@statelyai/sdk 0.11.0 → 0.12.0

package/README.md

@@ -28,11 +28,35 @@ embed.init({
 });
 ```
 
+Restrict an embed by passing a resolved access policy:
+
+```ts
+embed.init({
+  machine: myMachineConfig,
+  mode: 'viewing',
+  readOnly: true,
+  capabilities: {
+    edit: false,
+    export: false,
+    ai: false,
+    simulate: false,
+    navigateHierarchy: false,
+    maxDepth: 1,
+    panels: ['structure', 'details', 'validations'],
+  },
+});
+
+embed.on('capabilityDenied', (event) => {
+  console.warn(event.message);
+});
+```
+
 Key capabilities:
 
 - **Mount or attach** to any container element or existing iframe
 - **Two-way sync** - push machine configs in, get changes and saves back via event callbacks
 - **Export** to multiple formats: XState v5, XState JSON, Mermaid, Redux, Zustand, ASL, SCXML, and more
+- **Access policies** for read-only, no-export, no-AI, shallow-viewer embeds
 - **Comments** via Liveblocks integration (optional)
 - **Asset uploads** with built-in S3 and Supabase adapters, or bring your own upload handler
 - **Runtime settings** - toggle color mode, grid, snap lines, autolayout, and view mode on the fly
@@ -69,7 +93,10 @@ Programmatic access to Stately Studio for managing projects and machines, extrac
 import { createStatelyClient } from '@statelyai/sdk';
 
 const studio = createStatelyClient({
-  apiKey: process.env.STATELY_API_KEY,
+  credential: {
+    type: 'oauth',
+    accessToken: process.env.STATELY_ACCESS_TOKEN!,
+  },
 });
 
 const projects = await studio.projects.list();
@@ -77,6 +104,10 @@ const machine = await studio.machines.get('machine-id');
 const extracted = await studio.code.extractMachines(sourceCode);
 ```
 
+Legacy `apiKey` is still accepted as an alias for
+`credential: { type: 'api_key', token }`. Use `authMode: 'none'` only for
+self-hosted deployments that intentionally accept unauthenticated calls.
+
 ### Inspector
 
 Stream live actor-system state to the Stately inspector over WebSockets, with support for automatic XState actor adoption and manual actor registration.

package/dist/auth-DO1-eQcU.d.mts

@@ -0,0 +1,15 @@
+//#region src/auth.d.ts
+type StatelyCredential = {
+  type: 'api_key';
+  token: string;
+} | {
+  type: 'oauth';
+  accessToken: string;
+  refreshToken?: string;
+  expiresAt?: number;
+};
+type StatelyAuthMode = 'auto' | 'none' | 'bearer';
+declare function getCredentialToken(credential: StatelyCredential | string | null | undefined): string | undefined;
+declare function createAuthorizationHeader(credential: StatelyCredential | string): string;
+//#endregion
+export { getCredentialToken as i, StatelyCredential as n, createAuthorizationHeader as r, StatelyAuthMode as t };

package/dist/auth.d.mts

@@ -0,0 +1,2 @@
+import { i as getCredentialToken, n as StatelyCredential, r as createAuthorizationHeader, t as StatelyAuthMode } from "./auth-DO1-eQcU.mjs";
+export { StatelyAuthMode, StatelyCredential, createAuthorizationHeader, getCredentialToken };

package/dist/auth.mjs

@@ -0,0 +1,11 @@
+//#region src/auth.ts
+function getCredentialToken(credential) {
+	if (!credential) return;
+	return typeof credential === "string" ? credential : credential.type === "oauth" ? credential.accessToken : credential.token;
+}
+function createAuthorizationHeader(credential) {
+	return `Bearer ${getCredentialToken(credential)}`;
+}
+
+//#endregion
+export { createAuthorizationHeader, getCredentialToken };

package/dist/embed.d.mts

@@ -1,4 +1,4 @@
-import { CommentsConfig, EmbedEventHandler, EmbedEventMap, EmbedEventName, EmbedMode, ExportCallOptions, ExportFormat, ExportFormatMap, InitOptions, MachineInitOptions, MachineSourceLocations, ProjectEmbedMachine, UploadResult } from "./protocol.mjs";
+import { CapabilityDeniedEvent, CommentsConfig, EditorCapabilities, EmbedEventHandler, EmbedEventMap, EmbedEventName, EmbedMode, ExportCallOptions, ExportFormat, ExportFormatMap, InitOptions, MachineInitOptions, MachineSourceLocations, ProjectEmbedMachine, UploadResult } from "./protocol.mjs";
 import { AssetUploadAdapter } from "./assetStorage.mjs";
 
 //#region src/embed.d.ts
@@ -56,6 +56,7 @@ interface StatelyEmbedOptions extends Partial<MachineInitOptions> {
     code: string;
     message: string;
   }) => void;
+  onCapabilityDenied?: (event: CapabilityDeniedEvent) => void;
 }
 interface StatelyEmbed {
   /** Attach to an existing iframe element. Sets src and begins handshake. */
@@ -89,4 +90,4 @@ interface StatelyEmbed {
 }
 declare function createStatelyEmbed(options: StatelyEmbedOptions): StatelyEmbed;
 //#endregion
-export { AssetConfig, type CommentsConfig, type EmbedEventHandler, type EmbedEventMap, type EmbedEventName, type EmbedMode, type ExportCallOptions, type ExportFormat, type ExportFormatMap, type InitOptions, type MachineInitOptions, type MachineSourceLocations, type ProjectEmbedMachine, StatelyEmbed, StatelyEmbedOptions, type UploadResult, createStatelyEmbed };
+export { AssetConfig, type CapabilityDeniedEvent, type CommentsConfig, type EditorCapabilities, type EmbedEventHandler, type EmbedEventMap, type EmbedEventName, type EmbedMode, type ExportCallOptions, type ExportFormat, type ExportFormatMap, type InitOptions, type MachineInitOptions, type MachineSourceLocations, type ProjectEmbedMachine, StatelyEmbed, StatelyEmbedOptions, type UploadResult, createStatelyEmbed };

package/dist/embed.mjs

@@ -1,4 +1,4 @@
-import { a as toInitMessage, i as createPendingExportManager, r as createEventRegistry, t as createPostMessageTransport } from "./transport-CVZGF0w9.mjs";
+import { a as toInitMessage, i as createPendingExportManager, r as createEventRegistry, t as createPostMessageTransport } from "./transport-D0nlFaLn.mjs";
 
 //#region src/embed.ts
 function buildEmbedUrl(options) {
@@ -15,6 +15,7 @@ function extractInitOptions(options) {
 		theme: options.theme,
 		readOnly: options.readOnly,
 		depth: options.depth,
+		capabilities: options.capabilities,
 		panels: options.panels,
 		commentsByMachineId: options.commentsByMachineId,
 		unsavedIndicator: options.unsavedIndicator
@@ -26,6 +27,7 @@ function extractInitOptions(options) {
 		theme: options.theme,
 		readOnly: options.readOnly,
 		depth: options.depth,
+		capabilities: options.capabilities,
 		panels: options.panels,
 		comments: options.comments,
 		sourceLocations: options.sourceLocations,
@@ -134,6 +136,12 @@ function createStatelyEmbed(options) {
 				events.emit("error", err);
 				break;
 			}
+			case "@statelyai.capabilityDenied": {
+				const { type: _type, ...event } = data;
+				options.onCapabilityDenied?.(event);
+				events.emit("capabilityDenied", event);
+				break;
+			}
 			case "@statelyai.uploadRequest": {
 				const req = data;
 				if (!uploadAsset) {

package/dist/{graph-GeuH-mFK.d.mts → graph-CszT5J6W.d.mts}

@@ -181,9 +181,10 @@ interface CodeGenInvoke {
 interface CodeGenNodeData {
   nodeId?: string | null;
   key: string;
-  type?: 'normal' | 'parallel' | 'final' | 'history' | null;
+  type?: 'normal' | 'parallel' | 'final' | 'history' | 'choice' | null;
   initialId?: string | null;
   history?: 'shallow' | 'deep' | boolean;
+  output?: Record<string, unknown> | CodeExpression;
   entry?: CodeGenAction[];
   exit?: CodeGenAction[];
   invokes?: CodeGenInvoke[];
@@ -200,6 +201,7 @@ interface CodeGenEdgeData {
   eventType: string;
   transitionType?: 'normal' | 'targetless' | 'reenter';
   guard?: CodeGenGuard | null;
+  context?: Record<string, unknown> | CodeExpression;
   actions?: CodeGenAction[];
   description?: string | null;
   color?: string;

package/dist/graph.d.mts

@@ -1,2 +1,2 @@
-import { _ as studioMachineConverter, a as StatelyGraphData, c as StatelyInvoke, d as StudioAction, f as StudioEdge, g as fromStudioMachine, h as StudioNode, i as StatelyGraph, l as StatelyNodeData, m as StudioMachine, n as StatelyActorImplementation, o as StatelyGuard, p as StudioEventTypeData, r as StatelyEdgeData, s as StatelyImplementation, t as StatelyAction, u as StatelyTagImplementation, v as toStudioMachine } from "./graph-GeuH-mFK.mjs";
+import { _ as studioMachineConverter, a as StatelyGraphData, c as StatelyInvoke, d as StudioAction, f as StudioEdge, g as fromStudioMachine, h as StudioNode, i as StatelyGraph, l as StatelyNodeData, m as StudioMachine, n as StatelyActorImplementation, o as StatelyGuard, p as StudioEventTypeData, r as StatelyEdgeData, s as StatelyImplementation, t as StatelyAction, u as StatelyTagImplementation, v as toStudioMachine } from "./graph-CszT5J6W.mjs";
 export { StatelyAction, StatelyActorImplementation, StatelyEdgeData, StatelyGraph, StatelyGraphData, StatelyGuard, StatelyImplementation, StatelyInvoke, StatelyNodeData, StatelyTagImplementation, StudioAction, StudioEdge, StudioEventTypeData, StudioMachine, StudioNode, fromStudioMachine, studioMachineConverter, toStudioMachine };

package/dist/{graphToXStateTS-DV62vO_d.mjs → graphToXStateTS-D12GTMBp.mjs}

@@ -4697,6 +4697,10 @@ function formatObjectKey(key) {
 const eventParamSchema = union([string(), object({ type: string() }).catchall(unknown())]);
 const delayParamSchema = union([number(), string()]);
 const builtInActionParamSchemas = {
+	"xstate.enqueue": object({
+		code: string().optional(),
+		lang: string().optional()
+	}),
 	"xstate.raise": object({
 		event: eventParamSchema.optional(),
 		id: string().optional(),
@@ -4720,6 +4724,16 @@ const builtInActionParamSchemas = {
 	"xstate.assign": object({ assignment: record(string(), unknown()).optional() }).catchall(unknown())
 };
 const XSTATE_BUILT_IN_ACTIONS = {
+	"xstate.enqueue": {
+		package: "xstate",
+		version: "^6",
+		import: "enqueue",
+		importKind: "named",
+		paramsSchema: builtInActionParamSchemas["xstate.enqueue"],
+		emit(params) {
+			return typeof params?.code === "string" ? stripExportDefault$1(params.code) : "";
+		}
+	},
 	"xstate.raise": {
 		package: "xstate",
 		version: "^5",
@@ -4862,6 +4876,7 @@ function serializeGuard(guard, asTypeRef) {
 */
 function serializeActionItem(action) {
 	const { type, params } = action;
+	if (type === "xstate.enqueue" && typeof params?.code === "string") return inlineCodeExpression(params.code);
 	const exprCode = type === "xstate.expr" && typeof params?.code === "string" ? params.code : void 0;
 	if (isBuiltInActionType(type)) {
 		const builtInAction = XSTATE_BUILT_IN_ACTIONS[type];
@@ -4894,7 +4909,8 @@ function graphToMachineConfig(graph, options = {}) {
 		const nodeType = [
 			"final",
 			"history",
-			"parallel"
+			"parallel",
+			"choice"
 		].includes(node.data.type) ? node.data.type : void 0;
 		const tags = node.data.tags;
 		Object.assign(nodeConfig, {
@@ -4909,6 +4925,7 @@ function graphToMachineConfig(graph, options = {}) {
 				...inv.input ? { input: inv.input } : void 0,
 				...inv.output ? { output: inv.output } : void 0
 			})) } : void 0,
+			...node.data.output !== void 0 ? { output: node.data.output } : void 0,
 			...tags?.length ? { tags: tags.map(tagToString) } : void 0,
 			...showDescriptions && node.data.description ? { description: node.data.description } : void 0,
 			...showMeta && node.data.meta && Object.keys(node.data.meta).length > 0 ? { meta: node.data.meta } : void 0,
@@ -4920,6 +4937,7 @@ function graphToMachineConfig(graph, options = {}) {
 			const on = {};
 			const after = {};
 			const alwaysArr = [];
+			const choiceArr = [];
 			const onDone = {};
 			const invokeMap = {};
 			for (const edge of edges) {
@@ -4931,6 +4949,7 @@ function graphToMachineConfig(graph, options = {}) {
 					target: edge.data.transitionType === "targetless" ? void 0 : `${resolvedTarget}`,
 					...edge.data.transitionType === "reenter" ? { reenter: true } : void 0,
 					guard: edge.data.guard ? serializeGuard(edge.data.guard, inlineGuardsAsTypeRef) : void 0,
+					...edge.data.context !== void 0 ? { context: edge.data.context } : void 0,
 					actions: edge.data.actions?.length ? edge.data.actions.map(serializeActionItem) : void 0,
 					description: edge.data.description ?? void 0,
 					...transitionMeta ? { meta: transitionMeta } : void 0
@@ -4953,6 +4972,7 @@ function graphToMachineConfig(graph, options = {}) {
 					if (!onDone[type]) onDone[type] = [];
 					onDone[type].push(transitionObject);
 				} else pushOn(`xstate.${ref.kind === "actionDone" ? "done" : "error"}.actor.${resolveSpawnActorId(node, ref.blockId)}`);
+				else if (type === "" && node.data.type === "choice") choiceArr.push(transitionObject);
 				else if (type === "") alwaysArr.push(transitionObject);
 				else if (type.startsWith("xstate.after.")) {
 					const delayKey = type.slice(13).split(".")[0];
@@ -4972,6 +4992,7 @@ function graphToMachineConfig(graph, options = {}) {
 			if (Object.keys(on).length > 0) nodeConfig.on = singleOrArrayRecord(on);
 			if (Object.keys(after).length > 0) nodeConfig.after = singleOrArrayRecord(after);
 			if (alwaysArr.length > 0) nodeConfig.always = singleOrArray(alwaysArr);
+			if (choiceArr.length > 0) nodeConfig.choice = singleOrArray(choiceArr);
 			if (Object.keys(onDone).length > 0) nodeConfig.onDone = singleOrArray(Object.values(onDone).flat());
 			if (Object.keys(invokeMap).length > 0 && Array.isArray(nodeConfig.invoke)) nodeConfig.invoke = nodeConfig.invoke.map((inv, index) => {
 				const mapped = invokeMap[node.data.invokes?.[index]?.id ?? inv.id];

package/dist/index.d.mts

@@ -1,10 +1,12 @@
 import { StatelyApiClientOptions, StatelyApiError, StatelyApiUrlOptions, createStatelyApiClient, createStatelyApiUrl } from "./api.mjs";
-import { CommentsConfig, EmbedEventHandler, EmbedEventMap, EmbedEventName, EmbedMode, ExportCallOptions, ExportFormat, ExportFormatMap, InitOptions, ProjectEmbedMachine, UploadResult } from "./protocol.mjs";
+import { CapabilityDeniedCapability, CapabilityDeniedEvent, CommentsConfig, EditorCapabilities, EmbedEventHandler, EmbedEventMap, EmbedEventName, EmbedMode, ExportCallOptions, ExportFormat, ExportFormatMap, InitOptions, ProjectEmbedMachine, UploadResult } from "./protocol.mjs";
 import { AssetUploadAdapter, AssetUploadContext, AssetUploadRequest, CreateS3AssetUploadAdapterOptions, CreateSupabaseAssetUploadAdapterOptions, S3UploadTarget, SupabaseStorageClient, createS3AssetUploadAdapter, createSupabaseAssetUploadAdapter } from "./assetStorage.mjs";
+import { i as getCredentialToken, n as StatelyCredential, r as createAuthorizationHeader, t as StatelyAuthMode } from "./auth-DO1-eQcU.mjs";
 import { AssetConfig, StatelyEmbed, StatelyEmbedOptions, createStatelyEmbed } from "./embed.mjs";
-import { C as EventTypeData, E as JSONSchema7, S as DigraphNodeConfig, T as CodeGenGraph, _ as studioMachineConverter, a as StatelyGraphData, b as DigraphConfig, c as StatelyInvoke, d as StudioAction, f as StudioEdge, g as fromStudioMachine, h as StudioNode, i as StatelyGraph, l as StatelyNodeData, m as StudioMachine, o as StatelyGuard, r as StatelyEdgeData, t as StatelyAction, v as toStudioMachine, w as StateNodeJSONData, x as DigraphEdgeConfig, y as DigraphAction } from "./graph-GeuH-mFK.mjs";
-import { a as ManualActorOptions, c as createPostMessageTransport, i as InspectorEvents, l as createWebSocketTransport, n as CreateInspectorOptions, o as createStatelyInspector, r as Inspector, s as Transport, t as AdoptedActor } from "./inspect-CZ8iLJR7.mjs";
+import { C as EventTypeData, E as JSONSchema7, S as DigraphNodeConfig, T as CodeGenGraph, _ as studioMachineConverter, a as StatelyGraphData, b as DigraphConfig, c as StatelyInvoke, d as StudioAction, f as StudioEdge, g as fromStudioMachine, h as StudioNode, i as StatelyGraph, l as StatelyNodeData, m as StudioMachine, o as StatelyGuard, r as StatelyEdgeData, t as StatelyAction, v as toStudioMachine, w as StateNodeJSONData, x as DigraphEdgeConfig, y as DigraphAction } from "./graph-CszT5J6W.mjs";
+import { a as ManualActorOptions, c as createPostMessageTransport, i as InspectorEvents, l as createWebSocketTransport, n as CreateInspectorOptions, o as createStatelyInspector, r as Inspector, s as Transport, t as AdoptedActor } from "./inspect-BibyPhFj.mjs";
 import { ConnectedRepo, CreateMachineFromDefinitionInput, CreateMachineFromTemplateInput, CreateMachineInput, CreateMachineTemplate, CreateProjectInput, EnsureProjectInput, ExtractMachinesResponse, ExtractedMachine, GetMachineOptions, ProjectData, ProjectMachine, ProjectVisibility, RepoType, StudioApiError, StudioClient, StudioClientOptions, StudioMachineRecord, UpdateMachineInput, VerifyApiKeyResponse, XStateVersion, createStatelyClient } from "./studio.mjs";
+import { OAuthAuthorizationServerMetadata, OAuthProtectedResourceMetadata, OAuthTokenResponse, PkcePair, buildAuthorizeUrl, createPkcePair, discoverAuthorizationServer, discoverProtectedResource, exchangeCodeForToken, refreshToken } from "./oauth.mjs";
 import { PlanSyncOptions, PullSyncResult, PushLocalMachineLinksResult, PushSyncOptions, PushSyncProjectOptions, PushSyncResult, ResolvedSyncInput, SyncInputFormat, SyncPlan, SyncPlanSummary } from "./sync.mjs";
 import { ActionLocation, GraphPatch } from "./patchTypes.mjs";
 import { UnknownMachineConfig } from "xstate";
@@ -83,4 +85,4 @@ declare function contextSchemaToTSType(context: Record<string, JSONSchema7> | nu
  */
 declare function eventsSchemaToTSType(events: Record<string, JSONSchema7> | null | undefined): string | null;
 //#endregion
-export { type ActionLocation, type AdoptedActor, type AssetConfig, type AssetUploadAdapter, type AssetUploadContext, type AssetUploadRequest, type CodeGenGraph, type CommentsConfig, type ConnectedRepo, type CreateInspectorOptions, type CreateMachineFromDefinitionInput, type CreateMachineFromTemplateInput, type CreateMachineInput, type CreateMachineTemplate, type CreateProjectInput, type CreateS3AssetUploadAdapterOptions, type CreateSupabaseAssetUploadAdapterOptions, type DigraphAction, type DigraphConfig, type DigraphEdgeConfig, type DigraphNodeConfig, type EmbedEventHandler, type EmbedEventMap, type EmbedEventName, type EmbedMode, type EnsureProjectInput, type EventTypeData, type ExportCallOptions, type ExportFormat, type ExportFormatMap, type ExtractMachinesResponse, type ExtractedMachine, type GetMachineOptions, type GraphPatch, type InitOptions, type Inspector, type InspectorEvents, type MachineConfigOptions, type ManualActorOptions, type PlanSyncOptions, type ProjectData, type ProjectEmbedMachine, type ProjectMachine, type ProjectVisibility, type PullSyncResult, type PushLocalMachineLinksResult, type PushSyncOptions, type PushSyncProjectOptions, type PushSyncResult, RawCode, type RepoType, type ResolvedSyncInput, type S3UploadTarget, type StateNodeJSONData, type StatelyAction, type StatelyApiClientOptions, StatelyApiError, type StatelyApiUrlOptions, type StatelyEdgeData, type StatelyEmbed, type StatelyEmbedOptions, type StatelyGraph, type StatelyGraphData, type StatelyGuard, type StatelyInvoke, type StatelyNodeData, type StatelyPragma, type StatelyPragmaAttachment, type StudioAction, StudioApiError, type StudioClient, type StudioClientOptions, type StudioEdge, type StudioMachine, type StudioMachineRecord, type StudioNode, type SupabaseStorageClient, type SyncInputFormat, type SyncPlan, type SyncPlanSummary, type Transport, type UpdateMachineInput, type UploadResult, type UpsertStatelyPragmaOptions, type VerifyApiKeyResponse, type XStateTSOptions, type XStateVersion, contextSchemaToTSType, createPostMessageTransport, createS3AssetUploadAdapter, createStatelyApiClient, createStatelyApiUrl, createStatelyClient, createStatelyEmbed, createStatelyInspector, createSupabaseAssetUploadAdapter, createWebSocketTransport, eventsSchemaToTSType, findStatelyPragmaAttachments, fromStudioMachine, getStatelyPragma, graphToMachineConfig, graphToXStateTS, jsonSchemaToTSType, raw, serializeJS, studioMachineConverter, toStudioMachine, upsertStatelyPragma };
+export { type ActionLocation, type AdoptedActor, type AssetConfig, type AssetUploadAdapter, type AssetUploadContext, type AssetUploadRequest, type CapabilityDeniedCapability, type CapabilityDeniedEvent, type CodeGenGraph, type CommentsConfig, type ConnectedRepo, type CreateInspectorOptions, type CreateMachineFromDefinitionInput, type CreateMachineFromTemplateInput, type CreateMachineInput, type CreateMachineTemplate, type CreateProjectInput, type CreateS3AssetUploadAdapterOptions, type CreateSupabaseAssetUploadAdapterOptions, type DigraphAction, type DigraphConfig, type DigraphEdgeConfig, type DigraphNodeConfig, type EditorCapabilities, type EmbedEventHandler, type EmbedEventMap, type EmbedEventName, type EmbedMode, type EnsureProjectInput, type EventTypeData, type ExportCallOptions, type ExportFormat, type ExportFormatMap, type ExtractMachinesResponse, type ExtractedMachine, type GetMachineOptions, type GraphPatch, type InitOptions, type Inspector, type InspectorEvents, type MachineConfigOptions, type ManualActorOptions, type OAuthAuthorizationServerMetadata, type OAuthProtectedResourceMetadata, type OAuthTokenResponse, type PkcePair, type PlanSyncOptions, type ProjectData, type ProjectEmbedMachine, type ProjectMachine, type ProjectVisibility, type PullSyncResult, type PushLocalMachineLinksResult, type PushSyncOptions, type PushSyncProjectOptions, type PushSyncResult, RawCode, type RepoType, type ResolvedSyncInput, type S3UploadTarget, type StateNodeJSONData, type StatelyAction, type StatelyApiClientOptions, StatelyApiError, type StatelyApiUrlOptions, type StatelyAuthMode, type StatelyCredential, type StatelyEdgeData, type StatelyEmbed, type StatelyEmbedOptions, type StatelyGraph, type StatelyGraphData, type StatelyGuard, type StatelyInvoke, type StatelyNodeData, type StatelyPragma, type StatelyPragmaAttachment, type StudioAction, StudioApiError, type StudioClient, type StudioClientOptions, type StudioEdge, type StudioMachine, type StudioMachineRecord, type StudioNode, type SupabaseStorageClient, type SyncInputFormat, type SyncPlan, type SyncPlanSummary, type Transport, type UpdateMachineInput, type UploadResult, type UpsertStatelyPragmaOptions, type VerifyApiKeyResponse, type XStateTSOptions, type XStateVersion, buildAuthorizeUrl, contextSchemaToTSType, createAuthorizationHeader, createPkcePair, createPostMessageTransport, createS3AssetUploadAdapter, createStatelyApiClient, createStatelyApiUrl, createStatelyClient, createStatelyEmbed, createStatelyInspector, createSupabaseAssetUploadAdapter, createWebSocketTransport, discoverAuthorizationServer, discoverProtectedResource, eventsSchemaToTSType, exchangeCodeForToken, findStatelyPragmaAttachments, fromStudioMachine, getCredentialToken, getStatelyPragma, graphToMachineConfig, graphToXStateTS, jsonSchemaToTSType, raw, refreshToken, serializeJS, studioMachineConverter, toStudioMachine, upsertStatelyPragma };

package/dist/index.mjs

@@ -1,10 +1,12 @@
-import { n as createWebSocketTransport, t as createPostMessageTransport } from "./transport-CVZGF0w9.mjs";
+import { n as createWebSocketTransport, t as createPostMessageTransport } from "./transport-D0nlFaLn.mjs";
 import { createStatelyEmbed } from "./embed.mjs";
 import { createS3AssetUploadAdapter, createSupabaseAssetUploadAdapter } from "./assetStorage.mjs";
 import { createStatelyInspector } from "./inspect.mjs";
+import { createAuthorizationHeader, getCredentialToken } from "./auth.mjs";
 import { StudioApiError, createStatelyClient } from "./studio.mjs";
+import { buildAuthorizeUrl, createPkcePair, discoverAuthorizationServer, discoverProtectedResource, exchangeCodeForToken, refreshToken } from "./oauth.mjs";
 import { StatelyApiError, createStatelyApiClient, createStatelyApiUrl } from "./api.mjs";
-import { S as upsertStatelyPragma, a as graphToMachineConfig, b as findStatelyPragmaAttachments, c as serializeJS, i as jsonSchemaToTSType, n as contextSchemaToTSType, o as RawCode, r as eventsSchemaToTSType, s as raw, t as graphToXStateTS, x as getStatelyPragma } from "./graphToXStateTS-DV62vO_d.mjs";
+import { S as upsertStatelyPragma, a as graphToMachineConfig, b as findStatelyPragmaAttachments, c as serializeJS, i as jsonSchemaToTSType, n as contextSchemaToTSType, o as RawCode, r as eventsSchemaToTSType, s as raw, t as graphToXStateTS, x as getStatelyPragma } from "./graphToXStateTS-D12GTMBp.mjs";
 import { fromStudioMachine, studioMachineConverter, toStudioMachine } from "./graph.mjs";
 
-export { RawCode, StatelyApiError, StudioApiError, contextSchemaToTSType, createPostMessageTransport, createS3AssetUploadAdapter, createStatelyApiClient, createStatelyApiUrl, createStatelyClient, createStatelyEmbed, createStatelyInspector, createSupabaseAssetUploadAdapter, createWebSocketTransport, eventsSchemaToTSType, findStatelyPragmaAttachments, fromStudioMachine, getStatelyPragma, graphToMachineConfig, graphToXStateTS, jsonSchemaToTSType, raw, serializeJS, studioMachineConverter, toStudioMachine, upsertStatelyPragma };
+export { RawCode, StatelyApiError, StudioApiError, buildAuthorizeUrl, contextSchemaToTSType, createAuthorizationHeader, createPkcePair, createPostMessageTransport, createS3AssetUploadAdapter, createStatelyApiClient, createStatelyApiUrl, createStatelyClient, createStatelyEmbed, createStatelyInspector, createSupabaseAssetUploadAdapter, createWebSocketTransport, discoverAuthorizationServer, discoverProtectedResource, eventsSchemaToTSType, exchangeCodeForToken, findStatelyPragmaAttachments, fromStudioMachine, getCredentialToken, getStatelyPragma, graphToMachineConfig, graphToXStateTS, jsonSchemaToTSType, raw, refreshToken, serializeJS, studioMachineConverter, toStudioMachine, upsertStatelyPragma };

package/dist/{inspect-CZ8iLJR7.d.mts → inspect-BibyPhFj.d.mts}

@@ -1,4 +1,4 @@
-import { EmbedEventMap, ExportCallOptions, ExportFormat, ExportFormatMap, ProtocolMessage } from "./protocol.mjs";
+import { EditorCapabilities, EmbedEventMap, ExportCallOptions, ExportFormat, ExportFormatMap, ProtocolMessage } from "./protocol.mjs";
 
 //#region src/transport.d.ts
 interface Transport {
@@ -153,6 +153,7 @@ interface CreateInspectorOptions {
   theme?: 'light' | 'dark';
   readOnly?: boolean;
   depth?: number;
+  capabilities?: EditorCapabilities;
   /**
    * Advanced: inject a pre-built transport (e.g. a channel from a
    * multiplexed connection). When provided, `url`/`name` are ignored and the

package/dist/inspect.d.mts

@@ -1,3 +1,3 @@
-import { EmbedEventHandler, EmbedEventMap, EmbedEventName, EmbedMode, ExportCallOptions, ExportFormat, ExportFormatMap } from "./protocol.mjs";
-import { a as ManualActorOptions, i as InspectorEvents, n as CreateInspectorOptions, o as createStatelyInspector, r as Inspector, s as Transport, t as AdoptedActor } from "./inspect-CZ8iLJR7.mjs";
-export { AdoptedActor, CreateInspectorOptions, EmbedEventHandler, EmbedEventMap, EmbedEventName, EmbedMode, ExportCallOptions, ExportFormat, ExportFormatMap, Inspector, InspectorEvents, ManualActorOptions, Transport, createStatelyInspector };
+import { EditorCapabilities, EmbedEventHandler, EmbedEventMap, EmbedEventName, EmbedMode, ExportCallOptions, ExportFormat, ExportFormatMap } from "./protocol.mjs";
+import { a as ManualActorOptions, i as InspectorEvents, n as CreateInspectorOptions, o as createStatelyInspector, r as Inspector, s as Transport, t as AdoptedActor } from "./inspect-BibyPhFj.mjs";
+export { AdoptedActor, CreateInspectorOptions, EditorCapabilities, EmbedEventHandler, EmbedEventMap, EmbedEventName, EmbedMode, ExportCallOptions, ExportFormat, ExportFormatMap, Inspector, InspectorEvents, ManualActorOptions, Transport, createStatelyInspector };

package/dist/inspect.mjs

@@ -1,4 +1,4 @@
-import { i as createPendingExportManager, n as createWebSocketTransport, r as createEventRegistry } from "./transport-CVZGF0w9.mjs";
+import { i as createPendingExportManager, n as createWebSocketTransport, r as createEventRegistry } from "./transport-D0nlFaLn.mjs";
 
 //#region src/inspect.ts
 const defaultSerializeSnapshot = (snapshot) => ({
@@ -11,7 +11,7 @@ function generateSessionId() {
 	return `manual-${Date.now()}-${nextManualId++}`;
 }
 function createStatelyInspector(options = {}) {
-	const { url = "ws://localhost:4242", autoOpen = true, name, serializeSnapshot = defaultSerializeSnapshot, extractMachineConfig = defaultExtractMachineConfig, selectedActorId, panels, theme, readOnly, depth, transport: injectedTransport } = options;
+	const { url = "ws://localhost:4242", autoOpen = true, name, serializeSnapshot = defaultSerializeSnapshot, extractMachineConfig = defaultExtractMachineConfig, selectedActorId, panels, theme, readOnly, depth, capabilities, transport: injectedTransport } = options;
 	const sessionId = options.sessionId ?? generateSessionId();
 	const displayName = name ?? "system:manual";
 	let destroyed = false;
@@ -134,6 +134,7 @@ function createStatelyInspector(options = {}) {
 			...theme && { theme },
 			...readOnly !== void 0 && { readOnly },
 			...depth !== void 0 && { depth },
+			...capabilities !== void 0 && { capabilities },
 			...panels?.leftPanels && { leftPanels: panels.leftPanels },
 			...panels?.rightPanels && { rightPanels: panels.rightPanels },
 			...panels?.activePanels && { activePanels: panels.activePanels }

package/dist/oauth.d.mts

@@ -0,0 +1,60 @@
+//#region src/oauth.d.ts
+interface OAuthProtectedResourceMetadata {
+  resource: string;
+  authorization_servers?: string[];
+  bearer_methods_supported?: string[];
+  scopes_supported?: string[];
+  [key: string]: unknown;
+}
+interface OAuthAuthorizationServerMetadata {
+  issuer: string;
+  authorization_endpoint?: string;
+  token_endpoint?: string;
+  code_challenge_methods_supported?: string[];
+  scopes_supported?: string[];
+  [key: string]: unknown;
+}
+interface PkcePair {
+  codeVerifier: string;
+  codeChallenge: string;
+}
+interface OAuthTokenResponse {
+  access_token: string;
+  refresh_token?: string;
+  expires_in?: number;
+  expires_at?: number;
+  token_type?: string;
+  scope?: string;
+  [key: string]: unknown;
+}
+declare function discoverProtectedResource(resourceUrl: string | URL, options?: {
+  fetch?: typeof fetch;
+}): Promise<OAuthProtectedResourceMetadata>;
+declare function discoverAuthorizationServer(issuer: string | URL, options?: {
+  fetch?: typeof fetch;
+}): Promise<OAuthAuthorizationServerMetadata>;
+declare function createPkcePair(): Promise<PkcePair>;
+declare function buildAuthorizeUrl(options: {
+  authorizationEndpoint: string | URL;
+  clientId: string;
+  redirectUri: string;
+  codeChallenge: string;
+  state: string;
+  scopes?: string[];
+}): string;
+declare function exchangeCodeForToken(options: {
+  tokenEndpoint: string | URL;
+  code: string;
+  codeVerifier: string;
+  redirectUri: string;
+  clientId: string;
+  fetch?: typeof fetch;
+}): Promise<OAuthTokenResponse>;
+declare function refreshToken(options: {
+  tokenEndpoint: string | URL;
+  refreshToken: string;
+  clientId: string;
+  fetch?: typeof fetch;
+}): Promise<OAuthTokenResponse>;
+//#endregion
+export { OAuthAuthorizationServerMetadata, OAuthProtectedResourceMetadata, OAuthTokenResponse, PkcePair, buildAuthorizeUrl, createPkcePair, discoverAuthorizationServer, discoverProtectedResource, exchangeCodeForToken, refreshToken };

package/dist/oauth.mjs

@@ -0,0 +1,98 @@
+//#region src/oauth.ts
+function getFetch(fetchImpl) {
+	const resolvedFetch = fetchImpl ?? globalThis.fetch;
+	if (!resolvedFetch) throw new Error("No fetch implementation available.");
+	return resolvedFetch;
+}
+async function fetchJson(url, fetchImpl) {
+	const response = await getFetch(fetchImpl)(url, { headers: { Accept: "application/json" } });
+	if (!response.ok) throw new Error(`${url} failed with HTTP ${response.status}`);
+	return response.json();
+}
+async function discoverProtectedResource(resourceUrl, options = {}) {
+	const resource = new URL(String(resourceUrl));
+	const pathParts = resource.pathname.split("/").filter(Boolean);
+	const baseParts = pathParts.length > 2 && pathParts[0] !== "api" ? pathParts.slice(0, 1) : [];
+	const metadataUrl = new URL(resource.origin);
+	metadataUrl.pathname = [
+		...baseParts,
+		".well-known",
+		"oauth-protected-resource",
+		...pathParts
+	].join("/");
+	return fetchJson(metadataUrl.toString(), options.fetch);
+}
+async function discoverAuthorizationServer(issuer, options = {}) {
+	const issuerUrl = new URL(String(issuer));
+	const metadataUrls = [new URL(".well-known/oauth-authorization-server", ensureTrailingSlash(issuerUrl)), new URL(".well-known/openid-configuration", ensureTrailingSlash(issuerUrl))];
+	let lastError;
+	for (const metadataUrl of metadataUrls) try {
+		return await fetchJson(metadataUrl.toString(), options.fetch);
+	} catch (error) {
+		lastError = error;
+	}
+	throw lastError instanceof Error ? lastError : /* @__PURE__ */ new Error(`Unable to discover authorization server metadata for ${issuerUrl}`);
+}
+function ensureTrailingSlash(url) {
+	const next = new URL(url);
+	if (!next.pathname.endsWith("/")) next.pathname = `${next.pathname}/`;
+	return next;
+}
+function base64UrlEncode(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+async function createPkcePair() {
+	const verifierBytes = new Uint8Array(32);
+	crypto.getRandomValues(verifierBytes);
+	const codeVerifier = base64UrlEncode(verifierBytes);
+	return {
+		codeVerifier,
+		codeChallenge: base64UrlEncode(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(codeVerifier))))
+	};
+}
+function buildAuthorizeUrl(options) {
+	const url = new URL(String(options.authorizationEndpoint));
+	url.searchParams.set("response_type", "code");
+	url.searchParams.set("client_id", options.clientId);
+	url.searchParams.set("redirect_uri", options.redirectUri);
+	url.searchParams.set("code_challenge", options.codeChallenge);
+	url.searchParams.set("code_challenge_method", "S256");
+	url.searchParams.set("state", options.state);
+	if (options.scopes?.length) url.searchParams.set("scope", options.scopes.join(" "));
+	return url.toString();
+}
+async function exchangeCodeForToken(options) {
+	const body = new URLSearchParams({
+		grant_type: "authorization_code",
+		code: options.code,
+		code_verifier: options.codeVerifier,
+		redirect_uri: options.redirectUri,
+		client_id: options.clientId
+	});
+	const response = await getFetch(options.fetch)(String(options.tokenEndpoint), {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body
+	});
+	if (!response.ok) throw new Error(`Token exchange failed with HTTP ${response.status}`);
+	return response.json();
+}
+async function refreshToken(options) {
+	const body = new URLSearchParams({
+		grant_type: "refresh_token",
+		refresh_token: options.refreshToken,
+		client_id: options.clientId
+	});
+	const response = await getFetch(options.fetch)(String(options.tokenEndpoint), {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body
+	});
+	if (!response.ok) throw new Error(`Token refresh failed with HTTP ${response.status}`);
+	return response.json();
+}
+
+//#endregion
+export { buildAuthorizeUrl, createPkcePair, discoverAuthorizationServer, discoverProtectedResource, exchangeCodeForToken, refreshToken };

package/dist/protocol.d.mts

@@ -18,6 +18,25 @@ interface ValidationIssue {
   level: "info" | "warning" | "error";
   message: string;
 }
+interface EditorCapabilities {
+  edit?: boolean;
+  export?: boolean;
+  ai?: boolean;
+  simulate?: boolean;
+  inspect?: boolean;
+  navigateHierarchy?: boolean;
+  maxDepth?: number;
+  panels?: string[];
+  commands?: string[];
+}
+type CapabilityDeniedCapability = "edit" | "export" | "ai" | "simulate" | "inspect" | "navigateHierarchy" | "panel" | "mode";
+interface CapabilityDeniedEvent {
+  capability: CapabilityDeniedCapability;
+  action: "openPanel" | "openDialog" | "editSource" | "navigateHierarchy" | "setMode" | "simulationStart" | "inspectStart" | "retrieve";
+  requested?: string;
+  message: string;
+  dedupeKey: string;
+}
 interface SourceRange {
   startLine: number;
   startChar: number;
@@ -142,6 +161,7 @@ interface EmbedEventMap {
     code: string;
     message: string;
   };
+  capabilityDenied: CapabilityDeniedEvent;
   snapshot: {
     snapshot: unknown;
     event: unknown | null;
@@ -159,6 +179,7 @@ interface MachineInitOptions {
   theme?: "light" | "dark";
   readOnly?: boolean;
   depth?: number;
+  capabilities?: EditorCapabilities;
   panels?: {
     leftPanels?: string[];
     rightPanels?: string[];
@@ -191,6 +212,7 @@ interface ProjectInitOptions {
   theme?: "light" | "dark";
   readOnly?: boolean;
   depth?: number;
+  capabilities?: EditorCapabilities;
   panels?: {
     leftPanels?: string[];
     rightPanels?: string[];
@@ -212,6 +234,7 @@ interface InitMessage {
   theme?: "light" | "dark";
   readOnly?: boolean;
   depth?: number;
+  capabilities?: EditorCapabilities;
   leftPanels?: string[];
   rightPanels?: string[];
   activePanels?: string[];
@@ -234,6 +257,7 @@ interface ProjectInitMessage {
   theme?: "light" | "dark";
   readOnly?: boolean;
   depth?: number;
+  capabilities?: EditorCapabilities;
   leftPanels?: string[];
   rightPanels?: string[];
   activePanels?: string[];
@@ -317,6 +341,7 @@ interface SystemInitMessage {
   theme?: "light" | "dark";
   readOnly?: boolean;
   depth?: number;
+  capabilities?: EditorCapabilities;
   leftPanels?: string[];
   rightPanels?: string[];
   activePanels?: string[];
@@ -387,6 +412,9 @@ interface ErrorMessage {
   message: string;
   requestId?: string;
 }
+interface CapabilityDeniedMessage extends CapabilityDeniedEvent {
+  type: "@statelyai.capabilityDenied";
+}
 /** File metadata sent from viz to SDK when a file needs uploading. */
 interface UploadFileInfo {
   /** Original filename (e.g. "screenshot.png") */
@@ -430,7 +458,7 @@ interface UploadResponseMessage {
 /** All messages a client (embed/inspector) can send to the viz. */
 type ClientMessage = InitMessage | ProjectInitMessage | ProjectUpdateMessage | ProjectSelectMachineMessage | UpdateMessage | SetModeMessage | SetThemeMessage | SetSettingsMessage | RetrieveMessage | ToastMessage | InspectSnapshotMessage | SystemInitMessage | SystemActorRegisteredMessage | SystemActorSnapshotMessage | SystemActorStoppedMessage | UploadCapabilitiesMessage | UploadResponseMessage | ErrorMessage;
 /** All messages the viz can send back to a client. */
-type VizMessage = ReadyMessage | LoadedMessage | ChangeMessage | SaveMessage | ProjectMachineSelectedMessage | RetrievedMessage | ErrorMessage | UploadRequestMessage;
+type VizMessage = ReadyMessage | LoadedMessage | ChangeMessage | SaveMessage | ProjectMachineSelectedMessage | RetrievedMessage | ErrorMessage | CapabilityDeniedMessage | UploadRequestMessage;
 interface RegisterMessage {
   type: "@statelyai.register";
   role: "client" | "viz";
@@ -478,4 +506,4 @@ type SessionMessage = RegisterMessage | RegisteredMessage | RequestOpenMessage |
 type ProtocolMessage = ClientMessage | VizMessage | SessionMessage;
 declare const PREFIX = "@statelyai.";
 //#endregion
-export { ActorSystemEntry, AddSessionMessage, ChangeMessage, ClientMessage, CommentsConfig, EmbedEventHandler, EmbedEventMap, EmbedEventName, EmbedMode, ErrorMessage, ExportCallOptions, ExportFormat, ExportFormatMap, InitMessage, InitOptions, InspectSnapshotMessage, LoadedMessage, MachineInitOptions, MachineSourceLocations, PREFIX, ProjectEmbedMachine, ProjectInitMessage, ProjectInitOptions, ProjectMachineSelectedMessage, ProjectSelectMachineMessage, ProjectUpdateMessage, ProtocolMessage, ReadyMessage, RegisterMessage, RegisteredMessage, RequestOpenMessage, RetrieveMessage, RetrievedMessage, SaveMessage, SessionAddedMessage, SessionMessage, SetModeMessage, SetSettingsMessage, SetThemeMessage, SourceLocation, SourceRange, StateSourceLocation, SystemActorRegisteredMessage, SystemActorSnapshotMessage, SystemActorStoppedMessage, SystemInitMessage, ToastMessage, UpdateMessage, UploadCapabilitiesMessage, UploadFileInfo, UploadRequestMessage, UploadResponseMessage, UploadResult, ValidationIssue, VizMessage };
+export { ActorSystemEntry, AddSessionMessage, CapabilityDeniedCapability, CapabilityDeniedEvent, CapabilityDeniedMessage, ChangeMessage, ClientMessage, CommentsConfig, EditorCapabilities, EmbedEventHandler, EmbedEventMap, EmbedEventName, EmbedMode, ErrorMessage, ExportCallOptions, ExportFormat, ExportFormatMap, InitMessage, InitOptions, InspectSnapshotMessage, LoadedMessage, MachineInitOptions, MachineSourceLocations, PREFIX, ProjectEmbedMachine, ProjectInitMessage, ProjectInitOptions, ProjectMachineSelectedMessage, ProjectSelectMachineMessage, ProjectUpdateMessage, ProtocolMessage, ReadyMessage, RegisterMessage, RegisteredMessage, RequestOpenMessage, RetrieveMessage, RetrievedMessage, SaveMessage, SessionAddedMessage, SessionMessage, SetModeMessage, SetSettingsMessage, SetThemeMessage, SourceLocation, SourceRange, StateSourceLocation, SystemActorRegisteredMessage, SystemActorSnapshotMessage, SystemActorStoppedMessage, SystemInitMessage, ToastMessage, UpdateMessage, UploadCapabilitiesMessage, UploadFileInfo, UploadRequestMessage, UploadResponseMessage, UploadResult, ValidationIssue, VizMessage };

package/dist/studio.d.mts

@@ -1,7 +1,12 @@
+import { n as StatelyCredential, t as StatelyAuthMode } from "./auth-DO1-eQcU.mjs";
+
 //#region src/studio.d.ts
 interface StudioClientOptions {
   baseUrl?: string;
+  credential?: StatelyCredential;
+  /** @deprecated Use credential: { type: 'api_key', token }. */
   apiKey?: string;
+  authMode?: StatelyAuthMode;
   fetch?: typeof fetch;
 }
 interface VerifyApiKeyResponse {
@@ -93,7 +98,7 @@ declare class StudioApiError extends Error {
 }
 interface StudioClient {
   auth: {
-    verify(apiKey?: string): Promise<VerifyApiKeyResponse>;
+    verify(credential?: StatelyCredential | string): Promise<VerifyApiKeyResponse>;
   };
   projects: {
     list(): Promise<ProjectData[]>;
@@ -109,7 +114,9 @@ interface StudioClient {
   };
   code: {
     extractMachines(code: string, options?: {
+      credential?: StatelyCredential | null; /** @deprecated Use credential. */
       apiKey?: string | null;
+      authMode?: StatelyAuthMode;
     }): Promise<ExtractMachinesResponse>;
   };
 }