@elizaos/core 2.0.0-alpha.21 → 2.0.0-alpha.22

package/dist/media/fetch.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Media fetching utilities with SSRF protection.
+ *
+ * Provides secure remote media fetching with:
+ * - SSRF protection via DNS pinning
+ * - Content-Disposition parsing
+ * - Size limits
+ * - MIME type detection
+ */
+import { type LookupFn, type SsrfPolicy } from "../network/index.js";
+export type FetchMediaResult = {
+    buffer: Buffer;
+    contentType?: string;
+    fileName?: string;
+};
+export type MediaFetchErrorCode = "max_bytes" | "http_error" | "fetch_failed";
+export declare class MediaFetchError extends Error {
+    readonly code: MediaFetchErrorCode;
+    constructor(code: MediaFetchErrorCode, message: string);
+}
+export type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+export type FetchMediaOptions = {
+    url: string;
+    fetchImpl?: FetchLike;
+    filePathHint?: string;
+    maxBytes?: number;
+    maxRedirects?: number;
+    ssrfPolicy?: SsrfPolicy;
+    lookupFn?: LookupFn;
+};
+/**
+ * Fetch remote media with SSRF protection.
+ *
+ * @param options - Fetch options
+ * @returns Promise resolving to buffer, content type, and filename
+ * @throws MediaFetchError on fetch failures
+ */
+export declare function fetchRemoteMedia(options: FetchMediaOptions): Promise<FetchMediaResult>;
+//# sourceMappingURL=fetch.d.ts.map

package/dist/media/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/media/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAEN,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,MAAM,qBAAqB,CAAC;AAG7B,MAAM,MAAM,gBAAgB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,YAAY,GAAG,cAAc,CAAC;AAE9E,qBAAa,eAAgB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;gBAEvB,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM;CAKtD;AAED,MAAM,MAAM,SAAS,GAAG,CACvB,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,CAAC,EAAE,WAAW,KACd,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB,MAAM,MAAM,iBAAiB,GAAG;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACpB,CAAC;AAmDF;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACrC,OAAO,EAAE,iBAAiB,GACxB,OAAO,CAAC,gBAAgB,CAAC,CA4G3B"}

package/dist/media/image-ops.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Image processing utilities for Eliza.
+ *
+ * Provides image resizing, format conversion, and EXIF handling.
+ * Supports both Sharp and macOS sips for Bun compatibility.
+ */
+export type ImageMetadata = {
+    width: number;
+    height: number;
+};
+/**
+ * Get image dimensions from a buffer.
+ */
+export declare function getImageMetadata(buffer: Buffer): Promise<ImageMetadata | null>;
+/**
+ * Normalizes EXIF orientation in an image buffer.
+ * Returns the buffer with correct pixel orientation (rotated if needed).
+ */
+export declare function normalizeExifOrientation(buffer: Buffer): Promise<Buffer>;
+/**
+ * Resize an image to JPEG format.
+ */
+export declare function resizeToJpeg(params: {
+    buffer: Buffer;
+    maxSide: number;
+    quality: number;
+    withoutEnlargement?: boolean;
+}): Promise<Buffer>;
+/**
+ * Convert HEIC/HEIF image to JPEG.
+ */
+export declare function convertHeicToJpeg(buffer: Buffer): Promise<Buffer>;
+/**
+ * Check if an image has an alpha channel (transparency).
+ */
+export declare function hasAlphaChannel(buffer: Buffer): Promise<boolean>;
+/**
+ * Resize an image to PNG format, preserving alpha channel.
+ */
+export declare function resizeToPng(params: {
+    buffer: Buffer;
+    maxSide: number;
+    compressionLevel?: number;
+    withoutEnlargement?: boolean;
+}): Promise<Buffer>;
+/**
+ * Optimize an image to PNG format within a size limit.
+ */
+export declare function optimizeImageToPng(buffer: Buffer, maxBytes: number): Promise<{
+    buffer: Buffer;
+    optimizedSize: number;
+    resizeSide: number;
+    compressionLevel: number;
+}>;
+//# sourceMappingURL=image-ops.d.ts.map

package/dist/media/image-ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image-ops.d.ts","sourceRoot":"","sources":["../../src/media/image-ops.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,MAAM,MAAM,aAAa,GAAG;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CACf,CAAC;AA+PF;;GAEG;AACH,wBAAsB,gBAAgB,CACrC,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAoB/B;AAgDD;;;GAGG;AACH,wBAAsB,wBAAwB,CAC7C,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAmBjB;AAiBD;;GAEG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC7B,GAAG,OAAO,CAAC,MAAM,CAAC,CAmClB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMvE;AAED;;GAEG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQtE;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC7B,GAAG,OAAO,CAAC,MAAM,CAAC,CAclB;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CACvC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC;IACV,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;CACzB,CAAC,CA+CD"}

package/dist/media/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Media utilities for Eliza.
+ *
+ * Provides MIME type detection, media parsing, fetching, and format utilities.
+ */
+export { type FetchLike, type FetchMediaOptions, type FetchMediaResult, fetchRemoteMedia, MediaFetchError, type MediaFetchErrorCode, } from "./fetch.js";
+export { convertHeicToJpeg, getImageMetadata, hasAlphaChannel, type ImageMetadata, normalizeExifOrientation, optimizeImageToPng, resizeToJpeg, resizeToPng, } from "./image-ops.js";
+export { detectMime, extensionForMime, getFileExtension, imageMimeFromFormat, isAudioFileName, isGifMedia, isVoiceCompatibleAudio, type MediaKind, mediaKindFromMime, } from "./mime.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/media/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/media/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACN,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,gBAAgB,EAChB,eAAe,EACf,KAAK,mBAAmB,GACxB,MAAM,YAAY,CAAC;AACpB,OAAO,EACN,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,EACf,KAAK,aAAa,EAClB,wBAAwB,EACxB,kBAAkB,EAClB,YAAY,EACZ,WAAW,GACX,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,eAAe,EACf,UAAU,EACV,sBAAsB,EACtB,KAAK,SAAS,EACd,iBAAiB,GACjB,MAAM,WAAW,CAAC"}

package/dist/media/mime.d.ts

@@ -0,0 +1,51 @@
+/**
+ * MIME type detection and media utilities for Eliza.
+ *
+ * Provides robust MIME type detection from file buffers, headers, and extensions.
+ */
+/** Media kind categories */
+export type MediaKind = "image" | "audio" | "video" | "document" | "unknown";
+/**
+ * Get the file extension from a path or URL.
+ */
+export declare function getFileExtension(filePath?: string | null): string | undefined;
+/**
+ * Detect MIME type from buffer, headers, and/or file path.
+ * Prioritizes sniffed types over extension-based detection.
+ */
+export declare function detectMime(opts: {
+    buffer?: Buffer | Uint8Array;
+    headerMime?: string | null;
+    filePath?: string;
+}): Promise<string | undefined>;
+/**
+ * Get the file extension for a MIME type.
+ */
+export declare function extensionForMime(mime?: string | null): string | undefined;
+/**
+ * Check if a file appears to be an audio file by extension.
+ */
+export declare function isAudioFileName(fileName?: string | null): boolean;
+/**
+ * Check if media is a GIF.
+ */
+export declare function isGifMedia(opts: {
+    contentType?: string | null;
+    fileName?: string | null;
+}): boolean;
+/**
+ * Check if audio is voice-compatible (Opus/Ogg format).
+ */
+export declare function isVoiceCompatibleAudio(opts: {
+    contentType?: string | null;
+    fileName?: string | null;
+}): boolean;
+/**
+ * Get media kind from MIME type.
+ */
+export declare function mediaKindFromMime(mime?: string | null): MediaKind;
+/**
+ * Get image MIME type from format name.
+ */
+export declare function imageMimeFromFormat(format?: string | null): string | undefined;
+//# sourceMappingURL=mime.d.ts.map

package/dist/media/mime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mime.d.ts","sourceRoot":"","sources":["../../src/media/mime.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAwBH,4BAA4B;AAC5B,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;AAqF7E;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAc7E;AAWD;;;GAGG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE;IACtC,MAAM,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiB9B;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAGzE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAGjE;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,GAAG,OAAO,CAGV;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC5C,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,GAAG,OAAO,CAKV;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAgBjE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAClC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,MAAM,GAAG,SAAS,CAmBpB"}

package/dist/memory.d.ts

@@ -0,0 +1,40 @@
+import { type Content, type CustomMetadata, type DescriptionMetadata, type DocumentMetadata, type FragmentMetadata, type Memory, type MemoryMetadata, type MessageMemory, type MessageMetadata, type UUID } from "./types";
+export declare function createMessageMemory(params: {
+    id?: UUID;
+    entityId: UUID;
+    agentId?: UUID;
+    roomId: UUID;
+    content: Content & {
+        text: string;
+    };
+    embedding?: number[];
+}): MessageMemory;
+export declare function isDocumentMetadata(metadata: MemoryMetadata): metadata is DocumentMetadata;
+/**
+ * Type guard to check if a memory metadata is a FragmentMetadata
+ * @param metadata The metadata to check
+ * @returns True if the metadata is a FragmentMetadata
+ */
+export declare function isFragmentMetadata(metadata: MemoryMetadata): metadata is FragmentMetadata;
+export declare function isMessageMetadata(metadata: MemoryMetadata): metadata is MessageMetadata;
+/**
+ * Type guard to check if a memory metadata is a DescriptionMetadata
+ * @param metadata The metadata to check
+ * @returns True if the metadata is a DescriptionMetadata
+ */
+export declare function isDescriptionMetadata(metadata: MemoryMetadata): metadata is DescriptionMetadata;
+export declare function isCustomMetadata(metadata: MemoryMetadata): metadata is CustomMetadata;
+/**
+ * Memory type guard for document memories
+ */
+export declare function isDocumentMemory(memory: Memory): memory is Memory & {
+    metadata: DocumentMetadata;
+};
+/**
+ * Memory type guard for fragment memories
+ */
+export declare function isFragmentMemory(memory: Memory): memory is Memory & {
+    metadata: FragmentMetadata;
+};
+export declare function getMemoryText(memory: Memory, defaultValue?: string): string;
+//# sourceMappingURL=memory.d.ts.map

package/dist/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../src/memory.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,OAAO,EACZ,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,MAAM,EACX,KAAK,cAAc,EAEnB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,IAAI,EACT,MAAM,SAAS,CAAC;AAEjB,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAC3C,EAAE,CAAC,EAAE,IAAI,CAAC;IACV,QAAQ,EAAE,IAAI,CAAC;IACf,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,MAAM,EAAE,IAAI,CAAC;IACb,OAAO,EAAE,OAAO,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB,GAAG,aAAa,CAWhB;AAED,wBAAgB,kBAAkB,CACjC,QAAQ,EAAE,cAAc,GACtB,QAAQ,IAAI,gBAAgB,CAE9B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CACjC,QAAQ,EAAE,cAAc,GACtB,QAAQ,IAAI,gBAAgB,CAE9B;AAED,wBAAgB,iBAAiB,CAChC,QAAQ,EAAE,cAAc,GACtB,QAAQ,IAAI,eAAe,CAE7B;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACpC,QAAQ,EAAE,cAAc,GACtB,QAAQ,IAAI,mBAAmB,CAEjC;AAED,wBAAgB,gBAAgB,CAC/B,QAAQ,EAAE,cAAc,GACtB,QAAQ,IAAI,cAAc,CAO5B;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,MAAM,GACZ,MAAM,IAAI,MAAM,GAAG;IAAE,QAAQ,EAAE,gBAAgB,CAAA;CAAE,CAKnD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC/B,MAAM,EAAE,MAAM,GACZ,MAAM,IAAI,MAAM,GAAG;IAAE,QAAQ,EAAE,gBAAgB,CAAA;CAAE,CAKnD;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,SAAK,GAAG,MAAM,CAEvE"}

package/dist/network/fetch-guard.d.ts

@@ -0,0 +1,34 @@
+/**
+ * SSRF-guarded fetch utilities.
+ *
+ * Provides a fetch wrapper that validates URLs and pins DNS to prevent
+ * SSRF attacks and DNS rebinding.
+ */
+import { type LookupFn, type SsrfPolicy } from "./ssrf.js";
+type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+export type GuardedFetchOptions = {
+    url: string;
+    fetchImpl?: FetchLike;
+    init?: RequestInit;
+    maxRedirects?: number;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    policy?: SsrfPolicy;
+    lookupFn?: LookupFn;
+};
+export type GuardedFetchResult = {
+    response: Response;
+    finalUrl: string;
+    release: () => Promise<void>;
+};
+/**
+ * Fetch with SSRF protection.
+ *
+ * - Validates URL protocol (http/https only)
+ * - Resolves and pins DNS to prevent rebinding attacks
+ * - Follows redirects manually with validation
+ * - Supports timeout and abort signals
+ */
+export declare function fetchWithSsrfGuard(params: GuardedFetchOptions): Promise<GuardedFetchResult>;
+export {};
+//# sourceMappingURL=fetch-guard.d.ts.map

package/dist/network/fetch-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-guard.d.ts","sourceRoot":"","sources":["../../src/network/fetch-guard.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACN,KAAK,QAAQ,EAGb,KAAK,UAAU,EACf,MAAM,WAAW,CAAC;AAEnB,KAAK,SAAS,GAAG,CAChB,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,CAAC,EAAE,WAAW,KACd,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB,MAAM,MAAM,mBAAmB,GAAG;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAChC,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B,CAAC;AAmDF;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACvC,MAAM,EAAE,mBAAmB,GACzB,OAAO,CAAC,kBAAkB,CAAC,CAkG7B"}

package/dist/network/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Network utilities for Eliza.
+ *
+ * Provides SSRF protection and secure fetch utilities.
+ *
+ * Note: The dispatcher utilities (undici-based DNS pinning) are Node-specific
+ * and should be imported directly from "./network/dispatcher.js" when needed.
+ */
+export { fetchWithSsrfGuard, type GuardedFetchOptions, type GuardedFetchResult, } from "./fetch-guard.js";
+export { assertPublicHostname, createPinnedLookup, isBlockedHostname, isPrivateIpAddress, type LookupFn, type PinnedHostname, resolvePinnedHostname, resolvePinnedHostnameWithPolicy, SsrfBlockedError, type SsrfPolicy, } from "./ssrf.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/network/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/network/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACN,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,GACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACN,oBAAoB,EACpB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,QAAQ,EACb,KAAK,cAAc,EACnB,qBAAqB,EACrB,+BAA+B,EAC/B,gBAAgB,EAChB,KAAK,UAAU,GACf,MAAM,WAAW,CAAC"}

package/dist/network/sandbox-fetch-proxy.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Sandbox fetch proxy. Detokenizes outbound requests, sanitizes inbound responses.
+ */
+import { type SandboxTokenManager } from "../security/sandbox-token-manager.js";
+export interface SandboxFetchProxyOptions {
+    /** The token manager holding token↔secret mappings. */
+    tokenManager: SandboxTokenManager;
+    /** Base fetch to delegate to after detokenization. Defaults to globalThis.fetch. */
+    baseFetch?: typeof fetch;
+    onAuditEvent?: (event: SandboxFetchAuditEvent) => void;
+    /** "fail-closed" = throw on error; "fail-open" = proceed without replacement. */
+    failureMode?: "fail-closed" | "fail-open";
+    /** Max response body size to scan (default 10MB). */
+    maxResponseScanBytes?: number;
+}
+export interface SandboxFetchAuditEvent {
+    timestamp: number;
+    direction: "outbound" | "inbound";
+    url: string;
+    replacementCount: number;
+    tokenIds: string[];
+    error?: string;
+}
+export declare function createSandboxFetchProxy(options: SandboxFetchProxyOptions): typeof fetch;
+//# sourceMappingURL=sandbox-fetch-proxy.d.ts.map

package/dist/network/sandbox-fetch-proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-fetch-proxy.d.ts","sourceRoot":"","sources":["../../src/network/sandbox-fetch-proxy.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,sCAAsC,CAAC;AAI9C,MAAM,WAAW,wBAAwB;IACvC,uDAAuD;IACvD,YAAY,EAAE,mBAAmB,CAAC;IAElC,oFAAoF;IACpF,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IAEzB,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,IAAI,CAAC;IACvD,iFAAiF;IACjF,WAAW,CAAC,EAAE,aAAa,GAAG,WAAW,CAAC;IAC1C,qDAAqD;IACrD,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,UAAU,GAAG,SAAS,CAAC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA4BD,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,KAAK,CA0Ed"}

package/dist/network/ssrf.d.ts

@@ -0,0 +1,53 @@
+/**
+ * SSRF (Server-Side Request Forgery) protection utilities.
+ *
+ * Provides DNS pinning and IP address validation to prevent SSRF attacks
+ * when fetching external resources.
+ */
+import { lookup as dnsLookupCb } from "node:dns";
+import { lookup as dnsLookup } from "node:dns/promises";
+export declare class SsrfBlockedError extends Error {
+    constructor(message: string);
+}
+export type LookupFn = typeof dnsLookup;
+export type SsrfPolicy = {
+    allowPrivateNetwork?: boolean;
+    allowedHostnames?: string[];
+};
+/**
+ * Check if an IP address is private/internal.
+ */
+export declare function isPrivateIpAddress(address: string): boolean;
+/**
+ * Check if a hostname should be blocked (localhost, internal domains).
+ */
+export declare function isBlockedHostname(hostname: string): boolean;
+/**
+ * Create a DNS lookup function that pins to specific resolved addresses.
+ */
+export declare function createPinnedLookup(params: {
+    hostname: string;
+    addresses: string[];
+    fallback?: typeof dnsLookupCb;
+}): typeof dnsLookupCb;
+export type PinnedHostname = {
+    hostname: string;
+    addresses: string[];
+    lookup: typeof dnsLookupCb;
+};
+/**
+ * Resolve a hostname with SSRF policy enforcement.
+ */
+export declare function resolvePinnedHostnameWithPolicy(hostname: string, params?: {
+    lookupFn?: LookupFn;
+    policy?: SsrfPolicy;
+}): Promise<PinnedHostname>;
+/**
+ * Resolve a hostname and pin DNS to prevent TOCTOU attacks.
+ */
+export declare function resolvePinnedHostname(hostname: string, lookupFn?: LookupFn): Promise<PinnedHostname>;
+/**
+ * Assert that a hostname resolves to a public IP address.
+ */
+export declare function assertPublicHostname(hostname: string, lookupFn?: LookupFn): Promise<void>;
+//# sourceMappingURL=ssrf.d.ts.map

package/dist/network/ssrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssrf.d.ts","sourceRoot":"","sources":["../../src/network/ssrf.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,IAAI,WAAW,EAAsB,MAAM,UAAU,CAAC;AACrE,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAQxD,qBAAa,gBAAiB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI3B;AAED,MAAM,MAAM,QAAQ,GAAG,OAAO,SAAS,CAAC;AAExC,MAAM,MAAM,UAAU,GAAG;IACxB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAuGF;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CA+B3D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAa3D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,WAAW,CAAC;CAC9B,GAAG,OAAO,WAAW,CAyDrB;AAED,MAAM,MAAM,cAAc,GAAG;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,OAAO,WAAW,CAAC;CAC3B,CAAC;AAEF;;GAEG;AACH,wBAAsB,+BAA+B,CACpD,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE;IAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAAC,MAAM,CAAC,EAAE,UAAU,CAAA;CAAO,GACvD,OAAO,CAAC,cAAc,CAAC,CAgDzB;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAC1C,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,QAAoB,GAC5B,OAAO,CAAC,cAAc,CAAC,CAEzB;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACzC,QAAQ,EAAE,MAAM,EAChB,QAAQ,GAAE,QAAoB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/node/index.d.ts

@@ -0,0 +1,2 @@
+// Type definitions for @elizaos/core (Node.js)
+export * from '../index.node.js';