lua-cli 3.23.2 → 3.24.0

package/dist/index.js

@@ -12890,17 +12890,42 @@ var init_custom_data_api_service = __esm({
         this.agentId = agentId;
       }
       /**
+      * Lists the agent's data collections with entry counts, timestamps, and —
+      * when declared — managed index status (fields, pending/building/ready/
+      * failed/rejected, error reason). The place to diagnose index declarations.
+      * @returns Promise resolving to the collections listing
+      */
+      async collections() {
+        const response = await this.httpGet(`/developer/agents/${this.agentId}/custom-data`, {
+          Authorization: `Bearer ${this.apiKey}`
+        });
+        if (response.success && response.data) {
+          return response.data;
+        }
+        throw new Error(response.error?.message || "Failed to list custom data collections");
+      }
+      /**
       * Creates a new custom data entry in a specified collection
       * @param collectionName - The name of the collection to create the entry in
       * @param data - The data object to store in the entry
-      * @param searchText - Optional text to be used for semantic search indexing
+      * @param optionsOrSearchText - Either a searchText string (legacy form) or an
+      *   options object: `searchText` for semantic search indexing, and `index` to
+      *   declare data fields this agent filters on (e.g. `['business_id']` or
+      *   compounds like `[['country', 'business_id']]`). Declared fields get
+      *   agent-scoped database indexes maintained by the platform: created when
+      *   first declared, removed automatically ~14 days after the code stops
+      *   declaring them. Declaring on every write is the intended, idempotent use.
       * @returns Promise resolving to a DataEntryInstance representing the created entry
       * @throws Error if the entry creation fails or the API request is unsuccessful
       */
-      async create(collectionName, data, searchText) {
+      async create(collectionName, data, optionsOrSearchText) {
+        const options = typeof optionsOrSearchText === "string" ? {
+          searchText: optionsOrSearchText
+        } : optionsOrSearchText ?? {};
         const response = await this.httpPost(`/developer/agents/${this.agentId}/custom-data/${collectionName}`, {
           data,
-          searchText
+          searchText: options.searchText,
+          index: options.index
         }, {
           Authorization: `Bearer ${this.apiKey}`
         });
@@ -12953,14 +12978,19 @@ var init_custom_data_api_service = __esm({
       * @param collectionName - The name of the collection containing the entry
       * @param entryId - The unique identifier of the entry to update
       * @param data - The data object to update
-      * @param searchText - Optional text to be used for semantic search indexing
+      * @param optionsOrSearchText - searchText string (legacy) or { searchText?, index? };
+      *   `index` refreshes this agent's index declarations (same semantics as create)
       * @returns Promise resolving to an UpdateCustomDataResponse with the updated entry details
       * @throws Error if the entry is not found or the update fails
       */
-      async update(collectionName, entryId, data, searchText) {
+      async update(collectionName, entryId, data, optionsOrSearchText) {
+        const options = typeof optionsOrSearchText === "string" ? {
+          searchText: optionsOrSearchText
+        } : optionsOrSearchText ?? {};
         const response = await this.httpPut(`/developer/agents/${this.agentId}/custom-data/${collectionName}/${entryId}`, {
           data,
-          searchText
+          searchText: options.searchText,
+          index: options.index
         }, {
           Authorization: `Bearer ${this.apiKey}`
         });
@@ -20723,6 +20753,14 @@ var DEFAULT_BLOCK_CIDRS = [
   "fe80::/10",
   "fc00::/7"
 ];
+var HOSTNAME_NON_OVERRIDABLE_CIDRS = [
+  "127.0.0.0/8",
+  "169.254.0.0/16",
+  "0.0.0.0/8",
+  "::1/128",
+  "fe80::/10",
+  "fd00:ec2::254/128"
+];
 function ipv4ToInt(ip) {
   const parts = ip.split(".").map(Number);
   if (parts.length !== 4 || parts.some((n) => Number.isNaN(n) || n < 0 || n > 255)) {
@@ -20824,24 +20862,50 @@ function ipInCidr(ip, cidrs) {
 }
 __name(ipInCidr, "ipInCidr");
 __name4(ipInCidr, "ipInCidr");
+function normalizeHostname(hostname) {
+  return stripBrackets(hostname.trim()).toLowerCase().replace(/\.$/, "");
+}
+__name(normalizeHostname, "normalizeHostname");
+__name4(normalizeHostname, "normalizeHostname");
+function parseAllowedHostname(value) {
+  const hostname = normalizeHostname(value);
+  if (!hostname || net.isIP(hostname) || /[\s*/:\\?#]/.test(hostname)) {
+    throw new Error(`Invalid sandbox egress hostname allowlist entry: ${JSON.stringify(value)}. Use an exact hostname without a wildcard, URL, port, or IP literal.`);
+  }
+  return hostname;
+}
+__name(parseAllowedHostname, "parseAllowedHostname");
+__name4(parseAllowedHostname, "parseAllowedHostname");
 function compile2(opts) {
   return {
     blockCidrs: DEFAULT_BLOCK_CIDRS.map(parseCidr),
     allowCidrs: (opts.extraAllowedCidrs ?? []).map(parseCidr),
+    allowHostnames: new Set((opts.extraAllowedHostnames ?? []).map(parseAllowedHostname)),
+    hostnameNonOverridableCidrs: HOSTNAME_NON_OVERRIDABLE_CIDRS.map(parseCidr),
     mode: opts.mode,
     onEvent: opts.onSecurityEvent
   };
 }
 __name(compile2, "compile");
 __name4(compile2, "compile");
-function checkAddress(address, guard) {
-  if (ipInCidr(address, guard.allowCidrs)) return null;
+function isAllowedHostname(hostname, guard) {
+  return !net.isIP(hostname) && guard.allowHostnames.has(normalizeHostname(hostname));
+}
+__name(isAllowedHostname, "isAllowedHostname");
+__name4(isAllowedHostname, "isAllowedHostname");
+function checkAddress(address, guard, allowedByHostname = false) {
+  const v4 = ipv4MappedFromIpv6(address);
+  if (ipInCidr(address, guard.allowCidrs) || v4 !== null && ipInCidr(v4, guard.allowCidrs)) return null;
+  if (allowedByHostname) {
+    if (ipInCidr(address, guard.hostnameNonOverridableCidrs) || v4 !== null && ipInCidr(v4, guard.hostnameNonOverridableCidrs)) {
+      return `address ${address} is protected from sandbox hostname allowances`;
+    }
+    return null;
+  }
   if (ipInCidr(address, guard.blockCidrs)) {
     return `address ${address} is in the sandbox egress block list`;
   }
-  const v4 = ipv4MappedFromIpv6(address);
   if (v4) {
-    if (ipInCidr(v4, guard.allowCidrs)) return null;
     if (ipInCidr(v4, guard.blockCidrs)) {
       return `address ${address} (IPv4-mapped: ${v4}) is in the sandbox egress block list`;
     }
@@ -20866,8 +20930,9 @@ async function resolveAndCheck(hostname, guard) {
   } catch {
     return null;
   }
+  const allowedByHostname = isAllowedHostname(hostname, guard);
   for (const { address } of addresses) {
-    const reason = checkAddress(address, guard);
+    const reason = checkAddress(address, guard, allowedByHostname);
     if (reason) return {
       reason,
       address
@@ -20978,8 +21043,9 @@ function buildBlockingLookup(guard, target) {
     }, (err, addresses) => {
       if (err) return cb(err);
       const list = addresses;
+      const allowedByHostname = isAllowedHostname(hostname, guard);
       for (const { address } of list) {
-        const reason = checkAddress(address, guard);
+        const reason = checkAddress(address, guard, allowedByHostname);
         if (reason) {
           emit(guard, target, reason, address);
           if (guard.mode === "enforce") {
@@ -21275,6 +21341,7 @@ function createBaseSandboxContext(opts) {
   const egressOpts = {
     mode: egressMode,
     extraAllowedCidrs: opts.egressExtraAllowedCidrs,
+    extraAllowedHostnames: opts.egressExtraAllowedHostnames,
     onSecurityEvent: onSecurityEvent ? (evt) => onSecurityEvent(evt) : void 0
   };
   const wrappedModuleCache = /* @__PURE__ */ new Map();
@@ -21338,6 +21405,13 @@ function resolveExtraAllowedCidrs() {
 }
 __name(resolveExtraAllowedCidrs, "resolveExtraAllowedCidrs");
 __name4(resolveExtraAllowedCidrs, "resolveExtraAllowedCidrs");
+function resolveExtraAllowedHostnames() {
+  const csv = process.env.LUA_ALLOWED_EGRESS_HOSTNAMES;
+  if (!csv) return [];
+  return csv.split(",").map((s) => s.trim()).filter(Boolean);
+}
+__name(resolveExtraAllowedHostnames, "resolveExtraAllowedHostnames");
+__name4(resolveExtraAllowedHostnames, "resolveExtraAllowedHostnames");
 function wrapBundleAsCjsModule(source) {
   return "(function(module, exports, require) {\n" + source + "\n})(module, module.exports, require);";
 }
@@ -21571,6 +21645,12 @@ function resolveExtraAllowedCidrs2() {
   return csv.split(",").map((s) => s.trim()).filter(Boolean);
 }
 __name(resolveExtraAllowedCidrs2, "resolveExtraAllowedCidrs");
+function resolveExtraAllowedHostnames2() {
+  const csv = process.env.LUA_ALLOWED_EGRESS_HOSTNAMES;
+  if (!csv) return [];
+  return csv.split(",").map((s) => s.trim()).filter(Boolean);
+}
+__name(resolveExtraAllowedHostnames2, "resolveExtraAllowedHostnames");
 function defaultSecurityEventLogger(evt) {
   console.warn("[sandbox]", JSON.stringify(evt));
 }
@@ -21759,6 +21839,7 @@ function createSandbox(options) {
     requireMode: resolveRequireMode(),
     egressMode: resolveEgressMode(),
     egressExtraAllowedCidrs: resolveExtraAllowedCidrs2(),
+    egressExtraAllowedHostnames: resolveExtraAllowedHostnames2(),
     onSecurityEvent: defaultSecurityEventLogger
   });
 }