@anvia/core 0.25.0 → 0.26.0

package/dist/agent/index.js

@@ -1,21 +1,21 @@
 import {
   AgentBuilder
-} from "../chunk-4HWN7734.js";
-import "../chunk-YEBIVZM2.js";
-import "../chunk-VXONXP2G.js";
+} from "../chunk-JI5YZWNT.js";
+import "../chunk-DALYP4PX.js";
+import "../chunk-BALBBVI3.js";
 import "../chunk-YK4WAAS4.js";
 import "../chunk-XUUY2L2D.js";
-import "../chunk-2NDQHV7V.js";
-import "../chunk-4BGN6PYF.js";
+import "../chunk-HYUYZEAJ.js";
+import "../chunk-MELYDKWQ.js";
 import "../chunk-2ODTMRHP.js";
 import "../chunk-UQX6EXWG.js";
 import "../chunk-MRQLEK2B.js";
+import "../chunk-MNWK2USR.js";
+import "../chunk-OIMLU4SF.js";
 import "../chunk-Q25IWLBT.js";
 import "../chunk-MC3CCKEB.js";
 import "../chunk-ADH7NNCS.js";
 import "../chunk-WQKHFADH.js";
-import "../chunk-MNWK2USR.js";
-import "../chunk-OIMLU4SF.js";
 import "../chunk-CWUJUSOS.js";
 export {
   AgentBuilder

package/dist/{chunk-VXONXP2G.js → chunk-BALBBVI3.js}

@@ -4,7 +4,7 @@ import {
 import {
   parseToolArgs,
   toolResultContentToText
-} from "./chunk-2NDQHV7V.js";
+} from "./chunk-HYUYZEAJ.js";
 import {
   runControl,
   toolCallControl
@@ -15,6 +15,9 @@ import {
   createMemoryCompactionSummary,
   cumulativeCompactedMessageCount
 } from "./chunk-MRQLEK2B.js";
+import {
+  mapWithConcurrency
+} from "./chunk-OIMLU4SF.js";
 import {
   CompletionRequestBuilder
 } from "./chunk-Q25IWLBT.js";
@@ -30,9 +33,6 @@ import {
   getAssistantGenerationMetadata,
   textFromAssistantContent
 } from "./chunk-ADH7NNCS.js";
-import {
-  mapWithConcurrency
-} from "./chunk-OIMLU4SF.js";
 import {
   appendGuardrailPolicies,
   hasEnforcedOutputGuardrails,
@@ -2729,4 +2729,4 @@ export {
   extractRagText,
   PromptRequest
 };
-//# sourceMappingURL=chunk-VXONXP2G.js.map
+//# sourceMappingURL=chunk-BALBBVI3.js.map

package/dist/{chunk-YEBIVZM2.js → chunk-DALYP4PX.js}

@@ -1,15 +1,15 @@
 import {
   PromptRequest
-} from "./chunk-VXONXP2G.js";
+} from "./chunk-BALBBVI3.js";
 import {
   isSkillTool
 } from "./chunk-YK4WAAS4.js";
 import {
   ToolSet
-} from "./chunk-2NDQHV7V.js";
+} from "./chunk-HYUYZEAJ.js";
 import {
   createTool
-} from "./chunk-4BGN6PYF.js";
+} from "./chunk-MELYDKWQ.js";
 import {
   isStreamingCompletionModel
 } from "./chunk-MC3CCKEB.js";
@@ -222,4 +222,4 @@ export {
   Agent,
   AgentSession
 };
-//# sourceMappingURL=chunk-YEBIVZM2.js.map
+//# sourceMappingURL=chunk-DALYP4PX.js.map

package/dist/{chunk-2NDQHV7V.js → chunk-HYUYZEAJ.js}

@@ -1,14 +1,14 @@
 import {
   InMemoryVectorStore,
   createTool
-} from "./chunk-4BGN6PYF.js";
+} from "./chunk-MELYDKWQ.js";
+import {
+  embedDocuments
+} from "./chunk-MNWK2USR.js";
 import {
   isToolResultContentArray,
   serializeToolResultOutput
 } from "./chunk-ADH7NNCS.js";
-import {
-  embedDocuments
-} from "./chunk-MNWK2USR.js";
 
 // src/tool/errors.ts
 var ToolCallError = class extends Error {
@@ -220,4 +220,4 @@ export {
   createMiddleware,
   createThinkTool
 };
-//# sourceMappingURL=chunk-2NDQHV7V.js.map
+//# sourceMappingURL=chunk-HYUYZEAJ.js.map

package/dist/{chunk-4HWN7734.js → chunk-JI5YZWNT.js}

@@ -1,10 +1,10 @@
 import {
   Agent,
   normalizeAgentId
-} from "./chunk-YEBIVZM2.js";
+} from "./chunk-DALYP4PX.js";
 import {
   ToolSet
-} from "./chunk-2NDQHV7V.js";
+} from "./chunk-HYUYZEAJ.js";
 import {
   resolveMemoryOptions
 } from "./chunk-UQX6EXWG.js";
@@ -217,4 +217,4 @@ var AgentBuilder = class {
 export {
   AgentBuilder
 };
-//# sourceMappingURL=chunk-4HWN7734.js.map
+//# sourceMappingURL=chunk-JI5YZWNT.js.map

package/dist/{chunk-4BGN6PYF.js → chunk-MELYDKWQ.js}

@@ -1,10 +1,10 @@
-import {
-  toProviderJsonSchema
-} from "./chunk-WQKHFADH.js";
 import {
   cosineSimilarity,
   embedText
 } from "./chunk-MNWK2USR.js";
+import {
+  toProviderJsonSchema
+} from "./chunk-WQKHFADH.js";
 
 // src/vector-store/index.ts
 import { z } from "zod";
@@ -334,4 +334,4 @@ export {
   InMemoryVectorIndex,
   createVectorSearchTool
 };
-//# sourceMappingURL=chunk-4BGN6PYF.js.map
+//# sourceMappingURL=chunk-MELYDKWQ.js.map

package/dist/{chunk-BCA4VZ5W.js → chunk-NCPN4SJR.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-YK4WAAS4.js";
 import {
   createTool
-} from "./chunk-4BGN6PYF.js";
+} from "./chunk-MELYDKWQ.js";
 
 // src/skills/instructions.ts
 function skillInstructions(skills) {
@@ -395,4 +395,4 @@ export {
   SkillValidationError,
   skill
 };
-//# sourceMappingURL=chunk-BCA4VZ5W.js.map
+//# sourceMappingURL=chunk-NCPN4SJR.js.map

package/dist/{chunk-KYEBWN3E.js → chunk-YLMDBQO4.js}

@@ -1,12 +1,12 @@
 import {
   AgentBuilder
-} from "./chunk-4HWN7734.js";
+} from "./chunk-JI5YZWNT.js";
 import {
   extractRagText
-} from "./chunk-VXONXP2G.js";
+} from "./chunk-BALBBVI3.js";
 import {
   createTool
-} from "./chunk-4BGN6PYF.js";
+} from "./chunk-MELYDKWQ.js";
 import {
   CompletionRequestBuilder
 } from "./chunk-Q25IWLBT.js";
@@ -138,4 +138,4 @@ export {
   Extractor,
   ExtractorBuilder
 };
-//# sourceMappingURL=chunk-KYEBWN3E.js.map
+//# sourceMappingURL=chunk-YLMDBQO4.js.map

package/dist/evals/index.js

@@ -1,22 +1,16 @@
 import {
   ExtractorBuilder
-} from "../chunk-KYEBWN3E.js";
-import "../chunk-4HWN7734.js";
-import "../chunk-YEBIVZM2.js";
-import "../chunk-VXONXP2G.js";
+} from "../chunk-YLMDBQO4.js";
+import "../chunk-JI5YZWNT.js";
+import "../chunk-DALYP4PX.js";
+import "../chunk-BALBBVI3.js";
 import "../chunk-YK4WAAS4.js";
 import "../chunk-XUUY2L2D.js";
-import "../chunk-2NDQHV7V.js";
-import "../chunk-4BGN6PYF.js";
+import "../chunk-HYUYZEAJ.js";
+import "../chunk-MELYDKWQ.js";
 import "../chunk-2ODTMRHP.js";
 import "../chunk-UQX6EXWG.js";
 import "../chunk-MRQLEK2B.js";
-import "../chunk-Q25IWLBT.js";
-import "../chunk-MC3CCKEB.js";
-import {
-  Usage
-} from "../chunk-ADH7NNCS.js";
-import "../chunk-WQKHFADH.js";
 import {
   cosineSimilarity,
   embedText
@@ -24,6 +18,12 @@ import {
 import {
   mapWithConcurrency
 } from "../chunk-OIMLU4SF.js";
+import "../chunk-Q25IWLBT.js";
+import "../chunk-MC3CCKEB.js";
+import {
+  Usage
+} from "../chunk-ADH7NNCS.js";
+import "../chunk-WQKHFADH.js";
 import "../chunk-CWUJUSOS.js";
 
 // src/evals/advanced-metrics.ts

package/dist/extractor/index.js

@@ -2,23 +2,23 @@ import {
   ExtractionError,
   Extractor,
   ExtractorBuilder
-} from "../chunk-KYEBWN3E.js";
-import "../chunk-4HWN7734.js";
-import "../chunk-YEBIVZM2.js";
-import "../chunk-VXONXP2G.js";
+} from "../chunk-YLMDBQO4.js";
+import "../chunk-JI5YZWNT.js";
+import "../chunk-DALYP4PX.js";
+import "../chunk-BALBBVI3.js";
 import "../chunk-YK4WAAS4.js";
 import "../chunk-XUUY2L2D.js";
-import "../chunk-2NDQHV7V.js";
-import "../chunk-4BGN6PYF.js";
+import "../chunk-HYUYZEAJ.js";
+import "../chunk-MELYDKWQ.js";
 import "../chunk-2ODTMRHP.js";
 import "../chunk-UQX6EXWG.js";
 import "../chunk-MRQLEK2B.js";
+import "../chunk-MNWK2USR.js";
+import "../chunk-OIMLU4SF.js";
 import "../chunk-Q25IWLBT.js";
 import "../chunk-MC3CCKEB.js";
 import "../chunk-ADH7NNCS.js";
 import "../chunk-WQKHFADH.js";
-import "../chunk-MNWK2USR.js";
-import "../chunk-OIMLU4SF.js";
 import "../chunk-CWUJUSOS.js";
 export {
   ExtractionError,

package/dist/index.js

@@ -2,7 +2,7 @@ import {
   SkillValidationError,
   loadSkills,
   skill
-} from "./chunk-BCA4VZ5W.js";
+} from "./chunk-NCPN4SJR.js";
 import {
   coreMessagesToUIMessages,
   uiMessagesToCoreMessages
@@ -11,22 +11,22 @@ import "./chunk-CQNNSZPG.js";
 import "./chunk-XWUC7CIT.js";
 import {
   AgentBuilder
-} from "./chunk-4HWN7734.js";
-import "./chunk-YEBIVZM2.js";
+} from "./chunk-JI5YZWNT.js";
+import "./chunk-DALYP4PX.js";
 import {
   MaxTurnsError,
   PromptCancelledError,
   ToolApprovalRequiredError
-} from "./chunk-VXONXP2G.js";
+} from "./chunk-BALBBVI3.js";
 import "./chunk-YK4WAAS4.js";
 import "./chunk-XUUY2L2D.js";
 import {
   createMiddleware,
   createThinkTool
-} from "./chunk-2NDQHV7V.js";
+} from "./chunk-HYUYZEAJ.js";
 import {
   createTool
-} from "./chunk-4BGN6PYF.js";
+} from "./chunk-MELYDKWQ.js";
 import {
   cancelPrompt,
   createHook,
@@ -42,6 +42,8 @@ import {
   createSummaryMemoryCompactor,
   isMemoryCompactionSummary
 } from "./chunk-MRQLEK2B.js";
+import "./chunk-MNWK2USR.js";
+import "./chunk-OIMLU4SF.js";
 import "./chunk-Q25IWLBT.js";
 import {
   createCompletion,
@@ -62,8 +64,6 @@ import {
   withContextUsage
 } from "./chunk-ADH7NNCS.js";
 import "./chunk-WQKHFADH.js";
-import "./chunk-MNWK2USR.js";
-import "./chunk-OIMLU4SF.js";
 import {
   allow,
   block,

package/dist/internal/agent.js

@@ -2,20 +2,20 @@ import {
   Agent,
   AgentSession,
   DEFAULT_MAX_TURNS
-} from "../chunk-YEBIVZM2.js";
-import "../chunk-VXONXP2G.js";
+} from "../chunk-DALYP4PX.js";
+import "../chunk-BALBBVI3.js";
 import "../chunk-YK4WAAS4.js";
 import "../chunk-XUUY2L2D.js";
-import "../chunk-2NDQHV7V.js";
-import "../chunk-4BGN6PYF.js";
+import "../chunk-HYUYZEAJ.js";
+import "../chunk-MELYDKWQ.js";
 import "../chunk-2ODTMRHP.js";
 import "../chunk-MRQLEK2B.js";
+import "../chunk-MNWK2USR.js";
+import "../chunk-OIMLU4SF.js";
 import "../chunk-Q25IWLBT.js";
 import "../chunk-MC3CCKEB.js";
 import "../chunk-ADH7NNCS.js";
 import "../chunk-WQKHFADH.js";
-import "../chunk-MNWK2USR.js";
-import "../chunk-OIMLU4SF.js";
 import "../chunk-CWUJUSOS.js";
 export {
   Agent,

package/dist/mcp/index.js

@@ -101,6 +101,172 @@ import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+
+// src/mcp/url-safety.ts
+import { lookup } from "dns/promises";
+import { BlockList, isIP } from "net";
+import { Agent, Pool, fetch as undiciFetch } from "undici";
+var blockedIpv4Addresses = new BlockList();
+var blockedIpv6Addresses = new BlockList();
+for (const [network, prefix] of [
+  ["0.0.0.0", 8],
+  ["10.0.0.0", 8],
+  ["100.64.0.0", 10],
+  ["127.0.0.0", 8],
+  ["169.254.0.0", 16],
+  ["172.16.0.0", 12],
+  ["192.0.0.0", 24],
+  ["192.0.2.0", 24],
+  ["192.88.99.0", 24],
+  ["192.168.0.0", 16],
+  ["198.18.0.0", 15],
+  ["198.51.100.0", 24],
+  ["203.0.113.0", 24],
+  ["224.0.0.0", 4],
+  ["240.0.0.0", 4]
+]) {
+  blockedIpv4Addresses.addSubnet(network, prefix, "ipv4");
+}
+for (const [network, prefix] of [
+  ["::", 96],
+  ["::ffff:0:0", 96],
+  ["64:ff9b::", 96],
+  ["64:ff9b:1::", 48],
+  ["100::", 64],
+  ["2001::", 32],
+  ["2001:2::", 48],
+  ["2001:10::", 28],
+  ["2001:20::", 28],
+  ["2001:db8::", 32],
+  ["2002::", 16],
+  ["fc00::", 7],
+  ["fe80::", 10],
+  ["fec0::", 10],
+  ["ff00::", 8]
+]) {
+  blockedIpv6Addresses.addSubnet(network, prefix, "ipv6");
+}
+var defaultAddressResolver = (hostname) => lookup(hostname, { all: true, verbatim: true });
+function parseAndValidateMcpUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`Invalid MCP URL: ${url}`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`MCP URL blocked: only HTTP(S) URLs are allowed (${parsed.protocol})`);
+  }
+  validateMcpHostname(parsed.hostname);
+  return parsed;
+}
+async function resolveAndValidateMcpHostname(hostname, resolveAddresses = defaultAddressResolver) {
+  const normalizedHostname = normalizeHostname(hostname);
+  validateMcpHostname(normalizedHostname);
+  const family = isIP(normalizedHostname);
+  if (family !== 0) {
+    return [{ address: normalizedHostname, family }];
+  }
+  let addresses;
+  try {
+    addresses = await resolveAddresses(normalizedHostname);
+  } catch (cause) {
+    throw new Error(`Unable to resolve MCP URL hostname (${normalizedHostname})`, { cause });
+  }
+  if (addresses.length === 0) {
+    throw new Error(`Unable to resolve MCP URL hostname (${normalizedHostname})`);
+  }
+  for (const { address } of addresses) {
+    validateMcpHostname(address);
+  }
+  return addresses;
+}
+function createSafeMcpLookup(resolveAddresses = defaultAddressResolver) {
+  return (hostname, options, callback) => {
+    void resolveAndValidateMcpHostname(hostname, resolveAddresses).then(
+      (addresses) => {
+        const requestedFamily = normalizeRequestedFamily(options.family);
+        const matchingAddresses = requestedFamily === 0 ? addresses : addresses.filter(({ family }) => family === requestedFamily);
+        if (matchingAddresses.length === 0) {
+          const error = new Error(`No matching address family for MCP URL (${hostname})`);
+          Object.assign(error, { code: "EAI_ADDRFAMILY" });
+          callback(error, []);
+          return;
+        }
+        if (options.all) {
+          callback(null, matchingAddresses);
+          return;
+        }
+        const address = matchingAddresses[0];
+        if (!address) {
+          callback(new Error(`Unable to resolve MCP URL hostname (${hostname})`), []);
+          return;
+        }
+        callback(null, address.address, address.family);
+      },
+      (cause) => {
+        callback(asError(cause), []);
+      }
+    );
+  };
+}
+function createSafeMcpFetch() {
+  return (url, init) => {
+    parseAndValidateMcpUrl(url);
+    return undiciFetch(url, {
+      ...init,
+      dispatcher: safeMcpDispatcher
+    });
+  };
+}
+function validateMcpHostname(hostname) {
+  const normalizedHostname = normalizeHostname(hostname);
+  if (normalizedHostname === "localhost" || normalizedHostname.endsWith(".localhost")) {
+    throw new Error(`MCP URL blocked: localhost not allowed (${normalizedHostname})`);
+  }
+  const family = isIP(normalizedHostname);
+  if (family === 0) {
+    return;
+  }
+  if (family === 4 && normalizedHostname.startsWith("127.") || family === 6 && normalizedHostname === "::1") {
+    throw new Error(`MCP URL blocked: localhost not allowed (${normalizedHostname})`);
+  }
+  if (normalizedHostname === "169.254.169.254" || normalizedHostname === "fd00:ec2::254") {
+    throw new Error(`MCP URL blocked: cloud metadata endpoint not allowed (${normalizedHostname})`);
+  }
+  if (family === 4 && blockedIpv4Addresses.check(normalizedHostname, "ipv4") || family === 6 && blockedIpv6Addresses.check(normalizedHostname, "ipv6")) {
+    const range = family === 4 ? "IP" : "IPv6";
+    throw new Error(`MCP URL blocked: private ${range} range not allowed (${normalizedHostname})`);
+  }
+}
+function normalizeHostname(hostname) {
+  const withoutBrackets = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+  return withoutBrackets.toLowerCase().replace(/\.+$/, "");
+}
+function normalizeRequestedFamily(family) {
+  if (family === 4 || family === "IPv4") {
+    return 4;
+  }
+  if (family === 6 || family === "IPv6") {
+    return 6;
+  }
+  return 0;
+}
+function asError(cause) {
+  return cause instanceof Error ? cause : new Error(String(cause));
+}
+var safeMcpDispatcher = new Agent({
+  autoSelectFamily: true,
+  connect: {
+    lookup: createSafeMcpLookup()
+  },
+  factory(origin, options) {
+    parseAndValidateMcpUrl(origin);
+    return new Pool(origin, options);
+  }
+});
+
+// src/mcp/connections.ts
 var CORE_CLIENT_VERSION = readCorePackageVersion();
 var mcp = {
   stdio(options) {
@@ -118,10 +284,15 @@ var mcp = {
     return {
       name: options.name,
       async connect() {
+        assertNoCustomMcpFetch(options.transport?.fetch);
+        const url = parseAndValidateMcpUrl(options.url);
         const client = createSdkClient();
         await client.connect(
           asSdkTransport(
-            new StreamableHTTPClientTransport(new URL(options.url), options.transport)
+            new StreamableHTTPClientTransport(url, {
+              ...options.transport,
+              fetch: createSafeMcpFetch()
+            })
           )
         );
         return client;
@@ -132,15 +303,29 @@ var mcp = {
     return {
       name: options.name,
       async connect() {
+        assertNoCustomMcpFetch(options.transport?.fetch);
+        const url = parseAndValidateMcpUrl(options.url);
         const client = createSdkClient();
         await client.connect(
-          asSdkTransport(new SSEClientTransport(new URL(options.url), options.transport))
+          asSdkTransport(
+            new SSEClientTransport(url, {
+              ...options.transport,
+              fetch: createSafeMcpFetch()
+            })
+          )
         );
         return client;
       }
     };
   }
 };
+function assertNoCustomMcpFetch(fetch) {
+  if (fetch !== void 0) {
+    throw new Error(
+      "Custom MCP transport fetch implementations are not allowed because they can bypass SSRF protection"
+    );
+  }
+}
 function createSdkClient() {
   return new Client({
     name: "@anvia/core",

package/dist/mcp/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/mcp/result.ts","../../src/mcp/tool.ts","../../src/mcp/connect.ts","../../src/mcp/connections.ts"],"sourcesContent":["import { isRecord } from \"../internal/record\";\nimport type { McpToolCallContent, McpToolCallResult } from \"./types\";\n\nexport function createCallToolParams(\n  name: string,\n  args: unknown,\n): { name: string; arguments?: Record<string, unknown> } {\n  if (args === null || args === undefined) {\n    return { name };\n  }\n\n  if (!isRecord(args)) {\n    throw new Error(\"MCP tool arguments must be a JSON object\");\n  }\n\n  return { name, arguments: args };\n}\n\nexport function mapMcpToolResult(result: McpToolCallResult): string {\n  if (\"toolResult\" in result) {\n    return serializeMcpValue(result.toolResult);\n  }\n\n  if (result.isError === true) {\n    throw new Error(mcpErrorMessage(result.content));\n  }\n\n  return result.content.map(mapMcpContent).join(\"\");\n}\n\nfunction mcpErrorMessage(content: McpToolCallContent[]): string {\n  const text = content\n    .map((item) => (item.type === \"text\" ? item.text : undefined))\n    .filter((item): item is string => item !== undefined)\n    .join(\"\\n\");\n\n  return text === \"\" ? \"MCP tool returned an error\" : text;\n}\n\nfunction mapMcpContent(content: McpToolCallContent): string {\n  if (content.type === \"text\") {\n    return content.text;\n  }\n\n  if (content.type === \"image\") {\n    return `data:${content.mimeType};base64,${content.data}`;\n  }\n\n  if (content.type === \"resource\") {\n    const mimeType =\n      content.resource.mimeType === undefined ? \"\" : `data:${content.resource.mimeType};`;\n    if (\"text\" in content.resource) {\n      return `${mimeType}${content.resource.uri}:${content.resource.text}`;\n    }\n\n    return `${mimeType}${content.resource.uri}:${content.resource.blob}`;\n  }\n\n  throw new Error(`Unsupported MCP tool result content: ${serializeMcpValue(content)}`);\n}\n\nfunction serializeMcpValue(value: unknown): string {\n  if (typeof value === \"string\") {\n    return value;\n  }\n\n  const serialized = JSON.stringify(value);\n  return serialized === undefined ? String(value) : serialized;\n}\n","import type { ToolDefinition } from \"../completion/index\";\nimport type { Tool } from \"../tool/index\";\nimport { createCallToolParams, mapMcpToolResult } from \"./result\";\nimport type { McpClient, McpToolDefinition } from \"./types\";\n\nconst MCP_TOOL_METADATA_KEY = Symbol.for(\"anvia.mcp.tool.metadata\");\n\nexport function createMcpTool(\n  definition: McpToolDefinition,\n  client: McpClient,\n  serverName?: string,\n): Tool {\n  const tool: Tool = {\n    name: definition.name,\n    definition(): ToolDefinition {\n      return {\n        name: definition.name,\n        description: definition.description ?? \"\",\n        parameters: definition.inputSchema,\n      };\n    },\n    async call(args): Promise<string> {\n      const result = await client.callTool(createCallToolParams(definition.name, args));\n      return mapMcpToolResult(result);\n    },\n  };\n  if (serverName !== undefined) {\n    Object.defineProperty(tool, MCP_TOOL_METADATA_KEY, {\n      value: { serverName },\n      enumerable: false,\n    });\n  }\n  return tool;\n}\n","import { createMcpTool } from \"./tool\";\nimport type { McpConnection, McpServer } from \"./types\";\n\nexport async function connectMcp(connection: McpConnection): Promise<McpServer> {\n  const client = await connection.connect();\n  let tools: Awaited<ReturnType<typeof client.listTools>>[\"tools\"];\n  try {\n    ({ tools } = await client.listTools());\n  } catch (error) {\n    try {\n      await client.close();\n    } catch {\n      // Preserve the initialization failure so callers see the actionable MCP error.\n    }\n    throw error;\n  }\n\n  return {\n    name: connection.name,\n    tools: tools.map((tool) => createMcpTool(tool, client, connection.name)),\n    close: () => client.close(),\n  };\n}\n","import { readFileSync } from \"node:fs\";\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { SSEClientTransport } from \"@modelcontextprotocol/sdk/client/sse.js\";\nimport { StdioClientTransport } from \"@modelcontextprotocol/sdk/client/stdio.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport type {\n  McpClient,\n  McpConnection,\n  McpHttpOptions,\n  McpSseOptions,\n  McpStdioOptions,\n} from \"./types\";\n\nconst CORE_CLIENT_VERSION = readCorePackageVersion();\n\nexport const mcp = {\n  stdio(options: McpStdioOptions): McpConnection {\n    return {\n      name: options.name,\n      async connect(): Promise<McpClient> {\n        const { name: _name, ...server } = options;\n        const client = createSdkClient();\n        await client.connect(asSdkTransport(new StdioClientTransport(server)));\n        return client as McpClient;\n      },\n    };\n  },\n\n  http(options: McpHttpOptions): McpConnection {\n    return {\n      name: options.name,\n      async connect(): Promise<McpClient> {\n        const client = createSdkClient();\n        await client.connect(\n          asSdkTransport(\n            new StreamableHTTPClientTransport(new URL(options.url), options.transport),\n          ),\n        );\n        return client as McpClient;\n      },\n    };\n  },\n\n  sse(options: McpSseOptions): McpConnection {\n    return {\n      name: options.name,\n      async connect(): Promise<McpClient> {\n        const client = createSdkClient();\n        await client.connect(\n          asSdkTransport(new SSEClientTransport(new URL(options.url), options.transport)),\n        );\n        return client as McpClient;\n      },\n    };\n  },\n};\n\nfunction createSdkClient(): Client {\n  return new Client({\n    name: \"@anvia/core\",\n    version: CORE_CLIENT_VERSION,\n  });\n}\n\nfunction readCorePackageVersion(): string {\n  try {\n    const packageJson = JSON.parse(\n      readFileSync(new URL(\"../../package.json\", import.meta.url), \"utf8\"),\n    ) as { version?: unknown };\n    return typeof packageJson.version === \"string\" ? packageJson.version : \"0.0.0\";\n  } catch {\n    return \"0.0.0\";\n  }\n}\n\nfunction asSdkTransport(transport: unknown): Parameters<Client[\"connect\"]>[0] {\n  return transport as Parameters<Client[\"connect\"]>[0];\n}\n"],"mappings":";;;;;AAGO,SAAS,qBACd,MACA,MACuD;AACvD,MAAI,SAAS,QAAQ,SAAS,QAAW;AACvC,WAAO,EAAE,KAAK;AAAA,EAChB;AAEA,MAAI,CAAC,SAAS,IAAI,GAAG;AACnB,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AAEA,SAAO,EAAE,MAAM,WAAW,KAAK;AACjC;AAEO,SAAS,iBAAiB,QAAmC;AAClE,MAAI,gBAAgB,QAAQ;AAC1B,WAAO,kBAAkB,OAAO,UAAU;AAAA,EAC5C;AAEA,MAAI,OAAO,YAAY,MAAM;AAC3B,UAAM,IAAI,MAAM,gBAAgB,OAAO,OAAO,CAAC;AAAA,EACjD;AAEA,SAAO,OAAO,QAAQ,IAAI,aAAa,EAAE,KAAK,EAAE;AAClD;AAEA,SAAS,gBAAgB,SAAuC;AAC9D,QAAM,OAAO,QACV,IAAI,CAAC,SAAU,KAAK,SAAS,SAAS,KAAK,OAAO,MAAU,EAC5D,OAAO,CAAC,SAAyB,SAAS,MAAS,EACnD,KAAK,IAAI;AAEZ,SAAO,SAAS,KAAK,+BAA+B;AACtD;AAEA,SAAS,cAAc,SAAqC;AAC1D,MAAI,QAAQ,SAAS,QAAQ;AAC3B,WAAO,QAAQ;AAAA,EACjB;AAEA,MAAI,QAAQ,SAAS,SAAS;AAC5B,WAAO,QAAQ,QAAQ,QAAQ,WAAW,QAAQ,IAAI;AAAA,EACxD;AAEA,MAAI,QAAQ,SAAS,YAAY;AAC/B,UAAM,WACJ,QAAQ,SAAS,aAAa,SAAY,KAAK,QAAQ,QAAQ,SAAS,QAAQ;AAClF,QAAI,UAAU,QAAQ,UAAU;AAC9B,aAAO,GAAG,QAAQ,GAAG,QAAQ,SAAS,GAAG,IAAI,QAAQ,SAAS,IAAI;AAAA,IACpE;AAEA,WAAO,GAAG,QAAQ,GAAG,QAAQ,SAAS,GAAG,IAAI,QAAQ,SAAS,IAAI;AAAA,EACpE;AAEA,QAAM,IAAI,MAAM,wCAAwC,kBAAkB,OAAO,CAAC,EAAE;AACtF;AAEA,SAAS,kBAAkB,OAAwB;AACjD,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,KAAK,UAAU,KAAK;AACvC,SAAO,eAAe,SAAY,OAAO,KAAK,IAAI;AACpD;;;AC/DA,IAAM,wBAAwB,uBAAO,IAAI,yBAAyB;AAE3D,SAAS,cACd,YACA,QACA,YACM;AACN,QAAM,OAAa;AAAA,IACjB,MAAM,WAAW;AAAA,IACjB,aAA6B;AAC3B,aAAO;AAAA,QACL,MAAM,WAAW;AAAA,QACjB,aAAa,WAAW,eAAe;AAAA,QACvC,YAAY,WAAW;AAAA,MACzB;AAAA,IACF;AAAA,IACA,MAAM,KAAK,MAAuB;AAChC,YAAM,SAAS,MAAM,OAAO,SAAS,qBAAqB,WAAW,MAAM,IAAI,CAAC;AAChF,aAAO,iBAAiB,MAAM;AAAA,IAChC;AAAA,EACF;AACA,MAAI,eAAe,QAAW;AAC5B,WAAO,eAAe,MAAM,uBAAuB;AAAA,MACjD,OAAO,EAAE,WAAW;AAAA,MACpB,YAAY;AAAA,IACd,CAAC;AAAA,EACH;AACA,SAAO;AACT;;;AC9BA,eAAsB,WAAW,YAA+C;AAC9E,QAAM,SAAS,MAAM,WAAW,QAAQ;AACxC,MAAI;AACJ,MAAI;AACF,KAAC,EAAE,MAAM,IAAI,MAAM,OAAO,UAAU;AAAA,EACtC,SAAS,OAAO;AACd,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,IACrB,QAAQ;AAAA,IAER;AACA,UAAM;AAAA,EACR;AAEA,SAAO;AAAA,IACL,MAAM,WAAW;AAAA,IACjB,OAAO,MAAM,IAAI,CAAC,SAAS,cAAc,MAAM,QAAQ,WAAW,IAAI,CAAC;AAAA,IACvE,OAAO,MAAM,OAAO,MAAM;AAAA,EAC5B;AACF;;;ACtBA,SAAS,oBAAoB;AAC7B,SAAS,cAAc;AACvB,SAAS,0BAA0B;AACnC,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;AAS9C,IAAM,sBAAsB,uBAAuB;AAE5C,IAAM,MAAM;AAAA,EACjB,MAAM,SAAyC;AAC7C,WAAO;AAAA,MACL,MAAM,QAAQ;AAAA,MACd,MAAM,UAA8B;AAClC,cAAM,EAAE,MAAM,OAAO,GAAG,OAAO,IAAI;AACnC,cAAM,SAAS,gBAAgB;AAC/B,cAAM,OAAO,QAAQ,eAAe,IAAI,qBAAqB,MAAM,CAAC,CAAC;AACrE,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA,EAEA,KAAK,SAAwC;AAC3C,WAAO;AAAA,MACL,MAAM,QAAQ;AAAA,MACd,MAAM,UAA8B;AAClC,cAAM,SAAS,gBAAgB;AAC/B,cAAM,OAAO;AAAA,UACX;AAAA,YACE,IAAI,8BAA8B,IAAI,IAAI,QAAQ,GAAG,GAAG,QAAQ,SAAS;AAAA,UAC3E;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA,EAEA,IAAI,SAAuC;AACzC,WAAO;AAAA,MACL,MAAM,QAAQ;AAAA,MACd,MAAM,UAA8B;AAClC,cAAM,SAAS,gBAAgB;AAC/B,cAAM,OAAO;AAAA,UACX,eAAe,IAAI,mBAAmB,IAAI,IAAI,QAAQ,GAAG,GAAG,QAAQ,SAAS,CAAC;AAAA,QAChF;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,kBAA0B;AACjC,SAAO,IAAI,OAAO;AAAA,IAChB,MAAM;AAAA,IACN,SAAS;AAAA,EACX,CAAC;AACH;AAEA,SAAS,yBAAiC;AACxC,MAAI;AACF,UAAM,cAAc,KAAK;AAAA,MACvB,aAAa,IAAI,IAAI,sBAAsB,YAAY,GAAG,GAAG,MAAM;AAAA,IACrE;AACA,WAAO,OAAO,YAAY,YAAY,WAAW,YAAY,UAAU;AAAA,EACzE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,eAAe,WAAsD;AAC5E,SAAO;AACT;","names":[]}
+{"version":3,"sources":["../../src/mcp/result.ts","../../src/mcp/tool.ts","../../src/mcp/connect.ts","../../src/mcp/connections.ts","../../src/mcp/url-safety.ts"],"sourcesContent":["import { isRecord } from \"../internal/record\";\nimport type { McpToolCallContent, McpToolCallResult } from \"./types\";\n\nexport function createCallToolParams(\n  name: string,\n  args: unknown,\n): { name: string; arguments?: Record<string, unknown> } {\n  if (args === null || args === undefined) {\n    return { name };\n  }\n\n  if (!isRecord(args)) {\n    throw new Error(\"MCP tool arguments must be a JSON object\");\n  }\n\n  return { name, arguments: args };\n}\n\nexport function mapMcpToolResult(result: McpToolCallResult): string {\n  if (\"toolResult\" in result) {\n    return serializeMcpValue(result.toolResult);\n  }\n\n  if (result.isError === true) {\n    throw new Error(mcpErrorMessage(result.content));\n  }\n\n  return result.content.map(mapMcpContent).join(\"\");\n}\n\nfunction mcpErrorMessage(content: McpToolCallContent[]): string {\n  const text = content\n    .map((item) => (item.type === \"text\" ? item.text : undefined))\n    .filter((item): item is string => item !== undefined)\n    .join(\"\\n\");\n\n  return text === \"\" ? \"MCP tool returned an error\" : text;\n}\n\nfunction mapMcpContent(content: McpToolCallContent): string {\n  if (content.type === \"text\") {\n    return content.text;\n  }\n\n  if (content.type === \"image\") {\n    return `data:${content.mimeType};base64,${content.data}`;\n  }\n\n  if (content.type === \"resource\") {\n    const mimeType =\n      content.resource.mimeType === undefined ? \"\" : `data:${content.resource.mimeType};`;\n    if (\"text\" in content.resource) {\n      return `${mimeType}${content.resource.uri}:${content.resource.text}`;\n    }\n\n    return `${mimeType}${content.resource.uri}:${content.resource.blob}`;\n  }\n\n  throw new Error(`Unsupported MCP tool result content: ${serializeMcpValue(content)}`);\n}\n\nfunction serializeMcpValue(value: unknown): string {\n  if (typeof value === \"string\") {\n    return value;\n  }\n\n  const serialized = JSON.stringify(value);\n  return serialized === undefined ? String(value) : serialized;\n}\n","import type { ToolDefinition } from \"../completion/index\";\nimport type { Tool } from \"../tool/index\";\nimport { createCallToolParams, mapMcpToolResult } from \"./result\";\nimport type { McpClient, McpToolDefinition } from \"./types\";\n\nconst MCP_TOOL_METADATA_KEY = Symbol.for(\"anvia.mcp.tool.metadata\");\n\nexport function createMcpTool(\n  definition: McpToolDefinition,\n  client: McpClient,\n  serverName?: string,\n): Tool {\n  const tool: Tool = {\n    name: definition.name,\n    definition(): ToolDefinition {\n      return {\n        name: definition.name,\n        description: definition.description ?? \"\",\n        parameters: definition.inputSchema,\n      };\n    },\n    async call(args): Promise<string> {\n      const result = await client.callTool(createCallToolParams(definition.name, args));\n      return mapMcpToolResult(result);\n    },\n  };\n  if (serverName !== undefined) {\n    Object.defineProperty(tool, MCP_TOOL_METADATA_KEY, {\n      value: { serverName },\n      enumerable: false,\n    });\n  }\n  return tool;\n}\n","import { createMcpTool } from \"./tool\";\nimport type { McpConnection, McpServer } from \"./types\";\n\nexport async function connectMcp(connection: McpConnection): Promise<McpServer> {\n  const client = await connection.connect();\n  let tools: Awaited<ReturnType<typeof client.listTools>>[\"tools\"];\n  try {\n    ({ tools } = await client.listTools());\n  } catch (error) {\n    try {\n      await client.close();\n    } catch {\n      // Preserve the initialization failure so callers see the actionable MCP error.\n    }\n    throw error;\n  }\n\n  return {\n    name: connection.name,\n    tools: tools.map((tool) => createMcpTool(tool, client, connection.name)),\n    close: () => client.close(),\n  };\n}\n","import { readFileSync } from \"node:fs\";\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { SSEClientTransport } from \"@modelcontextprotocol/sdk/client/sse.js\";\nimport { StdioClientTransport } from \"@modelcontextprotocol/sdk/client/stdio.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport type {\n  McpClient,\n  McpConnection,\n  McpHttpOptions,\n  McpSseOptions,\n  McpStdioOptions,\n} from \"./types\";\nimport { createSafeMcpFetch, parseAndValidateMcpUrl } from \"./url-safety\";\n\nconst CORE_CLIENT_VERSION = readCorePackageVersion();\n\nexport const mcp = {\n  stdio(options: McpStdioOptions): McpConnection {\n    return {\n      name: options.name,\n      async connect(): Promise<McpClient> {\n        const { name: _name, ...server } = options;\n        const client = createSdkClient();\n        await client.connect(asSdkTransport(new StdioClientTransport(server)));\n        return client as McpClient;\n      },\n    };\n  },\n\n  http(options: McpHttpOptions): McpConnection {\n    return {\n      name: options.name,\n      async connect(): Promise<McpClient> {\n        assertNoCustomMcpFetch(options.transport?.fetch);\n        const url = parseAndValidateMcpUrl(options.url);\n        const client = createSdkClient();\n        await client.connect(\n          asSdkTransport(\n            new StreamableHTTPClientTransport(url, {\n              ...options.transport,\n              fetch: createSafeMcpFetch(),\n            }),\n          ),\n        );\n        return client as McpClient;\n      },\n    };\n  },\n\n  sse(options: McpSseOptions): McpConnection {\n    return {\n      name: options.name,\n      async connect(): Promise<McpClient> {\n        assertNoCustomMcpFetch(options.transport?.fetch);\n        const url = parseAndValidateMcpUrl(options.url);\n        const client = createSdkClient();\n        await client.connect(\n          asSdkTransport(\n            new SSEClientTransport(url, {\n              ...options.transport,\n              fetch: createSafeMcpFetch(),\n            }),\n          ),\n        );\n        return client as McpClient;\n      },\n    };\n  },\n};\n\nfunction assertNoCustomMcpFetch(fetch: unknown): void {\n  if (fetch !== undefined) {\n    throw new Error(\n      \"Custom MCP transport fetch implementations are not allowed because they can bypass SSRF protection\",\n    );\n  }\n}\n\nfunction createSdkClient(): Client {\n  return new Client({\n    name: \"@anvia/core\",\n    version: CORE_CLIENT_VERSION,\n  });\n}\n\nfunction readCorePackageVersion(): string {\n  try {\n    const packageJson = JSON.parse(\n      readFileSync(new URL(\"../../package.json\", import.meta.url), \"utf8\"),\n    ) as { version?: unknown };\n    return typeof packageJson.version === \"string\" ? packageJson.version : \"0.0.0\";\n  } catch {\n    return \"0.0.0\";\n  }\n}\n\nfunction asSdkTransport(transport: unknown): Parameters<Client[\"connect\"]>[0] {\n  return transport as Parameters<Client[\"connect\"]>[0];\n}\n","import type { LookupAddress } from \"node:dns\";\nimport { lookup } from \"node:dns/promises\";\nimport type { LookupFunction } from \"node:net\";\nimport { BlockList, isIP } from \"node:net\";\nimport type { StreamableHTTPClientTransportOptions } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport { Agent, Pool, fetch as undiciFetch } from \"undici\";\n\ntype FetchLike = NonNullable<StreamableHTTPClientTransportOptions[\"fetch\"]>;\n\nexport type McpAddressResolver = (hostname: string) => Promise<LookupAddress[]>;\n\nconst blockedIpv4Addresses = new BlockList();\nconst blockedIpv6Addresses = new BlockList();\n\nfor (const [network, prefix] of [\n  [\"0.0.0.0\", 8],\n  [\"10.0.0.0\", 8],\n  [\"100.64.0.0\", 10],\n  [\"127.0.0.0\", 8],\n  [\"169.254.0.0\", 16],\n  [\"172.16.0.0\", 12],\n  [\"192.0.0.0\", 24],\n  [\"192.0.2.0\", 24],\n  [\"192.88.99.0\", 24],\n  [\"192.168.0.0\", 16],\n  [\"198.18.0.0\", 15],\n  [\"198.51.100.0\", 24],\n  [\"203.0.113.0\", 24],\n  [\"224.0.0.0\", 4],\n  [\"240.0.0.0\", 4],\n] as const) {\n  blockedIpv4Addresses.addSubnet(network, prefix, \"ipv4\");\n}\n\nfor (const [network, prefix] of [\n  [\"::\", 96],\n  [\"::ffff:0:0\", 96],\n  [\"64:ff9b::\", 96],\n  [\"64:ff9b:1::\", 48],\n  [\"100::\", 64],\n  [\"2001::\", 32],\n  [\"2001:2::\", 48],\n  [\"2001:10::\", 28],\n  [\"2001:20::\", 28],\n  [\"2001:db8::\", 32],\n  [\"2002::\", 16],\n  [\"fc00::\", 7],\n  [\"fe80::\", 10],\n  [\"fec0::\", 10],\n  [\"ff00::\", 8],\n] as const) {\n  blockedIpv6Addresses.addSubnet(network, prefix, \"ipv6\");\n}\n\nconst defaultAddressResolver: McpAddressResolver = (hostname) =>\n  lookup(hostname, { all: true, verbatim: true });\n\nexport function parseAndValidateMcpUrl(url: string | URL): URL {\n  let parsed: URL;\n  try {\n    parsed = new URL(url);\n  } catch {\n    throw new Error(`Invalid MCP URL: ${url}`);\n  }\n\n  if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n    throw new Error(`MCP URL blocked: only HTTP(S) URLs are allowed (${parsed.protocol})`);\n  }\n\n  validateMcpHostname(parsed.hostname);\n  return parsed;\n}\n\nexport async function resolveAndValidateMcpHostname(\n  hostname: string,\n  resolveAddresses: McpAddressResolver = defaultAddressResolver,\n): Promise<LookupAddress[]> {\n  const normalizedHostname = normalizeHostname(hostname);\n  validateMcpHostname(normalizedHostname);\n\n  const family = isIP(normalizedHostname);\n  if (family !== 0) {\n    return [{ address: normalizedHostname, family }];\n  }\n\n  let addresses: LookupAddress[];\n  try {\n    addresses = await resolveAddresses(normalizedHostname);\n  } catch (cause) {\n    throw new Error(`Unable to resolve MCP URL hostname (${normalizedHostname})`, { cause });\n  }\n\n  if (addresses.length === 0) {\n    throw new Error(`Unable to resolve MCP URL hostname (${normalizedHostname})`);\n  }\n\n  for (const { address } of addresses) {\n    validateMcpHostname(address);\n  }\n\n  return addresses;\n}\n\nexport function createSafeMcpLookup(\n  resolveAddresses: McpAddressResolver = defaultAddressResolver,\n): LookupFunction {\n  return (hostname, options, callback) => {\n    void resolveAndValidateMcpHostname(hostname, resolveAddresses).then(\n      (addresses) => {\n        const requestedFamily = normalizeRequestedFamily(options.family);\n        const matchingAddresses =\n          requestedFamily === 0\n            ? addresses\n            : addresses.filter(({ family }) => family === requestedFamily);\n\n        if (matchingAddresses.length === 0) {\n          const error = new Error(`No matching address family for MCP URL (${hostname})`);\n          Object.assign(error, { code: \"EAI_ADDRFAMILY\" });\n          callback(error, []);\n          return;\n        }\n\n        if (options.all) {\n          callback(null, matchingAddresses);\n          return;\n        }\n\n        const address = matchingAddresses[0];\n        if (!address) {\n          callback(new Error(`Unable to resolve MCP URL hostname (${hostname})`), []);\n          return;\n        }\n        callback(null, address.address, address.family);\n      },\n      (cause: unknown) => {\n        callback(asError(cause), []);\n      },\n    );\n  };\n}\n\nexport function createSafeMcpFetch(): FetchLike {\n  return (url, init) => {\n    parseAndValidateMcpUrl(url);\n    return undiciFetch(url as Parameters<typeof undiciFetch>[0], {\n      ...(init as Parameters<typeof undiciFetch>[1]),\n      dispatcher: safeMcpDispatcher,\n    }) as ReturnType<FetchLike>;\n  };\n}\n\nfunction validateMcpHostname(hostname: string): void {\n  const normalizedHostname = normalizeHostname(hostname);\n\n  if (normalizedHostname === \"localhost\" || normalizedHostname.endsWith(\".localhost\")) {\n    throw new Error(`MCP URL blocked: localhost not allowed (${normalizedHostname})`);\n  }\n\n  const family = isIP(normalizedHostname);\n  if (family === 0) {\n    return;\n  }\n\n  if (\n    (family === 4 && normalizedHostname.startsWith(\"127.\")) ||\n    (family === 6 && normalizedHostname === \"::1\")\n  ) {\n    throw new Error(`MCP URL blocked: localhost not allowed (${normalizedHostname})`);\n  }\n\n  if (normalizedHostname === \"169.254.169.254\" || normalizedHostname === \"fd00:ec2::254\") {\n    throw new Error(`MCP URL blocked: cloud metadata endpoint not allowed (${normalizedHostname})`);\n  }\n\n  if (\n    (family === 4 && blockedIpv4Addresses.check(normalizedHostname, \"ipv4\")) ||\n    (family === 6 && blockedIpv6Addresses.check(normalizedHostname, \"ipv6\"))\n  ) {\n    const range = family === 4 ? \"IP\" : \"IPv6\";\n    throw new Error(`MCP URL blocked: private ${range} range not allowed (${normalizedHostname})`);\n  }\n}\n\nfunction normalizeHostname(hostname: string): string {\n  const withoutBrackets =\n    hostname.startsWith(\"[\") && hostname.endsWith(\"]\") ? hostname.slice(1, -1) : hostname;\n  return withoutBrackets.toLowerCase().replace(/\\.+$/, \"\");\n}\n\nfunction normalizeRequestedFamily(family: number | string | undefined): 0 | 4 | 6 {\n  if (family === 4 || family === \"IPv4\") {\n    return 4;\n  }\n  if (family === 6 || family === \"IPv6\") {\n    return 6;\n  }\n  return 0;\n}\n\nfunction asError(cause: unknown): Error {\n  return cause instanceof Error ? cause : new Error(String(cause));\n}\n\nconst safeMcpDispatcher = new Agent({\n  autoSelectFamily: true,\n  connect: {\n    lookup: createSafeMcpLookup(),\n  },\n  factory(origin, options) {\n    parseAndValidateMcpUrl(origin);\n    return new Pool(origin, options as Pool.Options);\n  },\n});\n"],"mappings":";;;;;AAGO,SAAS,qBACd,MACA,MACuD;AACvD,MAAI,SAAS,QAAQ,SAAS,QAAW;AACvC,WAAO,EAAE,KAAK;AAAA,EAChB;AAEA,MAAI,CAAC,SAAS,IAAI,GAAG;AACnB,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AAEA,SAAO,EAAE,MAAM,WAAW,KAAK;AACjC;AAEO,SAAS,iBAAiB,QAAmC;AAClE,MAAI,gBAAgB,QAAQ;AAC1B,WAAO,kBAAkB,OAAO,UAAU;AAAA,EAC5C;AAEA,MAAI,OAAO,YAAY,MAAM;AAC3B,UAAM,IAAI,MAAM,gBAAgB,OAAO,OAAO,CAAC;AAAA,EACjD;AAEA,SAAO,OAAO,QAAQ,IAAI,aAAa,EAAE,KAAK,EAAE;AAClD;AAEA,SAAS,gBAAgB,SAAuC;AAC9D,QAAM,OAAO,QACV,IAAI,CAAC,SAAU,KAAK,SAAS,SAAS,KAAK,OAAO,MAAU,EAC5D,OAAO,CAAC,SAAyB,SAAS,MAAS,EACnD,KAAK,IAAI;AAEZ,SAAO,SAAS,KAAK,+BAA+B;AACtD;AAEA,SAAS,cAAc,SAAqC;AAC1D,MAAI,QAAQ,SAAS,QAAQ;AAC3B,WAAO,QAAQ;AAAA,EACjB;AAEA,MAAI,QAAQ,SAAS,SAAS;AAC5B,WAAO,QAAQ,QAAQ,QAAQ,WAAW,QAAQ,IAAI;AAAA,EACxD;AAEA,MAAI,QAAQ,SAAS,YAAY;AAC/B,UAAM,WACJ,QAAQ,SAAS,aAAa,SAAY,KAAK,QAAQ,QAAQ,SAAS,QAAQ;AAClF,QAAI,UAAU,QAAQ,UAAU;AAC9B,aAAO,GAAG,QAAQ,GAAG,QAAQ,SAAS,GAAG,IAAI,QAAQ,SAAS,IAAI;AAAA,IACpE;AAEA,WAAO,GAAG,QAAQ,GAAG,QAAQ,SAAS,GAAG,IAAI,QAAQ,SAAS,IAAI;AAAA,EACpE;AAEA,QAAM,IAAI,MAAM,wCAAwC,kBAAkB,OAAO,CAAC,EAAE;AACtF;AAEA,SAAS,kBAAkB,OAAwB;AACjD,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO;AAAA,EACT;AAEA,QAAM,aAAa,KAAK,UAAU,KAAK;AACvC,SAAO,eAAe,SAAY,OAAO,KAAK,IAAI;AACpD;;;AC/DA,IAAM,wBAAwB,uBAAO,IAAI,yBAAyB;AAE3D,SAAS,cACd,YACA,QACA,YACM;AACN,QAAM,OAAa;AAAA,IACjB,MAAM,WAAW;AAAA,IACjB,aAA6B;AAC3B,aAAO;AAAA,QACL,MAAM,WAAW;AAAA,QACjB,aAAa,WAAW,eAAe;AAAA,QACvC,YAAY,WAAW;AAAA,MACzB;AAAA,IACF;AAAA,IACA,MAAM,KAAK,MAAuB;AAChC,YAAM,SAAS,MAAM,OAAO,SAAS,qBAAqB,WAAW,MAAM,IAAI,CAAC;AAChF,aAAO,iBAAiB,MAAM;AAAA,IAChC;AAAA,EACF;AACA,MAAI,eAAe,QAAW;AAC5B,WAAO,eAAe,MAAM,uBAAuB;AAAA,MACjD,OAAO,EAAE,WAAW;AAAA,MACpB,YAAY;AAAA,IACd,CAAC;AAAA,EACH;AACA,SAAO;AACT;;;AC9BA,eAAsB,WAAW,YAA+C;AAC9E,QAAM,SAAS,MAAM,WAAW,QAAQ;AACxC,MAAI;AACJ,MAAI;AACF,KAAC,EAAE,MAAM,IAAI,MAAM,OAAO,UAAU;AAAA,EACtC,SAAS,OAAO;AACd,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,IACrB,QAAQ;AAAA,IAER;AACA,UAAM;AAAA,EACR;AAEA,SAAO;AAAA,IACL,MAAM,WAAW;AAAA,IACjB,OAAO,MAAM,IAAI,CAAC,SAAS,cAAc,MAAM,QAAQ,WAAW,IAAI,CAAC;AAAA,IACvE,OAAO,MAAM,OAAO,MAAM;AAAA,EAC5B;AACF;;;ACtBA,SAAS,oBAAoB;AAC7B,SAAS,cAAc;AACvB,SAAS,0BAA0B;AACnC,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;;;ACH9C,SAAS,cAAc;AAEvB,SAAS,WAAW,YAAY;AAEhC,SAAS,OAAO,MAAM,SAAS,mBAAmB;AAMlD,IAAM,uBAAuB,IAAI,UAAU;AAC3C,IAAM,uBAAuB,IAAI,UAAU;AAE3C,WAAW,CAAC,SAAS,MAAM,KAAK;AAAA,EAC9B,CAAC,WAAW,CAAC;AAAA,EACb,CAAC,YAAY,CAAC;AAAA,EACd,CAAC,cAAc,EAAE;AAAA,EACjB,CAAC,aAAa,CAAC;AAAA,EACf,CAAC,eAAe,EAAE;AAAA,EAClB,CAAC,cAAc,EAAE;AAAA,EACjB,CAAC,aAAa,EAAE;AAAA,EAChB,CAAC,aAAa,EAAE;AAAA,EAChB,CAAC,eAAe,EAAE;AAAA,EAClB,CAAC,eAAe,EAAE;AAAA,EAClB,CAAC,cAAc,EAAE;AAAA,EACjB,CAAC,gBAAgB,EAAE;AAAA,EACnB,CAAC,eAAe,EAAE;AAAA,EAClB,CAAC,aAAa,CAAC;AAAA,EACf,CAAC,aAAa,CAAC;AACjB,GAAY;AACV,uBAAqB,UAAU,SAAS,QAAQ,MAAM;AACxD;AAEA,WAAW,CAAC,SAAS,MAAM,KAAK;AAAA,EAC9B,CAAC,MAAM,EAAE;AAAA,EACT,CAAC,cAAc,EAAE;AAAA,EACjB,CAAC,aAAa,EAAE;AAAA,EAChB,CAAC,eAAe,EAAE;AAAA,EAClB,CAAC,SAAS,EAAE;AAAA,EACZ,CAAC,UAAU,EAAE;AAAA,EACb,CAAC,YAAY,EAAE;AAAA,EACf,CAAC,aAAa,EAAE;AAAA,EAChB,CAAC,aAAa,EAAE;AAAA,EAChB,CAAC,cAAc,EAAE;AAAA,EACjB,CAAC,UAAU,EAAE;AAAA,EACb,CAAC,UAAU,CAAC;AAAA,EACZ,CAAC,UAAU,EAAE;AAAA,EACb,CAAC,UAAU,EAAE;AAAA,EACb,CAAC,UAAU,CAAC;AACd,GAAY;AACV,uBAAqB,UAAU,SAAS,QAAQ,MAAM;AACxD;AAEA,IAAM,yBAA6C,CAAC,aAClD,OAAO,UAAU,EAAE,KAAK,MAAM,UAAU,KAAK,CAAC;AAEzC,SAAS,uBAAuB,KAAwB;AAC7D,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,GAAG;AAAA,EACtB,QAAQ;AACN,UAAM,IAAI,MAAM,oBAAoB,GAAG,EAAE;AAAA,EAC3C;AAEA,MAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU;AAC/D,UAAM,IAAI,MAAM,mDAAmD,OAAO,QAAQ,GAAG;AAAA,EACvF;AAEA,sBAAoB,OAAO,QAAQ;AACnC,SAAO;AACT;AAEA,eAAsB,8BACpB,UACA,mBAAuC,wBACb;AAC1B,QAAM,qBAAqB,kBAAkB,QAAQ;AACrD,sBAAoB,kBAAkB;AAEtC,QAAM,SAAS,KAAK,kBAAkB;AACtC,MAAI,WAAW,GAAG;AAChB,WAAO,CAAC,EAAE,SAAS,oBAAoB,OAAO,CAAC;AAAA,EACjD;AAEA,MAAI;AACJ,MAAI;AACF,gBAAY,MAAM,iBAAiB,kBAAkB;AAAA,EACvD,SAAS,OAAO;AACd,UAAM,IAAI,MAAM,uCAAuC,kBAAkB,KAAK,EAAE,MAAM,CAAC;AAAA,EACzF;AAEA,MAAI,UAAU,WAAW,GAAG;AAC1B,UAAM,IAAI,MAAM,uCAAuC,kBAAkB,GAAG;AAAA,EAC9E;AAEA,aAAW,EAAE,QAAQ,KAAK,WAAW;AACnC,wBAAoB,OAAO;AAAA,EAC7B;AAEA,SAAO;AACT;AAEO,SAAS,oBACd,mBAAuC,wBACvB;AAChB,SAAO,CAAC,UAAU,SAAS,aAAa;AACtC,SAAK,8BAA8B,UAAU,gBAAgB,EAAE;AAAA,MAC7D,CAAC,cAAc;AACb,cAAM,kBAAkB,yBAAyB,QAAQ,MAAM;AAC/D,cAAM,oBACJ,oBAAoB,IAChB,YACA,UAAU,OAAO,CAAC,EAAE,OAAO,MAAM,WAAW,eAAe;AAEjE,YAAI,kBAAkB,WAAW,GAAG;AAClC,gBAAM,QAAQ,IAAI,MAAM,2CAA2C,QAAQ,GAAG;AAC9E,iBAAO,OAAO,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,mBAAS,OAAO,CAAC,CAAC;AAClB;AAAA,QACF;AAEA,YAAI,QAAQ,KAAK;AACf,mBAAS,MAAM,iBAAiB;AAChC;AAAA,QACF;AAEA,cAAM,UAAU,kBAAkB,CAAC;AACnC,YAAI,CAAC,SAAS;AACZ,mBAAS,IAAI,MAAM,uCAAuC,QAAQ,GAAG,GAAG,CAAC,CAAC;AAC1E;AAAA,QACF;AACA,iBAAS,MAAM,QAAQ,SAAS,QAAQ,MAAM;AAAA,MAChD;AAAA,MACA,CAAC,UAAmB;AAClB,iBAAS,QAAQ,KAAK,GAAG,CAAC,CAAC;AAAA,MAC7B;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,qBAAgC;AAC9C,SAAO,CAAC,KAAK,SAAS;AACpB,2BAAuB,GAAG;AAC1B,WAAO,YAAY,KAA0C;AAAA,MAC3D,GAAI;AAAA,MACJ,YAAY;AAAA,IACd,CAAC;AAAA,EACH;AACF;AAEA,SAAS,oBAAoB,UAAwB;AACnD,QAAM,qBAAqB,kBAAkB,QAAQ;AAErD,MAAI,uBAAuB,eAAe,mBAAmB,SAAS,YAAY,GAAG;AACnF,UAAM,IAAI,MAAM,2CAA2C,kBAAkB,GAAG;AAAA,EAClF;AAEA,QAAM,SAAS,KAAK,kBAAkB;AACtC,MAAI,WAAW,GAAG;AAChB;AAAA,EACF;AAEA,MACG,WAAW,KAAK,mBAAmB,WAAW,MAAM,KACpD,WAAW,KAAK,uBAAuB,OACxC;AACA,UAAM,IAAI,MAAM,2CAA2C,kBAAkB,GAAG;AAAA,EAClF;AAEA,MAAI,uBAAuB,qBAAqB,uBAAuB,iBAAiB;AACtF,UAAM,IAAI,MAAM,yDAAyD,kBAAkB,GAAG;AAAA,EAChG;AAEA,MACG,WAAW,KAAK,qBAAqB,MAAM,oBAAoB,MAAM,KACrE,WAAW,KAAK,qBAAqB,MAAM,oBAAoB,MAAM,GACtE;AACA,UAAM,QAAQ,WAAW,IAAI,OAAO;AACpC,UAAM,IAAI,MAAM,4BAA4B,KAAK,uBAAuB,kBAAkB,GAAG;AAAA,EAC/F;AACF;AAEA,SAAS,kBAAkB,UAA0B;AACnD,QAAM,kBACJ,SAAS,WAAW,GAAG,KAAK,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;AAC/E,SAAO,gBAAgB,YAAY,EAAE,QAAQ,QAAQ,EAAE;AACzD;AAEA,SAAS,yBAAyB,QAAgD;AAChF,MAAI,WAAW,KAAK,WAAW,QAAQ;AACrC,WAAO;AAAA,EACT;AACA,MAAI,WAAW,KAAK,WAAW,QAAQ;AACrC,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,QAAQ,OAAuB;AACtC,SAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AACjE;AAEA,IAAM,oBAAoB,IAAI,MAAM;AAAA,EAClC,kBAAkB;AAAA,EAClB,SAAS;AAAA,IACP,QAAQ,oBAAoB;AAAA,EAC9B;AAAA,EACA,QAAQ,QAAQ,SAAS;AACvB,2BAAuB,MAAM;AAC7B,WAAO,IAAI,KAAK,QAAQ,OAAuB;AAAA,EACjD;AACF,CAAC;;;ADtMD,IAAM,sBAAsB,uBAAuB;AAE5C,IAAM,MAAM;AAAA,EACjB,MAAM,SAAyC;AAC7C,WAAO;AAAA,MACL,MAAM,QAAQ;AAAA,MACd,MAAM,UAA8B;AAClC,cAAM,EAAE,MAAM,OAAO,GAAG,OAAO,IAAI;AACnC,cAAM,SAAS,gBAAgB;AAC/B,cAAM,OAAO,QAAQ,eAAe,IAAI,qBAAqB,MAAM,CAAC,CAAC;AACrE,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA,EAEA,KAAK,SAAwC;AAC3C,WAAO;AAAA,MACL,MAAM,QAAQ;AAAA,MACd,MAAM,UAA8B;AAClC,+BAAuB,QAAQ,WAAW,KAAK;AAC/C,cAAM,MAAM,uBAAuB,QAAQ,GAAG;AAC9C,cAAM,SAAS,gBAAgB;AAC/B,cAAM,OAAO;AAAA,UACX;AAAA,YACE,IAAI,8BAA8B,KAAK;AAAA,cACrC,GAAG,QAAQ;AAAA,cACX,OAAO,mBAAmB;AAAA,YAC5B,CAAC;AAAA,UACH;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAAA,EAEA,IAAI,SAAuC;AACzC,WAAO;AAAA,MACL,MAAM,QAAQ;AAAA,MACd,MAAM,UAA8B;AAClC,+BAAuB,QAAQ,WAAW,KAAK;AAC/C,cAAM,MAAM,uBAAuB,QAAQ,GAAG;AAC9C,cAAM,SAAS,gBAAgB;AAC/B,cAAM,OAAO;AAAA,UACX;AAAA,YACE,IAAI,mBAAmB,KAAK;AAAA,cAC1B,GAAG,QAAQ;AAAA,cACX,OAAO,mBAAmB;AAAA,YAC5B,CAAC;AAAA,UACH;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,uBAAuB,OAAsB;AACpD,MAAI,UAAU,QAAW;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,kBAA0B;AACjC,SAAO,IAAI,OAAO;AAAA,IAChB,MAAM;AAAA,IACN,SAAS;AAAA,EACX,CAAC;AACH;AAEA,SAAS,yBAAiC;AACxC,MAAI;AACF,UAAM,cAAc,KAAK;AAAA,MACvB,aAAa,IAAI,IAAI,sBAAsB,YAAY,GAAG,GAAG,MAAM;AAAA,IACrE;AACA,WAAO,OAAO,YAAY,YAAY,WAAW,YAAY,UAAU;AAAA,EACzE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,eAAe,WAAsD;AAC5E,SAAO;AACT;","names":[]}

package/dist/request/index.js

@@ -3,18 +3,18 @@ import {
   PromptCancelledError,
   PromptRequest,
   ToolApprovalRequiredError
-} from "../chunk-VXONXP2G.js";
+} from "../chunk-BALBBVI3.js";
 import "../chunk-XUUY2L2D.js";
-import "../chunk-2NDQHV7V.js";
-import "../chunk-4BGN6PYF.js";
+import "../chunk-HYUYZEAJ.js";
+import "../chunk-MELYDKWQ.js";
 import "../chunk-2ODTMRHP.js";
 import "../chunk-MRQLEK2B.js";
+import "../chunk-MNWK2USR.js";
+import "../chunk-OIMLU4SF.js";
 import "../chunk-Q25IWLBT.js";
 import "../chunk-MC3CCKEB.js";
 import "../chunk-ADH7NNCS.js";
 import "../chunk-WQKHFADH.js";
-import "../chunk-MNWK2USR.js";
-import "../chunk-OIMLU4SF.js";
 import "../chunk-CWUJUSOS.js";
 export {
   MaxTurnsError,

package/dist/skills/index.js

@@ -2,15 +2,15 @@ import {
   SkillValidationError,
   loadSkills,
   skill
-} from "../chunk-BCA4VZ5W.js";
+} from "../chunk-NCPN4SJR.js";
 import "../chunk-CQNNSZPG.js";
 import "../chunk-YK4WAAS4.js";
-import "../chunk-2NDQHV7V.js";
-import "../chunk-4BGN6PYF.js";
-import "../chunk-ADH7NNCS.js";
-import "../chunk-WQKHFADH.js";
+import "../chunk-HYUYZEAJ.js";
+import "../chunk-MELYDKWQ.js";
 import "../chunk-MNWK2USR.js";
 import "../chunk-OIMLU4SF.js";
+import "../chunk-ADH7NNCS.js";
+import "../chunk-WQKHFADH.js";
 export {
   SkillValidationError,
   loadSkills,

package/dist/tool/index.js

@@ -12,17 +12,17 @@ import {
   normalizeToolResultOutput,
   parseToolArgs,
   toolResultContentToText
-} from "../chunk-2NDQHV7V.js";
+} from "../chunk-HYUYZEAJ.js";
 import {
   createTool
-} from "../chunk-4BGN6PYF.js";
+} from "../chunk-MELYDKWQ.js";
+import "../chunk-MNWK2USR.js";
+import "../chunk-OIMLU4SF.js";
 import {
   isToolResultContentArray,
   serializeToolResultOutput
 } from "../chunk-ADH7NNCS.js";
 import "../chunk-WQKHFADH.js";
-import "../chunk-MNWK2USR.js";
-import "../chunk-OIMLU4SF.js";
 export {
   ToolCallError,
   ToolJsonError,

package/dist/vector-store/index.js

@@ -3,10 +3,10 @@ import {
   InMemoryVectorStore,
   createVectorSearchTool,
   vectorFilter
-} from "../chunk-4BGN6PYF.js";
-import "../chunk-WQKHFADH.js";
+} from "../chunk-MELYDKWQ.js";
 import "../chunk-MNWK2USR.js";
 import "../chunk-OIMLU4SF.js";
+import "../chunk-WQKHFADH.js";
 export {
   InMemoryVectorIndex,
   InMemoryVectorStore,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anvia/core",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "description": "Core runtime primitives for context-aware Anvia agents.",
   "author": "anvia",
   "maintainer": "Indra Zulfi",
@@ -118,9 +118,10 @@
     }
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0",
-    "pdfjs-dist": "^6.1.200",
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "pdfjs-dist": "^6.2.108",
     "tinyglobby": "^0.2.17",
+    "undici": "^6.25.0",
     "yaml": "^2.9.0",
     "zod": "^4.4.3"
   },