fix(memory): enforce guarded remote policy for embeddings

src/memory/embeddings-voyage.ts

@@ -1,3 +1,4 @@
+import type { SsrFPolicy } from "../infra/net/ssrf.js";
 import { resolveRemoteEmbeddingBearerClient } from "./embeddings-remote-client.js";
 import { fetchRemoteEmbeddingVectors } from "./embeddings-remote-fetch.js";
 import type { EmbeddingProvider, EmbeddingProviderOptions } from "./embeddings.js";
@@ -5,6 +6,7 @@ import type { EmbeddingProvider, EmbeddingProviderOptions } from "./embeddings.j
 export type VoyageEmbeddingClient = {
   baseUrl: string;
   headers: Record<string, string>;
+  ssrfPolicy?: SsrFPolicy;
   model: string;
 };
 
@@ -48,6 +50,7 @@ export async function createVoyageEmbeddingProvider(
     return await fetchRemoteEmbeddingVectors({
       url,
       headers: client.headers,
+      ssrfPolicy: client.ssrfPolicy,
       body,
       errorPrefix: "voyage embeddings failed",
     });
@@ -71,11 +74,11 @@ export async function createVoyageEmbeddingProvider(
 export async function resolveVoyageEmbeddingClient(
   options: EmbeddingProviderOptions,
 ): Promise<VoyageEmbeddingClient> {
-  const { baseUrl, headers } = await resolveRemoteEmbeddingBearerClient({
+  const { baseUrl, headers, ssrfPolicy } = await resolveRemoteEmbeddingBearerClient({
     provider: "voyage",
     options,
     defaultBaseUrl: DEFAULT_VOYAGE_BASE_URL,
   });
   const model = normalizeVoyageModel(options.model);
-  return { baseUrl, headers, model };
+  return { baseUrl, headers, ssrfPolicy, model };
 }