@agent-native/core 0.101.7 → 0.101.10

package/dist/server/builder-browser.d.ts

@@ -1,5 +1,81 @@
 import type { H3Event } from "h3";
 export declare const BUILDER_CALLBACK_PATH = "/_agent-native/builder/callback";
+export declare const BUILDER_RELAY_PATH = "/_agent-native/builder/relay";
+export declare const BUILDER_RELAY_STATE_PARAM = "_an_relay";
+export declare const BUILDER_RELAY_SECRET_ENV = "AGENT_NATIVE_BUILDER_RELAY_SECRET";
+export declare const BUILDER_RELAY_TARGET_ORIGINS_ENV = "AGENT_NATIVE_BUILDER_RELAY_TARGET_ORIGINS";
+export declare const BUILDER_RELAY_TIMESTAMP_HEADER = "x-agent-native-relay-timestamp";
+export declare const BUILDER_RELAY_FLOW_HEADER = "x-agent-native-relay-flow";
+export declare const BUILDER_RELAY_SIGNATURE_HEADER = "x-agent-native-relay-signature";
+declare const BUILDER_RELAY_PURPOSE = "builder-preview-callback-relay";
+export interface BuilderPreviewRelayState {
+    v: 1;
+    purpose: typeof BUILDER_RELAY_PURPOSE;
+    flowId: string;
+    ownerEmail: string;
+    targetOrigin: string;
+    basePath: string;
+    iat: number;
+    exp: number;
+}
+export interface BuilderRelayCredentials {
+    privateKey: string;
+    publicKey: string;
+    userId: string | null;
+    orgName: string | null;
+    orgKind: string | null;
+    subscription: string | null;
+    subscriptionLevel: string | null;
+    subscriptionName: string | null;
+    isEnterprise: boolean | null;
+    isFreeAccount: boolean | null;
+}
+export interface BuilderRelayRequestBody {
+    relayState: string;
+    credentials: BuilderRelayCredentials;
+}
+export declare function isSafeBuilderRelayTargetOrigin(value: string): boolean;
+export declare function isTrustedBuilderRelayTargetOrigin(value: string): boolean;
+export declare function signBuilderPreviewRelayState(input: {
+    ownerEmail: string;
+    targetOrigin: string;
+    basePath?: string;
+    flowId?: string;
+    now?: number;
+}): {
+    state: string;
+    payload: BuilderPreviewRelayState;
+};
+export declare function verifyBuilderPreviewRelayState(state: string | null | undefined, options?: {
+    now?: number;
+}): BuilderPreviewRelayState | null;
+/**
+ * Corporate callback trust check. Preview-side state verification and relay
+ * receipt deliberately do not require this callback-only allowlist.
+ */
+export declare function verifyBuilderPreviewRelayStateForCallback(state: string | null | undefined, options?: {
+    now?: number;
+}): BuilderPreviewRelayState | null;
+export declare function getBuilderPreviewRelayUrl(payload: BuilderPreviewRelayState): string;
+export declare function createBuilderRelayRequest(relayState: string, credentials: BuilderRelayCredentials, options?: {
+    now?: number;
+}): {
+    body: string;
+    headers: Record<string, string>;
+    url: string;
+};
+export declare function verifyBuilderRelayRequest(input: {
+    body: string;
+    timestamp: string | null | undefined;
+    flowId: string | null | undefined;
+    signature: string | null | undefined;
+    requestOrigin: string;
+    requestBasePath: string;
+    now?: number;
+}): {
+    payload: BuilderPreviewRelayState;
+    body: BuilderRelayRequestBody;
+} | null;
 /**
  * Query-param name carrying the signed CSRF state on the connect→callback
  * round-trip. Prefixed with `_an_` to avoid collisions if Builder ever
@@ -144,6 +220,7 @@ export declare const BUILDER_OPENER_PARAM = "_an_opener";
  */
 export declare function buildBuilderCliAuthUrl(callbackOrigin: string, state?: string | null, options?: {
     previewOrigin?: string;
+    relayState?: string;
     tracking?: BuilderConnectTrackingParams;
 }): string;
 /**
@@ -246,4 +323,5 @@ export interface RunBuilderAgentResult {
  */
 export declare function runBuilderAgent(args: RunBuilderAgentArgs): Promise<RunBuilderAgentResult>;
 export declare function requestBuilderBrowserConnection(args: BrowserConnectionArgs): Promise<Record<string, unknown>>;
+export {};
 //# sourceMappingURL=builder-browser.d.ts.map

package/dist/server/builder-browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builder-browser.d.ts","sourceRoot":"","sources":["../../src/server/builder-browser.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAclC,eAAO,MAAM,qBAAqB,oCAAoC,CAAC;AAmBvE;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAC/C,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AACnD,eAAO,MAAM,4BAA4B,6BAA6B,CAAC;AACvE,eAAO,MAAM,2BAA2B,iBAAiB,CAAC;AAC1D,eAAO,MAAM,+BAA+B,oBAAoB,CAAC;AACjE,eAAO,MAAM,yCAAyC,6BAC1B,CAAC;AAC7B,eAAO,MAAM,8BAA8B,mBAAmB,CAAC;AAC/D,eAAO,MAAM,mCAAmC,wBAAwB,CAAC;AAKzE,MAAM,WAAW,4BAA4B;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAQD,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,eAAe,GACtB,4BAA4B,CAkB9B;AAED,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,4BAA4B,GACrC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBxB;AAoBD,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;IACxB,yBAAyB,EAAE,OAAO,CAAC;IACnC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,WAAW,GAAG,KAAK,CAAC;IACxD;;;;OAIG;IACH,SAAS,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,YAAY,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAiED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,YAAY,EAAE,MAAM,GACnB,OAAO,CAET;AAED,wBAAgB,qCAAqC,CACnD,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,GAAG,IAAI,CAef;AAED,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,UAAU,EAAE,MAAM,GACjB,OAAO,CAET;AAED,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,GAAG,IAAI,CAef;AAED,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,MAAM,CAOR;AAsCD,wBAAgB,iBAAiB,IAAI,MAAM,CAM1C;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAO1C;AAUD,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,wBAAgB,yBAAyB,IAAI,OAAO,CAEnD;AAED,wBAAsB,6BAA6B,IAAI,OAAO,CAAC,MAAM,CAAC,CAmBrE;AAED,wBAAsB,gCAAgC,IAAI,OAAO,CAAC,OAAO,CAAC,CAEzE;AAgDD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAYjD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,MAAM,EACtB,KAAK,GAAE,MAAM,GAAG,IAAW,EAC3B,OAAO,GAAE;IACP,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,4BAA4B,CAAC;CACpC,GACL,MAAM,CAmDR;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACpC,MAAM,CAKR;AAqFD;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAqBtE;AAED;;;;;;;GAOG;AACH,wBAAgB,uCAAuC,CACrD,KAAK,EAAE,OAAO,GACb,MAAM,CAcR;AAUD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,CA0B5E;AASD,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,OAAO,GACb,oBAAoB,CAEtB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,YAC3B,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,CACjB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IAChD,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,aAAa,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAChC;;;IAoBA;AAED,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,KAAK,EAAE,OAAO,GACb,MAAM,CAKR;AAED,wBAAgB,+BAA+B,CAAC,OAAO,EAAE;IACvD,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,GAAG,MAAM,CAST;AA6JD,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,MAAM,CAsER;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IACJ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CAClB,GACL,MAAM,CA8DR;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAiCD;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAkEhC;AAED,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAgDlC"}
+{"version":3,"file":"builder-browser.d.ts","sourceRoot":"","sources":["../../src/server/builder-browser.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAclC,eAAO,MAAM,qBAAqB,oCAAoC,CAAC;AACvE,eAAO,MAAM,kBAAkB,iCAAiC,CAAC;AACjE,eAAO,MAAM,yBAAyB,cAAc,CAAC;AACrD,eAAO,MAAM,wBAAwB,sCAAsC,CAAC;AAC5E,eAAO,MAAM,gCAAgC,8CACA,CAAC;AAC9C,eAAO,MAAM,8BAA8B,mCAAmC,CAAC;AAC/E,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AACrE,eAAO,MAAM,8BAA8B,mCAAmC,CAAC;AAE/E,QAAA,MAAM,qBAAqB,mCAAmC,CAAC;AAK/D,MAAM,WAAW,wBAAwB;IACvC,CAAC,EAAE,CAAC,CAAC;IACL,OAAO,EAAE,OAAO,qBAAqB,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,uBAAuB,CAAC;CACtC;AA4CD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAgCrE;AAED,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAkBxE;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,wBAAwB,CAAA;CAAE,CAuBvD;AAED,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,wBAAwB,GAAG,IAAI,CAmCjC;AAED;;;GAGG;AACH,wBAAgB,yCAAyC,CACvD,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B,wBAAwB,GAAG,IAAI,CAKjC;AAED,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,wBAAwB,GAChC,MAAM,CAER;AAgBD,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,uBAAuB,EACpC,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC7B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAsBhE;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACrC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAClC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG;IACF,OAAO,EAAE,wBAAwB,CAAC;IAClC,IAAI,EAAE,uBAAuB,CAAC;CAC/B,GAAG,IAAI,CA2DP;AAmBD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAC/C,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AACnD,eAAO,MAAM,4BAA4B,6BAA6B,CAAC;AACvE,eAAO,MAAM,2BAA2B,iBAAiB,CAAC;AAC1D,eAAO,MAAM,+BAA+B,oBAAoB,CAAC;AACjE,eAAO,MAAM,yCAAyC,6BAC1B,CAAC;AAC7B,eAAO,MAAM,8BAA8B,mBAAmB,CAAC;AAC/D,eAAO,MAAM,mCAAmC,wBAAwB,CAAC;AAKzE,MAAM,WAAW,4BAA4B;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAQD,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,eAAe,GACtB,4BAA4B,CAkB9B;AAED,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,4BAA4B,GACrC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAgBxB;AAoBD,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,OAAO,CAAC;IACxB,yBAAyB,EAAE,OAAO,CAAC;IACnC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,WAAW,GAAG,KAAK,CAAC;IACxD;;;;OAIG;IACH,SAAS,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,YAAY,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAiED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,YAAY,EAAE,MAAM,GACnB,OAAO,CAET;AAED,wBAAgB,qCAAqC,CACnD,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,GAAG,IAAI,CAef;AAED,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,UAAU,EAAE,MAAM,GACjB,OAAO,CAET;AAED,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,GAAG,IAAI,CAef;AAED,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,MAAM,CAOR;AAsCD,wBAAgB,iBAAiB,IAAI,MAAM,CAM1C;AAED,wBAAgB,iBAAiB,IAAI,MAAM,CAO1C;AAUD,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,wBAAgB,yBAAyB,IAAI,OAAO,CAEnD;AAED,wBAAsB,6BAA6B,IAAI,OAAO,CAAC,MAAM,CAAC,CAmBrE;AAED,wBAAsB,gCAAgC,IAAI,OAAO,CAAC,OAAO,CAAC,CAEzE;AAgDD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAYjD;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,cAAc,EAAE,MAAM,EACtB,KAAK,GAAE,MAAM,GAAG,IAAW,EAC3B,OAAO,GAAE;IACP,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,4BAA4B,CAAC;CACpC,GACL,MAAM,CAsDR;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACpC,MAAM,CAKR;AAqFD;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAqBtE;AAED;;;;;;;GAOG;AACH,wBAAgB,uCAAuC,CACrD,KAAK,EAAE,OAAO,GACb,MAAM,CAcR;AAUD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,oBAAoB,CA0B5E;AASD,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,OAAO,GACb,oBAAoB,CAEtB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,YAC3B,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EACtB,4BAA4B,EAC5B,2BAA2B,EAC3B,uBAAuB,EACvB,yBAAyB,CACjB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IAChD,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,aAAa,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAChC;;;IAoBA;AAED,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,KAAK,EAAE,OAAO,GACb,MAAM,CAKR;AAED,wBAAgB,+BAA+B,CAAC,OAAO,EAAE;IACvD,KAAK,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,GAAG,MAAM,CAST;AA6JD,wBAAgB,gCAAgC,CAC9C,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,MAAM,CAsER;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IACJ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CAClB,GACL,MAAM,CA8DR;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAiCD;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAkEhC;AAED,wBAAsB,+BAA+B,CACnD,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAgDlC"}

package/dist/server/builder-browser.js

@@ -1,4 +1,4 @@
-import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { createHash, createHmac, randomBytes, timingSafeEqual, } from "node:crypto";
 import { getHeader } from "h3";
 import { getAuthSecret, resolveSignupTrackingIdentity, } from "./better-auth-instance.js";
 import { getAppBasePath, getOrigin } from "./google-oauth.js";
@@ -7,6 +7,248 @@ const DEFAULT_BUILDER_API_HOST = "https://api.builder.io";
 const BUILDER_BROWSER_HOST = "agent-native-browser";
 const BUILDER_BROWSER_CLIENT_ID = "Agent Native Browser";
 export const BUILDER_CALLBACK_PATH = "/_agent-native/builder/callback";
+export const BUILDER_RELAY_PATH = "/_agent-native/builder/relay";
+export const BUILDER_RELAY_STATE_PARAM = "_an_relay";
+export const BUILDER_RELAY_SECRET_ENV = "AGENT_NATIVE_BUILDER_RELAY_SECRET";
+export const BUILDER_RELAY_TARGET_ORIGINS_ENV = "AGENT_NATIVE_BUILDER_RELAY_TARGET_ORIGINS";
+export const BUILDER_RELAY_TIMESTAMP_HEADER = "x-agent-native-relay-timestamp";
+export const BUILDER_RELAY_FLOW_HEADER = "x-agent-native-relay-flow";
+export const BUILDER_RELAY_SIGNATURE_HEADER = "x-agent-native-relay-signature";
+const BUILDER_RELAY_PURPOSE = "builder-preview-callback-relay";
+const BUILDER_RELAY_STATE_VERSION = 1;
+const BUILDER_RELAY_TTL_MS = 10 * 60 * 1000;
+const BUILDER_RELAY_REQUEST_SKEW_MS = 2 * 60 * 1000;
+function builderRelaySecret() {
+    const secret = process.env[BUILDER_RELAY_SECRET_ENV]?.trim();
+    if (!secret) {
+        throw new Error(`${BUILDER_RELAY_SECRET_ENV} is required for Builder preview authorization relay.`);
+    }
+    if (secret.length < 32) {
+        throw new Error(`${BUILDER_RELAY_SECRET_ENV} must be at least 32 characters long.`);
+    }
+    return secret;
+}
+function builderRelayMac(value) {
+    return createHmac("sha256", builderRelaySecret())
+        .update(value)
+        .digest("base64url");
+}
+function safeEqualText(expected, actual) {
+    const expectedBuffer = Buffer.from(expected);
+    const actualBuffer = Buffer.from(actual);
+    return (expectedBuffer.length === actualBuffer.length &&
+        timingSafeEqual(expectedBuffer, actualBuffer));
+}
+function normalizeBuilderRelayBasePath(value) {
+    if (!value)
+        return "";
+    if (!value.startsWith("/") || value.includes("?") || value.includes("#")) {
+        return null;
+    }
+    const normalized = value.replace(/\/+$/, "");
+    if (normalized.split("/").some((part) => part === "." || part === "..")) {
+        return null;
+    }
+    return normalized;
+}
+export function isSafeBuilderRelayTargetOrigin(value) {
+    try {
+        const url = new URL(value);
+        if (url.origin !== value ||
+            url.username ||
+            url.password ||
+            url.hostname.includes("*"))
+            return false;
+        const hostname = url.hostname.toLowerCase();
+        const loopback = hostname === "localhost" ||
+            hostname === "127.0.0.1" ||
+            hostname === "::1" ||
+            hostname === "[::1]";
+        if (loopback)
+            return url.protocol === "http:" && process.env.NODE_ENV !== "production";
+        if (url.protocol !== "https:")
+            return false;
+        return (hostname.endsWith(".netlify.app") ||
+            hostname.endsWith(".vercel.app") ||
+            hostname === "agent-native.com" ||
+            hostname.endsWith(".agent-native.com") ||
+            hostname.endsWith(".builder.io") ||
+            hostname.endsWith(".builderio.xyz") ||
+            hostname.endsWith(".builderio.dev") ||
+            hostname.endsWith(".builder.codes"));
+    }
+    catch {
+        return false;
+    }
+}
+export function isTrustedBuilderRelayTargetOrigin(value) {
+    if (!isSafeBuilderRelayTargetOrigin(value))
+        return false;
+    const hostname = new URL(value).hostname.toLowerCase();
+    if (hostname.endsWith(".netlify.app") &&
+        !/^[a-f0-9]{24}--[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.netlify\.app$/.test(hostname)) {
+        return false;
+    }
+    const configured = process.env[BUILDER_RELAY_TARGET_ORIGINS_ENV];
+    if (!configured)
+        return false;
+    return configured
+        .split(",")
+        .map((origin) => origin.trim())
+        .filter(Boolean)
+        .some((origin) => origin === value && !origin.includes("*"));
+}
+export function signBuilderPreviewRelayState(input) {
+    if (!isSafeBuilderRelayTargetOrigin(input.targetOrigin)) {
+        throw new Error("Builder relay target origin is not an approved preview origin.");
+    }
+    const basePath = normalizeBuilderRelayBasePath(input.basePath ?? "");
+    if (basePath === null)
+        throw new Error("Builder relay base path is invalid.");
+    const now = input.now ?? Date.now();
+    const payload = {
+        v: BUILDER_RELAY_STATE_VERSION,
+        purpose: BUILDER_RELAY_PURPOSE,
+        flowId: input.flowId ?? randomBytes(24).toString("base64url"),
+        ownerEmail: input.ownerEmail,
+        targetOrigin: input.targetOrigin,
+        basePath,
+        iat: now,
+        exp: now + BUILDER_RELAY_TTL_MS,
+    };
+    const encoded = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+    return { state: `${encoded}.${builderRelayMac(encoded)}`, payload };
+}
+export function verifyBuilderPreviewRelayState(state, options = {}) {
+    if (!state)
+        return null;
+    const parts = state.split(".");
+    if (parts.length !== 2 || !parts[0] || !parts[1])
+        return null;
+    if (!safeEqualText(builderRelayMac(parts[0]), parts[1]))
+        return null;
+    let value;
+    try {
+        value = JSON.parse(Buffer.from(parts[0], "base64url").toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+    if (!value || typeof value !== "object")
+        return null;
+    const payload = value;
+    const now = options.now ?? Date.now();
+    if (payload.v !== BUILDER_RELAY_STATE_VERSION ||
+        payload.purpose !== BUILDER_RELAY_PURPOSE ||
+        typeof payload.flowId !== "string" ||
+        !/^[A-Za-z0-9_-]{24,128}$/.test(payload.flowId) ||
+        typeof payload.ownerEmail !== "string" ||
+        !payload.ownerEmail.includes("@") ||
+        typeof payload.targetOrigin !== "string" ||
+        !isSafeBuilderRelayTargetOrigin(payload.targetOrigin) ||
+        typeof payload.basePath !== "string" ||
+        normalizeBuilderRelayBasePath(payload.basePath) !== payload.basePath ||
+        typeof payload.iat !== "number" ||
+        typeof payload.exp !== "number" ||
+        payload.exp <= payload.iat ||
+        payload.exp - payload.iat > BUILDER_RELAY_TTL_MS ||
+        payload.iat > now + BUILDER_RELAY_REQUEST_SKEW_MS ||
+        payload.exp < now) {
+        return null;
+    }
+    return payload;
+}
+/**
+ * Corporate callback trust check. Preview-side state verification and relay
+ * receipt deliberately do not require this callback-only allowlist.
+ */
+export function verifyBuilderPreviewRelayStateForCallback(state, options = {}) {
+    const payload = verifyBuilderPreviewRelayState(state, options);
+    return payload && isTrustedBuilderRelayTargetOrigin(payload.targetOrigin)
+        ? payload
+        : null;
+}
+export function getBuilderPreviewRelayUrl(payload) {
+    return `${payload.targetOrigin}${payload.basePath}${BUILDER_RELAY_PATH}`;
+}
+function builderRelayBodyDigest(body) {
+    return createHash("sha256").update(body).digest("base64url");
+}
+function builderRelayRequestSignature(timestamp, flowId, body) {
+    return builderRelayMac(`v1.${timestamp}.${flowId}.${builderRelayBodyDigest(body)}`);
+}
+export function createBuilderRelayRequest(relayState, credentials, options = {}) {
+    const payload = verifyBuilderPreviewRelayState(relayState, options);
+    if (!payload)
+        throw new Error("Builder relay state is invalid or expired.");
+    const body = JSON.stringify({
+        relayState,
+        credentials,
+    });
+    const timestamp = options.now ?? Date.now();
+    return {
+        body,
+        url: getBuilderPreviewRelayUrl(payload),
+        headers: {
+            "content-type": "application/json",
+            [BUILDER_RELAY_TIMESTAMP_HEADER]: String(timestamp),
+            [BUILDER_RELAY_FLOW_HEADER]: payload.flowId,
+            [BUILDER_RELAY_SIGNATURE_HEADER]: builderRelayRequestSignature(timestamp, payload.flowId, body),
+        },
+    };
+}
+export function verifyBuilderRelayRequest(input) {
+    const timestamp = Number(input.timestamp);
+    const now = input.now ?? Date.now();
+    if (!Number.isFinite(timestamp) ||
+        Math.abs(now - timestamp) > BUILDER_RELAY_REQUEST_SKEW_MS ||
+        !input.flowId ||
+        !input.signature ||
+        !safeEqualText(builderRelayRequestSignature(timestamp, input.flowId, input.body), input.signature)) {
+        return null;
+    }
+    let body;
+    try {
+        body = JSON.parse(input.body);
+    }
+    catch {
+        return null;
+    }
+    const payload = verifyBuilderPreviewRelayState(body.relayState, { now });
+    if (!payload ||
+        payload.flowId !== input.flowId ||
+        payload.targetOrigin !== input.requestOrigin ||
+        payload.basePath !== input.requestBasePath ||
+        !body.credentials ||
+        typeof body.credentials.privateKey !== "string" ||
+        typeof body.credentials.publicKey !== "string" ||
+        !body.credentials.privateKey ||
+        !body.credentials.publicKey) {
+        return null;
+    }
+    const nullableString = (value) => typeof value === "string" ? value : null;
+    const nullableBoolean = (value) => typeof value === "boolean" ? value : null;
+    return {
+        payload,
+        body: {
+            relayState: body.relayState,
+            // Explicitly rebuild the credential payload. Extra fields such as an
+            // attacker-supplied ownerEmail/orgId never reach the credential writer.
+            credentials: {
+                privateKey: body.credentials.privateKey,
+                publicKey: body.credentials.publicKey,
+                userId: nullableString(body.credentials.userId),
+                orgName: nullableString(body.credentials.orgName),
+                orgKind: nullableString(body.credentials.orgKind),
+                subscription: nullableString(body.credentials.subscription),
+                subscriptionLevel: nullableString(body.credentials.subscriptionLevel),
+                subscriptionName: nullableString(body.credentials.subscriptionName),
+                isEnterprise: nullableBoolean(body.credentials.isEnterprise),
+                isFreeAccount: nullableBoolean(body.credentials.isFreeAccount),
+            },
+        },
+    };
+}
 function escapeHtml(value) {
     return value.replace(/[&<>"']/g, (ch) => {
         switch (ch) {
@@ -377,6 +619,9 @@ export function buildBuilderCliAuthUrl(callbackOrigin, state = null, options = {
     if (state) {
         callbackUrl.searchParams.set(BUILDER_STATE_PARAM, state);
     }
+    if (options.relayState) {
+        callbackUrl.searchParams.set(BUILDER_RELAY_STATE_PARAM, options.relayState);
+    }
     // When the cli-auth allow-list forces preview_url onto the gateway origin,
     // the callback would otherwise lose the real opener origin and post its
     // success message to the gateway instead of the preview tab. Embed the