@agent-native/core 0.157.18 → 0.157.20

package/dist/a2a/index.d.ts

@@ -3,6 +3,7 @@ export type { A2ATokenPayload } from "./server.js";
 export { generateAgentCard } from "./agent-card.js";
 export { A2A_AGENT_ACTIVITY_KIND, A2A_AGENT_ACTIVITY_VERSION, MAX_A2A_ACTIVITY_REASONING_CHARS, MAX_A2A_ACTIVITY_REASONING_SEGMENTS, MAX_A2A_ACTIVITY_RESPONSE_CHARS, MAX_A2A_ACTIVITY_TOOL_CALLS, MAX_A2A_ACTIVITY_TOTAL_CHARS, MAX_A2A_ACTIVITY_TOOL_ID_CHARS, MAX_A2A_ACTIVITY_TOOL_INPUT_CHARS, MAX_A2A_ACTIVITY_TOOL_NAME_CHARS, MAX_A2A_ACTIVITY_TOOL_PAYLOAD_CHARS, MAX_A2A_ACTIVITY_TOOL_RESULT_CHARS, applyA2AAgentActivityEvent, buildA2AAgentActivityPart, buildA2AAgentActivitySnapshot, createA2AAgentActivityState, parseA2AAgentActivityPart, } from "./activity.js";
 export { A2AClient, callAction, callAgent, signA2AToken } from "./client.js";
+export { canonicalA2AAudience } from "./audience.js";
 export { resolveA2ACallerAuth } from "./caller-auth.js";
 export type { A2ACallerAuth } from "./caller-auth.js";
 export { AgentInvocationError, buildAgentInvocationPrompt, invokeAgent, invokeAgentAction, looksLikeAgentUrl, resolveAgentInvocationTarget, } from "./invoke.js";

package/dist/a2a/index.js

@@ -4,5 +4,6 @@ export { generateAgentCard } from "./agent-card.js";
 export { A2A_AGENT_ACTIVITY_KIND, A2A_AGENT_ACTIVITY_VERSION, MAX_A2A_ACTIVITY_REASONING_CHARS, MAX_A2A_ACTIVITY_REASONING_SEGMENTS, MAX_A2A_ACTIVITY_RESPONSE_CHARS, MAX_A2A_ACTIVITY_TOOL_CALLS, MAX_A2A_ACTIVITY_TOTAL_CHARS, MAX_A2A_ACTIVITY_TOOL_ID_CHARS, MAX_A2A_ACTIVITY_TOOL_INPUT_CHARS, MAX_A2A_ACTIVITY_TOOL_NAME_CHARS, MAX_A2A_ACTIVITY_TOOL_PAYLOAD_CHARS, MAX_A2A_ACTIVITY_TOOL_RESULT_CHARS, applyA2AAgentActivityEvent, buildA2AAgentActivityPart, buildA2AAgentActivitySnapshot, createA2AAgentActivityState, parseA2AAgentActivityPart, } from "./activity.js";
 // Client
 export { A2AClient, callAction, callAgent, signA2AToken } from "./client.js";
+export { canonicalA2AAudience } from "./audience.js";
 export { resolveA2ACallerAuth } from "./caller-auth.js";
 export { AgentInvocationError, buildAgentInvocationPrompt, invokeAgent, invokeAgentAction, looksLikeAgentUrl, resolveAgentInvocationTarget, } from "./invoke.js";

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
-    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
+    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
-    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
+    error?: undefined;
 }>>;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/observability/routes.d.ts

@@ -41,27 +41,27 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    ok?: undefined;
-    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
-} | {
-    ok?: undefined;
     error?: undefined;
+    ok?: undefined;
+} | {
     summary?: undefined;
     spans?: undefined;
     id: string;
-} | {
+    error?: undefined;
     ok?: undefined;
+} | {
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
+    ok?: undefined;
 } | {
-    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/secrets/routes.d.ts

@@ -34,16 +34,16 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
     ok: boolean;
     status: string;
     error?: undefined;
 } | {
-    ok?: undefined;
     error: string;
     removed?: undefined;
+    ok?: undefined;
 } | {
     ok: boolean;
     removed: boolean;
@@ -54,9 +54,9 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
     note?: undefined;
+    ok?: undefined;
 } | {
     ok: boolean;
     note?: undefined;

package/dist/server/action-routes.js

@@ -143,7 +143,10 @@ function getAllowedCorsOrigin(origin) {
         // keeps production from trusting arbitrary localhost callers.
     });
     if (allowedOrigin) {
-        return { origin: allowedOrigin, credentials: true };
+        return {
+            origin: allowedOrigin,
+            credentials: shouldAllowMcpEmbedCredentials(allowedOrigin),
+        };
     }
     if (origin && isMcpEmbedCorsOrigin(origin)) {
         return {

package/dist/server/agent-engine-api-key-route.d.ts

@@ -27,10 +27,10 @@ export declare function resolveAgentEngineApiKeyWriteTarget(event: H3Event, scop
 export declare function createAgentEngineApiKeyHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: any;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
     baseUrlKey?: string;
     scope: AgentEngineApiKeyScope;
+    error?: undefined;
 }>>;
 export {};

package/dist/server/auth.js

@@ -1394,7 +1394,6 @@ function applyCorsHeaders(event) {
             Boolean(getHeader(event, "authorization")));
     const allowedOrigin = getAllowedCorsOrigin(origin, {
         allowedOrigins: readCorsAllowedOrigins(),
-        allowLocalhostWhenNoAllowlist: true,
     });
     const responseOrigin = mcpEmbedCorsRequest ? origin : allowedOrigin;
     if (!responseOrigin)

package/dist/server/core-routes-plugin.js

@@ -1103,7 +1103,6 @@ export function createCoreRoutesPlugin(options = {}) {
                     : getAllowedCorsOrigin(origin, {
                         allowedOrigins: allowlist,
                         allowAnyOriginWhenNoAllowlist: false,
-                        allowLocalhostWhenNoAllowlist: true,
                     });
                 // Reject preflights from disallowed cross-origin callers BEFORE
                 // returning 204. Previously the OPTIONS short-circuit returned 204

package/dist/server/embed-route.js

@@ -1,8 +1,9 @@
 import { defineEventHandler, getHeader, getMethod, getQuery, setResponseHeader, } from "h3";
 import { withCollapsedAgentSidebarParam } from "../shared/agent-sidebar-url.js";
 import { EMBED_MODE_QUERY_PARAM, EMBED_START_PATH, EMBED_TOKEN_QUERY_PARAM, MCP_APP_CHAT_BRIDGE_QUERY_PARAM, } from "../shared/embed-auth.js";
-import { isMcpEmbedCorsOrigin, MCP_EMBED_CORS_ALLOW_HEADERS, } from "../shared/mcp-embed-headers.js";
+import { isMcpEmbedTransplantOrigin, MCP_EMBED_CORS_ALLOW_HEADERS, } from "../shared/mcp-embed-headers.js";
 import { getConfiguredAppBasePath } from "./app-base-path.js";
+import { readCorsAllowedOrigins } from "./cors-origins.js";
 import { consumeEmbedSessionTicket, isEmbedCapabilityScope, normalizeEmbedTargetPath, setEmbedSessionCookie, signEmbedSessionToken, } from "./embed-session.js";
 function withConfiguredBasePath(path) {
     const base = getConfiguredAppBasePath();
@@ -48,7 +49,13 @@ function setEmbedStartResponseHeaders(event) {
 }
 function embedStartCorsOrigin(event) {
     const origin = getHeader(event, "origin");
-    return isMcpEmbedCorsOrigin(origin) ? (origin ?? null) : null;
+    if (!origin)
+        return null;
+    if (origin === "null")
+        return origin;
+    if (isMcpEmbedTransplantOrigin(origin))
+        return origin;
+    return readCorsAllowedOrigins().includes(origin) ? origin : null;
 }
 function embedStartResponseHeaders(event, init = {}) {
     const headers = new Headers({
@@ -138,6 +145,16 @@ function firstQueryValue(value) {
             : "";
 }
 function wantsTransplantLocationResponse(event) {
+    const origin = getHeader(event, "origin");
+    const fetchDestination = getHeader(event, "sec-fetch-dest")?.toLowerCase();
+    if (fetchDestination !== "document" && fetchDestination !== "iframe") {
+        return false;
+    }
+    const canReadLocation = !origin ||
+        (origin !== "null" && embedStartCorsOrigin(event) !== null) ||
+        isMcpEmbedTransplantOrigin(origin);
+    if (!canReadLocation)
+        return false;
     if (getHeader(event, "x-agent-native-embed-transplant") === "1") {
         return true;
     }

package/dist/shared/mcp-embed-headers.d.ts

@@ -7,6 +7,13 @@ export declare function isMcpProductHostOrigin(origin: string | null | undefined
 export declare function isAgentNativeFirstPartyAppOrigin(origin: string | null | undefined): boolean;
 export declare function isBuilderIoEmbedOrigin(origin: string | null | undefined): boolean;
 export declare function isMcpEmbedCorsOrigin(origin: string | null | undefined): boolean;
+/**
+ * Origins allowed to read the one-time embed location returned by a browser
+ * transplant request. Builder and localhost origins may use the broader MCP
+ * CORS surface, but must not receive a reusable session location unless they
+ * are explicitly configured through CORS_ALLOWED_ORIGINS.
+ */
+export declare function isMcpEmbedTransplantOrigin(origin: string | null | undefined): boolean;
 export declare function shouldAllowMcpEmbedCredentials(origin: string | null | undefined): boolean;
 export declare const MCP_EMBED_STATIC_ASSET_HEADERS: {
     readonly "Access-Control-Allow-Origin": "*";

package/dist/shared/mcp-embed-headers.js

@@ -8,6 +8,14 @@ const MCP_PRODUCT_HOST_ORIGINS = new Set([
     "https://chatgpt.com",
     "https://claude.ai",
 ]);
+const TRUSTED_NATIVE_APP_ORIGIN_RE = /^(?:tauri:\/\/localhost|https?:\/\/tauri\.localhost(?::\d+)?)$/;
+function isExplicitCorsAllowedOrigin(origin) {
+    return (process.env.CORS_ALLOWED_ORIGINS ?? "")
+        .split(",")
+        .map((value) => value.trim())
+        .filter(Boolean)
+        .includes(origin);
+}
 export function isLocalMcpEmbedOrigin(origin) {
     if (!origin)
         return false;
@@ -97,12 +105,27 @@ export function isMcpEmbedCorsOrigin(origin) {
         isAgentNativeFirstPartyAppOrigin(origin) ||
         isBuilderIoEmbedOrigin(origin));
 }
+/**
+ * Origins allowed to read the one-time embed location returned by a browser
+ * transplant request. Builder and localhost origins may use the broader MCP
+ * CORS surface, but must not receive a reusable session location unless they
+ * are explicitly configured through CORS_ALLOWED_ORIGINS.
+ */
+export function isMcpEmbedTransplantOrigin(origin) {
+    return (isClaudeMcpContentOrigin(origin) ||
+        isChatGptMcpSandboxOrigin(origin) ||
+        isMcpProductHostOrigin(origin) ||
+        isAgentNativeFirstPartyAppOrigin(origin));
+}
 export function shouldAllowMcpEmbedCredentials(origin) {
-    return (origin !== "null" &&
-        !isClaudeMcpContentOrigin(origin) &&
-        !isChatGptMcpSandboxOrigin(origin) &&
-        !isMcpProductHostOrigin(origin) &&
-        !isAgentNativeFirstPartyAppOrigin(origin));
+    if (!origin || origin === "null")
+        return false;
+    // Credentialed CORS is an explicit deployment decision. MCP product,
+    // Builder, localhost, and arbitrary origins use bearer/embed credentials;
+    // only the configured browser allowlist and the framework's exact native
+    // app origins may receive cookies.
+    return (TRUSTED_NATIVE_APP_ORIGIN_RE.test(origin) ||
+        isExplicitCorsAllowedOrigin(origin));
 }
 // These paths are served straight off the CDN, so the security-headers h3
 // middleware never runs for them — anything it sets that must also hold for

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.157.18",
+  "version": "0.157.20",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {