@callembed/sdk 0.1.0 → 0.1.2

package/dist/core/api.js

@@ -1,5 +1,16 @@
 import { CallEmbedError } from "./errors.js";
 import { assertValidMetadata } from "./metadata.js";
+/** Publishable request headers; includes parent origin for hosted iframe (B109). */
+function publishableHeaders(cfg, extra) {
+    const headers = {
+        "X-Publishable-Key": cfg.publishableKey,
+        ...extra,
+    };
+    if (cfg.parentOrigin) {
+        headers["X-CallEmbed-Parent-Origin"] = cfg.parentOrigin;
+    }
+    return headers;
+}
 /**
  * Create a call via `POST /v1/calls` using the publishable key only.
  * Response includes `endToken` (memory-only — never persist or log).
@@ -9,10 +20,7 @@ export async function apiCreateCall(cfg, opts) {
     const base = cfg.apiBaseUrl.replace(/\/$/, "");
     const res = await fetch(`${base}/v1/calls`, {
         method: "POST",
-        headers: {
-            "Content-Type": "application/json",
-            "X-Publishable-Key": cfg.publishableKey,
-        },
+        headers: publishableHeaders(cfg, { "Content-Type": "application/json" }),
         body: JSON.stringify({
             queue: opts.queue,
             ...(opts.metadata !== undefined ? { metadata: opts.metadata } : {}),
@@ -92,10 +100,7 @@ const STATUS_MAX_ATTEMPTS = 3;
 export async function apiEndCall(cfg, callId, endToken) {
     const url = endCallUrl(cfg, callId);
     const body = endBody(endToken);
-    const headers = {
-        "Content-Type": "application/json",
-        "X-Publishable-Key": cfg.publishableKey,
-    };
+    const headers = publishableHeaders(cfg, { "Content-Type": "application/json" });
     for (let attempt = 0; attempt < END_MAX_ATTEMPTS; attempt++) {
         try {
             const res = await fetch(url, { method: "POST", headers, body });
@@ -123,10 +128,7 @@ export function apiEndCallKeepalive(cfg, callId, endToken) {
     try {
         void fetch(endCallUrl(cfg, callId), {
             method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                "X-Publishable-Key": cfg.publishableKey,
-            },
+            headers: publishableHeaders(cfg, { "Content-Type": "application/json" }),
             body: endBody(endToken),
             keepalive: true,
         });
@@ -141,9 +143,7 @@ export function apiEndCallKeepalive(cfg, callId, endToken) {
  * Retries briefly on 429 (Retry-After + jitter) so ring polls survive key/IP spikes.
  */
 export async function apiGetCallStatus(cfg, callId, endToken) {
-    const headers = {
-        "X-Publishable-Key": cfg.publishableKey,
-    };
+    const headers = publishableHeaders(cfg);
     if (endToken)
         headers["X-Call-End-Token"] = endToken;
     const url = callStatusUrl(cfg, callId);

package/dist/core/client.js

@@ -86,6 +86,22 @@ export const CallEmbed = {
         if (options.apiBaseUrl === undefined || options.apiBaseUrl === null) {
             throw new CallEmbedError("invalid_config", 'apiBaseUrl is required (use "" for same-origin).');
         }
+        const parentRaw = typeof options.parentOrigin === "string" ? options.parentOrigin.trim() : "";
+        let parentOrigin;
+        if (parentRaw) {
+            try {
+                const u = new URL(parentRaw);
+                if (u.protocol !== "http:" && u.protocol !== "https:") {
+                    throw new CallEmbedError("invalid_config", "parentOrigin must be a valid http(s) origin.");
+                }
+                parentOrigin = u.origin;
+            }
+            catch (err) {
+                if (err instanceof CallEmbedError)
+                    throw err;
+                throw new CallEmbedError("invalid_config", "parentOrigin must be a valid http(s) origin.");
+            }
+        }
         runtime = {
             publishableKey: options.publishableKey.trim(),
             apiBaseUrl: String(options.apiBaseUrl).trim().replace(/\/$/, ""),
@@ -94,6 +110,7 @@ export const CallEmbed = {
             copyOverrides: options.copy ?? {},
             branding: options.branding !== false,
             debug: options.debug === true,
+            ...(parentOrigin ? { parentOrigin } : {}),
         };
     },
     /**

package/dist/core/errors.d.ts

@@ -2,7 +2,7 @@
  * Error codes and {@link CallEmbedError} for the public SDK surface.
  */
 /** Well-known SDK / API error codes (English, machine-readable). */
-export type ErrorCode = "not_initialized" | "invalid_config" | "invalid_queue" | "invalid_metadata" | "invalid_display_name" | "invalid_container" | "invalid_selector" | "call_in_progress" | "mic_permission_denied" | "no_microphone" | "connection_failed" | "call_failed" | "no_agent_online" | "no_answer" | "agent_busy" | "call_already_answered" | "invalid_end_token" | "quota_exceeded" | "origin_not_allowed" | "invalid_publishable_key" | "rate_limited" | "livekit_not_configured" | "unknown_queue";
+export type ErrorCode = "not_initialized" | "invalid_config" | "invalid_queue" | "invalid_metadata" | "invalid_display_name" | "invalid_container" | "invalid_selector" | "call_in_progress" | "mic_permission_denied" | "no_microphone" | "connection_failed" | "call_failed" | "no_agent_online" | "no_answer" | "agent_busy" | "call_already_answered" | "invalid_end_token" | "quota_exceeded" | "origin_not_allowed" | "parent_origin_required" | "parent_origin_not_allowed" | "invalid_publishable_key" | "rate_limited" | "livekit_not_configured" | "unknown_queue";
 /**
  * Thrown by CallEmbed SDK methods and surfaced via the `error` event.
  */

package/dist/core/hosted-embed.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Hosted iframe embed defaults (B135).
+ *
+ * Production iframe lives on its own origin so callembed-web can keep a global
+ * `X-Frame-Options: DENY`. Override the URL when self-hosting the embed page.
+ *
+ * Legacy `https://app.callembed.sealby.me/embed.html` (and the Render
+ * `callembed-web` hostname) remain parseable as iframe `src` values but are
+ * blocked by the app site's permanent DENY — prefer the URL below.
+ */
+/** Origin that serves the hosted `/embed.html` page. */
+export declare const DEFAULT_HOSTED_EMBED_ORIGIN = "https://callembed-embed.onrender.com";
+/** Default hosted iframe document URL (configurable by overriding iframe `src`). */
+export declare const DEFAULT_HOSTED_EMBED_URL = "https://callembed-embed.onrender.com/embed.html";

package/dist/core/hosted-embed.js

@@ -0,0 +1,14 @@
+/**
+ * Hosted iframe embed defaults (B135).
+ *
+ * Production iframe lives on its own origin so callembed-web can keep a global
+ * `X-Frame-Options: DENY`. Override the URL when self-hosting the embed page.
+ *
+ * Legacy `https://app.callembed.sealby.me/embed.html` (and the Render
+ * `callembed-web` hostname) remain parseable as iframe `src` values but are
+ * blocked by the app site's permanent DENY — prefer the URL below.
+ */
+/** Origin that serves the hosted `/embed.html` page. */
+export const DEFAULT_HOSTED_EMBED_ORIGIN = "https://callembed-embed.onrender.com";
+/** Default hosted iframe document URL (configurable by overriding iframe `src`). */
+export const DEFAULT_HOSTED_EMBED_URL = `${DEFAULT_HOSTED_EMBED_ORIGIN}/embed.html`;

package/dist/core/types.d.ts

@@ -43,6 +43,13 @@ export interface InitOptions {
      * Default: `false`.
      */
     debug?: boolean;
+    /**
+     * Embedding parent page origin for the hosted iframe (`embed.html`).
+     * Sent as `X-CallEmbed-Parent-Origin` on publishable API calls. Required by
+     * the API when the browser `Origin` is the hosted embed host (B109).
+     * Ordinary first-party SDK usage should omit this.
+     */
+    parentOrigin?: string;
 }
 /**
  * Options for {@link CallEmbed.startCall}.
@@ -172,4 +179,6 @@ export interface RuntimeConfig {
     copyOverrides: Partial<Record<string, string>>;
     branding: boolean;
     debug: boolean;
+    /** See {@link InitOptions.parentOrigin}. */
+    parentOrigin?: string;
 }

package/dist/index.d.ts

@@ -7,5 +7,6 @@
 export { CallEmbed } from "./core/client.js";
 export { CallEmbedError, type ErrorCode } from "./core/errors.js";
 export { METADATA_MAX_BYTES, assertValidMetadata } from "./core/metadata.js";
+export { DEFAULT_HOSTED_EMBED_ORIGIN, DEFAULT_HOSTED_EMBED_URL, } from "./core/hosted-embed.js";
 export type { ActiveCall, ApiErrorBody, CallEventHandler, CallEventMap, CallEventName, CallSession, CallStatus, InitOptions, Locale, RuntimeConfig, StartCallEventHandlers, StartCallOptions, } from "./core/types.js";
 export { CallEmbed as default } from "./core/client.js";

package/dist/index.js

@@ -7,4 +7,5 @@
 export { CallEmbed } from "./core/client.js";
 export { CallEmbedError } from "./core/errors.js";
 export { METADATA_MAX_BYTES, assertValidMetadata } from "./core/metadata.js";
+export { DEFAULT_HOSTED_EMBED_ORIGIN, DEFAULT_HOSTED_EMBED_URL, } from "./core/hosted-embed.js";
 export { CallEmbed as default } from "./core/client.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@callembed/sdk",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "CallEmbed embeddable web SDK — headless core + optional UI",
   "license": "MIT",
   "author": "Sealby",
@@ -42,6 +42,14 @@
     "pack:verify:workflow": "node ./scripts/pack-verify-workflow-smoke.mjs"
   },
   "homepage": "https://callembed.sealby.me",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/TonyFeng1203/CallEmbed.git",
+    "directory": "packages/sdk"
+  },
+  "bugs": {
+    "url": "https://github.com/TonyFeng1203/CallEmbed/issues"
+  },
   "keywords": [
     "callembed",
     "voice",