@heroui/agent 1.0.0-beta.3 → 1.0.0-beta.5

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 ## Unreleased
 
+- Move the visible Agent UI into a cross-origin iframe hosted by HeroUI. This is
+  the one-time host-bridge upgrade; UI, renderer, chart, PDF/XLSX, and backend
+  changes no longer require another customer npm release.
+- Keep client tools, product context, navigation, mutations, identity, drafts,
+  attachments, and the durable message outbox in the customer page behind the
+  origin- and session-bound iframe RPC boundary.
+- Replace custom React tool/Markdown renderers and React icon components with
+  hosted declarative UI and HeroUI-owned icon identifiers.
+- Keep `@heroui/agent/css` as a compatibility no-op; the iframe ships its own
+  hashed, code-split styles and assets.
+- Move the full conversation implementation into the private
+  `@heroui/agent-hosted-runtime` workspace package. The published package keeps
+  only the host bridge, public types, client tools, and server helper, and
+  no longer installs Streamdown as a customer dependency.
+- Move runtime, telemetry, remote configuration, token-claim, and generated UI
+  schemas into the private `@heroui/agent-runtime-contracts` workspace
+  package. Remove the beta-only public `@heroui/agent/contracts` entry point.
+- Retire `@heroui/agent-client`; its session manager now belongs to the public
+  bridge, while conversation targeting and history belong to the hosted runtime.
 - Keep the built-in Agent palette isolated from generic host variables such as
   `--background` and `--foreground`, which may contain framework-specific color
   channels rather than valid CSS colors and previously made panels transparent.

package/README.md

@@ -2,23 +2,53 @@
 
 # HeroUI Agents SDK
 
-Embed a hosted generative-UI agent in your React app with [`@heroui/agent`](https://heroui.pro/agents). Declare typed client tools that read your data — the hosted runtime plans the answer, runs calculations in a sandbox, and streams back charts, tables, and metrics.
+Embed a hosted generative-UI agent in any modern website. Use
+[`@heroui/agent`](https://heroui.pro/agents) for typed React integrations, or the CDN loader with
+vanilla JavaScript. The hosted runtime plans answers, runs calculations in a sandbox, and streams
+back charts, tables, and metrics.
 
-## Installation
+The npm package contains only the iframe bridge, public types, client-tool executor, and server
+token helper. The full conversation UI lives in the private `@heroui/agent-hosted-runtime` workspace
+package and is deployed through `agent.heroui.pro`.
+
+## React installation
 
 ```bash
 npm install @heroui/agent@beta
 ```
 
-Import the stylesheet once:
+## React (Vite) usage
+
+```tsx
+import {HeroUIAgent} from "@heroui/agent";
+
+const agentId = process.env.HEROUI_AGENT_ID;
 
-```css
-@import "@heroui/agent/css";
+export function AppAgent() {
+  return (
+    <HeroUIAgent
+      agentId={agentId!}
+      getAuthToken={async (context) => {
+        const response = await fetch("/api/heroui-agent/auth-token", {
+          method: "POST",
+          headers: {"Content-Type": "application/json"},
+          body: JSON.stringify(context),
+        });
+
+        if (!response.ok) throw new Error("Agent authentication failed");
+
+        return response.json();
+      }}
+    />
+  );
+}
 ```
 
-## Usage
+## Next.js usage
 
 ```tsx
+"use client";
+
 import {HeroUIAgent} from "@heroui/agent/next";
 
 export function AppAgent() {
@@ -48,36 +78,70 @@ import {createAuthToken} from "@heroui/agent/server";
 
 export async function POST(request: Request) {
   const {anonymousId, agentId} = await request.json();
+  const configuredAgentId = process.env.HEROUI_AGENT_ID;
+
+  if (!configuredAgentId || agentId !== configuredAgentId) {
+    return Response.json({error: "Invalid agent"}, {status: 400});
+  }
 
   return Response.json(
     await createAuthToken({
+      anonymousId,
       apiKey: process.env.HEROUI_AGENT_API_KEY!,
       identity: {id: anonymousId, type: "anonymous"},
-      agentId,
+      agentId: configuredAgentId,
     }),
   );
 }
 ```
 
+## Vanilla JavaScript
+
+No npm package or React dependency is required:
+
+```html
+<script src="https://agent.heroui.pro/loader.js" defer></script>
+<script>
+  window.addEventListener("heroui-agent:loaded", () => {
+    window.agent = window.HeroUIAgent.mount({
+      agentId: "your_agent_id",
+      getAuthToken: async (context) => {
+        const response = await fetch("/api/heroui-agent/auth-token", {
+          body: JSON.stringify(context),
+          headers: {"Content-Type": "application/json"},
+          method: "POST",
+        });
+
+        if (!response.ok) throw new Error("Agent authentication failed");
+
+        return response.json();
+      },
+    });
+  });
+</script>
+```
+
+Vanilla client tools use raw JSON Schema for `parameters`. The returned controller exposes `show`,
+`hide`, `toggle`, `newConversation`, `refreshAuth`, `shutdown`, and `destroy`.
+
 ## Overview
 
 `@heroui/agent` provides a unified SDK for embedding HeroUI Agents into web applications.
 
 ### Entrypoints
 
-| Entrypoint                                   | Description                            | Links                                                                                                                   |
-| -------------------------------------------- | -------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
-| [`@heroui/agent`](#herouiagent)              | React embed, hooks, and client tools   | [npm](https://www.npmjs.com/package/@heroui/agent) • [Docs](https://heroui.pro/docs/agent/getting-started/installation) |
-| [`@heroui/agent/next`](#herouiagentnext)     | Next.js App Router entry               | [Docs](https://heroui.pro/docs/agent/getting-started/installation)                                                      |
-| [`@heroui/agent/server`](#herouiagentserver) | Server helpers for minting auth tokens | [Docs](https://heroui.pro/docs/agent/getting-started/identifying-users)                                                 |
-| [`@heroui/agent/css`](#styles)               | Agent stylesheet                       | —                                                                                                                       |
-| [`@heroui/agent/contracts`](#contracts)      | Shared protocol types and schemas      | —                                                                                                                       |
+| Entrypoint                                   | Description                                    | Links                                                                                                    |
+| -------------------------------------------- | ---------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
+| [`@heroui/agent`](#herouiagent)              | React bridge, hooks, and typed client tools    | [npm](https://www.npmjs.com/package/@heroui/agent) • [Docs](https://heroui.pro/docs/agents/installation) |
+| [`@heroui/agent/next`](#herouiagentnext)     | Next.js App Router entry                       | [Docs](https://heroui.pro/docs/agents/installation)                                                      |
+| `agent.heroui.pro/loader.js`                 | Framework-independent browser bridge           | [Docs](https://heroui.pro/docs/agents/installation)                                                      |
+| [`@heroui/agent/server`](#herouiagentserver) | Framework-independent auth-token server helper | [Docs](https://heroui.pro/docs/agents/identifying-users)                                                 |
 
 ## Package Details
 
 ### @heroui/agent
 
-The core React SDK for embedding a hosted agent.
+The typed React bridge for embedding the hosted Agent iframe.
 
 #### Features
 
@@ -85,7 +149,7 @@ The core React SDK for embedding a hosted agent.
 - **Client tools** — Typed browser functions that run with the signed-in user's session
 - **Dashboard-driven appearance** — Theme, launcher, greeting, subtitle, and composer without a redeploy
 - **Anonymous → identified** — Merge guest history when the user signs in
-- **Edge-safe contracts** — Protocol types with no Node built-ins
+- **Shared host core** — React, Next.js, and the CDN loader use the same iframe bridge
 
 #### Installation
 
@@ -109,27 +173,6 @@ Server-only helpers for exchanging a project API key for a short-lived browser c
 import {createAuthToken} from "@heroui/agent/server";
 ```
 
-### Styles
-
-```css
-@import "@heroui/agent/css";
-```
-
-Optional Pro theme variants (`brutalism`, `glass`, `mouve`) ship from [`@heroui-pro/react`](https://heroui.pro/docs):
-
-```tsx
-import "@heroui/agent/css";
-import "@heroui-pro/react/agent-themes/glass";
-```
-
-### Contracts
-
-Shared protocol version, message types, and schemas used by the SDK and hosted API.
-
-```ts
-import {HEROUI_AGENT_PROTOCOL_VERSION} from "@heroui/agent/contracts";
-```
-
 ## Client Tools
 
 Client tools let the agent call into your application — fetch data, change filters, create records:
@@ -150,60 +193,68 @@ const tools = [
 ];
 
 <HeroUIAgent
-  agentId={process.env.NEXT_PUBLIC_HEROUI_AGENT_ID!}
+  agentId={process.env.HEROUI_AGENT_ID!}
   getAuthToken={getAuthToken}
   context={{apiClient}}
   tools={tools}
 />;
 ```
 
-Only tool names, descriptions, and JSON schemas reach the hosted agent. Implementations and `context` never leave the browser.
+Tool manifests, JSON-safe page context, and validated tool results cross the iframe boundary. Tool
+implementations, API clients, routers, state setters, and the rest of `context` stay in the browser.
 
-[Learn more](https://heroui.pro/docs/agent/api-reference/client-tools)
+[Learn more](https://heroui.pro/docs/agents/api-reference/client-tools)
 
 ## Documentation
 
-- [Installation](https://heroui.pro/docs/agent/getting-started/installation)
-- [Identifying users](https://heroui.pro/docs/agent/getting-started/identifying-users)
-- [Configuration](https://heroui.pro/docs/agent/api-reference/configuration)
-- [Client tools](https://heroui.pro/docs/agent/api-reference/client-tools)
-- [Appearance](https://heroui.pro/docs/agent/configure/appearance)
-- [Configure](https://heroui.pro/docs/agent/configure)
+- [Installation](https://heroui.pro/docs/agents/installation)
+- [Identifying users](https://heroui.pro/docs/agents/identifying-users)
+- [Configuration](https://heroui.pro/docs/agents/api-reference/configuration)
+- [Client tools](https://heroui.pro/docs/agents/api-reference/client-tools)
+- [Appearance](https://heroui.pro/docs/agents/configure/appearance)
+- [Configure](https://heroui.pro/docs/agents/configure)
 
 Projects and API keys are managed in the [Agents dashboard](https://heroui.pro/dashboard/agents).
 
 ## What runs where
 
-The HeroUI API authenticates the visitor once, verifies conversation ownership, and returns a
-one-use connection ticket. The browser then keeps a resumable WebSocket directly to the
-conversation's Cloudflare Durable Object. That object owns the transcript, streams from the model
-provider, and starts MCP or an offline, per-call-scoped sandbox only when a tool actually needs
-one. Before the composer clears, the SDK durably stores the submitted turn and attachment blobs in
-an identity-and-conversation-scoped IndexedDB outbox. It removes that entry only after the Durable
-Object acknowledges committed admission, and reconciles the same `turnId` after a reload. InstantDB
-is updated asynchronously for dashboard monitoring and never sits in front of a response stream.
-
-| In the browser                              | At the HeroUI edge runtime                   |
-| ------------------------------------------- | -------------------------------------------- |
-| Panel, theme, composer, generated UI        | Conversation Durable Object and model stream |
-| Client tools, running as the signed-in user | Server tools, lazy MCP and offline Python    |
-| Pre-admission IndexedDB turn outbox         | SDK transcript and resumable stream storage  |
-| A short-lived HeroUI browser credential     | Hashed tickets, credit lease, Queue outbox   |
+The npm package creates a cross-origin iframe at `agent.heroui.pro` and keeps the customer-product
+trust boundary in the parent page. A versioned `heroui-agent-bridge/v1` handshake exchanges the
+browser credential for a short-lived iframe session bound to both origins. Credentials never appear
+in the iframe URL.
+
+| In the customer page                          | In the hosted iframe and edge runtime         |
+| --------------------------------------------- | --------------------------------------------- |
+| Client tool functions and product context     | Panel, composer, Markdown, and generated UI   |
+| Navigation, mutations, and approval effects   | Approval, progress, result, and error cards   |
+| Identity, drafts, attachments, durable outbox | Conversation Durable Object and model stream  |
+| Outside clicks, page margin, focus, z-index   | Server tools, lazy MCP, PDF/XLSX, and sandbox |
+
+Add the iframe origin to your Content Security Policy:
+
+```http
+Content-Security-Policy: frame-src https://agent.heroui.pro
+```
+
+When using the CDN loader, allow the same origin in `script-src`:
+
+```http
+Content-Security-Policy: frame-src https://agent.heroui.pro; script-src 'self' https://agent.heroui.pro
+```
 
 ## Compatibility
 
-- React 19+
-- Next.js 15+ for `@heroui/agent/next`
+- Any modern website through `agent.heroui.pro/loader.js`
+- React 19+ only when using `@heroui/agent`
+- Next.js 15+ only when using `@heroui/agent/next`
 - Chrome/Edge 120+, Firefox 121+, Safari 17.2+
-- ESM only
-
-This SDK speaks protocol version `6`. The hosted API returns `426 Upgrade Required` when a beta SDK is no longer compatible.
+- ESM-only npm entry points; the CDN loader is a classic browser script
 
 ## Support
 
-- [Documentation](https://heroui.pro/docs/agent)
+- [Documentation](https://heroui.pro/docs/agents)
 - [Agents product](https://heroui.pro/agents)
-- [Issues](https://github.com/heroui-inc/heroui-platform/issues)
+- [Issues](https://github.com/heroui-inc/heroui-pro/issues)
 - [Discord](https://discord.gg/9b6yyZKmH4)
 
 ## License

package/dist/chunk-6O4WPQKO.js

@@ -0,0 +1 @@
+import{b as B}from"./chunk-KGJ6UDTY.js";import{c as q,e as G,f as K,i as J,j as V,k as Y}from"./chunk-SWO2ABN5.js";function X(e){return`heroui-agent:anonymous:${e}`}function de(e){return e instanceof Error?e:new Error("Auth token request failed")}var S=class{constructor(t,n){this.agentId=t;this.getAuthToken=n}cached=null;failure=null;generation=0;pending=null;clear(){this.generation+=1,this.cached=null,this.failure=null,this.pending=null}reset(){this.clear();try{localStorage.removeItem(X(this.agentId))}catch{}}async get(){if(this.cached&&this.expiresAt(this.cached)>Date.now()+6e4)return this.cached.token;if(!this.pending&&this.failure&&Date.now()<this.failure.retryAt)throw this.failure.error;let t=this.generation,n=this.pending??this.refresh();this.pending||(this.pending=n);try{let i=await n;return t!==this.generation?this.get():(this.cached=i,this.failure=null,i.token)}catch(i){throw t===this.generation&&(this.failure={error:de(i),retryAt:Date.now()+5e3}),i}finally{this.pending===n&&(this.pending=null)}}async subjectHash(){let t=await this.get(),n=ce(t),i=typeof n.sub=="string"?n.sub:"anonymous",l=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(`${this.agentId}:${i}`));return Array.from(new Uint8Array(l),u=>u.toString(16).padStart(2,"0")).join("").slice(0,24)}anonymousId(){let t=X(this.agentId);try{let n=localStorage.getItem(t);if(n)return n;let i=crypto.randomUUID();return localStorage.setItem(t,i),i}catch{return crypto.randomUUID()}}expiresAt(t){return t.expiresAt}async refresh(){let t=await this.getAuthToken({agentId:this.agentId,anonymousId:this.anonymousId()});if(!t||typeof t.token!="string"||!t.token.trim()||typeof t.expiresAt!="number"||!Number.isFinite(t.expiresAt)||t.expiresAt<=0)throw new Error("Auth token callback returned invalid data");return{expiresAt:t.expiresAt,token:t.token}}};function ce(e){try{let t=e.split(".")[1];if(!t)return{};let n=t.replace(/-/g,"+").replace(/_/g,"/"),i=n.padEnd(Math.ceil(n.length/4)*4,"=");return JSON.parse(atob(i))}catch{return{}}}function Q(e){return{bounds:null,closing:!1,dragging:!1,expanded:e.appearance?.panel?.expanded??!1,mounted:!1,open:!1,overlayOpen:!1,ready:!1,resizing:!1,sidebarWidth:null,viewMode:e.appearance?.viewMode??"floating"}}function y(e,t,n){return{background:"transparent",border:"0",clipPath:ue(e,t,n),colorScheme:"normal",height:"100dvh",inset:"0",position:"fixed",width:"100vw",zIndex:t.appearance?.zIndex??40}}function Z(e){if(!e||typeof e!="object")return null;let t=e;return typeof t.open!="boolean"||typeof t.ready!="boolean"||typeof t.expanded!="boolean"||t.viewMode!=="floating"&&t.viewMode!=="sidebar"?null:{bounds:pe(t.bounds),closing:t.closing===!0,dragging:t.dragging===!0,expanded:t.expanded,mounted:t.mounted!==!1,open:t.open,overlayOpen:t.overlayOpen===!0,ready:t.ready,resizing:t.resizing===!0,sidebarWidth:H(t.sidebarWidth)?t.sidebarWidth:null,viewMode:t.viewMode}}function ee(){let e=document.documentElement,t=document.body;return{active:!1,body:t,original:{bodyLeft:t.style.left,bodyOverflow:t.style.overflow,bodyPosition:t.style.position,bodyRight:t.style.right,bodyTop:t.style.top,bodyWidth:t.style.width,rootMarginRight:e.style.marginRight,rootOverflow:e.style.overflow,rootTransition:e.style.transition},root:e,scrollLock:null}}function x(e,t,n,i){let l=t.open||t.closing;if(!l&&!e.active)return;l&&(e.active=!0);let u=l&&(i||t.viewMode==="sidebar"&&t.expanded);ne(e,u);let a=l&&t.viewMode==="sidebar"&&!t.expanded&&!i?ge(t,n):e.original.rootMarginRight;e.root.style.transition=e.original.rootTransition,e.root.style.marginRight=a,l||(e.active=!1)}function te(e){ne(e,!1),e.root.style.marginRight=e.original.rootMarginRight,e.root.style.transition=e.original.rootTransition,e.active=!1}function ue(e,t,n){let i=e.open||e.closing;if(i&&(n||e.overlayOpen))return"inset(0px)";if(e.bounds)return`inset(${e.bounds.top}px calc(100% - ${e.bounds.right}px) calc(100% - ${e.bounds.bottom}px) ${e.bounds.left}px)`;let l=t.appearance?.launcher,u=l?.position==="bottom-left",p=(l?.offset?.x??24)+60,a=(l?.offset?.y??24)+60;if(!i)return u?`inset(calc(100% - ${a}px) calc(100% - ${p}px) 0px 0px)`:`inset(calc(100% - ${a}px) 0px 0px calc(100% - ${p}px))`;if(e.viewMode==="sidebar")return`inset(0px 0px 0px calc(100% - (${M(t.appearance?.panel?.initialWidth??420)} + 16px)))`;let h=M(t.appearance?.panel?.initialWidth??440),E=`calc(100% - min(calc(${M(t.appearance?.panel?.initialHeight??"max(420px, 56dvh)")} + 32px), 100dvh))`;return u?`inset(${E} calc(100% - min(calc(${h} + 32px), 100vw)) 0px 0px)`:`inset(${E} 0px 0px calc(100% - min(calc(${h} + 32px), 100vw)))`}function pe(e){if(!e||typeof e!="object")return null;let t=e;return!H(t.top)||!H(t.right)||!H(t.bottom)||!H(t.left)||t.right<t.left||t.bottom<t.top?null:{bottom:t.bottom,left:t.left,right:t.right,top:t.top}}function H(e){return typeof e=="number"&&Number.isFinite(e)&&e>=0&&e<=1e5}function ge(e,t){return e.sidebarWidth===null?M(t.appearance?.panel?.initialWidth??420):`${Math.round(e.sidebarWidth)}px`}function M(e){return typeof e=="number"?`${Math.round(e)}px`:e}function ne(e,t){if(t&&!e.scrollLock){e.scrollLock={x:window.scrollX,y:window.scrollY},e.root.style.overflow="hidden",e.body.style.overflow="hidden",e.body.style.position="fixed",e.body.style.top=`${-e.scrollLock.y}px`,e.body.style.left=`${-e.scrollLock.x}px`,e.body.style.right="0",e.body.style.width="100%";return}if(!t&&e.scrollLock){let{x:n,y:i}=e.scrollLock;e.root.style.overflow=e.original.rootOverflow,e.body.style.overflow=e.original.bodyOverflow,e.body.style.position=e.original.bodyPosition,e.body.style.top=e.original.bodyTop,e.body.style.left=e.original.bodyLeft,e.body.style.right=e.original.bodyRight,e.body.style.width=e.original.bodyWidth,e.scrollLock=null;try{window.scrollTo(n,i)}catch{}}}var fe=16*1024,he=64*1024;function Oe(e,t){let n=e;if(!n?.agentId||typeof n.getAuthToken!="function")throw new Error("HeroUIAgent.mount requires agentId and getAuthToken");let i=crypto.randomUUID(),l=crypto.randomUUID(),u=(n._api?.baseUrl??B).replace(/\/$/,""),p=Ie(u,n._api?.embedOrigin),a=document.createElement("iframe"),h=new Map,w=[],E=new Set,b=new Map,k=new Set,v=ee(),P=new S(n.agentId,n.getAuthToken),s=Q(n),W=null,m=!1,A=!1,I=null,U=!1,C=!1,_=new URL("/embed",p);_.searchParams.set("agentId",n.agentId),_.hash=new URLSearchParams({nonce:l,parentOrigin:window.location.origin,sessionId:i}).toString(),a.allow="microphone; clipboard-write",a.referrerPolicy="origin",a.setAttribute("sandbox","allow-downloads allow-forms allow-popups allow-popups-to-escape-sandbox allow-same-origin allow-scripts"),a.src=_.toString(),a.title="HeroUI Agent",Object.assign(a.style,y(s,n,window.innerWidth<640)),document.body.append(a);let g=(o,r,d)=>{C||a.contentWindow?.postMessage(J(i,l,o,r,d),p)},ie=(o,r)=>{let d=crypto.randomUUID();return new Promise((c,f)=>{let F=window.setTimeout(()=>{h.delete(d),f(new Error(`HeroUI Agent iframe request timed out: ${o}`))},3e4);h.set(d,{reject:f,resolve:c,timer:F}),g(o,r,d)})},$=0,N="",z=async(o,r=!1)=>{let d=++$,c=await ye(n,t);if(C||d!==$)return;let f=JSON.stringify({props:c.props,tools:c.tools});!r&&f===N||(N=f,g(o,c))},T=(o,r)=>{if(!s.mounted){w.push({name:o,payload:r}),w.length>32&&w.shift();return}g("host.command",{name:o,payload:r})},O=o=>{m=o,o||(A=!1),T(o?"show":"hide")},se=()=>{if(s.mounted)for(let o of w.splice(0))g("host.command",o)},ae=()=>{A=s.mounted&&m&&!s.closing,s={...s,bounds:null,closing:!1,mounted:!1,open:A,ready:!1},U=!1;for(let o of k)o();Object.assign(a.style,y(s,n,window.innerWidth<640)),x(v,s,n,window.innerWidth<640)},D=o=>{if(o.origin!==p||o.source!==a.contentWindow)return;let r=V(o.data);if(!(!r||r.sessionId!==i||r.nonce!==l)){if(r.type==="iframe.rpc-result"||r.type==="iframe.rpc-error"){we(r,h);return}Ae(E,r.requestId)&&le(r)}},le=async o=>{try{if(o.type==="iframe.ready"){(s.mounted||s.ready)&&ae(),await z("host.init",!0);return}if(o.type==="iframe.state"){let r=Z(o.payload);if(r){let d=s.open||s.closing,c=r;A?r.mounted?(A=!1,r.open||(g("host.command",{name:"show"}),c={...r,bounds:null,closing:!1,open:!0,sidebarWidth:r.sidebarWidth??s.sidebarWidth})):c={...r,bounds:null,closing:!1,open:!0,sidebarWidth:r.sidebarWidth??s.sidebarWidth}:r.open?m=!0:(r.closing||s.open||s.closing)&&(m=!1);let f=c.open||c.closing;f&&!d&&(W=document.activeElement),!f&&d&&W?.focus({preventScroll:!0}),s=c,f&&s.expanded?a.dataset.expanded="true":a.removeAttribute("data-expanded");for(let F of k)F();Object.assign(a.style,y(s,n,window.innerWidth<640)),x(v,s,n,window.innerWidth<640),se(),s.ready&&!U&&(U=!0,n.onReady?.())}return}if(o.type==="iframe.auth-request"){let r=await P.get(),d=await fetch(`${u}/v1/agents/${encodeURIComponent(n.agentId)}/embed-sessions`,{body:JSON.stringify({iframeOrigin:p,sessionId:i}),cache:"no-store",headers:{Authorization:`Bearer ${r}`,"Content-Type":"application/json"},method:"POST"});if(!d.ok)throw new Error("Unable to create HeroUI Agent iframe session");g("host.rpc-result",{value:await d.json()},o.requestId);return}if(o.type==="iframe.context-request"){let r=await n.context?.page?.()??{};re(r,fe,"Agent page context"),g("host.rpc-result",{value:r},o.requestId);return}if(o.type==="iframe.tool-execute"){let r=be(o.payload),d=n.tools?.find(f=>f.name===r.name);if(!d)throw new Error(`Unknown client tool: ${r.name}`);let c=b.get(r.idempotencyKey);c||(c=me(d,r,n,ie),b.set(r.idempotencyKey,c),b.size>2048&&b.delete(b.keys().next().value)),g("host.rpc-result",{value:await c},o.requestId);return}if(o.type==="iframe.feedback"){await n.onFeedback?.(o.payload);return}if(o.type==="iframe.storage"){ve(o.payload);return}if(o.type==="iframe.persistence"){let r=await import("./persistence-YI6JSYCT.js").then(({executeAgentHostPersistence:d})=>d(n.agentId,o.payload));g("host.rpc-result",{value:r},o.requestId)}}catch(r){console.error("HeroUI Agent bridge request failed",r),g("host.rpc-error",{error:r instanceof Error?r.message:"Request failed"},o.requestId)}},j=o=>{o.composedPath().includes(a)||s.open&&s.viewMode==="floating"&&(n.appearance?.shouldCloseOnInteractOutside??!0)&&O(!1)},L=()=>{s={...s,bounds:null},Object.assign(a.style,y(s,n,window.innerWidth<640)),x(v,s,n,window.innerWidth<640)},R=()=>{document.visibilityState==="visible"&&(s={...s,bounds:null},Object.assign(a.style,y(s,n,window.innerWidth<640)),x(v,s,n,window.innerWidth<640),m&&s.mounted&&g("host.command",{name:"show"}),I!==null&&window.cancelAnimationFrame(I),I=window.requestAnimationFrame(()=>{I=null,Object.assign(a.style,y(s,n,window.innerWidth<640))}))};return window.addEventListener("message",D),window.addEventListener("pointerdown",j,!0),window.addEventListener("resize",L),window.addEventListener("pageshow",R),window.visualViewport?.addEventListener("resize",L),document.addEventListener("visibilitychange",R),{destroy:()=>{C=!0,window.removeEventListener("message",D),window.removeEventListener("pointerdown",j,!0),window.removeEventListener("resize",L),window.removeEventListener("pageshow",R),window.visualViewport?.removeEventListener("resize",L),document.removeEventListener("visibilitychange",R),I!==null&&window.cancelAnimationFrame(I);for(let o of h.values())window.clearTimeout(o.timer),o.reject(new Error("HeroUI Agent iframe was removed"));h.clear(),w.length=0,k.clear(),te(v),a.remove()},hide:()=>O(!1),newConversation:o=>{m=!0,T("newConversation",{prompt:o})},preload:()=>T("preload"),get ready(){return s.ready},refreshAuth:()=>{P.clear(),T("refreshAuth")},show:()=>O(!0),shutdown:()=>{m=!1,A=!1,P.reset(),T("shutdown")},subscribe:o=>(k.add(o),()=>k.delete(o)),toggle:()=>O(!m),update:o=>{if(o.agentId!==n.agentId)throw new Error("HeroUI Agent agentId cannot change without remounting");o.getAuthToken!==n.getAuthToken&&(P=new S(o.agentId,o.getAuthToken)),n=o,Object.assign(a.style,y(s,n,window.innerWidth<640)),x(v,s,n,window.innerWidth<640),s.ready&&z("host.update")}}}async function me(e,t,n,i){let l={conversationId:t.conversationId,idempotencyKey:t.idempotencyKey,toolCallId:t.toolCallId,uploadDataSource:async p=>await i("host.upload-data-source",{toolCallId:t.toolCallId,upload:p})},u=await e.execute(q(e,t.args),n.context??{},l)??null;return re(u,he,`Client tool ${e.name} result`),u}async function ye(e,t){let{context:n,getAuthToken:i,onFeedback:l,onReady:u,tools:p,...a}=e,h=await t(p??[]);return{localStorage:oe(window.localStorage),props:JSON.parse(JSON.stringify(a)),sessionStorage:oe(window.sessionStorage),tools:h}}function we(e,t){let n=t.get(e.requestId);if(n)if(t.delete(e.requestId),window.clearTimeout(n.timer),e.type==="iframe.rpc-error"){let i=e.payload;n.reject(new Error(typeof i?.error=="string"?i.error:"Iframe request failed"))}else{let i=e.payload;n.resolve(i?.value)}}function be(e){if(!e||typeof e!="object")throw new Error("Invalid client tool request");let t=e;if(typeof t.conversationId!="string"||typeof t.idempotencyKey!="string"||typeof t.name!="string"||typeof t.toolCallId!="string")throw new Error("Invalid client tool request");return t}function re(e,t,n){if(!Y(e))throw new Error(`${n} must be JSON-serializable`);if(new TextEncoder().encode(JSON.stringify(e)).byteLength>t)throw new Error(`${n} exceeds ${Math.round(t/1024)} KiB`)}function oe(e){let t={};try{for(let n=0;n<e.length;n+=1){let i=e.key(n);i?.startsWith("heroui-agent:")&&(t[i]=e.getItem(i)??"")}}catch{}return t}function ve(e){if(!e||typeof e!="object")return;let t=e;if(typeof t.key=="string"&&!t.key.startsWith("heroui-agent:"))return;let n=t.storage==="session"?sessionStorage:localStorage;try{if(t.operation==="set"&&typeof t.key=="string"&&typeof t.value=="string")n.setItem(t.key,t.value);else if(t.operation==="remove"&&typeof t.key=="string")n.removeItem(t.key);else if(t.operation==="clear")for(let i=n.length-1;i>=0;i-=1){let l=n.key(i);l?.startsWith("heroui-agent:")&&n.removeItem(l)}}catch{}}function Ae(e,t){return e.has(t)?!1:(e.add(t),e.size>2048&&e.delete(e.values().next().value),!0)}function Ie(e,t){if(t){let n=new URL(t);if(n.protocol!=="http:"&&n.protocol!=="https:")throw new Error("HeroUI Agent embed origin must use HTTP or HTTPS");return n.origin}return/^https?:\/\/(?:localhost|127\.0\.0\.1)(?::\d+)?$/i.test(e)?"http://localhost:8793":e.includes("staging")?K:G}export{S as a,Oe as b};

package/dist/chunk-7OTMWVOC.js

@@ -0,0 +1 @@
+var c={animation:"fadeIn",duration:160,easing:"ease-out",sep:"word",stagger:18};var A=5,l=10485760,r={"application/epub+zip":"epub","application/json":"json","application/msword":"doc","application/pdf":"pdf","application/rtf":"rtf","application/vnd.ms-excel":"xls","application/vnd.ms-excel.sheet.binary.macroenabled.12":"xlsb","application/vnd.ms-excel.sheet.macroenabled.12":"xlsm","application/vnd.ms-powerpoint":"ppt","application/vnd.ms-powerpoint.presentation.macroenabled.12":"pptm","application/vnd.ms-word.document.macroenabled.12":"docm","application/vnd.oasis.opendocument.presentation":"odp","application/vnd.oasis.opendocument.spreadsheet":"ods","application/vnd.oasis.opendocument.text":"odt","application/vnd.openxmlformats-officedocument.presentationml.presentation":"pptx","application/vnd.openxmlformats-officedocument.spreadsheetml.sheet":"xlsx","application/vnd.openxmlformats-officedocument.wordprocessingml.document":"docx","image/gif":"gif","image/jpeg":"jpg","image/png":"png","image/webp":"webp","text/csv":"csv","text/html":"html","text/markdown":"md","text/plain":"txt","text/rtf":"rtf","text/tab-separated-values":"tsv"},a=Object.freeze(Object.keys(r)),d=a.join(","),i=Object.freeze({...Object.fromEntries(Object.entries(r).map(([e,t])=>[t,e])),htm:"text/html",xhtml:"text/html"}),p=new Set(a),m=new Set(["application/json","text/csv","text/markdown","text/plain","text/tab-separated-values"]);function s(e){return p.has(e.trim().toLowerCase())}function T(e,t){let n=e.trim().toLowerCase();if(s(n))return n;let o=t.trim().toLowerCase().match(/\.([a-z0-9]+)$/)?.[1];return o?i[o]??null:null}export{c as a,A as b,l as c,r as d,a as e,d as f,i as g,m as h,s as i,T as j};

package/dist/chunk-KGJ6UDTY.js

@@ -0,0 +1 @@
+var t="1.0.0-beta.5",o="https://api.heroui.pro";export{t as a,o as b};

package/dist/chunk-PKCBDTYR.js

@@ -0,0 +1 @@
+import{b as i,k as a}from"./chunk-SWO2ABN5.js";import{z as t}from"zod";var c=["callMcpTool","composeUI","executeSandbox","generateFile","getComponentSchema","renderComponent","searchKnowledge","searchMcpTools","searchWeb"],m="mcp_",p=20,l=16*1024,d=t.object({description:t.string().trim().min(1).max(1e3),inputSchema:t.record(t.string(),t.unknown()),name:t.string().regex(/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/).refine(e=>!c.includes(e)&&!e.toLowerCase().startsWith(m),"Client tool name is reserved by the HeroUI Agent runtime"),needsApproval:t.boolean().optional()}),f=t.array(d).max(p).superRefine((e,n)=>{let o=new Set;for(let r of e)o.has(r.name)&&n.addIssue({code:"custom",message:`Duplicate client tool name: ${r.name}`}),o.add(r.name);new TextEncoder().encode(JSON.stringify(e)).byteLength>l&&n.addIssue({code:"custom",message:"Client tool manifest exceeds 16KB"})});function u(e){let n=i(e.parameters)?t.toJSONSchema(e.parameters):e.parameters;if(!a(n))throw new Error(`Client tool ${e.name} parameters must be a JSON-serializable schema`);return s(n)}function s(e){return Array.isArray(e)?e.map(s):e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([n,o])=>[n,s(o)])):e}function E(e){return f.parse(e.map(n=>({description:n.description,inputSchema:u(n),name:n.name,...n.needsApproval?{needsApproval:!0}:{}})))}export{c as a,m as b,p as c,l as d,d as e,f,E as g};

package/dist/chunk-PX3X4VP2.js

@@ -0,0 +1 @@
+import{b as E}from"./chunk-6O4WPQKO.js";import{b as p}from"./chunk-SWO2ABN5.js";import{useEffect as S,useLayoutEffect as d,useMemo as x,useRef as u,useState as b,useSyncExternalStore as H}from"react";var s=new Map,m=new Set;function T(){for(let e of m)e()}function k(e){return m.add(e),()=>m.delete(e)}function l(e,o,r){let n=e?s.get(e):[...s.values()][s.size-1];if(!n){console.warn("HeroUI Agent is not mounted yet. Add <HeroUIAgent /> to your layout.");return}o==="newConversation"?n.newConversation(r):n[o]()}function D(e){let o=H(k,()=>(e?s.get(e):[...s.values()].at(-1))?.ready??!1,()=>!1);return x(()=>({hide:()=>l(e,"hide"),newConversation:r=>l(e,"newConversation",r),preload:()=>l(e,"preload"),ready:o,refreshAuth:()=>l(e,"refreshAuth"),show:()=>l(e,"show"),shutdown:()=>l(e,"shutdown"),toggle:()=>l(e,"toggle")}),[e,o])}async function G(e){let{serializeClientTools:o}=await import("./client-tools-manifest-62CRLCZY.js");return o(e).map(n=>{let i=e.find(a=>a.name===n.name);return{...n,...i?.displayName?{displayName:i.displayName}:{},...i?.icon?{icon:i.icon}:{},...i?.iconColor?{iconColor:i.iconColor}:{}}})}function R(e){let o=u(e),r=u(null),n=u(null);d(()=>{o.current=e}),n.current||(n.current={getAuthToken:t=>o.current.getAuthToken(t),onFeedback:t=>o.current.onFeedback?.(t),onReady:()=>o.current.onReady?.()},Object.defineProperties(n.current,{context:{enumerable:!0,get(){return o.current.context}},tools:{enumerable:!0,get(){return o.current.tools}}}));let i=y(e),a=n.current;for(let t of Object.keys(a))t!=="context"&&t!=="getAuthToken"&&t!=="onFeedback"&&t!=="onReady"&&t!=="tools"&&!(t in i)&&delete a[t];Object.assign(a,i,{agentId:e.agentId});let g=n.current;d(()=>{let t=E(g,G),A=t.subscribe(T);return r.current=t,s.set(e.agentId,t),T(),()=>{A(),t.destroy(),s.get(e.agentId)===t&&s.delete(e.agentId),r.current===t&&(r.current=null),T()}},[e.agentId]);let[N,h]=b("");S(()=>{let t=e.tools??[];if(!t.some(c=>p(c.parameters))){h("");return}let A=!1;return import("./client-tools-manifest-62CRLCZY.js").then(({serializeClientTools:c})=>{A||h(JSON.stringify(c(t).map(f=>({inputSchema:f.inputSchema,name:f.name}))))}),()=>{A=!0}},[e.tools]);let M=JSON.stringify({props:y(e),tools:(e.tools??[]).map(t=>({description:t.description,displayName:t.displayName,icon:t.icon,iconColor:t.iconColor,name:t.name,needsApproval:t.needsApproval===!0,parameters:p(t.parameters)?null:t.parameters})),zodToolsSchemasKey:N});return d(()=>{r.current?.update(g)},[M]),null}function y(e){let{context:o,getAuthToken:r,onFeedback:n,onReady:i,tools:a,...g}=e;return JSON.parse(JSON.stringify(g))}var _=["moonshotai/Kimi-K3","openai/gpt-5.6-luna","openai/gpt-5.6-terra","openai/gpt-5.6-sol","google/gemini-3.7-flash","anthropic/claude-sonnet-5","anthropic/claude-opus-4.8"],C={"google/gemini-3.5-flash":"google/gemini-3.7-flash","google/gemini-3.6-flash":"google/gemini-3.7-flash"};function I(e){return C[e]??e}var w="google/gemini-3.7-flash",O=[{description:"Flagship model for coding, reasoning, and knowledge work",id:"moonshotai/Kimi-K3",label:"Kimi K3",provider:"Moonshot AI",tier:"light"},{description:"Fast answers and lightweight agent workflows",id:"openai/gpt-5.6-luna",label:"GPT-5.6 Luna",provider:"OpenAI",tier:"light"},{description:"Balanced reasoning for everyday agent tasks",id:"openai/gpt-5.6-terra",label:"GPT-5.6 Terra",provider:"OpenAI",tier:"codegen"},{description:"Deep reasoning for complex, multi-step analysis",id:"openai/gpt-5.6-sol",label:"GPT-5.6 Sol",provider:"OpenAI",tier:"complex"},{description:"Fast multimodal analysis with a large context window",id:"google/gemini-3.7-flash",label:"Gemini 3.7 Flash",provider:"Google",tier:"light"},{description:"Strong agentic reasoning and polished UI decisions",id:"anthropic/claude-sonnet-5",label:"Claude Sonnet 5",provider:"Anthropic",tier:"codegen"},{description:"Highest-capability Claude for difficult research and analysis",id:"anthropic/claude-opus-4.8",label:"Claude Opus 4.8",provider:"Anthropic",tier:"complex"}],P=new Set(_);function U(e){return typeof e=="string"&&P.has(e)}function v(e){let o=e?I(e):void 0;return O.find(r=>r.id===o)?.tier??"light"}var L=["base","brutalism","glass","mouve"];export{D as a,R as b,_ as c,C as d,I as e,w as f,O as g,U as h,v as i,L as j};

package/dist/chunk-SWO2ABN5.js

@@ -0,0 +1 @@
+function g(){return function(t){return t}}function a(e){return!!(e&&typeof e=="object"&&typeof e.safeParse=="function")}function u(e,t){return a(e.parameters)?e.parameters.parse(t):t}function l(e,t){let n=e.get(t);return!n||n.needsApproval?null:n}var f="https://agent.heroui.pro",y="https://staging-agent.heroui.pro",T=262144,A=57671680;function m(e,t,n,o,r=crypto.randomUUID()){return{nonce:t,...o===void 0?{}:{payload:o},requestId:r,sessionId:e,type:n}}function E(e){if(!e||typeof e!="object")return null;let t=e;if(typeof t.sessionId!="string"||!i(t.sessionId)||typeof t.nonce!="string"||!i(t.nonce)||typeof t.requestId!="string"||!i(t.requestId)||typeof t.type!="string"||t.type.length===0||t.type.length>80)return null;let n=t.type==="iframe.persistence"||t.type==="host.upload-data-source"||t.type==="host.rpc-result"?57671680:262144;return c(e)>n?null:{nonce:t.nonce,...Object.hasOwn(t,"payload")?{payload:t.payload}:{},requestId:t.requestId,sessionId:t.sessionId,type:t.type}}function p(e,t=new Set){if(e===null||typeof e=="string"||typeof e=="boolean")return!0;if(typeof e=="number")return Number.isFinite(e);if(typeof e!="object"||t.has(e))return!1;t.add(e);let n=Array.isArray(e)?e.every(o=>p(o,t)):Object.getPrototypeOf(e)===Object.prototype&&Object.values(e).every(o=>p(o,t));return t.delete(e),n}function c(e){return s(e,new Set)}function s(e,t){if(e==null)return 4;if(typeof e=="string")return new TextEncoder().encode(e).byteLength+2;if(typeof e=="boolean"||typeof e=="number")return 8;if(typeof e!="object"||t.has(e))return Number.POSITIVE_INFINITY;if(e instanceof ArrayBuffer||ArrayBuffer.isView(e))return e.byteLength;if(typeof Blob<"u"&&e instanceof Blob)return e.size;t.add(e);let n=2;for(let[o,r]of Object.entries(e))if(n+=s(o,t)+s(r,t),!Number.isFinite(n))break;return t.delete(e),n}function i(e){return e.length>0&&e.length<=128&&/^[A-Za-z0-9._:-]+$/.test(e)}export{g as a,a as b,u as c,l as d,f as e,y as f,T as g,A as h,m as i,E as j,p as k,c as l};

package/dist/client-tools-manifest-62CRLCZY.js

@@ -0,0 +1 @@
+import{a,b,c,d,e,f,g}from"./chunk-PKCBDTYR.js";import"./chunk-SWO2ABN5.js";export{c as MAX_CLIENT_TOOLS,d as MAX_CLIENT_TOOLS_BYTES,a as RESERVED_AGENT_TOOL_NAMES,b as RESERVED_AGENT_TOOL_PREFIX,e as clientToolManifestEntrySchema,f as clientToolsSchema,g as serializeClientTools};