@agentforge/tools 0.16.76 → 0.16.78

package/dist/index.js

@@ -1,5 +1,7 @@
 import { toolBuilder, ToolCategory, LogLevel, createLogger } from '@agentforge/core';
-import axios16 from 'axios';
+import { lookup } from 'dns/promises';
+import net from 'net';
+import axios13 from 'axios';
 import { z } from 'zod';
 import * as cheerio from 'cheerio';
 import { WebClient } from '@slack/web-api';
@@ -12,7 +14,7 @@ import { EventEmitter } from 'events';
 import { Readable } from 'stream';
 import { createHash, randomUUID } from 'crypto';
 import { promises } from 'fs';
-import * as path7 from 'path';
+import * as path from 'path';
 import { format, parse as parse$1, isValid, add, sub, differenceInDays, differenceInHours, differenceInMinutes, isAfter, isBefore } from 'date-fns';
 
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
@@ -21,6 +23,204 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
   if (typeof require !== "undefined") return require.apply(this, arguments);
   throw Error('Dynamic require of "' + x + '" is not supported');
 });
+var DEFAULT_MAX_REDIRECTS = 5;
+var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var IPV4_MAPPED_NETWORK = "::ffff:0:0";
+var SENSITIVE_REDIRECT_HEADERS = /* @__PURE__ */ new Set(["authorization", "cookie", "proxy-authorization"]);
+var DEFAULT_DESTINATION_POLICY = Object.freeze({
+  allowLocalhost: false,
+  allowPrivateNetwork: false,
+  allowLinkLocal: false,
+  allowMetadata: false,
+  allowRedirects: true,
+  maxRedirects: DEFAULT_MAX_REDIRECTS
+});
+var DestinationPolicyError = class extends Error {
+  constructor(url, reason, message) {
+    super(message);
+    this.url = url;
+    this.reason = reason;
+    this.name = "DestinationPolicyError";
+  }
+  code = "WEB_DESTINATION_BLOCKED";
+};
+function ipv4ToNumber(address) {
+  const octets = address.split(".").map(Number);
+  if (octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) return void 0;
+  return ((octets[0] * 256 + octets[1]) * 256 + octets[2]) * 256 + octets[3] >>> 0;
+}
+function ipv4InCidr(address, network, prefix) {
+  const value = ipv4ToNumber(address);
+  const networkValue = ipv4ToNumber(network);
+  if (value === void 0 || networkValue === void 0) return false;
+  const mask = prefix === 0 ? 0 : 4294967295 << 32 - prefix >>> 0;
+  return (value & mask) === (networkValue & mask);
+}
+function expandIpv6(address) {
+  const normalized = address.toLowerCase().split("%")[0];
+  let input = normalized;
+  const ipv4Start = normalized.lastIndexOf(":") + 1;
+  const ipv4 = normalized.slice(ipv4Start);
+  if (net.isIP(ipv4) === 4) {
+    const value = ipv4ToNumber(ipv4);
+    if (value === void 0) return void 0;
+    input = `${normalized.slice(0, ipv4Start)}${(value >>> 16).toString(16)}:${(value & 65535).toString(16)}`;
+  }
+  const halves = input.split("::");
+  if (halves.length > 2) return void 0;
+  const left = halves[0] ? halves[0].split(":").filter(Boolean) : [];
+  const right = halves.length === 2 && halves[1] ? halves[1].split(":").filter(Boolean) : [];
+  const missing = 8 - left.length - right.length;
+  if (missing < 0 || halves.length === 1 && missing !== 0) return void 0;
+  const groups = [...left, ...Array.from({ length: missing }, () => "0"), ...right];
+  if (groups.length !== 8 || groups.some((group) => !/^[0-9a-f]{1,4}$/.test(group))) return void 0;
+  return groups.reduce((value, group) => value << 16n | BigInt(parseInt(group, 16)), 0n);
+}
+function ipv6InCidr(address, network, prefix) {
+  return prefix === 0 || address >> BigInt(128 - prefix) === network >> BigInt(128 - prefix);
+}
+function ipv6ToIpv4(address) {
+  const mappedNetwork = expandIpv6(IPV4_MAPPED_NETWORK);
+  if (mappedNetwork === void 0 || !ipv6InCidr(address, mappedNetwork, 96)) return void 0;
+  const value = Number(address & 0xffffffffn) >>> 0;
+  return [value >>> 24, value >>> 16 & 255, value >>> 8 & 255, value & 255].join(".");
+}
+function classifyIp(address) {
+  const normalized = address.replace(/^\[|\]$/g, "").toLowerCase();
+  const version = net.isIP(normalized);
+  if (version === 4) {
+    if (normalized === "169.254.169.254") return "metadata";
+    if (ipv4InCidr(normalized, "127.0.0.0", 8)) return "localhost";
+    if (ipv4InCidr(normalized, "169.254.0.0", 16)) return "link-local";
+    if (ipv4InCidr(normalized, "10.0.0.0", 8) || ipv4InCidr(normalized, "172.16.0.0", 12) || ipv4InCidr(normalized, "192.168.0.0", 16) || ipv4InCidr(normalized, "100.64.0.0", 10)) return "private-network";
+    return void 0;
+  }
+  if (version !== 6) return void 0;
+  const value = expandIpv6(normalized);
+  if (value === void 0) return void 0;
+  const mappedIpv4 = ipv6ToIpv4(value);
+  if (mappedIpv4) return classifyIp(mappedIpv4);
+  if (value === expandIpv6("fd00:ec2::254")) return "metadata";
+  if (value === expandIpv6("::1")) return "localhost";
+  if (ipv6InCidr(value, expandIpv6("fe80::"), 10)) return "link-local";
+  if (ipv6InCidr(value, expandIpv6("fc00::"), 7)) return "private-network";
+  return void 0;
+}
+function classifyHostname(hostname) {
+  const normalized = hostname.toLowerCase().replace(/\.$/, "");
+  if (normalized === "localhost" || normalized.endsWith(".localhost") || normalized === "localhost.localdomain") return "localhost";
+  if (normalized === "metadata" || normalized === "metadata.google.internal" || normalized === "instance-data") return "metadata";
+  return classifyIp(normalized);
+}
+function policyAllows(reason, policy) {
+  if (reason === "localhost") return policy.allowLocalhost === true;
+  if (reason === "metadata") return policy.allowMetadata === true;
+  if (reason === "private-network") return policy.allowPrivateNetwork === true;
+  if (reason === "link-local") return policy.allowLinkLocal === true;
+  return false;
+}
+async function resolveDestinationAddresses(hostname) {
+  try {
+    const addresses = await lookup(hostname, { all: true, verbatim: true });
+    return addresses.map(({ address, family }) => ({ address, family }));
+  } catch (error) {
+    throw new DestinationPolicyError(hostname, "dns-resolution-failed", `Destination policy could not resolve hostname "${hostname}" before making a request: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+function blockDestination(url, reason) {
+  throw new DestinationPolicyError(url, reason, `Destination blocked by web egress policy (${reason}): ${url}`);
+}
+async function validateDestinationAllowed(url, policy) {
+  const effectivePolicy = { ...DEFAULT_DESTINATION_POLICY, ...policy };
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    blockDestination(url, "unsupported-protocol");
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") blockDestination(url, "unsupported-protocol");
+  const hostname = parsed.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  const directReason = classifyHostname(hostname);
+  if (directReason && !policyAllows(directReason, effectivePolicy)) blockDestination(url, directReason);
+  const version = net.isIP(hostname);
+  if (version !== 0) return [{ address: hostname, family: version }];
+  const addresses = await resolveDestinationAddresses(hostname);
+  for (const { address } of addresses) {
+    const reason = classifyIp(address);
+    if (reason && !policyAllows(reason, effectivePolicy)) blockDestination(url, reason);
+  }
+  return addresses;
+}
+async function assertDestinationAllowed(url, policy = {}) {
+  await validateDestinationAllowed(url, policy);
+}
+function isRedirectStatus(status) {
+  return REDIRECT_STATUSES.has(status);
+}
+function responseLocation(response) {
+  const headers = response.headers;
+  return headers.location ?? headers.Location;
+}
+function stripSensitiveRedirectHeaders(headers) {
+  if (!headers) return headers;
+  const sanitizedHeaders = { ...headers };
+  for (const headerName of Object.keys(sanitizedHeaders)) {
+    if (SENSITIVE_REDIRECT_HEADERS.has(headerName.toLowerCase())) delete sanitizedHeaders[headerName];
+  }
+  return sanitizedHeaders;
+}
+function createPinnedLookup(addresses) {
+  return (_hostname, options, callback) => {
+    const requestedFamily = "family" in options && (options.family === 4 || options.family === 6) ? options.family : void 0;
+    const candidates = requestedFamily ? addresses.filter(({ family: family2 }) => family2 === requestedFamily) : addresses;
+    if (candidates.length === 0) {
+      callback(new Error(`No validated destination address matches the requested address family: ${requestedFamily}`), "", void 0);
+      return;
+    }
+    if ("all" in options && options.all === true) {
+      callback(null, candidates, void 0);
+      return;
+    }
+    const [{ address, family }] = candidates;
+    callback(null, address, family);
+  };
+}
+async function requestWithDestinationPolicy(config, policy = {}) {
+  if (!config.url) throw new Error("A request URL is required for destination policy enforcement");
+  const effectivePolicy = { ...DEFAULT_DESTINATION_POLICY, ...policy };
+  const maxRedirects = effectivePolicy.maxRedirects;
+  if (!Number.isInteger(maxRedirects) || maxRedirects < 0) throw new Error("maxRedirects must be a non-negative integer");
+  let currentUrl = config.url;
+  let currentConfig = {
+    ...config,
+    url: currentUrl,
+    maxRedirects: 0,
+    validateStatus: (status) => isRedirectStatus(status) || (config.validateStatus ? config.validateStatus(status) : status >= 200 && status < 300)
+  };
+  for (let redirectCount = 0; ; redirectCount += 1) {
+    const validatedAddresses = await validateDestinationAllowed(currentUrl, effectivePolicy);
+    currentConfig.lookup = createPinnedLookup(validatedAddresses);
+    const response = await axios13(currentConfig);
+    if (!isRedirectStatus(response.status)) return response;
+    if (effectivePolicy.allowRedirects === false) blockDestination(currentUrl, "redirect");
+    if (redirectCount >= maxRedirects) throw new DestinationPolicyError(currentUrl, "redirect", `Maximum redirect count (${maxRedirects}) exceeded for ${currentUrl}`);
+    const location = responseLocation(response);
+    if (!location) throw new DestinationPolicyError(currentUrl, "redirect", `Redirect response did not include a Location header: ${currentUrl}`);
+    const previousUrl = currentUrl;
+    try {
+      currentUrl = new URL(location, currentUrl).toString();
+    } catch {
+      throw new DestinationPolicyError(currentUrl, "redirect", `Redirect response included an invalid Location header: ${location}`);
+    }
+    const method = String(currentConfig.method ?? "GET").toUpperCase();
+    const nextMethod = response.status === 303 || (response.status === 301 || response.status === 302) && method === "POST" ? "GET" : method;
+    currentConfig = { ...currentConfig, url: currentUrl, method: nextMethod };
+    if (new URL(previousUrl).origin !== new URL(currentUrl).origin) {
+      currentConfig.headers = stripSensitiveRedirectHeaders(currentConfig.headers);
+    }
+    if (nextMethod === "GET" || nextMethod === "HEAD") delete currentConfig.data;
+  }
+}
 var HttpMethod = z.enum(["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"]);
 var httpRequestSchema = z.object({
   url: z.string().url().describe("The URL to make the request to"),
@@ -42,8 +242,8 @@ var httpPostSchema = z.object({
 });
 
 // src/web/http/tools/http-client.ts
-function createHttpClientTool(defaultTimeout = 3e4, defaultHeaders = {}) {
-  return toolBuilder().name("http-client").description("Make HTTP requests to web APIs and services. Supports GET, POST, PUT, DELETE, PATCH methods with custom headers and body.").category(ToolCategory.WEB).tags(["http", "api", "request", "web"]).schema(httpRequestSchema).implement(async (input) => {
+function createHttpClientTool(defaultTimeout = 3e4, defaultHeaders = {}, destinationPolicy = {}) {
+  return toolBuilder().name("http-client").description("Make policy-checked HTTP requests to web APIs and services. Supports GET, POST, PUT, DELETE, PATCH methods with custom headers and body. Local, metadata, link-local, and private-network destinations are blocked by default.").category(ToolCategory.WEB).tags(["http", "api", "request", "web"]).schema(httpRequestSchema).implement(async (input) => {
     const config = {
       method: input.method,
       url: input.url,
@@ -54,37 +254,42 @@ function createHttpClientTool(defaultTimeout = 3e4, defaultHeaders = {}) {
       validateStatus: () => true
       // Don't throw on any status code
     };
-    const response = await axios16(config);
+    const response = await requestWithDestinationPolicy(config, destinationPolicy);
     return {
       status: response.status,
       statusText: response.statusText,
       headers: response.headers,
       data: response.data,
-      url: input.url,
+      url: response.config.url ?? input.url,
       method: input.method ?? "GET"
     };
   }).build();
 }
-function createHttpGetTool(defaultTimeout = 3e4, defaultHeaders = {}) {
-  return toolBuilder().name("http-get").description("Make a simple HTTP GET request to a URL and return the response data.").category(ToolCategory.WEB).tags(["http", "get", "fetch", "web"]).schema(httpGetSchema).implement(async (input) => {
-    const response = await axios16.get(input.url, {
+function createHttpGetTool(defaultTimeout = 3e4, defaultHeaders = {}, destinationPolicy = {}) {
+  return toolBuilder().name("http-get").description("Make a policy-checked HTTP GET request to a URL and return the response data. Local, metadata, link-local, and private-network destinations are blocked by default.").category(ToolCategory.WEB).tags(["http", "get", "fetch", "web"]).schema(httpGetSchema).implement(async (input) => {
+    const response = await requestWithDestinationPolicy({
+      method: "GET",
+      url: input.url,
       headers: { ...defaultHeaders, ...input.headers },
       params: input.params,
       timeout: defaultTimeout
-    });
+    }, destinationPolicy);
     return response.data;
   }).build();
 }
-function createHttpPostTool(defaultTimeout = 3e4, defaultHeaders = {}) {
-  return toolBuilder().name("http-post").description("Make a simple HTTP POST request with JSON body and return the response data.").category(ToolCategory.WEB).tags(["http", "post", "api", "web"]).schema(httpPostSchema).implement(async (input) => {
-    const response = await axios16.post(input.url, input.body, {
+function createHttpPostTool(defaultTimeout = 3e4, defaultHeaders = {}, destinationPolicy = {}) {
+  return toolBuilder().name("http-post").description("Make a policy-checked HTTP POST request with JSON body and return the response data. Local, metadata, link-local, and private-network destinations are blocked by default.").category(ToolCategory.WEB).tags(["http", "post", "api", "web"]).schema(httpPostSchema).implement(async (input) => {
+    const response = await requestWithDestinationPolicy({
+      method: "POST",
+      url: input.url,
+      data: input.body,
       headers: {
         "Content-Type": "application/json",
         ...defaultHeaders,
         ...input.headers
       },
       timeout: defaultTimeout
-    });
+    }, destinationPolicy);
     return response.data;
   }).build();
 }
@@ -95,11 +300,11 @@ var httpGet = createHttpGetTool();
 var httpPost = createHttpPostTool();
 var httpTools = [httpClient, httpGet, httpPost];
 function createHttpTools(config = {}) {
-  const { defaultTimeout = 3e4, defaultHeaders = {} } = config;
+  const { defaultTimeout = 3e4, defaultHeaders = {}, destinationPolicy = {} } = config;
   return [
-    createHttpClientTool(defaultTimeout, defaultHeaders),
-    createHttpGetTool(defaultTimeout, defaultHeaders),
-    createHttpPostTool(defaultTimeout, defaultHeaders)
+    createHttpClientTool(defaultTimeout, defaultHeaders, destinationPolicy),
+    createHttpGetTool(defaultTimeout, defaultHeaders, destinationPolicy),
+    createHttpPostTool(defaultTimeout, defaultHeaders, destinationPolicy)
   ];
 }
 var webScraperSchema = z.object({
@@ -112,18 +317,20 @@ var webScraperSchema = z.object({
   extractMetadata: z.boolean().default(false).describe("Extract meta tags (title, description, etc.)"),
   timeout: z.number().default(3e4).describe("Request timeout in milliseconds")
 });
-function createWebScraperTool(defaultTimeout = 3e4, userAgent = "Mozilla/5.0 (compatible; AgentForge/1.0; +https://agentforge.dev)") {
-  return toolBuilder().name("web-scraper").description("Scrape and extract data from web pages. Can extract text, HTML, links, images, and use CSS selectors to target specific elements.").category(ToolCategory.WEB).tags(["scraper", "web", "html", "extract", "parse"]).schema(webScraperSchema).implement(async (input) => {
-    const response = await axios16.get(input.url, {
+function createWebScraperTool(defaultTimeout = 3e4, userAgent = "Mozilla/5.0 (compatible; AgentForge/1.0; +https://agentforge.dev)", destinationPolicy = {}) {
+  return toolBuilder().name("web-scraper").description("Scrape and extract data from policy-checked web pages. Local, metadata, link-local, and private-network destinations are blocked by default. Supports text, HTML, links, images, and CSS selectors.").category(ToolCategory.WEB).tags(["scraper", "web", "html", "extract", "parse"]).schema(webScraperSchema).implement(async (input) => {
+    const response = await requestWithDestinationPolicy({
+      method: "GET",
+      url: input.url,
       timeout: input.timeout || defaultTimeout,
       headers: {
         "User-Agent": userAgent
       }
-    });
+    }, destinationPolicy);
     const html = response.data;
     const $ = cheerio.load(html);
     const result = {
-      url: input.url
+      url: response.config.url ?? input.url
     };
     const $selected = input.selector ? $(input.selector) : $("body");
     if (input.extractText) {
@@ -188,8 +395,8 @@ function createWebScraperTool(defaultTimeout = 3e4, userAgent = "Mozilla/5.0 (co
 var webScraper = createWebScraperTool();
 var scraperTools = [webScraper];
 function createScraperTools(config = {}) {
-  const { defaultTimeout = 3e4, userAgent = "Mozilla/5.0 (compatible; AgentForge/1.0; +https://agentforge.dev)" } = config;
-  return [createWebScraperTool(defaultTimeout, userAgent)];
+  const { defaultTimeout = 3e4, userAgent = "Mozilla/5.0 (compatible; AgentForge/1.0; +https://agentforge.dev)", destinationPolicy = {} } = config;
+  return [createWebScraperTool(defaultTimeout, userAgent, destinationPolicy)];
 }
 var htmlParserSchema = z.object({
   html: z.string().describe("The HTML content to parse"),
@@ -463,7 +670,7 @@ function isRetryableError(error) {
   return false;
 }
 function sleep(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 async function retryWithBackoff(fn, config = DEFAULT_RETRY_CONFIG) {
   let lastError;
@@ -504,7 +711,7 @@ var DuckDuckGoProvider = class {
   async search(query, maxResults, timeout = DEFAULT_TIMEOUT) {
     return retryWithBackoff(async () => {
       try {
-        const response = await axios16.get(
+        const response = await axios13.get(
           "https://api.duckduckgo.com/",
           {
             params: {
@@ -608,7 +815,7 @@ var SerperProvider = class {
     }
     return retryWithBackoff(async () => {
       try {
-        const response = await axios16.post(
+        const response = await axios13.post(
           "https://google.serper.dev/search",
           {
             q: query,
@@ -1042,7 +1249,7 @@ function createSearchConfluenceTool(getAuth, getAuthHeader2, logger19) {
     logger19.info("search-confluence called", { query, limit });
     try {
       const { ATLASSIAN_SITE_URL } = getAuth();
-      const response = await axios16.get(`${ATLASSIAN_SITE_URL}/wiki/rest/api/content/search`, {
+      const response = await axios13.get(`${ATLASSIAN_SITE_URL}/wiki/rest/api/content/search`, {
         headers: {
           Authorization: getAuthHeader2(),
           Accept: "application/json"
@@ -1104,7 +1311,7 @@ function createGetConfluencePageTool(getAuth, getAuthHeader2, logger19) {
     logger19.info("get-confluence-page called", { page_id });
     try {
       const { ATLASSIAN_SITE_URL } = getAuth();
-      const response = await axios16.get(`${ATLASSIAN_SITE_URL}/wiki/rest/api/content/${page_id}`, {
+      const response = await axios13.get(`${ATLASSIAN_SITE_URL}/wiki/rest/api/content/${page_id}`, {
         headers: {
           Authorization: getAuthHeader2(),
           Accept: "application/json"
@@ -1155,7 +1362,7 @@ function createListConfluenceSpacesTool(getAuth, getAuthHeader2, logger19) {
     logger19.info("list-confluence-spaces called", { limit });
     try {
       const { ATLASSIAN_SITE_URL } = getAuth();
-      const response = await axios16.get(`${ATLASSIAN_SITE_URL}/wiki/rest/api/space`, {
+      const response = await axios13.get(`${ATLASSIAN_SITE_URL}/wiki/rest/api/space`, {
         headers: {
           Authorization: getAuthHeader2(),
           Accept: "application/json"
@@ -1201,7 +1408,7 @@ function createGetSpacePagesTool(getAuth, getAuthHeader2, logger19) {
     logger19.info("get-space-pages called", { space_key, limit });
     try {
       const { ATLASSIAN_SITE_URL } = getAuth();
-      const response = await axios16.get(`${ATLASSIAN_SITE_URL}/wiki/rest/api/content`, {
+      const response = await axios13.get(`${ATLASSIAN_SITE_URL}/wiki/rest/api/content`, {
         headers: {
           Authorization: getAuthHeader2(),
           Accept: "application/json"
@@ -1275,7 +1482,7 @@ function createCreateConfluencePageTool(getAuth, getAuthHeader2, logger19) {
       if (parent_page_id) {
         pageData.ancestors = [{ id: parent_page_id }];
       }
-      const response = await axios16.post(
+      const response = await axios13.post(
         `${ATLASSIAN_SITE_URL}/wiki/rest/api/content`,
         pageData,
         {
@@ -1323,7 +1530,7 @@ function createUpdateConfluencePageTool(getAuth, getAuthHeader2, logger19) {
     logger19.info("update-confluence-page called", { page_id, title });
     try {
       const { ATLASSIAN_SITE_URL } = getAuth();
-      const getResponse = await axios16.get(
+      const getResponse = await axios13.get(
         `${ATLASSIAN_SITE_URL}/wiki/rest/api/content/${page_id}`,
         {
           headers: {
@@ -1333,7 +1540,7 @@ function createUpdateConfluencePageTool(getAuth, getAuthHeader2, logger19) {
         }
       );
       const currentVersion = getResponse.data.version.number;
-      const updateResponse = await axios16.put(
+      const updateResponse = await axios13.put(
         `${ATLASSIAN_SITE_URL}/wiki/rest/api/content/${page_id}`,
         {
           type: "page",
@@ -1394,7 +1601,7 @@ function createArchiveConfluencePageTool(getAuth, getAuthHeader2, logger19) {
     });
     try {
       const { ATLASSIAN_SITE_URL } = getAuth();
-      const getResponse = await axios16.get(
+      const getResponse = await axios13.get(
         `${ATLASSIAN_SITE_URL}/wiki/rest/api/content/${page_id}`,
         {
           headers: {
@@ -1405,7 +1612,7 @@ function createArchiveConfluencePageTool(getAuth, getAuthHeader2, logger19) {
       );
       const currentVersion = getResponse.data.version.number;
       const pageData = getResponse.data;
-      await axios16.put(
+      await axios13.put(
         `${ATLASSIAN_SITE_URL}/wiki/rest/api/content/${page_id}`,
         {
           version: { number: currentVersion + 1 },
@@ -1972,8 +2179,8 @@ var objectOmitSchema = z.object({
 });
 
 // src/data/transformer/tools/shared.ts
-function getNestedValue(value, path12) {
-  return path12.split(".").reduce((current, key) => {
+function getNestedValue(value, path13) {
+  return path13.split(".").reduce((current, key) => {
     if (current == null) {
       return void 0;
     }
@@ -2363,7 +2570,7 @@ function isRetryableError2(error) {
   return false;
 }
 function sleep2(ms) {
-  return new Promise((resolve2) => setTimeout(resolve2, ms));
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
 async function retryWithBackoff2(fn, config = DEFAULT_RETRY_CONFIG2) {
   let lastError;
@@ -2470,7 +2677,7 @@ var OpenAIEmbeddingProvider = class {
     const modelToUse = model || this.defaultModel;
     return retryWithBackoff2(async () => {
       try {
-        const response = await axios16.post(
+        const response = await axios13.post(
           `${this.baseURL}/embeddings`,
           {
             input: text,
@@ -2534,7 +2741,7 @@ var OpenAIEmbeddingProvider = class {
     const modelToUse = model || this.defaultModel;
     return retryWithBackoff2(async () => {
       try {
-        const response = await axios16.post(
+        const response = await axios13.post(
           `${this.baseURL}/embeddings`,
           {
             input: texts,
@@ -2614,7 +2821,7 @@ var CohereEmbeddingProvider = class {
     const modelToUse = model || this.defaultModel;
     return retryWithBackoff2(async () => {
       try {
-        const response = await axios16.post(
+        const response = await axios13.post(
           `${this.baseUrl}/embed`,
           {
             texts,
@@ -2642,7 +2849,7 @@ var CohereEmbeddingProvider = class {
           } : void 0
         };
       } catch (error) {
-        if (axios16.isAxiosError(error)) {
+        if (axios13.isAxiosError(error)) {
           const status = error.response?.status;
           const message = error.response?.data?.message || error.message;
           let wrappedError;
@@ -2682,7 +2889,7 @@ var HuggingFaceEmbeddingProvider = class {
     const modelToUse = model || this.defaultModel;
     return retryWithBackoff2(async () => {
       try {
-        const response = await axios16.post(
+        const response = await axios13.post(
           `${this.baseUrl}/${modelToUse}`,
           {
             inputs: text,
@@ -2704,7 +2911,7 @@ var HuggingFaceEmbeddingProvider = class {
           dimensions: embedding.length
         };
       } catch (error) {
-        if (axios16.isAxiosError(error)) {
+        if (axios13.isAxiosError(error)) {
           const status = error.response?.status;
           const message = error.response?.data?.error || error.message;
           let wrappedError;
@@ -2731,7 +2938,7 @@ var HuggingFaceEmbeddingProvider = class {
     const modelToUse = model || this.defaultModel;
     return retryWithBackoff2(async () => {
       try {
-        const response = await axios16.post(
+        const response = await axios13.post(
           `${this.baseUrl}/${modelToUse}`,
           {
             inputs: texts,
@@ -2754,7 +2961,7 @@ var HuggingFaceEmbeddingProvider = class {
           dimensions
         };
       } catch (error) {
-        if (axios16.isAxiosError(error)) {
+        if (axios13.isAxiosError(error)) {
           const status = error.response?.status;
           const message = error.response?.data?.error || error.message;
           let wrappedError;
@@ -2805,7 +3012,7 @@ var VoyageEmbeddingProvider = class {
     const modelToUse = model || this.defaultModel;
     return retryWithBackoff2(async () => {
       try {
-        const response = await axios16.post(
+        const response = await axios13.post(
           `${this.baseUrl}/embeddings`,
           {
             input: texts,
@@ -2832,7 +3039,7 @@ var VoyageEmbeddingProvider = class {
           } : void 0
         };
       } catch (error) {
-        if (axios16.isAxiosError(error)) {
+        if (axios13.isAxiosError(error)) {
           const status = error.response?.status;
           const message = error.response?.data?.message || error.message;
           let wrappedError;
@@ -2871,7 +3078,7 @@ var OllamaEmbeddingProvider = class {
     const modelToUse = model || this.defaultModel;
     return retryWithBackoff2(async () => {
       try {
-        const response = await axios16.post(
+        const response = await axios13.post(
           `${this.baseUrl}/api/embeddings`,
           {
             model: modelToUse,
@@ -2890,7 +3097,7 @@ var OllamaEmbeddingProvider = class {
           dimensions: embedding.length
         };
       } catch (error) {
-        if (axios16.isAxiosError(error)) {
+        if (axios13.isAxiosError(error)) {
           const status = error.response?.status;
           const message = error.response?.data?.error || error.message;
           let wrappedError;
@@ -3262,16 +3469,16 @@ function formatRelationship(rel) {
     properties: formatValue(rel.properties)
   };
 }
-function formatPath(path12) {
+function formatPath(path13) {
   return {
-    start: formatNode(path12.start),
-    end: formatNode(path12.end),
-    segments: path12.segments.map((segment) => ({
+    start: formatNode(path13.start),
+    end: formatNode(path13.end),
+    segments: path13.segments.map((segment) => ({
       start: formatNode(segment.start),
       relationship: formatRelationship(segment.relationship),
       end: formatNode(segment.end)
     })),
-    length: path12.length
+    length: path13.length
   };
 }
 function formatResults(records) {
@@ -5448,8 +5655,8 @@ function toBatchErrorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
 function delayBatchRetry(ms) {
-  return new Promise((resolve2) => {
-    setTimeout(resolve2, ms);
+  return new Promise((resolve3) => {
+    setTimeout(resolve3, ms);
   });
 }
 
@@ -5875,7 +6082,7 @@ function withTransactionTimeout(operation, timeoutMs, onTimeout) {
   if (!timeoutMs) {
     return operation;
   }
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve3, reject) => {
     let timedOut = false;
     const timer = setTimeout(() => {
       timedOut = true;
@@ -5887,7 +6094,7 @@ function withTransactionTimeout(operation, timeoutMs, onTimeout) {
         return;
       }
       clearTimeout(timer);
-      resolve2(result);
+      resolve3(result);
     }).catch((error) => {
       if (timedOut) {
         return;
@@ -9120,11 +9327,135 @@ var fileDeleteSchema = z.object({
 var fileExistsSchema = z.object({
   path: z.string().describe("Path to check")
 });
-function createFileReaderTool(defaultEncoding = "utf8") {
+var FileSystemPolicyError = class extends Error {
+  constructor(message, operation, inputPath) {
+    super(message);
+    this.operation = operation;
+    this.inputPath = inputPath;
+    this.name = "FileSystemPolicyError";
+  }
+  code = "FILE_SYSTEM_POLICY_VIOLATION";
+};
+function containsTraversal(inputPath) {
+  return inputPath.split(/[\\/]+/).includes("..");
+}
+function isWithinRoot(root, target) {
+  const relative4 = path.relative(root, target);
+  return relative4 === "" || !relative4.startsWith(`..${path.sep}`) && relative4 !== ".." && !path.isAbsolute(relative4);
+}
+async function resolveWithMissingTail(inputPath) {
+  let currentPath = inputPath;
+  const missingSegments = [];
+  while (true) {
+    try {
+      const resolvedPath = await promises.realpath(currentPath);
+      return path.join(resolvedPath, ...missingSegments);
+    } catch (error) {
+      const code = error.code;
+      if (code !== "ENOENT" && code !== "ENOTDIR") {
+        throw error;
+      }
+      const parentPath = path.dirname(currentPath);
+      if (parentPath === currentPath) {
+        throw error;
+      }
+      missingSegments.unshift(path.basename(currentPath));
+      currentPath = parentPath;
+    }
+  }
+}
+var FileSystemPolicy = class {
+  allowedRoots;
+  allowOutsideRoots;
+  allowRootDeletion;
+  baseDirectory;
+  constructor(options = {}) {
+    const configuredRoots = [
+      ...options.allowedRoots ?? [],
+      ...options.workspaceRoot ? [options.workspaceRoot] : []
+    ];
+    this.allowedRoots = [...new Set(configuredRoots.map((root) => path.resolve(root)))];
+    this.baseDirectory = path.resolve(options.workspaceRoot ?? process.cwd());
+    this.allowOutsideRoots = options.allowOutsideRoots ?? this.allowedRoots.length === 0;
+    this.allowRootDeletion = options.allowRootDeletion ?? this.allowOutsideRoots;
+  }
+  async resolvePath(inputPath, operation) {
+    const { resolvedPath } = await this.resolvePathWithRoots(inputPath, operation);
+    return resolvedPath;
+  }
+  async resolveDeletePath(inputPath, recursive) {
+    const { resolvedPath, resolvedRoots } = await this.resolvePathWithRoots(inputPath, "directory deletion");
+    if (recursive && !this.allowRootDeletion && resolvedRoots.some((root) => root === resolvedPath)) {
+      throw new FileSystemPolicyError(
+        "Filesystem policy blocked directory deletion: recursive deletion of an allowed root is not permitted",
+        "directory deletion",
+        inputPath
+      );
+    }
+    return resolvedPath;
+  }
+  async resolvePathWithRoots(inputPath, operation) {
+    const absolutePath = path.resolve(this.baseDirectory, inputPath);
+    if (this.allowOutsideRoots) {
+      return { resolvedPath: absolutePath, resolvedRoots: [] };
+    }
+    if (containsTraversal(inputPath)) {
+      throw new FileSystemPolicyError(
+        `Filesystem policy blocked ${operation}: path traversal is not allowed`,
+        operation,
+        inputPath
+      );
+    }
+    let resolvedPath;
+    try {
+      resolvedPath = await resolveWithMissingTail(absolutePath);
+    } catch {
+      throw new FileSystemPolicyError(
+        `Filesystem policy could not resolve ${operation} path`,
+        operation,
+        inputPath
+      );
+    }
+    const resolvedRoots = await this.resolveRoots(operation, inputPath);
+    if (!resolvedRoots.some((root) => isWithinRoot(root, resolvedPath))) {
+      throw new FileSystemPolicyError(
+        `Filesystem policy blocked ${operation}: path is outside the allowed roots`,
+        operation,
+        inputPath
+      );
+    }
+    return { resolvedPath, resolvedRoots };
+  }
+  async resolveRoots(operation, inputPath) {
+    try {
+      return await Promise.all(this.allowedRoots.map((root) => promises.realpath(root)));
+    } catch {
+      throw new FileSystemPolicyError(
+        `Filesystem policy could not resolve an allowed root for ${operation}`,
+        operation,
+        inputPath
+      );
+    }
+  }
+};
+var DEFAULT_FILE_SYSTEM_POLICY = new FileSystemPolicy();
+function createFileSystemPolicy(options = {}) {
+  return new FileSystemPolicy(options);
+}
+function resolveFileSystemPolicy(policy) {
+  if (!policy) {
+    return DEFAULT_FILE_SYSTEM_POLICY;
+  }
+  return policy instanceof FileSystemPolicy ? policy : createFileSystemPolicy(policy);
+}
+
+// src/file/operations/tools/file-reader.ts
+function createFileReaderTool(defaultEncoding = "utf8", policy = DEFAULT_FILE_SYSTEM_POLICY) {
   return toolBuilder().name("file-reader").description("Read the contents of a file from the file system. Supports text and binary files with various encodings.").category(ToolCategory.FILE_SYSTEM).tags(["file", "read", "io", "filesystem"]).schema(fileReaderSchema).implementSafe(async (input) => {
     const encoding = input.encoding || defaultEncoding;
-    const content = await promises.readFile(input.path, encoding);
-    const stats = await promises.stat(input.path);
+    const safePath = await policy.resolvePath(input.path, "file read");
+    const content = await promises.readFile(safePath, encoding);
+    const stats = await promises.stat(safePath);
     return {
       content,
       size: stats.size,
@@ -9133,16 +9464,17 @@ function createFileReaderTool(defaultEncoding = "utf8") {
     };
   }).build();
 }
-function createFileWriterTool(defaultEncoding = "utf8", createDirsDefault = false) {
+function createFileWriterTool(defaultEncoding = "utf8", createDirsDefault = false, policy = DEFAULT_FILE_SYSTEM_POLICY) {
   return toolBuilder().name("file-writer").description("Write content to a file. Creates the file if it doesn't exist, or overwrites it if it does.").category(ToolCategory.FILE_SYSTEM).tags(["file", "write", "io", "filesystem"]).schema(fileWriterSchema).implementSafe(async (input) => {
     const encoding = input.encoding || defaultEncoding;
     const createDirs = input.createDirs ?? createDirsDefault;
+    const safePath = await policy.resolvePath(input.path, "file write");
     if (createDirs) {
-      const dir = path7.dirname(input.path);
+      const dir = path.dirname(safePath);
       await promises.mkdir(dir, { recursive: true });
     }
-    await promises.writeFile(input.path, input.content, encoding);
-    const stats = await promises.stat(input.path);
+    await promises.writeFile(safePath, input.content, encoding);
+    const stats = await promises.stat(safePath);
     return {
       path: input.path,
       size: stats.size,
@@ -9150,31 +9482,34 @@ function createFileWriterTool(defaultEncoding = "utf8", createDirsDefault = fals
     };
   }).build();
 }
-function createFileAppendTool(defaultEncoding = "utf8") {
+function createFileAppendTool(defaultEncoding = "utf8", policy = DEFAULT_FILE_SYSTEM_POLICY) {
   return toolBuilder().name("file-append").description("Append content to the end of a file. Creates the file if it doesn't exist.").category(ToolCategory.FILE_SYSTEM).tags(["file", "append", "io", "filesystem"]).schema(fileAppendSchema).implementSafe(async (input) => {
     const encoding = input.encoding || defaultEncoding;
-    await promises.appendFile(input.path, input.content, encoding);
-    const stats = await promises.stat(input.path);
+    const safePath = await policy.resolvePath(input.path, "file append");
+    await promises.appendFile(safePath, input.content, encoding);
+    const stats = await promises.stat(safePath);
     return {
       path: input.path,
       size: stats.size
     };
   }).build();
 }
-function createFileDeleteTool() {
+function createFileDeleteTool(policy = DEFAULT_FILE_SYSTEM_POLICY) {
   return toolBuilder().name("file-delete").description("Delete a file from the file system. Returns an error if the file doesn't exist.").category(ToolCategory.FILE_SYSTEM).tags(["file", "delete", "remove", "filesystem"]).schema(fileDeleteSchema).implementSafe(async (input) => {
-    await promises.unlink(input.path);
+    const safePath = await policy.resolvePath(input.path, "file deletion");
+    await promises.unlink(safePath);
     return {
       path: input.path,
       message: "File deleted successfully"
     };
   }).build();
 }
-function createFileExistsTool() {
+function createFileExistsTool(policy = DEFAULT_FILE_SYSTEM_POLICY) {
   return toolBuilder().name("file-exists").description("Check if a file or directory exists at the specified path.").category(ToolCategory.FILE_SYSTEM).tags(["file", "exists", "check", "filesystem"]).schema(fileExistsSchema).implement(async (input) => {
     try {
-      await promises.access(input.path);
-      const stats = await promises.stat(input.path);
+      const safePath = await policy.resolvePath(input.path, "file existence check");
+      await promises.access(safePath);
+      const stats = await promises.stat(safePath);
       return {
         exists: true,
         path: input.path,
@@ -9183,7 +9518,13 @@ function createFileExistsTool() {
         size: stats.size,
         modified: stats.mtime.toISOString()
       };
-    } catch {
+    } catch (error) {
+      if (error instanceof FileSystemPolicyError) {
+        return {
+          success: false,
+          error: error.message
+        };
+      }
       return {
         exists: false,
         path: input.path
@@ -9208,14 +9549,16 @@ var fileOperationTools = [
 function createFileOperationTools(config = {}) {
   const {
     defaultEncoding = "utf8",
-    createDirsDefault = false
+    createDirsDefault = false,
+    policy: policyInput
   } = config;
+  const policy = resolveFileSystemPolicy(policyInput);
   return [
-    createFileReaderTool(defaultEncoding),
-    createFileWriterTool(defaultEncoding, createDirsDefault),
-    createFileAppendTool(defaultEncoding),
-    createFileDeleteTool(),
-    createFileExistsTool()
+    createFileReaderTool(defaultEncoding, policy),
+    createFileWriterTool(defaultEncoding, createDirsDefault, policy),
+    createFileAppendTool(defaultEncoding, policy),
+    createFileDeleteTool(policy),
+    createFileExistsTool(policy)
   ];
 }
 var directoryListSchema = z.object({
@@ -9238,21 +9581,23 @@ var fileSearchSchema = z.object({
   recursive: z.boolean().default(true).describe("Search in subdirectories"),
   caseSensitive: z.boolean().default(false).describe("Case-sensitive pattern matching")
 });
-function createDirectoryListTool(defaultRecursive = false, defaultIncludeDetails = false) {
+function createDirectoryListTool(defaultRecursive = false, defaultIncludeDetails = false, policy = DEFAULT_FILE_SYSTEM_POLICY) {
   return toolBuilder().name("directory-list").description("List all files and directories in a directory. Can optionally include file details and filter by extension.").category(ToolCategory.FILE_SYSTEM).tags(["directory", "list", "files", "filesystem"]).schema(directoryListSchema).implementSafe(async (input) => {
+    const safePath = await policy.resolvePath(input.path, "directory listing");
+    const includeDetails = input.includeDetails ?? defaultIncludeDetails;
     const listFiles = async (dir, recursive2) => {
       const entries = await promises.readdir(dir, { withFileTypes: true });
       const files2 = [];
       for (const entry of entries) {
-        const fullPath = path7.join(dir, entry.name);
-        const relativePath = path7.relative(input.path, fullPath);
+        const fullPath = path.join(dir, entry.name);
+        const relativePath = path.relative(safePath, fullPath);
         if (input.extension && !entry.name.endsWith(input.extension)) {
           if (!entry.isDirectory() || !recursive2) {
             continue;
           }
         }
-        if (input.includeDetails) {
-          const stats = await promises.stat(fullPath);
+        if (includeDetails) {
+          const stats = await promises.lstat(fullPath);
           files2.push({
             name: entry.name,
             path: relativePath,
@@ -9278,7 +9623,7 @@ function createDirectoryListTool(defaultRecursive = false, defaultIncludeDetails
       return files2;
     };
     const recursive = input.recursive ?? defaultRecursive;
-    const files = await listFiles(input.path, recursive);
+    const files = await listFiles(safePath, recursive);
     return {
       path: input.path,
       files,
@@ -9286,37 +9631,40 @@ function createDirectoryListTool(defaultRecursive = false, defaultIncludeDetails
     };
   }).build();
 }
-function createDirectoryCreateTool(defaultRecursive = true) {
+function createDirectoryCreateTool(defaultRecursive = true, policy = DEFAULT_FILE_SYSTEM_POLICY) {
   return toolBuilder().name("directory-create").description("Create a new directory. Can optionally create parent directories if they don't exist.").category(ToolCategory.FILE_SYSTEM).tags(["directory", "create", "mkdir", "filesystem"]).schema(directoryCreateSchema).implementSafe(async (input) => {
     const recursive = input.recursive ?? defaultRecursive;
-    await promises.mkdir(input.path, { recursive });
+    const safePath = await policy.resolvePath(input.path, "directory creation");
+    await promises.mkdir(safePath, { recursive });
     return {
       path: input.path,
       message: "Directory created successfully"
     };
   }).build();
 }
-function createDirectoryDeleteTool(defaultRecursive = false) {
+function createDirectoryDeleteTool(defaultRecursive = false, policy = DEFAULT_FILE_SYSTEM_POLICY) {
   return toolBuilder().name("directory-delete").description("Delete a directory. Can optionally delete non-empty directories recursively.").category(ToolCategory.FILE_SYSTEM).tags(["directory", "delete", "remove", "filesystem"]).schema(directoryDeleteSchema).implementSafe(async (input) => {
     const recursive = input.recursive ?? defaultRecursive;
-    await promises.rm(input.path, { recursive, force: false });
+    const safePath = await policy.resolveDeletePath(input.path, recursive);
+    await promises.rm(safePath, { recursive, force: false });
     return {
       path: input.path,
       message: "Directory deleted successfully"
     };
   }).build();
 }
-function createFileSearchTool(defaultRecursive = true, defaultCaseSensitive = false) {
+function createFileSearchTool(defaultRecursive = true, defaultCaseSensitive = false, policy = DEFAULT_FILE_SYSTEM_POLICY) {
   return toolBuilder().name("file-search").description("Search for files by name pattern in a directory. Supports wildcards and recursive search.").category(ToolCategory.FILE_SYSTEM).tags(["file", "search", "find", "filesystem"]).schema(fileSearchSchema).implementSafe(async (input) => {
     const recursive = input.recursive ?? defaultRecursive;
     const caseSensitive = input.caseSensitive ?? defaultCaseSensitive;
+    const safeDirectory = await policy.resolvePath(input.directory, "file search");
     const searchFiles = async (dir) => {
       const entries = await promises.readdir(dir, { withFileTypes: true });
       const matches2 = [];
       const regexPattern = input.pattern.replace(/\./g, "\\.").replace(/\*/g, ".*");
       const regex = new RegExp(`^${regexPattern}$`, caseSensitive ? "" : "i");
       for (const entry of entries) {
-        const fullPath = path7.join(dir, entry.name);
+        const fullPath = path.join(dir, entry.name);
         if (entry.isFile() && regex.test(entry.name)) {
           matches2.push(fullPath);
         }
@@ -9327,7 +9675,7 @@ function createFileSearchTool(defaultRecursive = true, defaultCaseSensitive = fa
       }
       return matches2;
     };
-    const matches = await searchFiles(input.directory);
+    const matches = await searchFiles(safeDirectory);
     return {
       directory: input.directory,
       pattern: input.pattern,
@@ -9352,15 +9700,17 @@ function createDirectoryOperationTools(config = {}) {
   const {
     defaultRecursive = false,
     defaultIncludeDetails = false,
-    defaultCaseSensitive = false
+    defaultCaseSensitive = false,
+    policy: policyInput
   } = config;
+  const policy = resolveFileSystemPolicy(policyInput);
   return [
-    createDirectoryListTool(defaultRecursive, defaultIncludeDetails),
-    createDirectoryCreateTool(true),
+    createDirectoryListTool(defaultRecursive, defaultIncludeDetails, policy),
+    createDirectoryCreateTool(true, policy),
     // Always default to true for create
-    createDirectoryDeleteTool(false),
+    createDirectoryDeleteTool(false, policy),
     // Always default to false for delete (safety)
-    createFileSearchTool(defaultRecursive, defaultCaseSensitive)
+    createFileSearchTool(defaultRecursive, defaultCaseSensitive, policy)
   ];
 }
 var pathJoinSchema = z.object({
@@ -9391,7 +9741,7 @@ var pathNormalizeSchema = z.object({
 });
 function createPathJoinTool() {
   return toolBuilder().name("path-join").description("Join multiple path segments into a single path. Handles platform-specific separators.").category(ToolCategory.FILE_SYSTEM).tags(["path", "join", "filesystem"]).schema(pathJoinSchema).implement(async (input) => {
-    const joined = path7.join(...input.segments);
+    const joined = path.join(...input.segments);
     return {
       path: joined,
       segments: input.segments
@@ -9400,59 +9750,59 @@ function createPathJoinTool() {
 }
 function createPathResolveTool() {
   return toolBuilder().name("path-resolve").description("Resolve a sequence of paths into an absolute path. Resolves relative paths from the current working directory.").category(ToolCategory.FILE_SYSTEM).tags(["path", "resolve", "absolute", "filesystem"]).schema(pathResolveSchema).implement(async (input) => {
-    const resolved = path7.resolve(...input.paths);
+    const resolved = path.resolve(...input.paths);
     return {
       path: resolved,
-      isAbsolute: path7.isAbsolute(resolved)
+      isAbsolute: path.isAbsolute(resolved)
     };
   }).build();
 }
 function createPathParseTool() {
   return toolBuilder().name("path-parse").description("Parse a file path into its components (directory, filename, extension, etc.).").category(ToolCategory.FILE_SYSTEM).tags(["path", "parse", "filesystem"]).schema(pathParseSchema).implement(async (input) => {
-    const parsed = path7.parse(input.path);
+    const parsed = path.parse(input.path);
     return {
       root: parsed.root,
       dir: parsed.dir,
       base: parsed.base,
       name: parsed.name,
       ext: parsed.ext,
-      isAbsolute: path7.isAbsolute(input.path)
+      isAbsolute: path.isAbsolute(input.path)
     };
   }).build();
 }
 function createPathBasenameTool() {
   return toolBuilder().name("path-basename").description("Get the last portion of a path (filename with extension). Optionally remove the extension.").category(ToolCategory.FILE_SYSTEM).tags(["path", "basename", "filename", "filesystem"]).schema(pathBasenameSchema).implement(async (input) => {
-    const basename4 = input.removeExtension ? path7.basename(input.path, path7.extname(input.path)) : path7.basename(input.path);
+    const basename5 = input.removeExtension ? path.basename(input.path, path.extname(input.path)) : path.basename(input.path);
     return {
-      basename: basename4,
-      extension: path7.extname(input.path)
+      basename: basename5,
+      extension: path.extname(input.path)
     };
   }).build();
 }
 function createPathDirnameTool() {
   return toolBuilder().name("path-dirname").description("Get the directory name of a path (everything except the last portion).").category(ToolCategory.FILE_SYSTEM).tags(["path", "dirname", "directory", "filesystem"]).schema(pathDirnameSchema).implement(async (input) => {
-    const dirname3 = path7.dirname(input.path);
+    const dirname4 = path.dirname(input.path);
     return {
-      dirname: dirname3,
-      basename: path7.basename(input.path)
+      dirname: dirname4,
+      basename: path.basename(input.path)
     };
   }).build();
 }
 function createPathExtensionTool() {
   return toolBuilder().name("path-extension").description('Get the file extension from a path (including the dot, e.g., ".txt").').category(ToolCategory.FILE_SYSTEM).tags(["path", "extension", "ext", "filesystem"]).schema(pathExtensionSchema).implement(async (input) => {
-    const ext = path7.extname(input.path);
+    const ext = path.extname(input.path);
     return {
       extension: ext,
       hasExtension: ext.length > 0,
-      filename: path7.basename(input.path, ext)
+      filename: path.basename(input.path, ext)
     };
   }).build();
 }
 function createPathRelativeTool() {
   return toolBuilder().name("path-relative").description("Get the relative path from one path to another.").category(ToolCategory.FILE_SYSTEM).tags(["path", "relative", "filesystem"]).schema(pathRelativeSchema).implement(async (input) => {
-    const relative3 = path7.relative(input.from, input.to);
+    const relative4 = path.relative(input.from, input.to);
     return {
-      relativePath: relative3,
+      relativePath: relative4,
       from: input.from,
       to: input.to
     };
@@ -9460,7 +9810,7 @@ function createPathRelativeTool() {
 }
 function createPathNormalizeTool() {
   return toolBuilder().name("path-normalize").description('Normalize a path by resolving ".." and "." segments and removing duplicate separators.').category(ToolCategory.FILE_SYSTEM).tags(["path", "normalize", "filesystem"]).schema(pathNormalizeSchema).implement(async (input) => {
-    const normalized = path7.normalize(input.path);
+    const normalized = path.normalize(input.path);
     return {
       normalized,
       original: input.path
@@ -10360,6 +10710,6 @@ function createAskHumanTool() {
 }
 var askHumanTool = createAskHumanTool();
 
-export { AskHumanInputSchema, CalculatorSchema, ConnectionManager, ConnectionState, CreditCardValidatorSchema, CurrentDateTimeSchema, DEFAULT_BATCH_SIZE, DEFAULT_CHUNK_SIZE, DEFAULT_RETRY_CONFIG2 as DEFAULT_RETRY_CONFIG, DateArithmeticSchema, DateComparisonSchema, DateDifferenceSchema, DateFormatterSchema, DuckDuckGoProvider, EmailValidatorSchema, EmbeddingManager, HttpMethod, IpValidatorSchema, MAX_BATCH_SIZE, MathFunctionsSchema, MissingPeerDependencyError, OpenAIEmbeddingProvider, PhoneValidatorSchema, RandomNumberSchema, SchemaInspector, SerperProvider, StatisticsSchema, StringCaseConverterSchema, StringJoinSchema, StringLengthSchema, StringReplaceSchema, StringSplitSchema, StringSubstringSchema, StringTrimSchema, UrlValidatorSimpleSchema, UuidValidatorSchema, archiveConfluencePage, arrayFilter, arrayFilterSchema, arrayGroupBy, arrayGroupBySchema, arrayMap, arrayMapSchema, arraySort, arraySortSchema, askHumanTool, benchmarkBatchExecution, benchmarkStreamingSelectMemory, buildDeleteQuery, buildInsertQuery, buildSelectQuery, buildUpdateQuery, calculator, checkPeerDependency, confluenceTools, createArrayFilterTool, createArrayGroupByTool, createArrayMapTool, createArraySortTool, createAskHumanTool, createCalculatorTool, createConfluencePage, createConfluenceTools, createCreditCardValidatorTool, createCsvGeneratorTool, createCsvParserTool, createCsvToJsonTool, createCsvTools, createCurrentDateTimeTool, createDateArithmeticTool, createDateComparisonTool, createDateDifferenceTool, createDateFormatterTool, createDateTimeTools, createDirectoryCreateTool, createDirectoryDeleteTool, createDirectoryListTool, createDirectoryOperationTools, createDuckDuckGoProvider, createEmailValidatorTool, createExtractImagesTool, createExtractLinksTool, createFileAppendTool, createFileDeleteTool, createFileExistsTool, createFileOperationTools, createFileReaderTool, createFileSearchTool, createFileWriterTool, createHtmlParserTool, createHtmlParserTools, createHttpTools, createIpValidatorTool, createJsonMergeTool, createJsonParserTool, createJsonQueryTool, createJsonStringifyTool, createJsonToCsvTool, createJsonToXmlTool, createJsonTools, createJsonValidatorTool, createMathFunctionsTool, createMathOperationTools, createNeo4jCreateNodeWithEmbeddingTool, createNeo4jFindNodesTool, createNeo4jGetSchemaTool, createNeo4jQueryTool, createNeo4jTools, createNeo4jTraverseTool, createNeo4jVectorSearchTool, createNeo4jVectorSearchWithEmbeddingTool, createObjectOmitTool, createObjectPickTool, createPathBasenameTool, createPathDirnameTool, createPathExtensionTool, createPathJoinTool, createPathNormalizeTool, createPathParseTool, createPathRelativeTool, createPathResolveTool, createPathUtilityTools, createPhoneValidatorTool, createRandomNumberTool, createScraperTools, createSelectReadableStream, createSerperProvider, createSlackTools, createStatisticsTool, createStringCaseConverterTool, createStringJoinTool, createStringLengthTool, createStringReplaceTool, createStringSplitTool, createStringSubstringTool, createStringTrimTool, createStringUtilityTools, createTransformerTools, createUrlBuilderTool, createUrlQueryParserTool, createUrlValidatorSimpleTool, createUrlValidatorTool, createUrlValidatorTools, createUuidValidatorTool, createValidationTools, createWebScraperTool, createXmlGeneratorTool, createXmlParserTool, createXmlToJsonTool, createXmlTools, creditCardValidator, csvGenerator, csvGeneratorSchema, csvParser, csvParserSchema, csvToJson, csvToJsonSchema, csvTools, currentDateTime, dateArithmetic, dateComparison, dateDifference, dateFormatter, dateTimeTools, diffSchemas, directoryCreate, directoryCreateSchema, directoryDelete, directoryDeleteSchema, directoryList, directoryListSchema, directoryOperationTools, emailValidator, embeddingManager, executeBatchedTask, executeQuery2 as executeQuery, executeStreamingSelect, exportSchemaToJson, extractImages, extractImagesSchema, extractLinks, extractLinksSchema, fileAppend, fileAppendSchema, fileDelete, fileDeleteSchema, fileExists, fileExistsSchema, fileOperationTools, fileReader, fileReaderSchema, fileSearch, fileSearchSchema, fileWriter, fileWriterSchema, generateBatchEmbeddings, generateEmbedding, getCohereApiKey, getConfluencePage, getEmbeddingModel, getEmbeddingProvider, getHuggingFaceApiKey, getInstallationInstructions, getOllamaBaseUrl, getOpenAIApiKey, getPeerDependencyName, getSlackChannels, getSlackMessages, getSpacePages, getVendorTypeMap, getVoyageApiKey, htmlParser, htmlParserSchema, htmlParserTools, httpClient, httpGet, httpGetSchema, httpPost, httpPostSchema, httpRequestSchema, httpTools, importSchemaFromJson, initializeEmbeddings, initializeEmbeddingsWithConfig, initializeFromEnv, initializeNeo4jTools, ipValidator, isRetryableError2 as isRetryableError, jsonMerge, jsonMergeSchema, jsonParser, jsonParserSchema, jsonQuery, jsonQuerySchema, jsonStringify, jsonStringifySchema, jsonToCsv, jsonToCsvSchema, jsonToXml, jsonToXmlSchema, jsonTools, jsonValidator, jsonValidatorSchema, listConfluenceSpaces, mapColumnType, mapSchemaTypes, mathFunctions, mathOperationTools, neo4jCoreTools, neo4jCreateNodeWithEmbedding, neo4jCreateNodeWithEmbeddingSchema, neo4jFindNodes, neo4jFindNodesSchema, neo4jGetSchema, neo4jGetSchemaSchema, neo4jPool, neo4jQuery, neo4jQuerySchema, neo4jTools, neo4jTraverse, neo4jTraverseSchema, neo4jVectorSearch, neo4jVectorSearchSchema, neo4jVectorSearchWithEmbedding, neo4jVectorSearchWithEmbeddingSchema, notifySlack, objectOmit, objectOmitSchema, objectPick, objectPickSchema, pathBasename, pathBasenameSchema, pathDirname, pathDirnameSchema, pathExtension, pathExtensionSchema, pathJoin, pathJoinSchema, pathNormalize, pathNormalizeSchema, pathParse, pathParseSchema, pathRelative, pathRelativeSchema, pathResolve, pathResolveSchema, pathUtilityTools, phoneValidator, randomNumber, relationalDelete, relationalGetSchema, relationalInsert, relationalQuery, relationalSelect, relationalUpdate, retryWithBackoff2 as retryWithBackoff, scraperTools, searchConfluence, searchResultSchema, sendSlackMessage, slackTools, statistics, streamSelectChunks, stringCaseConverter, stringJoin, stringLength, stringReplace, stringSplit, stringSubstring, stringTrim, stringUtilityTools, transformerArraySchema, transformerObjectSchema, transformerTools, transformerValueSchema, updateConfluencePage, urlBuilder, urlBuilderSchema, urlQueryParser, urlQueryParserSchema, urlValidator, urlValidatorSchema, urlValidatorSimple, urlValidatorTools, uuidValidator, validateBatch, validateColumnTypes, validateColumnsExist, validateTableExists, validateText, validationTools, webScraper, webScraperSchema, webSearch, webSearchOutputSchema, webSearchSchema, withTransaction, xmlGenerator, xmlGeneratorSchema, xmlParser, xmlParserSchema, xmlToJson, xmlToJsonSchema, xmlTools };
+export { AskHumanInputSchema, CalculatorSchema, ConnectionManager, ConnectionState, CreditCardValidatorSchema, CurrentDateTimeSchema, DEFAULT_BATCH_SIZE, DEFAULT_CHUNK_SIZE, DEFAULT_DESTINATION_POLICY, DEFAULT_FILE_SYSTEM_POLICY, DEFAULT_RETRY_CONFIG2 as DEFAULT_RETRY_CONFIG, DateArithmeticSchema, DateComparisonSchema, DateDifferenceSchema, DateFormatterSchema, DestinationPolicyError, DuckDuckGoProvider, EmailValidatorSchema, EmbeddingManager, FileSystemPolicy, FileSystemPolicyError, HttpMethod, IpValidatorSchema, MAX_BATCH_SIZE, MathFunctionsSchema, MissingPeerDependencyError, OpenAIEmbeddingProvider, PhoneValidatorSchema, RandomNumberSchema, SchemaInspector, SerperProvider, StatisticsSchema, StringCaseConverterSchema, StringJoinSchema, StringLengthSchema, StringReplaceSchema, StringSplitSchema, StringSubstringSchema, StringTrimSchema, UrlValidatorSimpleSchema, UuidValidatorSchema, archiveConfluencePage, arrayFilter, arrayFilterSchema, arrayGroupBy, arrayGroupBySchema, arrayMap, arrayMapSchema, arraySort, arraySortSchema, askHumanTool, assertDestinationAllowed, benchmarkBatchExecution, benchmarkStreamingSelectMemory, buildDeleteQuery, buildInsertQuery, buildSelectQuery, buildUpdateQuery, calculator, checkPeerDependency, confluenceTools, createArrayFilterTool, createArrayGroupByTool, createArrayMapTool, createArraySortTool, createAskHumanTool, createCalculatorTool, createConfluencePage, createConfluenceTools, createCreditCardValidatorTool, createCsvGeneratorTool, createCsvParserTool, createCsvToJsonTool, createCsvTools, createCurrentDateTimeTool, createDateArithmeticTool, createDateComparisonTool, createDateDifferenceTool, createDateFormatterTool, createDateTimeTools, createDirectoryCreateTool, createDirectoryDeleteTool, createDirectoryListTool, createDirectoryOperationTools, createDuckDuckGoProvider, createEmailValidatorTool, createExtractImagesTool, createExtractLinksTool, createFileAppendTool, createFileDeleteTool, createFileExistsTool, createFileOperationTools, createFileReaderTool, createFileSearchTool, createFileSystemPolicy, createFileWriterTool, createHtmlParserTool, createHtmlParserTools, createHttpTools, createIpValidatorTool, createJsonMergeTool, createJsonParserTool, createJsonQueryTool, createJsonStringifyTool, createJsonToCsvTool, createJsonToXmlTool, createJsonTools, createJsonValidatorTool, createMathFunctionsTool, createMathOperationTools, createNeo4jCreateNodeWithEmbeddingTool, createNeo4jFindNodesTool, createNeo4jGetSchemaTool, createNeo4jQueryTool, createNeo4jTools, createNeo4jTraverseTool, createNeo4jVectorSearchTool, createNeo4jVectorSearchWithEmbeddingTool, createObjectOmitTool, createObjectPickTool, createPathBasenameTool, createPathDirnameTool, createPathExtensionTool, createPathJoinTool, createPathNormalizeTool, createPathParseTool, createPathRelativeTool, createPathResolveTool, createPathUtilityTools, createPhoneValidatorTool, createRandomNumberTool, createScraperTools, createSelectReadableStream, createSerperProvider, createSlackTools, createStatisticsTool, createStringCaseConverterTool, createStringJoinTool, createStringLengthTool, createStringReplaceTool, createStringSplitTool, createStringSubstringTool, createStringTrimTool, createStringUtilityTools, createTransformerTools, createUrlBuilderTool, createUrlQueryParserTool, createUrlValidatorSimpleTool, createUrlValidatorTool, createUrlValidatorTools, createUuidValidatorTool, createValidationTools, createWebScraperTool, createXmlGeneratorTool, createXmlParserTool, createXmlToJsonTool, createXmlTools, creditCardValidator, csvGenerator, csvGeneratorSchema, csvParser, csvParserSchema, csvToJson, csvToJsonSchema, csvTools, currentDateTime, dateArithmetic, dateComparison, dateDifference, dateFormatter, dateTimeTools, diffSchemas, directoryCreate, directoryCreateSchema, directoryDelete, directoryDeleteSchema, directoryList, directoryListSchema, directoryOperationTools, emailValidator, embeddingManager, executeBatchedTask, executeQuery2 as executeQuery, executeStreamingSelect, exportSchemaToJson, extractImages, extractImagesSchema, extractLinks, extractLinksSchema, fileAppend, fileAppendSchema, fileDelete, fileDeleteSchema, fileExists, fileExistsSchema, fileOperationTools, fileReader, fileReaderSchema, fileSearch, fileSearchSchema, fileWriter, fileWriterSchema, generateBatchEmbeddings, generateEmbedding, getCohereApiKey, getConfluencePage, getEmbeddingModel, getEmbeddingProvider, getHuggingFaceApiKey, getInstallationInstructions, getOllamaBaseUrl, getOpenAIApiKey, getPeerDependencyName, getSlackChannels, getSlackMessages, getSpacePages, getVendorTypeMap, getVoyageApiKey, htmlParser, htmlParserSchema, htmlParserTools, httpClient, httpGet, httpGetSchema, httpPost, httpPostSchema, httpRequestSchema, httpTools, importSchemaFromJson, initializeEmbeddings, initializeEmbeddingsWithConfig, initializeFromEnv, initializeNeo4jTools, ipValidator, isRetryableError2 as isRetryableError, jsonMerge, jsonMergeSchema, jsonParser, jsonParserSchema, jsonQuery, jsonQuerySchema, jsonStringify, jsonStringifySchema, jsonToCsv, jsonToCsvSchema, jsonToXml, jsonToXmlSchema, jsonTools, jsonValidator, jsonValidatorSchema, listConfluenceSpaces, mapColumnType, mapSchemaTypes, mathFunctions, mathOperationTools, neo4jCoreTools, neo4jCreateNodeWithEmbedding, neo4jCreateNodeWithEmbeddingSchema, neo4jFindNodes, neo4jFindNodesSchema, neo4jGetSchema, neo4jGetSchemaSchema, neo4jPool, neo4jQuery, neo4jQuerySchema, neo4jTools, neo4jTraverse, neo4jTraverseSchema, neo4jVectorSearch, neo4jVectorSearchSchema, neo4jVectorSearchWithEmbedding, neo4jVectorSearchWithEmbeddingSchema, notifySlack, objectOmit, objectOmitSchema, objectPick, objectPickSchema, pathBasename, pathBasenameSchema, pathDirname, pathDirnameSchema, pathExtension, pathExtensionSchema, pathJoin, pathJoinSchema, pathNormalize, pathNormalizeSchema, pathParse, pathParseSchema, pathRelative, pathRelativeSchema, pathResolve, pathResolveSchema, pathUtilityTools, phoneValidator, randomNumber, relationalDelete, relationalGetSchema, relationalInsert, relationalQuery, relationalSelect, relationalUpdate, requestWithDestinationPolicy, resolveFileSystemPolicy, retryWithBackoff2 as retryWithBackoff, scraperTools, searchConfluence, searchResultSchema, sendSlackMessage, slackTools, statistics, streamSelectChunks, stringCaseConverter, stringJoin, stringLength, stringReplace, stringSplit, stringSubstring, stringTrim, stringUtilityTools, transformerArraySchema, transformerObjectSchema, transformerTools, transformerValueSchema, updateConfluencePage, urlBuilder, urlBuilderSchema, urlQueryParser, urlQueryParserSchema, urlValidator, urlValidatorSchema, urlValidatorSimple, urlValidatorTools, uuidValidator, validateBatch, validateColumnTypes, validateColumnsExist, validateTableExists, validateText, validationTools, webScraper, webScraperSchema, webSearch, webSearchOutputSchema, webSearchSchema, withTransaction, xmlGenerator, xmlGeneratorSchema, xmlParser, xmlParserSchema, xmlToJson, xmlToJsonSchema, xmlTools };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map