@statelyai/sdk 0.11.0 → 0.12.1

package/README.md

@@ -28,11 +28,35 @@ embed.init({
 });
 ```
 
+Restrict an embed by passing a resolved access policy:
+
+```ts
+embed.init({
+  machine: myMachineConfig,
+  mode: 'viewing',
+  readOnly: true,
+  capabilities: {
+    edit: false,
+    export: false,
+    ai: false,
+    simulate: false,
+    navigateHierarchy: false,
+    maxDepth: 1,
+    panels: ['structure', 'details', 'validations'],
+  },
+});
+
+embed.on('capabilityDenied', (event) => {
+  console.warn(event.message);
+});
+```
+
 Key capabilities:
 
 - **Mount or attach** to any container element or existing iframe
 - **Two-way sync** - push machine configs in, get changes and saves back via event callbacks
 - **Export** to multiple formats: XState v5, XState JSON, Mermaid, Redux, Zustand, ASL, SCXML, and more
+- **Access policies** for read-only, no-export, no-AI, shallow-viewer embeds
 - **Comments** via Liveblocks integration (optional)
 - **Asset uploads** with built-in S3 and Supabase adapters, or bring your own upload handler
 - **Runtime settings** - toggle color mode, grid, snap lines, autolayout, and view mode on the fly
@@ -69,7 +93,10 @@ Programmatic access to Stately Studio for managing projects and machines, extrac
 import { createStatelyClient } from '@statelyai/sdk';
 
 const studio = createStatelyClient({
-  apiKey: process.env.STATELY_API_KEY,
+  credential: {
+    type: 'oauth',
+    accessToken: process.env.STATELY_ACCESS_TOKEN!,
+  },
 });
 
 const projects = await studio.projects.list();
@@ -77,6 +104,10 @@ const machine = await studio.machines.get('machine-id');
 const extracted = await studio.code.extractMachines(sourceCode);
 ```
 
+Legacy `apiKey` is still accepted as an alias for
+`credential: { type: 'api_key', token }`. Use `authMode: 'none'` only for
+self-hosted deployments that intentionally accept unauthenticated calls.
+
 ### Inspector
 
 Stream live actor-system state to the Stately inspector over WebSockets, with support for automatic XState actor adoption and manual actor registration.

package/dist/auth-DO1-eQcU.d.mts

@@ -0,0 +1,15 @@
+//#region src/auth.d.ts
+type StatelyCredential = {
+  type: 'api_key';
+  token: string;
+} | {
+  type: 'oauth';
+  accessToken: string;
+  refreshToken?: string;
+  expiresAt?: number;
+};
+type StatelyAuthMode = 'auto' | 'none' | 'bearer';
+declare function getCredentialToken(credential: StatelyCredential | string | null | undefined): string | undefined;
+declare function createAuthorizationHeader(credential: StatelyCredential | string): string;
+//#endregion
+export { getCredentialToken as i, StatelyCredential as n, createAuthorizationHeader as r, StatelyAuthMode as t };

package/dist/auth.d.mts

@@ -0,0 +1,2 @@
+import { i as getCredentialToken, n as StatelyCredential, r as createAuthorizationHeader, t as StatelyAuthMode } from "./auth-DO1-eQcU.mjs";
+export { StatelyAuthMode, StatelyCredential, createAuthorizationHeader, getCredentialToken };

package/dist/auth.mjs

@@ -0,0 +1,11 @@
+//#region src/auth.ts
+function getCredentialToken(credential) {
+	if (!credential) return;
+	return typeof credential === "string" ? credential : credential.type === "oauth" ? credential.accessToken : credential.token;
+}
+function createAuthorizationHeader(credential) {
+	return `Bearer ${getCredentialToken(credential)}`;
+}
+
+//#endregion
+export { createAuthorizationHeader, getCredentialToken };