Smore agent prompt

Copy this prompt into your coding agent and fill in the bracketed details.

Implement the Smore partner integration in this repository.

Application context:
- Server framework/runtime: [FRAMEWORK]
- Browser framework: [FRAMEWORK]
- Database/ORM: [DATABASE]
- Durable queue or job system: [QUEUE]
- Local parent origin: [LOCAL_ORIGIN]
- Production parent origin: [PRODUCTION_ORIGIN]

Before changing code:
1. Read https://docs.smore.video/llms.txt.
2. Read the raw Markdown pages it identifies for authentication, images and scenes,
   embedding, retries, recording and packages, browser events, errors, and security.
3. If an active test key is already available through the environment, read
   https://api.smore.video/openapi.partner.json as the machine-readable HTTP contract.
   Never ask for the key in chat or print it. Otherwise use the documentation schemas.
4. Inspect this repository's existing authentication, authorization, persistence,
   HTTP client, retry, queue, configuration, and testing patterns.

Implementation requirements:
- Use the REST API from the server and a native hosted iframe in the browser.
- Never put SMORE_SECRET_KEY, signed media URLs, or complete embed URLs in public
  source code, logs, analytics, traces, or agent output.
- Authenticate and authorize every application-owned endpoint. Load Smore IDs from
  authorized server-side records; never treat a browser-supplied Smore ID as authorization.
- Persist image asset IDs, exact mutation bodies, canonical UUID v4 idempotency keys,
  and returned operation IDs before crossing a retry boundary.
- Keep create, edit, and poll requests short. Preserve Smore status, safe error body,
  Retry-After, and requestId through application-owned relays.
- Return Smore resources and embed URLs with Cache-Control: private, no-store.
- Register the iframe message listener before assigning src. Validate the exact
  https://embed.smore.video origin, iframe contentWindow, protocol version, and fields.
- Forward reference-package IDs only to an authenticated application endpoint.
  Durably queue each ID with the expected Smore scene ID loaded from an authorized record.
- Retrieve fresh package URLs when the worker starts, verify the scene binding,
  acknowledge durable receipt, and deduplicate repeated delivery.
- Do not invent a Smore SDK, webhook, scene-artifact endpoint, browser API key,
  geometry API, or client-supplied conversation history.

Execution:
1. Present a concise implementation map tied to existing files and data records.
2. Implement the smallest complete integration using existing repository conventions.
3. Add focused tests for server-only secrets, tenant authorization, idempotent retries,
   exact iframe origins, message source validation, package scene binding, and deduplication.
4. Run existing formatting, linting, typechecking, tests, and production builds.
5. Report what passed, what remains an external credential/browser check, and every
   required environment variable without printing a secret value.

Credentials

Do not paste a real sk_test_ or sk_live_ value into the prompt. Add it through the application’s normal local secret mechanism only after reviewing the implementation.