@declarion/embed 0.1.92 → 0.1.93

package/README.md

@@ -153,14 +153,23 @@ cross-origin `postMessage` frames are dropped silently. The SDK detects:
 A protocol version mismatch between this SDK and the Declarion deployment
 produces a clear `console.warn` naming both versions.
 
-## Reference integration
-
-A complete, runnable foreign-host app lives at
-[`typescript/examples/embed-host`](../../examples/embed-host) in the Declarion
-Core monorepo. It embeds list, detail, and action screens, demonstrates both
-navigation modes, and mints tokens with `@declarion/embed/server` from a host
-backend that holds the `dk:` API key server-side only. Use it as the
-copy-from template for a real integration.
+## Putting it together
+
+A real integration is two halves, and the snippets above are the whole
+contract:
+
+- **Host frontend** - renders `<DeclarionEmbed />` (React) or calls
+  `createDeclarionEmbed` (any framework) and supplies the async `getToken`
+  callback. The SDK owns the iframe, the `ready` -> `set-token` handshake,
+  resize, navigation, and token refresh.
+- **Host backend** - holds the `dk:` API key (server-side only) and mints
+  short-lived, scoped embed tokens with `createEmbedSession` from
+  `@declarion/embed/server`. Your `getToken` callback fetches one from your
+  own backend endpoint.
+
+The `dk:` key never leaves your server; the browser only ever holds a
+short-lived, scoped embed token. That split is the entire security model -
+keep `@declarion/embed/server` out of any browser bundle.
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@declarion/embed",
-  "version": "0.1.92",
+  "version": "0.1.93",
   "private": false,
   "license": "MIT",
   "description": "Host integration SDK for embedding Declarion screens as white-label iframes.",