statelyai 0.6.0 → 0.6.1

package/README.md

@@ -13,11 +13,10 @@ This package contains the `statelyai` command implementation.
 statelyai login
 ```
 
-Automation can still pass `--api-key`, set `STATELY_API_KEY`, or set
-`STATELY_ACCESS_TOKEN`. For no-auth self-hosted deployments, run
-`statelyai login --auth none`.
+Automation can set `STATELY_ACCESS_TOKEN` for OAuth, or pass `--api-key` /
+`STATELY_API_KEY` for legacy API-key commands.
 
-For a self-hosted or local MCP/API resource, discover OAuth from that resource:
+For a custom OAuth protected resource, discover OAuth from that resource:
 
 ```bash
 statelyai login --base-url http://localhost:3000/registry/api/mcp
@@ -25,6 +24,8 @@ statelyai login --base-url http://localhost:3000/registry/api/mcp
 
 `statelyai login --auth bearer` uses the same browser OAuth flow explicitly.
 `statelyai login --api-key` keeps the legacy manual API-key path.
+`statelyai open` requires OAuth (`statelyai login` or `STATELY_ACCESS_TOKEN`);
+free accounts open read-only root-level views.
 
 2. Initialize the current repo:
 

package/dist/bin.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { _ as run } from "./cli-Buz_BC3I.mjs";
+import { v as run } from "./cli-jiby9qdf.mjs";
 
 //#region src/bin.ts
 run();

package/dist/{cli-Buz_BC3I.mjs → cli-jiby9qdf.mjs}

@@ -11,7 +11,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { promisify } from "node:util";
 import { Args, Command, Flags, flush, handle, run } from "@oclif/core";
 import os from "node:os";
-import { StudioApiError, buildAuthorizeUrl, createPkcePair, createStatelyClient, discoverAuthorizationServer, discoverProtectedResource, exchangeCodeForToken, getStatelyPragma } from "@statelyai/sdk";
+import { StudioApiError, buildAuthorizeUrl, createPkcePair, createStatelyClient, discoverAuthorizationServer, discoverProtectedResource, exchangeCodeForToken, getStatelyPragma, registerOAuthClient } from "@statelyai/sdk";
 import { planSync, pullSync, pushLocalMachineLinks } from "@statelyai/sdk/sync";
 
 //#region src/cliHost.ts
@@ -86,6 +86,7 @@ var RemoteEditorSession = class {
 	lastPersistedGraph;
 	currentSourceLocations;
 	currentFormat;
+	editorSyncAccess;
 	ready = false;
 	pendingMessages = [];
 	pendingRetrievals = /* @__PURE__ */ new Map();
@@ -146,13 +147,16 @@ var RemoteEditorSession = class {
 			const update = await this.parseRootDocument();
 			this.currentFormat = update.format;
 			this.currentSourceLocations = update.sourceLocations;
+			this.editorSyncAccess = update.access;
 			this.updateSourceLocations(update.sourceLocations);
 			this.postMessage({
 				type: "@statelyai.init",
 				machine: update.machine,
 				format: update.format,
 				sourceLocations: update.sourceLocations,
-				mode: "editing",
+				mode: update.access?.readOnly ? "viewing" : "editing",
+				readOnly: update.access?.readOnly,
+				capabilities: update.access?.capabilities,
 				theme: "light",
 				unsavedIndicator: { enabled: true },
 				leftPanels: [],
@@ -173,6 +177,7 @@ var RemoteEditorSession = class {
 			const update = await this.parseRootDocument();
 			this.currentFormat = update.format;
 			this.currentSourceLocations = update.sourceLocations;
+			this.editorSyncAccess = update.access ?? this.editorSyncAccess;
 			this.updateSourceLocations(update.sourceLocations);
 			this.postMessage({
 				type: "@statelyai.update",
@@ -185,6 +190,16 @@ var RemoteEditorSession = class {
 		}
 	}
 	async saveFromEditor(msg) {
+		if (this.editorSyncAccess?.readOnly) {
+			const message = "Your Stately plan allows read-only editor sync.";
+			this.postMessage({
+				type: "@statelyai.toast",
+				message,
+				toastType: "error"
+			});
+			this.showError(message);
+			return;
+		}
 		const validationErrors = getValidationErrors(msg.validations);
 		if (validationErrors.length > 0) {
 			const message = formatValidationErrorMessage(validationErrors);
@@ -1359,6 +1374,23 @@ async function resolveApiKey(explicitApiKey) {
 	};
 	return { source: "missing" };
 }
+async function resolveOAuthAccessToken() {
+	const envCredential = getEnvCredential();
+	if (envCredential?.credential.type === "oauth") return {
+		apiKey: envCredential.credential.accessToken,
+		source: "env",
+		detail: envCredential.variable
+	};
+	if (envCredential?.credential.type === "api_key") throw new Error("`statelyai open` requires OAuth login. Run `statelyai login` instead of using an API key.");
+	const storedCredential = await getStoredCredential();
+	if (storedCredential?.credential?.type === "oauth") return {
+		apiKey: storedCredential.credential.accessToken,
+		source: "stored",
+		detail: describeCredentialBackend(storedCredential.backend, storedCredential.location)
+	};
+	if (storedCredential?.credential?.type === "api_key") throw new Error("`statelyai open` requires OAuth login. Run `statelyai login` to replace the stored API key.");
+	return { source: "missing" };
+}
 function getDefaultBaseUrl() {
 	return process.env.STATELY_API_URL ?? process.env.NEXT_PUBLIC_BASE_URL ?? process.env.NEXT_PUBLIC_STATELY_API_URL;
 }
@@ -1368,34 +1400,48 @@ function getDefaultEditorUrl() {
 function getResolvedStudioUrl(baseUrl) {
 	return baseUrl ?? getDefaultBaseUrl() ?? "https://stately.ai";
 }
-function getDefaultMcpResourceUrl() {
-	return process.env.STATELY_MCP_RESOURCE_URL ?? process.env.NEXT_PUBLIC_MCP_RESOURCE_URL ?? process.env.STATELY_MCP_API_BASE_URL ?? "https://editor.stately.ai/api/mcp";
+function getDefaultOAuthIssuer() {
+	return process.env.STATELY_OAUTH_ISSUER ?? process.env.NEXT_PUBLIC_STATELY_OAUTH_ISSUER ?? "https://stately.ai";
 }
 function normalizeLoginResourceUrl(baseUrl) {
-	const raw = baseUrl ?? getDefaultMcpResourceUrl();
+	const raw = baseUrl;
 	const url = new URL(raw);
 	if (url.pathname === "/" || url.pathname === "") url.pathname = "/api/mcp";
 	return url.toString();
 }
-function getOauthClientId() {
-	return process.env.STATELY_OAUTH_CLIENT_ID ?? process.env.NEXT_PUBLIC_STATELY_OAUTH_CLIENT_ID ?? "statelyai-cli";
+function getConfiguredOauthClientId() {
+	return process.env.STATELY_OAUTH_CLIENT_ID ?? process.env.NEXT_PUBLIC_STATELY_OAUTH_CLIENT_ID;
 }
 async function discoverOAuthLogin(options = {}) {
-	const resourceUrl = normalizeLoginResourceUrl(options.baseUrl);
-	const protectedResource = await discoverProtectedResource(resourceUrl, { fetch: options.fetch });
-	const [issuer] = protectedResource.authorization_servers ?? [];
-	if (!issuer) throw new Error(`No OAuth authorization server advertised by ${resourceUrl}. Use \`statelyai login --auth none\` for no-auth self-hosted deployments.`);
+	const resourceUrl = options.baseUrl ? normalizeLoginResourceUrl(options.baseUrl) : getDefaultOAuthIssuer();
+	const protectedResource = options.baseUrl ? await discoverProtectedResource(resourceUrl, { fetch: options.fetch }) : void 0;
+	const issuer = protectedResource ? protectedResource.authorization_servers?.[0] : resourceUrl;
+	if (!issuer) throw new Error(`No OAuth authorization server advertised by ${resourceUrl}. Pass --base-url for a Stately OAuth-enabled resource or set STATELY_OAUTH_ISSUER.`);
 	const authorizationServer = await discoverAuthorizationServer(issuer, { fetch: options.fetch });
 	const authorizationEndpoint = authorizationServer.authorization_endpoint;
 	const tokenEndpoint = authorizationServer.token_endpoint;
 	if (!authorizationEndpoint || !tokenEndpoint) throw new Error(`Authorization server ${issuer} did not advertise authorization and token endpoints.`);
+	const configuredClientId = options.clientId ?? getConfiguredOauthClientId();
+	const scopes = protectedResource?.scopes_supported ?? [];
+	let clientId = configuredClientId;
+	if (!clientId && authorizationServer.registration_endpoint && options.redirectUri) try {
+		clientId = (await registerOAuthClient({
+			registrationEndpoint: authorizationServer.registration_endpoint,
+			redirectUri: options.redirectUri,
+			scopes,
+			fetch: options.fetch
+		})).client_id;
+	} catch (error) {
+		throw new Error(`OAuth dynamic client registration failed for ${authorizationServer.registration_endpoint}. Enable dynamic client registration on the OAuth authorization server, or set STATELY_OAUTH_CLIENT_ID to a registered OAuth client id.`, { cause: error });
+	}
+	if (!clientId) throw new Error(`Authorization server ${issuer} did not advertise dynamic client registration. Set STATELY_OAUTH_CLIENT_ID to a registered OAuth client id.`);
 	return {
 		authorizationServer,
 		authorizationEndpoint,
-		clientId: options.clientId ?? getOauthClientId(),
-		protectedResource,
+		clientId,
+		...protectedResource ? { protectedResource } : {},
 		resourceUrl,
-		scopes: protectedResource.scopes_supported ?? [],
+		scopes,
 		tokenEndpoint
 	};
 }
@@ -1564,7 +1610,8 @@ async function buildOAuthLoginStart(options) {
 	const [discovery, pkce] = await Promise.all([discoverOAuthLogin({
 		baseUrl: options.baseUrl,
 		clientId: options.clientId,
-		fetch: options.fetch
+		fetch: options.fetch,
+		redirectUri: options.redirectUri
 	}), createPkcePair()]);
 	return {
 		authorizeUrl: buildAuthorizeUrl({
@@ -2286,7 +2333,7 @@ var OpenCommand = class OpenCommand extends Command {
 	}) };
 	static flags = {
 		help: Flags.help({ char: "h" }),
-		"api-key": Flags.string({ description: "Stately API key used when the editor server requires auth" }),
+		"api-key": Flags.string({ description: "Deprecated. `statelyai open` requires OAuth login." }),
 		"editor-url": Flags.string({ description: "Base URL for the Stately editor embed" }),
 		host: Flags.string({
 			description: "Local server host",
@@ -2309,7 +2356,9 @@ var OpenCommand = class OpenCommand extends Command {
 	};
 	async run() {
 		const { args, flags } = await this.parse(OpenCommand);
-		const apiKey = (await resolveApiKey(flags["api-key"])).apiKey;
+		if (flags["api-key"]) throw new Error("`statelyai open` requires OAuth login. Run `statelyai login` and retry.");
+		const apiKey = (await resolveOAuthAccessToken()).apiKey;
+		if (!apiKey) throw new Error("`statelyai open` requires OAuth login. Run `statelyai login` and retry.");
 		await openEditor({
 			fileName: path.resolve(args.file),
 			editorUrl: flags["editor-url"] ?? getDefaultEditorUrl(),
@@ -2399,7 +2448,7 @@ var LoginCommand = class LoginCommand extends Command {
 	static flags = {
 		help: Flags.help({ char: "h" }),
 		"api-key": Flags.string({ description: "API key to store without an interactive prompt" }),
-		"base-url": Flags.string({ description: "MCP/API resource URL used for OAuth discovery" }),
+		"base-url": Flags.string({ description: "OAuth protected-resource URL for custom deployments" }),
 		stdin: Flags.boolean({
 			description: "Read the API key from standard input",
 			default: false
@@ -2509,4 +2558,4 @@ function isDirectExecution() {
 if (isDirectExecution()) run$1();
 
 //#endregion
-export { run$1 as _, discoverOAuthLogin as a, formatPlanSummary as c, getEnvCredential as d, inferInitProjectName as f, resolveConfiguredPullTargets as g, resolveApiKey as h, discoverLinkedPullTargets as i, formatStoredCredentialSource as l, isFileGitDirty as m, buildOAuthLoginStart as n, discoverRemoteProjectMachineTargets as o, initProject as p, classifyPushCandidates as r, formatMissingNewMachineDirMessage as s, COMMANDS as t, getEnvApiKey as u, scanProjectSources as v, createStatelyProjectConfig as y };
+export { resolveOAuthAccessToken as _, discoverOAuthLogin as a, createStatelyProjectConfig as b, formatPlanSummary as c, getEnvCredential as d, inferInitProjectName as f, resolveConfiguredPullTargets as g, resolveApiKey as h, discoverLinkedPullTargets as i, formatStoredCredentialSource as l, isFileGitDirty as m, buildOAuthLoginStart as n, discoverRemoteProjectMachineTargets as o, initProject as p, classifyPushCandidates as r, formatMissingNewMachineDirMessage as s, COMMANDS as t, getEnvApiKey as u, run$1 as v, scanProjectSources as y };

package/dist/index.d.mts

@@ -115,11 +115,12 @@ declare function getEnvCredential(): {
   variable: 'NEXT_PUBLIC_STATELY_API_KEY' | 'STATELY_API_KEY' | 'STATELY_ACCESS_TOKEN';
 } | undefined;
 declare function resolveApiKey(explicitApiKey?: string): Promise<ApiKeyResolution>;
+declare function resolveOAuthAccessToken(): Promise<ApiKeyResolution>;
 interface OAuthLoginDiscovery {
   authorizationServer: OAuthAuthorizationServerMetadata;
   authorizationEndpoint: string;
   clientId: string;
-  protectedResource: OAuthProtectedResourceMetadata;
+  protectedResource?: OAuthProtectedResourceMetadata;
   resourceUrl: string;
   scopes: string[];
   tokenEndpoint: string;
@@ -128,6 +129,7 @@ declare function discoverOAuthLogin(options?: {
   baseUrl?: string;
   clientId?: string;
   fetch?: typeof fetch;
+  redirectUri?: string;
 }): Promise<OAuthLoginDiscovery>;
 declare function inferInitProjectName(cwd: string, repo?: ConnectedRepo): string;
 declare function buildOAuthLoginStart(options: {
@@ -315,4 +317,4 @@ declare const COMMANDS: {
 };
 declare function run(argv?: any, entryUrl?: string): Promise<void>;
 //#endregion
-export { ApiKeyResolution, COMMANDS, InitProjectOptions, InitProjectResult, LinkedPullTarget, OAuthLoginDiscovery, PushCandidateClassification, RemoteProjectMachineTarget, ResolvedConfiguredPullTargets, ScanProjectSourcesOptions, buildOAuthLoginStart, classifyPushCandidates, createStatelyProjectConfig, discoverLinkedPullTargets, discoverOAuthLogin, discoverRemoteProjectMachineTargets, formatMissingNewMachineDirMessage, formatPlanSummary, formatStoredCredentialSource, getEnvApiKey, getEnvCredential, inferInitProjectName, initProject, isFileGitDirty, resolveApiKey, resolveConfiguredPullTargets, run, scanProjectSources };
+export { ApiKeyResolution, COMMANDS, InitProjectOptions, InitProjectResult, LinkedPullTarget, OAuthLoginDiscovery, PushCandidateClassification, RemoteProjectMachineTarget, ResolvedConfiguredPullTargets, ScanProjectSourcesOptions, buildOAuthLoginStart, classifyPushCandidates, createStatelyProjectConfig, discoverLinkedPullTargets, discoverOAuthLogin, discoverRemoteProjectMachineTargets, formatMissingNewMachineDirMessage, formatPlanSummary, formatStoredCredentialSource, getEnvApiKey, getEnvCredential, inferInitProjectName, initProject, isFileGitDirty, resolveApiKey, resolveConfiguredPullTargets, resolveOAuthAccessToken, run, scanProjectSources };

package/dist/index.mjs

@@ -1,3 +1,3 @@
-import { _ as run, a as discoverOAuthLogin, c as formatPlanSummary, d as getEnvCredential, f as inferInitProjectName, g as resolveConfiguredPullTargets, h as resolveApiKey, i as discoverLinkedPullTargets, l as formatStoredCredentialSource, m as isFileGitDirty, n as buildOAuthLoginStart, o as discoverRemoteProjectMachineTargets, p as initProject, r as classifyPushCandidates, s as formatMissingNewMachineDirMessage, t as COMMANDS, u as getEnvApiKey, v as scanProjectSources, y as createStatelyProjectConfig } from "./cli-Buz_BC3I.mjs";
+import { _ as resolveOAuthAccessToken, a as discoverOAuthLogin, b as createStatelyProjectConfig, c as formatPlanSummary, d as getEnvCredential, f as inferInitProjectName, g as resolveConfiguredPullTargets, h as resolveApiKey, i as discoverLinkedPullTargets, l as formatStoredCredentialSource, m as isFileGitDirty, n as buildOAuthLoginStart, o as discoverRemoteProjectMachineTargets, p as initProject, r as classifyPushCandidates, s as formatMissingNewMachineDirMessage, t as COMMANDS, u as getEnvApiKey, v as run, y as scanProjectSources } from "./cli-jiby9qdf.mjs";
 
-export { COMMANDS, buildOAuthLoginStart, classifyPushCandidates, createStatelyProjectConfig, discoverLinkedPullTargets, discoverOAuthLogin, discoverRemoteProjectMachineTargets, formatMissingNewMachineDirMessage, formatPlanSummary, formatStoredCredentialSource, getEnvApiKey, getEnvCredential, inferInitProjectName, initProject, isFileGitDirty, resolveApiKey, resolveConfiguredPullTargets, run, scanProjectSources };
+export { COMMANDS, buildOAuthLoginStart, classifyPushCandidates, createStatelyProjectConfig, discoverLinkedPullTargets, discoverOAuthLogin, discoverRemoteProjectMachineTargets, formatMissingNewMachineDirMessage, formatPlanSummary, formatStoredCredentialSource, getEnvApiKey, getEnvCredential, inferInitProjectName, initProject, isFileGitDirty, resolveApiKey, resolveConfiguredPullTargets, resolveOAuthAccessToken, run, scanProjectSources };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "statelyai",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Command-line tools for Stately",
   "license": "MIT",
   "type": "module",
@@ -21,7 +21,7 @@
   },
   "dependencies": {
     "@oclif/core": "^4.10.3",
-    "@statelyai/sdk": "0.12.0"
+    "@statelyai/sdk": "0.12.1"
   },
   "devDependencies": {
     "tsdown": "0.21.0-beta.2",