@iblai/iblai-js 2.23.0 → 2.23.1

package/dist/web-containers/source/index.esm.js

@@ -1,7 +1,7 @@
 import * as React from 'react';
 import React__default, { useRef, useEffect, useMemo, useCallback, useState, createContext, useContext, forwardRef, createElement as createElement$1, useLayoutEffect, useReducer, useImperativeHandle, isValidElement, Children, PureComponent, cloneElement, Component, Fragment as Fragment$2, useId as useId$2, useDebugValue, lazy, Suspense } from 'react';
 import * as dataLayer from '@iblai/data-layer';
-import { useGetLlmsQuery, useCreateSessionIdMutation, useTimeTrackingMutation, useGetUserMetadataQuery, useGetUserMetadataEdxQuery, useGetUserProfileSummaryQuery, useUpdateUserMetadataMutation, useUpdateUserMetadataEdxMutation, useUploadProfileImageMutation, useResetPasswordMutation, useSelfRetireMutation, useCreateUserInstitutionMutation, useGetUserInstitutionsQuery, useCreateUserEducationMutation, useUpdateUserEducationMutation, useDeleteUserEducationMutation, useGetUserEducationQuery, useCreateUserCompanyMutation, useGetUserCompaniesQuery, useCreateUserExperienceMutation, useUpdateUserExperienceMutation, useDeleteUserExperienceMutation, useGetUserExperienceQuery, useGetUserResumeQuery, useCreateUserResumeMutation, useGetMySubscriptionsQuery, useGetItemSubscriptionQuery, useCancelSubscriptionMutation, useGetLearnerCourseOutlineQuery, getSections, findResumeBlock, flattenOutline, normalizeLearnerCompletionError, useGetLearnerDetailsQuery, useGetUserEnrolledCoursesQuery, useGetUserEnrolledProgramsQuery, useGetUserCatalogPathwaysQuery, useGetUsersAsAssertionsQuery, useGetUserEarnedSkillsQuery, useGetUserReportedSkillsQuery, useGetUserDesiredSkillsQuery, useCreateGlobalMemoryMutation, useUpdateGlobalMemoryMutation, useUpdateMentorMemoryMutation, useGetMemsearchStatusQuery, useGetUserMemorySettingsQuery, useUpdateUserMemorySettingsMutation, useGetGlobalMemoriesQuery, useGetAllMentorMemoriesQuery, useDeleteGlobalMemoryMutation, useDeleteMentorMemoryMutation, useGetAiSearchMentorsQuery, useGetUserChatHistoryReportsQuery, USER_CHAT_HISTORY_REPORT_ACTIVE_STATES, useCreateUserChatHistoryReportMutation, useLazyGetDownloadReportFromURLQuery, useGetUserChatHistoryReportStatusQuery, userChatHistoryApiSlice, USER_CHAT_HISTORY_QUERY_KEYS, useGetUserChatHistoryQuery, useGetUserChatHistoryFilterQuery, useGetMentorsQuery, useGetUserChatHistorySessionQuery, useUserLlmUsageSummary, useUserLlmSpendOverTime, useUserLlmCostByModel, useUserLlmCostByService, useUserLlmRecentActivity, USER_LLM_RECENT_ACTIVITY_PAGE_SIZE, useUserLlmTraceObservations, useInviteUserMutation, usePlatformInvitationsQuery, useCreateCatalogInvitationCourseBulkMutation, useGetCatalogInvitationsCourseQuery, useLazyPlatformUsersQuery, useLazyPlatformUserGroupsQuery, useGetPersonnalizedSearchQuery, useCreateCatalogInvitationProgramBulkMutation, useGetCatalogInvitationsProgramQuery, useGetVectorDocumentsQuery, useUpdateUserRoleMutation, useUpdateUserStatusMutation, useUpdatePlatformUserRoleWithPoliciesMutation, usePlatformUsersQuery, useGetAccessibleUsersQuery, isPoliciesResponse, platformApiSlice, featureTags, useLazyGetRbacTeamsAccessListQuery, useCreateRbacTeamsAccessMutation, useGetRbacGroupsQuery, usePlatformUserGroupsQuery, useCreateRbacGroupMutation, useUpdateRbacGroupMutation, useDeleteRbacGroupMutation, useCreatePlatformUserGroupMutation, useUpdatePlatformUserGroupMutation, useDeletePlatformUserGroupMutation, useGetRbacGroupDetailsQuery, useGetPlatformUserGroupDetailsQuery, useGetRbacPermissionsMutation, useGetRbacRolesQuery, useCreateRbacRoleMutation, useUpdateRbacRoleMutation, useDeleteRbacRoleMutation, useGetRbacRoleDetailsQuery, useGetRbacActionsDefinitionQuery, useGetRbacResourceDiscoveryQuery, useGetRbacResourceListQuery, useGetRbacPoliciesQuery, useCreateRbacPolicyMutation, useUpdateRbacPolicyMutation, useDeleteRbacPolicyMutation, useGetRbacPolicyDetailsQuery, useGetWatchedGroupsQuery, useCreateWatchedGroupMutation, useUpdateWatchedGroupMutation, useDeleteWatchedGroupMutation, useAddWatchedUserMutation, useRemoveWatchedUserMutation, useAddWatcherMutation, useUpdateWatcherMutation, useDeleteWatcherMutation, useGetWatchedUsersQuery, useGetWatchersQuery, WATCHER_NOTIFICATION_EVENTS, WATCHER_NOTIFICATION_EVENT_LABELS, useGetApplicationFormsQuery, useGetApplicationFormDetailQuery, useCreateApplicationFormMutation, useUpdateApplicationFormMutation, useGetApplicationAdminDetailQuery, useInviteApplicationCandidateMutation, useLazyGetApplicationAttachmentFileQuery, useCreateApplicationWaiverMutation, useDeleteApplicationWaiverMutation, useSubmitApplicationOverrideMutation, useUpdateApplicationPlacementMutation, useDeleteApplicationCourseAssignmentMutation, useCreateApplicationNoteMutation, useUpdateApplicationNoteMutation, useDeleteApplicationNoteMutation, useTransitionApplicationMutation, useLinkApplicationCandidateMutation, useCreateApplicationPlacementsMutation, useGetCustomMentorsQuery, useCreateApplicationCourseAssignmentsMutation, useGetApplicationBlocksQuery, useDeleteApplicationBlockMutation, useGetApplicationsPipelineStatsQuery, useGetApplicationsPipelineQuery, useGetTenantMetadataQuery, useUpdateTenantMetadataMutation, useLazyGetTenantMetadataQuery, useDeleteApiKeyMutation, useGetApiKeyQuery, useGetApiKeyFieldPermissionsQuery, useUpdateApiKeyMutation, useGetApiKeysQuery, unwrapApiTokenList, useCreateApiKeyMutation, useCreateLLMCredentialMutation, useGetCredentialsSchemaQuery, useGetMaskedLLMCredentialsQuery, useDeleteIntegrationCredentialMutation, useDeleteCredentialMutation, useCreateIntegrationCredentialMutation, useGetIntegrationCredentialsSchemaQuery, useGetMaskedIntegrationCredentialsQuery, useGetAccountBillingInfoQuery, useUpdateAutoRechargeInfoMutation, useTriggerAutoRechargeMutation, useGetAgentSpendCapQuery, useGetTenantSpendCapQuery, useListAgentUserSpendCapsQuery, useUpsertAgentSpendCapMutation, useDeleteAgentSpendCapMutation, useUpsertTenantSpendCapMutation, useDeleteTenantSpendCapMutation, useUpsertUserSpendCapMutation, useDeleteUserSpendCapMutation, useGetLlmUsageMetricsQuery, useListAgentSpendCapsQuery, useGetCreditTransactionsQuery, useCreateStripeCustomerPortalMutation, useSetPlatformConfigurationsMutation, useGetPlatformConfigurationsQuery, useUpdatePlatformMembershipMutation, useGetPlatformMembershipQuery, VERCEL_SPA, useGetCustomDomainsQuery, useGetHostingProjectsQuery, useCreateCustomDomainMutation, useDeleteCustomDomainMutation, useCreateHostingProjectDomainMutation, useUpdateHostingDomainMutation, useDeleteHostingDomainMutation, useGetStudentMentorCreationStatusQuery, useSetStudentMentorCreationStatusMutation, coreApiSlice, recommendationPromptTypeEnum, useGetRecommendedPromptsListQuery, useCreateRecommendedPromptMutation, useUpdateRecommendedPromptMutation, useDeleteRecommendedPromptMutation, useLazyGetPublicPlatformImageAssetFileUrlQuery, useCreatePlatformImageAssetMutation, useGetProviderConfigQuery, useCreateProviderConfigMutation, useDeleteProviderConfigMutation, useGetExternalMappingQuery, useGetCredentialsListQuery, useCreateExternalMappingMutation, useDeleteExternalMappingMutation, useGetMemsearchConfigQuery, useUpdateMemsearchConfigMutation, useGetStripeConnectStatusQuery, useStartStripeConnectOnboardingMutation, useLazyGetStripeConnectDashboardQuery, useListPaywallsQuery, useListPricesQuery, useCreatePriceMutation, useUpdatePriceMutation, useDeletePriceMutation, useGetPaywallConfigQuery, useEnablePaywallMutation, useUpdatePaywallMutation, useGetMentorMemoriesListQuery, useGetMemoryCategoriesAdminQuery, useCreateMentorMemoryMutation, useGetNotificationsCountQuery, useLazyGetNotificationsQuery, useMarkAllAsReadMutation, useCreateNotificationPreviewMutation, useSendNotificationMutation, USER_PROGRESS_DATA_POINTS, useResetTemplateMutation, useSendTestTemplateEmailMutation, useUpdateTemplateMutation, useGetTemplateDetailsQuery, USER_PROGRESS_SUMMARY_TYPE, useGetTemplatesQuery, useLazyGetTemplateDetailsQuery, useToggleTemplateMutation, useGetLlmUsageTracesQuery, useGetLlmUsageObservationsQuery, useGetTopicsStatsQuery, useGetUsersStatsQuery, useGetSessionStatsQuery, useGetTopicsDetailsStatsQuery, useGetTranscriptsConversationHeadlineQuery, useGetAccessTimeHeatmapQuery, useGetUserDetailsStatsQuery, useGetAverageRatingQuery, useGetModelCostsQuery, useGetPerUserCostsQuery, useGetTenantCostQuery, useGetAgentCostQuery, useGetTranscriptsMessagesDetailsQuery, useGetTranscriptsMessagesQuery, useGetReportDetailQuery, useGetMentorPublicSettingsQuery, useGetReportsQuery, useCreateReportMutation, useGetContentAnalyticsQuery, useGetContentAnalyticsDetailsQuery, useGetRevenueQuery, useListSubscribersQuery, useGetAuditLogsQuery, useGetPlatformAuditLogsQuery, PLATFORM_AUDIT_EVENT_TYPES, PLATFORM_AUDIT_ACTION_CODES, useGetMentorMemoriesQuery, useLazyGetCourseMetaDataQuery, useLazyGetCourseCompletionOutlinesQuery, useLazyGetCourseEligibilityQuery, useLazyGetUserEnrolledCoursesQuery, useLazyGetUserAssignedCoursesQuery, useLazyGetUserCredentialsQuery, useLazyGetOverTimeActivityQuery, useLazyGetCatalogSearchQuery, useCreateOrUpdateUserReportedSkillMutation, useCreateOrUpdateUserDesiredSkillMutation, useLazyGetPathwayListQuery, useLazyGetUserAssignedPathwaysQuery, useLazyGetUserEnrolledPathwaysQuery, useLazyGetPathwayCompletionQuery, useLazyGetProgramListQuery, useLazyGetProgramCompletionQuery, useLazyGetUserEnrolledProgramsQuery, useLazyGetAssignedProgramsQuery, useLazyGetUserSkillsPointsQuery, useLazyGetUserReportedSkillsQuery, useLazyGetUserDesiredSkillsQuery, useLazyGetUserCatalogPathwaysQuery, useLazyGetPerLearnerInfoQuery, useLazyGetEdxSSOTokenQuery, useCreateCourseEnrollmentMutation, useCreateStripeCheckoutSessionMutation, useLazyGetCourseProgressQuery, useLazyGetCourseCompletionQuery, useLazyGetPersonnalizedSearchQuery, useUpdateExamAttemptMutation, useStartExamMutation, useLazyGetExamInfoQuery, useGetMentorSettingsQuery, useEditMentorMutation, useGetClawMentorConfigQuery, useGetClawInstancesQuery, useGetAgentConfigQuery, useUpdateClawMentorConfigMutation, useCreateClawMentorConfigMutation, useDeleteClawMentorConfigMutation, usePushClawConfigMutation, useCreateClawInstanceMutation, useDeleteClawInstanceMutation, useUpdateAgentConfigMutation, useHealthCheckClawInstanceMutation, useTestConnectivityClawInstanceMutation, useUpdateClawInstanceMutation, useGetAgentSkillResourcesQuery, useCreateAgentSkillResourceMutation, useUpdateAgentSkillResourceMutation, useUploadAgentSkillResourceAssetMutation, useDeleteAgentSkillResourceMutation, useGetMentorSkillAssignmentsQuery, useGetAgentSkillsQuery, useCreateMentorSkillAssignmentMutation, useUpdateMentorSkillAssignmentMutation, useDeleteMentorSkillAssignmentMutation, useCreateAgentSkillMutation, useUpdateAgentSkillMutation, useDeleteAgentSkillMutation, filterSlashSkills, useGetMentorSkillAssignmentsInfiniteQuery, MENTOR_SKILL_ASSIGNMENTS_PAGE_SIZE, useCreateCheckoutMutation, useGetUserProjectsQuery, useUpdateUserProjectMutation, useGetTrainingDocumentsQuery, useLazyGetConnectedServiceAuthUrlQuery, useCreateUserProjectMutation, useDeleteUserProjectMutation, useGetUserProjectDetailsQuery, useEditTrainingDocumentMutation, useAddTrainingDocumentMutation, useLazyGetCredentialsQuery, useGetMentorCategoriesQuery, useCreateMentorMutation, useUpdateUserPlatformMetadataMutation, useGetApplicationStatusQuery, useListOwnApplicationsQuery, useGetApplicationFormQuery, useWithdrawApplicationMutation, useRenewApplicationMutation, useCreateApplicationDraftMutation, useSubmitApplicationMutation, useUpdateApplicationMutation, useUploadApplicationAttachmentMutation, useDeleteApplicationAttachmentMutation, useCreateMemoryCategoryMutation, useUpdateMemoryCategoryMutation, useDeleteMemoryCategoryMutation, useGetPromptCategoriesQuery, useCreatePromptMutation, useDeletePromptMutation, useGetPromptsSearchQuery, useUpdatePromptMutation, useDeleteTrainingDocumentMutation, useGetTrainingDocumentRetrainScheduleQuery, useCreateTrainingDocumentRetrainScheduleMutation } from '@iblai/data-layer';
+import { useGetCredentialsSchemaQuery, useGetLlmsQuery, useCreateSessionIdMutation, useTimeTrackingMutation, useGetUserMetadataQuery, useGetUserMetadataEdxQuery, useGetUserProfileSummaryQuery, useUpdateUserMetadataMutation, useUpdateUserMetadataEdxMutation, useUploadProfileImageMutation, useResetPasswordMutation, useSelfRetireMutation, useCreateUserInstitutionMutation, useGetUserInstitutionsQuery, useCreateUserEducationMutation, useUpdateUserEducationMutation, useDeleteUserEducationMutation, useGetUserEducationQuery, useCreateUserCompanyMutation, useGetUserCompaniesQuery, useCreateUserExperienceMutation, useUpdateUserExperienceMutation, useDeleteUserExperienceMutation, useGetUserExperienceQuery, useGetUserResumeQuery, useCreateUserResumeMutation, useGetMySubscriptionsQuery, useGetItemSubscriptionQuery, useCancelSubscriptionMutation, useGetLearnerCourseOutlineQuery, getSections, findResumeBlock, flattenOutline, normalizeLearnerCompletionError, useGetLearnerDetailsQuery, useGetUserEnrolledCoursesQuery, useGetUserEnrolledProgramsQuery, useGetUserCatalogPathwaysQuery, useGetUsersAsAssertionsQuery, useGetUserEarnedSkillsQuery, useGetUserReportedSkillsQuery, useGetUserDesiredSkillsQuery, useCreateGlobalMemoryMutation, useUpdateGlobalMemoryMutation, useUpdateMentorMemoryMutation, useGetMemsearchStatusQuery, useGetUserMemorySettingsQuery, useUpdateUserMemorySettingsMutation, useGetGlobalMemoriesQuery, useGetAllMentorMemoriesQuery, useDeleteGlobalMemoryMutation, useDeleteMentorMemoryMutation, useGetAiSearchMentorsQuery, useGetUserChatHistoryReportsQuery, USER_CHAT_HISTORY_REPORT_ACTIVE_STATES, useCreateUserChatHistoryReportMutation, useLazyGetDownloadReportFromURLQuery, useGetUserChatHistoryReportStatusQuery, userChatHistoryApiSlice, USER_CHAT_HISTORY_QUERY_KEYS, useGetUserChatHistoryQuery, useGetUserChatHistoryFilterQuery, useGetMentorsQuery, useGetUserChatHistorySessionQuery, useUserLlmUsageSummary, useUserLlmSpendOverTime, useUserLlmCostByModel, useUserLlmCostByService, useUserLlmRecentActivity, USER_LLM_RECENT_ACTIVITY_PAGE_SIZE, useUserLlmTraceObservations, useInviteUserMutation, usePlatformInvitationsQuery, useCreateCatalogInvitationCourseBulkMutation, useGetCatalogInvitationsCourseQuery, useLazyPlatformUsersQuery, useLazyPlatformUserGroupsQuery, useGetPersonnalizedSearchQuery, useCreateCatalogInvitationProgramBulkMutation, useGetCatalogInvitationsProgramQuery, useGetVectorDocumentsQuery, useUpdateUserRoleMutation, useUpdateUserStatusMutation, useUpdatePlatformUserRoleWithPoliciesMutation, usePlatformUsersQuery, useGetAccessibleUsersQuery, isPoliciesResponse, platformApiSlice, featureTags, useLazyGetRbacTeamsAccessListQuery, useCreateRbacTeamsAccessMutation, useGetRbacGroupsQuery, usePlatformUserGroupsQuery, useCreateRbacGroupMutation, useUpdateRbacGroupMutation, useDeleteRbacGroupMutation, useCreatePlatformUserGroupMutation, useUpdatePlatformUserGroupMutation, useDeletePlatformUserGroupMutation, useGetRbacGroupDetailsQuery, useGetPlatformUserGroupDetailsQuery, useGetRbacPermissionsMutation, useGetRbacRolesQuery, useCreateRbacRoleMutation, useUpdateRbacRoleMutation, useDeleteRbacRoleMutation, useGetRbacRoleDetailsQuery, useGetRbacActionsDefinitionQuery, useGetRbacResourceDiscoveryQuery, useGetRbacResourceListQuery, useGetRbacPoliciesQuery, useCreateRbacPolicyMutation, useUpdateRbacPolicyMutation, useDeleteRbacPolicyMutation, useGetRbacPolicyDetailsQuery, useGetWatchedGroupsQuery, useCreateWatchedGroupMutation, useUpdateWatchedGroupMutation, useDeleteWatchedGroupMutation, useAddWatchedUserMutation, useRemoveWatchedUserMutation, useAddWatcherMutation, useUpdateWatcherMutation, useDeleteWatcherMutation, useGetWatchedUsersQuery, useGetWatchersQuery, WATCHER_NOTIFICATION_EVENTS, WATCHER_NOTIFICATION_EVENT_LABELS, useGetApplicationFormsQuery, useGetApplicationFormDetailQuery, useCreateApplicationFormMutation, useUpdateApplicationFormMutation, useGetApplicationAdminDetailQuery, useInviteApplicationCandidateMutation, useLazyGetApplicationAttachmentFileQuery, useCreateApplicationWaiverMutation, useDeleteApplicationWaiverMutation, useSubmitApplicationOverrideMutation, useUpdateApplicationPlacementMutation, useDeleteApplicationCourseAssignmentMutation, useCreateApplicationNoteMutation, useUpdateApplicationNoteMutation, useDeleteApplicationNoteMutation, useTransitionApplicationMutation, useLinkApplicationCandidateMutation, useCreateApplicationPlacementsMutation, useGetCustomMentorsQuery, useCreateApplicationCourseAssignmentsMutation, useGetApplicationBlocksQuery, useDeleteApplicationBlockMutation, useGetApplicationsPipelineStatsQuery, useGetApplicationsPipelineQuery, useGetTenantMetadataQuery, useUpdateTenantMetadataMutation, useLazyGetTenantMetadataQuery, useDeleteApiKeyMutation, useGetApiKeyQuery, useGetApiKeyFieldPermissionsQuery, useUpdateApiKeyMutation, useGetApiKeysQuery, unwrapApiTokenList, useCreateApiKeyMutation, useCreateLLMCredentialMutation, useGetMaskedLLMCredentialsQuery, useDeleteIntegrationCredentialMutation, useDeleteCredentialMutation, useCreateIntegrationCredentialMutation, useGetIntegrationCredentialsSchemaQuery, useGetMaskedIntegrationCredentialsQuery, useGetAccountBillingInfoQuery, useUpdateAutoRechargeInfoMutation, useTriggerAutoRechargeMutation, useGetAgentSpendCapQuery, useGetTenantSpendCapQuery, useListAgentUserSpendCapsQuery, useUpsertAgentSpendCapMutation, useDeleteAgentSpendCapMutation, useUpsertTenantSpendCapMutation, useDeleteTenantSpendCapMutation, useUpsertUserSpendCapMutation, useDeleteUserSpendCapMutation, useGetLlmUsageMetricsQuery, useListAgentSpendCapsQuery, useGetCreditTransactionsQuery, useCreateStripeCustomerPortalMutation, useSetPlatformConfigurationsMutation, useGetPlatformConfigurationsQuery, useUpdatePlatformMembershipMutation, useGetPlatformMembershipQuery, VERCEL_SPA, useGetCustomDomainsQuery, useGetHostingProjectsQuery, useCreateCustomDomainMutation, useDeleteCustomDomainMutation, useCreateHostingProjectDomainMutation, useUpdateHostingDomainMutation, useDeleteHostingDomainMutation, useGetStudentMentorCreationStatusQuery, useSetStudentMentorCreationStatusMutation, coreApiSlice, recommendationPromptTypeEnum, useGetRecommendedPromptsListQuery, useCreateRecommendedPromptMutation, useUpdateRecommendedPromptMutation, useDeleteRecommendedPromptMutation, useLazyGetPublicPlatformImageAssetFileUrlQuery, useCreatePlatformImageAssetMutation, useGetProviderConfigQuery, useCreateProviderConfigMutation, useDeleteProviderConfigMutation, useGetExternalMappingQuery, useGetCredentialsListQuery, useCreateExternalMappingMutation, useDeleteExternalMappingMutation, useGetMemsearchConfigQuery, useUpdateMemsearchConfigMutation, useGetStripeConnectStatusQuery, useStartStripeConnectOnboardingMutation, useLazyGetStripeConnectDashboardQuery, useListPaywallsQuery, useListPricesQuery, useCreatePriceMutation, useUpdatePriceMutation, useDeletePriceMutation, useGetPaywallConfigQuery, useEnablePaywallMutation, useUpdatePaywallMutation, useGetMentorMemoriesListQuery, useGetMemoryCategoriesAdminQuery, useCreateMentorMemoryMutation, splitHostPortInput, validateHostPort, useCreateVirtualMachineNetworkPolicyMutation, useUpdateVirtualMachineNetworkPolicyMutation, VIRTUAL_MACHINE_MAX_POLICY_HOSTS, getVirtualMachineApiError, useDeleteVirtualMachineNetworkPolicyMutation, extractBoundMentorIds, useCreateVirtualMachineSecretMutation, useUpdateVirtualMachineSecretMutation, VIRTUAL_MACHINE_SECRET_VALUE_MIN_LENGTH, VIRTUAL_MACHINE_ENV_VAR_PATTERN, useDeleteVirtualMachineSecretMutation, useGetIntegrationCredentialsQuery, useListVirtualMachineNetworkPoliciesQuery, useListVirtualMachineSecretsQuery, getVirtualMachineErrorStatus, useGetNotificationsCountQuery, useLazyGetNotificationsQuery, useMarkAllAsReadMutation, useCreateNotificationPreviewMutation, useSendNotificationMutation, USER_PROGRESS_DATA_POINTS, useResetTemplateMutation, useSendTestTemplateEmailMutation, useUpdateTemplateMutation, useGetTemplateDetailsQuery, USER_PROGRESS_SUMMARY_TYPE, useGetTemplatesQuery, useLazyGetTemplateDetailsQuery, useToggleTemplateMutation, useGetLlmUsageTracesQuery, useGetLlmUsageObservationsQuery, useGetTopicsStatsQuery, useGetUsersStatsQuery, useGetSessionStatsQuery, useGetTopicsDetailsStatsQuery, useGetTranscriptsConversationHeadlineQuery, useGetAccessTimeHeatmapQuery, useGetUserDetailsStatsQuery, useGetAverageRatingQuery, useGetModelCostsQuery, useGetPerUserCostsQuery, useGetTenantCostQuery, useGetAgentCostQuery, useGetTranscriptsMessagesDetailsQuery, useGetTranscriptsMessagesQuery, useGetReportDetailQuery, useGetMentorPublicSettingsQuery, useGetReportsQuery, useCreateReportMutation, useGetContentAnalyticsQuery, useGetContentAnalyticsDetailsQuery, useGetRevenueQuery, useListSubscribersQuery, useGetAuditLogsQuery, useGetPlatformAuditLogsQuery, PLATFORM_AUDIT_EVENT_TYPES, PLATFORM_AUDIT_ACTION_CODES, useGetMentorMemoriesQuery, useLazyGetCourseMetaDataQuery, useLazyGetCourseCompletionOutlinesQuery, useLazyGetCourseEligibilityQuery, useLazyGetUserEnrolledCoursesQuery, useLazyGetUserAssignedCoursesQuery, useLazyGetUserCredentialsQuery, useLazyGetOverTimeActivityQuery, useLazyGetCatalogSearchQuery, useCreateOrUpdateUserReportedSkillMutation, useCreateOrUpdateUserDesiredSkillMutation, useLazyGetPathwayListQuery, useLazyGetUserAssignedPathwaysQuery, useLazyGetUserEnrolledPathwaysQuery, useLazyGetPathwayCompletionQuery, useLazyGetProgramListQuery, useLazyGetProgramCompletionQuery, useLazyGetUserEnrolledProgramsQuery, useLazyGetAssignedProgramsQuery, useLazyGetUserSkillsPointsQuery, useLazyGetUserReportedSkillsQuery, useLazyGetUserDesiredSkillsQuery, useLazyGetUserCatalogPathwaysQuery, useLazyGetPerLearnerInfoQuery, useLazyGetEdxSSOTokenQuery, useCreateCourseEnrollmentMutation, useCreateStripeCheckoutSessionMutation, useLazyGetCourseProgressQuery, useLazyGetCourseCompletionQuery, useLazyGetPersonnalizedSearchQuery, useUpdateExamAttemptMutation, useStartExamMutation, useLazyGetExamInfoQuery, useGetMentorSettingsQuery, useEditMentorMutation, isVirtualMachineEgressNetworked, findUncoveredSecretHosts, VIRTUAL_MACHINE_MAX_SECRETS_PER_MENTOR, VIRTUAL_MACHINE_DEFAULT_BILLING, VIRTUAL_MACHINE_EGRESS_PROFILES, useGetClawMentorConfigQuery, useGetClawInstancesQuery, useGetAgentConfigQuery, useUpdateClawMentorConfigMutation, useCreateClawMentorConfigMutation, useDeleteClawMentorConfigMutation, usePushClawConfigMutation, useCreateClawInstanceMutation, useDeleteClawInstanceMutation, useUpdateAgentConfigMutation, useHealthCheckClawInstanceMutation, useTestConnectivityClawInstanceMutation, useUpdateClawInstanceMutation, useGetAgentSkillResourcesQuery, useCreateAgentSkillResourceMutation, useUpdateAgentSkillResourceMutation, useUploadAgentSkillResourceAssetMutation, useDeleteAgentSkillResourceMutation, useGetMentorSkillAssignmentsQuery, useGetAgentSkillsQuery, useCreateMentorSkillAssignmentMutation, useUpdateMentorSkillAssignmentMutation, useDeleteMentorSkillAssignmentMutation, useCreateAgentSkillMutation, useUpdateAgentSkillMutation, useDeleteAgentSkillMutation, filterSlashSkills, useGetMentorSkillAssignmentsInfiniteQuery, MENTOR_SKILL_ASSIGNMENTS_PAGE_SIZE, useCreateCheckoutMutation, useGetUserProjectsQuery, useUpdateUserProjectMutation, useGetTrainingDocumentsQuery, useLazyGetConnectedServiceAuthUrlQuery, useCreateUserProjectMutation, useDeleteUserProjectMutation, useGetUserProjectDetailsQuery, useEditTrainingDocumentMutation, useAddTrainingDocumentMutation, useLazyGetCredentialsQuery, useGetMentorCategoriesQuery, useCreateMentorMutation, useUpdateUserPlatformMetadataMutation, useGetApplicationStatusQuery, useListOwnApplicationsQuery, useGetApplicationFormQuery, useWithdrawApplicationMutation, useRenewApplicationMutation, useCreateApplicationDraftMutation, useSubmitApplicationMutation, useUpdateApplicationMutation, useUploadApplicationAttachmentMutation, useDeleteApplicationAttachmentMutation, useCreateMemoryCategoryMutation, useUpdateMemoryCategoryMutation, useDeleteMemoryCategoryMutation, useGetPromptCategoriesQuery, useCreatePromptMutation, useDeletePromptMutation, useGetPromptsSearchQuery, useUpdatePromptMutation, useDeleteTrainingDocumentMutation, useGetTrainingDocumentRetrainScheduleQuery, useCreateTrainingDocumentRetrainScheduleMutation } from '@iblai/data-layer';
 import { useDispatch, useSelector } from 'react-redux';
 import { selectSessionId, selectActiveChatMessages, useCachedSessionId, chatActions, LOCAL_STORAGE_KEYS, TimeTracker, selectRbacPermissions, useCurrentTenant, canViewOtherUsersChatHistory, isPureWatcher, getInitials, useTenantMetadata, useUsername, selectStreaming, isLoggedIn, TOOL_NAME_MAP, WRITE_TODOS_TOOL, WithPermissions, canWriteField, useStripeUpgrade, openExternalUrl, CHAT_AREA_SIZE, isAlphaNumeric32, checkRbacPermission, getTimeAgo, REQUIRED_ACTIONS_FOR_GROUPS, getVisibleAnalyticsTabs, canViewMonetizationAnalytics, getUserName as getUserName$2, formatRelativeTime as formatRelativeTime$2, ANONYMOUS_USERNAME, combineCSVData, WATCHER_HIDDEN_REPORTS, canViewPlatformAuditLogs, redirectToAuthSpaJoinTenant, redirectToAuthSpa, getAuthSpaJoinUrl, useOS, selectNumberOfActiveChatMessages, TOOLS, hasRemoteAiConfig, isSafariBrowser, useShowAttachment, useShowVoiceCall, useShowVoiceRecorder, useMentorSettings, selectShowingSharedChat, useShowFreeTrialDialog, useEmbedMode, chatInputSliceSelectors, useResponsive, useAccessingPublicRoute, useVisitingTenant, useModelFileUploadCapabilities, useChatFileUpload, useVoiceChat, selectAttachedFiles, MENTOR_CHAT_DOCUMENTS_EXTENSIONS, chatInputSliceActions, removeFile, WithFormPermissions, MENTOR_VISIBILITY } from '@iblai/web-utils';
 import { toast } from 'sonner';
@@ -266,6 +266,34 @@ function useLlmDisplayName({ llmName, llmConfig, org, userId, mentorId, }) {
     }, [skip, providers, llmName]);
     return (_a = fromConfig !== null && fromConfig !== void 0 ? fromConfig : fromCatalogue) !== null && _a !== void 0 ? _a : getLLMModelDisplayName(llmName);
 }
+/**
+ * A resolver from an LLM provider's display name (what the mentor-search
+ * `llm_providers` facet carries, e.g. `OpenAI`, `Microsoft`) to the logo the
+ * tenant's credentials schema publishes for it, matched on
+ * `service_info.display_name`. Resolves to `null` when disabled, still
+ * loading, or when no schema row carries that name.
+ *
+ * Moved here from the mentorai app's `use-llm-provider-details` so every host
+ * shares one copy; the app keeps its own until its next SDK bump.
+ */
+function useCredentialsSchemaLogos({ org, enabled }) {
+    const { data: schemas } = useGetCredentialsSchemaQuery({ org: org !== null && org !== void 0 ? org : '' }, { skip: !org || !enabled });
+    // First row wins on a duplicate display name, as `Array.find` would.
+    const logosByDisplayName = useMemo(() => {
+        var _a, _b;
+        const byName = new Map();
+        if (!Array.isArray(schemas))
+            return byName;
+        for (const schema of schemas) {
+            const displayName = (_a = schema === null || schema === void 0 ? void 0 : schema.service_info) === null || _a === void 0 ? void 0 : _a.display_name;
+            const logo = (_b = schema === null || schema === void 0 ? void 0 : schema.service_info) === null || _b === void 0 ? void 0 : _b.logo;
+            if (displayName && logo && !byName.has(displayName))
+                byName.set(displayName, logo);
+        }
+        return byName;
+    }, [schemas]);
+    return useCallback((displayName) => (displayName && logosByDisplayName.get(displayName)) || null, [logosByDisplayName]);
+}
 
 var _a;
 const dl$1 = dataLayer;
@@ -5215,7 +5243,9 @@ var profileAccount$3 = {
 	groupSystem: "System",
 	ariaSettingsNav: "Organization settings",
 	ariaSettingsNavMobile: "Organization settings (mobile)",
-	groupFinance: "Finance"
+	groupFinance: "Finance",
+	tabVirtualMachine: "Virtual Machine",
+	descVirtualMachine: "Manage the network policies and secrets available to agents' virtual machines."
 };
 var profileAddCreditsModal$3 = {
 	title: "Add Credits",
@@ -7015,8 +7045,8 @@ var uiSidebar$3 = {
 var userProfileDropdownIndex$3 = {
 	profile: "Profile",
 	account: "Account",
-	learner: "Learner",
-	instructor: "Instructor",
+	learner: "User",
+	instructor: "Admin",
 	help: "Help",
 	logOut: "Log Out",
 	moreOptions: "More options"
@@ -8553,6 +8583,177 @@ var profileLlmUsage$3 = {
 	tryAgain: "Try again",
 	scopeUser: "Usage for {username}"
 };
+var virtualMachineHostInput$3 = {
+	listLabel: "Allowed Hosts",
+	removeHost: "Remove {host}",
+	placeholder: "api.example.com:443",
+	hint: "Type host:port and press Enter, or paste a list.",
+	errorFormat: "{entry} must be host:port, for example api.example.com:443 — no scheme, path or wildcard.",
+	errorPort: "{entry}: the port must be between 1 and 65535.",
+	errorRejectedHost: "{entry}: this host is reserved and cannot be allowed.",
+	errorIpNotAllowed: "{entry}: use a hostname here, not an IP address.",
+	errorDuplicate: "{entry} is already in the list.",
+	errorMax: "You can add at most {max} hosts."
+};
+var virtualMachineAdminTab$3 = {
+	infoBox: "Agents with Virtual Machine Shell run code in an isolated Linux VM that has no network access by default. Network policies are reusable lists of the host:port destinations a VM may reach, and VM secrets are keys the VM can use but never read. Pick them for an agent from its Sandbox settings.",
+	tabsAriaLabel: "Virtual machine sections",
+	tabNetworkPolicies: "Network Policies",
+	tabSecrets: "Secrets",
+	forbidden: "You do not have permission to manage virtual machine network policies or secrets."
+};
+var virtualMachineNetworkPolicies$3 = {
+	newPolicy: "New Policy",
+	loadFailed: "Network policies could not be loaded. Try again in a moment.",
+	colName: "Name",
+	colHosts: "Allowed Hosts",
+	colDescription: "Description",
+	colUpdated: "Updated",
+	colActions: "Actions",
+	hostsListAriaLabel: "Hosts allowed by {name}",
+	moreHosts: "+{count} more",
+	editAriaLabel: "Edit policy {name}",
+	deleteAriaLabel: "Delete policy {name}",
+	empty: "No network policies yet. Create one to let an agent's VM reach specific hosts.",
+	createTitle: "New Network Policy",
+	editTitle: "Edit Network Policy",
+	dialogDescription: "The host:port destinations a VM may reach under this policy. HTTPS is port 443.",
+	fieldName: "Name",
+	namePlaceholder: "e.g. Acme APIs",
+	fieldHosts: "Allowed Hosts",
+	hostsHint: "Type host:port and press Enter, or paste a list. Up to {max} entries; IP addresses are allowed.",
+	removedHostsWarning: "You are removing {hosts}. If an agent uses this policy and has a secret that is sent to one of these hosts, that secret will stop working.",
+	fieldDescription: "Description (Optional)",
+	descriptionPlaceholder: "What this policy is for",
+	cancel: "Cancel",
+	saveChanges: "Save Changes",
+	createPolicy: "Create Policy",
+	errorNameRequired: "Give the policy a name.",
+	errorHostsRequired: "Add at least one host.",
+	created: "Network policy created",
+	updated: "Network policy updated",
+	deleted: "Network policy deleted",
+	saveFailed: "The policy could not be saved. Try again.",
+	forbiddenWrite: "You do not have permission to change network policies.",
+	forbiddenDelete: "You do not have permission to delete network policies.",
+	deleteTitle: "Delete Network Policy",
+	deleteConfirm: "Delete {name}? Agents set to the Custom profile can only use policies that still exist.",
+	deleteBlockedInUse: "This policy is still used by the following agents. Move them to another policy or profile first.",
+	deleteFailed: "The policy could not be deleted. Try again.",
+	"delete": "Delete"
+};
+var virtualMachineSecrets$3 = {
+	newSecret: "New Secret",
+	loadFailed: "VM secrets could not be loaded. Try again in a moment.",
+	colName: "Name",
+	colEnvVar: "Variable",
+	colHosts: "Allowed Hosts",
+	colSource: "Source",
+	colUpdated: "Updated",
+	colActions: "Actions",
+	hostsListAriaLabel: "Hosts {name} is sent to",
+	moreHosts: "+{count} more",
+	sourceStored: "Stored Value",
+	sourceFromCredential: "Credential {credential} · {field}",
+	editAriaLabel: "Edit secret {name}",
+	deleteAriaLabel: "Delete secret {name}",
+	empty: "No VM secrets yet. Create one to let an agent call an API with your organization's key without ever seeing it.",
+	createTitle: "New VM Secret",
+	editTitle: "Edit VM Secret",
+	dialogDescription: "The value is never shown again after you save it.",
+	fieldName: "Name",
+	namePlaceholder: "e.g. Acme API key",
+	fieldEnvVar: "Environment Variable",
+	envVarPlaceholder: "e.g. ACME_KEY",
+	envVarHelp: "Letters, digits and underscores; cannot start with a digit.",
+	envVarReadOnlyHelp: "Cannot be renamed. Delete this secret and create a new one instead.",
+	fieldHosts: "Allowed Hosts",
+	hostsHint: "Only these hosts receive the real key, so keep it to the narrowest host that needs it. Type host:port and press Enter.",
+	fieldSource: "Value Source",
+	sourceValue: "Enter a Value",
+	sourceValueDescription: "Stored encrypted and never shown again.",
+	sourceCredential: "Use an Integration Credential",
+	sourceCredentialDescription: "Reads one field of a saved credential and follows rotations automatically.",
+	fieldValue: "Value",
+	valuePlaceholder: "Paste the key",
+	valueKeepPlaceholder: "Leave blank to keep the current value",
+	valueHelp: "At least {min} characters.",
+	valueKeepHelp: "Leave blank to keep the current value.",
+	fieldCredential: "Integration Credential",
+	credentialPlaceholder: "Choose a credential",
+	noCredentials: "Your organization has no integration credentials yet. Add one under Integrations, or enter a value instead.",
+	fieldCredentialField: "Credential Field",
+	credentialFieldPlaceholder: "Choose a field",
+	credentialNoFields: "This credential has no fields to read from.",
+	cancel: "Cancel",
+	saveChanges: "Save Changes",
+	createSecret: "Create Secret",
+	errorNameRequired: "Give the secret a name.",
+	errorEnvVarRequired: "Enter the environment variable name.",
+	errorEnvVarFormat: "Use letters, digits and underscores only, and do not start with a digit.",
+	errorHostsRequired: "Add at least one host.",
+	errorValueRequired: "Enter the value.",
+	errorValueTooShort: "The value must be at least {min} characters.",
+	errorValueMasked: "This looks like a masked value. Paste the real key.",
+	errorCredentialRequired: "Choose a credential.",
+	errorFieldRequired: "Choose the credential field.",
+	created: "VM secret created",
+	updated: "VM secret updated",
+	deleted: "VM secret deleted",
+	saveFailed: "The secret could not be saved. Try again.",
+	forbiddenWrite: "You do not have permission to change VM secrets.",
+	forbiddenDelete: "You do not have permission to delete VM secrets.",
+	deleteTitle: "Delete VM Secret",
+	deleteConfirm: "Delete {envVar}? It will also be removed from every agent that uses it.",
+	deleteFailed: "The secret could not be deleted. Try again.",
+	"delete": "Delete"
+};
+var virtualMachineNetworkSection$3 = {
+	title: "Network Access",
+	description: "Decide what this agent's virtual machine can reach and which credentials it can use.",
+	billingNotice: "Virtual machine time is billed to the chatting user's credits: ${usd} per {minutes} minutes by default, prorated per second. Your organization's rate may differ.",
+	egressLabel: "Egress Profile",
+	egressHelp: "How much of the network the VM gets.",
+	egressNoneLabel: "No Network",
+	egressNoneDescription: "The VM cannot reach anything.",
+	egressRegistriesLabel: "Package Registries",
+	egressRegistriesDescription: "PyPI, npm, apt and apk only, for installing packages.",
+	egressPublicLabel: "Public Internet",
+	egressPublicDescription: "Any public host. Private networks, localhost and cloud metadata stay blocked.",
+	egressCustomLabel: "Custom Allowlist",
+	egressCustomDescription: "Only the hosts in the network policy you pick below.",
+	policyLabel: "Network Policy",
+	policiesForbidden: "You do not have permission to view network policies, so this profile cannot be configured from here.",
+	noPolicies: "No network policies yet",
+	policyPlaceholder: "Choose a policy",
+	createPolicy: "Create Policy",
+	editPolicy: "Edit Policy",
+	managePolicies: "Manage Policies",
+	manageSecrets: "Manage Secrets",
+	policyRequired: "The Custom profile needs a network policy.",
+	policyHosts: "Hosts this policy allows:",
+	secretsLabel: "Secrets",
+	secretsHelp: "Keys the VM can use but never read. Up to {max} per agent.",
+	noSecrets: "Your organization has no VM secrets yet. Use Manage Secrets to create one.",
+	secretsCapReached: "This agent has the maximum of {max} secrets.",
+	uncoveredTitle: "Some secrets are sent to hosts this policy does not allow:",
+	uncoveredItem: "{envVar} needs {hosts}, which {policy} doesn't allow.",
+	addHostsAndSave: "Add Hosts to {policy} and Save",
+	saved: "Network settings saved",
+	saveFailed: "The network settings could not be saved. Try again.",
+	forbiddenSave: "You do not have permission to change these settings.",
+	policyHostsAdded: "Hosts added to {policy}",
+	policyUpdateFailed: "The policy could not be updated, so the settings were not saved.",
+	policyUpdateForbidden: "You do not have permission to change network policies, so the settings were not saved.",
+	discard: "Discard",
+	save: "Save Changes",
+	narrowTitle: "Unbind Secrets?",
+	narrowDescription: "{profile} gives the VM no access to the hosts these secrets need, so saving will unbind {count, plural, one {# secret} other {# secrets}} from this agent.",
+	cancel: "Cancel",
+	narrowConfirm: "Unbind and Save",
+	manageTitle: "Virtual Machine Settings",
+	manageDescription: "Network policies and VM secrets are shared by every agent in your organization."
+};
 var en = {
 	accessTabAddAccess: accessTabAddAccess$3,
 	accessTabLabels: accessTabLabels$3,
@@ -8838,7 +9039,12 @@ var en = {
 	analyticsCostTabs: analyticsCostTabs$3,
 	analyticsLlmUsage: analyticsLlmUsage$3,
 	analyticsTraces: analyticsTraces$3,
-	profileLlmUsage: profileLlmUsage$3
+	profileLlmUsage: profileLlmUsage$3,
+	virtualMachineHostInput: virtualMachineHostInput$3,
+	virtualMachineAdminTab: virtualMachineAdminTab$3,
+	virtualMachineNetworkPolicies: virtualMachineNetworkPolicies$3,
+	virtualMachineSecrets: virtualMachineSecrets$3,
+	virtualMachineNetworkSection: virtualMachineNetworkSection$3
 };
 
 var accessTabAddAccess$2 = {
@@ -12719,7 +12925,9 @@ var profileAccount$2 = {
 	groupSystem: "Système",
 	ariaSettingsNav: "Paramètres de l'organisation",
 	ariaSettingsNavMobile: "Paramètres de l'organisation (mobile)",
-	groupFinance: "Finance"
+	groupFinance: "Finance",
+	tabVirtualMachine: "Machine virtuelle",
+	descVirtualMachine: "Gérez les politiques réseau et les secrets disponibles pour les machines virtuelles des agents."
 };
 var profileAddCreditsModal$2 = {
 	title: "Ajouter des crédits",
@@ -14519,8 +14727,8 @@ var uiSidebar$2 = {
 var userProfileDropdownIndex$2 = {
 	profile: "Profil",
 	account: "Compte",
-	learner: "Apprenant",
-	instructor: "Instructeur",
+	learner: "Utilisateur",
+	instructor: "Administrateur",
 	help: "Aide",
 	logOut: "Se déconnecter",
 	moreOptions: "Plus d'options"
@@ -15891,6 +16099,177 @@ var profileLlmUsage$2 = {
 	tryAgain: "Réessayer",
 	scopeUser: "Utilisation de {username}"
 };
+var virtualMachineHostInput$2 = {
+	listLabel: "Hôtes autorisés",
+	removeHost: "Retirer {host}",
+	placeholder: "api.exemple.com:443",
+	hint: "Saisissez hôte:port et appuyez sur Entrée, ou collez une liste.",
+	errorFormat: "{entry} doit être au format hôte:port, par exemple api.exemple.com:443, sans schéma, chemin ni joker.",
+	errorPort: "{entry} : le port doit être compris entre 1 et 65535.",
+	errorRejectedHost: "{entry} : cet hôte est réservé et ne peut pas être autorisé.",
+	errorIpNotAllowed: "{entry} : utilisez ici un nom d'hôte, pas une adresse IP.",
+	errorDuplicate: "{entry} figure déjà dans la liste.",
+	errorMax: "Vous pouvez ajouter au plus {max} hôtes."
+};
+var virtualMachineAdminTab$2 = {
+	infoBox: "Les agents dotés du Shell de machine virtuelle exécutent du code dans une VM Linux isolée, sans accès réseau par défaut. Les politiques réseau sont des listes réutilisables de destinations hôte:port qu'une VM peut joindre, et les secrets de VM sont des clés que la VM peut utiliser sans jamais les lire. Sélectionnez-les pour un agent depuis ses paramètres Sandbox.",
+	tabsAriaLabel: "Sections de la machine virtuelle",
+	tabNetworkPolicies: "Politiques réseau",
+	tabSecrets: "Secrets",
+	forbidden: "Vous n'avez pas l'autorisation de gérer les politiques réseau ni les secrets des machines virtuelles."
+};
+var virtualMachineNetworkPolicies$2 = {
+	newPolicy: "Nouvelle politique",
+	loadFailed: "Impossible de charger les politiques réseau. Réessayez dans un instant.",
+	colName: "Nom",
+	colHosts: "Hôtes autorisés",
+	colDescription: "Description",
+	colUpdated: "Mise à jour",
+	colActions: "Actions",
+	hostsListAriaLabel: "Hôtes autorisés par {name}",
+	moreHosts: "+{count} de plus",
+	editAriaLabel: "Modifier la politique {name}",
+	deleteAriaLabel: "Supprimer la politique {name}",
+	empty: "Aucune politique réseau pour l'instant. Créez-en une pour que la VM d'un agent puisse joindre des hôtes précis.",
+	createTitle: "Nouvelle politique réseau",
+	editTitle: "Modifier la politique réseau",
+	dialogDescription: "Les destinations hôte:port qu'une VM peut joindre avec cette politique. HTTPS correspond au port 443.",
+	fieldName: "Nom",
+	namePlaceholder: "p. ex. API Acme",
+	fieldHosts: "Hôtes autorisés",
+	hostsHint: "Saisissez hôte:port et appuyez sur Entrée, ou collez une liste. Jusqu'à {max} entrées ; les adresses IP sont acceptées.",
+	removedHostsWarning: "Vous retirez {hosts}. Si un agent utilise cette politique et possède un secret envoyé à l'un de ces hôtes, ce secret cessera de fonctionner.",
+	fieldDescription: "Description (facultatif)",
+	descriptionPlaceholder: "À quoi sert cette politique",
+	cancel: "Annuler",
+	saveChanges: "Enregistrer les modifications",
+	createPolicy: "Créer la politique",
+	errorNameRequired: "Donnez un nom à la politique.",
+	errorHostsRequired: "Ajoutez au moins un hôte.",
+	created: "Politique réseau créée",
+	updated: "Politique réseau mise à jour",
+	deleted: "Politique réseau supprimée",
+	saveFailed: "La politique n'a pas pu être enregistrée. Réessayez.",
+	forbiddenWrite: "Vous n'avez pas l'autorisation de modifier les politiques réseau.",
+	forbiddenDelete: "Vous n'avez pas l'autorisation de supprimer les politiques réseau.",
+	deleteTitle: "Supprimer la politique réseau",
+	deleteConfirm: "Supprimer {name} ? Les agents en profil Personnalisé ne peuvent utiliser que des politiques existantes.",
+	deleteBlockedInUse: "Cette politique est encore utilisée par les agents suivants. Passez-les d'abord sur une autre politique ou un autre profil.",
+	deleteFailed: "La politique n'a pas pu être supprimée. Réessayez.",
+	"delete": "Supprimer"
+};
+var virtualMachineSecrets$2 = {
+	newSecret: "Nouveau secret",
+	loadFailed: "Impossible de charger les secrets de VM. Réessayez dans un instant.",
+	colName: "Nom",
+	colEnvVar: "Variable",
+	colHosts: "Hôtes autorisés",
+	colSource: "Source",
+	colUpdated: "Mis à jour",
+	colActions: "Actions",
+	hostsListAriaLabel: "Hôtes auxquels {name} est envoyé",
+	moreHosts: "+{count} de plus",
+	sourceStored: "Valeur enregistrée",
+	sourceFromCredential: "Identifiant {credential} · {field}",
+	editAriaLabel: "Modifier le secret {name}",
+	deleteAriaLabel: "Supprimer le secret {name}",
+	empty: "Aucun secret de VM pour l'instant. Créez-en un pour qu'un agent appelle une API avec la clé de votre organisation sans jamais la voir.",
+	createTitle: "Nouveau secret de VM",
+	editTitle: "Modifier le secret de VM",
+	dialogDescription: "La valeur n'est plus jamais affichée après l'enregistrement.",
+	fieldName: "Nom",
+	namePlaceholder: "p. ex. Clé API Acme",
+	fieldEnvVar: "Variable d'environnement",
+	envVarPlaceholder: "p. ex. ACME_KEY",
+	envVarHelp: "Lettres, chiffres et tirets bas ; ne peut pas commencer par un chiffre.",
+	envVarReadOnlyHelp: "Ne peut pas être renommée. Supprimez ce secret et créez-en un nouveau.",
+	fieldHosts: "Hôtes autorisés",
+	hostsHint: "Seuls ces hôtes reçoivent la vraie clé ; limitez la liste à l'hôte le plus précis qui en a besoin. Saisissez hôte:port et appuyez sur Entrée.",
+	fieldSource: "Source de la valeur",
+	sourceValue: "Saisir une valeur",
+	sourceValueDescription: "Stockée chiffrée et jamais réaffichée.",
+	sourceCredential: "Utiliser un identifiant d'intégration",
+	sourceCredentialDescription: "Lit un champ d'un identifiant enregistré et suit automatiquement les rotations.",
+	fieldValue: "Valeur",
+	valuePlaceholder: "Collez la clé",
+	valueKeepPlaceholder: "Laissez vide pour conserver la valeur actuelle",
+	valueHelp: "Au moins {min} caractères.",
+	valueKeepHelp: "Laissez vide pour conserver la valeur actuelle.",
+	fieldCredential: "Identifiant d'intégration",
+	credentialPlaceholder: "Choisissez un identifiant",
+	noCredentials: "Votre organisation n'a pas encore d'identifiants d'intégration. Ajoutez-en un dans Intégrations, ou saisissez une valeur.",
+	fieldCredentialField: "Champ de l'identifiant",
+	credentialFieldPlaceholder: "Choisissez un champ",
+	credentialNoFields: "Cet identifiant n'a aucun champ à lire.",
+	cancel: "Annuler",
+	saveChanges: "Enregistrer les modifications",
+	createSecret: "Créer le secret",
+	errorNameRequired: "Donnez un nom au secret.",
+	errorEnvVarRequired: "Saisissez le nom de la variable d'environnement.",
+	errorEnvVarFormat: "Utilisez uniquement des lettres, des chiffres et des tirets bas, sans commencer par un chiffre.",
+	errorHostsRequired: "Ajoutez au moins un hôte.",
+	errorValueRequired: "Saisissez la valeur.",
+	errorValueTooShort: "La valeur doit contenir au moins {min} caractères.",
+	errorValueMasked: "Cela ressemble à une valeur masquée. Collez la vraie clé.",
+	errorCredentialRequired: "Choisissez un identifiant.",
+	errorFieldRequired: "Choisissez le champ de l'identifiant.",
+	created: "Secret de VM créé",
+	updated: "Secret de VM mis à jour",
+	deleted: "Secret de VM supprimé",
+	saveFailed: "Le secret n'a pas pu être enregistré. Réessayez.",
+	forbiddenWrite: "Vous n'avez pas l'autorisation de modifier les secrets de VM.",
+	forbiddenDelete: "Vous n'avez pas l'autorisation de supprimer les secrets de VM.",
+	deleteTitle: "Supprimer le secret de VM",
+	deleteConfirm: "Supprimer {envVar} ? Il sera aussi retiré de tous les agents qui l'utilisent.",
+	deleteFailed: "Le secret n'a pas pu être supprimé. Réessayez.",
+	"delete": "Supprimer"
+};
+var virtualMachineNetworkSection$2 = {
+	title: "Accès réseau",
+	description: "Décidez ce que la machine virtuelle de cet agent peut joindre et quels identifiants elle peut utiliser.",
+	billingNotice: "Le temps de machine virtuelle est facturé sur les crédits de l'utilisateur qui discute : ${usd} par {minutes} minutes par défaut, au prorata de la seconde. Le tarif de votre organisation peut différer.",
+	egressLabel: "Profil de sortie",
+	egressHelp: "Quelle part du réseau la VM obtient.",
+	egressNoneLabel: "Aucun réseau",
+	egressNoneDescription: "La VM ne peut rien joindre.",
+	egressRegistriesLabel: "Registres de paquets",
+	egressRegistriesDescription: "PyPI, npm, apt et apk uniquement, pour installer des paquets.",
+	egressPublicLabel: "Internet public",
+	egressPublicDescription: "Tout hôte public. Les réseaux privés, localhost et les métadonnées cloud restent bloqués.",
+	egressCustomLabel: "Liste personnalisée",
+	egressCustomDescription: "Uniquement les hôtes de la politique réseau choisie ci-dessous.",
+	policyLabel: "Politique réseau",
+	policiesForbidden: "Vous n'avez pas l'autorisation de voir les politiques réseau, ce profil ne peut donc pas être configuré d'ici.",
+	noPolicies: "Aucune politique réseau pour l'instant",
+	policyPlaceholder: "Choisissez une politique",
+	createPolicy: "Créer une politique",
+	editPolicy: "Modifier la politique",
+	managePolicies: "Gérer les politiques",
+	manageSecrets: "Gérer les secrets",
+	policyRequired: "Le profil Personnalisé nécessite une politique réseau.",
+	policyHosts: "Hôtes autorisés par cette politique :",
+	secretsLabel: "Secrets",
+	secretsHelp: "Clés que la VM peut utiliser sans jamais les lire. Jusqu'à {max} par agent.",
+	noSecrets: "Votre organisation n'a pas encore de secrets de VM. Utilisez Gérer les secrets pour en créer un.",
+	secretsCapReached: "Cet agent a atteint le maximum de {max} secrets.",
+	uncoveredTitle: "Certains secrets sont envoyés à des hôtes que cette politique n'autorise pas :",
+	uncoveredItem: "{envVar} a besoin de {hosts}, que {policy} n'autorise pas.",
+	addHostsAndSave: "Ajouter les hôtes à {policy} et enregistrer",
+	saved: "Paramètres réseau enregistrés",
+	saveFailed: "Les paramètres réseau n'ont pas pu être enregistrés. Réessayez.",
+	forbiddenSave: "Vous n'avez pas l'autorisation de modifier ces paramètres.",
+	policyHostsAdded: "Hôtes ajoutés à {policy}",
+	policyUpdateFailed: "La politique n'a pas pu être mise à jour, les paramètres n'ont donc pas été enregistrés.",
+	policyUpdateForbidden: "Vous n'avez pas l'autorisation de modifier les politiques réseau, les paramètres n'ont donc pas été enregistrés.",
+	discard: "Annuler les modifications",
+	save: "Enregistrer les modifications",
+	narrowTitle: "Détacher les secrets ?",
+	narrowDescription: "{profile} ne donne à la VM aucun accès aux hôtes dont ces secrets ont besoin ; l'enregistrement détachera donc {count, plural, one {# secret} other {# secrets}} de cet agent.",
+	cancel: "Annuler",
+	narrowConfirm: "Détacher et enregistrer",
+	manageTitle: "Paramètres de la machine virtuelle",
+	manageDescription: "Les politiques réseau et les secrets de VM sont partagés par tous les agents de votre organisation."
+};
 var fr = {
 	accessTabAddAccess: accessTabAddAccess$2,
 	accessTabLabels: accessTabLabels$2,
@@ -16176,7 +16555,12 @@ var fr = {
 	analyticsCostTabs: analyticsCostTabs$2,
 	analyticsLlmUsage: analyticsLlmUsage$2,
 	analyticsTraces: analyticsTraces$2,
-	profileLlmUsage: profileLlmUsage$2
+	profileLlmUsage: profileLlmUsage$2,
+	virtualMachineHostInput: virtualMachineHostInput$2,
+	virtualMachineAdminTab: virtualMachineAdminTab$2,
+	virtualMachineNetworkPolicies: virtualMachineNetworkPolicies$2,
+	virtualMachineSecrets: virtualMachineSecrets$2,
+	virtualMachineNetworkSection: virtualMachineNetworkSection$2
 };
 
 var accessTabAddAccess$1 = {
@@ -20057,7 +20441,9 @@ var profileAccount$1 = {
 	groupSystem: "Sistema",
 	ariaSettingsNav: "Configuración de la organización",
 	ariaSettingsNavMobile: "Configuración de la organización (móvil)",
-	groupFinance: "Finanzas"
+	groupFinance: "Finanzas",
+	tabVirtualMachine: "Máquina virtual",
+	descVirtualMachine: "Gestiona las políticas de red y los secretos disponibles para las máquinas virtuales de los agentes."
 };
 var profileAddCreditsModal$1 = {
 	title: "Agregar créditos",
@@ -21857,8 +22243,8 @@ var uiSidebar$1 = {
 var userProfileDropdownIndex$1 = {
 	profile: "Perfil",
 	account: "Cuenta",
-	learner: "Estudiante",
-	instructor: "Instructor",
+	learner: "Usuario",
+	instructor: "Administrador",
 	help: "Ayuda",
 	logOut: "Cerrar sesión",
 	moreOptions: "Más opciones"
@@ -23229,6 +23615,177 @@ var profileLlmUsage$1 = {
 	tryAgain: "Intentar de nuevo",
 	scopeUser: "Uso de {username}"
 };
+var virtualMachineHostInput$1 = {
+	listLabel: "Hosts permitidos",
+	removeHost: "Quitar {host}",
+	placeholder: "api.ejemplo.com:443",
+	hint: "Escribe host:puerto y pulsa Intro, o pega una lista.",
+	errorFormat: "{entry} debe tener el formato host:puerto, por ejemplo api.ejemplo.com:443, sin esquema, ruta ni comodín.",
+	errorPort: "{entry}: el puerto debe estar entre 1 y 65535.",
+	errorRejectedHost: "{entry}: este host está reservado y no se puede permitir.",
+	errorIpNotAllowed: "{entry}: usa aquí un nombre de host, no una dirección IP.",
+	errorDuplicate: "{entry} ya está en la lista.",
+	errorMax: "Puedes añadir como máximo {max} hosts."
+};
+var virtualMachineAdminTab$1 = {
+	infoBox: "Los agentes con Shell de máquina virtual ejecutan código en una VM Linux aislada que, por defecto, no tiene acceso a la red. Las políticas de red son listas reutilizables de destinos host:puerto a los que una VM puede llegar, y los secretos de VM son claves que la VM puede usar pero nunca leer. Elígelos para un agente desde su configuración de Sandbox.",
+	tabsAriaLabel: "Secciones de máquina virtual",
+	tabNetworkPolicies: "Políticas de red",
+	tabSecrets: "Secretos",
+	forbidden: "No tienes permiso para gestionar las políticas de red ni los secretos de las máquinas virtuales."
+};
+var virtualMachineNetworkPolicies$1 = {
+	newPolicy: "Nueva política",
+	loadFailed: "No se pudieron cargar las políticas de red. Inténtalo de nuevo en un momento.",
+	colName: "Nombre",
+	colHosts: "Hosts permitidos",
+	colDescription: "Descripción",
+	colUpdated: "Actualizada",
+	colActions: "Acciones",
+	hostsListAriaLabel: "Hosts permitidos por {name}",
+	moreHosts: "+{count} más",
+	editAriaLabel: "Editar la política {name}",
+	deleteAriaLabel: "Eliminar la política {name}",
+	empty: "Todavía no hay políticas de red. Crea una para que la VM de un agente pueda llegar a hosts concretos.",
+	createTitle: "Nueva política de red",
+	editTitle: "Editar política de red",
+	dialogDescription: "Los destinos host:puerto a los que una VM puede llegar con esta política. HTTPS es el puerto 443.",
+	fieldName: "Nombre",
+	namePlaceholder: "p. ej. APIs de Acme",
+	fieldHosts: "Hosts permitidos",
+	hostsHint: "Escribe host:puerto y pulsa Intro, o pega una lista. Hasta {max} entradas; se admiten direcciones IP.",
+	removedHostsWarning: "Vas a quitar {hosts}. Si un agente usa esta política y tiene un secreto que se envía a uno de estos hosts, ese secreto dejará de funcionar.",
+	fieldDescription: "Descripción (opcional)",
+	descriptionPlaceholder: "Para qué sirve esta política",
+	cancel: "Cancelar",
+	saveChanges: "Guardar cambios",
+	createPolicy: "Crear política",
+	errorNameRequired: "Dale un nombre a la política.",
+	errorHostsRequired: "Añade al menos un host.",
+	created: "Política de red creada",
+	updated: "Política de red actualizada",
+	deleted: "Política de red eliminada",
+	saveFailed: "No se pudo guardar la política. Inténtalo de nuevo.",
+	forbiddenWrite: "No tienes permiso para modificar políticas de red.",
+	forbiddenDelete: "No tienes permiso para eliminar políticas de red.",
+	deleteTitle: "Eliminar política de red",
+	deleteConfirm: "¿Eliminar {name}? Los agentes con el perfil Personalizado solo pueden usar políticas que sigan existiendo.",
+	deleteBlockedInUse: "Esta política todavía la usan los siguientes agentes. Cámbialos antes a otra política o perfil.",
+	deleteFailed: "No se pudo eliminar la política. Inténtalo de nuevo.",
+	"delete": "Eliminar"
+};
+var virtualMachineSecrets$1 = {
+	newSecret: "Nuevo secreto",
+	loadFailed: "No se pudieron cargar los secretos de VM. Inténtalo de nuevo en un momento.",
+	colName: "Nombre",
+	colEnvVar: "Variable",
+	colHosts: "Hosts permitidos",
+	colSource: "Origen",
+	colUpdated: "Actualizado",
+	colActions: "Acciones",
+	hostsListAriaLabel: "Hosts a los que se envía {name}",
+	moreHosts: "+{count} más",
+	sourceStored: "Valor guardado",
+	sourceFromCredential: "Credencial {credential} · {field}",
+	editAriaLabel: "Editar el secreto {name}",
+	deleteAriaLabel: "Eliminar el secreto {name}",
+	empty: "Todavía no hay secretos de VM. Crea uno para que un agente llame a una API con la clave de tu organización sin verla nunca.",
+	createTitle: "Nuevo secreto de VM",
+	editTitle: "Editar secreto de VM",
+	dialogDescription: "El valor no vuelve a mostrarse después de guardarlo.",
+	fieldName: "Nombre",
+	namePlaceholder: "p. ej. Clave de la API de Acme",
+	fieldEnvVar: "Variable de entorno",
+	envVarPlaceholder: "p. ej. ACME_KEY",
+	envVarHelp: "Letras, dígitos y guiones bajos; no puede empezar por un dígito.",
+	envVarReadOnlyHelp: "No se puede renombrar. Elimina este secreto y crea uno nuevo.",
+	fieldHosts: "Hosts permitidos",
+	hostsHint: "Solo estos hosts reciben la clave real; limita la lista al host más concreto que la necesite. Escribe host:puerto y pulsa Intro.",
+	fieldSource: "Origen del valor",
+	sourceValue: "Introducir un valor",
+	sourceValueDescription: "Se guarda cifrada y no vuelve a mostrarse.",
+	sourceCredential: "Usar una credencial de integración",
+	sourceCredentialDescription: "Lee un campo de una credencial guardada y sigue las rotaciones automáticamente.",
+	fieldValue: "Valor",
+	valuePlaceholder: "Pega la clave",
+	valueKeepPlaceholder: "Déjalo en blanco para conservar el valor actual",
+	valueHelp: "Al menos {min} caracteres.",
+	valueKeepHelp: "Déjalo en blanco para conservar el valor actual.",
+	fieldCredential: "Credencial de integración",
+	credentialPlaceholder: "Elige una credencial",
+	noCredentials: "Tu organización todavía no tiene credenciales de integración. Añade una en Integraciones o introduce un valor.",
+	fieldCredentialField: "Campo de la credencial",
+	credentialFieldPlaceholder: "Elige un campo",
+	credentialNoFields: "Esta credencial no tiene campos de los que leer.",
+	cancel: "Cancelar",
+	saveChanges: "Guardar cambios",
+	createSecret: "Crear secreto",
+	errorNameRequired: "Dale un nombre al secreto.",
+	errorEnvVarRequired: "Introduce el nombre de la variable de entorno.",
+	errorEnvVarFormat: "Usa solo letras, dígitos y guiones bajos, y no empieces por un dígito.",
+	errorHostsRequired: "Añade al menos un host.",
+	errorValueRequired: "Introduce el valor.",
+	errorValueTooShort: "El valor debe tener al menos {min} caracteres.",
+	errorValueMasked: "Parece un valor enmascarado. Pega la clave real.",
+	errorCredentialRequired: "Elige una credencial.",
+	errorFieldRequired: "Elige el campo de la credencial.",
+	created: "Secreto de VM creado",
+	updated: "Secreto de VM actualizado",
+	deleted: "Secreto de VM eliminado",
+	saveFailed: "No se pudo guardar el secreto. Inténtalo de nuevo.",
+	forbiddenWrite: "No tienes permiso para modificar secretos de VM.",
+	forbiddenDelete: "No tienes permiso para eliminar secretos de VM.",
+	deleteTitle: "Eliminar secreto de VM",
+	deleteConfirm: "¿Eliminar {envVar}? También se quitará de todos los agentes que lo usan.",
+	deleteFailed: "No se pudo eliminar el secreto. Inténtalo de nuevo.",
+	"delete": "Eliminar"
+};
+var virtualMachineNetworkSection$1 = {
+	title: "Acceso a la red",
+	description: "Decide a qué puede llegar la máquina virtual de este agente y qué credenciales puede usar.",
+	billingNotice: "El tiempo de máquina virtual se cobra de los créditos del usuario que chatea: ${usd} por cada {minutes} minutos por defecto, prorrateado por segundo. La tarifa de tu organización puede ser distinta.",
+	egressLabel: "Perfil de salida",
+	egressHelp: "Cuánta red recibe la VM.",
+	egressNoneLabel: "Sin red",
+	egressNoneDescription: "La VM no puede llegar a nada.",
+	egressRegistriesLabel: "Registros de paquetes",
+	egressRegistriesDescription: "Solo PyPI, npm, apt y apk, para instalar paquetes.",
+	egressPublicLabel: "Internet público",
+	egressPublicDescription: "Cualquier host público. Las redes privadas, localhost y los metadatos de la nube siguen bloqueados.",
+	egressCustomLabel: "Lista personalizada",
+	egressCustomDescription: "Solo los hosts de la política de red que elijas abajo.",
+	policyLabel: "Política de red",
+	policiesForbidden: "No tienes permiso para ver las políticas de red, así que este perfil no se puede configurar desde aquí.",
+	noPolicies: "Todavía no hay políticas de red",
+	policyPlaceholder: "Elige una política",
+	createPolicy: "Crear política",
+	editPolicy: "Editar política",
+	managePolicies: "Gestionar políticas",
+	manageSecrets: "Gestionar secretos",
+	policyRequired: "El perfil Personalizado necesita una política de red.",
+	policyHosts: "Hosts que permite esta política:",
+	secretsLabel: "Secretos",
+	secretsHelp: "Claves que la VM puede usar pero nunca leer. Hasta {max} por agente.",
+	noSecrets: "Tu organización todavía no tiene secretos de VM. Usa Gestionar secretos para crear uno.",
+	secretsCapReached: "Este agente tiene el máximo de {max} secretos.",
+	uncoveredTitle: "Algunos secretos se envían a hosts que esta política no permite:",
+	uncoveredItem: "{envVar} necesita {hosts}, y {policy} no lo permite.",
+	addHostsAndSave: "Añadir hosts a {policy} y guardar",
+	saved: "Configuración de red guardada",
+	saveFailed: "No se pudo guardar la configuración de red. Inténtalo de nuevo.",
+	forbiddenSave: "No tienes permiso para cambiar esta configuración.",
+	policyHostsAdded: "Hosts añadidos a {policy}",
+	policyUpdateFailed: "No se pudo actualizar la política, así que la configuración no se guardó.",
+	policyUpdateForbidden: "No tienes permiso para modificar políticas de red, así que la configuración no se guardó.",
+	discard: "Descartar",
+	save: "Guardar cambios",
+	narrowTitle: "¿Desvincular los secretos?",
+	narrowDescription: "{profile} no da a la VM acceso a los hosts que necesitan estos secretos, así que al guardar se {count, plural, one {desvinculará # secreto} other {desvincularán # secretos}} de este agente.",
+	cancel: "Cancelar",
+	narrowConfirm: "Desvincular y guardar",
+	manageTitle: "Configuración de la máquina virtual",
+	manageDescription: "Las políticas de red y los secretos de VM son compartidos por todos los agentes de tu organización."
+};
 var es = {
 	accessTabAddAccess: accessTabAddAccess$1,
 	accessTabLabels: accessTabLabels$1,
@@ -23514,7 +24071,12 @@ var es = {
 	analyticsCostTabs: analyticsCostTabs$1,
 	analyticsLlmUsage: analyticsLlmUsage$1,
 	analyticsTraces: analyticsTraces$1,
-	profileLlmUsage: profileLlmUsage$1
+	profileLlmUsage: profileLlmUsage$1,
+	virtualMachineHostInput: virtualMachineHostInput$1,
+	virtualMachineAdminTab: virtualMachineAdminTab$1,
+	virtualMachineNetworkPolicies: virtualMachineNetworkPolicies$1,
+	virtualMachineSecrets: virtualMachineSecrets$1,
+	virtualMachineNetworkSection: virtualMachineNetworkSection$1
 };
 
 var accessTabAddAccess = {
@@ -27395,7 +27957,9 @@ var profileAccount = {
 	groupSystem: "系统",
 	ariaSettingsNav: "组织设置",
 	ariaSettingsNavMobile: "组织设置（移动端）",
-	groupFinance: "财务"
+	groupFinance: "财务",
+	tabVirtualMachine: "虚拟机",
+	descVirtualMachine: "管理可供智能体虚拟机使用的网络策略和密钥。"
 };
 var profileAddCreditsModal = {
 	title: "添加积分",
@@ -29195,8 +29759,8 @@ var uiSidebar = {
 var userProfileDropdownIndex = {
 	profile: "个人资料",
 	account: "账户",
-	learner: "学习者",
-	instructor: "讲师",
+	learner: "用户",
+	instructor: "管理员",
 	help: "帮助",
 	logOut: "退出登录",
 	moreOptions: "更多选项"
@@ -30567,6 +31131,177 @@ var profileLlmUsage = {
 	tryAgain: "重试",
 	scopeUser: "{username} 的用量"
 };
+var virtualMachineHostInput = {
+	listLabel: "允许的主机",
+	removeHost: "移除 {host}",
+	placeholder: "api.example.com:443",
+	hint: "输入 host:port 并按 Enter，或粘贴列表。",
+	errorFormat: "{entry} 必须为 host:port 格式，例如 api.example.com:443，不能包含协议、路径或通配符。",
+	errorPort: "{entry}：端口必须在 1 到 65535 之间。",
+	errorRejectedHost: "{entry}：此主机为保留主机，不能加入允许列表。",
+	errorIpNotAllowed: "{entry}：此处请使用主机名，而不是 IP 地址。",
+	errorDuplicate: "{entry} 已在列表中。",
+	errorMax: "最多只能添加 {max} 个主机。"
+};
+var virtualMachineAdminTab = {
+	infoBox: "启用了虚拟机 Shell 的智能体会在隔离的 Linux 虚拟机中运行代码，默认没有网络访问权限。网络策略是可复用的 host:port 目标列表，规定虚拟机可以访问的地址；虚拟机密钥是虚拟机可以使用但永远无法读取的密钥。请在智能体的沙箱设置中为其选择。",
+	tabsAriaLabel: "虚拟机设置分区",
+	tabNetworkPolicies: "网络策略",
+	tabSecrets: "密钥",
+	forbidden: "您没有权限管理虚拟机的网络策略或密钥。"
+};
+var virtualMachineNetworkPolicies = {
+	newPolicy: "新建策略",
+	loadFailed: "无法加载网络策略，请稍后重试。",
+	colName: "名称",
+	colHosts: "允许的主机",
+	colDescription: "描述",
+	colUpdated: "更新时间",
+	colActions: "操作",
+	hostsListAriaLabel: "{name} 允许的主机",
+	moreHosts: "还有 {count} 个",
+	editAriaLabel: "编辑策略 {name}",
+	deleteAriaLabel: "删除策略 {name}",
+	empty: "还没有网络策略。创建一个策略，让智能体的虚拟机可以访问指定主机。",
+	createTitle: "新建网络策略",
+	editTitle: "编辑网络策略",
+	dialogDescription: "此策略下虚拟机可以访问的 host:port 目标。HTTPS 使用 443 端口。",
+	fieldName: "名称",
+	namePlaceholder: "例如：Acme API",
+	fieldHosts: "允许的主机",
+	hostsHint: "输入 host:port 并按 Enter，或粘贴列表。最多 {max} 条；允许使用 IP 地址。",
+	removedHostsWarning: "您正在移除 {hosts}。如果某个智能体使用此策略，并且有密钥会发送到这些主机之一，该密钥将无法再使用。",
+	fieldDescription: "描述（可选）",
+	descriptionPlaceholder: "此策略的用途",
+	cancel: "取消",
+	saveChanges: "保存更改",
+	createPolicy: "创建策略",
+	errorNameRequired: "请为策略输入名称。",
+	errorHostsRequired: "请至少添加一个主机。",
+	created: "网络策略已创建",
+	updated: "网络策略已更新",
+	deleted: "网络策略已删除",
+	saveFailed: "无法保存策略，请重试。",
+	forbiddenWrite: "您没有权限修改网络策略。",
+	forbiddenDelete: "您没有权限删除网络策略。",
+	deleteTitle: "删除网络策略",
+	deleteConfirm: "确定删除 {name} 吗？设为“自定义”配置的智能体只能使用仍然存在的策略。",
+	deleteBlockedInUse: "以下智能体仍在使用此策略。请先将它们改为其他策略或配置。",
+	deleteFailed: "无法删除策略，请重试。",
+	"delete": "删除"
+};
+var virtualMachineSecrets = {
+	newSecret: "新建密钥",
+	loadFailed: "无法加载虚拟机密钥，请稍后重试。",
+	colName: "名称",
+	colEnvVar: "变量",
+	colHosts: "允许的主机",
+	colSource: "来源",
+	colUpdated: "更新时间",
+	colActions: "操作",
+	hostsListAriaLabel: "{name} 发送至的主机",
+	moreHosts: "还有 {count} 个",
+	sourceStored: "已存储的值",
+	sourceFromCredential: "凭据 {credential} · {field}",
+	editAriaLabel: "编辑密钥 {name}",
+	deleteAriaLabel: "删除密钥 {name}",
+	empty: "还没有虚拟机密钥。创建一个密钥，让智能体无需看到组织的密钥即可调用 API。",
+	createTitle: "新建虚拟机密钥",
+	editTitle: "编辑虚拟机密钥",
+	dialogDescription: "保存后，该值不会再显示。",
+	fieldName: "名称",
+	namePlaceholder: "例如：Acme API 密钥",
+	fieldEnvVar: "环境变量",
+	envVarPlaceholder: "例如：ACME_KEY",
+	envVarHelp: "只能包含字母、数字和下划线，且不能以数字开头。",
+	envVarReadOnlyHelp: "无法重命名。请删除此密钥并新建一个。",
+	fieldHosts: "允许的主机",
+	hostsHint: "只有这些主机会收到真实密钥，请仅填写需要它的最小范围主机。输入 host:port 并按 Enter。",
+	fieldSource: "值的来源",
+	sourceValue: "输入一个值",
+	sourceValueDescription: "加密存储，之后不再显示。",
+	sourceCredential: "使用集成凭据",
+	sourceCredentialDescription: "读取已保存凭据中的一个字段，并自动跟随凭据轮换。",
+	fieldValue: "值",
+	valuePlaceholder: "粘贴密钥",
+	valueKeepPlaceholder: "留空以保留当前值",
+	valueHelp: "至少 {min} 个字符。",
+	valueKeepHelp: "留空以保留当前值。",
+	fieldCredential: "集成凭据",
+	credentialPlaceholder: "选择一个凭据",
+	noCredentials: "您的组织还没有集成凭据。请在“集成”中添加，或改为输入一个值。",
+	fieldCredentialField: "凭据字段",
+	credentialFieldPlaceholder: "选择一个字段",
+	credentialNoFields: "此凭据没有可读取的字段。",
+	cancel: "取消",
+	saveChanges: "保存更改",
+	createSecret: "创建密钥",
+	errorNameRequired: "请为密钥输入名称。",
+	errorEnvVarRequired: "请输入环境变量名。",
+	errorEnvVarFormat: "只能使用字母、数字和下划线，且不能以数字开头。",
+	errorHostsRequired: "请至少添加一个主机。",
+	errorValueRequired: "请输入值。",
+	errorValueTooShort: "值至少需要 {min} 个字符。",
+	errorValueMasked: "这看起来是打码后的值，请粘贴真实密钥。",
+	errorCredentialRequired: "请选择一个凭据。",
+	errorFieldRequired: "请选择凭据字段。",
+	created: "虚拟机密钥已创建",
+	updated: "虚拟机密钥已更新",
+	deleted: "虚拟机密钥已删除",
+	saveFailed: "无法保存密钥，请重试。",
+	forbiddenWrite: "您没有权限修改虚拟机密钥。",
+	forbiddenDelete: "您没有权限删除虚拟机密钥。",
+	deleteTitle: "删除虚拟机密钥",
+	deleteConfirm: "确定删除 {envVar} 吗？它也会从所有使用它的智能体中移除。",
+	deleteFailed: "无法删除密钥，请重试。",
+	"delete": "删除"
+};
+var virtualMachineNetworkSection = {
+	title: "网络访问",
+	description: "决定此智能体的虚拟机可以访问哪些地址，以及可以使用哪些凭据。",
+	billingNotice: "虚拟机使用时长按聊天用户的积分计费：默认每 {minutes} 分钟 ${usd}，按秒计算。您所在组织的费率可能不同。",
+	egressLabel: "出站配置",
+	egressHelp: "虚拟机可获得的网络访问范围。",
+	egressNoneLabel: "无网络",
+	egressNoneDescription: "虚拟机无法访问任何地址。",
+	egressRegistriesLabel: "软件包仓库",
+	egressRegistriesDescription: "仅限 PyPI、npm、apt 和 apk，用于安装软件包。",
+	egressPublicLabel: "公共互联网",
+	egressPublicDescription: "任何公共主机。私有网络、localhost 和云元数据仍被阻止。",
+	egressCustomLabel: "自定义允许列表",
+	egressCustomDescription: "仅限下方所选网络策略中的主机。",
+	policyLabel: "网络策略",
+	policiesForbidden: "您没有权限查看网络策略，因此无法在此处配置该选项。",
+	noPolicies: "还没有网络策略",
+	policyPlaceholder: "选择一个策略",
+	createPolicy: "创建策略",
+	editPolicy: "编辑策略",
+	managePolicies: "管理策略",
+	manageSecrets: "管理密钥",
+	policyRequired: "“自定义”配置需要一个网络策略。",
+	policyHosts: "此策略允许的主机：",
+	secretsLabel: "密钥",
+	secretsHelp: "虚拟机可以使用但永远无法读取的密钥。每个智能体最多 {max} 个。",
+	noSecrets: "您的组织还没有虚拟机密钥。请使用“管理密钥”创建一个。",
+	secretsCapReached: "此智能体已达到 {max} 个密钥的上限。",
+	uncoveredTitle: "部分密钥会发送到此策略不允许的主机：",
+	uncoveredItem: "{envVar} 需要 {hosts}，但 {policy} 不允许。",
+	addHostsAndSave: "将主机添加到 {policy} 并保存",
+	saved: "网络设置已保存",
+	saveFailed: "无法保存网络设置，请重试。",
+	forbiddenSave: "您没有权限修改这些设置。",
+	policyHostsAdded: "主机已添加到 {policy}",
+	policyUpdateFailed: "无法更新策略，因此设置未保存。",
+	policyUpdateForbidden: "您没有权限修改网络策略，因此设置未保存。",
+	discard: "放弃更改",
+	save: "保存更改",
+	narrowTitle: "解除密钥绑定？",
+	narrowDescription: "{profile} 不允许虚拟机访问这些密钥所需的主机，因此保存后将从此智能体解除 {count, plural, one {# 个密钥} other {# 个密钥}} 的绑定。",
+	cancel: "取消",
+	narrowConfirm: "解除绑定并保存",
+	manageTitle: "虚拟机设置",
+	manageDescription: "网络策略和虚拟机密钥由您组织中的所有智能体共享。"
+};
 var zh = {
 	accessTabAddAccess: accessTabAddAccess,
 	accessTabLabels: accessTabLabels,
@@ -30852,7 +31587,12 @@ var zh = {
 	analyticsCostTabs: analyticsCostTabs,
 	analyticsLlmUsage: analyticsLlmUsage,
 	analyticsTraces: analyticsTraces,
-	profileLlmUsage: profileLlmUsage
+	profileLlmUsage: profileLlmUsage,
+	virtualMachineHostInput: virtualMachineHostInput,
+	virtualMachineAdminTab: virtualMachineAdminTab,
+	virtualMachineNetworkPolicies: virtualMachineNetworkPolicies,
+	virtualMachineSecrets: virtualMachineSecrets,
+	virtualMachineNetworkSection: virtualMachineNetworkSection
 };
 
 /**
@@ -200358,6 +201098,686 @@ function MemoryAdminTab({ tenantKey, username }) {
     return (jsxs(Tabs, { defaultValue: "global-memories", "aria-label": t('memoryAdminTab.tabsAriaLabel'), children: [jsxs(TabsList, { "aria-label": t('memoryAdminTab.tabsAriaLabel'), className: "max-w-full overflow-x-auto justify-start px-1", children: [jsx(TabsTrigger, { "data-testid": "memory-admin-sub-tab-global", value: "global-memories", children: t('memoryAdminTab.tabGlobalMemories') }), jsx(TabsTrigger, { "data-testid": "memory-admin-sub-tab-agent", value: "agent-memories", children: t('memoryAdminTab.tabAgentMemories') })] }), jsx(TabsContent, { className: "mt-4", value: "global-memories", children: jsx(GlobalMemoriesSection, { tenantKey: tenantKey, username: username }) }), jsx(TabsContent, { className: "mt-4", value: "agent-memories", children: jsx(AgentMemoriesSection, { tenantKey: tenantKey, username: username }) })] }));
 }
 
+const ISSUE_KEYS = {
+    format: 'virtualMachineHostInput.errorFormat',
+    port: 'virtualMachineHostInput.errorPort',
+    rejected_host: 'virtualMachineHostInput.errorRejectedHost',
+    ip_not_allowed: 'virtualMachineHostInput.errorIpNotAllowed',
+};
+/**
+ * A chip (tag) input for `host:port` allowlists. Entries are added with Enter,
+ * comma or space, or by pasting a list; each is checked client-side
+ * (`validateHostPort`) before it becomes a chip, and invalid ones stay in the
+ * box with the reason announced through a polite live region. Backspace on an
+ * empty box removes the last chip; every chip has a labelled remove button so
+ * the whole control works from the keyboard.
+ */
+function HostPortChipInput({ id, value, onChange, allowIpAddresses = false, maxEntries, disabled = false, placeholder, describedBy, error, listLabel, hint, testId, }) {
+    var _a;
+    const t = useT();
+    const generatedId = useId$2();
+    const hintId = `${generatedId}-hint`;
+    const errorId = `${generatedId}-error`;
+    const [draft, setDraft] = useState('');
+    const [localError, setLocalError] = useState(null);
+    const message = (_a = localError !== null && localError !== void 0 ? localError : error) !== null && _a !== void 0 ? _a : null;
+    /**
+     * Turn the typed / pasted text into chips. Valid entries are appended;
+     * whatever failed stays in the box, with the first problem explained.
+     */
+    const commit = (text) => {
+        const entries = splitHostPortInput(text);
+        if (entries.length === 0) {
+            setDraft('');
+            return;
+        }
+        const next = [...value];
+        const leftover = [];
+        let problem = null;
+        for (const entry of entries) {
+            if (next.includes(entry)) {
+                problem !== null && problem !== void 0 ? problem : (problem = t('virtualMachineHostInput.errorDuplicate', { entry }));
+                continue;
+            }
+            const issue = validateHostPort(entry, { allowIpAddresses });
+            if (issue) {
+                problem !== null && problem !== void 0 ? problem : (problem = t(ISSUE_KEYS[issue], { entry }));
+                leftover.push(entry);
+                continue;
+            }
+            if (maxEntries !== undefined && next.length >= maxEntries) {
+                problem !== null && problem !== void 0 ? problem : (problem = t('virtualMachineHostInput.errorMax', { max: maxEntries }));
+                leftover.push(entry);
+                continue;
+            }
+            next.push(entry);
+        }
+        if (next.length !== value.length)
+            onChange(next);
+        setDraft(leftover.join(' '));
+        setLocalError(problem);
+    };
+    const remove = (host) => {
+        onChange(value.filter((entry) => entry !== host));
+    };
+    const handleKeyDown = (event) => {
+        if (event.key === 'Enter' || event.key === ',' || event.key === ' ') {
+            event.preventDefault();
+            commit(draft);
+        }
+        else if (event.key === 'Backspace' && draft === '' && value.length > 0) {
+            event.preventDefault();
+            remove(value[value.length - 1]);
+        }
+        else if (event.key === 'Escape' && (draft !== '' || localError)) {
+            event.preventDefault();
+            setDraft('');
+            setLocalError(null);
+        }
+    };
+    const handlePaste = (event) => {
+        const pasted = event.clipboardData.getData('text');
+        if (!pasted)
+            return;
+        event.preventDefault();
+        commit(`${draft} ${pasted}`);
+    };
+    return (jsxs("div", { className: "space-y-2", "data-testid": testId, children: [value.length > 0 && (jsx("ul", { role: "list", "aria-label": listLabel !== null && listLabel !== void 0 ? listLabel : t('virtualMachineHostInput.listLabel'), className: "flex flex-wrap gap-2", children: value.map((host) => (jsxs("li", { className: "inline-flex items-center gap-1 rounded-md border border-gray-200 bg-gray-50 py-0.5 pr-1 pl-2 font-mono text-xs text-gray-700", children: [jsx("span", { children: host }), !disabled && (jsx("button", { type: "button", onClick: () => remove(host), "aria-label": t('virtualMachineHostInput.removeHost', { host }), className: "cursor-pointer rounded p-0.5 text-gray-400 hover:text-gray-700 focus:outline-none focus-visible:ring-2 focus-visible:ring-blue-500", children: jsx(X$1, { className: "h-3 w-3", "aria-hidden": "true" }) }))] }, host))) })), jsx(Input, { id: id, type: "text", value: draft, disabled: disabled, placeholder: placeholder !== null && placeholder !== void 0 ? placeholder : t('virtualMachineHostInput.placeholder'), autoComplete: "off", autoCapitalize: "off", spellCheck: false, onChange: (event) => {
+                    setDraft(event.target.value);
+                    if (localError)
+                        setLocalError(null);
+                }, onKeyDown: handleKeyDown, onPaste: handlePaste, onBlur: () => {
+                    if (draft.trim())
+                        commit(draft);
+                }, "aria-invalid": message ? true : undefined, "aria-describedby": [describedBy, hintId, errorId].filter(Boolean).join(' ') }), jsx("p", { id: hintId, className: "text-xs text-gray-500", children: hint !== null && hint !== void 0 ? hint : t('virtualMachineHostInput.hint') }), jsx("p", { id: errorId, "aria-live": "polite", className: cn(message ? 'text-xs text-red-600' : 'sr-only'), children: message })] }));
+}
+
+const NAME_MAX_LENGTH$1 = 255;
+/**
+ * Create / edit form for a virtual-machine network policy: a name (unique in
+ * the org), 1–100 `host:port` entries and an optional description. Backend
+ * 400s land next to the matching field or, for a plain-string `error`, as a
+ * form-level message. On edit, only the fields that changed are sent
+ * (`allowed_hosts` always replaces the whole list), and removing a host warns
+ * that a bound secret which needs it would stop working — the backend does
+ * not block that edit.
+ */
+function NetworkPolicyDialog({ open, onOpenChange, tenantKey, policy = null, onSaved, }) {
+    const t = useT();
+    const baseId = useId$2();
+    const nameId = `${baseId}-name`;
+    const hostsId = `${baseId}-hosts`;
+    const descriptionId = `${baseId}-description`;
+    const [createPolicy, { isLoading: isCreating }] = useCreateVirtualMachineNetworkPolicyMutation();
+    const [updatePolicy, { isLoading: isUpdating }] = useUpdateVirtualMachineNetworkPolicyMutation();
+    const isSaving = isCreating || isUpdating;
+    const [name, setName] = useState('');
+    const [hosts, setHosts] = useState([]);
+    const [description, setDescription] = useState('');
+    const [fieldErrors, setFieldErrors] = useState({});
+    const [formError, setFormError] = useState(null);
+    // Start from the policy being edited (or blank) every time the dialog opens.
+    useEffect(() => {
+        var _a, _b, _c;
+        if (!open)
+            return;
+        setName((_a = policy === null || policy === void 0 ? void 0 : policy.name) !== null && _a !== void 0 ? _a : '');
+        setHosts((_b = policy === null || policy === void 0 ? void 0 : policy.allowed_hosts) !== null && _b !== void 0 ? _b : []);
+        setDescription((_c = policy === null || policy === void 0 ? void 0 : policy.description) !== null && _c !== void 0 ? _c : '');
+        setFieldErrors({});
+        setFormError(null);
+    }, [open, policy]);
+    const isEdit = policy !== null;
+    const removedHosts = isEdit ? policy.allowed_hosts.filter((host) => !hosts.includes(host)) : [];
+    const handleSubmit = async (event) => {
+        var _a;
+        event.preventDefault();
+        const trimmedName = name.trim();
+        const trimmedDescription = description.trim();
+        const clientErrors = {};
+        if (!trimmedName)
+            clientErrors.name = t('virtualMachineNetworkPolicies.errorNameRequired');
+        if (hosts.length === 0) {
+            clientErrors.allowed_hosts = t('virtualMachineNetworkPolicies.errorHostsRequired');
+        }
+        setFieldErrors(clientErrors);
+        setFormError(null);
+        if (Object.keys(clientErrors).length > 0)
+            return;
+        try {
+            let saved;
+            if (isEdit) {
+                const body = { id: policy.id };
+                if (trimmedName !== policy.name)
+                    body.name = trimmedName;
+                if (hosts.length !== policy.allowed_hosts.length ||
+                    hosts.some((host, index) => host !== policy.allowed_hosts[index])) {
+                    body.allowed_hosts = hosts;
+                }
+                if (trimmedDescription !== ((_a = policy.description) !== null && _a !== void 0 ? _a : ''))
+                    body.description = trimmedDescription;
+                if (Object.keys(body).length === 1) {
+                    onOpenChange(false);
+                    return;
+                }
+                saved = await updatePolicy({ org: tenantKey, body }).unwrap();
+                toast.success(t('virtualMachineNetworkPolicies.updated'));
+            }
+            else {
+                saved = await createPolicy({
+                    org: tenantKey,
+                    body: { name: trimmedName, allowed_hosts: hosts, description: trimmedDescription },
+                }).unwrap();
+                toast.success(t('virtualMachineNetworkPolicies.created'));
+            }
+            onSaved === null || onSaved === void 0 ? void 0 : onSaved(saved);
+            onOpenChange(false);
+        }
+        catch (error) {
+            const parsed = getVirtualMachineApiError(error);
+            if (parsed.status === 403) {
+                setFormError(t('virtualMachineNetworkPolicies.forbiddenWrite'));
+                return;
+            }
+            const nextErrors = {};
+            let unmatched = [];
+            for (const [field, messages] of Object.entries(parsed.fieldErrors)) {
+                if (field === 'name' || field === 'allowed_hosts' || field === 'description') {
+                    nextErrors[field] = messages.join(' ');
+                }
+                else {
+                    unmatched = unmatched.concat(messages);
+                }
+            }
+            setFieldErrors(nextErrors);
+            const message = [parsed.message, ...unmatched].filter(Boolean).join(' ');
+            if (message) {
+                setFormError(message);
+            }
+            else if (Object.keys(nextErrors).length === 0) {
+                setFormError(t('virtualMachineNetworkPolicies.saveFailed'));
+            }
+        }
+    };
+    return (jsx(Dialog, { open: open, onOpenChange: (next) => !isSaving && onOpenChange(next), children: jsxs(DialogContent, { className: "max-h-[90vh] w-full max-w-lg overflow-y-auto", "data-testid": "network-policy-dialog", children: [jsxs(DialogHeader, { children: [jsx(DialogTitle, { className: "ibl-dialog-title", children: isEdit
+                                ? t('virtualMachineNetworkPolicies.editTitle')
+                                : t('virtualMachineNetworkPolicies.createTitle') }), jsx(DialogDescription, { children: t('virtualMachineNetworkPolicies.dialogDescription') })] }), jsxs("form", { onSubmit: handleSubmit, noValidate: true, className: "mt-1 grid gap-5", children: [formError && (jsx("div", { role: "alert", "data-testid": "network-policy-form-error", className: "rounded-md border border-red-200 bg-red-50 px-3 py-2 text-sm text-red-700", children: formError })), jsxs("div", { className: "space-y-1.5", children: [jsx(Label$2, { htmlFor: nameId, className: "flex items-center text-sm font-medium text-[#646464]", children: t('virtualMachineNetworkPolicies.fieldName') }), jsx(Input, { id: nameId, value: name, maxLength: NAME_MAX_LENGTH$1, onChange: (event) => setName(event.target.value), placeholder: t('virtualMachineNetworkPolicies.namePlaceholder'), "aria-invalid": fieldErrors.name ? true : undefined, "aria-describedby": fieldErrors.name ? `${nameId}-error` : undefined, required: true }), fieldErrors.name && (jsx("p", { id: `${nameId}-error`, role: "alert", className: "text-xs text-red-600", children: fieldErrors.name }))] }), jsxs("div", { className: "space-y-1.5", children: [jsx(Label$2, { htmlFor: hostsId, className: "flex items-center text-sm font-medium text-[#646464]", children: t('virtualMachineNetworkPolicies.fieldHosts') }), jsx(HostPortChipInput, { id: hostsId, value: hosts, onChange: setHosts, allowIpAddresses: true, maxEntries: VIRTUAL_MACHINE_MAX_POLICY_HOSTS, hint: t('virtualMachineNetworkPolicies.hostsHint', {
+                                        max: VIRTUAL_MACHINE_MAX_POLICY_HOSTS,
+                                    }), error: fieldErrors.allowed_hosts, testId: "network-policy-hosts" }), removedHosts.length > 0 && (jsxs("div", { role: "status", "data-testid": "network-policy-removed-hosts-warning", className: "flex items-start gap-2 rounded-md border border-amber-200 bg-amber-50 px-3 py-2 text-xs text-amber-800", children: [jsx(TriangleAlert, { className: "mt-0.5 h-4 w-4 shrink-0", "aria-hidden": "true" }), jsx("span", { children: t('virtualMachineNetworkPolicies.removedHostsWarning', {
+                                                hosts: removedHosts.join(', '),
+                                            }) })] }))] }), jsxs("div", { className: "space-y-1.5", children: [jsx(Label$2, { htmlFor: descriptionId, className: "flex items-center text-sm font-medium text-[#646464]", children: t('virtualMachineNetworkPolicies.fieldDescription') }), jsx(Textarea, { id: descriptionId, value: description, rows: 2, onChange: (event) => setDescription(event.target.value), placeholder: t('virtualMachineNetworkPolicies.descriptionPlaceholder'), "aria-invalid": fieldErrors.description ? true : undefined, "aria-describedby": fieldErrors.description ? `${descriptionId}-error` : undefined }), fieldErrors.description && (jsx("p", { id: `${descriptionId}-error`, role: "alert", className: "text-xs text-red-600", children: fieldErrors.description }))] }), jsxs(DialogFooter, { children: [jsx(Button$1, { type: "button", variant: "outline", onClick: () => onOpenChange(false), disabled: isSaving, children: t('virtualMachineNetworkPolicies.cancel') }), jsxs(Button$1, { type: "submit", disabled: isSaving, "data-testid": "network-policy-save", className: "bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: [isSaving && jsx(LoaderCircle, { className: "h-4 w-4 animate-spin", "aria-hidden": "true" }), isEdit
+                                            ? t('virtualMachineNetworkPolicies.saveChanges')
+                                            : t('virtualMachineNetworkPolicies.createPolicy')] })] })] })] }) }));
+}
+
+const HOST_PREVIEW_COUNT$1 = 3;
+/** Placeholder swapped for the inline record in the delete sentence. */
+const RECORD_SLOT$1 = '__record__';
+const MENTOR_LOOKUP_LIMIT = 100;
+/** "3 days ago" for a backend timestamp, or a dash when it is unusable. */
+function relativeTime$1(value) {
+    const date = new Date(value);
+    return Number.isNaN(date.getTime()) ? '—' : formatDistanceToNow(date, { addSuffix: true });
+}
+/**
+ * Network policies table with create / edit / delete. Deleting a policy an
+ * agent still uses is refused by the backend; the refusal names the agents,
+ * which are listed (by name where the tenant agent list resolves them, else
+ * by id) so the admin knows what to move off it first.
+ */
+function NetworkPoliciesSection({ tenantKey, username, policies, isLoading, isError, }) {
+    var _a;
+    const t = useT();
+    const [dialogOpen, setDialogOpen] = useState(false);
+    const [editingPolicy, setEditingPolicy] = useState(null);
+    const [deletingPolicy, setDeletingPolicy] = useState(null);
+    const [deleteFailure, setDeleteFailure] = useState(null);
+    const [deletePolicy, { isLoading: isDeleting }] = useDeleteVirtualMachineNetworkPolicyMutation();
+    const boundMentorIds = (_a = deleteFailure === null || deleteFailure === void 0 ? void 0 : deleteFailure.boundMentorIds) !== null && _a !== void 0 ? _a : [];
+    // Best-effort names for the agents named in a refused delete.
+    const { data: mentorsData } = useGetMentorsQuery({ org: tenantKey, username: username !== null && username !== void 0 ? username : '', limit: MENTOR_LOOKUP_LIMIT }, { skip: !username || boundMentorIds.length === 0 });
+    const mentorNames = useMemo(() => {
+        const names = new Map();
+        const results = mentorsData === null || mentorsData === void 0 ? void 0 : mentorsData.results;
+        for (const mentor of results !== null && results !== void 0 ? results : []) {
+            if (mentor.unique_id && mentor.name)
+                names.set(mentor.unique_id, mentor.name);
+        }
+        return names;
+    }, [mentorsData]);
+    // The translated sentence with the policy name rendered inline, whatever the word order.
+    const [deleteConfirmBefore, deleteConfirmAfter] = t('virtualMachineNetworkPolicies.deleteConfirm', {
+        name: RECORD_SLOT$1,
+    }).split(RECORD_SLOT$1);
+    const openCreate = () => {
+        setEditingPolicy(null);
+        setDialogOpen(true);
+    };
+    const openEdit = (policy) => {
+        setEditingPolicy(policy);
+        setDialogOpen(true);
+    };
+    const openDelete = (policy) => {
+        setDeleteFailure(null);
+        setDeletingPolicy(policy);
+    };
+    const handleDelete = async (policy) => {
+        var _a;
+        try {
+            await deletePolicy({ org: tenantKey, id: policy.id }).unwrap();
+            toast.success(t('virtualMachineNetworkPolicies.deleted'));
+            setDeletingPolicy(null);
+        }
+        catch (error) {
+            const parsed = getVirtualMachineApiError(error);
+            const boundIds = extractBoundMentorIds(parsed.message);
+            setDeleteFailure({
+                message: parsed.status === 403
+                    ? t('virtualMachineNetworkPolicies.forbiddenDelete')
+                    : boundIds.length > 0
+                        ? t('virtualMachineNetworkPolicies.deleteBlockedInUse')
+                        : ((_a = parsed.message) !== null && _a !== void 0 ? _a : t('virtualMachineNetworkPolicies.deleteFailed')),
+                boundMentorIds: boundIds,
+            });
+        }
+    };
+    return (jsxs("div", { "data-testid": "vm-network-policies-section", className: "space-y-4", children: [jsx("div", { className: "flex justify-end", children: jsxs(Button$1, { size: "sm", onClick: openCreate, "data-testid": "vm-network-policy-new", className: "cursor-pointer bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: [jsx(Plus, { className: "h-4 w-4", "aria-hidden": "true" }), t('virtualMachineNetworkPolicies.newPolicy')] }) }), isLoading ? (jsx("div", { className: "flex h-40 items-center justify-center", children: jsx(Spinner, {}) })) : isError ? (jsx("div", { role: "alert", className: "rounded-lg border border-red-200 bg-red-50 px-6 py-6 text-center text-sm text-red-700", children: t('virtualMachineNetworkPolicies.loadFailed') })) : (jsx("div", { className: "overflow-x-auto rounded-lg border border-gray-200 bg-white dark:border-gray-700 dark:bg-gray-800", children: jsxs("table", { className: "w-full text-sm", children: [jsx("thead", { className: "border-b border-gray-200 bg-gray-50 dark:border-gray-600 dark:bg-gray-700", children: jsxs("tr", { children: [jsx("th", { className: "px-6 py-3 text-left font-medium text-gray-500 dark:text-gray-400", children: t('virtualMachineNetworkPolicies.colName') }), jsx("th", { className: "px-6 py-3 text-left font-medium text-gray-500 dark:text-gray-400", children: t('virtualMachineNetworkPolicies.colHosts') }), jsx("th", { className: "px-6 py-3 text-left font-medium text-gray-500 dark:text-gray-400", children: t('virtualMachineNetworkPolicies.colDescription') }), jsx("th", { className: "px-6 py-3 text-left font-medium whitespace-nowrap text-gray-500 dark:text-gray-400", children: t('virtualMachineNetworkPolicies.colUpdated') }), jsx("th", { className: "px-6 py-3 text-right font-medium text-gray-500 dark:text-gray-400", children: t('virtualMachineNetworkPolicies.colActions') })] }) }), jsxs("tbody", { className: "divide-y divide-gray-200 dark:divide-gray-600", children: [policies.map((policy) => {
+                                    const preview = policy.allowed_hosts.slice(0, HOST_PREVIEW_COUNT$1);
+                                    const remaining = policy.allowed_hosts.length - preview.length;
+                                    return (jsxs("tr", { "data-testid": `vm-network-policy-row-${policy.id}`, children: [jsx("td", { className: "px-6 py-4 font-medium text-gray-900 dark:text-gray-100", children: policy.name }), jsx("td", { className: "px-6 py-4", children: jsxs("ul", { role: "list", "aria-label": t('virtualMachineNetworkPolicies.hostsListAriaLabel', {
+                                                        name: policy.name,
+                                                    }), className: "flex flex-wrap gap-1", children: [preview.map((host) => (jsx("li", { className: "rounded-md border border-gray-200 bg-gray-50 px-2 py-0.5 font-mono text-xs text-gray-700", children: host }, host))), remaining > 0 && (jsx("li", { className: "px-1 py-0.5 text-xs text-gray-500", children: t('virtualMachineNetworkPolicies.moreHosts', { count: remaining }) }))] }) }), jsx("td", { className: "max-w-0 px-6 py-4 text-gray-600 dark:text-gray-300", children: jsx("div", { className: "truncate", children: policy.description || '—' }) }), jsx("td", { className: "px-6 py-4 whitespace-nowrap text-gray-600 dark:text-gray-300", children: relativeTime$1(policy.updated_at) }), jsx("td", { className: "px-6 py-4", children: jsxs("div", { className: "flex justify-end gap-1", children: [jsx(Button$1, { variant: "ghost", size: "sm", onClick: () => openEdit(policy), "aria-label": t('virtualMachineNetworkPolicies.editAriaLabel', {
+                                                                name: policy.name,
+                                                            }), "data-testid": `vm-network-policy-edit-${policy.id}`, children: jsx(Pencil, { className: "h-4 w-4", "aria-hidden": "true" }) }), jsx(Button$1, { variant: "ghost", size: "sm", onClick: () => openDelete(policy), "aria-label": t('virtualMachineNetworkPolicies.deleteAriaLabel', {
+                                                                name: policy.name,
+                                                            }), "data-testid": `vm-network-policy-delete-${policy.id}`, className: "text-red-600 hover:text-red-700", children: jsx(Trash2, { className: "h-4 w-4", "aria-hidden": "true" }) })] }) })] }, policy.id));
+                                }), policies.length === 0 && (jsx("tr", { children: jsx("td", { colSpan: 5, className: "px-6 py-8 text-center text-gray-500 dark:text-gray-400", children: t('virtualMachineNetworkPolicies.empty') }) }))] })] }) })), jsx(NetworkPolicyDialog, { open: dialogOpen, onOpenChange: setDialogOpen, tenantKey: tenantKey, policy: editingPolicy }), jsx(Dialog, { open: deletingPolicy !== null, onOpenChange: (open) => {
+                    if (!open && !isDeleting) {
+                        setDeletingPolicy(null);
+                        setDeleteFailure(null);
+                    }
+                }, children: jsxs(DialogContent, { className: "max-w-md", "data-testid": "vm-network-policy-delete-dialog", children: [jsx(DialogHeader, { children: jsx(DialogTitle, { children: t('virtualMachineNetworkPolicies.deleteTitle') }) }), jsxs(DialogDescription, { className: "text-gray-600", children: [deleteConfirmBefore, jsx("span", { className: "font-medium text-gray-900", children: deletingPolicy === null || deletingPolicy === void 0 ? void 0 : deletingPolicy.name }), deleteConfirmAfter] }), deleteFailure && (jsxs("div", { role: "alert", "data-testid": "vm-network-policy-delete-error", className: "space-y-2 rounded-md border border-red-200 bg-red-50 px-3 py-2 text-sm text-red-700", children: [jsx("p", { children: deleteFailure.message }), boundMentorIds.length > 0 && (jsx("ul", { role: "list", className: "list-disc space-y-0.5 pl-5", children: boundMentorIds.map((id) => {
+                                        var _a;
+                                        return (jsx("li", { children: (_a = mentorNames.get(id)) !== null && _a !== void 0 ? _a : id }, id));
+                                    }) }))] })), jsxs(DialogFooter, { className: "pt-2", children: [jsx(Button$1, { type: "button", variant: "outline", disabled: isDeleting, onClick: () => {
+                                        setDeletingPolicy(null);
+                                        setDeleteFailure(null);
+                                    }, children: t('virtualMachineNetworkPolicies.cancel') }), boundMentorIds.length === 0 && deletingPolicy && (jsxs(Button$1, { type: "button", onClick: () => void handleDelete(deletingPolicy), disabled: isDeleting, "data-testid": "vm-network-policy-delete-confirm", className: "cursor-pointer bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: [isDeleting && jsx(LoaderCircle, { className: "h-4 w-4 animate-spin", "aria-hidden": "true" }), t('virtualMachineNetworkPolicies.delete')] }))] })] }) })] }));
+}
+
+function fieldKeys(value) {
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+        return Object.keys(value);
+    }
+    // Some serialisers hand the masked value back as a JSON string.
+    if (typeof value === 'string') {
+        try {
+            return fieldKeys(JSON.parse(value));
+        }
+        catch (_a) {
+            return [];
+        }
+    }
+    return [];
+}
+/**
+ * Normalise the integration-credential list response into picker options.
+ * Tolerates a bare array or a `{ results }` / `{ data }` wrapper, and drops
+ * rows without a numeric id.
+ */
+function toIntegrationCredentialOptions(data) {
+    var _a, _b;
+    const rows = Array.isArray(data)
+        ? data
+        : data && typeof data === 'object'
+            ? ((_b = (_a = data.results) !== null && _a !== void 0 ? _a : data.data) !== null && _b !== void 0 ? _b : [])
+            : [];
+    const options = [];
+    for (const row of rows) {
+        if (!row || typeof row !== 'object')
+            continue;
+        const { id, name, value } = row;
+        if (typeof id !== 'number')
+            continue;
+        options.push({
+            id,
+            name: typeof name === 'string' && name ? name : String(id),
+            fields: fieldKeys(value),
+        });
+    }
+    return options.sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/**
+ * Radio items in the virtual-machine forms use the same blue as the sandbox
+ * switches (`data-[state=checked]:bg-blue-500`) so the selected option reads
+ * as "on" like the toggles around it. The indicator is an inner svg, hence the
+ * descendant variants.
+ */
+const BLUE_RADIO_ITEM_CLASS = 'mt-0.5 border-gray-300 text-blue-500 data-[state=checked]:border-blue-500 [&_svg]:fill-blue-500 [&_svg]:text-blue-500';
+/** Checkboxes beside those radios: the same grey border while unchecked, the same blue when checked. */
+const BLUE_CHECKBOX_CLASS = 'mt-0.5 border-gray-300 data-[state=checked]:border-blue-500';
+
+const FIELD_NAMES = [
+    'name',
+    'env_var',
+    'allow_hosts',
+    'value',
+    'source_credential_id',
+    'source_field',
+];
+const NAME_MAX_LENGTH = 255;
+const ENV_VAR_MAX_LENGTH = 128;
+/** Values that look masked (`sk-****`) are rejected by the backend too. */
+const MASKED_VALUE_PATTERN = /\*{3,}/;
+/**
+ * Create / edit form for a VM secret. A secret gets its value in one of two
+ * ways, offered as a choice: the admin pastes a key (stored, min 8
+ * characters), or the secret points at one field of an integration
+ * credential the org already saved and reads it at run time. No endpoint ever
+ * returns the value, so the field is never prefilled — on edit it stays blank
+ * to keep the current value — and `env_var` is read-only once created (delete
+ * and recreate to rename). Backend 400s land next to the matching field or as
+ * a form-level message.
+ */
+function VmSecretDialog({ open, onOpenChange, tenantKey, secret = null, credentials, onSaved, }) {
+    var _a;
+    const t = useT();
+    const baseId = useId$2();
+    const ids = {
+        name: `${baseId}-name`,
+        envVar: `${baseId}-env-var`,
+        envVarHelp: `${baseId}-env-var-help`,
+        hosts: `${baseId}-hosts`,
+        source: `${baseId}-source`,
+        sourceValue: `${baseId}-source-value`,
+        sourceCredential: `${baseId}-source-credential`,
+        value: `${baseId}-value`,
+        valueHelp: `${baseId}-value-help`,
+        credential: `${baseId}-credential`,
+        credentialLabel: `${baseId}-credential-label`,
+        field: `${baseId}-field`,
+        fieldLabel: `${baseId}-field-label`,
+    };
+    const [createSecret, { isLoading: isCreating }] = useCreateVirtualMachineSecretMutation();
+    const [updateSecret, { isLoading: isUpdating }] = useUpdateVirtualMachineSecretMutation();
+    const isSaving = isCreating || isUpdating;
+    const [name, setName] = useState('');
+    const [envVar, setEnvVar] = useState('');
+    const [hosts, setHosts] = useState([]);
+    const [source, setSource] = useState('value');
+    const [value, setValue] = useState('');
+    const [credentialId, setCredentialId] = useState('');
+    const [field, setField] = useState('');
+    const [fieldErrors, setFieldErrors] = useState({});
+    const [formError, setFormError] = useState(null);
+    // Start from the secret being edited (or blank) every time the dialog
+    // opens. The value is deliberately never prefilled.
+    useEffect(() => {
+        var _a, _b, _c, _d;
+        if (!open)
+            return;
+        setName((_a = secret === null || secret === void 0 ? void 0 : secret.name) !== null && _a !== void 0 ? _a : '');
+        setEnvVar((_b = secret === null || secret === void 0 ? void 0 : secret.env_var) !== null && _b !== void 0 ? _b : '');
+        setHosts((_c = secret === null || secret === void 0 ? void 0 : secret.allow_hosts) !== null && _c !== void 0 ? _c : []);
+        const linked = (secret === null || secret === void 0 ? void 0 : secret.source_credential_id) != null;
+        setSource(linked ? 'credential' : 'value');
+        setValue('');
+        setCredentialId(linked ? String(secret.source_credential_id) : '');
+        setField(linked ? ((_d = secret.source_field) !== null && _d !== void 0 ? _d : '') : '');
+        setFieldErrors({});
+        setFormError(null);
+    }, [open, secret]);
+    const isEdit = secret !== null;
+    const selectedCredential = credentials.find((option) => String(option.id) === credentialId);
+    const credentialFields = (_a = selectedCredential === null || selectedCredential === void 0 ? void 0 : selectedCredential.fields) !== null && _a !== void 0 ? _a : [];
+    const handleSubmit = async (event) => {
+        event.preventDefault();
+        const trimmedName = name.trim();
+        const trimmedEnvVar = envVar.trim();
+        const clientErrors = {};
+        if (!trimmedName)
+            clientErrors.name = t('virtualMachineSecrets.errorNameRequired');
+        if (!isEdit) {
+            if (!trimmedEnvVar) {
+                clientErrors.env_var = t('virtualMachineSecrets.errorEnvVarRequired');
+            }
+            else if (!VIRTUAL_MACHINE_ENV_VAR_PATTERN.test(trimmedEnvVar)) {
+                clientErrors.env_var = t('virtualMachineSecrets.errorEnvVarFormat');
+            }
+        }
+        if (hosts.length === 0)
+            clientErrors.allow_hosts = t('virtualMachineSecrets.errorHostsRequired');
+        if (source === 'value') {
+            if (!isEdit && !value) {
+                clientErrors.value = t('virtualMachineSecrets.errorValueRequired');
+            }
+            else if (value && value.length < VIRTUAL_MACHINE_SECRET_VALUE_MIN_LENGTH) {
+                clientErrors.value = t('virtualMachineSecrets.errorValueTooShort', {
+                    min: VIRTUAL_MACHINE_SECRET_VALUE_MIN_LENGTH,
+                });
+            }
+            else if (value && MASKED_VALUE_PATTERN.test(value)) {
+                clientErrors.value = t('virtualMachineSecrets.errorValueMasked');
+            }
+        }
+        else {
+            if (!credentialId) {
+                clientErrors.source_credential_id = t('virtualMachineSecrets.errorCredentialRequired');
+            }
+            if (!field)
+                clientErrors.source_field = t('virtualMachineSecrets.errorFieldRequired');
+        }
+        setFieldErrors(clientErrors);
+        setFormError(null);
+        if (Object.keys(clientErrors).length > 0)
+            return;
+        try {
+            let saved;
+            if (isEdit) {
+                const body = { env_var: secret.env_var };
+                if (trimmedName !== secret.name)
+                    body.name = trimmedName;
+                if (hosts.length !== secret.allow_hosts.length ||
+                    hosts.some((host, index) => host !== secret.allow_hosts[index])) {
+                    body.allow_hosts = hosts;
+                }
+                if (source === 'value') {
+                    // A blank value keeps the stored one; a new value replaces it (and
+                    // drops any credential link on the backend).
+                    if (value)
+                        body.value = value;
+                }
+                else if (Number(credentialId) !== secret.source_credential_id ||
+                    field !== secret.source_field) {
+                    body.source_credential_id = Number(credentialId);
+                    body.source_field = field;
+                }
+                if (Object.keys(body).length === 1) {
+                    onOpenChange(false);
+                    return;
+                }
+                saved = await updateSecret({ org: tenantKey, body }).unwrap();
+                toast.success(t('virtualMachineSecrets.updated'));
+            }
+            else {
+                const body = {
+                    name: trimmedName,
+                    env_var: trimmedEnvVar,
+                    allow_hosts: hosts,
+                    ...(source === 'value'
+                        ? { value }
+                        : { source_credential_id: Number(credentialId), source_field: field }),
+                };
+                saved = await createSecret({ org: tenantKey, body }).unwrap();
+                toast.success(t('virtualMachineSecrets.created'));
+            }
+            onSaved === null || onSaved === void 0 ? void 0 : onSaved(saved);
+            onOpenChange(false);
+        }
+        catch (error) {
+            const parsed = getVirtualMachineApiError(error);
+            if (parsed.status === 403) {
+                setFormError(t('virtualMachineSecrets.forbiddenWrite'));
+                return;
+            }
+            const nextErrors = {};
+            let unmatched = [];
+            for (const [key, messages] of Object.entries(parsed.fieldErrors)) {
+                if (FIELD_NAMES.includes(key)) {
+                    nextErrors[key] = messages.join(' ');
+                }
+                else {
+                    unmatched = unmatched.concat(messages);
+                }
+            }
+            setFieldErrors(nextErrors);
+            const message = [parsed.message, ...unmatched].filter(Boolean).join(' ');
+            if (message) {
+                setFormError(message);
+            }
+            else if (Object.keys(nextErrors).length === 0) {
+                setFormError(t('virtualMachineSecrets.saveFailed'));
+            }
+        }
+    };
+    const fieldError = (key, id) => fieldErrors[key] ? (jsx("p", { id: `${id}-error`, role: "alert", className: "text-xs text-red-600", children: fieldErrors[key] })) : null;
+    return (jsx(Dialog, { open: open, onOpenChange: (next) => !isSaving && onOpenChange(next), children: jsxs(DialogContent, { className: "max-h-[90vh] w-full max-w-lg overflow-y-auto", "data-testid": "vm-secret-dialog", children: [jsxs(DialogHeader, { children: [jsx(DialogTitle, { className: "ibl-dialog-title", children: isEdit ? t('virtualMachineSecrets.editTitle') : t('virtualMachineSecrets.createTitle') }), jsx(DialogDescription, { children: t('virtualMachineSecrets.dialogDescription') })] }), jsxs("form", { onSubmit: handleSubmit, noValidate: true, className: "mt-1 grid gap-5", children: [formError && (jsx("div", { role: "alert", "data-testid": "vm-secret-form-error", className: "rounded-md border border-red-200 bg-red-50 px-3 py-2 text-sm text-red-700", children: formError })), jsxs("div", { className: "space-y-1.5", children: [jsx(Label$2, { htmlFor: ids.name, className: "flex items-center text-sm font-medium text-[#646464]", children: t('virtualMachineSecrets.fieldName') }), jsx(Input, { id: ids.name, value: name, maxLength: NAME_MAX_LENGTH, onChange: (event) => setName(event.target.value), placeholder: t('virtualMachineSecrets.namePlaceholder'), "aria-invalid": fieldErrors.name ? true : undefined, "aria-describedby": fieldErrors.name ? `${ids.name}-error` : undefined, required: true }), fieldError('name', ids.name)] }), jsxs("div", { className: "space-y-1.5", children: [jsx(Label$2, { htmlFor: ids.envVar, className: "flex items-center text-sm font-medium text-[#646464]", children: t('virtualMachineSecrets.fieldEnvVar') }), jsx(Input, { id: ids.envVar, value: envVar, maxLength: ENV_VAR_MAX_LENGTH, readOnly: isEdit, disabled: isEdit, onChange: (event) => setEnvVar(event.target.value), placeholder: t('virtualMachineSecrets.envVarPlaceholder'), autoCapitalize: "characters", autoComplete: "off", spellCheck: false, className: "font-mono", "aria-invalid": fieldErrors.env_var ? true : undefined, "aria-describedby": [ids.envVarHelp, fieldErrors.env_var ? `${ids.envVar}-error` : '']
+                                        .filter(Boolean)
+                                        .join(' '), required: !isEdit }), jsx("p", { id: ids.envVarHelp, className: "text-xs text-gray-500", children: isEdit
+                                        ? t('virtualMachineSecrets.envVarReadOnlyHelp')
+                                        : t('virtualMachineSecrets.envVarHelp') }), fieldError('env_var', ids.envVar)] }), jsxs("div", { className: "space-y-1.5", children: [jsx(Label$2, { htmlFor: ids.hosts, className: "flex items-center text-sm font-medium text-[#646464]", children: t('virtualMachineSecrets.fieldHosts') }), jsx(HostPortChipInput, { id: ids.hosts, value: hosts, onChange: setHosts, hint: t('virtualMachineSecrets.hostsHint'), error: fieldErrors.allow_hosts, testId: "vm-secret-hosts" })] }), jsxs("fieldset", { className: "space-y-3", children: [jsx("legend", { id: ids.source, className: "flex items-center text-sm font-medium text-[#646464]", children: t('virtualMachineSecrets.fieldSource') }), jsxs(RadioGroup, { value: source, onValueChange: (next) => setSource(next), "aria-labelledby": ids.source, className: "gap-3", children: [jsxs("div", { className: "flex items-start gap-3", children: [jsx(RadioGroupItem, { value: "value", id: ids.sourceValue, "data-testid": "vm-secret-source-value", className: BLUE_RADIO_ITEM_CLASS }), jsxs(Label$2, { htmlFor: ids.sourceValue, className: "flex flex-col gap-1 font-normal", children: [jsx("span", { className: "text-[13px] font-medium text-[#646464]", children: t('virtualMachineSecrets.sourceValue') }), jsx("span", { className: "text-xs text-gray-500", children: t('virtualMachineSecrets.sourceValueDescription') })] })] }), jsxs("div", { className: "flex items-start gap-3", children: [jsx(RadioGroupItem, { value: "credential", id: ids.sourceCredential, "data-testid": "vm-secret-source-credential", className: BLUE_RADIO_ITEM_CLASS }), jsxs(Label$2, { htmlFor: ids.sourceCredential, className: "flex flex-col gap-1 font-normal", children: [jsx("span", { className: "text-[13px] font-medium text-[#646464]", children: t('virtualMachineSecrets.sourceCredential') }), jsx("span", { className: "text-xs text-gray-500", children: t('virtualMachineSecrets.sourceCredentialDescription') })] })] })] })] }), source === 'value' ? (jsxs("div", { className: "space-y-1.5", children: [jsx(Label$2, { htmlFor: ids.value, className: "flex items-center text-sm font-medium text-[#646464]", children: t('virtualMachineSecrets.fieldValue') }), jsx(Input, { id: ids.value, type: "password", value: value, onChange: (event) => setValue(event.target.value), placeholder: isEdit
+                                        ? t('virtualMachineSecrets.valueKeepPlaceholder')
+                                        : t('virtualMachineSecrets.valuePlaceholder'), autoComplete: "new-password", spellCheck: false, "aria-invalid": fieldErrors.value ? true : undefined, "aria-describedby": [ids.valueHelp, fieldErrors.value ? `${ids.value}-error` : '']
+                                        .filter(Boolean)
+                                        .join(' '), required: !isEdit, "data-testid": "vm-secret-value" }), jsx("p", { id: ids.valueHelp, className: "text-xs text-gray-500", children: isEdit
+                                        ? t('virtualMachineSecrets.valueKeepHelp')
+                                        : t('virtualMachineSecrets.valueHelp', {
+                                            min: VIRTUAL_MACHINE_SECRET_VALUE_MIN_LENGTH,
+                                        }) }), fieldError('value', ids.value)] })) : (jsxs("div", { className: "space-y-4", children: [jsxs("div", { className: "space-y-1.5", children: [jsx(Label$2, { id: ids.credentialLabel, htmlFor: ids.credential, className: "flex items-center text-sm font-medium text-[#646464]", children: t('virtualMachineSecrets.fieldCredential') }), credentials.length === 0 ? (jsx("p", { className: "text-xs text-gray-500", "data-testid": "vm-secret-no-credentials", children: t('virtualMachineSecrets.noCredentials') })) : (jsxs(Select$1, { value: credentialId, onValueChange: (next) => {
+                                                setCredentialId(next);
+                                                setField('');
+                                            }, children: [jsx(SelectTrigger, { id: ids.credential, "aria-labelledby": ids.credentialLabel, "aria-invalid": fieldErrors.source_credential_id ? true : undefined, "data-testid": "vm-secret-credential-select", children: jsx(SelectValue, { placeholder: t('virtualMachineSecrets.credentialPlaceholder') }) }), jsx(SelectContent, { children: credentials.map((option) => (jsx(SelectItem, { value: String(option.id), children: option.name }, option.id))) })] })), fieldError('source_credential_id', ids.credential)] }), jsxs("div", { className: "space-y-1.5", children: [jsx(Label$2, { id: ids.fieldLabel, htmlFor: ids.field, className: "flex items-center text-sm font-medium text-[#646464]", children: t('virtualMachineSecrets.fieldCredentialField') }), jsxs(Select$1, { value: field, onValueChange: setField, disabled: !selectedCredential || credentialFields.length === 0, children: [jsx(SelectTrigger, { id: ids.field, "aria-labelledby": ids.fieldLabel, "aria-invalid": fieldErrors.source_field ? true : undefined, "data-testid": "vm-secret-field-select", children: jsx(SelectValue, { placeholder: t('virtualMachineSecrets.credentialFieldPlaceholder') }) }), jsx(SelectContent, { children: credentialFields.map((key) => (jsx(SelectItem, { value: key, children: key }, key))) })] }), selectedCredential && credentialFields.length === 0 && (jsx("p", { className: "text-xs text-gray-500", children: t('virtualMachineSecrets.credentialNoFields') })), fieldError('source_field', ids.field)] })] })), jsxs(DialogFooter, { children: [jsx(Button$1, { type: "button", variant: "outline", onClick: () => onOpenChange(false), disabled: isSaving, children: t('virtualMachineSecrets.cancel') }), jsxs(Button$1, { type: "submit", disabled: isSaving, "data-testid": "vm-secret-save", className: "bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: [isSaving && jsx(LoaderCircle, { className: "h-4 w-4 animate-spin", "aria-hidden": "true" }), isEdit
+                                            ? t('virtualMachineSecrets.saveChanges')
+                                            : t('virtualMachineSecrets.createSecret')] })] })] })] }) }));
+}
+
+const HOST_PREVIEW_COUNT = 3;
+/** Placeholder swapped for the inline variable in the delete sentence. */
+const RECORD_SLOT = '__record__';
+/** "3 days ago" for a backend timestamp, or a dash when it is unusable. */
+function relativeTime(value) {
+    const date = new Date(value);
+    return Number.isNaN(date.getTime()) ? '—' : formatDistanceToNow(date, { addSuffix: true });
+}
+/**
+ * VM secrets table with create / edit / delete. A value is never displayed
+ * — the Source column only says whether the secret holds a stored value or
+ * follows an integration credential's field. Deleting a secret also unbinds
+ * it from every agent that uses it, which the confirmation spells out.
+ */
+function VmSecretsSection({ tenantKey, secrets, isLoading, isError, }) {
+    const t = useT();
+    const [dialogOpen, setDialogOpen] = useState(false);
+    const [editingSecret, setEditingSecret] = useState(null);
+    const [deletingSecret, setDeletingSecret] = useState(null);
+    const [deleteError, setDeleteError] = useState(null);
+    const [deleteSecret, { isLoading: isDeleting }] = useDeleteVirtualMachineSecretMutation();
+    // The org's integration credentials feed the "use an existing credential"
+    // source in the form and name the credential in the Source column.
+    const { data: credentialsData } = useGetIntegrationCredentialsQuery({ org: tenantKey });
+    const credentials = useMemo(() => toIntegrationCredentialOptions(credentialsData), [credentialsData]);
+    const credentialNames = useMemo(() => new Map(credentials.map((option) => [option.id, option.name])), [credentials]);
+    const sourceLabel = (secret) => {
+        var _a;
+        if (secret.source_credential_id == null)
+            return t('virtualMachineSecrets.sourceStored');
+        const credentialName = (_a = credentialNames.get(secret.source_credential_id)) !== null && _a !== void 0 ? _a : `#${secret.source_credential_id}`;
+        return t('virtualMachineSecrets.sourceFromCredential', {
+            credential: credentialName,
+            field: secret.source_field,
+        });
+    };
+    // The translated sentence with the variable rendered as the table's code chip.
+    const [deleteConfirmBefore, deleteConfirmAfter] = t('virtualMachineSecrets.deleteConfirm', {
+        envVar: RECORD_SLOT,
+    }).split(RECORD_SLOT);
+    const openCreate = () => {
+        setEditingSecret(null);
+        setDialogOpen(true);
+    };
+    const openEdit = (secret) => {
+        setEditingSecret(secret);
+        setDialogOpen(true);
+    };
+    const openDelete = (secret) => {
+        setDeleteError(null);
+        setDeletingSecret(secret);
+    };
+    const handleDelete = async (secret) => {
+        var _a;
+        try {
+            await deleteSecret({ org: tenantKey, envVar: secret.env_var }).unwrap();
+            toast.success(t('virtualMachineSecrets.deleted'));
+            setDeletingSecret(null);
+        }
+        catch (error) {
+            const parsed = getVirtualMachineApiError(error);
+            setDeleteError(parsed.status === 403
+                ? t('virtualMachineSecrets.forbiddenDelete')
+                : ((_a = parsed.message) !== null && _a !== void 0 ? _a : t('virtualMachineSecrets.deleteFailed')));
+        }
+    };
+    return (jsxs("div", { "data-testid": "vm-secrets-section", className: "space-y-4", children: [jsx("div", { className: "flex justify-end", children: jsxs(Button$1, { size: "sm", onClick: openCreate, "data-testid": "vm-secret-new", className: "cursor-pointer bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: [jsx(Plus, { className: "h-4 w-4", "aria-hidden": "true" }), t('virtualMachineSecrets.newSecret')] }) }), isLoading ? (jsx("div", { className: "flex h-40 items-center justify-center", children: jsx(Spinner, {}) })) : isError ? (jsx("div", { role: "alert", className: "rounded-lg border border-red-200 bg-red-50 px-6 py-6 text-center text-sm text-red-700", children: t('virtualMachineSecrets.loadFailed') })) : (jsx("div", { className: "overflow-x-auto rounded-lg border border-gray-200 bg-white dark:border-gray-700 dark:bg-gray-800", children: jsxs("table", { className: "w-full text-sm", children: [jsx("thead", { className: "border-b border-gray-200 bg-gray-50 dark:border-gray-600 dark:bg-gray-700", children: jsxs("tr", { children: [jsx("th", { className: "px-6 py-3 text-left font-medium text-gray-500 dark:text-gray-400", children: t('virtualMachineSecrets.colName') }), jsx("th", { className: "px-6 py-3 text-left font-medium whitespace-nowrap text-gray-500 dark:text-gray-400", children: t('virtualMachineSecrets.colEnvVar') }), jsx("th", { className: "px-6 py-3 text-left font-medium text-gray-500 dark:text-gray-400", children: t('virtualMachineSecrets.colHosts') }), jsx("th", { className: "px-6 py-3 text-left font-medium text-gray-500 dark:text-gray-400", children: t('virtualMachineSecrets.colSource') }), jsx("th", { className: "px-6 py-3 text-left font-medium whitespace-nowrap text-gray-500 dark:text-gray-400", children: t('virtualMachineSecrets.colUpdated') }), jsx("th", { className: "px-6 py-3 text-right font-medium text-gray-500 dark:text-gray-400", children: t('virtualMachineSecrets.colActions') })] }) }), jsxs("tbody", { className: "divide-y divide-gray-200 dark:divide-gray-600", children: [secrets.map((secret) => {
+                                    const preview = secret.allow_hosts.slice(0, HOST_PREVIEW_COUNT);
+                                    const remaining = secret.allow_hosts.length - preview.length;
+                                    return (jsxs("tr", { "data-testid": `vm-secret-row-${secret.env_var}`, children: [jsx("td", { className: "px-6 py-4 font-medium text-gray-900 dark:text-gray-100", children: secret.name }), jsx("td", { className: "px-6 py-4", children: jsx("code", { className: "rounded bg-gray-100 px-1.5 py-0.5 font-mono text-xs text-gray-800", children: secret.env_var }) }), jsx("td", { className: "px-6 py-4", children: jsxs("ul", { role: "list", "aria-label": t('virtualMachineSecrets.hostsListAriaLabel', {
+                                                        name: secret.name,
+                                                    }), className: "flex flex-wrap gap-1", children: [preview.map((host) => (jsx("li", { className: "rounded-md border border-gray-200 bg-gray-50 px-2 py-0.5 font-mono text-xs text-gray-700", children: host }, host))), remaining > 0 && (jsx("li", { className: "px-1 py-0.5 text-xs text-gray-500", children: t('virtualMachineSecrets.moreHosts', { count: remaining }) }))] }) }), jsx("td", { className: "px-6 py-4 text-gray-600 dark:text-gray-300", children: sourceLabel(secret) }), jsx("td", { className: "px-6 py-4 whitespace-nowrap text-gray-600 dark:text-gray-300", children: relativeTime(secret.updated_at) }), jsx("td", { className: "px-6 py-4", children: jsxs("div", { className: "flex justify-end gap-1", children: [jsx(Button$1, { variant: "ghost", size: "sm", onClick: () => openEdit(secret), "aria-label": t('virtualMachineSecrets.editAriaLabel', {
+                                                                name: secret.name,
+                                                            }), "data-testid": `vm-secret-edit-${secret.env_var}`, children: jsx(Pencil, { className: "h-4 w-4", "aria-hidden": "true" }) }), jsx(Button$1, { variant: "ghost", size: "sm", onClick: () => openDelete(secret), "aria-label": t('virtualMachineSecrets.deleteAriaLabel', {
+                                                                name: secret.name,
+                                                            }), "data-testid": `vm-secret-delete-${secret.env_var}`, className: "text-red-600 hover:text-red-700", children: jsx(Trash2, { className: "h-4 w-4", "aria-hidden": "true" }) })] }) })] }, secret.id));
+                                }), secrets.length === 0 && (jsx("tr", { children: jsx("td", { colSpan: 6, className: "px-6 py-8 text-center text-gray-500 dark:text-gray-400", children: t('virtualMachineSecrets.empty') }) }))] })] }) })), jsx(VmSecretDialog, { open: dialogOpen, onOpenChange: setDialogOpen, tenantKey: tenantKey, secret: editingSecret, credentials: credentials }), jsx(Dialog, { open: deletingSecret !== null, onOpenChange: (open) => {
+                    if (!open && !isDeleting) {
+                        setDeletingSecret(null);
+                        setDeleteError(null);
+                    }
+                }, children: jsxs(DialogContent, { className: "max-w-md", "data-testid": "vm-secret-delete-dialog", children: [jsx(DialogHeader, { children: jsx(DialogTitle, { children: t('virtualMachineSecrets.deleteTitle') }) }), jsxs(DialogDescription, { className: "text-gray-600", children: [deleteConfirmBefore, jsx("code", { className: "rounded bg-gray-100 px-1.5 py-0.5 font-mono text-xs text-gray-800", children: deletingSecret === null || deletingSecret === void 0 ? void 0 : deletingSecret.env_var }), deleteConfirmAfter] }), deleteError && (jsx("div", { role: "alert", "data-testid": "vm-secret-delete-error", className: "rounded-md border border-red-200 bg-red-50 px-3 py-2 text-sm text-red-700", children: deleteError })), jsxs(DialogFooter, { className: "pt-2", children: [jsx(Button$1, { type: "button", variant: "outline", disabled: isDeleting, onClick: () => {
+                                        setDeletingSecret(null);
+                                        setDeleteError(null);
+                                    }, children: t('virtualMachineSecrets.cancel') }), jsxs(Button$1, { type: "button", onClick: () => {
+                                        if (deletingSecret)
+                                            void handleDelete(deletingSecret);
+                                    }, disabled: isDeleting, "data-testid": "vm-secret-delete-confirm", className: "cursor-pointer bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: [isDeleting && jsx(LoaderCircle, { className: "h-4 w-4 animate-spin", "aria-hidden": "true" }), t('virtualMachineSecrets.delete')] })] })] }) })] }));
+}
+
+/**
+ * Tenant-settings **Virtual Machine** tab. Org admins manage the two records
+ * that decide what an agent's Virtual Machine Shell can reach: reusable
+ * `host:port` network policies (bound under the `custom` egress profile) and
+ * VM secrets the VM can use but never read. Each section is hidden when its
+ * list call answers 403; when both do, a single permission notice remains.
+ */
+function VirtualMachineAdminTab({ tenantKey, username, defaultTab = 'network-policies', }) {
+    var _a, _b;
+    const t = useT();
+    const policiesQuery = useListVirtualMachineNetworkPoliciesQuery({ org: tenantKey });
+    const secretsQuery = useListVirtualMachineSecretsQuery({ org: tenantKey });
+    const policiesForbidden = getVirtualMachineErrorStatus(policiesQuery.error) === 403;
+    const secretsForbidden = getVirtualMachineErrorStatus(secretsQuery.error) === 403;
+    if (policiesQuery.isLoading && secretsQuery.isLoading) {
+        return (jsxs("div", { className: "space-y-6", "data-testid": "vm-admin-loading", children: [jsx(Skeleton, { className: "h-10 w-full max-w-sm rounded-lg" }), jsx(Skeleton, { className: "h-40 w-full rounded-lg" })] }));
+    }
+    if (policiesForbidden && secretsForbidden) {
+        return (jsx("div", { className: "max-w-2xl", children: jsx("div", { className: "rounded-lg border px-6 py-8 text-center", style: { borderColor: 'oklch(.922 0 0)' }, "data-testid": "vm-admin-forbidden", children: jsx("p", { className: "text-sm text-gray-500", children: t('virtualMachineAdminTab.forbidden') }) }) }));
+    }
+    const initialTab = (defaultTab === 'secrets' && !secretsForbidden) || policiesForbidden
+        ? 'secrets'
+        : 'network-policies';
+    return (jsxs("div", { className: "space-y-4", children: [jsx("div", { className: "rounded-md border border-gray-200 bg-gray-50 p-3 text-xs text-gray-600", "data-testid": "vm-admin-info-box", children: t('virtualMachineAdminTab.infoBox') }), jsxs(Tabs, { defaultValue: initialTab, "aria-label": t('virtualMachineAdminTab.tabsAriaLabel'), children: [jsxs(TabsList, { "aria-label": t('virtualMachineAdminTab.tabsAriaLabel'), className: "max-w-full justify-start overflow-x-auto px-1", children: [!policiesForbidden && (jsx(TabsTrigger, { "data-testid": "vm-admin-sub-tab-policies", value: "network-policies", children: t('virtualMachineAdminTab.tabNetworkPolicies') })), !secretsForbidden && (jsx(TabsTrigger, { "data-testid": "vm-admin-sub-tab-secrets", value: "secrets", children: t('virtualMachineAdminTab.tabSecrets') }))] }), !policiesForbidden && (jsx(TabsContent, { className: "mt-4", value: "network-policies", children: jsx(NetworkPoliciesSection, { tenantKey: tenantKey, username: username, policies: (_a = policiesQuery.data) !== null && _a !== void 0 ? _a : [], isLoading: policiesQuery.isLoading, isError: policiesQuery.isError }) })), !secretsForbidden && (jsx(TabsContent, { className: "mt-4", value: "secrets", children: jsx(VmSecretsSection, { tenantKey: tenantKey, secrets: (_b = secretsQuery.data) !== null && _b !== void 0 ? _b : [], isLoading: secretsQuery.isLoading, isError: secretsQuery.isError }) }))] })] }));
+}
+
 // ::- Persistent data structure representing an ordered mapping from
 // strings to values, with some convenient update methods.
 function OrderedMap(content) {
@@ -240513,6 +241933,264 @@ function LLMProviderModal({ isOpen, onClose, onSelect, llmProvider, isSelecting,
                 }) })] }));
 }
 
+/** Copy for each egress profile, in the order the backend lists them. */
+const EGRESS_COPY = {
+    none: {
+        label: 'virtualMachineNetworkSection.egressNoneLabel',
+        description: 'virtualMachineNetworkSection.egressNoneDescription',
+    },
+    registries: {
+        label: 'virtualMachineNetworkSection.egressRegistriesLabel',
+        description: 'virtualMachineNetworkSection.egressRegistriesDescription',
+    },
+    public: {
+        label: 'virtualMachineNetworkSection.egressPublicLabel',
+        description: 'virtualMachineNetworkSection.egressPublicDescription',
+    },
+    custom: {
+        label: 'virtualMachineNetworkSection.egressCustomLabel',
+        description: 'virtualMachineNetworkSection.egressCustomDescription',
+    },
+};
+const sameIdSet = (a, b) => a.length === b.length && a.every((id) => b.includes(id));
+/**
+ * The Virtual Machine Shell network settings of an agent: the egress profile
+ * (a labelled radio group), the network policy picker (only under Custom,
+ * required, with a "Create policy" shortcut) and the secrets multi-select
+ * (only under Public or Custom, capped at 20), plus the billing notice.
+ *
+ * Mirrors the backend's rules before saving: Custom needs a policy; secrets
+ * need a networked profile, so narrowing to None or Registries asks to
+ * confirm and unbinds them in the same request; under Custom every host a
+ * bound secret needs must be in the policy, and the missing ones can be
+ * added to the policy (PATCH) right before the save. Backend 400s land next
+ * to the matching control or as a form-level message. The secrets control is
+ * hidden when the secrets list answers 403.
+ */
+function VirtualMachineNetworkSection({ platformKey, mentorUniqueId, username, }) {
+    var _a, _b, _c, _d;
+    const t = useT();
+    const baseId = useId$2();
+    const ids = {
+        egressLabel: `${baseId}-egress-label`,
+        egressHelp: `${baseId}-egress-help`,
+        policyLabel: `${baseId}-policy-label`,
+        policySelect: `${baseId}-policy-select`,
+        secretsLabel: `${baseId}-secrets-label`,
+        secretsHelp: `${baseId}-secrets-help`,
+    };
+    const { data: settingsData, isLoading: isLoadingSettings } = useGetMentorSettingsQuery({ mentor: mentorUniqueId, org: platformKey }, { skip: !platformKey || !mentorUniqueId });
+    const [editMentor, { isLoading: isSaving }] = useEditMentorMutation();
+    const [updatePolicy, { isLoading: isUpdatingPolicy }] = useUpdateVirtualMachineNetworkPolicyMutation();
+    const policiesQuery = useListVirtualMachineNetworkPoliciesQuery({ org: platformKey });
+    const secretsQuery = useListVirtualMachineSecretsQuery({ org: platformKey });
+    const policiesForbidden = getVirtualMachineErrorStatus(policiesQuery.error) === 403;
+    const secretsForbidden = getVirtualMachineErrorStatus(secretsQuery.error) === 403;
+    // What the server holds. The installed MentorSettings type predates these
+    // fields, so the response is read through the typed slice.
+    const settings = settingsData;
+    const server = useMemo(() => {
+        var _a, _b, _c;
+        return ({
+            egress: ((_a = settings === null || settings === void 0 ? void 0 : settings.virtual_machine_egress) !== null && _a !== void 0 ? _a : 'none'),
+            policy: (_b = settings === null || settings === void 0 ? void 0 : settings.virtual_machine_network_policy) !== null && _b !== void 0 ? _b : null,
+            secrets: (_c = settings === null || settings === void 0 ? void 0 : settings.virtual_machine_secrets) !== null && _c !== void 0 ? _c : [],
+        });
+    }, [settings]);
+    const serverPolicyId = (_b = (_a = server.policy) === null || _a === void 0 ? void 0 : _a.id) !== null && _b !== void 0 ? _b : null;
+    const serverSecretIds = useMemo(() => server.secrets.map((secret) => secret.id), [server]);
+    const [egress, setEgress] = useState(server.egress);
+    const [policyId, setPolicyId] = useState(serverPolicyId);
+    const [secretIds, setSecretIds] = useState(serverSecretIds);
+    const [fieldErrors, setFieldErrors] = useState({});
+    const [formError, setFormError] = useState(null);
+    const [policyDialogOpen, setPolicyDialogOpen] = useState(false);
+    // `null` creates a new policy; a policy edits it in place.
+    const [policyDialogPolicy, setPolicyDialogPolicy] = useState(null);
+    const [confirmNarrowOpen, setConfirmNarrowOpen] = useState(false);
+    // The org's policies + secrets admin UI, opened in place so the admin never
+    // has to leave the agent settings to create what they need here.
+    const [manageTab, setManageTab] = useState(null);
+    const resetDraft = () => {
+        setEgress(server.egress);
+        setPolicyId(serverPolicyId);
+        setSecretIds(serverSecretIds);
+        setFieldErrors({});
+        setFormError(null);
+    };
+    // Re-seed the draft whenever the saved settings change (after a save, or
+    // when another admin's change is refetched).
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    useEffect(resetDraft, [server, serverPolicyId, serverSecretIds]);
+    // The bound policy / secrets may be missing from the org lists (the list
+    // may be forbidden, or the settings refetch may lag) — fold the refs the
+    // settings carry into the options so the selection still renders.
+    const policyOptions = useMemo(() => {
+        var _a;
+        const policies = (_a = policiesQuery.data) !== null && _a !== void 0 ? _a : [];
+        if (server.policy && !policies.some((policy) => { var _a; return policy.id === ((_a = server.policy) === null || _a === void 0 ? void 0 : _a.id); })) {
+            return [...policies, { ...server.policy, description: '', created_at: '', updated_at: '' }];
+        }
+        return policies;
+    }, [policiesQuery.data, server.policy]);
+    const secretOptions = useMemo(() => {
+        var _a;
+        const known = new Map();
+        for (const secret of (_a = secretsQuery.data) !== null && _a !== void 0 ? _a : [])
+            known.set(secret.id, secret);
+        for (const ref of server.secrets) {
+            if (!known.has(ref.id)) {
+                known.set(ref.id, { ...ref, source_field: '', created_at: '', updated_at: '' });
+            }
+        }
+        return [...known.values()].sort((a, b) => a.env_var.localeCompare(b.env_var));
+    }, [secretsQuery.data, server.secrets]);
+    const selectedPolicy = (_c = policyOptions.find((policy) => policy.id === policyId)) !== null && _c !== void 0 ? _c : null;
+    const selectedSecrets = secretOptions.filter((secret) => secretIds.includes(secret.id));
+    const isNetworked = isVirtualMachineEgressNetworked(egress);
+    const uncovered = egress === 'custom' && selectedPolicy
+        ? findUncoveredSecretHosts(selectedSecrets, selectedPolicy.allowed_hosts)
+        : [];
+    /** Only the keys that differ from the server, as the PUT partial update expects. */
+    const buildPayload = () => {
+        const payload = {};
+        if (egress !== server.egress)
+            payload.virtual_machine_egress = egress;
+        if (egress === 'custom') {
+            if (policyId !== serverPolicyId || egress !== server.egress) {
+                payload.virtual_machine_network_policy_id = policyId;
+            }
+        }
+        else if (server.egress === 'custom' && serverPolicyId !== null) {
+            payload.virtual_machine_network_policy_id = null;
+        }
+        if (isNetworked) {
+            if (!sameIdSet(secretIds, serverSecretIds))
+                payload.virtual_machine_secret_ids = secretIds;
+        }
+        else if (serverSecretIds.length > 0) {
+            payload.virtual_machine_secret_ids = [];
+        }
+        return payload;
+    };
+    const isDirty = Object.keys(buildPayload()).length > 0;
+    const policyMissing = egress === 'custom' && policyId === null;
+    const isValid = !policyMissing && uncovered.length === 0;
+    const isBusy = isSaving || isUpdatingPolicy;
+    const persist = async (payload) => {
+        setFieldErrors({});
+        setFormError(null);
+        try {
+            await editMentor({
+                mentor: mentorUniqueId,
+                org: platformKey,
+                // @ts-expect-error userId is accepted at runtime (the pinned client's type omits it)
+                userId: username,
+                // The installed MentorSettingsRequest type predates the network fields.
+                formData: payload,
+            }).unwrap();
+            toast.success(t('virtualMachineNetworkSection.saved'));
+        }
+        catch (error) {
+            const parsed = getVirtualMachineApiError(error);
+            if (parsed.status === 403) {
+                setFormError(t('virtualMachineNetworkSection.forbiddenSave'));
+                return;
+            }
+            const nextErrors = {};
+            let unmatched = [];
+            for (const [field, messages] of Object.entries(parsed.fieldErrors)) {
+                const joined = messages.join(' ');
+                if (field === 'virtual_machine_egress')
+                    nextErrors.egress = joined;
+                else if (field === 'virtual_machine_network_policy_id')
+                    nextErrors.policy = joined;
+                else if (field === 'virtual_machine_secret_ids')
+                    nextErrors.secrets = joined;
+                else
+                    unmatched = unmatched.concat(messages);
+            }
+            setFieldErrors(nextErrors);
+            const message = [parsed.message, ...unmatched].filter(Boolean).join(' ');
+            if (message)
+                setFormError(message);
+            else if (Object.keys(nextErrors).length === 0) {
+                setFormError(t('virtualMachineNetworkSection.saveFailed'));
+            }
+        }
+    };
+    const handleSave = () => {
+        // Narrowing the profile while secrets are bound: confirm, then unbind
+        // them in the same request (the backend refuses otherwise).
+        if (!isNetworked && serverSecretIds.length > 0) {
+            setConfirmNarrowOpen(true);
+            return;
+        }
+        void persist(buildPayload());
+    };
+    const handleConfirmNarrow = () => {
+        setConfirmNarrowOpen(false);
+        void persist({ ...buildPayload(), virtual_machine_secret_ids: [] });
+    };
+    /** Add every uncovered host to the selected policy, then save the settings. */
+    const handleAddHostsAndSave = async (policy) => {
+        var _a;
+        const missing = uncovered.flatMap((entry) => entry.hosts);
+        const allowedHosts = Array.from(new Set([...policy.allowed_hosts, ...missing]));
+        setFormError(null);
+        try {
+            await updatePolicy({
+                org: platformKey,
+                body: { id: policy.id, allowed_hosts: allowedHosts },
+            }).unwrap();
+            toast.success(t('virtualMachineNetworkSection.policyHostsAdded', { policy: policy.name }));
+        }
+        catch (error) {
+            const parsed = getVirtualMachineApiError(error);
+            setFormError(parsed.status === 403
+                ? t('virtualMachineNetworkSection.policyUpdateForbidden')
+                : ((_a = parsed.message) !== null && _a !== void 0 ? _a : t('virtualMachineNetworkSection.policyUpdateFailed')));
+            return;
+        }
+        await persist(buildPayload());
+    };
+    const openPolicyDialog = (policy) => {
+        setPolicyDialogPolicy(policy);
+        setPolicyDialogOpen(true);
+    };
+    const toggleSecret = (id, checked) => {
+        setSecretIds((current) => checked ? Array.from(new Set([...current, id])) : current.filter((x) => x !== id));
+    };
+    if (isLoadingSettings || policiesQuery.isLoading || secretsQuery.isLoading) {
+        return (jsxs("div", { className: "space-y-3 rounded-lg border p-6", "data-testid": "vm-network-section-loading", children: [jsx(Skeleton, { className: "h-5 w-48 rounded" }), jsx(Skeleton, { className: "h-24 w-full rounded-lg" })] }));
+    }
+    const capReached = secretIds.length >= VIRTUAL_MACHINE_MAX_SECRETS_PER_MENTOR;
+    return (jsxs("div", { className: "rounded-lg border p-6", "data-testid": "vm-network-section", children: [jsxs("div", { className: "mb-4", children: [jsx("h4", { className: "text-base font-semibold text-gray-900", children: t('virtualMachineNetworkSection.title') }), jsx("p", { className: "mt-1 text-sm text-gray-500", children: t('virtualMachineNetworkSection.description') })] }), jsx("div", { role: "note", "data-testid": "vm-billing-notice", className: "mb-5 rounded-md border border-gray-200 bg-gray-50 p-3 text-xs text-gray-600", children: t('virtualMachineNetworkSection.billingNotice', {
+                    usd: VIRTUAL_MACHINE_DEFAULT_BILLING.usd,
+                    minutes: VIRTUAL_MACHINE_DEFAULT_BILLING.minutes,
+                }) }), jsxs("div", { className: "space-y-6", children: [jsxs("fieldset", { className: "space-y-2", children: [jsx("legend", { id: ids.egressLabel, className: "text-base font-semibold text-gray-900", children: t('virtualMachineNetworkSection.egressLabel') }), jsx("p", { id: ids.egressHelp, className: "text-sm text-gray-500", children: t('virtualMachineNetworkSection.egressHelp') }), jsx(RadioGroup, { value: egress, onValueChange: (next) => setEgress(next), "aria-labelledby": ids.egressLabel, "aria-describedby": ids.egressHelp, "aria-invalid": fieldErrors.egress ? true : undefined, disabled: isBusy, className: "gap-2", "data-testid": "vm-egress-group", children: VIRTUAL_MACHINE_EGRESS_PROFILES.map((profile) => {
+                                    const itemId = `${baseId}-egress-${profile}`;
+                                    return (jsxs("div", { className: "flex items-start gap-2 rounded-lg border border-gray-200 p-3", children: [jsx(RadioGroupItem, { value: profile, id: itemId, "data-testid": `vm-egress-${profile}`, className: BLUE_RADIO_ITEM_CLASS }), jsxs(Label$2, { htmlFor: itemId, className: "flex cursor-pointer flex-col gap-0.5 font-normal", children: [jsx("span", { className: "font-medium text-gray-900", children: t(EGRESS_COPY[profile].label) }), jsx("span", { className: "text-xs text-gray-500", children: t(EGRESS_COPY[profile].description) })] })] }, profile));
+                                }) }), fieldErrors.egress && (jsx("p", { role: "alert", className: "text-xs text-red-600", children: fieldErrors.egress }))] }), egress === 'custom' && (jsxs("div", { className: "space-y-2", "data-testid": "vm-policy-picker", children: [jsxs("div", { className: "flex items-center justify-between gap-2", children: [jsx(Label$2, { id: ids.policyLabel, htmlFor: ids.policySelect, className: "text-base leading-9 font-semibold text-gray-900", children: t('virtualMachineNetworkSection.policyLabel') }), !policiesForbidden && (jsxs("div", { className: "flex flex-wrap items-center justify-end gap-2", children: [jsxs(Button$1, { type: "button", variant: "outline", size: "sm", onClick: () => openPolicyDialog(null), disabled: isBusy, "data-testid": "vm-policy-create", children: [jsx(Plus, { className: "h-4 w-4", "aria-hidden": "true" }), t('virtualMachineNetworkSection.createPolicy')] }), jsxs(Button$1, { type: "button", variant: "outline", size: "sm", onClick: () => setManageTab('network-policies'), disabled: isBusy, "data-testid": "vm-manage-policies", children: [jsx(Settings, { className: "h-4 w-4", "aria-hidden": "true" }), t('virtualMachineNetworkSection.managePolicies')] })] }))] }), policiesForbidden ? (jsx("p", { className: "text-xs text-gray-500", "data-testid": "vm-policies-forbidden", children: t('virtualMachineNetworkSection.policiesForbidden') })) : (jsxs("div", { className: "flex flex-wrap items-center gap-2", children: [jsxs(Select$1, { value: policyId !== null ? String(policyId) : '', onValueChange: (next) => setPolicyId(Number(next)), disabled: isBusy || policyOptions.length === 0, children: [jsx(SelectTrigger, { id: ids.policySelect, "aria-labelledby": ids.policyLabel, "aria-invalid": policyMissing || fieldErrors.policy ? true : undefined, "data-testid": "vm-policy-select", className: "sm:w-80", children: jsx(SelectValue, { placeholder: policyOptions.length === 0
+                                                        ? t('virtualMachineNetworkSection.noPolicies')
+                                                        : t('virtualMachineNetworkSection.policyPlaceholder') }) }), jsx(SelectContent, { children: policyOptions.map((policy) => (jsx(SelectItem, { value: String(policy.id), children: policy.name }, policy.id))) })] }), selectedPolicy && (jsxs(Button$1, { type: "button", variant: "outline", size: "sm", onClick: () => openPolicyDialog(selectedPolicy), disabled: isBusy, "data-testid": "vm-policy-edit", children: [jsx(Pencil, { className: "h-4 w-4", "aria-hidden": "true" }), t('virtualMachineNetworkSection.editPolicy')] }))] })), jsx("p", { "aria-live": "polite", className: policyMissing || fieldErrors.policy ? 'text-xs text-red-600' : 'sr-only', children: (_d = fieldErrors.policy) !== null && _d !== void 0 ? _d : (policyMissing ? t('virtualMachineNetworkSection.policyRequired') : '') }), selectedPolicy && (jsxs("div", { className: "text-xs text-gray-500", "data-testid": "vm-policy-hosts", children: [jsx("span", { children: t('virtualMachineNetworkSection.policyHosts') }), jsx("ul", { role: "list", className: "mt-1 flex flex-wrap gap-1", children: selectedPolicy.allowed_hosts.map((host) => (jsx("li", { className: "rounded-md border border-gray-200 bg-gray-50 px-2 py-0.5 font-mono text-xs text-gray-700", children: host }, host))) })] }))] })), isNetworked && !secretsForbidden && (jsxs("div", { className: "space-y-2", "data-testid": "vm-secrets-picker", children: [jsxs("div", { className: "flex items-center justify-between gap-2", children: [jsx("span", { id: ids.secretsLabel, className: "text-base leading-9 font-semibold text-gray-900", children: t('virtualMachineNetworkSection.secretsLabel') }), jsxs(Button$1, { type: "button", variant: "outline", size: "sm", onClick: () => setManageTab('secrets'), disabled: isBusy, "data-testid": "vm-manage-secrets", children: [jsx(Settings, { className: "h-4 w-4", "aria-hidden": "true" }), t('virtualMachineNetworkSection.manageSecrets')] })] }), jsx("p", { id: ids.secretsHelp, className: "text-sm text-gray-500", children: t('virtualMachineNetworkSection.secretsHelp', {
+                                    max: VIRTUAL_MACHINE_MAX_SECRETS_PER_MENTOR,
+                                }) }), secretOptions.length === 0 ? (jsx("p", { className: "text-xs text-gray-500", "data-testid": "vm-no-secrets", children: t('virtualMachineNetworkSection.noSecrets') })) : (jsx("div", { role: "group", "aria-labelledby": ids.secretsLabel, "aria-describedby": ids.secretsHelp, className: "space-y-2", children: secretOptions.map((secret) => {
+                                    const itemId = `${baseId}-secret-${secret.id}`;
+                                    const checked = secretIds.includes(secret.id);
+                                    return (jsxs("div", { className: "flex items-start gap-2 rounded-lg border border-gray-200 p-3", children: [jsx(Checkbox, { id: itemId, checked: checked, disabled: isBusy || (!checked && capReached), onCheckedChange: (next) => toggleSecret(secret.id, next === true), "data-testid": `vm-secret-option-${secret.env_var}`, className: BLUE_CHECKBOX_CLASS }), jsxs(Label$2, { htmlFor: itemId, className: "flex cursor-pointer flex-col gap-0.5 font-normal", children: [jsxs("span", { className: "text-gray-900", children: [jsx("span", { className: "font-medium", children: secret.name }), ' ', jsx("code", { className: "rounded bg-gray-100 px-1 py-0.5 font-mono text-xs", children: secret.env_var })] }), jsx("span", { className: "text-xs text-gray-500", children: secret.allow_hosts.join(', ') })] })] }, secret.id));
+                                }) })), capReached && (jsx("p", { role: "status", className: "text-xs text-gray-500", "data-testid": "vm-secrets-cap", children: t('virtualMachineNetworkSection.secretsCapReached', {
+                                    max: VIRTUAL_MACHINE_MAX_SECRETS_PER_MENTOR,
+                                }) })), fieldErrors.secrets && (jsx("p", { role: "alert", className: "text-xs text-red-600", children: fieldErrors.secrets }))] })), uncovered.length > 0 && selectedPolicy && (jsxs("div", { role: "alert", "data-testid": "vm-uncovered-hosts", className: "space-y-2 rounded-md border border-amber-200 bg-amber-50 p-3 text-xs text-amber-800", children: [jsxs("div", { className: "flex items-start gap-2", children: [jsx(TriangleAlert, { className: "mt-0.5 h-4 w-4 shrink-0", "aria-hidden": "true" }), jsxs("div", { children: [jsx("p", { className: "font-medium", children: t('virtualMachineNetworkSection.uncoveredTitle') }), jsx("ul", { role: "list", className: "mt-1 list-disc space-y-0.5 pl-5", children: uncovered.map((entry) => (jsx("li", { children: t('virtualMachineNetworkSection.uncoveredItem', {
+                                                        envVar: entry.envVar,
+                                                        hosts: entry.hosts.join(', '),
+                                                        policy: selectedPolicy.name,
+                                                    }) }, entry.envVar))) })] })] }), !policiesForbidden && (jsxs(Button$1, { type: "button", variant: "outline", size: "sm", onClick: () => void handleAddHostsAndSave(selectedPolicy), disabled: isBusy, "data-testid": "vm-add-hosts-and-save", children: [isUpdatingPolicy && (jsx(LoaderCircle, { className: "h-4 w-4 animate-spin", "aria-hidden": "true" })), t('virtualMachineNetworkSection.addHostsAndSave', { policy: selectedPolicy.name })] }))] })), formError && (jsx("div", { role: "alert", "data-testid": "vm-network-form-error", className: "rounded-md border border-red-200 bg-red-50 px-3 py-2 text-sm text-red-700", children: formError })), jsxs("div", { className: "flex items-center justify-end gap-2", children: [jsx(Button$1, { type: "button", variant: "outline", size: "sm", onClick: resetDraft, disabled: !isDirty || isBusy, "data-testid": "vm-network-discard", children: t('virtualMachineNetworkSection.discard') }), jsxs(Button$1, { type: "button", size: "sm", onClick: handleSave, disabled: !isDirty || !isValid || isBusy, "data-testid": "vm-network-save", className: "cursor-pointer bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: [isSaving && jsx(LoaderCircle, { className: "h-4 w-4 animate-spin", "aria-hidden": "true" }), t('virtualMachineNetworkSection.save')] })] })] }), jsx(NetworkPolicyDialog, { open: policyDialogOpen, onOpenChange: setPolicyDialogOpen, tenantKey: platformKey, policy: policyDialogPolicy, onSaved: (policy) => setPolicyId(policy.id) }), jsx(Dialog, { open: manageTab !== null, onOpenChange: (open) => !open && setManageTab(null), children: jsxs(DialogContent, { className: "max-h-[90vh] w-full max-w-5xl overflow-y-auto", "data-testid": "vm-manage-dialog", children: [jsxs(DialogHeader, { children: [jsx(DialogTitle, { children: t('virtualMachineNetworkSection.manageTitle') }), jsx(DialogDescription, { children: t('virtualMachineNetworkSection.manageDescription') })] }), jsx(VirtualMachineAdminTab, { tenantKey: platformKey, username: username, defaultTab: manageTab !== null && manageTab !== void 0 ? manageTab : 'network-policies' })] }) }), jsx(Dialog, { open: confirmNarrowOpen, onOpenChange: setConfirmNarrowOpen, children: jsxs(DialogContent, { className: "max-w-md", "data-testid": "vm-narrow-confirm", children: [jsx(DialogHeader, { children: jsx(DialogTitle, { children: t('virtualMachineNetworkSection.narrowTitle') }) }), jsx(DialogDescription, { className: "text-gray-600", children: t('virtualMachineNetworkSection.narrowDescription', {
+                                profile: t(EGRESS_COPY[egress].label),
+                                count: serverSecretIds.length,
+                            }) }), jsxs(DialogFooter, { className: "pt-2", children: [jsx(Button$1, { type: "button", variant: "outline", onClick: () => setConfirmNarrowOpen(false), children: t('virtualMachineNetworkSection.cancel') }), jsx(Button$1, { type: "button", onClick: handleConfirmNarrow, "data-testid": "vm-narrow-confirm-action", className: "cursor-pointer bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: t('virtualMachineNetworkSection.narrowConfirm') })] })] }) })] }));
+}
+
 const HEALTHY_HEALTH_VALUES = new Set(['healthy', 'ok', 'pass', 'success']);
 const HEALTHY_STATUS_VALUES = new Set(['active', 'running', 'connected', 'ok', 'ready']);
 /** True when the instance's status is set and not one of the healthy values.
@@ -241004,7 +242682,7 @@ function SandboxConfig({ platformKey, mentorUniqueId, username }) {
                     llm_name: currentModel.llmName,
                     llm_provider: currentModel.provider,
                 }, llms: availableLLMProviders }))] })) : null;
-    return (jsxs("div", { className: "space-y-6", children: [sandboxKindsSection, clawEnabled && (mentorConfig ? connectedSection : notConnectedSection)] }));
+    return (jsxs("div", { className: "space-y-6", children: [sandboxKindsSection, sandboxFlags.enable_virtual_machine && (jsx(VirtualMachineNetworkSection, { platformKey: platformKey, mentorUniqueId: mentorUniqueId, username: resolvedUsername })), clawEnabled && (mentorConfig ? connectedSection : notConnectedSection)] }));
 }
 // ── Edit Instance Dialog ─────────────────────────────────────────────────────
 function EditInstanceDialog({ instance, org, onClose, onSaved, }) {
@@ -248892,5 +250570,5 @@ var trainOrDeleteModal = /*#__PURE__*/Object.freeze({
     TrainOrDeleteModal: TrainOrDeleteModal
 });
 
-export { ACCESS_COURSE_LABEL, ALL_CATEGORIES, AccessTimeHeatmap, AccessiblePaginate, AddMentorToProjectModal, AddSkillDialog, Admin, AdvancedTab, AgentConfigPrompts, AgentScopeLink, AgentSkills, AlertsTab, AnalyticsAgentPicker, AnalyticsAreaChart, AnalyticsAuditLogStats, AnalyticsBarChart, AnalyticsControlBar, AnalyticsCourseDetail, AnalyticsCourses, AnalyticsFinancialStats, AnalyticsGlobalFiltersProvider, AnalyticsLayout, AnalyticsLlmUsageStats, AnalyticsMemoryStats, AnalyticsMonetizationStats, AnalyticsNotice, AnalyticsOverview, AnalyticsPlatformAuditLog, AnalyticsProgramDetail, AnalyticsPrograms, AnalyticsReportDownload, AnalyticsReports, AnalyticsScopeProvider, AnalyticsSettingsProvider, AnalyticsTopicsStats, AnalyticsTraces, AnalyticsTranscriptsStats, AnalyticsUsersStats, AppleRestrictionModal, ApplyWizard, AuditLogChangesView, AuditLogJsonView, BUY_NOW_LABEL, BillingTab, CATALOGS, CHART_ORDINAL_RAMP, CHART_SERIES_COLORS, CHART_SINGLE_SERIES_COLOR, CREATE_AGENT_LABELS, CUA_DRIVER_REPO_URL, CUA_DRIVER_TAURI_COMMANDS, CUA_DRIVER_TAURI_EVENTS, CardInfoIcon, CategorizedDropdownMenu, ChartCardWrapper, ChartFiltersProvider, ChartLoading, ChartTooltipCard, ChatContext, ChatPrivacyToggle, ChatProvider, CompanyDialog, ConnectorManagementDialog, CopyButtonIcon, CourseAccessGuard, CourseCardSkeleton, CourseContentLoading, CourseOutline, CourseOutlineContext, CourseOutlineDrawer, CreateAgentForm, CreateAgentModal, CreateProjectModal, CreateWorkflowModal, CredentialBox, CredentialMiniBoxSkeleton, CredentialsList, CreditBalance, CustomDateRangePicker, CustomTooltip, DEFAULT_COWORK_REQUIRED_SIZE_GB, DEFAULT_LOCALE, DEFAULT_USER_IDENTITY_ORDER, DefaultEmptyBox, DeleteProjectModal, DeleteWorkflowModal, DiscoverContentCard, DiscoverFacetsFilter, DiscoverFilterDrawer, DocumentSidebar, DropdownMenu, DropdownMenuCheckboxItem, DropdownMenuContent, DropdownMenuGroup, DropdownMenuItem, DropdownMenuLabel, DropdownMenuPortal, DropdownMenuRadioGroup, DropdownMenuRadioItem, DropdownMenuSeparator, DropdownMenuShortcut, DropdownMenuSub, DropdownMenuSubContent, DropdownMenuSubTrigger, DropdownMenuTrigger, ENROLL_NOW_COURSE_STARTING_SOON_LABEL, ENROLL_NOW_LABEL, EditAlertDialog, EducationBox, EducationDialog, EducationTab, EdxIframeContext, EmptyStats, ExperienceBox, ExperienceDialog, ExperienceTab, FacetFilterContext, Footer, GradebookTab, GroupsFilterDropdown, INVITATION_ONLY_LABEL, InstitutionDialog, IntegrationsTab, InviteUserContent, InviteUserDialog, InvitedUsersDialog, LOCAL_LLM_CHANGED_EVENT, LOCAL_MODELS, LlmModelBadge, Loader, LocalLLMTab, LocalModelsContent, LoginButton, MACOS_PERMISSIONS_COMMANDS, MEMORY_PAGE_SIZE, Markdown, MemoryAdminTab, MinimumMentorAlert, MonetizationTab, NotificationDisplay, NotificationDropdown, ONBOARDING_FIELD_TYPES, ONBOARDING_SECTORS, OnboardingField, OnboardingShell, OnboardingWizard, PLATFORM_AUDIT_DEEP_PAGING_THRESHOLD, PLATFORM_AUDIT_PAGE_SIZE, PaywallModal, PlacementExam, PlacementExamsDropdown, PlatformAuditLogDetailSheet, PlatformNavbar, PlatformNavbarSearch, Profile, ProfileTimeChart, ProgressDots, ProjectActionButtons, ProjectFilesModal, ProjectInstructionsModal, ProjectLandingPage, ProjectMentorsList, ProjectsPage, REQUEST_ACCESS_COURSE_STARTING_SOON_LABEL, REQUEST_ACCESS_LABEL, RankedBars, RenameProjectModal, ResumeBox, ResumeTab, RetrievedDocumentsButton, RichTextEditor, SERVICE_COLOR_ORDER, SUPPORTED_LOCALES, SandboxConfig, SearchableMultiSelect, SendNotificationDialog, SignupButton, SkeletonActivityStatBox, SkeletonAddSkillsLoading, SkeletonCreatePathwaySearchList, SkeletonDiscoverFilterBox, SkeletonEducationBox, SkeletonMultiplier, SkeletonPathwayBox, SkeletonProfileInfoCard, SkeletonSkillBox, SkillBox, SkillDetailModal, SkillLeaderboardChart, SkillsBox, SkillsList, SlashSkillPicker, SourceChip, Spinner, StatCard, StepHeader, SummerNoteTextEditor, TAURI_COMMANDS, TAURI_EVENTS, TRACES_PAGE_SIZE, TenantSwitcher, TimeFilter, TimeTrackingProvider, TimedExam, ToolCallIndicator, ToolDialogs, TopBanner, TranscriptFileCards, TranscriptRollupBadges, TranscriptTurnDetails, TrendSparkline, USER_ONBOARDING_FORM_SLUG, USER_ONBOARDING_FORM_VERSION, USER_ONBOARDING_SUBMISSION_SLUG, UpgradePackageModal, UserAvatar, UserOnboardingWizard, UserProfileDialog, UserProfileLink, Version, WebContainersI18nProvider, WorkflowSidebar, addBookmarksTab, areChartFiltersEqual, availablePlacementExams, buildOnboardingAgentPath, buildUserOnboardingFormMetadata, buildUserOnboardingSubmissionMetadata, coerceOnboardingAgent, coerceOnboardingAgents, coerceUserOnboardingForm, colorForRank, colorForSeries, conversationDocuments, emptyUserOnboardingForm, findLastResumeBlock, findOnboardingAgent, findSequentialParent, flattenVerticalBlocks, formatAuditTimestamp, formatCompactNumber, formatFileSize, formatLatencySeconds, formatResult, formatTimeZoneLabel, getCatalog, getFirstAvailableUnit, getFriendlyToolName, getLLMModelDisplayName, getLocalLLMModel, getLocalLLMToolSupport, getNextUnitIframe, getOrg, getParentBlockById, getParentsInfosFromSublessonId, getPreviousUnitIframe, getQueryLabel, getRandomCourseImage, getSectorById, getTenant, getUnitToIframe, getUserId, getUserName, granularityForFilter, hasDistinctName, hasOnboardingContent, humanizeAuditToken, humanizeFieldName, inBrowserPrint, inIframe, inferProviderKeysFromModel, initialCuaDriverInstallState, initialModelDownloadState, isCoworkEnabled, isEmailLike, isFileReference, isLlmUsageForbidden, isLlmUsageUnavailable, isLocalLLMEnabled, isPlatformNavbarCreditBalanceVisible, isSlashCommandToken, isTauriApp, isValidLocale, isValidTimeZone, llmUsageDateArgs, components as markdownComponents, modelSupportsCowork, onboardingPrimaryButtonClass, onboardingSecondaryButtonClass, readUserOnboardingForm, readUserOnboardingSubmission, readUserOnboardingSubmissions, resolveAuditTimeZone, resolveCreateAgentLabels, resolveUserIdentity, sanitizeCss, setCoworkEnabled, setLocalLLMEnabled, setLocalLLMModel, setLocalLLMToolSupport, smallestCoworkModel, summarizeTranscriptTurns, toFileReference, toRetrievedDocuments, toToolCallInfos, useAnalyticsGlobalFilters, useAnalyticsScope, useAnalyticsSettings, useAuditLog, useCatalogSearch, useChartFilters, useChatPrivacy, useChatState, useCourseDetail, useCourseMetadata, useCourses, useCuaDriver, useDiscover, useEdxIframe, useFinancial, useIframeMessageHandler, useLlmDisplayName, useLlmProviderCatalogue, useLlmTraces, useLlmUsage, useLocalStorage, useMemory, useModelDownload, useMonetization, useOverview, usePlatformAuditLabels, usePlatformAuditLog, useProfileActivityStats, useProfileCredentials, useProfilePathways, useProfilePrograms, useProfileSkills, useProfileTimeSpent, usePrograms, useReports, useScopedMentorDbId, useScopedMentorId, useSelectedLocalModel, useSlashSkillPicker, useSlashSkills, useT, useTauri, useTimeTracking, useTopics, useTranscripts, useUserCourses, useUserMetadata, useUsers, useWebContainersI18n, useWebContainersLocale };
+export { ACCESS_COURSE_LABEL, ALL_CATEGORIES, AccessTimeHeatmap, AccessiblePaginate, AddMentorToProjectModal, AddSkillDialog, Admin, AdvancedTab, AgentConfigPrompts, AgentScopeLink, AgentSkills, AlertsTab, AnalyticsAgentPicker, AnalyticsAreaChart, AnalyticsAuditLogStats, AnalyticsBarChart, AnalyticsControlBar, AnalyticsCourseDetail, AnalyticsCourses, AnalyticsFinancialStats, AnalyticsGlobalFiltersProvider, AnalyticsLayout, AnalyticsLlmUsageStats, AnalyticsMemoryStats, AnalyticsMonetizationStats, AnalyticsNotice, AnalyticsOverview, AnalyticsPlatformAuditLog, AnalyticsProgramDetail, AnalyticsPrograms, AnalyticsReportDownload, AnalyticsReports, AnalyticsScopeProvider, AnalyticsSettingsProvider, AnalyticsTopicsStats, AnalyticsTraces, AnalyticsTranscriptsStats, AnalyticsUsersStats, AppleRestrictionModal, ApplyWizard, AuditLogChangesView, AuditLogJsonView, BUY_NOW_LABEL, BillingTab, CATALOGS, CHART_ORDINAL_RAMP, CHART_SERIES_COLORS, CHART_SINGLE_SERIES_COLOR, CREATE_AGENT_LABELS, CUA_DRIVER_REPO_URL, CUA_DRIVER_TAURI_COMMANDS, CUA_DRIVER_TAURI_EVENTS, CardInfoIcon, CategorizedDropdownMenu, ChartCardWrapper, ChartFiltersProvider, ChartLoading, ChartTooltipCard, ChatContext, ChatPrivacyToggle, ChatProvider, CompanyDialog, ConnectorManagementDialog, CopyButtonIcon, CourseAccessGuard, CourseCardSkeleton, CourseContentLoading, CourseOutline, CourseOutlineContext, CourseOutlineDrawer, CreateAgentForm, CreateAgentModal, CreateProjectModal, CreateWorkflowModal, CredentialBox, CredentialMiniBoxSkeleton, CredentialsList, CreditBalance, CustomDateRangePicker, CustomTooltip, DEFAULT_COWORK_REQUIRED_SIZE_GB, DEFAULT_LOCALE, DEFAULT_USER_IDENTITY_ORDER, DefaultEmptyBox, DeleteProjectModal, DeleteWorkflowModal, DiscoverContentCard, DiscoverFacetsFilter, DiscoverFilterDrawer, DocumentSidebar, DropdownMenu, DropdownMenuCheckboxItem, DropdownMenuContent, DropdownMenuGroup, DropdownMenuItem, DropdownMenuLabel, DropdownMenuPortal, DropdownMenuRadioGroup, DropdownMenuRadioItem, DropdownMenuSeparator, DropdownMenuShortcut, DropdownMenuSub, DropdownMenuSubContent, DropdownMenuSubTrigger, DropdownMenuTrigger, ENROLL_NOW_COURSE_STARTING_SOON_LABEL, ENROLL_NOW_LABEL, EditAlertDialog, EducationBox, EducationDialog, EducationTab, EdxIframeContext, EmptyStats, ExperienceBox, ExperienceDialog, ExperienceTab, FacetFilterContext, Footer, GradebookTab, GroupsFilterDropdown, HostPortChipInput, INVITATION_ONLY_LABEL, InstitutionDialog, IntegrationsTab, InviteUserContent, InviteUserDialog, InvitedUsersDialog, LOCAL_LLM_CHANGED_EVENT, LOCAL_MODELS, LlmModelBadge, Loader, LocalLLMTab, LocalModelsContent, LoginButton, MACOS_PERMISSIONS_COMMANDS, MEMORY_PAGE_SIZE, Markdown, MemoryAdminTab, MinimumMentorAlert, MonetizationTab, NotificationDisplay, NotificationDropdown, ONBOARDING_FIELD_TYPES, ONBOARDING_SECTORS, OnboardingField, OnboardingShell, OnboardingWizard, PLATFORM_AUDIT_DEEP_PAGING_THRESHOLD, PLATFORM_AUDIT_PAGE_SIZE, PaywallModal, PlacementExam, PlacementExamsDropdown, PlatformAuditLogDetailSheet, PlatformNavbar, PlatformNavbarSearch, Profile, ProfileTimeChart, ProgressDots, ProjectActionButtons, ProjectFilesModal, ProjectInstructionsModal, ProjectLandingPage, ProjectMentorsList, ProjectsPage, REQUEST_ACCESS_COURSE_STARTING_SOON_LABEL, REQUEST_ACCESS_LABEL, RankedBars, RenameProjectModal, ResumeBox, ResumeTab, RetrievedDocumentsButton, RichTextEditor, SERVICE_COLOR_ORDER, SUPPORTED_LOCALES, SandboxConfig, SearchableMultiSelect, SendNotificationDialog, SignupButton, SkeletonActivityStatBox, SkeletonAddSkillsLoading, SkeletonCreatePathwaySearchList, SkeletonDiscoverFilterBox, SkeletonEducationBox, SkeletonMultiplier, SkeletonPathwayBox, SkeletonProfileInfoCard, SkeletonSkillBox, SkillBox, SkillDetailModal, SkillLeaderboardChart, SkillsBox, SkillsList, SlashSkillPicker, SourceChip, Spinner, StatCard, StepHeader, SummerNoteTextEditor, TAURI_COMMANDS, TAURI_EVENTS, TRACES_PAGE_SIZE, TenantSwitcher, TimeFilter, TimeTrackingProvider, TimedExam, ToolCallIndicator, ToolDialogs, TopBanner, TranscriptFileCards, TranscriptRollupBadges, TranscriptTurnDetails, TrendSparkline, USER_ONBOARDING_FORM_SLUG, USER_ONBOARDING_FORM_VERSION, USER_ONBOARDING_SUBMISSION_SLUG, UpgradePackageModal, UserAvatar, UserOnboardingWizard, UserProfileDialog, UserProfileLink, Version, VirtualMachineAdminTab, VirtualMachineNetworkSection, WebContainersI18nProvider, WorkflowSidebar, addBookmarksTab, areChartFiltersEqual, availablePlacementExams, buildOnboardingAgentPath, buildUserOnboardingFormMetadata, buildUserOnboardingSubmissionMetadata, coerceOnboardingAgent, coerceOnboardingAgents, coerceUserOnboardingForm, colorForRank, colorForSeries, conversationDocuments, emptyUserOnboardingForm, findLastResumeBlock, findOnboardingAgent, findSequentialParent, flattenVerticalBlocks, formatAuditTimestamp, formatCompactNumber, formatFileSize, formatLatencySeconds, formatResult, formatTimeZoneLabel, getCatalog, getFirstAvailableUnit, getFriendlyToolName, getLLMModelDisplayName, getLocalLLMModel, getLocalLLMToolSupport, getNextUnitIframe, getOrg, getParentBlockById, getParentsInfosFromSublessonId, getPreviousUnitIframe, getQueryLabel, getRandomCourseImage, getSectorById, getTenant, getUnitToIframe, getUserId, getUserName, granularityForFilter, hasDistinctName, hasOnboardingContent, humanizeAuditToken, humanizeFieldName, inBrowserPrint, inIframe, inferProviderKeysFromModel, initialCuaDriverInstallState, initialModelDownloadState, isCoworkEnabled, isEmailLike, isFileReference, isLlmUsageForbidden, isLlmUsageUnavailable, isLocalLLMEnabled, isPlatformNavbarCreditBalanceVisible, isSlashCommandToken, isTauriApp, isValidLocale, isValidTimeZone, llmUsageDateArgs, components as markdownComponents, modelSupportsCowork, onboardingPrimaryButtonClass, onboardingSecondaryButtonClass, readUserOnboardingForm, readUserOnboardingSubmission, readUserOnboardingSubmissions, resolveAuditTimeZone, resolveCreateAgentLabels, resolveUserIdentity, sanitizeCss, setCoworkEnabled, setLocalLLMEnabled, setLocalLLMModel, setLocalLLMToolSupport, smallestCoworkModel, summarizeTranscriptTurns, toFileReference, toRetrievedDocuments, toToolCallInfos, useAnalyticsGlobalFilters, useAnalyticsScope, useAnalyticsSettings, useAuditLog, useCatalogSearch, useChartFilters, useChatPrivacy, useChatState, useCourseDetail, useCourseMetadata, useCourses, useCredentialsSchemaLogos, useCuaDriver, useDiscover, useEdxIframe, useFinancial, useIframeMessageHandler, useLlmDisplayName, useLlmProviderCatalogue, useLlmTraces, useLlmUsage, useLocalStorage, useMemory, useModelDownload, useMonetization, useOverview, usePlatformAuditLabels, usePlatformAuditLog, useProfileActivityStats, useProfileCredentials, useProfilePathways, useProfilePrograms, useProfileSkills, useProfileTimeSpent, usePrograms, useReports, useScopedMentorDbId, useScopedMentorId, useSelectedLocalModel, useSlashSkillPicker, useSlashSkills, useT, useTauri, useTimeTracking, useTopics, useTranscripts, useUserCourses, useUserMetadata, useUsers, useWebContainersI18n, useWebContainersLocale };
 //# sourceMappingURL=index.esm.js.map