@zkly-superbuddy/embed-sdk 0.2.0

package/README.md

@@ -0,0 +1,99 @@
+# Agent OS Embed SDK
+
+Lightweight SDK for embedding Agent OS conversations in external web applications.
+The host page creates an iframe that loads the standalone frontend-embed chat page
+and communicates with it over `postMessage`.
+
+## Installation
+
+```bash
+npm install @agentos/embed-sdk
+```
+
+## Usage
+
+`createOpenConversation(config)` exchanges `appKey`/`appSecret` for an embed token
+(`POST {apiUrl}/open/v1/embed/session`) and returns a `Promise<EmbedInstance>`
+that resolves once the iframe has loaded and the embed page has posted its `ready`
+event. If the token exchange fails the promise rejects; if the ready event does
+not arrive within `readyTimeoutMs` (default 15000 ms) the promise rejects and the
+iframe is removed. Invalid configuration (missing container, mismatched origin)
+throws synchronously.
+
+```javascript
+import { createOpenConversation } from '@agentos/embed-sdk';
+
+const instance = await createOpenConversation({
+  appKey: '<app-key>',
+  appSecret: '<app-secret>',
+  container: '#agent-os-container',
+  expert: '42',                        // optional project/expert id
+  envVars: { MY_FLAG: 'on' },          // optional env vars for the task
+  autoResize: true,
+});
+
+instance.on('state', (event) => {
+  console.log('task state', event.payload);
+});
+
+instance.on('close', () => instance.destroy());
+
+// Send a control command to the embed page.
+instance.postMessage('close');
+```
+
+### Configuration
+
+| Option | Description |
+| --- | --- |
+| `appKey` | Application key (the tenant API key `name`). Used to exchange the embed token. |
+| `appSecret` | Application secret (the plaintext key returned once at API key creation). |
+| `embedUrl` | URL of the deployed embed page. Defaults to `https://superbuddy.top/open-conversation/`. |
+| `apiUrl` | Base URL of the Agent OS API for token exchange. Defaults to `https://superbuddy.top/company-os`. |
+| `container` | HTMLElement or CSS selector the iframe is appended to. |
+| `title` | Optional title, appended as `title`. Shown above the input box while the conversation has no messages. |
+| `expert` | Optional expert/project id, appended as `expert`. Effective only when the first message creates the task. |
+| `envVars` | Optional string map, appended as `env_vars` (JSON). Effective only when the first message creates the task. |
+| `capabilities` | Optional capability map, appended as `capabilities` (JSON). |
+| `conversationId` | Optional conversation id, appended as `conversation_id`. |
+| `origin` | Expected embed origin. Defaults to the origin of `embedUrl`. Use `'*'` to disable origin checks (not recommended). |
+| `width` / `height` | Initial iframe size. Defaults: `100%` width; height is `100%` when `autoResize` is on, otherwise `600px`. |
+| `autoResize` | When `true`, the iframe fills its container (width and height `100%`). The `resize` event is still forwarded to the host but no longer changes the iframe height. |
+### Events (iframe → host)
+
+All events are `{ version: 1, type, conversation_id?, payload?, error? }` objects.
+Subscribe with `instance.on(type, callback)` or `instance.on('*', callback)`;
+`on()` returns an unsubscribe function.
+
+| Type | Meaning |
+| --- | --- |
+| `ready` | Embed page loaded and initialized; resolves the `createOpenConversation` promise. |
+| `session` | Session/conversation established; carries `conversation_id`. |
+| `state` | Task/conversation state changed; details in `payload`. |
+| `error` | An error occurred; details in `error.code` / `error.message`. |
+| `close` | The embed requests to be closed; call `instance.destroy()`. |
+| `resize` | Content height changed; `payload.height` (px). Forwarded to the host; the SDK does not resize the iframe itself. |
+
+### Host → iframe
+
+`instance.postMessage(type, payload?)` sends `{ version: 1, type, payload }` to the
+iframe (e.g. `close` and other control commands).
+
+## Security
+
+Incoming messages are accepted only from the created iframe's `contentWindow` and,
+unless `origin: '*'` is configured, only when `message.origin` matches the embed
+origin. Outgoing messages are targeted at the same origin. Prefer the default
+strict origin checking over `'*'`.
+
+## Development
+
+```bash
+npm install
+npm run build       # rollup: dist/index.umd.js + dist/index.esm.js + dist/index.d.ts
+npm run typecheck   # tsc --noEmit
+```
+
+## License
+
+MIT

package/dist/index.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Agent OS Embed SDK
+ *
+ * Lightweight SDK for embedding Agent OS conversations in external web applications.
+ * The host page provides app_key/app_secret; the SDK exchanges them for an embed
+ * token via POST {apiUrl}/open/v1/embed/session, then creates an iframe loading
+ * the standalone embed chat page and communicates with it over postMessage.
+ */
+export interface OpenConversationConfig {
+    /** 应用 Key(租户 API 密钥的 name) */
+    appKey: string;
+    /** 应用 Secret(创建密钥时返回的明文 key) */
+    appSecret: string;
+    /** URL of the deployed embed page. Defaults to https://superbuddy.top/open-conversation/ */
+    embedUrl?: string;
+    /** Base URL of the Agent OS API used for token exchange. Defaults to https://superbuddy.top/company-os */
+    apiUrl?: string;
+    container: HTMLElement | string;
+    /** 标题,仅在对话还没有内容时显示在输入框上方 */
+    title?: string;
+    /** 专家归属(个人项目 project_id),仅首条消息创建任务时生效 */
+    expert?: string;
+    /** 环境变量字典,传递给本地任务的 task_vars,仅首条消息创建任务时生效 */
+    envVars?: Record<string, string>;
+    capabilities?: Record<string, unknown>;
+    conversationId?: string;
+    origin?: string;
+    width?: string;
+    height?: string;
+    sandbox?: string;
+    allow?: string;
+    /** Fill the parent container (width/height 100%) instead of tracking content height. */
+    autoResize?: boolean;
+    /** Maximum time (ms) to wait for the embed 'ready' event before rejecting. Defaults to 15000. */
+    readyTimeoutMs?: number;
+    onReady?: (event: EmbedEvent) => void;
+    onEvent?: (event: EmbedEvent) => void;
+    onError?: (event: EmbedEvent) => void;
+    onClose?: (event: EmbedEvent) => void;
+    /** Optional callback invoked when the iframe has loaded. */
+    onLoad?: () => void;
+}
+export type EmbedEventType = 'ready' | 'session' | 'state' | 'error' | 'close' | 'resize';
+export interface EmbedEvent {
+    version: 1;
+    type: EmbedEventType;
+    conversation_id?: string;
+    payload?: Record<string, unknown>;
+    error?: {
+        code: string;
+        message: string;
+    };
+}
+export interface EmbedInstance {
+    iframe: HTMLIFrameElement;
+    open(): void;
+    destroy(): void;
+    on(type: EmbedEventType | '*', callback: (event: EmbedEvent) => void): () => void;
+    postMessage(type: string, payload?: Record<string, unknown>): void;
+}
+/**
+ * Version information
+ */
+export declare const VERSION = "0.2.0";
+/**
+ * Exchanges app_key/app_secret for an embed token, creates the embed iframe and
+ * resolves once the embed page posts its 'ready' event (validated against the
+ * iframe window and origin). Rejects if the token exchange fails or the ready
+ * event does not arrive within `readyTimeoutMs` (default 15s).
+ */
+export declare function createOpenConversation(config: OpenConversationConfig): Promise<EmbedInstance>;

package/dist/index.esm.js

@@ -0,0 +1,142 @@
+/**
+ * Agent OS Embed SDK
+ *
+ * Lightweight SDK for embedding Agent OS conversations in external web applications.
+ * The host page provides app_key/app_secret; the SDK exchanges them for an embed
+ * token via POST {apiUrl}/open/v1/embed/session, then creates an iframe loading
+ * the standalone embed chat page and communicates with it over postMessage.
+ */
+/**
+ * Version information
+ */
+const VERSION = '0.2.0';
+const DEFAULT_READY_TIMEOUT_MS = 15000;
+const DEFAULT_EMBED_URL = 'https://superbuddy.top/open-conversation/';
+const DEFAULT_API_URL = 'https://superbuddy.top/company-os';
+/**
+ * Exchanges app_key/app_secret for an embed token, creates the embed iframe and
+ * resolves once the embed page posts its 'ready' event (validated against the
+ * iframe window and origin). Rejects if the token exchange fails or the ready
+ * event does not arrive within `readyTimeoutMs` (default 15s).
+ */
+async function createOpenConversation(config) {
+    if (!config.appKey || !config.appSecret)
+        throw new Error('appKey and appSecret are required');
+    const resolved = { ...config, embedUrl: config.embedUrl || DEFAULT_EMBED_URL };
+    const token = await exchangeEmbedToken(config);
+    const instance = buildInstance(resolved, token);
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const offReady = instance.on('ready', () => {
+            settled = true;
+            clearTimeout(timer);
+            offReady();
+            resolve(instance);
+        });
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            offReady();
+            instance.destroy();
+            reject(new Error(`Embed did not become ready within ${config.readyTimeoutMs || DEFAULT_READY_TIMEOUT_MS}ms`));
+        }, config.readyTimeoutMs || DEFAULT_READY_TIMEOUT_MS);
+    });
+}
+async function exchangeEmbedToken(config) {
+    const endpoint = `${(config.apiUrl || DEFAULT_API_URL).replace(/\/+$/, '')}/open/v1/embed/session`;
+    let response;
+    try {
+        response = await fetch(endpoint, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ app_key: config.appKey, app_secret: config.appSecret }),
+        });
+    }
+    catch (error) {
+        throw new Error(`Embed token request failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const data = await response.json().catch(() => undefined);
+    if (!response.ok) {
+        const detail = typeof data?.detail === 'string' ? data.detail : response.statusText;
+        throw new Error(`Embed token exchange failed (HTTP ${response.status}): ${detail}`);
+    }
+    if (typeof data?.access_token !== 'string' || !data.access_token) {
+        throw new Error('Embed token exchange response is missing access_token');
+    }
+    return data.access_token;
+}
+function buildInstance(config, token) {
+    if (typeof document === 'undefined')
+        throw new Error('createOpenConversation requires a browser');
+    const container = typeof config.container === 'string' ? document.querySelector(config.container) : config.container;
+    if (!(container instanceof HTMLElement))
+        throw new Error('Embed container was not found');
+    const targetOrigin = config.origin || new URL(config.embedUrl, window.location.href).origin;
+    if (targetOrigin !== '*' && new URL(config.embedUrl, window.location.href).origin !== targetOrigin) {
+        throw new Error('Embed origin must match embedUrl origin');
+    }
+    const iframe = document.createElement('iframe');
+    iframe.src = buildUrl(config, token);
+    iframe.title = 'Agent OS conversation';
+    iframe.style.width = config.width || '100%';
+    iframe.style.height = config.height || '100%';
+    iframe.style.border = '0';
+    iframe.setAttribute('allow', config.allow || 'clipboard-write');
+    iframe.setAttribute('sandbox', config.sandbox || 'allow-scripts allow-forms allow-same-origin');
+    const listeners = new Map();
+    let active = true;
+    const emit = (event) => {
+        listeners.get(event.type)?.forEach((callback) => callback(event));
+        listeners.get('*')?.forEach((callback) => callback(event));
+        if (event.type === 'ready')
+            config.onReady?.(event);
+        if (event.type === 'error')
+            config.onError?.(event);
+        if (event.type === 'close')
+            config.onClose?.(event);
+        config.onEvent?.(event);
+    };
+    const receive = (message) => {
+        if (!active || message.source !== iframe.contentWindow || (targetOrigin !== '*' && message.origin !== targetOrigin))
+            return;
+        const event = message.data?.type && message.data?.version === 1 ? message.data : undefined;
+        if (!event)
+            return;
+        // autoResize 模式下 iframe 始终 100% 占满父容器，不再按内容高度调整;
+        // resize 事件仍透传给宿主，由宿主自行决定是否响应。
+        emit(event);
+    };
+    iframe.addEventListener('load', () => config.onLoad?.(), { once: true });
+    window.addEventListener('message', receive);
+    const open = () => { if (!iframe.isConnected)
+        container.appendChild(iframe); };
+    const destroy = () => { if (!active)
+        return; active = false; window.removeEventListener('message', receive); listeners.clear(); iframe.remove(); };
+    open();
+    const postMessage = (type, payload = {}) => {
+        if (!active || !iframe.contentWindow)
+            return;
+        iframe.contentWindow.postMessage({ version: 1, type, payload }, targetOrigin === '*' ? '*' : targetOrigin);
+    };
+    return { iframe, open, destroy, postMessage, on(type, callback) { const set = listeners.get(type) || new Set(); set.add(callback); listeners.set(type, set); return () => set.delete(callback); } };
+}
+function buildUrl(config, token) {
+    const url = new URL(config.embedUrl, window.location.href);
+    url.searchParams.set('token', token);
+    if (config.conversationId)
+        url.searchParams.set('conversation_id', config.conversationId);
+    if (config.capabilities)
+        url.searchParams.set('capabilities', JSON.stringify(config.capabilities));
+    if (config.title)
+        url.searchParams.set('title', config.title);
+    if (config.expert)
+        url.searchParams.set('expert', config.expert);
+    if (config.envVars)
+        url.searchParams.set('env_vars', JSON.stringify(config.envVars));
+    // 显式传入宿主 origin，embed 页据此确定 postMessage 目标，不再依赖 document.referrer。
+    url.searchParams.set('origin', window.location.origin);
+    return url.toString();
+}
+
+export { VERSION, createOpenConversation };
+//# sourceMappingURL=index.esm.js.map

package/dist/index.esm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.esm.js","sources":["../src/index.ts"],"sourcesContent":["/**\n * Agent OS Embed SDK\n *\n * Lightweight SDK for embedding Agent OS conversations in external web applications.\n * The host page provides app_key/app_secret; the SDK exchanges them for an embed\n * token via POST {apiUrl}/open/v1/embed/session, then creates an iframe loading\n * the standalone embed chat page and communicates with it over postMessage.\n */\n\nexport interface OpenConversationConfig {\n  /** 应用 Key(租户 API 密钥的 name) */\n  appKey: string;\n  /** 应用 Secret(创建密钥时返回的明文 key) */\n  appSecret: string;\n  /** URL of the deployed embed page. Defaults to https://superbuddy.top/open-conversation/ */\n  embedUrl?: string;\n  /** Base URL of the Agent OS API used for token exchange. Defaults to https://superbuddy.top/company-os */\n  apiUrl?: string;\n  container: HTMLElement | string;\n  /** 标题,仅在对话还没有内容时显示在输入框上方 */\n  title?: string;\n  /** 专家归属(个人项目 project_id),仅首条消息创建任务时生效 */\n  expert?: string;\n  /** 环境变量字典,传递给本地任务的 task_vars,仅首条消息创建任务时生效 */\n  envVars?: Record<string, string>;\n  capabilities?: Record<string, unknown>;\n  conversationId?: string;\n  origin?: string;\n  width?: string;\n  height?: string;\n  sandbox?: string;\n  allow?: string;\n  /** Fill the parent container (width/height 100%) instead of tracking content height. */\n  autoResize?: boolean;\n  /** Maximum time (ms) to wait for the embed 'ready' event before rejecting. Defaults to 15000. */\n  readyTimeoutMs?: number;\n  onReady?: (event: EmbedEvent) => void;\n  onEvent?: (event: EmbedEvent) => void;\n  onError?: (event: EmbedEvent) => void;\n  onClose?: (event: EmbedEvent) => void;\n  /** Optional callback invoked when the iframe has loaded. */\n  onLoad?: () => void;\n}\n\nexport type EmbedEventType = 'ready' | 'session' | 'state' | 'error' | 'close' | 'resize';\nexport interface EmbedEvent {\n  version: 1;\n  type: EmbedEventType;\n  conversation_id?: string;\n  payload?: Record<string, unknown>;\n  error?: { code: string; message: string };\n}\n\nexport interface EmbedInstance {\n  iframe: HTMLIFrameElement;\n  open(): void;\n  destroy(): void;\n  on(type: EmbedEventType | '*', callback: (event: EmbedEvent) => void): () => void;\n  postMessage(type: string, payload?: Record<string, unknown>): void;\n}\n\n/**\n * Version information\n */\nexport const VERSION = '0.2.0';\n\nconst DEFAULT_READY_TIMEOUT_MS = 15000;\nconst DEFAULT_EMBED_URL = 'https://superbuddy.top/open-conversation/';\nconst DEFAULT_API_URL = 'https://superbuddy.top/company-os';\n\ntype ResolvedConfig = OpenConversationConfig & { embedUrl: string };\n\n/**\n * Exchanges app_key/app_secret for an embed token, creates the embed iframe and\n * resolves once the embed page posts its 'ready' event (validated against the\n * iframe window and origin). Rejects if the token exchange fails or the ready\n * event does not arrive within `readyTimeoutMs` (default 15s).\n */\nexport async function createOpenConversation(config: OpenConversationConfig): Promise<EmbedInstance> {\n  if (!config.appKey || !config.appSecret) throw new Error('appKey and appSecret are required');\n  const resolved: ResolvedConfig = { ...config, embedUrl: config.embedUrl || DEFAULT_EMBED_URL };\n  const token = await exchangeEmbedToken(config);\n  const instance = buildInstance(resolved, token);\n  return new Promise<EmbedInstance>((resolve, reject) => {\n    let settled = false;\n    const offReady = instance.on('ready', () => {\n      settled = true;\n      clearTimeout(timer);\n      offReady();\n      resolve(instance);\n    });\n    const timer = setTimeout(() => {\n      if (settled) return;\n      offReady();\n      instance.destroy();\n      reject(new Error(`Embed did not become ready within ${config.readyTimeoutMs || DEFAULT_READY_TIMEOUT_MS}ms`));\n    }, config.readyTimeoutMs || DEFAULT_READY_TIMEOUT_MS);\n  });\n}\n\nasync function exchangeEmbedToken(config: OpenConversationConfig): Promise<string> {\n  const endpoint = `${(config.apiUrl || DEFAULT_API_URL).replace(/\\/+$/, '')}/open/v1/embed/session`;\n  let response: Response;\n  try {\n    response = await fetch(endpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({ app_key: config.appKey, app_secret: config.appSecret }),\n    });\n  } catch (error) {\n    throw new Error(`Embed token request failed: ${error instanceof Error ? error.message : String(error)}`);\n  }\n  const data = await response.json().catch(() => undefined) as { access_token?: unknown; detail?: unknown } | undefined;\n  if (!response.ok) {\n    const detail = typeof data?.detail === 'string' ? data.detail : response.statusText;\n    throw new Error(`Embed token exchange failed (HTTP ${response.status}): ${detail}`);\n  }\n  if (typeof data?.access_token !== 'string' || !data.access_token) {\n    throw new Error('Embed token exchange response is missing access_token');\n  }\n  return data.access_token;\n}\n\nfunction buildInstance(config: ResolvedConfig, token: string): EmbedInstance {\n  if (typeof document === 'undefined') throw new Error('createOpenConversation requires a browser');\n  const container = typeof config.container === 'string' ? document.querySelector(config.container) : config.container;\n  if (!(container instanceof HTMLElement)) throw new Error('Embed container was not found');\n  const targetOrigin = config.origin || new URL(config.embedUrl, window.location.href).origin;\n  if (targetOrigin !== '*' && new URL(config.embedUrl, window.location.href).origin !== targetOrigin) {\n    throw new Error('Embed origin must match embedUrl origin');\n  }\n  const iframe = document.createElement('iframe');\n  iframe.src = buildUrl(config, token);\n  iframe.title = 'Agent OS conversation';\n  iframe.style.width = config.width || '100%';\n  iframe.style.height = config.height || '100%';\n  iframe.style.border = '0';\n  iframe.setAttribute('allow', config.allow || 'clipboard-write');\n  iframe.setAttribute('sandbox', config.sandbox || 'allow-scripts allow-forms allow-same-origin');\n  const listeners = new Map<string, Set<(event: EmbedEvent) => void>>();\n  let active = true;\n  const emit = (event: EmbedEvent) => {\n    listeners.get(event.type)?.forEach((callback) => callback(event));\n    listeners.get('*')?.forEach((callback) => callback(event));\n    if (event.type === 'ready') config.onReady?.(event);\n    if (event.type === 'error') config.onError?.(event);\n    if (event.type === 'close') config.onClose?.(event);\n    config.onEvent?.(event);\n  };\n  const receive = (message: MessageEvent) => {\n    if (!active || message.source !== iframe.contentWindow || (targetOrigin !== '*' && message.origin !== targetOrigin)) return;\n    const event = message.data?.type && message.data?.version === 1 ? message.data as EmbedEvent : undefined;\n    if (!event) return;\n    // autoResize 模式下 iframe 始终 100% 占满父容器，不再按内容高度调整;\n    // resize 事件仍透传给宿主，由宿主自行决定是否响应。\n    emit(event);\n  };\n  iframe.addEventListener('load', () => config.onLoad?.(), { once: true });\n  window.addEventListener('message', receive);\n  const open = () => { if (!iframe.isConnected) container.appendChild(iframe); };\n  const destroy = () => { if (!active) return; active = false; window.removeEventListener('message', receive); listeners.clear(); iframe.remove(); };\n  open();\n  const postMessage = (type: string, payload: Record<string, unknown> = {}) => {\n    if (!active || !iframe.contentWindow) return;\n    iframe.contentWindow.postMessage({ version: 1, type, payload }, targetOrigin === '*' ? '*' : targetOrigin);\n  };\n  return { iframe, open, destroy, postMessage, on(type, callback) { const set = listeners.get(type) || new Set(); set.add(callback); listeners.set(type, set); return () => set.delete(callback); } };\n}\n\nfunction buildUrl(config: ResolvedConfig, token: string): string {\n  const url = new URL(config.embedUrl, window.location.href);\n  url.searchParams.set('token', token);\n  if (config.conversationId) url.searchParams.set('conversation_id', config.conversationId);\n  if (config.capabilities) url.searchParams.set('capabilities', JSON.stringify(config.capabilities));\n  if (config.title) url.searchParams.set('title', config.title);\n  if (config.expert) url.searchParams.set('expert', config.expert);\n  if (config.envVars) url.searchParams.set('env_vars', JSON.stringify(config.envVars));\n  // 显式传入宿主 origin，embed 页据此确定 postMessage 目标，不再依赖 document.referrer。\n  url.searchParams.set('origin', window.location.origin);\n  return url.toString();\n}\n"],"names":[],"mappings":"AAAA;;;;;;;AAOG;AAsDH;;AAEG;AACI,MAAM,OAAO,GAAG,QAAQ;AAE/B,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,MAAM,iBAAiB,GAAG,2CAA2C,CAAC;AACtE,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAI5D;;;;;AAKG;AACI,eAAe,sBAAsB,CAAC,MAA8B,EAAA;IACzE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS;AAAE,QAAA,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;AAC9F,IAAA,MAAM,QAAQ,GAAmB,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,iBAAiB,EAAE,CAAC;AAC/F,IAAA,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChD,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,KAAI;QACpD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAK;YACzC,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;AACpB,YAAA,QAAQ,EAAE,CAAC;YACX,OAAO,CAAC,QAAQ,CAAC,CAAC;AACpB,SAAC,CAAC,CAAC;AACH,QAAA,MAAM,KAAK,GAAG,UAAU,CAAC,MAAK;AAC5B,YAAA,IAAI,OAAO;gBAAE,OAAO;AACpB,YAAA,QAAQ,EAAE,CAAC;YACX,QAAQ,CAAC,OAAO,EAAE,CAAC;AACnB,YAAA,MAAM,CAAC,IAAI,KAAK,CAAC,CAAqC,kCAAA,EAAA,MAAM,CAAC,cAAc,IAAI,wBAAwB,CAAI,EAAA,CAAA,CAAC,CAAC,CAAC;AAChH,SAAC,EAAE,MAAM,CAAC,cAAc,IAAI,wBAAwB,CAAC,CAAC;AACxD,KAAC,CAAC,CAAC;AACL,CAAC;AAED,eAAe,kBAAkB,CAAC,MAA8B,EAAA;AAC9D,IAAA,MAAM,QAAQ,GAAG,CAAA,EAAG,CAAC,MAAM,CAAC,MAAM,IAAI,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,CAAC;AACnG,IAAA,IAAI,QAAkB,CAAC;AACvB,IAAA,IAAI;AACF,QAAA,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;AAC/B,YAAA,MAAM,EAAE,MAAM;AACd,YAAA,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;AAC/C,YAAA,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;AAC/E,SAAA,CAAC,CAAC;KACJ;IAAC,OAAO,KAAK,EAAE;QACd,MAAM,IAAI,KAAK,CAAC,CAAA,4BAAA,EAA+B,KAAK,YAAY,KAAK,GAAG,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAE,CAAA,CAAC,CAAC;KAC1G;AACD,IAAA,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,SAAS,CAA6D,CAAC;AACtH,IAAA,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;QAChB,MAAM,MAAM,GAAG,OAAO,IAAI,EAAE,MAAM,KAAK,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,CAAqC,kCAAA,EAAA,QAAQ,CAAC,MAAM,CAAM,GAAA,EAAA,MAAM,CAAE,CAAA,CAAC,CAAC;KACrF;AACD,IAAA,IAAI,OAAO,IAAI,EAAE,YAAY,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;AAChE,QAAA,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;KAC1E;IACD,OAAO,IAAI,CAAC,YAAY,CAAC;AAC3B,CAAC;AAED,SAAS,aAAa,CAAC,MAAsB,EAAE,KAAa,EAAA;IAC1D,IAAI,OAAO,QAAQ,KAAK,WAAW;AAAE,QAAA,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAClG,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;AACrH,IAAA,IAAI,EAAE,SAAS,YAAY,WAAW,CAAC;AAAE,QAAA,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC1F,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAC5F,IAAI,YAAY,KAAK,GAAG,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY,EAAE;AAClG,QAAA,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;KAC5D;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACrC,IAAA,MAAM,CAAC,KAAK,GAAG,uBAAuB,CAAC;IACvC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC;IAC5C,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC;AAC9C,IAAA,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;IAC1B,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,IAAI,iBAAiB,CAAC,CAAC;IAChE,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,IAAI,6CAA6C,CAAC,CAAC;AAChG,IAAA,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4C,CAAC;IACtE,IAAI,MAAM,GAAG,IAAI,CAAC;AAClB,IAAA,MAAM,IAAI,GAAG,CAAC,KAAiB,KAAI;QACjC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAClE,QAAA,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3D,QAAA,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;AAAE,YAAA,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC;AACpD,QAAA,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;AAAE,YAAA,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC;AACpD,QAAA,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;AAAE,YAAA,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC;AACpD,QAAA,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC;AAC1B,KAAC,CAAC;AACF,IAAA,MAAM,OAAO,GAAG,CAAC,OAAqB,KAAI;QACxC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,aAAa,KAAK,YAAY,KAAK,GAAG,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,CAAC;YAAE,OAAO;QAC5H,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,KAAK,CAAC,GAAG,OAAO,CAAC,IAAkB,GAAG,SAAS,CAAC;AACzG,QAAA,IAAI,CAAC,KAAK;YAAE,OAAO;;;QAGnB,IAAI,CAAC,KAAK,CAAC,CAAC;AACd,KAAC,CAAC;IACF,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AACzE,IAAA,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;AAC/E,IAAA,MAAM,OAAO,GAAG,MAAQ,EAAA,IAAI,CAAC,MAAM;AAAE,QAAA,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;AACnJ,IAAA,IAAI,EAAE,CAAC;IACP,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,OAAmC,GAAA,EAAE,KAAI;AAC1E,QAAA,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa;YAAE,OAAO;QAC7C,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,YAAY,KAAK,GAAG,GAAG,GAAG,GAAG,YAAY,CAAC,CAAC;AAC7G,KAAC,CAAC;AACF,IAAA,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAI,EAAA,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;AACtM,CAAC;AAED,SAAS,QAAQ,CAAC,MAAsB,EAAE,KAAa,EAAA;AACrD,IAAA,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,cAAc;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,YAAY;AAAE,QAAA,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;IACnG,IAAI,MAAM,CAAC,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,MAAM,CAAC,MAAM;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACjE,IAAI,MAAM,CAAC,OAAO;AAAE,QAAA,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;;AAErF,IAAA,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACvD,IAAA,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB;;;;"}

package/dist/index.umd.js

@@ -0,0 +1,151 @@
+(function (global, factory) {
+    typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports) :
+    typeof define === 'function' && define.amd ? define(['exports'], factory) :
+    (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.AgentOSEmbed = {}));
+})(this, (function (exports) { 'use strict';
+
+    /**
+     * Agent OS Embed SDK
+     *
+     * Lightweight SDK for embedding Agent OS conversations in external web applications.
+     * The host page provides app_key/app_secret; the SDK exchanges them for an embed
+     * token via POST {apiUrl}/open/v1/embed/session, then creates an iframe loading
+     * the standalone embed chat page and communicates with it over postMessage.
+     */
+    /**
+     * Version information
+     */
+    const VERSION = '0.2.0';
+    const DEFAULT_READY_TIMEOUT_MS = 15000;
+    const DEFAULT_EMBED_URL = 'https://superbuddy.top/open-conversation/';
+    const DEFAULT_API_URL = 'https://superbuddy.top/company-os';
+    /**
+     * Exchanges app_key/app_secret for an embed token, creates the embed iframe and
+     * resolves once the embed page posts its 'ready' event (validated against the
+     * iframe window and origin). Rejects if the token exchange fails or the ready
+     * event does not arrive within `readyTimeoutMs` (default 15s).
+     */
+    async function createOpenConversation(config) {
+        if (!config.appKey || !config.appSecret)
+            throw new Error('appKey and appSecret are required');
+        const resolved = { ...config, embedUrl: config.embedUrl || DEFAULT_EMBED_URL };
+        const token = await exchangeEmbedToken(config);
+        const instance = buildInstance(resolved, token);
+        return new Promise((resolve, reject) => {
+            let settled = false;
+            const offReady = instance.on('ready', () => {
+                settled = true;
+                clearTimeout(timer);
+                offReady();
+                resolve(instance);
+            });
+            const timer = setTimeout(() => {
+                if (settled)
+                    return;
+                offReady();
+                instance.destroy();
+                reject(new Error(`Embed did not become ready within ${config.readyTimeoutMs || DEFAULT_READY_TIMEOUT_MS}ms`));
+            }, config.readyTimeoutMs || DEFAULT_READY_TIMEOUT_MS);
+        });
+    }
+    async function exchangeEmbedToken(config) {
+        const endpoint = `${(config.apiUrl || DEFAULT_API_URL).replace(/\/+$/, '')}/open/v1/embed/session`;
+        let response;
+        try {
+            response = await fetch(endpoint, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ app_key: config.appKey, app_secret: config.appSecret }),
+            });
+        }
+        catch (error) {
+            throw new Error(`Embed token request failed: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const data = await response.json().catch(() => undefined);
+        if (!response.ok) {
+            const detail = typeof data?.detail === 'string' ? data.detail : response.statusText;
+            throw new Error(`Embed token exchange failed (HTTP ${response.status}): ${detail}`);
+        }
+        if (typeof data?.access_token !== 'string' || !data.access_token) {
+            throw new Error('Embed token exchange response is missing access_token');
+        }
+        return data.access_token;
+    }
+    function buildInstance(config, token) {
+        if (typeof document === 'undefined')
+            throw new Error('createOpenConversation requires a browser');
+        const container = typeof config.container === 'string' ? document.querySelector(config.container) : config.container;
+        if (!(container instanceof HTMLElement))
+            throw new Error('Embed container was not found');
+        const targetOrigin = config.origin || new URL(config.embedUrl, window.location.href).origin;
+        if (targetOrigin !== '*' && new URL(config.embedUrl, window.location.href).origin !== targetOrigin) {
+            throw new Error('Embed origin must match embedUrl origin');
+        }
+        const iframe = document.createElement('iframe');
+        iframe.src = buildUrl(config, token);
+        iframe.title = 'Agent OS conversation';
+        iframe.style.width = config.width || '100%';
+        iframe.style.height = config.height || '100%';
+        iframe.style.border = '0';
+        iframe.setAttribute('allow', config.allow || 'clipboard-write');
+        iframe.setAttribute('sandbox', config.sandbox || 'allow-scripts allow-forms allow-same-origin');
+        const listeners = new Map();
+        let active = true;
+        const emit = (event) => {
+            listeners.get(event.type)?.forEach((callback) => callback(event));
+            listeners.get('*')?.forEach((callback) => callback(event));
+            if (event.type === 'ready')
+                config.onReady?.(event);
+            if (event.type === 'error')
+                config.onError?.(event);
+            if (event.type === 'close')
+                config.onClose?.(event);
+            config.onEvent?.(event);
+        };
+        const receive = (message) => {
+            if (!active || message.source !== iframe.contentWindow || (targetOrigin !== '*' && message.origin !== targetOrigin))
+                return;
+            const event = message.data?.type && message.data?.version === 1 ? message.data : undefined;
+            if (!event)
+                return;
+            // autoResize 模式下 iframe 始终 100% 占满父容器，不再按内容高度调整;
+            // resize 事件仍透传给宿主，由宿主自行决定是否响应。
+            emit(event);
+        };
+        iframe.addEventListener('load', () => config.onLoad?.(), { once: true });
+        window.addEventListener('message', receive);
+        const open = () => { if (!iframe.isConnected)
+            container.appendChild(iframe); };
+        const destroy = () => { if (!active)
+            return; active = false; window.removeEventListener('message', receive); listeners.clear(); iframe.remove(); };
+        open();
+        const postMessage = (type, payload = {}) => {
+            if (!active || !iframe.contentWindow)
+                return;
+            iframe.contentWindow.postMessage({ version: 1, type, payload }, targetOrigin === '*' ? '*' : targetOrigin);
+        };
+        return { iframe, open, destroy, postMessage, on(type, callback) { const set = listeners.get(type) || new Set(); set.add(callback); listeners.set(type, set); return () => set.delete(callback); } };
+    }
+    function buildUrl(config, token) {
+        const url = new URL(config.embedUrl, window.location.href);
+        url.searchParams.set('token', token);
+        if (config.conversationId)
+            url.searchParams.set('conversation_id', config.conversationId);
+        if (config.capabilities)
+            url.searchParams.set('capabilities', JSON.stringify(config.capabilities));
+        if (config.title)
+            url.searchParams.set('title', config.title);
+        if (config.expert)
+            url.searchParams.set('expert', config.expert);
+        if (config.envVars)
+            url.searchParams.set('env_vars', JSON.stringify(config.envVars));
+        // 显式传入宿主 origin，embed 页据此确定 postMessage 目标，不再依赖 document.referrer。
+        url.searchParams.set('origin', window.location.origin);
+        return url.toString();
+    }
+
+    exports.VERSION = VERSION;
+    exports.createOpenConversation = createOpenConversation;
+
+}));
+//# sourceMappingURL=index.umd.js.map

package/dist/index.umd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.umd.js","sources":["../src/index.ts"],"sourcesContent":["/**\n * Agent OS Embed SDK\n *\n * Lightweight SDK for embedding Agent OS conversations in external web applications.\n * The host page provides app_key/app_secret; the SDK exchanges them for an embed\n * token via POST {apiUrl}/open/v1/embed/session, then creates an iframe loading\n * the standalone embed chat page and communicates with it over postMessage.\n */\n\nexport interface OpenConversationConfig {\n  /** 应用 Key(租户 API 密钥的 name) */\n  appKey: string;\n  /** 应用 Secret(创建密钥时返回的明文 key) */\n  appSecret: string;\n  /** URL of the deployed embed page. Defaults to https://superbuddy.top/open-conversation/ */\n  embedUrl?: string;\n  /** Base URL of the Agent OS API used for token exchange. Defaults to https://superbuddy.top/company-os */\n  apiUrl?: string;\n  container: HTMLElement | string;\n  /** 标题,仅在对话还没有内容时显示在输入框上方 */\n  title?: string;\n  /** 专家归属(个人项目 project_id),仅首条消息创建任务时生效 */\n  expert?: string;\n  /** 环境变量字典,传递给本地任务的 task_vars,仅首条消息创建任务时生效 */\n  envVars?: Record<string, string>;\n  capabilities?: Record<string, unknown>;\n  conversationId?: string;\n  origin?: string;\n  width?: string;\n  height?: string;\n  sandbox?: string;\n  allow?: string;\n  /** Fill the parent container (width/height 100%) instead of tracking content height. */\n  autoResize?: boolean;\n  /** Maximum time (ms) to wait for the embed 'ready' event before rejecting. Defaults to 15000. */\n  readyTimeoutMs?: number;\n  onReady?: (event: EmbedEvent) => void;\n  onEvent?: (event: EmbedEvent) => void;\n  onError?: (event: EmbedEvent) => void;\n  onClose?: (event: EmbedEvent) => void;\n  /** Optional callback invoked when the iframe has loaded. */\n  onLoad?: () => void;\n}\n\nexport type EmbedEventType = 'ready' | 'session' | 'state' | 'error' | 'close' | 'resize';\nexport interface EmbedEvent {\n  version: 1;\n  type: EmbedEventType;\n  conversation_id?: string;\n  payload?: Record<string, unknown>;\n  error?: { code: string; message: string };\n}\n\nexport interface EmbedInstance {\n  iframe: HTMLIFrameElement;\n  open(): void;\n  destroy(): void;\n  on(type: EmbedEventType | '*', callback: (event: EmbedEvent) => void): () => void;\n  postMessage(type: string, payload?: Record<string, unknown>): void;\n}\n\n/**\n * Version information\n */\nexport const VERSION = '0.2.0';\n\nconst DEFAULT_READY_TIMEOUT_MS = 15000;\nconst DEFAULT_EMBED_URL = 'https://superbuddy.top/open-conversation/';\nconst DEFAULT_API_URL = 'https://superbuddy.top/company-os';\n\ntype ResolvedConfig = OpenConversationConfig & { embedUrl: string };\n\n/**\n * Exchanges app_key/app_secret for an embed token, creates the embed iframe and\n * resolves once the embed page posts its 'ready' event (validated against the\n * iframe window and origin). Rejects if the token exchange fails or the ready\n * event does not arrive within `readyTimeoutMs` (default 15s).\n */\nexport async function createOpenConversation(config: OpenConversationConfig): Promise<EmbedInstance> {\n  if (!config.appKey || !config.appSecret) throw new Error('appKey and appSecret are required');\n  const resolved: ResolvedConfig = { ...config, embedUrl: config.embedUrl || DEFAULT_EMBED_URL };\n  const token = await exchangeEmbedToken(config);\n  const instance = buildInstance(resolved, token);\n  return new Promise<EmbedInstance>((resolve, reject) => {\n    let settled = false;\n    const offReady = instance.on('ready', () => {\n      settled = true;\n      clearTimeout(timer);\n      offReady();\n      resolve(instance);\n    });\n    const timer = setTimeout(() => {\n      if (settled) return;\n      offReady();\n      instance.destroy();\n      reject(new Error(`Embed did not become ready within ${config.readyTimeoutMs || DEFAULT_READY_TIMEOUT_MS}ms`));\n    }, config.readyTimeoutMs || DEFAULT_READY_TIMEOUT_MS);\n  });\n}\n\nasync function exchangeEmbedToken(config: OpenConversationConfig): Promise<string> {\n  const endpoint = `${(config.apiUrl || DEFAULT_API_URL).replace(/\\/+$/, '')}/open/v1/embed/session`;\n  let response: Response;\n  try {\n    response = await fetch(endpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({ app_key: config.appKey, app_secret: config.appSecret }),\n    });\n  } catch (error) {\n    throw new Error(`Embed token request failed: ${error instanceof Error ? error.message : String(error)}`);\n  }\n  const data = await response.json().catch(() => undefined) as { access_token?: unknown; detail?: unknown } | undefined;\n  if (!response.ok) {\n    const detail = typeof data?.detail === 'string' ? data.detail : response.statusText;\n    throw new Error(`Embed token exchange failed (HTTP ${response.status}): ${detail}`);\n  }\n  if (typeof data?.access_token !== 'string' || !data.access_token) {\n    throw new Error('Embed token exchange response is missing access_token');\n  }\n  return data.access_token;\n}\n\nfunction buildInstance(config: ResolvedConfig, token: string): EmbedInstance {\n  if (typeof document === 'undefined') throw new Error('createOpenConversation requires a browser');\n  const container = typeof config.container === 'string' ? document.querySelector(config.container) : config.container;\n  if (!(container instanceof HTMLElement)) throw new Error('Embed container was not found');\n  const targetOrigin = config.origin || new URL(config.embedUrl, window.location.href).origin;\n  if (targetOrigin !== '*' && new URL(config.embedUrl, window.location.href).origin !== targetOrigin) {\n    throw new Error('Embed origin must match embedUrl origin');\n  }\n  const iframe = document.createElement('iframe');\n  iframe.src = buildUrl(config, token);\n  iframe.title = 'Agent OS conversation';\n  iframe.style.width = config.width || '100%';\n  iframe.style.height = config.height || '100%';\n  iframe.style.border = '0';\n  iframe.setAttribute('allow', config.allow || 'clipboard-write');\n  iframe.setAttribute('sandbox', config.sandbox || 'allow-scripts allow-forms allow-same-origin');\n  const listeners = new Map<string, Set<(event: EmbedEvent) => void>>();\n  let active = true;\n  const emit = (event: EmbedEvent) => {\n    listeners.get(event.type)?.forEach((callback) => callback(event));\n    listeners.get('*')?.forEach((callback) => callback(event));\n    if (event.type === 'ready') config.onReady?.(event);\n    if (event.type === 'error') config.onError?.(event);\n    if (event.type === 'close') config.onClose?.(event);\n    config.onEvent?.(event);\n  };\n  const receive = (message: MessageEvent) => {\n    if (!active || message.source !== iframe.contentWindow || (targetOrigin !== '*' && message.origin !== targetOrigin)) return;\n    const event = message.data?.type && message.data?.version === 1 ? message.data as EmbedEvent : undefined;\n    if (!event) return;\n    // autoResize 模式下 iframe 始终 100% 占满父容器，不再按内容高度调整;\n    // resize 事件仍透传给宿主，由宿主自行决定是否响应。\n    emit(event);\n  };\n  iframe.addEventListener('load', () => config.onLoad?.(), { once: true });\n  window.addEventListener('message', receive);\n  const open = () => { if (!iframe.isConnected) container.appendChild(iframe); };\n  const destroy = () => { if (!active) return; active = false; window.removeEventListener('message', receive); listeners.clear(); iframe.remove(); };\n  open();\n  const postMessage = (type: string, payload: Record<string, unknown> = {}) => {\n    if (!active || !iframe.contentWindow) return;\n    iframe.contentWindow.postMessage({ version: 1, type, payload }, targetOrigin === '*' ? '*' : targetOrigin);\n  };\n  return { iframe, open, destroy, postMessage, on(type, callback) { const set = listeners.get(type) || new Set(); set.add(callback); listeners.set(type, set); return () => set.delete(callback); } };\n}\n\nfunction buildUrl(config: ResolvedConfig, token: string): string {\n  const url = new URL(config.embedUrl, window.location.href);\n  url.searchParams.set('token', token);\n  if (config.conversationId) url.searchParams.set('conversation_id', config.conversationId);\n  if (config.capabilities) url.searchParams.set('capabilities', JSON.stringify(config.capabilities));\n  if (config.title) url.searchParams.set('title', config.title);\n  if (config.expert) url.searchParams.set('expert', config.expert);\n  if (config.envVars) url.searchParams.set('env_vars', JSON.stringify(config.envVars));\n  // 显式传入宿主 origin，embed 页据此确定 postMessage 目标，不再依赖 document.referrer。\n  url.searchParams.set('origin', window.location.origin);\n  return url.toString();\n}\n"],"names":[],"mappings":";;;;;;IAAA;;;;;;;IAOG;IAsDH;;IAEG;AACI,UAAM,OAAO,GAAG,QAAQ;IAE/B,MAAM,wBAAwB,GAAG,KAAK,CAAC;IACvC,MAAM,iBAAiB,GAAG,2CAA2C,CAAC;IACtE,MAAM,eAAe,GAAG,mCAAmC,CAAC;IAI5D;;;;;IAKG;IACI,eAAe,sBAAsB,CAAC,MAA8B,EAAA;QACzE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS;IAAE,QAAA,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC9F,IAAA,MAAM,QAAQ,GAAmB,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,iBAAiB,EAAE,CAAC;IAC/F,IAAA,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,KAAI;YACpD,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAK;gBACzC,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;IACpB,YAAA,QAAQ,EAAE,CAAC;gBACX,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpB,SAAC,CAAC,CAAC;IACH,QAAA,MAAM,KAAK,GAAG,UAAU,CAAC,MAAK;IAC5B,YAAA,IAAI,OAAO;oBAAE,OAAO;IACpB,YAAA,QAAQ,EAAE,CAAC;gBACX,QAAQ,CAAC,OAAO,EAAE,CAAC;IACnB,YAAA,MAAM,CAAC,IAAI,KAAK,CAAC,CAAqC,kCAAA,EAAA,MAAM,CAAC,cAAc,IAAI,wBAAwB,CAAI,EAAA,CAAA,CAAC,CAAC,CAAC;IAChH,SAAC,EAAE,MAAM,CAAC,cAAc,IAAI,wBAAwB,CAAC,CAAC;IACxD,KAAC,CAAC,CAAC;IACL,CAAC;IAED,eAAe,kBAAkB,CAAC,MAA8B,EAAA;IAC9D,IAAA,MAAM,QAAQ,GAAG,CAAA,EAAG,CAAC,MAAM,CAAC,MAAM,IAAI,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,CAAC;IACnG,IAAA,IAAI,QAAkB,CAAC;IACvB,IAAA,IAAI;IACF,QAAA,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;IAC/B,YAAA,MAAM,EAAE,MAAM;IACd,YAAA,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;IAC/C,YAAA,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IAC/E,SAAA,CAAC,CAAC;SACJ;QAAC,OAAO,KAAK,EAAE;YACd,MAAM,IAAI,KAAK,CAAC,CAAA,4BAAA,EAA+B,KAAK,YAAY,KAAK,GAAG,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAE,CAAA,CAAC,CAAC;SAC1G;IACD,IAAA,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,SAAS,CAA6D,CAAC;IACtH,IAAA,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE;YAChB,MAAM,MAAM,GAAG,OAAO,IAAI,EAAE,MAAM,KAAK,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,CAAqC,kCAAA,EAAA,QAAQ,CAAC,MAAM,CAAM,GAAA,EAAA,MAAM,CAAE,CAAA,CAAC,CAAC;SACrF;IACD,IAAA,IAAI,OAAO,IAAI,EAAE,YAAY,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;IAChE,QAAA,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;SAC1E;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,SAAS,aAAa,CAAC,MAAsB,EAAE,KAAa,EAAA;QAC1D,IAAI,OAAO,QAAQ,KAAK,WAAW;IAAE,QAAA,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAClG,MAAM,SAAS,GAAG,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;IACrH,IAAA,IAAI,EAAE,SAAS,YAAY,WAAW,CAAC;IAAE,QAAA,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC1F,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QAC5F,IAAI,YAAY,KAAK,GAAG,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY,EAAE;IAClG,QAAA,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;SAC5D;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,CAAC,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrC,IAAA,MAAM,CAAC,KAAK,GAAG,uBAAuB,CAAC;QACvC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC;IAC9C,IAAA,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;QAC1B,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,IAAI,iBAAiB,CAAC,CAAC;QAChE,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,IAAI,6CAA6C,CAAC,CAAC;IAChG,IAAA,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4C,CAAC;QACtE,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,IAAA,MAAM,IAAI,GAAG,CAAC,KAAiB,KAAI;YACjC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,QAAA,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,QAAA,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;IAAE,YAAA,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC;IACpD,QAAA,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;IAAE,YAAA,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC;IACpD,QAAA,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;IAAE,YAAA,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC;IACpD,QAAA,MAAM,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC;IAC1B,KAAC,CAAC;IACF,IAAA,MAAM,OAAO,GAAG,CAAC,OAAqB,KAAI;YACxC,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,aAAa,KAAK,YAAY,KAAK,GAAG,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY,CAAC;gBAAE,OAAO;YAC5H,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,KAAK,CAAC,GAAG,OAAO,CAAC,IAAkB,GAAG,SAAS,CAAC;IACzG,QAAA,IAAI,CAAC,KAAK;gBAAE,OAAO;;;YAGnB,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,KAAC,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,IAAA,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IAC/E,IAAA,MAAM,OAAO,GAAG,MAAQ,EAAA,IAAI,CAAC,MAAM;IAAE,QAAA,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IACnJ,IAAA,IAAI,EAAE,CAAC;QACP,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,OAAmC,GAAA,EAAE,KAAI;IAC1E,QAAA,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa;gBAAE,OAAO;YAC7C,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,YAAY,KAAK,GAAG,GAAG,GAAG,GAAG,YAAY,CAAC,CAAC;IAC7G,KAAC,CAAC;IACF,IAAA,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAI,EAAA,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,MAAM,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;IACtM,CAAC;IAED,SAAS,QAAQ,CAAC,MAAsB,EAAE,KAAa,EAAA;IACrD,IAAA,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,cAAc;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QAC1F,IAAI,MAAM,CAAC,YAAY;IAAE,QAAA,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;QACnG,IAAI,MAAM,CAAC,KAAK;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,MAAM;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,OAAO;IAAE,QAAA,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;;IAErF,IAAA,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvD,IAAA,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB;;;;;;;;;"}

package/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "@zkly-superbuddy/embed-sdk",
+  "version": "0.2.0",
+  "description": "Lightweight SDK for embedding SuperBuddy conversations",
+  "main": "dist/index.umd.js",
+  "module": "dist/index.esm.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "rollup -c",
+    "dev": "rollup -c -w",
+    "typecheck": "tsc --noEmit"
+  },
+  "keywords": [
+    "superbuddy",
+    "embed",
+    "iframe",
+    "sdk"
+  ],
+  "author": "SuperBuddy Team",
+  "license": "MIT",
+  "devDependencies": {
+    "@rollup/plugin-node-resolve": "^15.0.0",
+    "@rollup/plugin-typescript": "^11.0.0",
+    "rollup": "^3.0.0",
+    "tslib": "^2.5.0",
+    "typescript": "^5.0.0"
+  }
+}