownMenuSubContent, DropdownMenuSubTrigger, DropdownMenuTrigger, ENROLL_NOW_COURSE_STARTING_SOON_LABEL, ENROLL_NOW_LABEL, EditAlertDialog, EducationBox, EducationDialog, EducationTab, EdxIframeContext, EmptyStats, ExperienceBox, ExperienceDialog, ExperienceTab, FacetFilterContext, Footer, GradebookTab, GroupsFilterDropdown, INVITATION_ONLY_LABEL, InstitutionDialog, IntegrationsTab, InviteUserContent, InviteUserDialog, InvitedUsersDialog, LOCAL_LLM_CHANGED_EVENT, LOCAL_MODELS, LlmModelBadge, Loader, LocalLLMTab, LocalModelsContent, LoginButton, MACOS_PERMISSIONS_COMMANDS, MEMORY_PAGE_SIZE, Markdown, MemoryAdminTab, MinimumMentorAlert, MonetizationTab, NotificationDisplay, NotificationDropdown, ONBOARDING_FIELD_TYPES, ONBOARDING_SECTORS, OnboardingField, OnboardingShell, OnboardingWizard, PLATFORM_AUDIT_DEEP_PAGING_THRESHOLD, PLATFORM_AUDIT_PAGE_SIZE, PaywallModal, PlacementExam, PlacementExamsDropdown, PlatformAuditLogDetailSheet, PlatformNavbar, PlatformNavbarSearch, Profile, ProfileTimeChart, ProgressDots, ProjectActionButtons, ProjectFilesModal, ProjectInstructionsModal, ProjectLandingPage, ProjectMentorsList, ProjectsPage, REQUEST_ACCESS_COURSE_STARTING_SOON_LABEL, REQUEST_ACCESS_LABEL, RankedBars, RenameProjectModal, ResumeBox, ResumeTab, RetrievedDocumentsButton, RichTextEditor, SERVICE_COLOR_ORDER, SUPPORTED_LOCALES, SandboxConfig, SearchableMultiSelect, SendNotificationDialog, SignupButton, SkeletonActivityStatBox, SkeletonAddSkillsLoading, SkeletonCreatePathwaySearchList, SkeletonDiscoverFilterBox, SkeletonEducationBox, SkeletonMultiplier, SkeletonPathwayBox, SkeletonProfileInfoCard, SkeletonSkillBox, SkillBox, SkillDetailModal, SkillLeaderboardChart, SkillsBox, SkillsList, SlashSkillPicker, SourceChip, Spinner, StatCard, StepHeader, SummerNoteTextEditor, TAURI_COMMANDS, TAURI_EVENTS, TRACES_PAGE_SIZE, TenantSwitcher, TimeFilter, TimeTrackingProvider, TimedExam, ToolCallIndicator, ToolDialogs, TopBanner, TranscriptFileCards, TranscriptRollupBadges, TranscriptTurnDetails, TrendSparkline, USER_ONBOARDING_FORM_SLUG, USER_ONBOARDING_FORM_VERSION, USER_ONBOARDING_SUBMISSION_SLUG, UpgradePackageModal, UserAvatar, UserOnboardingWizard, UserProfileDialog, UserProfileLink, Version, WebContainersI18nProvider, WorkflowSidebar, addBookmarksTab, areChartFiltersEqual, availablePlacementExams, buildOnboardingAgentPath, buildUserOnboardingFormMetadata, buildUserOnboardingSubmissionMetadata, coerceOnboardingAgent, coerceOnboardingAgents, coerceUserOnboardingForm, colorForRank, colorForSeries, conversationDocuments, emptyUserOnboardingForm, findLastResumeBlock, findOnboardingAgent, findSequentialParent, flattenVerticalBlocks, formatAuditTimestamp, formatCompactNumber, formatFileSize, formatLatencySeconds, formatResult, formatTimeZoneLabel, getCatalog, getFirstAvailableUnit, getFriendlyToolName, getLLMModelDisplayName, getLocalLLMModel, getLocalLLMToolSupport, getNextUnitIframe, getOrg, getParentBlockById, getParentsInfosFromSublessonId, getPreviousUnitIframe, getQueryLabel, getRandomCourseImage, getSectorById, getTenant, getUnitToIframe, getUserId, getUserName, granularityForFilter, hasDistinctName, hasOnboardingContent, humanizeAuditToken, humanizeFieldName, inBrowserPrint, inIframe, inferProviderKeysFromModel, initialCuaDriverInstallState, initialModelDownloadState, isCoworkEnabled, isEmailLike, isFileReference, isLlmUsageForbidden, isLlmUsageUnavailable, isLocalLLMEnabled, isPlatformNavbarCreditBalanceVisible, isSlashCommandToken, isTauriApp, isValidLocale, isValidTimeZone, llmUsageDateArgs, components as markdownComponents, modelSupportsCowork, onboardingPrimaryButtonClass, onboardingSecondaryButtonClass, readUserOnboardingForm, readUserOnboardingSubmission, readUserOnboardingSubmissions, resolveAuditTimeZone, resolveCreateAgentLabels, resolveUserIdentity, sanitizeCss, setCoworkEnabled, setLocalLLMEnabled, setLocalLLMModel, setLocalLLMToolSupport, smallestCoworkModel, summarizeTranscriptTurns, toFileReference, toRetrievedDocuments, toToolCallInfos, useAnalyticsGlobalFilters, useAnalyticsScope, useAnalyticsSettings, useAuditLog, useCatalogSearch, useChartFilters, useChatPrivacy, useChatState, useCourseDetail, useCourseMetadata, useCourses, useCuaDriver, useDiscover, useEdxIframe, useFinancial, useIframeMessageHandler, useLlmDisplayName, useLlmProviderCatalogue, useLlmTraces, useLlmUsage, useLocalStorage, useMemory, useModelDownload, useMonetization, useOverview, usePlatformAuditLabels, usePlatformAuditLog, useProfileActivityStats, useProfileCredentials, useProfilePathways, useProfilePrograms, useProfileSkills, useProfileTimeSpent, usePrograms, useReports, useScopedMentorDbId, useScopedMentorId, useSelectedLocalModel, useSlashSkillPicker, useSlashSkills, useT, useTauri, useTimeTracking, useTopics, useTranscripts, useUserCourses, useUserMetadata, useUsers, useWebContainersI18n, useWebContainersLocale };
+export { ACCESS_COURSE_LABEL, ALL_CATEGORIES, AccessTimeHeatmap, AccessiblePaginate, AddMentorToProjectModal, AddSkillDialog, Admin, AdvancedTab, AgentConfigPrompts, AgentScopeLink, AgentSkills, AlertsTab, AnalyticsAgentPicker, AnalyticsAreaChart, AnalyticsAuditLogStats, AnalyticsBarChart, AnalyticsControlBar, AnalyticsCourseDetail, AnalyticsCourses, AnalyticsFinancialStats, AnalyticsGlobalFiltersProvider, AnalyticsLayout, AnalyticsLlmUsageStats, AnalyticsMemoryStats, AnalyticsMonetizationStats, AnalyticsNotice, AnalyticsOverview, AnalyticsPlatformAuditLog, AnalyticsProgramDetail, AnalyticsPrograms, AnalyticsReportDownload, AnalyticsReports, AnalyticsScopeProvider, AnalyticsSettingsProvider, AnalyticsTopicsStats, AnalyticsTraces, AnalyticsTranscriptsStats, AnalyticsUsersStats, AppleRestrictionModal, ApplyWizard, AuditLogChangesView, AuditLogJsonView, BUY_NOW_LABEL, BillingTab, CATALOGS, CHART_ORDINAL_RAMP, CHART_SERIES_COLORS, CHART_SINGLE_SERIES_COLOR, CREATE_AGENT_LABELS, CUA_DRIVER_REPO_URL, CUA_DRIVER_TAURI_COMMANDS, CUA_DRIVER_TAURI_EVENTS, CardInfoIcon, CategorizedDropdownMenu, ChartCardWrapper, ChartFiltersProvider, ChartLoading, ChartTooltipCard, ChatContext, ChatPrivacyToggle, ChatProvider, CompanyDialog, ConnectorManagementDialog, CopyButtonIcon, CourseAccessGuard, CourseCardSkeleton, CourseContentLoading, CourseOutline, CourseOutlineContext, CourseOutlineDrawer, CreateAgentForm, CreateAgentModal, CreateProjectModal, CreateWorkflowModal, CredentialBox, CredentialMiniBoxSkeleton, CredentialsList, CreditBalance, CustomDateRangePicker, CustomTooltip, DEFAULT_COWORK_REQUIRED_SIZE_GB, DEFAULT_LOCALE, DEFAULT_USER_IDENTITY_ORDER, DefaultEmptyBox, DeleteProjectModal, DeleteWorkflowModal, DiscoverContentCard, DiscoverFacetsFilter, DiscoverFilterDrawer, DocumentSidebar, DropdownMenu, DropdownMenuCheckboxItem, DropdownMenuContent, DropdownMenuGroup, DropdownMenuItem, DropdownMenuLabel, DropdownMenuPortal, DropdownMenuRadioGroup, DropdownMenuRadioItem, DropdownMenuSeparator, DropdownMenuShortcut, DropdownMenuSub, DropdownMenuSubContent, DropdownMenuSubTrigger, DropdownMenuTrigger, ENROLL_NOW_COURSE_STARTING_SOON_LABEL, ENROLL_NOW_LABEL, EditAlertDialog, EducationBox, EducationDialog, EducationTab, EdxIframeContext, EmptyStats, ExperienceBox, ExperienceDialog, ExperienceTab, FacetFilterContext, Footer, GradebookTab, GroupsFilterDropdown, HostPortChipInput, INVITATION_ONLY_LABEL, InstitutionDialog, IntegrationsTab, InviteUserContent, InviteUserDialog, InvitedUsersDialog, LOCAL_LLM_CHANGED_EVENT, LOCAL_MODELS, LlmModelBadge, Loader, LocalLLMTab, LocalModelsContent, LoginButton, MACOS_PERMISSIONS_COMMANDS, MEMORY_PAGE_SIZE, Markdown, MemoryAdminTab, MinimumMentorAlert, MonetizationTab, NotificationDisplay, NotificationDropdown, ONBOARDING_FIELD_TYPES, ONBOARDING_SECTORS, OnboardingField, OnboardingShell, OnboardingWizard, PLATFORM_AUDIT_DEEP_PAGING_THRESHOLD, PLATFORM_AUDIT_PAGE_SIZE, PaywallModal, PlacementExam, PlacementExamsDropdown, PlatformAuditLogDetailSheet, PlatformNavbar, PlatformNavbarSearch, Profile, ProfileTimeChart, ProgressDots, ProjectActionButtons, ProjectFilesModal, ProjectInstructionsModal, ProjectLandingPage, ProjectMentorsList, ProjectsPage, REQUEST_ACCESS_COURSE_STARTING_SOON_LABEL, REQUEST_ACCESS_LABEL, RankedBars, RenameProjectModal, ResumeBox, ResumeTab, RetrievedDocumentsButton, RichTextEditor, SERVICE_COLOR_ORDER, SUPPORTED_LOCALES, SandboxConfig, SearchableMultiSelect, SendNotificationDialog, SignupButton, SkeletonActivityStatBox, SkeletonAddSkillsLoading, SkeletonCreatePathwaySearchList, SkeletonDiscoverFilterBox, SkeletonEducationBox, SkeletonMultiplier, SkeletonPathwayBox, SkeletonProfileInfoCard, SkeletonSkillBox, SkillBox, SkillDetailModal, SkillLeaderboardChart, SkillsBox, SkillsList, SlashSkillPicker, SourceChip, Spinner, StatCard, StepHeader, SummerNoteTextEditor, TAURI_COMMANDS, TAURI_EVENTS, TRACES_PAGE_SIZE, TenantSwitcher, TimeFilter, TimeTrackingProvider, TimedExam, ToolCallIndicator, ToolDialogs, TopBanner, TranscriptFileCards, TranscriptRollupBadges, TranscriptTurnDetails, TrendSparkline, USER_ONBOARDING_FORM_SLUG, USER_ONBOARDING_FORM_VERSION, USER_ONBOARDING_SUBMISSION_SLUG, UpgradePackageModal, UserAvatar, UserOnboardingWizard, UserProfileDialog, UserProfileLink, Version, VirtualMachineAdminTab, VirtualMachineNetworkSection, WebContainersI18nProvider, WorkflowSidebar, addBookmarksTab, areChartFiltersEqual, availablePlacementExams, buildOnboardingAgentPath, buildUserOnboardingFormMetadata, buildUserOnboardingSubmissionMetadata, coerceOnboardingAgent, coerceOnboardingAgents, coerceUserOnboardingForm, colorForRank, colorForSeries, conversationDocuments, emptyUserOnboardingForm, findLastResumeBlock, findOnboardingAgent, findSequentialParent, flattenVerticalBlocks, formatAuditTimestamp, formatCompactNumber, formatFileSize, formatLatencySeconds, formatResult, formatTimeZoneLabel, getCatalog, getFirstAvailableUnit, getFriendlyToolName, getLLMModelDisplayName, getLocalLLMModel, getLocalLLMToolSupport, getNextUnitIframe, getOrg, getParentBlockById, getParentsInfosFromSublessonId, getPreviousUnitIframe, getQueryLabel, getRandomCourseImage, getSectorById, getTenant, getUnitToIframe, getUserId, getUserName, granularityForFilter, hasDistinctName, hasOnboardingContent, humanizeAuditToken, humanizeFieldName, inBrowserPrint, inIframe, inferProviderKeysFromModel, initialCuaDriverInstallState, initialModelDownloadState, isCoworkEnabled, isEmailLike, isFileReference, isLlmUsageForbidden, isLlmUsageUnavailable, isLocalLLMEnabled, isPlatformNavbarCreditBalanceVisible, isSlashCommandToken, isTauriApp, isValidLocale, isValidTimeZone, llmUsageDateArgs, components as markdownComponents, modelSupportsCowork, onboardingPrimaryButtonClass, onboardingSecondaryButtonClass, readUserOnboardingForm, readUserOnboardingSubmission, readUserOnboardingSubmissions, resolveAuditTimeZone, resolveCreateAgentLabels, resolveUserIdentity, sanitizeCss, setCoworkEnabled, setLocalLLMEnabled, setLocalLLMModel, setLocalLLMToolSupport, smallestCoworkModel, summarizeTranscriptTurns, toFileReference, toRetrievedDocuments, toToolCallInfos, useAnalyticsGlobalFilters, useAnalyticsScope, useAnalyticsSettings, useAuditLog, useCatalogSearch, useChartFilters, useChatPrivacy, useChatState, useCourseDetail, useCourseMetadata, useCourses, useCredentialsSchemaLogos, useCuaDriver, useDiscover, useEdxIframe, useFinancial, useIframeMessageHandler, useLlmDisplayName, useLlmProviderCatalogue, useLlmTraces, useLlmUsage, useLocalStorage, useMemory, useModelDownload, useMonetization, useOverview, usePlatformAuditLabels, usePlatformAuditLog, useProfileActivityStats, useProfileCredentials, useProfilePathways, useProfilePrograms, useProfileSkills, useProfileTimeSpent, usePrograms, useReports, useScopedMentorDbId, useScopedMentorId, useSelectedLocalModel, useSlashSkillPicker, useSlashSkills, useT, useTauri, useTimeTracking, useTopics, useTranscripts, useUserCourses, useUserMetadata, useUsers, useWebContainersI18n, useWebContainersLocale };
 //# sourceMappingURL=index.esm.js.map