statelyai 0.6.0 → 0.7.0

package/README.md

@@ -13,18 +13,20 @@ This package contains the `statelyai` command implementation.
 statelyai login
 ```
 
-Automation can still pass `--api-key`, set `STATELY_API_KEY`, or set
-`STATELY_ACCESS_TOKEN`. For no-auth self-hosted deployments, run
-`statelyai login --auth none`.
+Automation can set `STATELY_ACCESS_TOKEN` for OAuth or `STATELY_API_KEY` for
+API-key auth.
 
-For a self-hosted or local MCP/API resource, discover OAuth from that resource:
+For a custom OAuth protected resource, discover OAuth from that resource:
 
 ```bash
 statelyai login --base-url http://localhost:3000/registry/api/mcp
 ```
 
 `statelyai login --auth bearer` uses the same browser OAuth flow explicitly.
-`statelyai login --api-key` keeps the legacy manual API-key path.
+`statelyai login --api-key` prompts securely for an API key, and
+`statelyai login --stdin` reads an API key from standard input. All commands use
+stored OAuth credentials or stored API keys. Free accounts open read-only
+root-level views.
 
 2. Initialize the current repo:
 

package/dist/bin.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { _ as run } from "./cli-Buz_BC3I.mjs";
+import { _ as run } from "./cli-DR7_Qkzm.mjs";
 
 //#region src/bin.ts
 run();

package/dist/{cli-Buz_BC3I.mjs → cli-DR7_Qkzm.mjs}

@@ -11,7 +11,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 import { promisify } from "node:util";
 import { Args, Command, Flags, flush, handle, run } from "@oclif/core";
 import os from "node:os";
-import { StudioApiError, buildAuthorizeUrl, createPkcePair, createStatelyClient, discoverAuthorizationServer, discoverProtectedResource, exchangeCodeForToken, getStatelyPragma } from "@statelyai/sdk";
+import { StudioApiError, buildAuthorizeUrl, createPkcePair, createStatelyClient, discoverAuthorizationServer, discoverProtectedResource, exchangeCodeForToken, getStatelyPragma, registerOAuthClient } from "@statelyai/sdk";
 import { planSync, pullSync, pushLocalMachineLinks } from "@statelyai/sdk/sync";
 
 //#region src/cliHost.ts
@@ -86,6 +86,7 @@ var RemoteEditorSession = class {
 	lastPersistedGraph;
 	currentSourceLocations;
 	currentFormat;
+	editorSyncAccess;
 	ready = false;
 	pendingMessages = [];
 	pendingRetrievals = /* @__PURE__ */ new Map();
@@ -146,13 +147,20 @@ var RemoteEditorSession = class {
 			const update = await this.parseRootDocument();
 			this.currentFormat = update.format;
 			this.currentSourceLocations = update.sourceLocations;
+			this.editorSyncAccess = update.access;
 			this.updateSourceLocations(update.sourceLocations);
+			if (this.options.apiKey) this.sendMessage({
+				type: "@statelyai.setApiKey",
+				apiKey: this.options.apiKey
+			});
 			this.postMessage({
 				type: "@statelyai.init",
 				machine: update.machine,
 				format: update.format,
 				sourceLocations: update.sourceLocations,
-				mode: "editing",
+				mode: update.access?.readOnly ? "viewing" : "editing",
+				readOnly: update.access?.readOnly,
+				capabilities: update.access?.capabilities,
 				theme: "light",
 				unsavedIndicator: { enabled: true },
 				leftPanels: [],
@@ -173,6 +181,7 @@ var RemoteEditorSession = class {
 			const update = await this.parseRootDocument();
 			this.currentFormat = update.format;
 			this.currentSourceLocations = update.sourceLocations;
+			this.editorSyncAccess = update.access ?? this.editorSyncAccess;
 			this.updateSourceLocations(update.sourceLocations);
 			this.postMessage({
 				type: "@statelyai.update",
@@ -185,6 +194,16 @@ var RemoteEditorSession = class {
 		}
 	}
 	async saveFromEditor(msg) {
+		if (this.editorSyncAccess?.readOnly) {
+			const message = "Your Stately plan allows read-only editor sync.";
+			this.postMessage({
+				type: "@statelyai.toast",
+				message,
+				toastType: "error"
+			});
+			this.showError(message);
+			return;
+		}
 		const validationErrors = getValidationErrors(msg.validations);
 		if (validationErrors.length > 0) {
 			const message = formatValidationErrorMessage(validationErrors);
@@ -355,10 +374,7 @@ async function openEditor(options) {
 			return;
 		}
 		response.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-		response.end(getCliWebviewContent({
-			editorUrl: options.editorUrl,
-			apiKey: options.apiKey
-		}));
+		response.end(getCliWebviewContent({ editorUrl: options.editorUrl }));
 	});
 	server.on("upgrade", (request, socket) => {
 		if (request.url !== "/ws") {
@@ -514,8 +530,6 @@ function watchWorkspace(rootDir, listener) {
 }
 function getCliWebviewContent(options) {
 	const baseUrl = normalizedBaseUrl(options.editorUrl);
-	const url = new URL(`${baseUrl}/embed`);
-	if (options.apiKey) url.searchParams.set("api_key", options.apiKey);
 	return `<!DOCTYPE html>
 <html lang="en" style="height:100%;margin:0">
 <head>
@@ -529,7 +543,7 @@ function getCliWebviewContent(options) {
 <body>
   <iframe
     id="stately-editor"
-    src="${escapeAttribute(url.toString())}"
+    src="${escapeAttribute(new URL(`${baseUrl}/embed`).toString())}"
     allow="clipboard-read; clipboard-write"
   ></iframe>
   <script>
@@ -703,15 +717,6 @@ function getCredentialsFilePath() {
 function shouldUseFileBackendOnly() {
 	return process.env.STATELYAI_CREDENTIALS_BACKEND === "file" || process.env.STATELYAI_CONFIG_DIR !== void 0;
 }
-async function readFileCredentials() {
-	const storedCredential = await readFileStoredCredential();
-	if (storedCredential?.credential?.type !== "api_key") return;
-	return {
-		apiKey: storedCredential.credential.token,
-		backend: storedCredential.backend,
-		location: storedCredential.location
-	};
-}
 function parseStoredCredential(raw, backend, location) {
 	try {
 		const parsed = JSON.parse(raw);
@@ -816,15 +821,6 @@ async function deleteFileCredentials() {
 		return false;
 	}
 }
-async function readMacOSKeychain() {
-	const storedCredential = await readMacOSStoredCredential();
-	if (storedCredential?.credential?.type !== "api_key") return;
-	return {
-		apiKey: storedCredential.credential.token,
-		backend: storedCredential.backend,
-		location: storedCredential.location
-	};
-}
 async function readMacOSStoredCredential() {
 	if (process.platform !== "darwin") return;
 	try {
@@ -897,15 +893,6 @@ async function deleteMacOSKeychain() {
 		return false;
 	}
 }
-async function readLinuxSecretTool() {
-	const storedCredential = await readLinuxStoredCredential();
-	if (storedCredential?.credential?.type !== "api_key") return;
-	return {
-		apiKey: storedCredential.credential.token,
-		backend: storedCredential.backend,
-		location: storedCredential.location
-	};
-}
 async function readLinuxStoredCredential() {
 	if (process.platform !== "linux") return;
 	try {
@@ -976,10 +963,6 @@ async function deleteLinuxSecretTool() {
 		return false;
 	}
 }
-async function getStoredApiKey() {
-	if (shouldUseFileBackendOnly()) return readFileCredentials();
-	return await readMacOSKeychain() ?? await readLinuxSecretTool() ?? await readFileCredentials();
-}
 async function getStoredCredential() {
 	if (shouldUseFileBackendOnly()) return readFileStoredCredential();
 	return await readMacOSStoredCredential() ?? await readLinuxStoredCredential() ?? await readFileStoredCredential();
@@ -1339,23 +1322,18 @@ function getEnvCredential() {
 		variable: "NEXT_PUBLIC_STATELY_API_KEY"
 	};
 }
-async function resolveApiKey(explicitApiKey) {
-	if (explicitApiKey) return {
-		apiKey: explicitApiKey,
-		source: "flag",
-		detail: "--api-key"
-	};
+async function resolveApiKey() {
 	const envApiKey = getEnvApiKey();
 	if (envApiKey) return {
 		apiKey: envApiKey.apiKey,
 		source: "env",
 		detail: envApiKey.variable
 	};
-	const storedApiKey = await getStoredApiKey();
-	if (storedApiKey) return {
-		apiKey: storedApiKey.apiKey,
+	const storedCredential = await getStoredCredential();
+	if (storedCredential?.credential) return {
+		apiKey: storedCredential.credential.type === "oauth" ? storedCredential.credential.accessToken : storedCredential.credential.token,
 		source: "stored",
-		detail: describeCredentialBackend(storedApiKey.backend, storedApiKey.location)
+		detail: describeCredentialBackend(storedCredential.backend, storedCredential.location)
 	};
 	return { source: "missing" };
 }
@@ -1368,34 +1346,48 @@ function getDefaultEditorUrl() {
 function getResolvedStudioUrl(baseUrl) {
 	return baseUrl ?? getDefaultBaseUrl() ?? "https://stately.ai";
 }
-function getDefaultMcpResourceUrl() {
-	return process.env.STATELY_MCP_RESOURCE_URL ?? process.env.NEXT_PUBLIC_MCP_RESOURCE_URL ?? process.env.STATELY_MCP_API_BASE_URL ?? "https://editor.stately.ai/api/mcp";
+function getDefaultOAuthIssuer() {
+	return process.env.STATELY_OAUTH_ISSUER ?? process.env.NEXT_PUBLIC_STATELY_OAUTH_ISSUER ?? "https://stately.ai";
 }
 function normalizeLoginResourceUrl(baseUrl) {
-	const raw = baseUrl ?? getDefaultMcpResourceUrl();
+	const raw = baseUrl;
 	const url = new URL(raw);
 	if (url.pathname === "/" || url.pathname === "") url.pathname = "/api/mcp";
 	return url.toString();
 }
-function getOauthClientId() {
-	return process.env.STATELY_OAUTH_CLIENT_ID ?? process.env.NEXT_PUBLIC_STATELY_OAUTH_CLIENT_ID ?? "statelyai-cli";
+function getConfiguredOauthClientId() {
+	return process.env.STATELY_OAUTH_CLIENT_ID ?? process.env.NEXT_PUBLIC_STATELY_OAUTH_CLIENT_ID;
 }
 async function discoverOAuthLogin(options = {}) {
-	const resourceUrl = normalizeLoginResourceUrl(options.baseUrl);
-	const protectedResource = await discoverProtectedResource(resourceUrl, { fetch: options.fetch });
-	const [issuer] = protectedResource.authorization_servers ?? [];
-	if (!issuer) throw new Error(`No OAuth authorization server advertised by ${resourceUrl}. Use \`statelyai login --auth none\` for no-auth self-hosted deployments.`);
+	const resourceUrl = options.baseUrl ? normalizeLoginResourceUrl(options.baseUrl) : getDefaultOAuthIssuer();
+	const protectedResource = options.baseUrl ? await discoverProtectedResource(resourceUrl, { fetch: options.fetch }) : void 0;
+	const issuer = protectedResource ? protectedResource.authorization_servers?.[0] : resourceUrl;
+	if (!issuer) throw new Error(`No OAuth authorization server advertised by ${resourceUrl}. Pass --base-url for a Stately OAuth-enabled resource or set STATELY_OAUTH_ISSUER.`);
 	const authorizationServer = await discoverAuthorizationServer(issuer, { fetch: options.fetch });
 	const authorizationEndpoint = authorizationServer.authorization_endpoint;
 	const tokenEndpoint = authorizationServer.token_endpoint;
 	if (!authorizationEndpoint || !tokenEndpoint) throw new Error(`Authorization server ${issuer} did not advertise authorization and token endpoints.`);
+	const configuredClientId = options.clientId ?? getConfiguredOauthClientId();
+	const scopes = protectedResource?.scopes_supported ?? [];
+	let clientId = configuredClientId;
+	if (!clientId && authorizationServer.registration_endpoint && options.redirectUri) try {
+		clientId = (await registerOAuthClient({
+			registrationEndpoint: authorizationServer.registration_endpoint,
+			redirectUri: options.redirectUri,
+			scopes,
+			fetch: options.fetch
+		})).client_id;
+	} catch (error) {
+		throw new Error(`OAuth dynamic client registration failed for ${authorizationServer.registration_endpoint}. Enable dynamic client registration on the OAuth authorization server, or set STATELY_OAUTH_CLIENT_ID to a registered OAuth client id.`, { cause: error });
+	}
+	if (!clientId) throw new Error(`Authorization server ${issuer} did not advertise dynamic client registration. Set STATELY_OAUTH_CLIENT_ID to a registered OAuth client id.`);
 	return {
 		authorizationServer,
 		authorizationEndpoint,
-		clientId: options.clientId ?? getOauthClientId(),
-		protectedResource,
+		clientId,
+		...protectedResource ? { protectedResource } : {},
 		resourceUrl,
-		scopes: protectedResource.scopes_supported ?? [],
+		scopes,
 		tokenEndpoint
 	};
 }
@@ -1458,7 +1450,7 @@ async function readApiKeyFromStdin() {
 	return Buffer.concat(chunks).toString("utf8").trim();
 }
 async function promptForApiKey() {
-	if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error("No interactive terminal available. Pass --api-key or pipe the key on stdin.");
+	if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error("No interactive terminal available. Pipe the API key to `statelyai login --stdin`.");
 	const maskedOutput = new Writable({ write(chunk, _encoding, callback) {
 		if (!maskedOutput.muted) process.stdout.write(chunk);
 		callback();
@@ -1564,7 +1556,8 @@ async function buildOAuthLoginStart(options) {
 	const [discovery, pkce] = await Promise.all([discoverOAuthLogin({
 		baseUrl: options.baseUrl,
 		clientId: options.clientId,
-		fetch: options.fetch
+		fetch: options.fetch,
+		redirectUri: options.redirectUri
 	}), createPkcePair()]);
 	return {
 		authorizeUrl: buildAuthorizeUrl({
@@ -1681,8 +1674,8 @@ function formatMissingNewMachineDirMessage(options) {
 function toMachineFileStem(machineName) {
 	return (typeof machineName === "string" ? machineName : "").trim().replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/[^A-Za-z0-9]+/g, "-").replace(/^-+|-+$/g, "").toLowerCase() || "machine";
 }
-function getMissingApiKeyMessage() {
-	return `No API key configured. Use \`statelyai login\`, set \`STATELY_API_KEY\`, or pass \`--api-key\`.\nGet or create an API key at ${STATELY_API_KEY_SETTINGS_URL}`;
+function getMissingCredentialMessage() {
+	return `No Stately credential configured. Run \`statelyai login\`, set \`STATELY_ACCESS_TOKEN\`, or set \`STATELY_API_KEY\`.\nGet or create an API key at ${STATELY_API_KEY_SETTINGS_URL}`;
 }
 function buildProjectEditorUrl(studioUrl, projectId) {
 	return `${studioUrl.replace(/\/+$/, "")}/registry/editor/${encodeURIComponent(projectId)}`;
@@ -1951,7 +1944,6 @@ const sharedFlags = {
 		default: false,
 		description: "Exit with a nonzero code when differences are found"
 	}),
-	"api-key": Flags.string({ description: "Stately API key used for remote source or target resolution" }),
 	"base-url": Flags.string({ description: "Base URL for Stately Studio or a self-hosted deployment" })
 };
 function formatChangeList(label, items) {
@@ -2006,7 +1998,7 @@ var PlanCommand = class PlanCommand extends ParsedSyncCommand {
 	static args = sharedArgs;
 	async run() {
 		const { args, flags } = await this.parseSync(PlanCommand);
-		const apiKey = (await resolveApiKey(flags["api-key"])).apiKey;
+		const apiKey = (await resolveApiKey()).apiKey;
 		const plan = await planSync({
 			source: args.source,
 			target: args.target,
@@ -2023,7 +2015,7 @@ var DiffCommand = class DiffCommand extends ParsedSyncCommand {
 	static args = sharedArgs;
 	async run() {
 		const { args, flags } = await this.parseSync(DiffCommand);
-		const apiKey = (await resolveApiKey(flags["api-key"])).apiKey;
+		const apiKey = (await resolveApiKey()).apiKey;
 		const plan = await planSync({
 			source: args.source,
 			target: args.target,
@@ -2057,9 +2049,9 @@ var PullCommand = class PullCommand extends ParsedSyncCommand {
 	};
 	async run() {
 		const { args, flags } = await this.parseSync(PullCommand);
-		const apiKey = (await resolveApiKey(flags["api-key"])).apiKey;
+		const apiKey = (await resolveApiKey()).apiKey;
 		if (!args.source) {
-			if (!apiKey) this.error(getMissingApiKeyMessage());
+			if (!apiKey) this.error(getMissingCredentialMessage());
 			this.log(colorize("Resolving configured project and linked source files...", ANSI_CYAN));
 			const { config, linkedTargets, project, remoteOnlyTargets, skipped, rewriteStatus } = await resolveConfiguredPullTargets({
 				apiKey,
@@ -2138,7 +2130,7 @@ var PullCommand = class PullCommand extends ParsedSyncCommand {
 			target = localCandidate;
 		}
 		if (!target) this.error("Missing target path. Pass `statelyai pull <machine-id|url> <file>` or `statelyai pull <linked-file>`.");
-		if (!apiKey) this.error(getMissingApiKeyMessage());
+		if (!apiKey) this.error(getMissingCredentialMessage());
 		if (!flags.force && await fileExists(target) && await isFileGitDirty(target)) this.error(`Refusing to overwrite locally modified file ${target}. Pass --force to overwrite it.`);
 		this.log(colorize(`Pulling ${source} into ${target}...`, ANSI_CYAN));
 		const result = await pullSync({
@@ -2160,7 +2152,6 @@ var PushCommand = class PushCommand extends Command {
 	}) };
 	static flags = {
 		help: Flags.help({ char: "h" }),
-		"api-key": Flags.string({ description: "Stately API key used to create or update remote machines" }),
 		"base-url": Flags.string({ description: "Base URL for Stately Studio or a self-hosted deployment" }),
 		config: Flags.string({ description: "Path to statelyai.json" }),
 		"dry-run": Flags.boolean({
@@ -2170,8 +2161,8 @@ var PushCommand = class PushCommand extends Command {
 	};
 	async run() {
 		const { args, flags } = await this.parse(PushCommand);
-		const resolvedApiKey = flags["dry-run"] ? { source: "missing" } : await resolveApiKey(flags["api-key"]);
-		if (!flags["dry-run"] && !resolvedApiKey.apiKey) this.error(getMissingApiKeyMessage());
+		const resolvedApiKey = flags["dry-run"] ? { source: "missing" } : await resolveApiKey();
+		if (!flags["dry-run"] && !resolvedApiKey.apiKey) this.error(getMissingCredentialMessage());
 		this.log(colorize("Resolving configured project and source files...", ANSI_CYAN));
 		const { client, config, files, rewriteStatus } = flags["dry-run"] ? await (async () => {
 			const { config, rootDir, rewriteStatus } = await readStatelyProjectConfig({
@@ -2286,7 +2277,6 @@ var OpenCommand = class OpenCommand extends Command {
 	}) };
 	static flags = {
 		help: Flags.help({ char: "h" }),
-		"api-key": Flags.string({ description: "Stately API key used when the editor server requires auth" }),
 		"editor-url": Flags.string({ description: "Base URL for the Stately editor embed" }),
 		host: Flags.string({
 			description: "Local server host",
@@ -2309,7 +2299,8 @@ var OpenCommand = class OpenCommand extends Command {
 	};
 	async run() {
 		const { args, flags } = await this.parse(OpenCommand);
-		const apiKey = (await resolveApiKey(flags["api-key"])).apiKey;
+		const apiKey = (await resolveApiKey()).apiKey;
+		if (!apiKey) throw new Error("No Stately credential configured. Run `statelyai login` and retry.");
 		await openEditor({
 			fileName: path.resolve(args.file),
 			editorUrl: flags["editor-url"] ?? getDefaultEditorUrl(),
@@ -2327,7 +2318,6 @@ var InitCommand = class InitCommand extends Command {
 	static description = "Creates or reuses a remote Studio project for the current working directory and writes a local statelyai.json configuration file.";
 	static flags = {
 		help: Flags.help({ char: "h" }),
-		"api-key": Flags.string({ description: "Stately API key used to create the remote project" }),
 		"base-url": Flags.string({ description: "Base URL for Stately Studio or a self-hosted deployment" }),
 		name: Flags.string({ description: "Project name to create remotely" }),
 		visibility: Flags.string({
@@ -2350,8 +2340,8 @@ var InitCommand = class InitCommand extends Command {
 	};
 	async run() {
 		const { flags } = await this.parse(InitCommand);
-		const resolvedApiKey = await resolveApiKey(flags["api-key"]);
-		if (!resolvedApiKey.apiKey) this.error(getMissingApiKeyMessage());
+		const resolvedApiKey = await resolveApiKey();
+		if (!resolvedApiKey.apiKey) this.error(getMissingCredentialMessage());
 		this.log("Creating or reusing remote project...");
 		const result = await initProject({
 			apiKey: resolvedApiKey.apiKey,
@@ -2398,8 +2388,8 @@ var LoginCommand = class LoginCommand extends Command {
 	static description = "Stores Stately credentials in the OS credential store when available, with a private file fallback.";
 	static flags = {
 		help: Flags.help({ char: "h" }),
-		"api-key": Flags.string({ description: "API key to store without an interactive prompt" }),
-		"base-url": Flags.string({ description: "MCP/API resource URL used for OAuth discovery" }),
+		"api-key": Flags.boolean({ description: "Prompt securely for an API key to store" }),
+		"base-url": Flags.string({ description: "OAuth protected-resource URL for custom deployments" }),
 		stdin: Flags.boolean({
 			description: "Read the API key from standard input",
 			default: false
@@ -2411,7 +2401,7 @@ var LoginCommand = class LoginCommand extends Command {
 	};
 	async run() {
 		const { flags } = await this.parse(LoginCommand);
-		if (flags["api-key"] && flags.auth === "bearer") this.error("Pass either --api-key or --auth bearer, not both.");
+		if ((flags["api-key"] || flags.stdin) && flags.auth === "bearer") this.error("Pass either --auth bearer or API-key login flags, not both.");
 		if (flags.auth === "none") {
 			if (flags.stdin || flags["api-key"]) this.error("Pass either --auth none or an API key, not both.");
 			const stored = await setStoredNoAuth();
@@ -2427,34 +2417,30 @@ var LoginCommand = class LoginCommand extends Command {
 			return;
 		}
 		if (flags.stdin && flags["api-key"]) this.error("Pass either --api-key or --stdin, not both.");
-		if (!flags["api-key"] && !flags.stdin && process.stdin.isTTY && process.stdout.isTTY) this.log(`Get or create an API key at ${STATELY_API_KEY_SETTINGS_URL}`);
-		const apiKey = normalizeApiKey(flags["api-key"] ?? (!process.stdin.isTTY || flags.stdin ? await readApiKeyFromStdin() : await promptForApiKey()));
+		const apiKey = normalizeApiKey(flags.stdin ? await readApiKeyFromStdin() : await promptForApiKey());
 		if (!apiKey) this.error(`API key cannot be empty.\nGet or create an API key at ${STATELY_API_KEY_SETTINGS_URL}`);
-		const stored = flags["api-key"] || flags.stdin ? await setStoredApiKey(apiKey) : await setStoredCredential({
-			type: "api_key",
-			token: apiKey
-		});
+		const stored = await setStoredApiKey(apiKey);
 		this.log(`Stored API key in ${describeCredentialBackend(stored.backend, stored.location)}.`);
 	}
 };
 var LogoutCommand = class extends Command {
 	static enableJsonFlag = false;
-	static summary = "Remove any API key stored by the CLI.";
-	static description = "Deletes the locally stored API key. Environment variables are not changed.";
+	static summary = "Remove credentials stored by the CLI.";
+	static description = "Deletes locally stored credentials. Environment variables are not changed.";
 	static flags = { help: Flags.help({ char: "h" }) };
 	async run() {
 		const result = await deleteStoredApiKey();
 		if (!result.deleted) {
-			this.log("No stored API key found.");
+			this.log("No stored credential found.");
 			return;
 		}
-		this.log(`Removed stored API key from ${result.locations.join(", ")}.`);
+		this.log(`Removed stored credential from ${result.locations.join(", ")}.`);
 	}
 };
 var WhoamiCommand = class extends Command {
 	static enableJsonFlag = false;
-	static summary = "Show how the CLI would resolve its API key.";
-	static description = "Reports whether the CLI would use a flag, environment variable, or stored credential.";
+	static summary = "Show how the CLI would resolve credentials.";
+	static description = "Reports whether the CLI would use an environment variable or stored credential.";
 	static flags = { help: Flags.help({ char: "h" }) };
 	async run() {
 		const envCredential = getEnvCredential();
@@ -2473,7 +2459,7 @@ var WhoamiCommand = class extends Command {
 			this.log(formatStoredCredentialSource(storedCredential));
 			return;
 		}
-		this.log(getMissingApiKeyMessage());
+		this.log(getMissingCredentialMessage());
 	}
 };
 const COMMANDS = {

package/dist/index.d.mts

@@ -100,7 +100,7 @@ interface ResolvedConfiguredPullTargets {
 type ApiKeyResolution = {
   apiKey: string;
   detail: string;
-  source: 'env' | 'flag' | 'stored';
+  source: 'env' | 'stored';
 } | {
   apiKey?: undefined;
   detail?: undefined;
@@ -114,12 +114,12 @@ declare function getEnvCredential(): {
   credential: StatelyCredential;
   variable: 'NEXT_PUBLIC_STATELY_API_KEY' | 'STATELY_API_KEY' | 'STATELY_ACCESS_TOKEN';
 } | undefined;
-declare function resolveApiKey(explicitApiKey?: string): Promise<ApiKeyResolution>;
+declare function resolveApiKey(): Promise<ApiKeyResolution>;
 interface OAuthLoginDiscovery {
   authorizationServer: OAuthAuthorizationServerMetadata;
   authorizationEndpoint: string;
   clientId: string;
-  protectedResource: OAuthProtectedResourceMetadata;
+  protectedResource?: OAuthProtectedResourceMetadata;
   resourceUrl: string;
   scopes: string[];
   tokenEndpoint: string;
@@ -128,6 +128,7 @@ declare function discoverOAuthLogin(options?: {
   baseUrl?: string;
   clientId?: string;
   fetch?: typeof fetch;
+  redirectUri?: string;
 }): Promise<OAuthLoginDiscovery>;
 declare function inferInitProjectName(cwd: string, repo?: ConnectedRepo): string;
 declare function buildOAuthLoginStart(options: {
@@ -171,7 +172,6 @@ declare abstract class BaseSyncCommand extends Command {
   static flags: {
     help: _oclif_core_interfaces0.BooleanFlag<void>;
     'fail-on-changes': _oclif_core_interfaces0.BooleanFlag<boolean>;
-    'api-key': _oclif_core_interfaces0.OptionFlag<string | undefined, _oclif_core_interfaces0.CustomOptions>;
     'base-url': _oclif_core_interfaces0.OptionFlag<string | undefined, _oclif_core_interfaces0.CustomOptions>;
   };
 }
@@ -179,7 +179,6 @@ declare abstract class ParsedSyncCommand extends BaseSyncCommand {
   protected parseSync<T extends typeof BaseSyncCommand>(command: T): Promise<_oclif_core_interfaces0.ParserOutput<{
     help: void;
     'fail-on-changes': boolean;
-    'api-key': string | undefined;
     'base-url': string | undefined;
   }, {
     [flag: string]: any;
@@ -213,7 +212,6 @@ declare class PullCommand extends ParsedSyncCommand {
     force: _oclif_core_interfaces0.BooleanFlag<boolean>;
     help: _oclif_core_interfaces0.BooleanFlag<void>;
     'fail-on-changes': _oclif_core_interfaces0.BooleanFlag<boolean>;
-    'api-key': _oclif_core_interfaces0.OptionFlag<string | undefined, _oclif_core_interfaces0.CustomOptions>;
     'base-url': _oclif_core_interfaces0.OptionFlag<string | undefined, _oclif_core_interfaces0.CustomOptions>;
   };
   static args: {
@@ -231,7 +229,6 @@ declare class PushCommand extends Command {
   };
   static flags: {
     help: _oclif_core_interfaces0.BooleanFlag<void>;
-    'api-key': _oclif_core_interfaces0.OptionFlag<string | undefined, _oclif_core_interfaces0.CustomOptions>;
     'base-url': _oclif_core_interfaces0.OptionFlag<string | undefined, _oclif_core_interfaces0.CustomOptions>;
     config: _oclif_core_interfaces0.OptionFlag<string | undefined, _oclif_core_interfaces0.CustomOptions>;
     'dry-run': _oclif_core_interfaces0.BooleanFlag<boolean>;
@@ -247,7 +244,6 @@ declare class OpenCommand extends Command {
   };
   static flags: {
     help: _oclif_core_interfaces0.BooleanFlag<void>;
-    'api-key': _oclif_core_interfaces0.OptionFlag<string | undefined, _oclif_core_interfaces0.CustomOptions>;
     'editor-url': _oclif_core_interfaces0.OptionFlag<string | undefined, _oclif_core_interfaces0.CustomOptions>;
     host: _oclif_core_interfaces0.OptionFlag<string, _oclif_core_interfaces0.CustomOptions>;
     port: _oclif_core_interfaces0.OptionFlag<number, _oclif_core_interfaces0.CustomOptions>;
@@ -262,7 +258,6 @@ declare class InitCommand extends Command {
   static description: string;
   static flags: {
     help: _oclif_core_interfaces0.BooleanFlag<void>;
-    'api-key': _oclif_core_interfaces0.OptionFlag<string | undefined, _oclif_core_interfaces0.CustomOptions>;
     'base-url': _oclif_core_interfaces0.OptionFlag<string | undefined, _oclif_core_interfaces0.CustomOptions>;
     name: _oclif_core_interfaces0.OptionFlag<string | undefined, _oclif_core_interfaces0.CustomOptions>;
     visibility: _oclif_core_interfaces0.OptionFlag<string, _oclif_core_interfaces0.CustomOptions>;
@@ -277,7 +272,7 @@ declare class LoginCommand extends Command {
   static description: string;
   static flags: {
     help: _oclif_core_interfaces0.BooleanFlag<void>;
-    'api-key': _oclif_core_interfaces0.OptionFlag<string | undefined, _oclif_core_interfaces0.CustomOptions>;
+    'api-key': _oclif_core_interfaces0.BooleanFlag<boolean>;
     'base-url': _oclif_core_interfaces0.OptionFlag<string | undefined, _oclif_core_interfaces0.CustomOptions>;
     stdin: _oclif_core_interfaces0.BooleanFlag<boolean>;
     auth: _oclif_core_interfaces0.OptionFlag<string | undefined, _oclif_core_interfaces0.CustomOptions>;

package/dist/index.mjs

@@ -1,3 +1,3 @@
-import { _ as run, a as discoverOAuthLogin, c as formatPlanSummary, d as getEnvCredential, f as inferInitProjectName, g as resolveConfiguredPullTargets, h as resolveApiKey, i as discoverLinkedPullTargets, l as formatStoredCredentialSource, m as isFileGitDirty, n as buildOAuthLoginStart, o as discoverRemoteProjectMachineTargets, p as initProject, r as classifyPushCandidates, s as formatMissingNewMachineDirMessage, t as COMMANDS, u as getEnvApiKey, v as scanProjectSources, y as createStatelyProjectConfig } from "./cli-Buz_BC3I.mjs";
+import { _ as run, a as discoverOAuthLogin, c as formatPlanSummary, d as getEnvCredential, f as inferInitProjectName, g as resolveConfiguredPullTargets, h as resolveApiKey, i as discoverLinkedPullTargets, l as formatStoredCredentialSource, m as isFileGitDirty, n as buildOAuthLoginStart, o as discoverRemoteProjectMachineTargets, p as initProject, r as classifyPushCandidates, s as formatMissingNewMachineDirMessage, t as COMMANDS, u as getEnvApiKey, v as scanProjectSources, y as createStatelyProjectConfig } from "./cli-DR7_Qkzm.mjs";
 
 export { COMMANDS, buildOAuthLoginStart, classifyPushCandidates, createStatelyProjectConfig, discoverLinkedPullTargets, discoverOAuthLogin, discoverRemoteProjectMachineTargets, formatMissingNewMachineDirMessage, formatPlanSummary, formatStoredCredentialSource, getEnvApiKey, getEnvCredential, inferInitProjectName, initProject, isFileGitDirty, resolveApiKey, resolveConfiguredPullTargets, run, scanProjectSources };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "statelyai",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Command-line tools for Stately",
   "license": "MIT",
   "type": "module",
@@ -21,7 +21,7 @@
   },
   "dependencies": {
     "@oclif/core": "^4.10.3",
-    "@statelyai/sdk": "0.12.0"
+    "@statelyai/sdk": "0.12.2"
   },
   "devDependencies": {
     "tsdown": "0.21.0-beta.2",