@doist/automations-cli 1.17.1 → 1.18.0

package/dist/index.js

@@ -6899,7 +6899,7 @@ import { fileURLToPath } from "node:url";
 // package.json
 var package_default = {
   name: "@doist/automations-cli",
-  version: "1.17.1",
+  version: "1.18.0",
   description: "Command-line client for Todoist Automations",
   type: "module",
   bin: {
@@ -6953,13 +6953,13 @@ var package_default = {
   devDependencies: {
     "@doist/automations-core": "*",
     "@doist/automations-sdk": "*",
-    "@types/node": "24.13.6",
+    "@types/node": "24.19.1",
     "conventional-changelog-conventionalcommits": "9.3.1",
     esbuild: "0.28.2",
     "semantic-release": "25.0.9",
     "semantic-release-monorepo": "8.0.2",
     typescript: "6.0.3",
-    vitest: "4.1.11"
+    vitest: "5.0.3"
   },
   engines: {
     node: ">=24"
@@ -7037,6 +7037,10 @@ var API_SCOPES = {
 };
 var API_SCOPE_CODES = Object.keys(API_SCOPES);
 
+// ../../packages/core/dist/esm/constants/cli-client.constants.js
+var AUTOMATIONS_CLI_CLIENT_NAME = "Todoist Automations CLI";
+var AUTOMATIONS_CLI_LOGO_URL = "https://todoist.b-cdn.net/agentist-icons/service_automations-cli_color_192px.png";
+
 // ../../packages/core/dist/esm/constants/connection.constants.js
 var CONNECTION_STATUSES = ["pending", "authorized", "expired", "error"];
 var CONNECTION_TYPES = ["mcp", "trigger", "api"];
@@ -7124,71 +7128,98 @@ var MODEL_CATALOG = {
   "gemini-2.5-flash-lite": {
     provider: "gemini",
     family: "2.5",
-    providerModelId: "gemini-2.5-flash-lite"
+    providerModelId: "gemini-2.5-flash-lite",
+    manifestSelectable: true
   },
   "gemini-2.5-flash": {
     provider: "gemini",
     family: "2.5",
-    providerModelId: "gemini-2.5-flash"
+    providerModelId: "gemini-2.5-flash",
+    manifestSelectable: true
   },
   "gemini-3.1-pro": {
     provider: "gemini",
     family: "3",
-    providerModelId: "gemini-3.1-pro-preview"
+    providerModelId: "gemini-3.1-pro-preview",
+    manifestSelectable: true
   },
   "gemini-3.8-flash": {
     provider: "gemini",
     family: "3",
-    providerModelId: "gemini-3.8-flash"
+    providerModelId: "gemini-3.8-flash",
+    manifestSelectable: true
   },
   "claude-opus-4-6": {
     provider: "anthropic",
     family: "4.6",
-    providerModelId: "claude-opus-4-6"
+    providerModelId: "claude-opus-4-6",
+    manifestSelectable: true
   },
   "claude-sonnet-5": {
     provider: "anthropic",
     family: "5",
-    providerModelId: "claude-sonnet-5"
+    providerModelId: "claude-sonnet-5",
+    manifestSelectable: true
+  },
+  "claude-sonnet-5-5": {
+    provider: "anthropic",
+    family: "5",
+    providerModelId: "claude-sonnet-5-5",
+    manifestSelectable: false
+  },
+  "claude-haiku-5-5": {
+    provider: "anthropic",
+    family: "5",
+    providerModelId: "claude-haiku-5-5",
+    manifestSelectable: false
   },
   "claude-sonnet-4-6": {
     provider: "anthropic",
     family: "4.6",
-    providerModelId: "claude-sonnet-4-6"
+    providerModelId: "claude-sonnet-4-6",
+    manifestSelectable: true
   },
   "claude-haiku-4-5": {
     provider: "anthropic",
     family: "4.5",
-    providerModelId: "claude-haiku-4-5"
+    providerModelId: "claude-haiku-4-5",
+    manifestSelectable: true
   },
   "deepseek-v4-flash": {
     provider: "openrouter",
     family: "deepseek",
-    providerModelId: "deepseek/deepseek-v4-flash-0731"
+    providerModelId: "deepseek/deepseek-v4-flash-0731",
+    manifestSelectable: true
   },
   "deepseek-v4-pro": {
     provider: "openrouter",
     family: "deepseek",
-    providerModelId: "deepseek/deepseek-v4-pro"
+    providerModelId: "deepseek/deepseek-v4-pro",
+    manifestSelectable: true
   },
   "mimo-v2.5": {
     provider: "openrouter",
     family: "mimo",
-    providerModelId: "xiaomi/mimo-v2.5"
+    providerModelId: "xiaomi/mimo-v2.5",
+    manifestSelectable: true
   },
   "mimo-v2.5-pro": {
     provider: "openrouter",
     family: "mimo",
-    providerModelId: "xiaomi/mimo-v2.5-pro"
+    providerModelId: "xiaomi/mimo-v2.5-pro",
+    manifestSelectable: true
   },
   "glm-5.2": {
     provider: "openrouter",
     family: "glm",
-    providerModelId: "z-ai/glm-5.2"
+    providerModelId: "z-ai/glm-5.2",
+    manifestSelectable: true
   }
 };
 var SUPPORTED_LLM_MODELS = Object.keys(MODEL_CATALOG);
 var SUPPORTED_SEARCH_MODELS = SUPPORTED_LLM_MODELS.filter(supportsWebSearch);
+var MANIFEST_LLM_MODELS = SUPPORTED_LLM_MODELS.filter((modelId) => MODEL_CATALOG[modelId].manifestSelectable);
+var MANIFEST_SEARCH_MODELS = MANIFEST_LLM_MODELS.filter((modelId) => supportsWebSearch(modelId));
 function supportsWebSearch(modelId) {
   const { provider } = MODEL_CATALOG[modelId];
   return provider === "gemini" || provider === "anthropic";
@@ -27675,7 +27706,12 @@ var ConnectorSchema = external_exports.object({
    * connection types — one onboarding covers both action and trigger uses.
    * The FE collapses per-type rows into a single account when this is true.
    */
-  isManaged: external_exports.boolean().optional()
+  isManaged: external_exports.boolean().optional(),
+  /**
+   * The service only admits loopback OAuth clients, so account setup runs in
+   * the Automations CLI on the user's machine instead of the web app.
+   */
+  connectsViaCli: external_exports.boolean().optional()
 });
 var GetConnectorsQuerySchema = external_exports.object({
   query: external_exports.string().optional()
@@ -27701,6 +27737,11 @@ var connectorListResponseSchema = external_exports.object({
   nextCursor: external_exports.string().nullable()
 });
 
+// ../../packages/core/dist/esm/utils/cli-command.js
+function connectViaCliCommand(connectorId, capability) {
+  return `tda connector connect ${connectorId} --capability ${capability}`;
+}
+
 // ../../packages/core/dist/esm/utils/duration.js
 var durationUnits = ["ms", "s", "m", "h", "d", "w"];
 var createDurationPattern = (units) => units.join("|");
@@ -28068,7 +28109,7 @@ var baseStepSchema = external_exports.object({
   })
 });
 var MODEL_TIERS = ["lite", "flash", "pro"];
-var SUPPORTED_MODEL_REFERENCES = [...MODEL_TIERS, ...SUPPORTED_LLM_MODELS];
+var SUPPORTED_MODEL_REFERENCES = [...MODEL_TIERS, ...MANIFEST_LLM_MODELS];
 var modelReferenceSchema = external_exports.enum(SUPPORTED_MODEL_REFERENCES).meta({
   description: "A stable model tier (lite, flash, pro) or a supported literal model override."
 });
@@ -28124,7 +28165,7 @@ var searchStepSchema = baseStepSchema.merge(external_exports.object({
     description: "The search prompt to execute using web search."
   }),
   outputSchema: searchStepOutputSchema,
-  model: external_exports.enum([...MODEL_TIERS, ...SUPPORTED_SEARCH_MODELS]).optional().meta({
+  model: external_exports.enum([...MODEL_TIERS, ...MANIFEST_SEARCH_MODELS]).optional().meta({
     description: "A stable tier (lite, flash, pro) or a supported search-enabled literal model override."
   })
 }));
@@ -28753,6 +28794,29 @@ var CreateConnectionParamsSchema = external_exports.object({
 var CreateConnectionBodySchema = external_exports.object({
   automationIds: external_exports.array(external_exports.uuid()).optional()
 });
+var ImportLocalOAuthConnectionBodySchema = external_exports.object({
+  /** The public client the CLI registered; the server bound the grant to it. */
+  clientId: external_exports.string().min(1),
+  accessToken: external_exports.string().min(1),
+  refreshToken: external_exports.string().min(1).optional(),
+  /** Seconds until `accessToken` expires, as the token endpoint reported it. */
+  expiresIn: external_exports.number().int().positive().optional(),
+  /**
+   * A broken connection of the caller's, for the same connector, whose
+   * automation bindings move to the new grant when the account cannot be
+   * matched to it.
+   */
+  repairConnectionId: external_exports.uuid().optional()
+});
+var LocalOAuthSetupSchema = external_exports.object({
+  /** RFC 7591 registration endpoint; null when the server offers none. */
+  registrationEndpoint: external_exports.string().url().nullable(),
+  authorizationEndpoint: external_exports.string().url(),
+  tokenEndpoint: external_exports.string().url(),
+  /** RFC 8707 resource indicator for the MCP server, when it advertises one. */
+  resource: external_exports.string().url().nullable(),
+  scopes: external_exports.array(external_exports.string())
+});
 var OAuthConnectionSetupSchema = external_exports.object({
   kind: external_exports.literal("oauth"),
   authorizationUrl: external_exports.string().url()
@@ -29572,7 +29636,9 @@ var FRONTEND_COHORT_EVENTS = [
   "chat:sent",
   "automation:repaired",
   "template:used",
-  "top-up:completed"
+  "top-up:completed",
+  "guided-creation:started",
+  "guided-creation:completed"
 ];
 var BACKEND_COHORT_EVENTS = [
   // API-process (publish lifecycle)
@@ -31326,6 +31392,7 @@ var connectionsEndpoints = {
   token: (id) => `${root10}/${encodeURIComponent(id)}/token`,
   dependentAutomations: (connectorId) => `${root10}/${encodeURIComponent(connectorId)}/automations`,
   create: (connectorId, capability) => `${root10}/${encodeURIComponent(connectorId)}/${encodeURIComponent(capability)}`,
+  localOAuth: (connectorId, capability) => `${root10}/${encodeURIComponent(connectorId)}/${encodeURIComponent(capability)}/local-oauth`,
   checkManifest: `${root10}/check-manifest`
 };
 
@@ -31405,6 +31472,41 @@ var ConnectionsClient = class extends BaseClient {
     });
     return CreateConnectionResponseSchema.parse(data);
   }
+  /**
+   * The authorization server endpoints and scopes for running a
+   * `connectsViaCli` connector's OAuth flow with a loopback client.
+   */
+  async getLocalOAuthSetup(args, options) {
+    const { connectorId, capability } = CreateConnectionParamsSchema.parse({
+      connectorId: IdSchema.parse(args.connectorId),
+      capability: args.capability
+    });
+    const data = await this.request({
+      method: "GET",
+      path: connectionsEndpoints.localOAuth(connectorId, capability),
+      options
+    });
+    return LocalOAuthSetupSchema.parse(data);
+  }
+  /**
+   * Stores a grant the CLI obtained with a loopback OAuth client, for a
+   * connector whose authorization server admits no hosted clients
+   * (`connectsViaCli`). The connection comes back already authorized.
+   */
+  async importLocalOAuth(args, options) {
+    const { connectorId, capability } = CreateConnectionParamsSchema.parse({
+      connectorId: IdSchema.parse(args.connectorId),
+      capability: args.capability
+    });
+    const body = ImportLocalOAuthConnectionBodySchema.parse(args.grant);
+    const data = await this.request({
+      method: "POST",
+      path: connectionsEndpoints.localOAuth(connectorId, capability),
+      body,
+      options
+    });
+    return CreateConnectionResponseSchema.parse(data);
+  }
   async checkManifest(manifest, options) {
     const parsedManifest = partialManifestSchema.parse(manifest);
     const data = await this.request({
@@ -35815,6 +35917,13 @@ async function* streamConnectorNdjsonItems(api, options, signal) {
   }
   yield { _meta: true, connectionsIncluded: options.connections };
 }
+async function findListedConnector(api, connectorId, signal) {
+  for await (const page of iterateConnectorPages(api, void 0, { signal })) {
+    const connector = page.data.find((candidate) => candidate.id === connectorId);
+    if (connector) return connector;
+  }
+  return void 0;
+}
 function findConnector2(api, connectorId, signal) {
   return findConnector(api, connectorId, { signal });
 }
@@ -35842,6 +35951,8 @@ async function runAuthorizationCommand(command, operation) {
       return operation({
         api,
         signal,
+        output: output2,
+        openBrowser: options.open,
         authorizer: new ApiConnectionAuthorizer({
           connections: api.connections,
           output: output2,
@@ -35931,17 +36042,172 @@ function summarizeAffectedAutomation(automation) {
   };
 }
 
+// src/commands/connector/local-oauth-connect.ts
+import { createDcrProvider, runOAuthFlow } from "@doist/cli-core/auth";
+var PREFERRED_CALLBACK_PORT = 24369;
+async function connectViaLocalOAuth({
+  api,
+  connector,
+  capability,
+  repairConnectionId,
+  output: output2,
+  openBrowser,
+  signal
+}) {
+  const setup = await api.connections.getLocalOAuthSetup(
+    { connectorId: connector.id, capability },
+    { signal }
+  );
+  const { registrationEndpoint } = setup;
+  if (!registrationEndpoint) {
+    throw new Error(
+      `${connector.name} does not support dynamic client registration, so the CLI cannot connect it.`
+    );
+  }
+  const grant = await runLoopbackGrant({
+    connector,
+    capability,
+    setup,
+    registrationEndpoint,
+    output: output2,
+    openBrowser,
+    signal
+  });
+  const created = await api.connections.importLocalOAuth(
+    {
+      connectorId: connector.id,
+      capability,
+      grant: {
+        clientId: grant.account.clientId,
+        accessToken: grant.bundle.accessToken,
+        refreshToken: grant.bundle.refreshToken,
+        expiresIn: expiresInSeconds(grant.bundle.accessTokenExpiresAt),
+        ...repairConnectionId ? { repairConnectionId } : {}
+      }
+    },
+    { signal }
+  );
+  output2.emit({
+    type: "connection_authorized",
+    connectionId: created.connectionId,
+    connectorId: connector.id,
+    serviceName: connector.name,
+    connectionType: capability,
+    state: "completed",
+    terminal: false
+  });
+  return created.connectionId;
+}
+async function runLoopbackGrant({
+  connector,
+  capability,
+  setup,
+  registrationEndpoint,
+  output: output2,
+  openBrowser,
+  signal
+}) {
+  const retryHint = `Try again: ${connectViaCliCommand(connector.id, capability)}`;
+  const provider = createDcrProvider({
+    registrationUrl: registrationEndpoint,
+    authorizeUrl: setup.authorizationEndpoint,
+    tokenUrl: setup.tokenEndpoint,
+    resource: setup.resource ?? void 0,
+    clientMetadata: {
+      clientName: AUTOMATIONS_CLI_CLIENT_NAME,
+      logoUri: AUTOMATIONS_CLI_LOGO_URL,
+      applicationType: "native",
+      // The backend refreshes with the client id alone, so the client
+      // must be public: no secret to copy across.
+      tokenEndpointAuthMethod: "none",
+      grantTypes: ["authorization_code", "refresh_token"]
+    },
+    // The grant is handed to the backend as-is; here the "account" only
+    // carries the client id the server bound it to.
+    validate: async ({ handshake }) => ({
+      id: connector.id,
+      label: connector.name,
+      clientId: requireClientId(handshake)
+    }),
+    errorHints: [retryHint]
+  });
+  let captured;
+  const store2 = {
+    active: async () => null,
+    set: async () => {
+    },
+    setBundle: async (account, bundle) => {
+      captured = { account, bundle };
+    },
+    clear: async () => null,
+    list: async () => [],
+    setDefault: async () => {
+    }
+  };
+  await runOAuthFlow({
+    provider,
+    store: store2,
+    scopes: setup.scopes,
+    readOnly: false,
+    flags: {},
+    preferredPort: PREFERRED_CALLBACK_PORT,
+    renderSuccess: renderAuthSuccessPage,
+    renderError: renderAuthErrorPage,
+    ...openBrowser ? {} : { openBrowser: async () => {
+    } },
+    onAuthorizeUrl: (url2) => {
+      output2.emit({
+        type: "connection_authorization_started",
+        connectorId: connector.id,
+        serviceName: connector.name,
+        connectionType: capability,
+        state: "waiting_for_user",
+        terminal: false,
+        setupKind: "oauth",
+        authorizationUrl: url2
+      });
+    },
+    timeoutMs: CONNECTION_AUTHORIZATION_TIMEOUT_MS,
+    signal
+  });
+  if (!captured) {
+    throw new Error(`${connector.name} sign-in finished without a token. ${retryHint}`);
+  }
+  return captured;
+}
+function requireClientId(handshake) {
+  const clientId = handshake.clientId;
+  if (typeof clientId !== "string" || clientId.length === 0) {
+    throw new Error("The authorization server did not return a client id.");
+  }
+  return clientId;
+}
+function expiresInSeconds(expiresAt) {
+  if (expiresAt === void 0) return void 0;
+  const seconds = Math.floor((expiresAt - Date.now()) / 1e3);
+  return seconds > 0 ? seconds : void 0;
+}
+
 // src/commands/connector/mutation-commands.ts
 function registerConnectorMutationCommands(connector) {
   connector.command("connect").description("Create a service connection and wait for authorization").argument("<connector-id>", "Connector ID").addOption(
     new Option4("--capability <capability>", "Capability to authorize").choices(["mcp", "trigger"]).makeOptionMandatory()
   ).action(async (connectorId, options, command) => {
-    await runAuthorizationCommand(command, async ({ api, authorizer, signal }) => {
+    await runAuthorizationCommand(command, async (context) => {
+      const { api, authorizer, signal } = context;
       const selected2 = await findConnector2(api, connectorId, signal);
       assertConnectorSupportsCapability(selected2, options.capability);
       if (!selected2.requiresConnection) {
         throw new Error(`${selected2.name} does not require a connection.`);
       }
+      if (selected2.connectsViaCli) {
+        const connectionId2 = await connectViaLocalOAuth({
+          ...context,
+          connector: selected2,
+          capability: options.capability
+        });
+        return { action: "connected", connectionId: connectionId2 };
+      }
       const connectionId = await authorizer.authorize(
         {
           connectorId: selected2.id,
@@ -35978,7 +36244,8 @@ function registerConnectorMutationCommands(connector) {
     });
   });
   connector.command("repair").description("Start a replacement setup for a broken or expired connection").argument("<connection-id>", "Connection ID").action(async (connectionId, _options, command) => {
-    await runAuthorizationCommand(command, async ({ api, authorizer, signal }) => {
+    await runAuthorizationCommand(command, async (context) => {
+      const { api, authorizer, signal } = context;
       const connection = await api.connections.get(connectionId, { signal });
       if (connection.status === "authorized") {
         throw new Error(`Connection ${connectionId} is already authorized.`);
@@ -35992,7 +36259,19 @@ function registerConnectorMutationCommands(connector) {
         await authorizer.resume(request2, connection.id, connection.setup, signal);
         return { action: "connected", connectionId };
       }
-      const affectedAutomations = await findAffectedAutomations(api, connectionId, signal);
+      const [selected2, affectedAutomations] = await Promise.all([
+        findListedConnector(api, connection.connectorId, signal),
+        findAffectedAutomations(api, connectionId, signal)
+      ]);
+      if (selected2?.connectsViaCli) {
+        const repairedConnectionId2 = await connectViaLocalOAuth({
+          ...context,
+          connector: selected2,
+          capability: request2.connectionType,
+          repairConnectionId: connection.id
+        });
+        return { action: "connected", connectionId: repairedConnectionId2 };
+      }
       const repairedConnectionId = await authorizer.authorize(
         {
           ...request2,