@statelyai/sdk 0.13.1 → 0.13.2

package/README.md

@@ -80,31 +80,6 @@ Key capabilities:
 - **Asset uploads** with built-in S3 and Supabase adapters, or bring your own upload handler
 - **Runtime settings** - toggle color mode, grid, snap lines, autolayout, and view mode on the fly
 
-### Self-hosting
-
-<!-- self-host configuration from the editor app auth and editor-sync routes -->
-
-The SDK works with both the hosted Stately editor (`editor.stately.ai`) and
-self-hosted deployments.
-
-When self-hosting, authentication is handled by your editor server, not by this npm package. The editor host supports configurable auth strategies, and you can disable API-key checks for editor-sync endpoints when running behind your own auth layer.
-
-A fully self-contained deployment with no external auth looks like:
-
-```ts
-const embed = createStatelyEmbed({
-  baseUrl: 'https://your-editor.example.com',
-});
-```
-
-Key environment variables for self-hosted deployments:
-
-| Variable                    | Purpose                                      |
-| --------------------------- | -------------------------------------------- |
-| `AUTH_PROVIDER`             | Auth strategy used by the editor host        |
-| `EDITOR_SYNC_AUTH_REQUIRED` | Set to `false` to skip editor-sync API-key checks |
-| `NEXT_PUBLIC_BASE_URL`      | Public-facing editor URL                     |
-
 ### Studio API client
 
 Programmatic access to Stately Studio for managing projects and machines, extracting machine configs from source code, and verifying API keys.
@@ -125,8 +100,10 @@ const extracted = await studio.code.extractMachines(sourceCode);
 ```
 
 Legacy `apiKey` is still accepted as an alias for
-`credential: { type: 'api_key', token }`. Use `authMode: 'none'` only for
-self-hosted deployments that intentionally accept unauthenticated calls.
+`credential: { type: 'api_key', token }`. The default `authMode: 'auto'` sends
+a credential when present and otherwise lets the server accept or reject an
+unauthenticated request. Use `authMode: 'bearer'` to require a credential before
+making requests, or `authMode: 'none'` to ignore a configured credential.
 
 ### Inspector
 
@@ -160,12 +137,14 @@ Node process does not need a Stately API key.
 
 The separate [`statelyai`](https://www.npmjs.com/package/statelyai) CLI syncs
 local XState source files with Stately Studio projects: push local machines,
-pull remote changes, and open a local file in a browser-backed visual editor
-session.
+pull remote changes, inspect project inventory, compare machines, and open a
+local file in a browser-backed visual editor session.
 
 ```bash
+npx statelyai status
 npx statelyai push
 npx statelyai pull
+npx statelyai diff ./checkout.machine.ts machine-id
 npx statelyai open ./checkout.machine.ts
 ```
 
@@ -175,5 +154,36 @@ Convert between Studio graph data, XState machine configs, and TypeScript source
 
 ## Support
 
-For pricing and self-hosting details, contact
+For pricing and support, contact
+[team@stately.ai](mailto:team@stately.ai).
+
+## Self-hosting
+
+<!-- self-host configuration from the editor app auth and editor-sync routes -->
+
+The SDK works with both the hosted Stately editor (`editor.stately.ai`) and
+self-hosted deployments.
+
+When self-hosting, authentication is handled by your editor server, not by this
+npm package. The editor host supports configurable auth strategies, and you can
+disable API-key checks for editor-sync endpoints when running behind your own
+auth layer.
+
+A fully self-contained deployment with no external auth looks like:
+
+```ts
+const embed = createStatelyEmbed({
+  baseUrl: 'https://your-editor.example.com',
+});
+```
+
+Key environment variables for self-hosted deployments:
+
+| Variable                    | Purpose                                           |
+| --------------------------- | ------------------------------------------------- |
+| `AUTH_PROVIDER`             | Auth strategy used by the editor host             |
+| `EDITOR_SYNC_AUTH_REQUIRED` | Set to `false` to skip editor-sync API-key checks |
+| `NEXT_PUBLIC_BASE_URL`      | Public-facing editor URL                          |
+
+For self-hosting details, contact
 [team@stately.ai](mailto:team@stately.ai).

package/dist/studio.mjs

@@ -91,8 +91,9 @@ function createStatelyClient(options = {}) {
 		const authMode = authModeOverride ?? defaultAuthMode;
 		const credential = credentialOverride ?? defaultCredential;
 		if (authMode !== "none") {
-			if (!getCredentialToken(credential) || !credential) throw new StudioApiError("No Stately credential configured. Pass createStatelyClient({ credential }) or set authMode: \"none\" for no-auth self-hosted deployments.", 401);
-			headers.set("Authorization", createAuthorizationHeader(credential));
+			const token = getCredentialToken(credential);
+			if (authMode === "bearer" && (!token || !credential)) throw new StudioApiError("No Stately credential configured. Pass createStatelyClient({ credential }) or use authMode: \"auto\" to let the server decide whether authentication is required.", 401);
+			if (token && credential) headers.set("Authorization", createAuthorizationHeader(credential));
 		}
 		const response = await fetchImpl(joinApiUrl(baseUrl, path), {
 			...init,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@statelyai/sdk",
-  "version": "0.13.1",
+  "version": "0.13.2",
   "license": "MIT",
   "files": [
     "dist",