@agentforge/tools 0.16.75 → 0.16.77

package/dist/index.cjs

@@ -1,7 +1,9 @@
 'use strict';
 
 var core = require('@agentforge/core');
-var axios16 = require('axios');
+var promises = require('dns/promises');
+var net = require('net');
+var axios13 = require('axios');
 var zod = require('zod');
 var cheerio = require('cheerio');
 var webApi = require('@slack/web-api');
@@ -37,7 +39,8 @@ function _interopNamespace(e) {
   return Object.freeze(n);
 }
 
-var axios16__default = /*#__PURE__*/_interopDefault(axios16);
+var net__default = /*#__PURE__*/_interopDefault(net);
+var axios13__default = /*#__PURE__*/_interopDefault(axios13);
 var cheerio__namespace = /*#__PURE__*/_interopNamespace(cheerio);
 var neo4j__default = /*#__PURE__*/_interopDefault(neo4j);
 var path7__namespace = /*#__PURE__*/_interopNamespace(path7);
@@ -48,6 +51,204 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   if (typeof require !== "undefined") return require.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
+var DEFAULT_MAX_REDIRECTS = 5;
+var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var IPV4_MAPPED_NETWORK = "::ffff:0:0";
+var SENSITIVE_REDIRECT_HEADERS = /* @__PURE__ */ new Set(["authorization", "cookie", "proxy-authorization"]);
+var DEFAULT_DESTINATION_POLICY = Object.freeze({
+  allowLocalhost: false,
+  allowPrivateNetwork: false,
+  allowLinkLocal: false,
+  allowMetadata: false,
+  allowRedirects: true,
+  maxRedirects: DEFAULT_MAX_REDIRECTS
+});
+var DestinationPolicyError = class extends Error {
+  constructor(url, reason, message) {
+    super(message);
+    this.url = url;
+    this.reason = reason;
+    this.name = "DestinationPolicyError";
+  }
+  code = "WEB_DESTINATION_BLOCKED";
+};
+function ipv4ToNumber(address) {
+  const octets = address.split(".").map(Number);
+  if (octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) return void 0;
+  return ((octets[0] * 256 + octets[1]) * 256 + octets[2]) * 256 + octets[3] >>> 0;
+}
+function ipv4InCidr(address, network, prefix) {
+  const value = ipv4ToNumber(address);
+  const networkValue = ipv4ToNumber(network);
+  if (value === void 0 || networkValue === void 0) return false;
+  const mask = prefix === 0 ? 0 : 4294967295 << 32 - prefix >>> 0;
+  return (value & mask) === (networkValue & mask);
+}
+function expandIpv6(address) {
+  const normalized = address.toLowerCase().split("%")[0];
+  let input = normalized;
+  const ipv4Start = normalized.lastIndexOf(":") + 1;
+  const ipv4 = normalized.slice(ipv4Start);
+  if (net__default.default.isIP(ipv4) === 4) {
+    const value = ipv4ToNumber(ipv4);
+    if (value === void 0) return void 0;
+    input = `${normalized.slice(0, ipv4Start)}${(value >>> 16).toString(16)}:${(value & 65535).toString(16)}`;
+  }
+  const halves = input.split("::");
+  if (halves.length > 2) return void 0;
+  const left = halves[0] ? halves[0].split(":").filter(Boolean) : [];
+  const right = halves.length === 2 && halves[1] ? halves[1].split(":").filter(Boolean) : [];
+  const missing = 8 - left.length - right.length;
+  if (missing < 0 || halves.length === 1 && missing !== 0) return void 0;
+  const groups = [...left, ...Array.from({ length: missing }, () => "0"), ...right];
+  if (groups.length !== 8 || groups.some((group) => !/^[0-9a-f]{1,4}$/.test(group))) return void 0;
+  return groups.reduce((value, group) => value << 16n | BigInt(parseInt(group, 16)), 0n);
+}
+function ipv6InCidr(address, network, prefix) {
+  return prefix === 0 || address >> BigInt(128 - prefix) === network >> BigInt(128 - prefix);
+}
+function ipv6ToIpv4(address) {
+  const mappedNetwork = expandIpv6(IPV4_MAPPED_NETWORK);
+  if (mappedNetwork === void 0 || !ipv6InCidr(address, mappedNetwork, 96)) return void 0;
+  const value = Number(address & 0xffffffffn) >>> 0;
+  return [value >>> 24, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
+}
+function classifyIp(address) {
+  const normalized = address.replace(/^\[|\]$/g, "").toLowerCase();
+  const version = net__default.default.isIP(normalized);
+  if (version === 4) {
+    if (normalized === "169.254.169.254") return "metadata";
+    if (ipv4InCidr(normalized, "127.0.0.0", 8)) return "localhost";
+    if (ipv4InCidr(normalized, "169.254.0.0", 16)) return "link-local";
+    if (ipv4InCidr(normalized, "10.0.0.0", 8) || ipv4InCidr(normalized, "172.16.0.0", 12) || ipv4InCidr(normalized, "192.168.0.0", 16) || ipv4InCidr(normalized, "100.64.0.0", 10)) return "private-network";
+    return void 0;
+  }
+  if (version !== 6) return void 0;
+  const value = expandIpv6(normalized);
+  if (value === void 0) return void 0;
+  const mappedIpv4 = ipv6ToIpv4(value);
+  if (mappedIpv4) return classifyIp(mappedIpv4);
+  if (value === expandIpv6("fd00:ec2::254")) return "metadata";
+  if (value === expandIpv6("::1")) return "localhost";
+  if (ipv6InCidr(value, expandIpv6("fe80::"), 10)) return "link-local";
+  if (ipv6InCidr(value, expandIpv6("fc00::"), 7)) return "private-network";
+  return void 0;
+}
+function classifyHostname(hostname) {
+  const normalized = hostname.toLowerCase().replace(/\.$/, "");
+  if (normalized === "localhost" || normalized.endsWith(".localhost") || normalized === "localhost.localdomain") return "localhost";
+  if (normalized === "metadata" || normalized === "metadata.google.internal" || normalized === "instance-data") return "metadata";
+  return classifyIp(normalized);
+}
+function policyAllows(reason, policy) {
+  if (reason === "localhost") return policy.allowLocalhost === true;
+  if (reason === "metadata") return policy.allowMetadata === true;
+  if (reason === "private-network") return policy.allowPrivateNetwork === true;
+  if (reason === "link-local") return policy.allowLinkLocal === true;
+  return false;
+}
+async function resolveDestinationAddresses(hostname) {
+  try {
+    const addresses = await promises.lookup(hostname, { all: true, verbatim: true });
+    return addresses.map(({ address, family }) => ({ address, family }));
+  } catch (error) {
+    throw new DestinationPolicyError(hostname, "dns-resolution-failed", `Destination policy could not resolve hostname "${hostname}" before making a request: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function blockDestination(url, reason) {
+  throw new DestinationPolicyError(url, reason, `Destination blocked by web egress policy (${reason}): ${url}`);
+}
+async function validateDestinationAllowed(url, policy) {
+  const effectivePolicy = { ...DEFAULT_DESTINATION_POLICY, ...policy };
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    blockDestination(url, "unsupported-protocol");
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") blockDestination(url, "unsupported-protocol");
+  const hostname = parsed.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  const directReason = classifyHostname(hostname);
+  if (directReason && !policyAllows(directReason, effectivePolicy)) blockDestination(url, directReason);
+  const version = net__default.default.isIP(hostname);
+  if (version !== 0) return [{ address: hostname, family: version }];
+  const addresses = await resolveDestinationAddresses(hostname);
+  for (const { address } of addresses) {
+    const reason = classifyIp(address);
+    if (reason && !policyAllows(reason, effectivePolicy)) blockDestination(url, reason);
+  }
+  return addresses;
+}
+async function assertDestinationAllowed(url, policy = {}) {
+  await validateDestinationAllowed(url, policy);
+}
+function isRedirectStatus(status) {
+  return REDIRECT_STATUSES.has(status);
+}
+function responseLocation(response) {
+  const headers = response.headers;
+  return headers.location ?? headers.Location;
+}
+function stripSensitiveRedirectHeaders(headers) {
+  if (!headers) return headers;
+  const sanitizedHeaders = { ...headers };
+  for (const headerName of Object.keys(sanitizedHeaders)) {
+    if (SENSITIVE_REDIRECT_HEADERS.has(headerName.toLowerCase())) delete sanitizedHeaders[headerName];
+  }
+  return sanitizedHeaders;
+}
+function createPinnedLookup(addresses) {
+  return (_hostname, options, callback) => {
+    const requestedFamily = "family" in options && (options.family === 4 || options.family === 6) ? options.family : void 0;
+    const candidates = requestedFamily ? addresses.filter(({ family: family2 }) => family2 === requestedFamily) : addresses;
+    if (candidates.length === 0) {
+      callback(new Error(`No validated destination address matches the requested address family: ${requestedFamily}`), "", void 0);
+      return;
+    }
+    if ("all" in options && options.all === true) {
+      callback(null, candidates, void 0);
+      return;
+    }
+    const [{ address, family }] = candidates;
+    callback(null, address, family);
+  };
+}
+async function requestWithDestinationPolicy(config, policy = {}) {
+  if (!config.url) throw new Error("A request URL is required for destination policy enforcement");
+  const effectivePolicy = { ...DEFAULT_DESTINATION_POLICY, ...policy };
+  const maxRedirects = effectivePolicy.maxRedirects;
+  if (!Number.isInteger(maxRedirects) || maxRedirects < 0) throw new Error("maxRedirects must be a non-negative integer");
+  let currentUrl = config.url;
+  let currentConfig = {
+    ...config,
+    url: currentUrl,
+    maxRedirects: 0,
+    validateStatus: (status) => isRedirectStatus(status) || (config.validateStatus ? config.validateStatus(status) : status >= 200 && status < 300)
+  };
+  for (let redirectCount = 0; ; redirectCount += 1) {
+    const validatedAddresses = await validateDestinationAllowed(currentUrl, effectivePolicy);
+    currentConfig.lookup = createPinnedLookup(validatedAddresses);
+    const response = await axios13__default.default(currentConfig);
+    if (!isRedirectStatus(response.status)) return response;
+    if (effectivePolicy.allowRedirects === false) blockDestination(currentUrl, "redirect");
+    if (redirectCount >= maxRedirects) throw new DestinationPolicyError(currentUrl, "redirect", `Maximum redirect count (${maxRedirects}) exceeded for ${currentUrl}`);
+    const location = responseLocation(response);
+    if (!location) throw new DestinationPolicyError(currentUrl, "redirect", `Redirect response did not include a Location header: ${currentUrl}`);
+    const previousUrl = currentUrl;
+    try {
+      currentUrl = new URL(location, currentUrl).toString();
+    } catch {
+      throw new DestinationPolicyError(currentUrl, "redirect", `Redirect response included an invalid Location header: ${location}`);
+    }
+    const method = String(currentConfig.method ?? "GET").toUpperCase();
+    const nextMethod = response.status === 303 || (response.status === 301 || response.status === 302) && method === "POST" ? "GET" : method;
+    currentConfig = { ...currentConfig, url: currentUrl, method: nextMethod };
+    if (new URL(previousUrl).origin !== new URL(currentUrl).origin) {
+      currentConfig.headers = stripSensitiveRedirectHeaders(currentConfig.headers);
+    }
+    if (nextMethod === "GET" || nextMethod === "HEAD") delete currentConfig.data;
+  }
+}
 var HttpMethod = zod.z.enum(["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"]);
 var httpRequestSchema = zod.z.object({
   url: zod.z.string().url().describe("The URL to make the request to"),
@@ -69,8 +270,8 @@ var httpPostSchema = zod.z.object({
 });
 
 // src/web/http/tools/http-client.ts
-function createHttpClientTool(defaultTimeout = 3e4, defaultHeaders = {}) {
-  return core.toolBuilder().name("http-client").description("Make HTTP requests to web APIs and services. Supports GET, POST, PUT, DELETE, PATCH methods with custom headers and body.").category(core.ToolCategory.WEB).tags(["http", "api", "request", "web"]).schema(httpRequestSchema).implement(async (input) => {
+function createHttpClientTool(defaultTimeout = 3e4, defaultHeaders = {}, destinationPolicy = {}) {
+  return core.toolBuilder().name("http-client").description("Make policy-checked HTTP requests to web APIs and services. Supports GET, POST, PUT, DELETE, PATCH methods with custom headers and body. Local, metadata, link-local, and private-network destinations are blocked by default.").category(core.ToolCategory.WEB).tags(["http", "api", "request", "web"]).schema(httpRequestSchema).implement(async (input) => {
     const config = {
       method: input.method,
       url: input.url,
@@ -81,37 +282,42 @@ function createHttpClientTool(defaultTimeout = 3e4, defaultHeaders = {}) {
       validateStatus: () => true
       // Don't throw on any status code
     };
-    const response = await axios16__default.default(config);
+    const response = await requestWithDestinationPolicy(config, destinationPolicy);
     return {
       status: response.status,
       statusText: response.statusText,
       headers: response.headers,
       data: response.data,
-      url: input.url,
+      url: response.config.url ?? input.url,
       method: input.method ?? "GET"
     };
   }).build();
 }
-function createHttpGetTool(defaultTimeout = 3e4, defaultHeaders = {}) {
-  return core.toolBuilder().name("http-get").description("Make a simple HTTP GET request to a URL and return the response data.").category(core.ToolCategory.WEB).tags(["http", "get", "fetch", "web"]).schema(httpGetSchema).implement(async (input) => {
-    const response = await axios16__default.default.get(input.url, {
+function createHttpGetTool(defaultTimeout = 3e4, defaultHeaders = {}, destinationPolicy = {}) {
+  return core.toolBuilder().name("http-get").description("Make a policy-checked HTTP GET request to a URL and return the response data. Local, metadata, link-local, and private-network destinations are blocked by default.").category(core.ToolCategory.WEB).tags(["http", "get", "fetch", "web"]).schema(httpGetSchema).implement(async (input) => {
+    const response = await requestWithDestinationPolicy({
+      method: "GET",
+      url: input.url,
       headers: { ...defaultHeaders, ...input.headers },
       params: input.params,
       timeout: defaultTimeout
-    });
+    }, destinationPolicy);
     return response.data;
   }).build();
 }
-function createHttpPostTool(defaultTimeout = 3e4, defaultHeaders = {}) {
-  return core.toolBuilder().name("http-post").description("Make a simple HTTP POST request with JSON body and return the response data.").category(core.ToolCategory.WEB).tags(["http", "post", "api", "web"]).schema(httpPostSchema).implement(async (input) => {
-    const response = await axios16__default.default.post(input.url, input.body, {
+function createHttpPostTool(defaultTimeout = 3e4, defaultHeaders = {}, destinationPolicy = {}) {
+  return core.toolBuilder().name("http-post").description("Make a policy-checked HTTP POST request with JSON body and return the response data. Local, metadata, link-local, and private-network destinations are blocked by default.").category(core.ToolCategory.WEB).tags(["http", "post", "api", "web"]).schema(httpPostSchema).implement(async (input) => {
+    const response = await requestWithDestinationPolicy({
+      method: "POST",
+      url: input.url,
+      data: input.body,
       headers: {
         "Content-Type": "application/json",
         ...defaultHeaders,
         ...input.headers
       },
       timeout: defaultTimeout
-    });
+    }, destinationPolicy);
     return response.data;
   }).build();
 }
@@ -122,11 +328,11 @@ var httpGet = createHttpGetTool();
 var httpPost = createHttpPostTool();
 var httpTools = [httpClient, httpGet, httpPost];
 function createHttpTools(config = {}) {
-  const { defaultTimeout = 3e4, defaultHeaders = {} } = config;
+  const { defaultTimeout = 3e4, defaultHeaders = {}, destinationPolicy = {} } = config;
   return [
-    createHttpClientTool(defaultTimeout, defaultHeaders),
-    createHttpGetTool(defaultTimeout, defaultHeaders),
-    createHttpPostTool(defaultTimeout, defaultHeaders)
+    createHttpClientTool(defaultTimeout, defaultHeaders, destinationPolicy),
+    createHttpGetTool(defaultTimeout, defaultHeaders, destinationPolicy),
+    createHttpPostTool(defaultTimeout, defaultHeaders, destinationPolicy)
   ];
 }
 var webScraperSchema = zod.z.object({
@@ -139,18 +345,20 @@ var webScraperSchema = zod.z.object({
   extractMetadata: zod.z.boolean().default(false).describe("Extract meta tags (title, description, etc.)"),
   timeout: zod.z.number().default(3e4).describe("Request timeout in milliseconds")
 });
-function createWebScraperTool(defaultTimeout = 3e4, userAgent = "Mozilla/5.0 (compatible; AgentForge/1.0; +https://agentforge.dev)") {
-  return core.toolBuilder().name("web-scraper").description("Scrape and extract data from web pages. Can extract text, HTML, links, images, and use CSS selectors to target specific elements.").category(core.ToolCategory.WEB).tags(["scraper", "web", "html", "extract", "parse"]).schema(webScraperSchema).implement(async (input) => {
-    const response = await axios16__default.default.get(input.url, {
+function createWebScraperTool(defaultTimeout = 3e4, userAgent = "Mozilla/5.0 (compatible; AgentForge/1.0; +https://agentforge.dev)", destinationPolicy = {}) {
+  return core.toolBuilder().name("web-scraper").description("Scrape and extract data from policy-checked web pages. Local, metadata, link-local, and private-network destinations are blocked by default. Supports text, HTML, links, images, and CSS selectors.").category(core.ToolCategory.WEB).tags(["scraper", "web", "html", "extract", "parse"]).schema(webScraperSchema).implement(async (input) => {
+    const response = await requestWithDestinationPolicy({
+      method: "GET",
+      url: input.url,
       timeout: input.timeout || defaultTimeout,
       headers: {
         "User-Agent": userAgent
       }
-    });
+    }, destinationPolicy);
     const html = response.data;
     const $ = cheerio__namespace.load(html);
     const result = {
-      url: input.url
+      url: response.config.url ?? input.url
     };
     const $selected = input.selector ? $(input.selector) : $("body");
     if (input.extractText) {
@@ -215,8 +423,8 @@ function createWebScraperTool(defaultTimeout = 3e4, userAgent = "Mozilla/5.0 (co
 var webScraper = createWebScraperTool();
 var scraperTools = [webScraper];
 function createScraperTools(config = {}) {
-  const { defaultTimeout = 3e4, userAgent = "Mozilla/5.0 (compatible; AgentForge/1.0; +https://agentforge.dev)" } = config;
-  return [createWebScraperTool(defaultTimeout, userAgent)];
+  const { defaultTimeout = 3e4, userAgent = "Mozilla/5.0 (compatible; AgentForge/1.0; +https://agentforge.dev)", destinationPolicy = {} } = config;
+  return [createWebScraperTool(defaultTimeout, userAgent, destinationPolicy)];
 }
 var htmlParserSchema = zod.z.object({
   html: zod.z.string().describe("The HTML content to parse"),
@@ -531,7 +739,7 @@ var DuckDuckGoProvider = class {
   async search(query, maxResults, timeout = DEFAULT_TIMEOUT) {
     return retryWithBackoff(async () => {
       try {
-        const response = await axios16__default.default.get(
+        const response = await axios13__default.default.get(
           "https://api.duckduckgo.com/",
           {
             params: {
@@ -635,7 +843,7 @@ var SerperProvider = class {
     }
     return retryWithBackoff(async () => {
       try {
-        const response = await axios16__default.default.post(
+        const response = await axios13__default.default.post(
           "https://google.serper.dev/search",
           {
             q: query,
@@ -1069,7 +1277,7 @@ function createSearchConfluenceTool(getAuth, getAuthHeader2, logger19) {
     logger19.info("search-confluence called", { query, limit });
     try {
       const { ATLASSIAN_SITE_URL } = getAuth();
-      const response = await axios16__default.default.get(`${ATLASSIAN_SITE_URL}/wiki/rest/api/content/search`, {
+      const response = await axios13__default.default.get(`${ATLASSIAN_SITE_URL}/wiki/rest/api/content/search`, {
         headers: {
           Authorization: getAuthHeader2(),
           Accept: "application/json"
@@ -1131,7 +1339,7 @@ function createGetConfluencePageTool(getAuth, getAuthHeader2, logger19) {
     logger19.info("get-confluence-page called", { page_id });
     try {
       const { ATLASSIAN_SITE_URL } = getAuth();
-      const response = await axios16__default.default.get(`${ATLASSIAN_SITE_URL}/wiki/rest/api/content/${page_id}`, {
+      const response = await axios13__default.default.get(`${ATLASSIAN_SITE_URL}/wiki/rest/api/content/${page_id}`, {
         headers: {
           Authorization: getAuthHeader2(),
           Accept: "application/json"
@@ -1182,7 +1390,7 @@ function createListConfluenceSpacesTool(getAuth, getAuthHeader2, logger19) {
     logger19.info("list-confluence-spaces called", { limit });
     try {
       const { ATLASSIAN_SITE_URL } = getAuth();
-      const response = await axios16__default.default.get(`${ATLASSIAN_SITE_URL}/wiki/rest/api/space`, {
+      const response = await axios13__default.default.get(`${ATLASSIAN_SITE_URL}/wiki/rest/api/space`, {
         headers: {
           Authorization: getAuthHeader2(),
           Accept: "application/json"
@@ -1228,7 +1436,7 @@ function createGetSpacePagesTool(getAuth, getAuthHeader2, logger19) {
     logger19.info("get-space-pages called", { space_key, limit });
     try {
       const { ATLASSIAN_SITE_URL } = getAuth();
-      const response = await axios16__default.default.get(`${ATLASSIAN_SITE_URL}/wiki/rest/api/content`, {
+      const response = await axios13__default.default.get(`${ATLASSIAN_SITE_URL}/wiki/rest/api/content`, {
         headers: {
           Authorization: getAuthHeader2(),
           Accept: "application/json"
@@ -1302,7 +1510,7 @@ function createCreateConfluencePageTool(getAuth, getAuthHeader2, logger19) {
       if (parent_page_id) {
         pageData.ancestors = [{ id: parent_page_id }];
       }
-      const response = await axios16__default.default.post(
+      const response = await axios13__default.default.post(
         `${ATLASSIAN_SITE_URL}/wiki/rest/api/content`,
         pageData,
         {
@@ -1350,7 +1558,7 @@ function createUpdateConfluencePageTool(getAuth, getAuthHeader2, logger19) {
     logger19.info("update-confluence-page called", { page_id, title });
     try {
       const { ATLASSIAN_SITE_URL } = getAuth();
-      const getResponse = await axios16__default.default.get(
+      const getResponse = await axios13__default.default.get(
         `${ATLASSIAN_SITE_URL}/wiki/rest/api/content/${page_id}`,
         {
           headers: {
@@ -1360,7 +1568,7 @@ function createUpdateConfluencePageTool(getAuth, getAuthHeader2, logger19) {
         }
       );
       const currentVersion = getResponse.data.version.number;
-      const updateResponse = await axios16__default.default.put(
+      const updateResponse = await axios13__default.default.put(
         `${ATLASSIAN_SITE_URL}/wiki/rest/api/content/${page_id}`,
         {
           type: "page",
@@ -1421,7 +1629,7 @@ function createArchiveConfluencePageTool(getAuth, getAuthHeader2, logger19) {
     });
     try {
       const { ATLASSIAN_SITE_URL } = getAuth();
-      const getResponse = await axios16__default.default.get(
+      const getResponse = await axios13__default.default.get(
         `${ATLASSIAN_SITE_URL}/wiki/rest/api/content/${page_id}`,
         {
           headers: {
@@ -1432,7 +1640,7 @@ function createArchiveConfluencePageTool(getAuth, getAuthHeader2, logger19) {
       );
       const currentVersion = getResponse.data.version.number;
       const pageData = getResponse.data;
-      await axios16__default.default.put(
+      await axios13__default.default.put(
         `${ATLASSIAN_SITE_URL}/wiki/rest/api/content/${page_id}`,
         {
           version: { number: currentVersion + 1 },
@@ -2497,7 +2705,7 @@ var OpenAIEmbeddingProvider = class {
     const modelToUse = model || this.defaultModel;
     return retryWithBackoff2(async () => {
       try {
-        const response = await axios16__default.default.post(
+        const response = await axios13__default.default.post(
           `${this.baseURL}/embeddings`,
           {
             input: text,
@@ -2561,7 +2769,7 @@ var OpenAIEmbeddingProvider = class {
     const modelToUse = model || this.defaultModel;
     return retryWithBackoff2(async () => {
       try {
-        const response = await axios16__default.default.post(
+        const response = await axios13__default.default.post(
           `${this.baseURL}/embeddings`,
           {
             input: texts,
@@ -2641,7 +2849,7 @@ var CohereEmbeddingProvider = class {
     const modelToUse = model || this.defaultModel;
     return retryWithBackoff2(async () => {
       try {
-        const response = await axios16__default.default.post(
+        const response = await axios13__default.default.post(
           `${this.baseUrl}/embed`,
           {
             texts,
@@ -2669,7 +2877,7 @@ var CohereEmbeddingProvider = class {
           } : void 0
         };
       } catch (error) {
-        if (axios16__default.default.isAxiosError(error)) {
+        if (axios13__default.default.isAxiosError(error)) {
           const status = error.response?.status;
           const message = error.response?.data?.message || error.message;
           let wrappedError;
@@ -2709,7 +2917,7 @@ var HuggingFaceEmbeddingProvider = class {
     const modelToUse = model || this.defaultModel;
     return retryWithBackoff2(async () => {
       try {
-        const response = await axios16__default.default.post(
+        const response = await axios13__default.default.post(
           `${this.baseUrl}/${modelToUse}`,
           {
             inputs: text,
@@ -2731,7 +2939,7 @@ var HuggingFaceEmbeddingProvider = class {
           dimensions: embedding.length
         };
       } catch (error) {
-        if (axios16__default.default.isAxiosError(error)) {
+        if (axios13__default.default.isAxiosError(error)) {
           const status = error.response?.status;
           const message = error.response?.data?.error || error.message;
           let wrappedError;
@@ -2758,7 +2966,7 @@ var HuggingFaceEmbeddingProvider = class {
     const modelToUse = model || this.defaultModel;
     return retryWithBackoff2(async () => {
       try {
-        const response = await axios16__default.default.post(
+        const response = await axios13__default.default.post(
           `${this.baseUrl}/${modelToUse}`,
           {
             inputs: texts,
@@ -2781,7 +2989,7 @@ var HuggingFaceEmbeddingProvider = class {
           dimensions
         };
       } catch (error) {
-        if (axios16__default.default.isAxiosError(error)) {
+        if (axios13__default.default.isAxiosError(error)) {
           const status = error.response?.status;
           const message = error.response?.data?.error || error.message;
           let wrappedError;
@@ -2832,7 +3040,7 @@ var VoyageEmbeddingProvider = class {
     const modelToUse = model || this.defaultModel;
     return retryWithBackoff2(async () => {
       try {
-        const response = await axios16__default.default.post(
+        const response = await axios13__default.default.post(
           `${this.baseUrl}/embeddings`,
           {
             input: texts,
@@ -2859,7 +3067,7 @@ var VoyageEmbeddingProvider = class {
           } : void 0
         };
       } catch (error) {
-        if (axios16__default.default.isAxiosError(error)) {
+        if (axios13__default.default.isAxiosError(error)) {
           const status = error.response?.status;
           const message = error.response?.data?.message || error.message;
           let wrappedError;
@@ -2898,7 +3106,7 @@ var OllamaEmbeddingProvider = class {
     const modelToUse = model || this.defaultModel;
     return retryWithBackoff2(async () => {
       try {
-        const response = await axios16__default.default.post(
+        const response = await axios13__default.default.post(
           `${this.baseUrl}/api/embeddings`,
           {
             model: modelToUse,
@@ -2917,7 +3125,7 @@ var OllamaEmbeddingProvider = class {
           dimensions: embedding.length
         };
       } catch (error) {
-        if (axios16__default.default.isAxiosError(error)) {
+        if (axios13__default.default.isAxiosError(error)) {
           const status = error.response?.status;
           const message = error.response?.data?.error || error.message;
           let wrappedError;
@@ -10395,11 +10603,13 @@ exports.CreditCardValidatorSchema = CreditCardValidatorSchema;
 exports.CurrentDateTimeSchema = CurrentDateTimeSchema;
 exports.DEFAULT_BATCH_SIZE = DEFAULT_BATCH_SIZE;
 exports.DEFAULT_CHUNK_SIZE = DEFAULT_CHUNK_SIZE;
+exports.DEFAULT_DESTINATION_POLICY = DEFAULT_DESTINATION_POLICY;
 exports.DEFAULT_RETRY_CONFIG = DEFAULT_RETRY_CONFIG2;
 exports.DateArithmeticSchema = DateArithmeticSchema;
 exports.DateComparisonSchema = DateComparisonSchema;
 exports.DateDifferenceSchema = DateDifferenceSchema;
 exports.DateFormatterSchema = DateFormatterSchema;
+exports.DestinationPolicyError = DestinationPolicyError;
 exports.DuckDuckGoProvider = DuckDuckGoProvider;
 exports.EmailValidatorSchema = EmailValidatorSchema;
 exports.EmbeddingManager = EmbeddingManager;
@@ -10433,6 +10643,7 @@ exports.arrayMapSchema = arrayMapSchema;
 exports.arraySort = arraySort;
 exports.arraySortSchema = arraySortSchema;
 exports.askHumanTool = askHumanTool;
+exports.assertDestinationAllowed = assertDestinationAllowed;
 exports.benchmarkBatchExecution = benchmarkBatchExecution;
 exports.benchmarkStreamingSelectMemory = benchmarkStreamingSelectMemory;
 exports.buildDeleteQuery = buildDeleteQuery;
@@ -10682,6 +10893,7 @@ exports.relationalInsert = relationalInsert;
 exports.relationalQuery = relationalQuery;
 exports.relationalSelect = relationalSelect;
 exports.relationalUpdate = relationalUpdate;
+exports.requestWithDestinationPolicy = requestWithDestinationPolicy;
 exports.retryWithBackoff = retryWithBackoff2;
 exports.scraperTools = scraperTools;
 exports.searchConfluence = searchConfluence;