@agent-native/core 0.157.19 → 0.157.20

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
-    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
+    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
-    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
+    error?: undefined;
 }>>;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/observability/routes.d.ts

@@ -62,6 +62,6 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;

package/dist/progress/routes.d.ts

@@ -15,6 +15,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/server/action-routes.js

@@ -143,7 +143,10 @@ function getAllowedCorsOrigin(origin) {
         // keeps production from trusting arbitrary localhost callers.
     });
     if (allowedOrigin) {
-        return { origin: allowedOrigin, credentials: true };
+        return {
+            origin: allowedOrigin,
+            credentials: shouldAllowMcpEmbedCredentials(allowedOrigin),
+        };
     }
     if (origin && isMcpEmbedCorsOrigin(origin)) {
         return {

package/dist/server/auth.js

@@ -1394,7 +1394,6 @@ function applyCorsHeaders(event) {
             Boolean(getHeader(event, "authorization")));
     const allowedOrigin = getAllowedCorsOrigin(origin, {
         allowedOrigins: readCorsAllowedOrigins(),
-        allowLocalhostWhenNoAllowlist: true,
     });
     const responseOrigin = mcpEmbedCorsRequest ? origin : allowedOrigin;
     if (!responseOrigin)

package/dist/server/core-routes-plugin.js

@@ -1103,7 +1103,6 @@ export function createCoreRoutesPlugin(options = {}) {
                     : getAllowedCorsOrigin(origin, {
                         allowedOrigins: allowlist,
                         allowAnyOriginWhenNoAllowlist: false,
-                        allowLocalhostWhenNoAllowlist: true,
                     });
                 // Reject preflights from disallowed cross-origin callers BEFORE
                 // returning 204. Previously the OPTIONS short-circuit returned 204

package/dist/server/embed-route.js

@@ -51,6 +51,8 @@ function embedStartCorsOrigin(event) {
     const origin = getHeader(event, "origin");
     if (!origin)
         return null;
+    if (origin === "null")
+        return origin;
     if (isMcpEmbedTransplantOrigin(origin))
         return origin;
     return readCorsAllowedOrigins().includes(origin) ? origin : null;
@@ -144,8 +146,12 @@ function firstQueryValue(value) {
 }
 function wantsTransplantLocationResponse(event) {
     const origin = getHeader(event, "origin");
+    const fetchDestination = getHeader(event, "sec-fetch-dest")?.toLowerCase();
+    if (fetchDestination !== "document" && fetchDestination !== "iframe") {
+        return false;
+    }
     const canReadLocation = !origin ||
-        embedStartCorsOrigin(event) !== null ||
+        (origin !== "null" && embedStartCorsOrigin(event) !== null) ||
         isMcpEmbedTransplantOrigin(origin);
     if (!canReadLocation)
         return false;

package/dist/server/realtime-token.d.ts

@@ -26,8 +26,8 @@ export declare function createRealtimeTokenHandler(): import("h3").EventHandlerW
     expiresAt?: undefined;
     ttlSeconds?: undefined;
 } | {
+    error?: undefined;
     token: string;
     expiresAt: string;
     ttlSeconds: number;
-    error?: undefined;
 }>>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.157.19",
+  "version": "0.157.20",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {