@doist/automations-cli 1.17.0 → 1.18.0

package/dist/index.js

@@ -6899,7 +6899,7 @@ import { fileURLToPath } from "node:url";
 // package.json
 var package_default = {
   name: "@doist/automations-cli",
-  version: "1.17.0",
+  version: "1.18.0",
   description: "Command-line client for Todoist Automations",
   type: "module",
   bin: {
@@ -6943,7 +6943,7 @@ var package_default = {
     postinstall: "node scripts/refresh-skills.mjs"
   },
   dependencies: {
-    "@doist/cli-core": "1.6.0",
+    "@doist/cli-core": "1.7.0",
     "@napi-rs/keyring": "2.1.0",
     ai: "7.0.77",
     commander: "15.0.0",
@@ -6953,13 +6953,13 @@ var package_default = {
   devDependencies: {
     "@doist/automations-core": "*",
     "@doist/automations-sdk": "*",
-    "@types/node": "24.13.6",
+    "@types/node": "24.19.1",
     "conventional-changelog-conventionalcommits": "9.3.1",
     esbuild: "0.28.2",
     "semantic-release": "25.0.9",
     "semantic-release-monorepo": "8.0.2",
     typescript: "6.0.3",
-    vitest: "4.1.11"
+    vitest: "5.0.3"
   },
   engines: {
     node: ">=24"
@@ -7037,6 +7037,10 @@ var API_SCOPES = {
 };
 var API_SCOPE_CODES = Object.keys(API_SCOPES);
 
+// ../../packages/core/dist/esm/constants/cli-client.constants.js
+var AUTOMATIONS_CLI_CLIENT_NAME = "Todoist Automations CLI";
+var AUTOMATIONS_CLI_LOGO_URL = "https://todoist.b-cdn.net/agentist-icons/service_automations-cli_color_192px.png";
+
 // ../../packages/core/dist/esm/constants/connection.constants.js
 var CONNECTION_STATUSES = ["pending", "authorized", "expired", "error"];
 var CONNECTION_TYPES = ["mcp", "trigger", "api"];
@@ -7124,71 +7128,98 @@ var MODEL_CATALOG = {
   "gemini-2.5-flash-lite": {
     provider: "gemini",
     family: "2.5",
-    providerModelId: "gemini-2.5-flash-lite"
+    providerModelId: "gemini-2.5-flash-lite",
+    manifestSelectable: true
   },
   "gemini-2.5-flash": {
     provider: "gemini",
     family: "2.5",
-    providerModelId: "gemini-2.5-flash"
+    providerModelId: "gemini-2.5-flash",
+    manifestSelectable: true
   },
   "gemini-3.1-pro": {
     provider: "gemini",
     family: "3",
-    providerModelId: "gemini-3.1-pro-preview"
+    providerModelId: "gemini-3.1-pro-preview",
+    manifestSelectable: true
   },
   "gemini-3.8-flash": {
     provider: "gemini",
     family: "3",
-    providerModelId: "gemini-3.8-flash"
+    providerModelId: "gemini-3.8-flash",
+    manifestSelectable: true
   },
   "claude-opus-4-6": {
     provider: "anthropic",
     family: "4.6",
-    providerModelId: "claude-opus-4-6"
+    providerModelId: "claude-opus-4-6",
+    manifestSelectable: true
   },
   "claude-sonnet-5": {
     provider: "anthropic",
     family: "5",
-    providerModelId: "claude-sonnet-5"
+    providerModelId: "claude-sonnet-5",
+    manifestSelectable: true
+  },
+  "claude-sonnet-5-5": {
+    provider: "anthropic",
+    family: "5",
+    providerModelId: "claude-sonnet-5-5",
+    manifestSelectable: false
+  },
+  "claude-haiku-5-5": {
+    provider: "anthropic",
+    family: "5",
+    providerModelId: "claude-haiku-5-5",
+    manifestSelectable: false
   },
   "claude-sonnet-4-6": {
     provider: "anthropic",
     family: "4.6",
-    providerModelId: "claude-sonnet-4-6"
+    providerModelId: "claude-sonnet-4-6",
+    manifestSelectable: true
   },
   "claude-haiku-4-5": {
     provider: "anthropic",
     family: "4.5",
-    providerModelId: "claude-haiku-4-5"
+    providerModelId: "claude-haiku-4-5",
+    manifestSelectable: true
   },
   "deepseek-v4-flash": {
     provider: "openrouter",
     family: "deepseek",
-    providerModelId: "deepseek/deepseek-v4-flash-0731"
+    providerModelId: "deepseek/deepseek-v4-flash-0731",
+    manifestSelectable: true
   },
   "deepseek-v4-pro": {
     provider: "openrouter",
     family: "deepseek",
-    providerModelId: "deepseek/deepseek-v4-pro"
+    providerModelId: "deepseek/deepseek-v4-pro",
+    manifestSelectable: true
   },
   "mimo-v2.5": {
     provider: "openrouter",
     family: "mimo",
-    providerModelId: "xiaomi/mimo-v2.5"
+    providerModelId: "xiaomi/mimo-v2.5",
+    manifestSelectable: true
   },
   "mimo-v2.5-pro": {
     provider: "openrouter",
     family: "mimo",
-    providerModelId: "xiaomi/mimo-v2.5-pro"
+    providerModelId: "xiaomi/mimo-v2.5-pro",
+    manifestSelectable: true
   },
   "glm-5.2": {
     provider: "openrouter",
     family: "glm",
-    providerModelId: "z-ai/glm-5.2"
+    providerModelId: "z-ai/glm-5.2",
+    manifestSelectable: true
   }
 };
 var SUPPORTED_LLM_MODELS = Object.keys(MODEL_CATALOG);
 var SUPPORTED_SEARCH_MODELS = SUPPORTED_LLM_MODELS.filter(supportsWebSearch);
+var MANIFEST_LLM_MODELS = SUPPORTED_LLM_MODELS.filter((modelId) => MODEL_CATALOG[modelId].manifestSelectable);
+var MANIFEST_SEARCH_MODELS = MANIFEST_LLM_MODELS.filter((modelId) => supportsWebSearch(modelId));
 function supportsWebSearch(modelId) {
   const { provider } = MODEL_CATALOG[modelId];
   return provider === "gemini" || provider === "anthropic";
@@ -26894,6 +26925,159 @@ var admitUsersResponseSchema = external_exports.object({
   })
 });
 
+// ../../packages/core/dist/esm/schemas/usage-billing.schema.js
+var UsageBillingProductSchema = external_exports.literal("automations");
+var USAGE_BILLING_BLOCK_REASONS = [
+  "insufficient_credit",
+  "temporarily_unavailable"
+];
+var USAGE_BILLING_AUTHORIZATION_DENIAL_REASONS = [
+  ...USAGE_BILLING_BLOCK_REASONS,
+  "no_billing_account"
+];
+var UsageBillingAuthorizationDenialReasonSchema = external_exports.enum(USAGE_BILLING_AUTHORIZATION_DENIAL_REASONS);
+var UsageBillingBlockReasonSchema = external_exports.enum(USAGE_BILLING_BLOCK_REASONS);
+var UsageBillingAccountSchema = external_exports.object({
+  id: external_exports.string().regex(/^[1-9]\d*$/),
+  type: external_exports.literal("user")
+});
+var RESERVATION_ID_MAX_LENGTH = 100;
+var EXTERNAL_EVENT_ID_MAX_LENGTH = 100;
+var CATEGORY_MAX_LENGTH = 64;
+var AuthorizeUsageRequestSchema = external_exports.object({
+  product: UsageBillingProductSchema,
+  account: UsageBillingAccountSchema,
+  reservation_id: external_exports.string().min(1).max(RESERVATION_ID_MAX_LENGTH),
+  category: external_exports.string().min(1).max(CATEGORY_MAX_LENGTH)
+});
+var UsageBillingUnitsSchema = external_exports.number().int().nonnegative();
+var UsageBillingBalanceSchema = external_exports.number().int();
+var RecordUsageRefsSchema = external_exports.record(external_exports.string().max(40), external_exports.string().max(500)).refine((refs) => Object.keys(refs).length <= 50);
+var AuthorizeUsageResponseSchema = external_exports.discriminatedUnion("decision", [
+  external_exports.object({
+    decision: external_exports.literal("allowed"),
+    reservation_id: external_exports.string().min(1),
+    available_units: UsageBillingBalanceSchema
+  }),
+  external_exports.object({
+    decision: external_exports.literal("denied"),
+    reason: UsageBillingAuthorizationDenialReasonSchema,
+    available_units: UsageBillingBalanceSchema
+  })
+]);
+var RecordUsageRequestSchema = external_exports.object({
+  product: UsageBillingProductSchema,
+  account: UsageBillingAccountSchema,
+  reservation_id: external_exports.string().min(1).max(RESERVATION_ID_MAX_LENGTH),
+  external_event_id: external_exports.string().min(1).max(EXTERNAL_EVENT_ID_MAX_LENGTH).refine((value) => !value.startsWith("reservation:")),
+  category: external_exports.string().min(1).max(CATEGORY_MAX_LENGTH),
+  status: external_exports.enum(["success", "failed", "cancelled", "timed_out", "partial"]),
+  incurred_cost: external_exports.number().int().nonnegative(),
+  refs: RecordUsageRefsSchema.optional(),
+  description: external_exports.string().min(1).max(255)
+});
+var RecordUsageResponseSchema = external_exports.object({
+  recorded: external_exports.boolean(),
+  charged_units: UsageBillingUnitsSchema,
+  available_units: UsageBillingBalanceSchema
+});
+var TOP_UP_USD_MIN_AMOUNT = 500;
+var TopUpCurrencySchema = external_exports.preprocess((value) => typeof value === "string" ? value.toLowerCase() : value, external_exports.literal("usd"));
+var StartTopUpRequestSchema = external_exports.object({
+  amount: external_exports.number().int().min(TOP_UP_USD_MIN_AMOUNT),
+  // The public OpenAPI example uses lowercase `usd`; the backend also
+  // normalizes caller casing before checking the currently supported currency.
+  currency: TopUpCurrencySchema,
+  return_url: external_exports.url()
+});
+var StartTopUpResponseSchema = external_exports.object({
+  session_id: external_exports.string().min(1),
+  checkout_url: external_exports.url()
+});
+var BillingPortalUrlRequestSchema = external_exports.object({
+  return_url: external_exports.url()
+});
+var BillingPortalUrlResponseSchema = external_exports.object({
+  billing_portal_url: external_exports.url()
+});
+var ReadStateResponseSchema = external_exports.object({
+  available_units: UsageBillingBalanceSchema,
+  available_amount: UsageBillingBalanceSchema,
+  currency: external_exports.string(),
+  usage_allowed: external_exports.boolean(),
+  low_balance: external_exports.boolean(),
+  depleted: external_exports.boolean(),
+  /**
+   * Additive hold-free snapshot. These fields remain optional until every
+   * Todoist producer emits them, and balances may be overdrawn after a
+   * settlement.
+   */
+  settled_units: UsageBillingBalanceSchema.optional(),
+  settled_amount: UsageBillingBalanceSchema.optional(),
+  is_settled_low_balance: external_exports.boolean().optional(),
+  usage_block_reason: UsageBillingBlockReasonSchema.nullable().optional()
+});
+var UsageBillingAmountSchema = UsageBillingUnitsSchema.nullable();
+var UsageBillingEntrySchema = external_exports.object({
+  id: external_exports.number().int().positive(),
+  type: external_exports.string().min(1),
+  created_at: external_exports.iso.datetime(),
+  category: external_exports.string().min(1).optional(),
+  status: external_exports.string().min(1).optional(),
+  charged_units: UsageBillingAmountSchema,
+  /** `charged_units` in integer microdollars. `null` exactly when it is. */
+  charged_amount: UsageBillingAmountSchema,
+  credited_units: UsageBillingAmountSchema,
+  /** `credited_units` in integer microdollars. `null` exactly when it is. */
+  credited_amount: UsageBillingAmountSchema,
+  refs: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  description: external_exports.string().optional()
+}).refine((entry) => entry.charged_units === null === (entry.charged_amount === null) && entry.credited_units === null === (entry.credited_amount === null), { message: "Each units field and its amount must be null together" });
+var USAGE_BILLING_ENTRY_TYPES = [
+  "usage_settled",
+  "top_up",
+  "adjustment",
+  "void",
+  "expiry",
+  "chargeback"
+];
+var UsageBillingEntryTypeSchema = external_exports.enum(USAGE_BILLING_ENTRY_TYPES);
+var ReadTransactionsResponseSchema = external_exports.object({
+  /**
+   * On the page rather than on each entry: an account pins one price for its
+   * whole life, so no two entries can differ.
+   */
+  currency: external_exports.string(),
+  entries: external_exports.array(UsageBillingEntrySchema),
+  has_more: external_exports.boolean(),
+  /** Absent on the last page. */
+  next_cursor: external_exports.string().min(1).optional()
+});
+var ReadUsageSummaryRequestSchema = external_exports.object({
+  /** Omit to total every category. */
+  category: external_exports.string().min(1).optional(),
+  /** Start of the window, inclusive. Omit to start at the account's first event. */
+  since: external_exports.iso.datetime().optional(),
+  /** End of the window, exclusive. Omit to run to now. */
+  until: external_exports.iso.datetime().optional()
+});
+var ReadUsageSummaryResponseSchema = external_exports.object({
+  currency: external_exports.string(),
+  usage_count: UsageBillingUnitsSchema,
+  charged_units: UsageBillingUnitsSchema,
+  /** `charged_units` in integer microdollars. `0` on an account with no usage. */
+  charged_amount: UsageBillingUnitsSchema
+});
+var GrantWelcomeCreditRequestSchema = external_exports.object({
+  product: UsageBillingProductSchema,
+  account: UsageBillingAccountSchema,
+  operator: external_exports.email().max(254)
+});
+var GrantWelcomeCreditResponseSchema = external_exports.object({
+  status: external_exports.enum(["granted", "already_granted"]),
+  grant_id: external_exports.string().min(1)
+});
+
 // ../../packages/core/dist/esm/types/failure-category.types.js
 var FAILURE_CATEGORIES = [
   "mcp_upstream_unavailable",
@@ -26918,7 +27102,7 @@ var FAILURE_CATEGORIES = [
   "billing_unavailable",
   "unknown"
 ];
-var SKIP_CATEGORIES = ["insufficient_credit"];
+var SKIP_CATEGORIES = USAGE_BILLING_AUTHORIZATION_DENIAL_REASONS;
 
 // ../../packages/core/dist/esm/schemas/shared.schema.js
 var RolloutCompatibleNullableStringSchema = external_exports.string().nullish().transform((value) => value ?? null);
@@ -27522,7 +27706,12 @@ var ConnectorSchema = external_exports.object({
    * connection types — one onboarding covers both action and trigger uses.
    * The FE collapses per-type rows into a single account when this is true.
    */
-  isManaged: external_exports.boolean().optional()
+  isManaged: external_exports.boolean().optional(),
+  /**
+   * The service only admits loopback OAuth clients, so account setup runs in
+   * the Automations CLI on the user's machine instead of the web app.
+   */
+  connectsViaCli: external_exports.boolean().optional()
 });
 var GetConnectorsQuerySchema = external_exports.object({
   query: external_exports.string().optional()
@@ -27548,6 +27737,11 @@ var connectorListResponseSchema = external_exports.object({
   nextCursor: external_exports.string().nullable()
 });
 
+// ../../packages/core/dist/esm/utils/cli-command.js
+function connectViaCliCommand(connectorId, capability) {
+  return `tda connector connect ${connectorId} --capability ${capability}`;
+}
+
 // ../../packages/core/dist/esm/utils/duration.js
 var durationUnits = ["ms", "s", "m", "h", "d", "w"];
 var createDurationPattern = (units) => units.join("|");
@@ -27915,7 +28109,7 @@ var baseStepSchema = external_exports.object({
   })
 });
 var MODEL_TIERS = ["lite", "flash", "pro"];
-var SUPPORTED_MODEL_REFERENCES = [...MODEL_TIERS, ...SUPPORTED_LLM_MODELS];
+var SUPPORTED_MODEL_REFERENCES = [...MODEL_TIERS, ...MANIFEST_LLM_MODELS];
 var modelReferenceSchema = external_exports.enum(SUPPORTED_MODEL_REFERENCES).meta({
   description: "A stable model tier (lite, flash, pro) or a supported literal model override."
 });
@@ -27971,7 +28165,7 @@ var searchStepSchema = baseStepSchema.merge(external_exports.object({
     description: "The search prompt to execute using web search."
   }),
   outputSchema: searchStepOutputSchema,
-  model: external_exports.enum([...MODEL_TIERS, ...SUPPORTED_SEARCH_MODELS]).optional().meta({
+  model: external_exports.enum([...MODEL_TIERS, ...MANIFEST_SEARCH_MODELS]).optional().meta({
     description: "A stable tier (lite, flash, pro) or a supported search-enabled literal model override."
   })
 }));
@@ -28600,6 +28794,29 @@ var CreateConnectionParamsSchema = external_exports.object({
 var CreateConnectionBodySchema = external_exports.object({
   automationIds: external_exports.array(external_exports.uuid()).optional()
 });
+var ImportLocalOAuthConnectionBodySchema = external_exports.object({
+  /** The public client the CLI registered; the server bound the grant to it. */
+  clientId: external_exports.string().min(1),
+  accessToken: external_exports.string().min(1),
+  refreshToken: external_exports.string().min(1).optional(),
+  /** Seconds until `accessToken` expires, as the token endpoint reported it. */
+  expiresIn: external_exports.number().int().positive().optional(),
+  /**
+   * A broken connection of the caller's, for the same connector, whose
+   * automation bindings move to the new grant when the account cannot be
+   * matched to it.
+   */
+  repairConnectionId: external_exports.uuid().optional()
+});
+var LocalOAuthSetupSchema = external_exports.object({
+  /** RFC 7591 registration endpoint; null when the server offers none. */
+  registrationEndpoint: external_exports.string().url().nullable(),
+  authorizationEndpoint: external_exports.string().url(),
+  tokenEndpoint: external_exports.string().url(),
+  /** RFC 8707 resource indicator for the MCP server, when it advertises one. */
+  resource: external_exports.string().url().nullable(),
+  scopes: external_exports.array(external_exports.string())
+});
 var OAuthConnectionSetupSchema = external_exports.object({
   kind: external_exports.literal("oauth"),
   authorizationUrl: external_exports.string().url()
@@ -29090,7 +29307,9 @@ var chatUsagePreviewSchema = external_exports.object({
 var chatStreamRequestErrorResponseSchema = external_exports.object({
   message: external_exports.string(),
   statusCode: external_exports.number().int(),
-  code: external_exports.enum(USAGE_BILLING_DENIAL_CODES).optional().catch(void 0)
+  code: external_exports.enum(USAGE_BILLING_DENIAL_CODES).optional().catch(void 0),
+  /** Present only when the server establishes whether work started. */
+  execution_started: external_exports.boolean().optional()
 });
 var CHAT_CONVERSATION_STATUSES = ["active", "archived", "all"];
 var chatConversationStatusSchema = external_exports.enum(CHAT_CONVERSATION_STATUSES);
@@ -29417,7 +29636,9 @@ var FRONTEND_COHORT_EVENTS = [
   "chat:sent",
   "automation:repaired",
   "template:used",
-  "top-up:completed"
+  "top-up:completed",
+  "guided-creation:started",
+  "guided-creation:completed"
 ];
 var BACKEND_COHORT_EVENTS = [
   // API-process (publish lifecycle)
@@ -29825,140 +30046,6 @@ var subscriptionResponseSchema = external_exports.object({
   updatedAt: external_exports.string()
 });
 
-// ../../packages/core/dist/esm/schemas/usage-billing.schema.js
-var UsageBillingProductSchema = external_exports.literal("automations");
-var UsageBillingAccountSchema = external_exports.object({
-  id: external_exports.string().regex(/^[1-9]\d*$/),
-  type: external_exports.literal("user")
-});
-var RESERVATION_ID_MAX_LENGTH = 100;
-var EXTERNAL_EVENT_ID_MAX_LENGTH = 100;
-var CATEGORY_MAX_LENGTH = 64;
-var AuthorizeUsageRequestSchema = external_exports.object({
-  product: UsageBillingProductSchema,
-  account: UsageBillingAccountSchema,
-  reservation_id: external_exports.string().min(1).max(RESERVATION_ID_MAX_LENGTH),
-  category: external_exports.string().min(1).max(CATEGORY_MAX_LENGTH)
-});
-var UsageBillingUnitsSchema = external_exports.number().int().nonnegative();
-var UsageBillingBalanceSchema = external_exports.number().int();
-var RecordUsageRefsSchema = external_exports.record(external_exports.string().max(40), external_exports.string().max(500)).refine((refs) => Object.keys(refs).length <= 50);
-var AuthorizeUsageResponseSchema = external_exports.discriminatedUnion("decision", [
-  external_exports.object({
-    decision: external_exports.literal("allowed"),
-    reservation_id: external_exports.string().min(1),
-    available_units: UsageBillingBalanceSchema
-  }),
-  external_exports.object({
-    decision: external_exports.literal("denied"),
-    reason: external_exports.enum(["insufficient_credit", "no_billing_account"]),
-    available_units: UsageBillingBalanceSchema
-  })
-]);
-var RecordUsageRequestSchema = external_exports.object({
-  product: UsageBillingProductSchema,
-  account: UsageBillingAccountSchema,
-  reservation_id: external_exports.string().min(1).max(RESERVATION_ID_MAX_LENGTH),
-  external_event_id: external_exports.string().min(1).max(EXTERNAL_EVENT_ID_MAX_LENGTH).refine((value) => !value.startsWith("reservation:")),
-  category: external_exports.string().min(1).max(CATEGORY_MAX_LENGTH),
-  status: external_exports.enum(["success", "failed", "cancelled", "timed_out", "partial"]),
-  incurred_cost: external_exports.number().int().nonnegative(),
-  refs: RecordUsageRefsSchema.optional(),
-  description: external_exports.string().min(1).max(255)
-});
-var RecordUsageResponseSchema = external_exports.object({
-  recorded: external_exports.boolean(),
-  charged_units: UsageBillingUnitsSchema,
-  available_units: UsageBillingBalanceSchema
-});
-var TOP_UP_USD_MIN_AMOUNT = 500;
-var TopUpCurrencySchema = external_exports.preprocess((value) => typeof value === "string" ? value.toLowerCase() : value, external_exports.literal("usd"));
-var StartTopUpRequestSchema = external_exports.object({
-  amount: external_exports.number().int().min(TOP_UP_USD_MIN_AMOUNT),
-  // The public OpenAPI example uses lowercase `usd`; the backend also
-  // normalizes caller casing before checking the currently supported currency.
-  currency: TopUpCurrencySchema,
-  return_url: external_exports.url()
-});
-var StartTopUpResponseSchema = external_exports.object({
-  session_id: external_exports.string().min(1),
-  checkout_url: external_exports.url()
-});
-var BillingPortalUrlRequestSchema = external_exports.object({
-  return_url: external_exports.url()
-});
-var BillingPortalUrlResponseSchema = external_exports.object({
-  billing_portal_url: external_exports.url()
-});
-var ReadStateResponseSchema = external_exports.object({
-  available_units: UsageBillingBalanceSchema,
-  available_amount: UsageBillingBalanceSchema,
-  currency: external_exports.string(),
-  usage_allowed: external_exports.boolean(),
-  low_balance: external_exports.boolean(),
-  depleted: external_exports.boolean()
-});
-var UsageBillingAmountSchema = UsageBillingUnitsSchema.nullable();
-var UsageBillingEntrySchema = external_exports.object({
-  id: external_exports.number().int().positive(),
-  type: external_exports.string().min(1),
-  created_at: external_exports.iso.datetime(),
-  category: external_exports.string().min(1).optional(),
-  status: external_exports.string().min(1).optional(),
-  charged_units: UsageBillingAmountSchema,
-  /** `charged_units` in integer microdollars. `null` exactly when it is. */
-  charged_amount: UsageBillingAmountSchema,
-  credited_units: UsageBillingAmountSchema,
-  /** `credited_units` in integer microdollars. `null` exactly when it is. */
-  credited_amount: UsageBillingAmountSchema,
-  refs: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
-  description: external_exports.string().optional()
-}).refine((entry) => entry.charged_units === null === (entry.charged_amount === null) && entry.credited_units === null === (entry.credited_amount === null), { message: "Each units field and its amount must be null together" });
-var USAGE_BILLING_ENTRY_TYPES = [
-  "usage_settled",
-  "top_up",
-  "adjustment",
-  "void",
-  "expiry",
-  "chargeback"
-];
-var UsageBillingEntryTypeSchema = external_exports.enum(USAGE_BILLING_ENTRY_TYPES);
-var ReadTransactionsResponseSchema = external_exports.object({
-  /**
-   * On the page rather than on each entry: an account pins one price for its
-   * whole life, so no two entries can differ.
-   */
-  currency: external_exports.string(),
-  entries: external_exports.array(UsageBillingEntrySchema),
-  has_more: external_exports.boolean(),
-  /** Absent on the last page. */
-  next_cursor: external_exports.string().min(1).optional()
-});
-var ReadUsageSummaryRequestSchema = external_exports.object({
-  /** Omit to total every category. */
-  category: external_exports.string().min(1).optional(),
-  /** Start of the window, inclusive. Omit to start at the account's first event. */
-  since: external_exports.iso.datetime().optional(),
-  /** End of the window, exclusive. Omit to run to now. */
-  until: external_exports.iso.datetime().optional()
-});
-var ReadUsageSummaryResponseSchema = external_exports.object({
-  currency: external_exports.string(),
-  usage_count: UsageBillingUnitsSchema,
-  charged_units: UsageBillingUnitsSchema,
-  /** `charged_units` in integer microdollars. `0` on an account with no usage. */
-  charged_amount: UsageBillingUnitsSchema
-});
-var GrantWelcomeCreditRequestSchema = external_exports.object({
-  product: UsageBillingProductSchema,
-  account: UsageBillingAccountSchema,
-  operator: external_exports.email().max(254)
-});
-var GrantWelcomeCreditResponseSchema = external_exports.object({
-  status: external_exports.enum(["granted", "already_granted"]),
-  grant_id: external_exports.string().min(1)
-});
-
 // ../../packages/core/dist/esm/schemas/user-settings.schema.js
 var UserAccessStateSchema = external_exports.enum(["allowed", "waiting"]);
 var UserOnboardingStateSchema = external_exports.object({
@@ -31305,6 +31392,7 @@ var connectionsEndpoints = {
   token: (id) => `${root10}/${encodeURIComponent(id)}/token`,
   dependentAutomations: (connectorId) => `${root10}/${encodeURIComponent(connectorId)}/automations`,
   create: (connectorId, capability) => `${root10}/${encodeURIComponent(connectorId)}/${encodeURIComponent(capability)}`,
+  localOAuth: (connectorId, capability) => `${root10}/${encodeURIComponent(connectorId)}/${encodeURIComponent(capability)}/local-oauth`,
   checkManifest: `${root10}/check-manifest`
 };
 
@@ -31384,6 +31472,41 @@ var ConnectionsClient = class extends BaseClient {
     });
     return CreateConnectionResponseSchema.parse(data);
   }
+  /**
+   * The authorization server endpoints and scopes for running a
+   * `connectsViaCli` connector's OAuth flow with a loopback client.
+   */
+  async getLocalOAuthSetup(args, options) {
+    const { connectorId, capability } = CreateConnectionParamsSchema.parse({
+      connectorId: IdSchema.parse(args.connectorId),
+      capability: args.capability
+    });
+    const data = await this.request({
+      method: "GET",
+      path: connectionsEndpoints.localOAuth(connectorId, capability),
+      options
+    });
+    return LocalOAuthSetupSchema.parse(data);
+  }
+  /**
+   * Stores a grant the CLI obtained with a loopback OAuth client, for a
+   * connector whose authorization server admits no hosted clients
+   * (`connectsViaCli`). The connection comes back already authorized.
+   */
+  async importLocalOAuth(args, options) {
+    const { connectorId, capability } = CreateConnectionParamsSchema.parse({
+      connectorId: IdSchema.parse(args.connectorId),
+      capability: args.capability
+    });
+    const body = ImportLocalOAuthConnectionBodySchema.parse(args.grant);
+    const data = await this.request({
+      method: "POST",
+      path: connectionsEndpoints.localOAuth(connectorId, capability),
+      body,
+      options
+    });
+    return CreateConnectionResponseSchema.parse(data);
+  }
   async checkManifest(manifest, options) {
     const parsedManifest = partialManifestSchema.parse(manifest);
     const data = await this.request({
@@ -35794,6 +35917,13 @@ async function* streamConnectorNdjsonItems(api, options, signal) {
   }
   yield { _meta: true, connectionsIncluded: options.connections };
 }
+async function findListedConnector(api, connectorId, signal) {
+  for await (const page of iterateConnectorPages(api, void 0, { signal })) {
+    const connector = page.data.find((candidate) => candidate.id === connectorId);
+    if (connector) return connector;
+  }
+  return void 0;
+}
 function findConnector2(api, connectorId, signal) {
   return findConnector(api, connectorId, { signal });
 }
@@ -35821,6 +35951,8 @@ async function runAuthorizationCommand(command, operation) {
       return operation({
         api,
         signal,
+        output: output2,
+        openBrowser: options.open,
         authorizer: new ApiConnectionAuthorizer({
           connections: api.connections,
           output: output2,
@@ -35910,17 +36042,172 @@ function summarizeAffectedAutomation(automation) {
   };
 }
 
+// src/commands/connector/local-oauth-connect.ts
+import { createDcrProvider, runOAuthFlow } from "@doist/cli-core/auth";
+var PREFERRED_CALLBACK_PORT = 24369;
+async function connectViaLocalOAuth({
+  api,
+  connector,
+  capability,
+  repairConnectionId,
+  output: output2,
+  openBrowser,
+  signal
+}) {
+  const setup = await api.connections.getLocalOAuthSetup(
+    { connectorId: connector.id, capability },
+    { signal }
+  );
+  const { registrationEndpoint } = setup;
+  if (!registrationEndpoint) {
+    throw new Error(
+      `${connector.name} does not support dynamic client registration, so the CLI cannot connect it.`
+    );
+  }
+  const grant = await runLoopbackGrant({
+    connector,
+    capability,
+    setup,
+    registrationEndpoint,
+    output: output2,
+    openBrowser,
+    signal
+  });
+  const created = await api.connections.importLocalOAuth(
+    {
+      connectorId: connector.id,
+      capability,
+      grant: {
+        clientId: grant.account.clientId,
+        accessToken: grant.bundle.accessToken,
+        refreshToken: grant.bundle.refreshToken,
+        expiresIn: expiresInSeconds(grant.bundle.accessTokenExpiresAt),
+        ...repairConnectionId ? { repairConnectionId } : {}
+      }
+    },
+    { signal }
+  );
+  output2.emit({
+    type: "connection_authorized",
+    connectionId: created.connectionId,
+    connectorId: connector.id,
+    serviceName: connector.name,
+    connectionType: capability,
+    state: "completed",
+    terminal: false
+  });
+  return created.connectionId;
+}
+async function runLoopbackGrant({
+  connector,
+  capability,
+  setup,
+  registrationEndpoint,
+  output: output2,
+  openBrowser,
+  signal
+}) {
+  const retryHint = `Try again: ${connectViaCliCommand(connector.id, capability)}`;
+  const provider = createDcrProvider({
+    registrationUrl: registrationEndpoint,
+    authorizeUrl: setup.authorizationEndpoint,
+    tokenUrl: setup.tokenEndpoint,
+    resource: setup.resource ?? void 0,
+    clientMetadata: {
+      clientName: AUTOMATIONS_CLI_CLIENT_NAME,
+      logoUri: AUTOMATIONS_CLI_LOGO_URL,
+      applicationType: "native",
+      // The backend refreshes with the client id alone, so the client
+      // must be public: no secret to copy across.
+      tokenEndpointAuthMethod: "none",
+      grantTypes: ["authorization_code", "refresh_token"]
+    },
+    // The grant is handed to the backend as-is; here the "account" only
+    // carries the client id the server bound it to.
+    validate: async ({ handshake }) => ({
+      id: connector.id,
+      label: connector.name,
+      clientId: requireClientId(handshake)
+    }),
+    errorHints: [retryHint]
+  });
+  let captured;
+  const store2 = {
+    active: async () => null,
+    set: async () => {
+    },
+    setBundle: async (account, bundle) => {
+      captured = { account, bundle };
+    },
+    clear: async () => null,
+    list: async () => [],
+    setDefault: async () => {
+    }
+  };
+  await runOAuthFlow({
+    provider,
+    store: store2,
+    scopes: setup.scopes,
+    readOnly: false,
+    flags: {},
+    preferredPort: PREFERRED_CALLBACK_PORT,
+    renderSuccess: renderAuthSuccessPage,
+    renderError: renderAuthErrorPage,
+    ...openBrowser ? {} : { openBrowser: async () => {
+    } },
+    onAuthorizeUrl: (url2) => {
+      output2.emit({
+        type: "connection_authorization_started",
+        connectorId: connector.id,
+        serviceName: connector.name,
+        connectionType: capability,
+        state: "waiting_for_user",
+        terminal: false,
+        setupKind: "oauth",
+        authorizationUrl: url2
+      });
+    },
+    timeoutMs: CONNECTION_AUTHORIZATION_TIMEOUT_MS,
+    signal
+  });
+  if (!captured) {
+    throw new Error(`${connector.name} sign-in finished without a token. ${retryHint}`);
+  }
+  return captured;
+}
+function requireClientId(handshake) {
+  const clientId = handshake.clientId;
+  if (typeof clientId !== "string" || clientId.length === 0) {
+    throw new Error("The authorization server did not return a client id.");
+  }
+  return clientId;
+}
+function expiresInSeconds(expiresAt) {
+  if (expiresAt === void 0) return void 0;
+  const seconds = Math.floor((expiresAt - Date.now()) / 1e3);
+  return seconds > 0 ? seconds : void 0;
+}
+
 // src/commands/connector/mutation-commands.ts
 function registerConnectorMutationCommands(connector) {
   connector.command("connect").description("Create a service connection and wait for authorization").argument("<connector-id>", "Connector ID").addOption(
     new Option4("--capability <capability>", "Capability to authorize").choices(["mcp", "trigger"]).makeOptionMandatory()
   ).action(async (connectorId, options, command) => {
-    await runAuthorizationCommand(command, async ({ api, authorizer, signal }) => {
+    await runAuthorizationCommand(command, async (context) => {
+      const { api, authorizer, signal } = context;
       const selected2 = await findConnector2(api, connectorId, signal);
       assertConnectorSupportsCapability(selected2, options.capability);
       if (!selected2.requiresConnection) {
         throw new Error(`${selected2.name} does not require a connection.`);
       }
+      if (selected2.connectsViaCli) {
+        const connectionId2 = await connectViaLocalOAuth({
+          ...context,
+          connector: selected2,
+          capability: options.capability
+        });
+        return { action: "connected", connectionId: connectionId2 };
+      }
       const connectionId = await authorizer.authorize(
         {
           connectorId: selected2.id,
@@ -35957,7 +36244,8 @@ function registerConnectorMutationCommands(connector) {
     });
   });
   connector.command("repair").description("Start a replacement setup for a broken or expired connection").argument("<connection-id>", "Connection ID").action(async (connectionId, _options, command) => {
-    await runAuthorizationCommand(command, async ({ api, authorizer, signal }) => {
+    await runAuthorizationCommand(command, async (context) => {
+      const { api, authorizer, signal } = context;
       const connection = await api.connections.get(connectionId, { signal });
       if (connection.status === "authorized") {
         throw new Error(`Connection ${connectionId} is already authorized.`);
@@ -35971,7 +36259,19 @@ function registerConnectorMutationCommands(connector) {
         await authorizer.resume(request2, connection.id, connection.setup, signal);
         return { action: "connected", connectionId };
       }
-      const affectedAutomations = await findAffectedAutomations(api, connectionId, signal);
+      const [selected2, affectedAutomations] = await Promise.all([
+        findListedConnector(api, connection.connectorId, signal),
+        findAffectedAutomations(api, connectionId, signal)
+      ]);
+      if (selected2?.connectsViaCli) {
+        const repairedConnectionId2 = await connectViaLocalOAuth({
+          ...context,
+          connector: selected2,
+          capability: request2.connectionType,
+          repairConnectionId: connection.id
+        });
+        return { action: "connected", connectionId: repairedConnectionId2 };
+      }
       const repairedConnectionId = await authorizer.authorize(
         {
           ...request2,