agentlink-sdk 1.0.2 → 1.0.3

package/dist/index.d.mts

@@ -1,16 +1,3 @@
-interface URLData {
-    data: any;
-    type: string;
-}
-/**
- * 将数据编码为 URL hash
- */
-declare function encodeDataToUrl(data: any, type: string, baseUrl: string): Promise<string>;
-/**
- * 从 URL 中解码数据
- */
-declare function decodeDataFromUrl(urlStr: string): Promise<URLData | null>;
-
 interface AgentLinkClientOptions {
     /**
      * 服务端验证地址
@@ -26,13 +13,33 @@ interface WhitelistResponse {
     whitelist: WhitelistInfo | WhitelistInfo[] | null;
     origin: string | null;
 }
+interface SenderInfo {
+    domain: string;
+    description: string | null;
+}
 /**
- * AgentLink 客户端 SDK (URL Hash 方案)
+ * AgentLink 客户端 SDK (URL Hash + Token 方案)
  */
 declare class AgentLinkClient {
     private serverUrl;
     private static DEFAULT_WINDOW_NAME;
+    private token;
+    private tokenPromise;
+    private static tokenCache;
+    private static CACHE_TTL;
     constructor(options: AgentLinkClientOptions);
+    /**
+     * 确保有 Token（自动获取）
+     */
+    private ensureToken;
+    /**
+     * 从服务器获取 Token
+     */
+    private fetchToken;
+    /**
+     * 验证发送端的 Token 和 Origin
+     */
+    private verifySender;
     /**
      * 发送数据到目标应用
      * @param targetUrl 目标应用的地址
@@ -45,11 +52,15 @@ declare class AgentLinkClient {
      * 监听来自 URL 的数据
      * @param callback 接收到数据时的回调函数
      */
-    receiveData(callback: (data: any, type: string) => void): () => void;
+    receiveData(callback: (data: any, type: string, senderInfo?: SenderInfo) => void): () => void;
     /**
-     * 从当前 URL 获取数据并验证接收方白名单
+     * 从当前 URL 获取数据并验证发送方
      */
-    getDataFromUrl(url?: string): Promise<URLData | null>;
+    getDataFromUrl(url?: string): Promise<{
+        data: any;
+        type: string;
+        senderInfo?: SenderInfo;
+    } | null>;
     /**
      * 获取白名单信息
      */
@@ -73,6 +84,21 @@ declare function uint8ArrayToBase64(arr: Uint8Array): string;
  */
 declare function base64ToUint8Array(base64: string): Uint8Array;
 
+interface URLData {
+    data: any;
+    type: string;
+    token: string;
+    origin: string;
+}
+/**
+ * 将数据编码为 URL hash
+ */
+declare function encodeDataToUrl(data: any, type: string, token: string, origin: string, baseUrl: string): Promise<string>;
+/**
+ * 从 URL 中解码数据
+ */
+declare function decodeDataFromUrl(urlStr: string): Promise<URLData | null>;
+
 /**
  * 验证域名是否在白名单中
  */
@@ -82,4 +108,4 @@ declare function verifyWhitelist(serverUrl: string, origin?: string): Promise<bo
  */
 declare function fetchWhitelistInfo(serverUrl: string, includeAll?: boolean): Promise<any>;
 
-export { AgentLinkClient, type AgentLinkClientOptions, type URLData, type WhitelistInfo, type WhitelistResponse, base64ToUint8Array, compress, decodeDataFromUrl, decompress, encodeDataToUrl, fetchWhitelistInfo, uint8ArrayToBase64, verifyWhitelist };
+export { AgentLinkClient, type AgentLinkClientOptions, type SenderInfo, type URLData, type WhitelistInfo, type WhitelistResponse, base64ToUint8Array, compress, decodeDataFromUrl, decompress, encodeDataToUrl, fetchWhitelistInfo, uint8ArrayToBase64, verifyWhitelist };

package/dist/index.d.ts

@@ -1,16 +1,3 @@
-interface URLData {
-    data: any;
-    type: string;
-}
-/**
- * 将数据编码为 URL hash
- */
-declare function encodeDataToUrl(data: any, type: string, baseUrl: string): Promise<string>;
-/**
- * 从 URL 中解码数据
- */
-declare function decodeDataFromUrl(urlStr: string): Promise<URLData | null>;
-
 interface AgentLinkClientOptions {
     /**
      * 服务端验证地址
@@ -26,13 +13,33 @@ interface WhitelistResponse {
     whitelist: WhitelistInfo | WhitelistInfo[] | null;
     origin: string | null;
 }
+interface SenderInfo {
+    domain: string;
+    description: string | null;
+}
 /**
- * AgentLink 客户端 SDK (URL Hash 方案)
+ * AgentLink 客户端 SDK (URL Hash + Token 方案)
  */
 declare class AgentLinkClient {
     private serverUrl;
     private static DEFAULT_WINDOW_NAME;
+    private token;
+    private tokenPromise;
+    private static tokenCache;
+    private static CACHE_TTL;
     constructor(options: AgentLinkClientOptions);
+    /**
+     * 确保有 Token（自动获取）
+     */
+    private ensureToken;
+    /**
+     * 从服务器获取 Token
+     */
+    private fetchToken;
+    /**
+     * 验证发送端的 Token 和 Origin
+     */
+    private verifySender;
     /**
      * 发送数据到目标应用
      * @param targetUrl 目标应用的地址
@@ -45,11 +52,15 @@ declare class AgentLinkClient {
      * 监听来自 URL 的数据
      * @param callback 接收到数据时的回调函数
      */
-    receiveData(callback: (data: any, type: string) => void): () => void;
+    receiveData(callback: (data: any, type: string, senderInfo?: SenderInfo) => void): () => void;
     /**
-     * 从当前 URL 获取数据并验证接收方白名单
+     * 从当前 URL 获取数据并验证发送方
      */
-    getDataFromUrl(url?: string): Promise<URLData | null>;
+    getDataFromUrl(url?: string): Promise<{
+        data: any;
+        type: string;
+        senderInfo?: SenderInfo;
+    } | null>;
     /**
      * 获取白名单信息
      */
@@ -73,6 +84,21 @@ declare function uint8ArrayToBase64(arr: Uint8Array): string;
  */
 declare function base64ToUint8Array(base64: string): Uint8Array;
 
+interface URLData {
+    data: any;
+    type: string;
+    token: string;
+    origin: string;
+}
+/**
+ * 将数据编码为 URL hash
+ */
+declare function encodeDataToUrl(data: any, type: string, token: string, origin: string, baseUrl: string): Promise<string>;
+/**
+ * 从 URL 中解码数据
+ */
+declare function decodeDataFromUrl(urlStr: string): Promise<URLData | null>;
+
 /**
  * 验证域名是否在白名单中
  */
@@ -82,4 +108,4 @@ declare function verifyWhitelist(serverUrl: string, origin?: string): Promise<bo
  */
 declare function fetchWhitelistInfo(serverUrl: string, includeAll?: boolean): Promise<any>;
 
-export { AgentLinkClient, type AgentLinkClientOptions, type URLData, type WhitelistInfo, type WhitelistResponse, base64ToUint8Array, compress, decodeDataFromUrl, decompress, encodeDataToUrl, fetchWhitelistInfo, uint8ArrayToBase64, verifyWhitelist };
+export { AgentLinkClient, type AgentLinkClientOptions, type SenderInfo, type URLData, type WhitelistInfo, type WhitelistResponse, base64ToUint8Array, compress, decodeDataFromUrl, decompress, encodeDataToUrl, fetchWhitelistInfo, uint8ArrayToBase64, verifyWhitelist };

package/dist/index.js

@@ -66,8 +66,8 @@ function base64ToUint8Array(base64) {
 }
 
 // src/utils/url.ts
-async function encodeDataToUrl(data, type, baseUrl) {
-  const payload = { data, type };
+async function encodeDataToUrl(data, type, token, origin, baseUrl) {
+  const payload = { data, type, token, origin };
   const jsonString = JSON.stringify(payload);
   const compressed = await compress(jsonString);
   const base64 = uint8ArrayToBase64(compressed);
@@ -137,8 +137,64 @@ async function fetchWhitelistInfo(serverUrl, includeAll = false) {
 // src/client.ts
 var _AgentLinkClient = class _AgentLinkClient {
   constructor(options) {
+    // 发送端 Token 缓存（实例级别）
+    this.token = null;
+    this.tokenPromise = null;
     this.serverUrl = options.serverUrl.replace(/\/$/, "");
   }
+  /**
+   * 确保有 Token（自动获取）
+   */
+  async ensureToken() {
+    if (this.token) return this.token;
+    if (!this.tokenPromise) {
+      this.tokenPromise = this.fetchToken();
+    }
+    return this.tokenPromise;
+  }
+  /**
+   * 从服务器获取 Token
+   */
+  async fetchToken() {
+    const origin = window.location.origin;
+    const response = await fetch(`${this.serverUrl}/api/tokens/get?origin=${encodeURIComponent(origin)}`);
+    if (!response.ok) {
+      const data2 = await response.json();
+      throw new Error(`[AgentLink] Failed to get token: ${data2.error || response.statusText}`);
+    }
+    const data = await response.json();
+    if (!data.token) {
+      throw new Error("[AgentLink] No token returned from server");
+    }
+    const token = data.token;
+    this.token = token;
+    return token;
+  }
+  /**
+   * 验证发送端的 Token 和 Origin
+   */
+  async verifySender(token, origin) {
+    const cached = _AgentLinkClient.tokenCache.get(token);
+    if (cached && Date.now() - cached.timestamp < _AgentLinkClient.CACHE_TTL) {
+      return { domain: cached.domain, description: cached.description };
+    }
+    const response = await fetch(
+      `${this.serverUrl}/api/tokens/verify?token=${encodeURIComponent(token)}&origin=${encodeURIComponent(origin)}`
+    );
+    if (!response.ok) {
+      return null;
+    }
+    const data = await response.json();
+    if (!data.valid) {
+      return null;
+    }
+    _AgentLinkClient.tokenCache.set(token, {
+      domain: data.domain,
+      description: data.description,
+      timestamp: Date.now()
+    });
+    return { domain: data.domain, description: data.description };
+  }
   /**
    * 发送数据到目标应用
    * @param targetUrl 目标应用的地址
@@ -147,11 +203,9 @@ var _AgentLinkClient = class _AgentLinkClient {
    * @param windowName 窗口名称，用于复用（默认: 'agentlink-window'）
    */
   async sendData(targetUrl, data, type, windowName = _AgentLinkClient.DEFAULT_WINDOW_NAME) {
-    const isAllowed = await verifyWhitelist(this.serverUrl);
-    if (!isAllowed) {
-      throw new Error(`[AgentLink] Current origin is not whitelisted: ${window.location.origin}`);
-    }
-    const encodedUrl = await encodeDataToUrl(data, type, targetUrl);
+    const token = await this.ensureToken();
+    const origin = window.location.origin;
+    const encodedUrl = await encodeDataToUrl(data, type, token, origin, targetUrl);
     const targetWindow = window.open(encodedUrl, windowName);
     if (!targetWindow) {
       throw new Error("[AgentLink] Failed to open target window. It might be blocked by a popup blocker.");
@@ -166,7 +220,7 @@ var _AgentLinkClient = class _AgentLinkClient {
     const handleHashChange = async () => {
       const result = await this.getDataFromUrl();
       if (result) {
-        callback(result.data, result.type);
+        callback(result.data, result.type, result.senderInfo);
       }
     };
     window.addEventListener("hashchange", handleHashChange);
@@ -176,19 +230,24 @@ var _AgentLinkClient = class _AgentLinkClient {
     };
   }
   /**
-   * 从当前 URL 获取数据并验证接收方白名单
+   * 从当前 URL 获取数据并验证发送方
    */
   async getDataFromUrl(url) {
     const targetUrl = url || window.location.href;
-    const data = await decodeDataFromUrl(targetUrl);
-    if (data) {
-      const isAllowed = await verifyWhitelist(this.serverUrl);
-      if (!isAllowed) {
-        console.warn(`[AgentLink] Data received but current origin is not whitelisted: ${window.location.origin}`);
-        return null;
-      }
+    const urlData = await decodeDataFromUrl(targetUrl);
+    if (!urlData) {
+      return null;
+    }
+    const senderInfo = await this.verifySender(urlData.token, urlData.origin);
+    if (!senderInfo) {
+      console.warn(`[AgentLink] Data received but sender verification failed`);
+      return null;
     }
-    return data;
+    return {
+      data: urlData.data,
+      type: urlData.type,
+      senderInfo
+    };
   }
   /**
    * 获取白名单信息
@@ -198,5 +257,9 @@ var _AgentLinkClient = class _AgentLinkClient {
   }
 };
 _AgentLinkClient.DEFAULT_WINDOW_NAME = "agentlink-window";
+// 接收端验证结果缓存（静态，跨实例共享）
+_AgentLinkClient.tokenCache = /* @__PURE__ */ new Map();
+// 缓存过期时间：1 小时
+_AgentLinkClient.CACHE_TTL = 60 * 60 * 1e3;
 var AgentLinkClient = _AgentLinkClient;
 //# sourceMappingURL=index.js.map

package/dist/index.mjs

@@ -32,8 +32,8 @@ function base64ToUint8Array(base64) {
 }
 
 // src/utils/url.ts
-async function encodeDataToUrl(data, type, baseUrl) {
-  const payload = { data, type };
+async function encodeDataToUrl(data, type, token, origin, baseUrl) {
+  const payload = { data, type, token, origin };
   const jsonString = JSON.stringify(payload);
   const compressed = await compress(jsonString);
   const base64 = uint8ArrayToBase64(compressed);
@@ -103,8 +103,64 @@ async function fetchWhitelistInfo(serverUrl, includeAll = false) {
 // src/client.ts
 var _AgentLinkClient = class _AgentLinkClient {
   constructor(options) {
+    // 发送端 Token 缓存（实例级别）
+    this.token = null;
+    this.tokenPromise = null;
     this.serverUrl = options.serverUrl.replace(/\/$/, "");
   }
+  /**
+   * 确保有 Token（自动获取）
+   */
+  async ensureToken() {
+    if (this.token) return this.token;
+    if (!this.tokenPromise) {
+      this.tokenPromise = this.fetchToken();
+    }
+    return this.tokenPromise;
+  }
+  /**
+   * 从服务器获取 Token
+   */
+  async fetchToken() {
+    const origin = window.location.origin;
+    const response = await fetch(`${this.serverUrl}/api/tokens/get?origin=${encodeURIComponent(origin)}`);
+    if (!response.ok) {
+      const data2 = await response.json();
+      throw new Error(`[AgentLink] Failed to get token: ${data2.error || response.statusText}`);
+    }
+    const data = await response.json();
+    if (!data.token) {
+      throw new Error("[AgentLink] No token returned from server");
+    }
+    const token = data.token;
+    this.token = token;
+    return token;
+  }
+  /**
+   * 验证发送端的 Token 和 Origin
+   */
+  async verifySender(token, origin) {
+    const cached = _AgentLinkClient.tokenCache.get(token);
+    if (cached && Date.now() - cached.timestamp < _AgentLinkClient.CACHE_TTL) {
+      return { domain: cached.domain, description: cached.description };
+    }
+    const response = await fetch(
+      `${this.serverUrl}/api/tokens/verify?token=${encodeURIComponent(token)}&origin=${encodeURIComponent(origin)}`
+    );
+    if (!response.ok) {
+      return null;
+    }
+    const data = await response.json();
+    if (!data.valid) {
+      return null;
+    }
+    _AgentLinkClient.tokenCache.set(token, {
+      domain: data.domain,
+      description: data.description,
+      timestamp: Date.now()
+    });
+    return { domain: data.domain, description: data.description };
+  }
   /**
    * 发送数据到目标应用
    * @param targetUrl 目标应用的地址
@@ -113,11 +169,9 @@ var _AgentLinkClient = class _AgentLinkClient {
    * @param windowName 窗口名称，用于复用（默认: 'agentlink-window'）
    */
   async sendData(targetUrl, data, type, windowName = _AgentLinkClient.DEFAULT_WINDOW_NAME) {
-    const isAllowed = await verifyWhitelist(this.serverUrl);
-    if (!isAllowed) {
-      throw new Error(`[AgentLink] Current origin is not whitelisted: ${window.location.origin}`);
-    }
-    const encodedUrl = await encodeDataToUrl(data, type, targetUrl);
+    const token = await this.ensureToken();
+    const origin = window.location.origin;
+    const encodedUrl = await encodeDataToUrl(data, type, token, origin, targetUrl);
     const targetWindow = window.open(encodedUrl, windowName);
     if (!targetWindow) {
       throw new Error("[AgentLink] Failed to open target window. It might be blocked by a popup blocker.");
@@ -132,7 +186,7 @@ var _AgentLinkClient = class _AgentLinkClient {
     const handleHashChange = async () => {
       const result = await this.getDataFromUrl();
       if (result) {
-        callback(result.data, result.type);
+        callback(result.data, result.type, result.senderInfo);
       }
     };
     window.addEventListener("hashchange", handleHashChange);
@@ -142,19 +196,24 @@ var _AgentLinkClient = class _AgentLinkClient {
     };
   }
   /**
-   * 从当前 URL 获取数据并验证接收方白名单
+   * 从当前 URL 获取数据并验证发送方
    */
   async getDataFromUrl(url) {
     const targetUrl = url || window.location.href;
-    const data = await decodeDataFromUrl(targetUrl);
-    if (data) {
-      const isAllowed = await verifyWhitelist(this.serverUrl);
-      if (!isAllowed) {
-        console.warn(`[AgentLink] Data received but current origin is not whitelisted: ${window.location.origin}`);
-        return null;
-      }
+    const urlData = await decodeDataFromUrl(targetUrl);
+    if (!urlData) {
+      return null;
+    }
+    const senderInfo = await this.verifySender(urlData.token, urlData.origin);
+    if (!senderInfo) {
+      console.warn(`[AgentLink] Data received but sender verification failed`);
+      return null;
     }
-    return data;
+    return {
+      data: urlData.data,
+      type: urlData.type,
+      senderInfo
+    };
   }
   /**
    * 获取白名单信息
@@ -164,6 +223,10 @@ var _AgentLinkClient = class _AgentLinkClient {
   }
 };
 _AgentLinkClient.DEFAULT_WINDOW_NAME = "agentlink-window";
+// 接收端验证结果缓存（静态，跨实例共享）
+_AgentLinkClient.tokenCache = /* @__PURE__ */ new Map();
+// 缓存过期时间：1 小时
+_AgentLinkClient.CACHE_TTL = 60 * 60 * 1e3;
 var AgentLinkClient = _AgentLinkClient;
 export {
   AgentLinkClient,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "agentlink-sdk",
-    "version": "1.0.2",
+    "version": "1.0.3",
     "description": "AgentLink client SDK for cross-domain data synchronization via URL hash",
     "main": "dist/index.js",
     "module": "dist/index.esm.js",