@agent-native/core 0.115.3 → 0.115.4

package/dist/server/transcribe-voice.d.ts

@@ -20,7 +20,7 @@ export declare function createTranscribeVoiceHandler(): import("h3").EventHandle
     error: string;
     text?: undefined;
 } | {
-    error?: undefined;
     text: string;
+    error?: undefined;
 }>>;
 //# sourceMappingURL=transcribe-voice.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.115.3",
+  "version": "0.115.4",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {
@@ -385,8 +385,8 @@
     "y-protocols": "^1.0.7",
     "yjs": "^13.6.31",
     "zod": "^4.3.6",
-    "@agent-native/toolkit": "^0.9.0",
-    "@agent-native/recap-cli": "0.5.0"
+    "@agent-native/recap-cli": "0.5.0",
+    "@agent-native/toolkit": "^0.9.0"
   },
   "devDependencies": {
     "@ai-sdk/anthropic": "^3.0.71",

package/src/server/builder-browser.ts

@@ -26,6 +26,8 @@ export const BUILDER_RELAY_STATE_PARAM = "_an_relay";
 export const BUILDER_RELAY_SECRET_ENV = "AGENT_NATIVE_BUILDER_RELAY_SECRET";
 export const BUILDER_RELAY_TARGET_ORIGINS_ENV =
   "AGENT_NATIVE_BUILDER_RELAY_TARGET_ORIGINS";
+export const BUILDER_RELAY_TARGET_DOMAIN_SUFFIXES_ENV =
+  "AGENT_NATIVE_BUILDER_RELAY_TARGET_DOMAIN_SUFFIXES";
 export const BUILDER_RELAY_TIMESTAMP_HEADER = "x-agent-native-relay-timestamp";
 export const BUILDER_RELAY_FLOW_HEADER = "x-agent-native-relay-flow";
 export const BUILDER_RELAY_SIGNATURE_HEADER = "x-agent-native-relay-signature";
@@ -151,15 +153,18 @@ export function isTrustedBuilderRelayTargetOrigin(value: string): boolean {
   ) {
     return false;
   }
-  const configured = process.env[BUILDER_RELAY_TARGET_ORIGINS_ENV];
-  if (!configured) return false;
-  return configured
+  const exactOriginMatch = (process.env[BUILDER_RELAY_TARGET_ORIGINS_ENV] ?? "")
     .split(",")
     .map((origin) => origin.trim())
     .filter(Boolean)
     .some((origin) => origin === value && !origin.includes("*"));
+  return (
+    exactOriginMatch ||
+    builderRelayTargetDomainSuffixes().some((suffix) =>
+      hostname.endsWith(suffix),
+    )
+  );
 }
-
 export function signBuilderPreviewRelayState(input: {
   ownerEmail: string;
   targetOrigin: string;
@@ -191,6 +196,31 @@ export function signBuilderPreviewRelayState(input: {
   return { state: `${encoded}.${builderRelayMac(encoded)}`, payload };
 }
 
+function builderRelayTargetDomainSuffixes(): string[] {
+  return (process.env[BUILDER_RELAY_TARGET_DOMAIN_SUFFIXES_ENV] ?? "")
+    .split(",")
+    .map((suffix) => suffix.trim().toLowerCase())
+    .filter((suffix) => {
+      if (!suffix.startsWith(".") || suffix.includes("*")) return false;
+      const hostname = suffix.slice(1);
+      if (!hostname.includes(".") || hostname.length > 253) return false;
+      if (
+        !hostname
+          .split(".")
+          .every((label) =>
+            /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label),
+          )
+      ) {
+        return false;
+      }
+      try {
+        return new URL(`https://${hostname}`).hostname === hostname;
+      } catch {
+        return false;
+      }
+    });
+}
+
 export function verifyBuilderPreviewRelayState(
   state: string | null | undefined,
   options: { now?: number } = {},

package/src/server/core-routes-plugin.ts

@@ -2345,7 +2345,7 @@ export function createCoreRoutesPlugin(
               timestamp: getHeader(event, BUILDER_RELAY_TIMESTAMP_HEADER),
               flowId: getHeader(event, BUILDER_RELAY_FLOW_HEADER),
               signature: getHeader(event, BUILDER_RELAY_SIGNATURE_HEADER),
-              requestOrigin: getFrameworkRouteRequestUrl(event).origin,
+              requestOrigin: getBuilderBrowserOriginForEvent(event),
               requestBasePath: getAppBasePath(),
             },
             {