@statelyai/sdk 0.10.2 → 0.12.0

package/README.md

@@ -28,11 +28,35 @@ embed.init({
 });
 ```
 
+Restrict an embed by passing a resolved access policy:
+
+```ts
+embed.init({
+  machine: myMachineConfig,
+  mode: 'viewing',
+  readOnly: true,
+  capabilities: {
+    edit: false,
+    export: false,
+    ai: false,
+    simulate: false,
+    navigateHierarchy: false,
+    maxDepth: 1,
+    panels: ['structure', 'details', 'validations'],
+  },
+});
+
+embed.on('capabilityDenied', (event) => {
+  console.warn(event.message);
+});
+```
+
 Key capabilities:
 
 - **Mount or attach** to any container element or existing iframe
 - **Two-way sync** - push machine configs in, get changes and saves back via event callbacks
 - **Export** to multiple formats: XState v5, XState JSON, Mermaid, Redux, Zustand, ASL, SCXML, and more
+- **Access policies** for read-only, no-export, no-AI, shallow-viewer embeds
 - **Comments** via Liveblocks integration (optional)
 - **Asset uploads** with built-in S3 and Supabase adapters, or bring your own upload handler
 - **Runtime settings** - toggle color mode, grid, snap lines, autolayout, and view mode on the fly
@@ -69,7 +93,10 @@ Programmatic access to Stately Studio for managing projects and machines, extrac
 import { createStatelyClient } from '@statelyai/sdk';
 
 const studio = createStatelyClient({
-  apiKey: process.env.STATELY_API_KEY,
+  credential: {
+    type: 'oauth',
+    accessToken: process.env.STATELY_ACCESS_TOKEN!,
+  },
 });
 
 const projects = await studio.projects.list();
@@ -77,6 +104,10 @@ const machine = await studio.machines.get('machine-id');
 const extracted = await studio.code.extractMachines(sourceCode);
 ```
 
+Legacy `apiKey` is still accepted as an alias for
+`credential: { type: 'api_key', token }`. Use `authMode: 'none'` only for
+self-hosted deployments that intentionally accept unauthenticated calls.
+
 ### Inspector
 
 Stream live actor-system state to the Stately inspector over WebSockets, with support for automatic XState actor adoption and manual actor registration.
@@ -85,10 +116,11 @@ Stream live actor-system state to the Stately inspector over WebSockets, with su
 import { createActor } from 'xstate';
 import { createStatelyInspector } from '@statelyai/sdk';
 
-const inspector = createStatelyInspector({
-  actor: createActor(machine),
-  autoOpen: true,
-});
+const actor = createActor(machine);
+const inspector = createStatelyInspector({ autoOpen: true });
+
+inspector.inspect(actor);
+actor.start();
 ```
 
 ### CLI and sync

package/dist/auth-DO1-eQcU.d.mts

@@ -0,0 +1,15 @@
+//#region src/auth.d.ts
+type StatelyCredential = {
+  type: 'api_key';
+  token: string;
+} | {
+  type: 'oauth';
+  accessToken: string;
+  refreshToken?: string;
+  expiresAt?: number;
+};
+type StatelyAuthMode = 'auto' | 'none' | 'bearer';
+declare function getCredentialToken(credential: StatelyCredential | string | null | undefined): string | undefined;
+declare function createAuthorizationHeader(credential: StatelyCredential | string): string;
+//#endregion
+export { getCredentialToken as i, StatelyCredential as n, createAuthorizationHeader as r, StatelyAuthMode as t };

package/dist/auth.d.mts

@@ -0,0 +1,2 @@
+import { i as getCredentialToken, n as StatelyCredential, r as createAuthorizationHeader, t as StatelyAuthMode } from "./auth-DO1-eQcU.mjs";
+export { StatelyAuthMode, StatelyCredential, createAuthorizationHeader, getCredentialToken };

package/dist/auth.mjs

@@ -0,0 +1,11 @@
+//#region src/auth.ts
+function getCredentialToken(credential) {
+	if (!credential) return;
+	return typeof credential === "string" ? credential : credential.type === "oauth" ? credential.accessToken : credential.token;
+}
+function createAuthorizationHeader(credential) {
+	return `Bearer ${getCredentialToken(credential)}`;
+}
+
+//#endregion
+export { createAuthorizationHeader, getCredentialToken };

package/dist/embed.d.mts

@@ -1,4 +1,4 @@
-import { CommentsConfig, EmbedEventHandler, EmbedEventMap, EmbedEventName, EmbedMode, ExportCallOptions, ExportFormat, ExportFormatMap, InitOptions, MachineInitOptions, MachineSourceLocations, ProjectEmbedMachine, UploadResult } from "./protocol.mjs";
+import { CapabilityDeniedEvent, CommentsConfig, EditorCapabilities, EmbedEventHandler, EmbedEventMap, EmbedEventName, EmbedMode, ExportCallOptions, ExportFormat, ExportFormatMap, InitOptions, MachineInitOptions, MachineSourceLocations, ProjectEmbedMachine, UploadResult } from "./protocol.mjs";
 import { AssetUploadAdapter } from "./assetStorage.mjs";
 
 //#region src/embed.d.ts
@@ -56,6 +56,7 @@ interface StatelyEmbedOptions extends Partial<MachineInitOptions> {
     code: string;
     message: string;
   }) => void;
+  onCapabilityDenied?: (event: CapabilityDeniedEvent) => void;
 }
 interface StatelyEmbed {
   /** Attach to an existing iframe element. Sets src and begins handshake. */
@@ -89,4 +90,4 @@ interface StatelyEmbed {
 }
 declare function createStatelyEmbed(options: StatelyEmbedOptions): StatelyEmbed;
 //#endregion
-export { AssetConfig, type CommentsConfig, type EmbedEventHandler, type EmbedEventMap, type EmbedEventName, type EmbedMode, type ExportCallOptions, type ExportFormat, type ExportFormatMap, type InitOptions, type MachineInitOptions, type MachineSourceLocations, type ProjectEmbedMachine, StatelyEmbed, StatelyEmbedOptions, type UploadResult, createStatelyEmbed };
+export { AssetConfig, type CapabilityDeniedEvent, type CommentsConfig, type EditorCapabilities, type EmbedEventHandler, type EmbedEventMap, type EmbedEventName, type EmbedMode, type ExportCallOptions, type ExportFormat, type ExportFormatMap, type InitOptions, type MachineInitOptions, type MachineSourceLocations, type ProjectEmbedMachine, StatelyEmbed, StatelyEmbedOptions, type UploadResult, createStatelyEmbed };

package/dist/embed.mjs

@@ -1,4 +1,4 @@
-import { a as toInitMessage, i as createPendingExportManager, r as createEventRegistry, t as createPostMessageTransport } from "./transport-CVZGF0w9.mjs";
+import { a as toInitMessage, i as createPendingExportManager, r as createEventRegistry, t as createPostMessageTransport } from "./transport-D0nlFaLn.mjs";
 
 //#region src/embed.ts
 function buildEmbedUrl(options) {
@@ -15,6 +15,7 @@ function extractInitOptions(options) {
 		theme: options.theme,
 		readOnly: options.readOnly,
 		depth: options.depth,
+		capabilities: options.capabilities,
 		panels: options.panels,
 		commentsByMachineId: options.commentsByMachineId,
 		unsavedIndicator: options.unsavedIndicator
@@ -26,6 +27,7 @@ function extractInitOptions(options) {
 		theme: options.theme,
 		readOnly: options.readOnly,
 		depth: options.depth,
+		capabilities: options.capabilities,
 		panels: options.panels,
 		comments: options.comments,
 		sourceLocations: options.sourceLocations,
@@ -134,6 +136,12 @@ function createStatelyEmbed(options) {
 				events.emit("error", err);
 				break;
 			}
+			case "@statelyai.capabilityDenied": {
+				const { type: _type, ...event } = data;
+				options.onCapabilityDenied?.(event);
+				events.emit("capabilityDenied", event);
+				break;
+			}
 			case "@statelyai.uploadRequest": {
 				const req = data;
 				if (!uploadAsset) {

package/dist/{graph-GeuH-mFK.d.mts → graph-CszT5J6W.d.mts}

@@ -181,9 +181,10 @@ interface CodeGenInvoke {
 interface CodeGenNodeData {
   nodeId?: string | null;
   key: string;
-  type?: 'normal' | 'parallel' | 'final' | 'history' | null;
+  type?: 'normal' | 'parallel' | 'final' | 'history' | 'choice' | null;
   initialId?: string | null;
   history?: 'shallow' | 'deep' | boolean;
+  output?: Record<string, unknown> | CodeExpression;
   entry?: CodeGenAction[];
   exit?: CodeGenAction[];
   invokes?: CodeGenInvoke[];
@@ -200,6 +201,7 @@ interface CodeGenEdgeData {
   eventType: string;
   transitionType?: 'normal' | 'targetless' | 'reenter';
   guard?: CodeGenGuard | null;
+  context?: Record<string, unknown> | CodeExpression;
   actions?: CodeGenAction[];
   description?: string | null;
   color?: string;

package/dist/graph.d.mts

@@ -1,2 +1,2 @@
-import { _ as studioMachineConverter, a as StatelyGraphData, c as StatelyInvoke, d as StudioAction, f as StudioEdge, g as fromStudioMachine, h as StudioNode, i as StatelyGraph, l as StatelyNodeData, m as StudioMachine, n as StatelyActorImplementation, o as StatelyGuard, p as StudioEventTypeData, r as StatelyEdgeData, s as StatelyImplementation, t as StatelyAction, u as StatelyTagImplementation, v as toStudioMachine } from "./graph-GeuH-mFK.mjs";
+import { _ as studioMachineConverter, a as StatelyGraphData, c as StatelyInvoke, d as StudioAction, f as StudioEdge, g as fromStudioMachine, h as StudioNode, i as StatelyGraph, l as StatelyNodeData, m as StudioMachine, n as StatelyActorImplementation, o as StatelyGuard, p as StudioEventTypeData, r as StatelyEdgeData, s as StatelyImplementation, t as StatelyAction, u as StatelyTagImplementation, v as toStudioMachine } from "./graph-CszT5J6W.mjs";
 export { StatelyAction, StatelyActorImplementation, StatelyEdgeData, StatelyGraph, StatelyGraphData, StatelyGuard, StatelyImplementation, StatelyInvoke, StatelyNodeData, StatelyTagImplementation, StudioAction, StudioEdge, StudioEventTypeData, StudioMachine, StudioNode, fromStudioMachine, studioMachineConverter, toStudioMachine };

package/dist/{graphToXStateTS-DOaLOySy.mjs → graphToXStateTS-D12GTMBp.mjs}

@@ -4668,6 +4668,7 @@ function deepSimplify(config) {
 	return config;
 }
 function buildMeta(meta, color) {
+	if (isCodeExpression(meta)) return meta;
 	const result = {};
 	if (meta) {
 		for (const [k, v] of Object.entries(meta)) if (v !== void 0 && v !== null) result[k] = v;
@@ -4675,6 +4676,9 @@ function buildMeta(meta, color) {
 	if (color) result["@statelyai.color"] = color;
 	return Object.keys(result).length > 0 ? result : void 0;
 }
+function isCodeExpression(value) {
+	return Boolean(value && typeof value === "object" && !Array.isArray(value) && value["@type"] === "code" && typeof value.expr === "string");
+}
 /** Format event param — supports { type: string } (new) and plain string (legacy) */
 function formatEventParam(event) {
 	if (event && typeof event === "object" && "type" in event) return formatInlineObject(event);
@@ -4693,6 +4697,10 @@ function formatObjectKey(key) {
 const eventParamSchema = union([string(), object({ type: string() }).catchall(unknown())]);
 const delayParamSchema = union([number(), string()]);
 const builtInActionParamSchemas = {
+	"xstate.enqueue": object({
+		code: string().optional(),
+		lang: string().optional()
+	}),
 	"xstate.raise": object({
 		event: eventParamSchema.optional(),
 		id: string().optional(),
@@ -4716,6 +4724,16 @@ const builtInActionParamSchemas = {
 	"xstate.assign": object({ assignment: record(string(), unknown()).optional() }).catchall(unknown())
 };
 const XSTATE_BUILT_IN_ACTIONS = {
+	"xstate.enqueue": {
+		package: "xstate",
+		version: "^6",
+		import: "enqueue",
+		importKind: "named",
+		paramsSchema: builtInActionParamSchemas["xstate.enqueue"],
+		emit(params) {
+			return typeof params?.code === "string" ? stripExportDefault$1(params.code) : "";
+		}
+	},
 	"xstate.raise": {
 		package: "xstate",
 		version: "^5",
@@ -4858,6 +4876,7 @@ function serializeGuard(guard, asTypeRef) {
 */
 function serializeActionItem(action) {
 	const { type, params } = action;
+	if (type === "xstate.enqueue" && typeof params?.code === "string") return inlineCodeExpression(params.code);
 	const exprCode = type === "xstate.expr" && typeof params?.code === "string" ? params.code : void 0;
 	if (isBuiltInActionType(type)) {
 		const builtInAction = XSTATE_BUILT_IN_ACTIONS[type];
@@ -4890,7 +4909,8 @@ function graphToMachineConfig(graph, options = {}) {
 		const nodeType = [
 			"final",
 			"history",
-			"parallel"
+			"parallel",
+			"choice"
 		].includes(node.data.type) ? node.data.type : void 0;
 		const tags = node.data.tags;
 		Object.assign(nodeConfig, {
@@ -4905,6 +4925,7 @@ function graphToMachineConfig(graph, options = {}) {
 				...inv.input ? { input: inv.input } : void 0,
 				...inv.output ? { output: inv.output } : void 0
 			})) } : void 0,
+			...node.data.output !== void 0 ? { output: node.data.output } : void 0,
 			...tags?.length ? { tags: tags.map(tagToString) } : void 0,
 			...showDescriptions && node.data.description ? { description: node.data.description } : void 0,
 			...showMeta && node.data.meta && Object.keys(node.data.meta).length > 0 ? { meta: node.data.meta } : void 0,
@@ -4916,6 +4937,7 @@ function graphToMachineConfig(graph, options = {}) {
 			const on = {};
 			const after = {};
 			const alwaysArr = [];
+			const choiceArr = [];
 			const onDone = {};
 			const invokeMap = {};
 			for (const edge of edges) {
@@ -4927,6 +4949,7 @@ function graphToMachineConfig(graph, options = {}) {
 					target: edge.data.transitionType === "targetless" ? void 0 : `${resolvedTarget}`,
 					...edge.data.transitionType === "reenter" ? { reenter: true } : void 0,
 					guard: edge.data.guard ? serializeGuard(edge.data.guard, inlineGuardsAsTypeRef) : void 0,
+					...edge.data.context !== void 0 ? { context: edge.data.context } : void 0,
 					actions: edge.data.actions?.length ? edge.data.actions.map(serializeActionItem) : void 0,
 					description: edge.data.description ?? void 0,
 					...transitionMeta ? { meta: transitionMeta } : void 0
@@ -4949,6 +4972,7 @@ function graphToMachineConfig(graph, options = {}) {
 					if (!onDone[type]) onDone[type] = [];
 					onDone[type].push(transitionObject);
 				} else pushOn(`xstate.${ref.kind === "actionDone" ? "done" : "error"}.actor.${resolveSpawnActorId(node, ref.blockId)}`);
+				else if (type === "" && node.data.type === "choice") choiceArr.push(transitionObject);
 				else if (type === "") alwaysArr.push(transitionObject);
 				else if (type.startsWith("xstate.after.")) {
 					const delayKey = type.slice(13).split(".")[0];
@@ -4968,6 +4992,7 @@ function graphToMachineConfig(graph, options = {}) {
 			if (Object.keys(on).length > 0) nodeConfig.on = singleOrArrayRecord(on);
 			if (Object.keys(after).length > 0) nodeConfig.after = singleOrArrayRecord(after);
 			if (alwaysArr.length > 0) nodeConfig.always = singleOrArray(alwaysArr);
+			if (choiceArr.length > 0) nodeConfig.choice = singleOrArray(choiceArr);
 			if (Object.keys(onDone).length > 0) nodeConfig.onDone = singleOrArray(Object.values(onDone).flat());
 			if (Object.keys(invokeMap).length > 0 && Array.isArray(nodeConfig.invoke)) nodeConfig.invoke = nodeConfig.invoke.map((inv, index) => {
 				const mapped = invokeMap[node.data.invokes?.[index]?.id ?? inv.id];

package/dist/index.d.mts

@@ -1,10 +1,12 @@
 import { StatelyApiClientOptions, StatelyApiError, StatelyApiUrlOptions, createStatelyApiClient, createStatelyApiUrl } from "./api.mjs";
-import { CommentsConfig, EmbedEventHandler, EmbedEventMap, EmbedEventName, EmbedMode, ExportCallOptions, ExportFormat, ExportFormatMap, InitOptions, ProjectEmbedMachine, UploadResult } from "./protocol.mjs";
+import { CapabilityDeniedCapability, CapabilityDeniedEvent, CommentsConfig, EditorCapabilities, EmbedEventHandler, EmbedEventMap, EmbedEventName, EmbedMode, ExportCallOptions, ExportFormat, ExportFormatMap, InitOptions, ProjectEmbedMachine, UploadResult } from "./protocol.mjs";
 import { AssetUploadAdapter, AssetUploadContext, AssetUploadRequest, CreateS3AssetUploadAdapterOptions, CreateSupabaseAssetUploadAdapterOptions, S3UploadTarget, SupabaseStorageClient, createS3AssetUploadAdapter, createSupabaseAssetUploadAdapter } from "./assetStorage.mjs";
+import { i as getCredentialToken, n as StatelyCredential, r as createAuthorizationHeader, t as StatelyAuthMode } from "./auth-DO1-eQcU.mjs";
 import { AssetConfig, StatelyEmbed, StatelyEmbedOptions, createStatelyEmbed } from "./embed.mjs";
-import { C as EventTypeData, E as JSONSchema7, S as DigraphNodeConfig, T as CodeGenGraph, _ as studioMachineConverter, a as StatelyGraphData, b as DigraphConfig, c as StatelyInvoke, d as StudioAction, f as StudioEdge, g as fromStudioMachine, h as StudioNode, i as StatelyGraph, l as StatelyNodeData, m as StudioMachine, o as StatelyGuard, r as StatelyEdgeData, t as StatelyAction, v as toStudioMachine, w as StateNodeJSONData, x as DigraphEdgeConfig, y as DigraphAction } from "./graph-GeuH-mFK.mjs";
-import { a as ManualActorOptions, c as createPostMessageTransport, i as InspectorEvents, l as createWebSocketTransport, n as CreateInspectorOptions, o as createStatelyInspector, r as Inspector, s as Transport, t as AdoptedActor } from "./inspect-BLlM3qKf.mjs";
+import { C as EventTypeData, E as JSONSchema7, S as DigraphNodeConfig, T as CodeGenGraph, _ as studioMachineConverter, a as StatelyGraphData, b as DigraphConfig, c as StatelyInvoke, d as StudioAction, f as StudioEdge, g as fromStudioMachine, h as StudioNode, i as StatelyGraph, l as StatelyNodeData, m as StudioMachine, o as StatelyGuard, r as StatelyEdgeData, t as StatelyAction, v as toStudioMachine, w as StateNodeJSONData, x as DigraphEdgeConfig, y as DigraphAction } from "./graph-CszT5J6W.mjs";
+import { a as ManualActorOptions, c as createPostMessageTransport, i as InspectorEvents, l as createWebSocketTransport, n as CreateInspectorOptions, o as createStatelyInspector, r as Inspector, s as Transport, t as AdoptedActor } from "./inspect-BibyPhFj.mjs";
 import { ConnectedRepo, CreateMachineFromDefinitionInput, CreateMachineFromTemplateInput, CreateMachineInput, CreateMachineTemplate, CreateProjectInput, EnsureProjectInput, ExtractMachinesResponse, ExtractedMachine, GetMachineOptions, ProjectData, ProjectMachine, ProjectVisibility, RepoType, StudioApiError, StudioClient, StudioClientOptions, StudioMachineRecord, UpdateMachineInput, VerifyApiKeyResponse, XStateVersion, createStatelyClient } from "./studio.mjs";
+import { OAuthAuthorizationServerMetadata, OAuthProtectedResourceMetadata, OAuthTokenResponse, PkcePair, buildAuthorizeUrl, createPkcePair, discoverAuthorizationServer, discoverProtectedResource, exchangeCodeForToken, refreshToken } from "./oauth.mjs";
 import { PlanSyncOptions, PullSyncResult, PushLocalMachineLinksResult, PushSyncOptions, PushSyncProjectOptions, PushSyncResult, ResolvedSyncInput, SyncInputFormat, SyncPlan, SyncPlanSummary } from "./sync.mjs";
 import { ActionLocation, GraphPatch } from "./patchTypes.mjs";
 import { UnknownMachineConfig } from "xstate";
@@ -83,4 +85,4 @@ declare function contextSchemaToTSType(context: Record<string, JSONSchema7> | nu
  */
 declare function eventsSchemaToTSType(events: Record<string, JSONSchema7> | null | undefined): string | null;
 //#endregion
-export { type ActionLocation, type AdoptedActor, type AssetConfig, type AssetUploadAdapter, type AssetUploadContext, type AssetUploadRequest, type CodeGenGraph, type CommentsConfig, type ConnectedRepo, type CreateInspectorOptions, type CreateMachineFromDefinitionInput, type CreateMachineFromTemplateInput, type CreateMachineInput, type CreateMachineTemplate, type CreateProjectInput, type CreateS3AssetUploadAdapterOptions, type CreateSupabaseAssetUploadAdapterOptions, type DigraphAction, type DigraphConfig, type DigraphEdgeConfig, type DigraphNodeConfig, type EmbedEventHandler, type EmbedEventMap, type EmbedEventName, type EmbedMode, type EnsureProjectInput, type EventTypeData, type ExportCallOptions, type ExportFormat, type ExportFormatMap, type ExtractMachinesResponse, type ExtractedMachine, type GetMachineOptions, type GraphPatch, type InitOptions, type Inspector, type InspectorEvents, type MachineConfigOptions, type ManualActorOptions, type PlanSyncOptions, type ProjectData, type ProjectEmbedMachine, type ProjectMachine, type ProjectVisibility, type PullSyncResult, type PushLocalMachineLinksResult, type PushSyncOptions, type PushSyncProjectOptions, type PushSyncResult, RawCode, type RepoType, type ResolvedSyncInput, type S3UploadTarget, type StateNodeJSONData, type StatelyAction, type StatelyApiClientOptions, StatelyApiError, type StatelyApiUrlOptions, type StatelyEdgeData, type StatelyEmbed, type StatelyEmbedOptions, type StatelyGraph, type StatelyGraphData, type StatelyGuard, type StatelyInvoke, type StatelyNodeData, type StatelyPragma, type StatelyPragmaAttachment, type StudioAction, StudioApiError, type StudioClient, type StudioClientOptions, type StudioEdge, type StudioMachine, type StudioMachineRecord, type StudioNode, type SupabaseStorageClient, type SyncInputFormat, type SyncPlan, type SyncPlanSummary, type Transport, type UpdateMachineInput, type UploadResult, type UpsertStatelyPragmaOptions, type VerifyApiKeyResponse, type XStateTSOptions, type XStateVersion, contextSchemaToTSType, createPostMessageTransport, createS3AssetUploadAdapter, createStatelyApiClient, createStatelyApiUrl, createStatelyClient, createStatelyEmbed, createStatelyInspector, createSupabaseAssetUploadAdapter, createWebSocketTransport, eventsSchemaToTSType, findStatelyPragmaAttachments, fromStudioMachine, getStatelyPragma, graphToMachineConfig, graphToXStateTS, jsonSchemaToTSType, raw, serializeJS, studioMachineConverter, toStudioMachine, upsertStatelyPragma };
+export { type ActionLocation, type AdoptedActor, type AssetConfig, type AssetUploadAdapter, type AssetUploadContext, type AssetUploadRequest, type CapabilityDeniedCapability, type CapabilityDeniedEvent, type CodeGenGraph, type CommentsConfig, type ConnectedRepo, type CreateInspectorOptions, type CreateMachineFromDefinitionInput, type CreateMachineFromTemplateInput, type CreateMachineInput, type CreateMachineTemplate, type CreateProjectInput, type CreateS3AssetUploadAdapterOptions, type CreateSupabaseAssetUploadAdapterOptions, type DigraphAction, type DigraphConfig, type DigraphEdgeConfig, type DigraphNodeConfig, type EditorCapabilities, type EmbedEventHandler, type EmbedEventMap, type EmbedEventName, type EmbedMode, type EnsureProjectInput, type EventTypeData, type ExportCallOptions, type ExportFormat, type ExportFormatMap, type ExtractMachinesResponse, type ExtractedMachine, type GetMachineOptions, type GraphPatch, type InitOptions, type Inspector, type InspectorEvents, type MachineConfigOptions, type ManualActorOptions, type OAuthAuthorizationServerMetadata, type OAuthProtectedResourceMetadata, type OAuthTokenResponse, type PkcePair, type PlanSyncOptions, type ProjectData, type ProjectEmbedMachine, type ProjectMachine, type ProjectVisibility, type PullSyncResult, type PushLocalMachineLinksResult, type PushSyncOptions, type PushSyncProjectOptions, type PushSyncResult, RawCode, type RepoType, type ResolvedSyncInput, type S3UploadTarget, type StateNodeJSONData, type StatelyAction, type StatelyApiClientOptions, StatelyApiError, type StatelyApiUrlOptions, type StatelyAuthMode, type StatelyCredential, type StatelyEdgeData, type StatelyEmbed, type StatelyEmbedOptions, type StatelyGraph, type StatelyGraphData, type StatelyGuard, type StatelyInvoke, type StatelyNodeData, type StatelyPragma, type StatelyPragmaAttachment, type StudioAction, StudioApiError, type StudioClient, type StudioClientOptions, type StudioEdge, type StudioMachine, type StudioMachineRecord, type StudioNode, type SupabaseStorageClient, type SyncInputFormat, type SyncPlan, type SyncPlanSummary, type Transport, type UpdateMachineInput, type UploadResult, type UpsertStatelyPragmaOptions, type VerifyApiKeyResponse, type XStateTSOptions, type XStateVersion, buildAuthorizeUrl, contextSchemaToTSType, createAuthorizationHeader, createPkcePair, createPostMessageTransport, createS3AssetUploadAdapter, createStatelyApiClient, createStatelyApiUrl, createStatelyClient, createStatelyEmbed, createStatelyInspector, createSupabaseAssetUploadAdapter, createWebSocketTransport, discoverAuthorizationServer, discoverProtectedResource, eventsSchemaToTSType, exchangeCodeForToken, findStatelyPragmaAttachments, fromStudioMachine, getCredentialToken, getStatelyPragma, graphToMachineConfig, graphToXStateTS, jsonSchemaToTSType, raw, refreshToken, serializeJS, studioMachineConverter, toStudioMachine, upsertStatelyPragma };

package/dist/index.mjs

@@ -1,10 +1,12 @@
-import { n as createWebSocketTransport, t as createPostMessageTransport } from "./transport-CVZGF0w9.mjs";
+import { n as createWebSocketTransport, t as createPostMessageTransport } from "./transport-D0nlFaLn.mjs";
 import { createStatelyEmbed } from "./embed.mjs";
 import { createS3AssetUploadAdapter, createSupabaseAssetUploadAdapter } from "./assetStorage.mjs";
 import { createStatelyInspector } from "./inspect.mjs";
+import { createAuthorizationHeader, getCredentialToken } from "./auth.mjs";
 import { StudioApiError, createStatelyClient } from "./studio.mjs";
+import { buildAuthorizeUrl, createPkcePair, discoverAuthorizationServer, discoverProtectedResource, exchangeCodeForToken, refreshToken } from "./oauth.mjs";
 import { StatelyApiError, createStatelyApiClient, createStatelyApiUrl } from "./api.mjs";
-import { S as upsertStatelyPragma, a as graphToMachineConfig, b as findStatelyPragmaAttachments, c as serializeJS, i as jsonSchemaToTSType, n as contextSchemaToTSType, o as RawCode, r as eventsSchemaToTSType, s as raw, t as graphToXStateTS, x as getStatelyPragma } from "./graphToXStateTS-DOaLOySy.mjs";
+import { S as upsertStatelyPragma, a as graphToMachineConfig, b as findStatelyPragmaAttachments, c as serializeJS, i as jsonSchemaToTSType, n as contextSchemaToTSType, o as RawCode, r as eventsSchemaToTSType, s as raw, t as graphToXStateTS, x as getStatelyPragma } from "./graphToXStateTS-D12GTMBp.mjs";
 import { fromStudioMachine, studioMachineConverter, toStudioMachine } from "./graph.mjs";
 
-export { RawCode, StatelyApiError, StudioApiError, contextSchemaToTSType, createPostMessageTransport, createS3AssetUploadAdapter, createStatelyApiClient, createStatelyApiUrl, createStatelyClient, createStatelyEmbed, createStatelyInspector, createSupabaseAssetUploadAdapter, createWebSocketTransport, eventsSchemaToTSType, findStatelyPragmaAttachments, fromStudioMachine, getStatelyPragma, graphToMachineConfig, graphToXStateTS, jsonSchemaToTSType, raw, serializeJS, studioMachineConverter, toStudioMachine, upsertStatelyPragma };
+export { RawCode, StatelyApiError, StudioApiError, buildAuthorizeUrl, contextSchemaToTSType, createAuthorizationHeader, createPkcePair, createPostMessageTransport, createS3AssetUploadAdapter, createStatelyApiClient, createStatelyApiUrl, createStatelyClient, createStatelyEmbed, createStatelyInspector, createSupabaseAssetUploadAdapter, createWebSocketTransport, discoverAuthorizationServer, discoverProtectedResource, eventsSchemaToTSType, exchangeCodeForToken, findStatelyPragmaAttachments, fromStudioMachine, getCredentialToken, getStatelyPragma, graphToMachineConfig, graphToXStateTS, jsonSchemaToTSType, raw, refreshToken, serializeJS, studioMachineConverter, toStudioMachine, upsertStatelyPragma };

package/dist/{inspect-BLlM3qKf.d.mts → inspect-BibyPhFj.d.mts}

@@ -1,4 +1,4 @@
-import { EmbedEventMap, ExportCallOptions, ExportFormat, ExportFormatMap, ProtocolMessage } from "./protocol.mjs";
+import { EditorCapabilities, EmbedEventMap, ExportCallOptions, ExportFormat, ExportFormatMap, ProtocolMessage } from "./protocol.mjs";
 
 //#region src/transport.d.ts
 interface Transport {
@@ -120,19 +120,13 @@ interface ManualActorOptions {
   systemId?: string;
 }
 interface CreateInspectorOptions {
-  /**
-   * Root xstate actor to adopt. The inspector walks its `system`.
-   * Omit this for manual-only mode where you call `.actor()` / `.snapshot()`.
-   */
-  actor?: any;
   /** WebSocket URL of the devtools server. Default: `'ws://localhost:4242'`. */
   url?: string;
   /** Auto-open browser to visualizer. Default: `true`. */
   autoOpen?: boolean;
   /**
-   * Relay session id. Defaults to the root actor's `sessionId` (auto mode)
-   * or a random id (manual mode). This is the `?session=<id>` value the viz
-   * iframe connects with.
+   * Relay session id. Defaults to a random id. This is the `?session=<id>`
+   * value the viz iframe connects with.
    */
   sessionId?: string;
   /** Display name for this system in the visualizer. */
@@ -148,7 +142,7 @@ interface CreateInspectorOptions {
    * `actor.logic.config`. Return `null` for non-machine actors.
    */
   extractMachineConfig?: (actor: any) => unknown;
-  /** Selected actor id to focus on first. Defaults to the root actor. */
+  /** Selected actor id to focus on first. Defaults to the first inspected root. */
   selectedActorId?: string;
   /** Panel layout forwarded into the system init message. */
   panels?: {
@@ -159,6 +153,7 @@ interface CreateInspectorOptions {
   theme?: 'light' | 'dark';
   readOnly?: boolean;
   depth?: number;
+  capabilities?: EditorCapabilities;
   /**
    * Advanced: inject a pre-built transport (e.g. a channel from a
    * multiplexed connection). When provided, `url`/`name` are ignored and the
@@ -171,6 +166,10 @@ interface Inspector {
   readonly actors: ReadonlyMap<string, AdoptedActor>;
   /** The relay sessionId this inspector registered under. */
   readonly sessionId: string;
+  /** Adopt an xstate actor system. Existing actors are backfilled immediately. */
+  inspect(actor: any): {
+    unsubscribe(): void;
+  };
   /** Subscribe to lifecycle / error events. Returns an unsubscribe function. */
   on<E extends EventName>(event: E, handler: Handler<E>): () => void;
   off<E extends EventName>(event: E, handler: Handler<E>): void;
@@ -201,6 +200,6 @@ interface Inspector {
   /** Tear down the WebSocket + xstate subscription. */
   destroy(): void;
 }
-declare function createStatelyInspector(options: CreateInspectorOptions): Inspector;
+declare function createStatelyInspector(options?: CreateInspectorOptions): Inspector;
 //#endregion
 export { ManualActorOptions as a, createPostMessageTransport as c, InspectorEvents as i, createWebSocketTransport as l, CreateInspectorOptions as n, createStatelyInspector as o, Inspector as r, Transport as s, AdoptedActor as t };

package/dist/inspect.d.mts

@@ -1,3 +1,3 @@
-import { EmbedEventHandler, EmbedEventMap, EmbedEventName, EmbedMode, ExportCallOptions, ExportFormat, ExportFormatMap } from "./protocol.mjs";
-import { a as ManualActorOptions, i as InspectorEvents, n as CreateInspectorOptions, o as createStatelyInspector, r as Inspector, s as Transport, t as AdoptedActor } from "./inspect-BLlM3qKf.mjs";
-export { AdoptedActor, CreateInspectorOptions, EmbedEventHandler, EmbedEventMap, EmbedEventName, EmbedMode, ExportCallOptions, ExportFormat, ExportFormatMap, Inspector, InspectorEvents, ManualActorOptions, Transport, createStatelyInspector };
+import { EditorCapabilities, EmbedEventHandler, EmbedEventMap, EmbedEventName, EmbedMode, ExportCallOptions, ExportFormat, ExportFormatMap } from "./protocol.mjs";
+import { a as ManualActorOptions, i as InspectorEvents, n as CreateInspectorOptions, o as createStatelyInspector, r as Inspector, s as Transport, t as AdoptedActor } from "./inspect-BibyPhFj.mjs";
+export { AdoptedActor, CreateInspectorOptions, EditorCapabilities, EmbedEventHandler, EmbedEventMap, EmbedEventName, EmbedMode, ExportCallOptions, ExportFormat, ExportFormatMap, Inspector, InspectorEvents, ManualActorOptions, Transport, createStatelyInspector };

package/dist/inspect.mjs

@@ -1,4 +1,4 @@
-import { i as createPendingExportManager, n as createWebSocketTransport, r as createEventRegistry } from "./transport-CVZGF0w9.mjs";
+import { i as createPendingExportManager, n as createWebSocketTransport, r as createEventRegistry } from "./transport-D0nlFaLn.mjs";
 
 //#region src/inspect.ts
 const defaultSerializeSnapshot = (snapshot) => ({
@@ -10,12 +10,10 @@ let nextManualId = 0;
 function generateSessionId() {
 	return `manual-${Date.now()}-${nextManualId++}`;
 }
-function createStatelyInspector(options) {
-	const { url = "ws://localhost:4242", autoOpen = true, actor: rootActor, name, serializeSnapshot = defaultSerializeSnapshot, extractMachineConfig = defaultExtractMachineConfig, selectedActorId, panels, theme, readOnly, depth, transport: injectedTransport } = options;
-	const root = rootActor ? rootActor : null;
-	const rootActorId = root?.sessionId ?? generateSessionId();
-	const sessionId = options.sessionId ?? rootActorId;
-	const displayName = name ?? (root ? `system:${root.id}` : "system:manual");
+function createStatelyInspector(options = {}) {
+	const { url = "ws://localhost:4242", autoOpen = true, name, serializeSnapshot = defaultSerializeSnapshot, extractMachineConfig = defaultExtractMachineConfig, selectedActorId, panels, theme, readOnly, depth, capabilities, transport: injectedTransport } = options;
+	const sessionId = options.sessionId ?? generateSessionId();
+	const displayName = name ?? "system:manual";
 	let destroyed = false;
 	let initSent = false;
 	const pendingMessages = [];
@@ -92,7 +90,7 @@ function createStatelyInspector(options) {
 			return null;
 		}
 	}
-	function toEntry(actorRef) {
+	function toEntry(actorRef, rootActorId) {
 		return {
 			actorId: actorRef.sessionId,
 			parentActorId: actorRef._parent?.sessionId ?? null,
@@ -116,34 +114,36 @@ function createStatelyInspector(options) {
 	* Walk the actor tree and populate the local `actors` map. Idempotent —
 	* existing entries stay in place but have their snapshot refreshed.
 	*/
-	function backfillActorTree(actorRef) {
+	function backfillActorTree(actorRef, rootActorId) {
 		const existing = actors.get(actorRef.sessionId);
-		const entry = existing ?? toEntry(actorRef);
+		const entry = existing ?? toEntry(actorRef, rootActorId);
 		if (existing) existing.snapshot = snapshotValue(actorRef);
 		else actors.set(entry.actorId, entry);
 		emitRegisterOnce(entry);
 		const children = actorRef.getSnapshot()?.children ?? {};
-		for (const child of Object.values(children)) if (child) backfillActorTree(child);
+		for (const child of Object.values(children)) if (child) backfillActorTree(child, rootActorId);
 	}
+	const inspectedRoots = /* @__PURE__ */ new Map();
 	function sendInit() {
-		if (root) backfillActorTree(root);
+		for (const [rootActorId, { actor }] of inspectedRoots) backfillActorTree(actor, rootActorId);
 		send({
 			type: "@statelyai.system.init",
 			mode: "inspecting",
 			actors: Array.from(actors.values()).map(toSystemEntry),
-			selectedActorId: selectedActorId ?? rootActorId,
+			selectedActorId: selectedActorId ?? inspectedRoots.keys().next().value ?? sessionId,
 			...theme && { theme },
 			...readOnly !== void 0 && { readOnly },
 			...depth !== void 0 && { depth },
+			...capabilities !== void 0 && { capabilities },
 			...panels?.leftPanels && { leftPanels: panels.leftPanels },
 			...panels?.rightPanels && { rightPanels: panels.rightPanels },
 			...panels?.activePanels && { activePanels: panels.activePanels }
 		});
 		initSent = true;
 	}
-	function handleActor(actorRef) {
+	function handleActor(actorRef, rootActorId) {
 		if (actors.has(actorRef.sessionId)) return;
-		const entry = toEntry(actorRef);
+		const entry = toEntry(actorRef, rootActorId);
 		actors.set(entry.actorId, entry);
 		if (!initSent) return;
 		send({
@@ -156,8 +156,8 @@ function createStatelyInspector(options) {
 		});
 		emitRegisterOnce(entry);
 	}
-	function handleSnapshot(actorRef, snapshot, triggeringEvent) {
-		if (!actors.has(actorRef.sessionId)) handleActor(actorRef);
+	function handleSnapshot(actorRef, snapshot, triggeringEvent, rootActorId) {
+		if (!actors.has(actorRef.sessionId)) handleActor(actorRef, rootActorId);
 		const entry = actors.get(actorRef.sessionId);
 		if (!entry) return;
 		const serialized = serializeSnapshot(snapshot);
@@ -183,28 +183,43 @@ function createStatelyInspector(options) {
 			emitLocal("stopped", { actorId: entry.actorId });
 		}
 	}
-	if (root) backfillActorTree(root);
-	const subscription = root ? root.system.inspect((inspectionEvent) => {
-		if (destroyed) return;
-		switch (inspectionEvent.type) {
-			case "@xstate.actor":
-				handleActor(inspectionEvent.actorRef);
-				break;
-			case "@xstate.event":
-				if (inspectionEvent.sourceRef) pendingEventSource.set(inspectionEvent.actorRef.sessionId, inspectionEvent.sourceRef.sessionId);
-				break;
-			case "@xstate.snapshot":
-				handleSnapshot(inspectionEvent.actorRef, inspectionEvent.snapshot, inspectionEvent.event);
-				break;
-			default: break;
-		}
-	}) : null;
+	function inspectActor(actor) {
+		const root = actor;
+		const rootActorId = root.sessionId;
+		const existing = inspectedRoots.get(rootActorId);
+		if (existing) return existing.subscription;
+		const subscription = root.system.inspect((inspectionEvent) => {
+			if (destroyed) return;
+			switch (inspectionEvent.type) {
+				case "@xstate.actor":
+					handleActor(inspectionEvent.actorRef, rootActorId);
+					break;
+				case "@xstate.event":
+					if (inspectionEvent.sourceRef) pendingEventSource.set(inspectionEvent.actorRef.sessionId, inspectionEvent.sourceRef.sessionId);
+					break;
+				case "@xstate.snapshot":
+					handleSnapshot(inspectionEvent.actorRef, inspectionEvent.snapshot, inspectionEvent.event, rootActorId);
+					break;
+				default: break;
+			}
+		});
+		inspectedRoots.set(rootActorId, {
+			actor: root,
+			subscription
+		});
+		backfillActorTree(root, rootActorId);
+		if (initSent) sendInit();
+		return { unsubscribe() {
+			subscription.unsubscribe();
+			inspectedRoots.delete(rootActorId);
+		} };
+	}
 	function manualRegister(id, opts) {
 		if (actors.has(id)) return;
 		const entry = {
 			actorId: id,
 			parentActorId: opts?.parent ?? null,
-			rootId: rootActorId,
+			rootId: sessionId,
 			id,
 			systemId: opts?.systemId,
 			snapshot: opts?.snapshot ?? null,
@@ -252,6 +267,7 @@ function createStatelyInspector(options) {
 		get sessionId() {
 			return sessionId;
 		},
+		inspect: inspectActor,
 		on(event, handler) {
 			if (!localListeners[event]) localListeners[event] = /* @__PURE__ */ new Set();
 			localListeners[event].add(handler);
@@ -273,12 +289,13 @@ function createStatelyInspector(options) {
 			if (destroyed) return;
 			destroyed = true;
 			try {
-				subscription?.unsubscribe();
+				for (const { subscription } of inspectedRoots.values()) subscription.unsubscribe();
 			} catch {}
 			if (ownsTransport) transport.destroy();
 			exportManager.clear("Inspector destroyed");
 			events.clear();
 			actors.clear();
+			inspectedRoots.clear();
 			pendingMessages.length = 0;
 			for (const set of Object.values(localListeners)) set?.clear();
 		}

package/dist/oauth.d.mts

@@ -0,0 +1,60 @@
+//#region src/oauth.d.ts
+interface OAuthProtectedResourceMetadata {
+  resource: string;
+  authorization_servers?: string[];
+  bearer_methods_supported?: string[];
+  scopes_supported?: string[];
+  [key: string]: unknown;
+}
+interface OAuthAuthorizationServerMetadata {
+  issuer: string;
+  authorization_endpoint?: string;
+  token_endpoint?: string;
+  code_challenge_methods_supported?: string[];
+  scopes_supported?: string[];
+  [key: string]: unknown;
+}
+interface PkcePair {
+  codeVerifier: string;
+  codeChallenge: string;
+}
+interface OAuthTokenResponse {
+  access_token: string;
+  refresh_token?: string;
+  expires_in?: number;
+  expires_at?: number;
+  token_type?: string;
+  scope?: string;
+  [key: string]: unknown;
+}
+declare function discoverProtectedResource(resourceUrl: string | URL, options?: {
+  fetch?: typeof fetch;
+}): Promise<OAuthProtectedResourceMetadata>;
+declare function discoverAuthorizationServer(issuer: string | URL, options?: {
+  fetch?: typeof fetch;
+}): Promise<OAuthAuthorizationServerMetadata>;
+declare function createPkcePair(): Promise<PkcePair>;
+declare function buildAuthorizeUrl(options: {
+  authorizationEndpoint: string | URL;
+  clientId: string;
+  redirectUri: string;
+  codeChallenge: string;
+  state: string;
+  scopes?: string[];
+}): string;
+declare function exchangeCodeForToken(options: {
+  tokenEndpoint: string | URL;
+  code: string;
+  codeVerifier: string;
+  redirectUri: string;
+  clientId: string;
+  fetch?: typeof fetch;
+}): Promise<OAuthTokenResponse>;
+declare function refreshToken(options: {
+  tokenEndpoint: string | URL;
+  refreshToken: string;
+  clientId: string;
+  fetch?: typeof fetch;
+}): Promise<OAuthTokenResponse>;
+//#endregion
+export { OAuthAuthorizationServerMetadata, OAuthProtectedResourceMetadata, OAuthTokenResponse, PkcePair, buildAuthorizeUrl, createPkcePair, discoverAuthorizationServer, discoverProtectedResource, exchangeCodeForToken, refreshToken };