@statelyai/sdk 0.23.1 → 0.24.0

package/README.md

@@ -45,6 +45,10 @@ embed.init({
 });
 ```
 
+The embed `apiKey` is sent to the iframe over `postMessage` after the editor
+handshake; it is not included in the iframe URL. Call `embed.setApiKey(token)`
+when the host refreshes the access token.
+
 Use `viewMode: 'list'` on `createStatelyEmbed` to add `?view=list` to the
 iframe URL, or subscribe to `viewModeChanged` when the user switches views.
 
@@ -108,7 +112,7 @@ Key capabilities:
 - **Reference documents** supplied as ordered, read-only Markdown, code, or text
 - **Comments** via Liveblocks integration (optional)
 - **Asset uploads** with built-in S3 and Supabase adapters, or bring your own upload handler
-- **Runtime settings** - toggle color mode, grid, snap lines, autolayout, and view mode on the fly
+- **Runtime settings** - toggle color mode, grid, snap lines, and view mode on the fly
 
 ### Resource API client
 

package/dist/embed.d.mts

@@ -71,6 +71,7 @@ type EmbedFormatDefinition = {
 };
 interface StatelyEmbedOptions extends Partial<MachineInitOptions> {
   baseUrl: string;
+  /** Access token sent to the iframe over the embed protocol. */
   apiKey?: string;
   /** Initial canvas view. Also reflected in the iframe URL as `?view=`. */
   viewMode?: 'graph' | 'list';
@@ -115,6 +116,8 @@ interface StatelyEmbed {
   attach(iframe: HTMLIFrameElement): void;
   /** Create an iframe and mount it into a container element. */
   mount(container: HTMLElement): HTMLIFrameElement;
+  /** Update the access token used by the iframe. */
+  setApiKey(apiKey: string): void;
   /** Send init message (queued if iframe not ready yet). */
   init(options: InitOptions): void;
   /** Update the machine (shorthand for update message). */

package/dist/embed.mjs

@@ -1,4 +1,4 @@
-import { a as createEventRegistry, o as createPendingExportManager, r as createPostMessageTransport, s as toInitMessage, t as SDK_VERSION } from "./version-DX-_ZovM.mjs";
+import { a as createEventRegistry, o as createPendingExportManager, r as createPostMessageTransport, s as toInitMessage, t as SDK_VERSION } from "./version-DALql3iM.mjs";
 import { t as EDITOR_PROTOCOL_VERSION } from "./editorHostProtocol-Bko7wge8.mjs";
 
 //#region src/embed.ts
@@ -25,10 +25,13 @@ function assertExtensionCall(value) {
 	if ((value.method === "export" || value.method === "validate") && !isEmbedGraph(payload.graph)) throw new Error("Invalid extension graph payload.");
 	if (value.method === "validate" && payload.revision !== void 0 && typeof payload.revision !== "number") throw new Error("Invalid extension revision payload.");
 }
+function normalizeApiKey(apiKey) {
+	return apiKey?.trim() || void 0;
+}
 function buildEmbedUrl(options) {
 	const base = options.baseUrl.replace(/\/+$/, "") + "/embed";
 	const url = new URL(base);
-	if (options.apiKey) url.searchParams.set("api_key", options.apiKey);
+	if (normalizeApiKey(options.apiKey)) url.searchParams.set("auth", "message");
 	if (options.viewMode) url.searchParams.set("view", options.viewMode);
 	return url.toString();
 }
@@ -113,6 +116,7 @@ function createStatelyEmbed(options) {
 	let ownedIframe = false;
 	let destroyed = false;
 	let editorProtocolCompatible;
+	let apiKey = normalizeApiKey(options.apiKey);
 	const pendingMessages = [];
 	const events = createEventRegistry();
 	const profiles = new Map((options.profiles ?? []).map((profile) => [profile.profile, profile]));
@@ -141,6 +145,12 @@ function createStatelyEmbed(options) {
 			transport.send(msg);
 		}
 	}
+	function sendApiKey() {
+		if (apiKey) send({
+			type: "@statelyai.setApiKey",
+			apiKey
+		});
+	}
 	function formatContext(profile) {
 		const namespace = profile.namespace ?? /^(@[^/]+)\//.exec(profile.profile)?.[1];
 		if (!namespace) throw new Error(`Profile ${profile.profile} has no namespace.`);
@@ -231,6 +241,7 @@ function createStatelyEmbed(options) {
 						}
 					});
 				} else editorProtocolCompatible = true;
+				sendApiKey();
 				flush();
 				if (uploadAsset) send({
 					type: "@statelyai.uploadCapabilities",
@@ -411,6 +422,10 @@ function createStatelyEmbed(options) {
 			setupTransport(el);
 			return el;
 		},
+		setApiKey(nextApiKey) {
+			apiKey = normalizeApiKey(nextApiKey);
+			sendApiKey();
+		},
 		init(opts) {
 			send(toInitMessage("machine" in opts ? {
 				...opts,

package/dist/index.mjs

@@ -1,13 +1,13 @@
 import "./openapi-BTDjYWXd.mjs";
 import { EMBED_DOCUMENT_LANGUAGES, EMBED_DOCUMENT_LIMITS, INSPECTION_PROTOCOL_VERSION, INSPECTION_ROOM_QUERY_PARAM, createInspectionActorId, createInspectionRoomUrls, getInspectionRoomId } from "./protocol.mjs";
-import { i as createWebSocketTransport, r as createPostMessageTransport } from "./version-DX-_ZovM.mjs";
+import { i as createWebSocketTransport, r as createPostMessageTransport } from "./version-DALql3iM.mjs";
 import { t as EDITOR_PROTOCOL_VERSION } from "./editorHostProtocol-Bko7wge8.mjs";
 import { createStatelyEmbed } from "./embed.mjs";
 import { i as fetchEditorSyncAccess, r as createRemoteEditorSyncBackend, t as EditorHostSession } from "./editorHostSession-BwS-EiBJ.mjs";
 import { n as StudioApiError, r as createStatelyClient, t as DEFAULT_STATELY_BASE_URL } from "./studio-iNSHtNmP.mjs";
 import { a as RawCode, c as eventsSchemaToTSType, d as jsonSchemaToTSType, l as graphToMachineConfig, m as serializeJS, n as getStatelyPragma, o as contextSchemaToTSType, p as raw, r as upsertStatelyPragma, t as findStatelyPragmaAttachments, u as graphToXStateTS } from "./statelyPragma-0djA1cnm.mjs";
 import { createS3AssetUploadAdapter, createSupabaseAssetUploadAdapter } from "./assetStorage.mjs";
-import { n as createStatelyInspector, t as createInspector } from "./inspect-CWFYJT9G.mjs";
+import { n as createStatelyInspector, t as createInspector } from "./inspect-j1T7sM6_.mjs";
 import { createAuthorizationHeader, getCredentialToken } from "./auth.mjs";
 import { buildAuthorizeUrl, createPkcePair, discoverAuthorizationServer, discoverProtectedResource, exchangeCodeForToken, refreshToken, registerOAuthClient } from "./oauth.mjs";
 import { StatelyApiError, createStatelyApiClient, createStatelyApiUrl } from "./api.mjs";

package/dist/{inspect-CWFYJT9G.mjs → inspect-j1T7sM6_.mjs}

@@ -1,5 +1,5 @@
 import { INSPECTION_PROTOCOL_VERSION, createInspectionRoomUrls, getInspectionRoomId } from "./protocol.mjs";
-import { a as createEventRegistry, i as createWebSocketTransport, n as inspectionRuntime, o as createPendingExportManager, t as SDK_VERSION } from "./version-DX-_ZovM.mjs";
+import { a as createEventRegistry, i as createWebSocketTransport, n as inspectionRuntime, o as createPendingExportManager, t as SDK_VERSION } from "./version-DALql3iM.mjs";
 
 //#region src/openBrowser.ts
 async function openBrowser(url) {

package/dist/inspect.mjs

@@ -1,4 +1,4 @@
-import "./version-DX-_ZovM.mjs";
-import { n as createStatelyInspector, t as createInspector } from "./inspect-CWFYJT9G.mjs";
+import "./version-DALql3iM.mjs";
+import { n as createStatelyInspector, t as createInspector } from "./inspect-j1T7sM6_.mjs";
 
 export { createInspector, createStatelyInspector };

package/dist/protocol.d.mts

@@ -65,12 +65,10 @@ interface ProjectWorkspaceCapabilities {
   deleteMachine?: ProjectWorkspaceAction;
   setRootMachine?: ProjectWorkspaceAction;
 }
-/** Serializable workspace tree rendered by project-mode embeds. */
-interface ProjectWorkspaceConfig {
-  /** Visible projects; pass one entry when embedding a single project. */
-  projects: ProjectWorkspaceProject[];
+interface ProjectWorkspaceConfigBase {
   defaultProjectId?: string;
-  backAction?: ProjectWorkspaceAction;
+  /** Optional navigation action shown above the workspace. Set to null to hide it. */
+  backAction?: ProjectWorkspaceAction | null;
   userAvatarUrl?: string;
   machineSelectionDisabled?: boolean;
   /** Optional host-backed operations for the built-in workspace controls. */
@@ -81,6 +79,14 @@ interface ProjectWorkspaceConfig {
   projectActions?: Record<string, ProjectWorkspaceAction[]>;
   machineActions?: Record<string, ProjectWorkspaceAction[]>;
 }
+/** Serializable workspace tree rendered by project-mode embeds. */
+type ProjectWorkspaceConfig = (ProjectWorkspaceConfigBase & {
+  /** Single-project mode: hides project CRUD and flattens its machines. */project: ProjectWorkspaceProject;
+  projects?: never;
+}) | (ProjectWorkspaceConfigBase & {
+  /** Multi-project mode: renders a collapsible project tree. */projects: ProjectWorkspaceProject[];
+  project?: never;
+});
 declare const EMBED_DOCUMENT_LANGUAGES: readonly ["markdown", "typescript", "javascript", "json", "xml", "mermaid", "text"];
 type EmbedDocumentLanguage = (typeof EMBED_DOCUMENT_LANGUAGES)[number];
 declare const EMBED_DOCUMENT_LIMITS: {
@@ -278,7 +284,7 @@ interface MachineInitOptions {
    * - `enabled` — whether to show the pill at all. Defaults to `false`.
    * - `mode` — `'structural'` (default) only triggers on graph-structural
    *   changes (state/transition/action/invoke/schema edits). Pure visual
-   *   changes like drag-to-position, color, and autolayout are ignored.
+   *   changes like drag-to-position, color, and layout are ignored.
    *   `'all'` triggers on any graph change.
    */
   unsavedIndicator?: {

package/dist/{version-DX-_ZovM.mjs → version-DALql3iM.mjs}

@@ -333,7 +333,7 @@ function createWebSocketTransport(options) {
 
 //#endregion
 //#region src/version.ts
-const SDK_VERSION = "0.23.1";
+const SDK_VERSION = "0.24.0";
 function inspectionRuntime() {
 	if (typeof window !== "undefined") return "browser";
 	if (typeof process !== "undefined" && process.versions?.node) return "node";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@statelyai/sdk",
-  "version": "0.23.1",
+  "version": "0.24.0",
   "license": "MIT",
   "bin": {
     "stately-sdk": "./dist/bin.mjs"
@@ -93,8 +93,8 @@
     "jsdom": "^27.4.0",
     "tsdown": "0.21.0-beta.2",
     "vitest": "^3.2.4",
-    "@statelyai/api-contract": "0.3.8",
-    "@statelyai/graph-tools": "0.2.2"
+    "@statelyai/graph-tools": "0.2.2",
+    "@statelyai/api-contract": "0.3.8"
   },
   "engines": {
     "node": ">=22.4"