@zapier/zapier-sdk-cli 0.59.3 → 0.61.0

package/dist/cli.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { Command, CommanderError, Option } from 'commander';
 import { z } from 'zod';
-import { definePlugin, createPluginMethod, OutputPropertySchema, ZapierBundleError, DEFAULT_CONFIG_PATH, ZapierValidationError, ZapierUnknownError, ZapierReleaseTriggerMessageSignal, injectCliLogin, BaseSdkOptionsSchema, getOrCreateApiClient, isPermanentHttpError, invalidateCachedToken, batch, toSnakeCase, ZapierAbortDrainSignal, createZapierSdkStack as createZapierSdkStack$1, createSdk as createSdk$1, defineLegacyMerge as defineLegacyMerge$1, zapierSdkPlugin as zapierSdkPlugin$1, addPlugin as addPlugin$1, ZapierError, isCredentialsObject, buildApplicationLifecycleEvent, AuthMechanism, ZapierAuthenticationError, runWithCallerContext, isPositional, runWithTelemetryContext, buildCapabilityMessage, formatErrorMessage, getOsInfo, getPlatformVersions, getAgent, getTtyContext, getCiPlatform, isCi, getReleaseId, getCurrentTimestamp, generateEventId, ZapierApprovalError } from '@zapier/zapier-sdk';
+import { definePlugin, createPluginMethod, OutputPropertySchema, ZapierBundleError, DEFAULT_CONFIG_PATH, ZapierValidationError, ZapierUnknownError, ZapierReleaseTriggerMessageSignal, injectCliLogin, BaseSdkOptionsSchema, getOrCreateApiClient, isPermanentHttpError, invalidateCachedToken, batch, toSnakeCase, ZapierAbortDrainSignal, createZapierSdkStack as createZapierSdkStack$1, createSdk as createSdk$1, defineLegacyMerge as defineLegacyMerge$1, zapierSdkPlugin as zapierSdkPlugin$1, addPlugin as addPlugin$1, ZapierError, isCredentialsObject, buildApplicationLifecycleEvent, AuthMechanism, ZapierAuthenticationError, DEPRECATION_NOTICE_EVENT, runWithCallerContext, isPositional, runWithTelemetryContext, buildCapabilityMessage, formatErrorMessage, getOsInfo, getPlatformVersions, getAgent, getTtyContext, getCiPlatform, isCi, getReleaseId, getCurrentTimestamp, generateEventId, ZapierApprovalError } from '@zapier/zapier-sdk';
 import inquirer from 'inquirer';
 import search from '@inquirer/search';
 import chalk from 'chalk';
@@ -59,12 +59,18 @@ var ZapierCliExitError = class extends ZapierCliError {
     this.exitCode = exitCode;
   }
 };
-var ZapierCliValidationError = class extends ZapierCliError {
-  constructor(message) {
+var ZapierCliValidationError = class _ZapierCliValidationError extends ZapierCliError {
+  constructor(message, options = {}) {
     super(message);
-    this.name = "ZapierCliValidationError";
-    this.code = "ZAPIER_CLI_VALIDATION_ERROR";
     this.exitCode = 1;
+    this.name = options.name ?? "ZapierCliValidationError";
+    this.code = options.code ?? "ZAPIER_CLI_VALIDATION_ERROR";
+  }
+  withMessage(message) {
+    return new _ZapierCliValidationError(message, {
+      name: this.name,
+      code: this.code
+    });
   }
 };
 var ZapierCliMissingParametersError = class extends ZapierCliError {
@@ -1536,7 +1542,7 @@ var SHARED_COMMAND_CLI_OPTIONS = [
 
 // package.json
 var package_default = {
-  version: "0.59.3"};
+  version: "0.61.0"};
 
 // src/telemetry/builders.ts
 function createCliBaseEvent(context = {}) {
@@ -3722,41 +3728,165 @@ var spinPromise = async (promise, text) => {
   }
 };
 
+// src/utils/auth/oauth-errors.ts
+var OauthFlowTimeoutError = class _OauthFlowTimeoutError extends ZapierCliValidationError {
+  constructor({
+    timeoutMs,
+    message = "OAuth flow timed out"
+  }) {
+    super(message, {
+      name: "OauthFlowTimeoutError",
+      code: "ZAPIER_OAUTH_FLOW_TIMEOUT"
+    });
+    this.timeoutMs = timeoutMs;
+  }
+  withMessage(message) {
+    return new _OauthFlowTimeoutError({ timeoutMs: this.timeoutMs, message });
+  }
+};
+var OauthAuthorizationDeniedError = class _OauthAuthorizationDeniedError extends ZapierCliValidationError {
+  constructor({
+    reason,
+    message = "OAuth authorization denied"
+  }) {
+    super(message, {
+      name: "OauthAuthorizationDeniedError",
+      code: "ZAPIER_OAUTH_AUTHORIZATION_DENIED"
+    });
+    this.reason = reason;
+  }
+  withMessage(message) {
+    return new _OauthAuthorizationDeniedError({
+      reason: this.reason,
+      message
+    });
+  }
+};
+var OauthFlowError = class _OauthFlowError extends ZapierCliValidationError {
+  constructor({ message }) {
+    super(message, {
+      name: "OauthFlowError",
+      code: "ZAPIER_OAUTH_FLOW"
+    });
+  }
+  withMessage(message) {
+    return new _OauthFlowError({ message });
+  }
+};
+var OauthCallbackError = class _OauthCallbackError extends ZapierCliValidationError {
+  constructor({ kind, message }) {
+    super(message, {
+      name: "OauthCallbackError",
+      code: "ZAPIER_OAUTH_CALLBACK"
+    });
+    this.kind = kind;
+  }
+  withMessage(message) {
+    return new _OauthCallbackError({ kind: this.kind, message });
+  }
+};
+var OauthTokenExchangeError = class _OauthTokenExchangeError extends ZapierCliValidationError {
+  constructor({ message }) {
+    super(message, {
+      name: "OauthTokenExchangeError",
+      code: "ZAPIER_OAUTH_TOKEN_EXCHANGE"
+    });
+  }
+  withMessage(message) {
+    return new _OauthTokenExchangeError({ message });
+  }
+};
+var SENSITIVE_OAUTH_FIELDS = [
+  "access_token",
+  "refresh_token",
+  "id_token",
+  "client_secret",
+  "code_verifier",
+  "code_challenge"
+];
+function getErrorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function toCamelCase(field) {
+  return field.replace(
+    /_([a-z])/g,
+    (_match, letter) => letter.toUpperCase()
+  );
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var sensitiveOauthFieldPattern = Array.from(
+  new Set(
+    SENSITIVE_OAUTH_FIELDS.flatMap((field) => [field, toCamelCase(field)])
+  )
+).map(escapeRegExp).join("|");
+var sensitiveQueryParamPattern = new RegExp(
+  `([?&])(${sensitiveOauthFieldPattern})(=)[^&#\\s"'<>]*`,
+  "gi"
+);
+function redactSensitiveOauthErrorMessage(message) {
+  return message.replace(
+    sensitiveQueryParamPattern,
+    (_match, prefix, key, separator) => `${prefix}${key}${separator}[REDACTED]`
+  ).replace(
+    new RegExp(`"(${sensitiveOauthFieldPattern})"(\\s*:\\s*)"[^"]*"`, "g"),
+    (_match, key, separator) => `"${key}"${separator}"[REDACTED]"`
+  );
+}
+function toRedactedOauthError(error) {
+  const message = redactSensitiveOauthErrorMessage(getErrorMessage(error));
+  if (error instanceof ZapierCliValidationError) {
+    return error.withMessage(message);
+  }
+  return new OauthFlowError({ message });
+}
+function toOauthTokenExchangeError(error) {
+  return new OauthTokenExchangeError({
+    message: redactSensitiveOauthErrorMessage(getErrorMessage(error))
+  });
+}
+
 // src/utils/auth/oauth-callback.ts
 function getCallbackCode({
   callbackUrl,
-  transaction,
-  recoveryMessage
+  transaction
 }) {
   let parsed;
   try {
     parsed = new URL(callbackUrl.trim());
   } catch {
-    throw new ZapierCliValidationError(
-      "Paste the final OAuth callback URL from your browser."
-    );
+    throw new OauthCallbackError({
+      kind: "invalid_url",
+      message: "Paste the final OAuth callback URL from your browser."
+    });
   }
   const expected = new URL(transaction.redirectUri);
   if (parsed.protocol !== "http:" || parsed.hostname !== expected.hostname || parsed.pathname !== expected.pathname || parsed.port !== expected.port) {
-    throw new ZapierCliValidationError(
-      `Expected the final OAuth callback URL to start with ${transaction.redirectUri}.`
-    );
+    throw new OauthCallbackError({
+      kind: "redirect_mismatch",
+      message: `Expected the final OAuth callback URL to start with ${transaction.redirectUri}.`
+    });
   }
   if (parsed.searchParams.get("state") !== transaction.state) {
-    throw new ZapierCliValidationError(
-      `OAuth state mismatch.${recoveryMessage ? ` ${recoveryMessage}` : ""}`
-    );
+    throw new OauthCallbackError({
+      kind: "state_mismatch",
+      message: "OAuth state mismatch."
+    });
   }
   if (parsed.searchParams.has("error")) {
-    throw new ZapierCliValidationError(
-      `Authorization denied: ${parsed.searchParams.get("error_description") ?? parsed.searchParams.get("error")}.${recoveryMessage ? ` ${recoveryMessage}` : ""}`
-    );
+    throw new OauthAuthorizationDeniedError({
+      reason: String(
+        parsed.searchParams.get("error_description") ?? parsed.searchParams.get("error")
+      )
+    });
   }
   const code = parsed.searchParams.get("code");
   if (!code) {
-    throw new ZapierCliValidationError(
-      "No authorization code found in the pasted callback URL."
-    );
+    throw new OauthCallbackError({
+      kind: "missing_code",
+      message: "No authorization code found in the pasted callback URL."
+    });
   }
   return code;
 }
@@ -3871,7 +4001,9 @@ async function exchangeOauthCode({
         "Content-Type": "application/x-www-form-urlencoded"
       }
     }
-  );
+  ).catch((error) => {
+    throw toOauthTokenExchangeError(error);
+  });
   return {
     accessToken: data.access_token,
     refreshToken: data.refresh_token,
@@ -3880,19 +4012,15 @@ async function exchangeOauthCode({
 }
 
 // src/utils/auth/oauth-flow.ts
-var OauthFlowTimeoutError = class extends Error {
-  constructor(timeoutMs) {
-    super("OAuth flow timed out");
-    this.timeoutMs = timeoutMs;
-    this.name = "OauthFlowTimeoutError";
-  }
+var LOGIN_OAUTH_COPY = {
+  flowName: "Login",
+  action: "log in",
+  urlLabel: "login URL"
 };
-var OauthAuthorizationDeniedError = class extends Error {
-  constructor(reason) {
-    super("OAuth authorization denied");
-    this.reason = reason;
-    this.name = "OauthAuthorizationDeniedError";
-  }
+var SIGNUP_OAUTH_COPY = {
+  flowName: "Signup",
+  action: "sign up",
+  urlLabel: "signup URL"
 };
 function findAvailablePort() {
   return new Promise((resolve4, reject) => {
@@ -3907,70 +4035,86 @@ function findAvailablePort() {
           tryPort(LOGIN_PORTS[portIndex++]);
         } else if (err.code === "EADDRINUSE") {
           reject(
-            new Error(
-              `All configured OAuth callback ports are busy: ${LOGIN_PORTS.join(", ")}. Please try again later or close applications using these ports.`
-            )
+            new OauthFlowError({
+              message: `All configured OAuth callback ports are busy: ${LOGIN_PORTS.join(", ")}. Please try again later or close applications using these ports.`
+            })
           );
         } else {
           reject(err);
         }
       });
     };
-    if (LOGIN_PORTS.length > 0) tryPort(LOGIN_PORTS[portIndex++]);
-    else reject(new Error("No OAuth callback ports configured"));
+    if (LOGIN_PORTS.length > 0) {
+      tryPort(LOGIN_PORTS[portIndex++]);
+      return;
+    }
+    reject(
+      new OauthFlowError({ message: "No OAuth callback ports configured" })
+    );
   });
 }
 async function runLoginOauthFlow(options) {
-  return runOauthFlowEntryPoint({
-    ...options,
+  return runOauthFlowForEntryPoint({
+    options,
     entryPoint: "login",
-    authAction: "log in",
-    flowName: "Login"
+    copy: LOGIN_OAUTH_COPY
   });
 }
 async function runSignupOauthFlow(options) {
+  return runOauthFlowForEntryPoint({
+    options,
+    entryPoint: "signup",
+    copy: SIGNUP_OAUTH_COPY
+  });
+}
+function runOauthFlowForEntryPoint({
+  options,
+  entryPoint,
+  copy
+}) {
   if (options.headless) {
     return runOauthFlowEntryPoint({
       ...options,
-      entryPoint: "signup",
-      authAction: "sign up",
-      flowName: "Signup",
-      headless: true
+      entryPoint,
+      headless: true,
+      copy
     });
   }
   return runOauthFlowEntryPoint({
     ...options,
-    entryPoint: "signup",
-    authAction: "sign up",
-    flowName: "Signup"
+    entryPoint,
+    copy,
+    headless: false
   });
 }
-async function runOauthFlowEntryPoint({
-  flowName,
-  ...options
-}) {
+async function runOauthFlowEntryPoint(options) {
   try {
-    return options.headless ? await runHeadlessSignupOauthFlow(options) : await runOauthFlow(options);
+    return options.headless ? await runHeadlessOauthFlow(options) : await runOauthFlow(options);
   } catch (error) {
     if (error instanceof OauthFlowTimeoutError) {
-      throw new Error(
+      throw error.withMessage(
         withRecoveryMessage(
-          `${flowName} timed out after ${Math.round(error.timeoutMs / 1e3)} seconds.`,
+          `${options.copy.flowName} timed out after ${Math.round(error.timeoutMs / 1e3)} seconds.`,
           options.recoveryMessage
         )
       );
     }
     if (error instanceof OauthAuthorizationDeniedError) {
-      throw new Error(
+      throw error.withMessage(
         withRecoveryMessage(
           `Authorization denied: ${error.reason}.`,
           options.recoveryMessage
         )
       );
     }
+    if (error instanceof OauthCallbackError && options.recoveryMessage) {
+      throw error.withMessage(
+        withRecoveryMessage(error.message, options.recoveryMessage)
+      );
+    }
     if (error instanceof ZapierCliUserCancellationError && !options.silent) {
       log_default.info(`
-\u274C ${flowName} cancelled by user`);
+\u274C ${options.copy.flowName} cancelled by user`);
     }
     throw error;
   }
@@ -3978,12 +4122,22 @@ async function runOauthFlowEntryPoint({
 function withRecoveryMessage(message, recoveryMessage) {
   return recoveryMessage ? `${message} ${recoveryMessage}` : message;
 }
+function createMissingHeadlessCallbackUrlError() {
+  return new OauthCallbackError({
+    kind: "missing_callback_url",
+    message: "Paste the final OAuth callback URL from your browser."
+  });
+}
+function writeHeadlessOauthStatus(message) {
+  process.stderr.write(`${message}
+`);
+}
 async function runOauthFlow({
   timeoutMs = LOGIN_TIMEOUT_MS,
   pkceCredentials,
   baseUrl: baseUrl2,
   entryPoint,
-  authAction,
+  copy,
   silent = false,
   onProgress
 }) {
@@ -3998,7 +4152,7 @@ async function runOauthFlow({
   const code = await collectLocalCallbackCode({
     transaction,
     timeoutMs,
-    authAction,
+    action: copy.action,
     silent,
     onProgress
   });
@@ -4012,92 +4166,104 @@ async function runOauthFlow({
 }
 async function readHeadlessCallbackUrl({
   timeoutMs,
-  interactive,
-  recoveryMessage
+  interactive
 }) {
-  const timeoutMessage = withRecoveryMessage(
-    `Signup timed out after ${Math.round(timeoutMs / 1e3)} seconds.`,
-    recoveryMessage
-  );
-  const missingCallbackUrlMessage = withRecoveryMessage(
-    "Paste the final OAuth callback URL from your browser.",
-    recoveryMessage
-  );
   const rl = createInterface({ input: process.stdin, output: process.stderr });
   const abortController = new AbortController();
   const timeoutTimer = setTimeout(() => abortController.abort(), timeoutMs);
-  const readUrl = interactive ? rl.question("Paste the final OAuth callback URL: ", {
-    signal: abortController.signal
-  }) : new Promise((resolve4, reject) => {
+  const readUrl = new Promise((resolve4, reject) => {
     let settled = false;
-    const settleResolve = (value) => {
+    const handleLine = (value) => settleResolve(value);
+    const handleAbort = () => settleReject(new OauthFlowTimeoutError({ timeoutMs }));
+    const handleClose = () => settleReject(createMissingHeadlessCallbackUrlError());
+    const handleError = (error) => settleReject(error);
+    const handleCancellation = () => settleReject(new ZapierCliUserCancellationError());
+    const cleanupListeners = () => {
+      abortController.signal.removeEventListener("abort", handleAbort);
+      rl.off("line", handleLine);
+      rl.off("close", handleClose);
+      rl.off("error", handleError);
+      rl.off("SIGINT", handleCancellation);
+      process.off("SIGINT", handleCancellation);
+      process.off("SIGTERM", handleCancellation);
+    };
+    function settleResolve(value) {
+      if (settled) return;
       settled = true;
+      cleanupListeners();
       resolve4(value);
-    };
-    const settleReject = (error) => {
+    }
+    function settleReject(error) {
       if (settled) return;
       settled = true;
+      cleanupListeners();
       reject(error);
-    };
-    abortController.signal.addEventListener(
-      "abort",
-      () => settleReject(new Error(timeoutMessage)),
-      { once: true }
-    );
-    rl.once("line", settleResolve);
-    rl.once(
-      "close",
-      () => settleReject(new ZapierCliValidationError(missingCallbackUrlMessage))
-    );
-    rl.once("error", settleReject);
+    }
+    abortController.signal.addEventListener("abort", handleAbort, {
+      once: true
+    });
+    rl.once("close", handleClose);
+    rl.once("error", handleError);
+    rl.once("SIGINT", handleCancellation);
+    process.once("SIGINT", handleCancellation);
+    process.once("SIGTERM", handleCancellation);
+    if (interactive) {
+      void rl.question("Paste the final OAuth callback URL: ", {
+        signal: abortController.signal
+      }).then(settleResolve).catch((error) => {
+        if (error instanceof Error && error.name === "AbortError") {
+          settleReject(new OauthFlowTimeoutError({ timeoutMs }));
+          return;
+        }
+        settleReject(error);
+      });
+      return;
+    }
+    rl.once("line", handleLine);
   });
   try {
-    return await readUrl.catch((error) => {
-      if (error instanceof Error && error.name === "AbortError") {
-        throw new Error(timeoutMessage);
-      }
-      throw error;
-    });
+    return await readUrl;
   } finally {
     clearTimeout(timeoutTimer);
     rl.close();
   }
 }
-async function runHeadlessSignupOauthFlow({
+async function runHeadlessOauthFlow({
   timeoutMs = LOGIN_TIMEOUT_MS,
   pkceCredentials,
   baseUrl: baseUrl2,
+  entryPoint,
   interactive = true,
   onProgress,
-  recoveryMessage
+  copy
 }) {
   const port = LOGIN_PORTS[0];
   const transaction = await prepareOauthTransaction({
     pkceCredentials,
     baseUrl: baseUrl2,
     redirectUri: `http://${OAUTH_LOOPBACK_HOST}:${port}/oauth`,
-    entryPoint: "signup"
+    entryPoint
   });
-  console.log(
-    "Use this mode when signing up from a machine that has no browser."
+  writeHeadlessOauthStatus(
+    `Use this mode to ${copy.action} from a machine that has no browser.`
+  );
+  writeHeadlessOauthStatus(
+    `Open this ${copy.urlLabel} in a browser on another machine:`
   );
-  console.log("Open this signup URL in a browser on another machine:");
   console.log(transaction.browserAuthUrl);
-  console.log(
+  writeHeadlessOauthStatus(
     `When the browser lands on ${transaction.redirectUri} and cannot connect, paste the full final URL back here.`
   );
   const callbackUrl = await readHeadlessCallbackUrl({
     timeoutMs,
-    interactive,
-    recoveryMessage
+    interactive
   });
   const code = getCallbackCode({
     callbackUrl,
-    transaction,
-    recoveryMessage
+    transaction
   });
   onProgress?.({ type: "callback_accepted" });
-  console.log("Exchanging authorization code for tokens...");
+  writeHeadlessOauthStatus("Exchanging authorization code for tokens...");
   onProgress?.({ type: "token_exchange_started" });
   const tokens = await exchangeOauthCode({ ...transaction, code });
   onProgress?.({ type: "token_exchange_completed" });
@@ -4106,7 +4272,7 @@ async function runHeadlessSignupOauthFlow({
 async function collectLocalCallbackCode({
   transaction,
   timeoutMs,
-  authAction,
+  action,
   silent,
   onProgress
 }) {
@@ -4114,21 +4280,26 @@ async function collectLocalCallbackCode({
   const app = express();
   app.get("/oauth", (req, res) => {
     res.setHeader("Connection", "close");
-    if (req.query.state !== transaction.state) {
-      res.status(400).end("Invalid state. You can close this tab.");
-    } else if (req.query.error) {
-      reject(
-        new OauthAuthorizationDeniedError(
-          String(req.query.error_description ?? req.query.error)
-        )
-      );
-      res.end("Authorization was denied. You can close this tab.");
-    } else if (!req.query.code) {
-      reject(new Error("No authorization code received"));
-      res.end("No authorization code received. You can close this tab.");
-    } else {
-      resolve4(String(req.query.code));
+    try {
+      const code = getCallbackCode({
+        callbackUrl: new URL(
+          req.originalUrl,
+          transaction.redirectUri
+        ).toString(),
+        transaction
+      });
+      resolve4(code);
       res.end("You can now close this tab and return to the CLI.");
+    } catch (error) {
+      if (error instanceof OauthCallbackError && error.kind === "state_mismatch") {
+        res.status(400).end("Invalid state. You can close this tab.");
+      } else if (error instanceof OauthAuthorizationDeniedError) {
+        reject(error);
+        res.end("Authorization was denied. You can close this tab.");
+      } else {
+        reject(error);
+        res.end("No authorization code received. You can close this tab.");
+      }
     }
   });
   const server = app.listen(
@@ -4149,19 +4320,19 @@ async function collectLocalCallbackCode({
   let timeoutTimer;
   try {
     await waitForServerListening(server);
-    await openBrowser({ transaction, authAction, silent, onProgress });
+    await openBrowser({ transaction, action, silent, onProgress });
     const waitForCode = Promise.race([
       promise,
       new Promise((_resolve, rejectTimeout) => {
         timeoutTimer = setTimeout(() => {
-          rejectTimeout(new OauthFlowTimeoutError(timeoutMs));
+          rejectTimeout(new OauthFlowTimeoutError({ timeoutMs }));
         }, timeoutMs);
       })
     ]);
     onProgress?.({ type: "callback_waiting" });
     return silent ? await waitForCode : await spinPromise(
       waitForCode,
-      `Waiting for you to ${authAction} and authorize`
+      `Waiting for you to ${action} and authorize`
     );
   } finally {
     if (timeoutTimer) clearTimeout(timeoutTimer);
@@ -4191,12 +4362,12 @@ async function waitForServerListening(server) {
 }
 async function openBrowser({
   transaction,
-  authAction,
+  action,
   silent,
   onProgress
 }) {
   if (!silent) {
-    log_default.info(`Opening your browser to ${authAction}.`);
+    log_default.info(`Opening your browser to ${action}.`);
     log_default.info("If it doesn't open, visit:", transaction.browserAuthUrl);
   }
   onProgress?.({ type: "browser_opening", url: transaction.browserAuthUrl });
@@ -4206,9 +4377,7 @@ async function openBrowser({
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
     if (!silent) {
-      log_default.info(
-        `Browser did not open automatically to ${authAction}: ${reason}`
-      );
+      log_default.info(`Browser did not open automatically to ${action}: ${reason}`);
       log_default.info("Visit this URL manually:", transaction.browserAuthUrl);
     }
     onProgress?.({
@@ -4237,61 +4406,10 @@ async function closeServer({
   });
 }
 
-// src/utils/auth/oauth-errors.ts
-var SENSITIVE_OAUTH_FIELDS = [
-  "access_token",
-  "refresh_token",
-  "id_token",
-  "client_secret",
-  "code_verifier",
-  "code_challenge"
-];
-function getErrorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-function toCamelCase(field) {
-  return field.replace(
-    /_([a-z])/g,
-    (_match, letter) => letter.toUpperCase()
-  );
-}
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-var sensitiveOauthFieldPattern = Array.from(
-  new Set(
-    SENSITIVE_OAUTH_FIELDS.flatMap((field) => [field, toCamelCase(field)])
-  )
-).map(escapeRegExp).join("|");
-var sensitiveQueryParamPattern = new RegExp(
-  `([?&])(${sensitiveOauthFieldPattern})(=)[^&#\\s"'<>]*`,
-  "gi"
-);
-function redactSensitiveOauthErrorMessage(message) {
-  return message.replace(
-    sensitiveQueryParamPattern,
-    (_match, prefix, key, separator) => `${prefix}${key}${separator}[REDACTED]`
-  ).replace(
-    new RegExp(`"(${sensitiveOauthFieldPattern})"(\\s*:\\s*)"[^"]*"`, "g"),
-    (_match, key, separator) => `"${key}"${separator}"[REDACTED]"`
-  );
-}
-function toRedactedOauthError(error) {
-  const message = redactSensitiveOauthErrorMessage(getErrorMessage(error));
-  if (error instanceof ZapierCliValidationError) {
-    return new ZapierCliValidationError(message);
-  }
-  if (error instanceof Error) {
-    const redactedError = new Error(message);
-    redactedError.name = error.name;
-    return redactedError;
-  }
-  return new ZapierCliValidationError(message);
-}
-
 // src/utils/auth/account-auth.ts
 var LEGACY_JWT_UPGRADE_PROMPT = "We're upgrading your login to client credentials for a simpler, more reliable experience and to support future security controls. Older Zapier SDK/CLI versions on this machine may stop working after the upgrade. Continue?";
 var SIGNUP_RECOVERY_MESSAGE = "Restart `zapier-sdk signup` to generate a fresh signup URL and try again.";
+var HEADLESS_LOGIN_RECOVERY_MESSAGE = "Restart `zapier-sdk login --headless` to generate a fresh login URL and try again.";
 var HEADLESS_SIGNUP_RECOVERY_MESSAGE = "Restart `zapier-sdk signup --headless` to generate a fresh signup URL and try again.";
 function getEntryPointLabel(entryPoint) {
   return entryPoint === "signup" ? "Signup" : "Login";
@@ -4411,7 +4529,8 @@ Logging out will delete these credentials and may interrupt other Zapier SDK or
 Log out and ${getActiveCredentialsAction(entryPoint)}?`
     }) : promptlessCredentialResetError(activeCredentials);
     if (!confirmed) {
-      console.log(`${flowLabel} cancelled.`);
+      process.stderr.write(`${flowLabel} cancelled.
+`);
       return false;
     }
     try {
@@ -4430,7 +4549,8 @@ Log out and ${getActiveCredentialsAction(entryPoint)}?`
         message: `${flowLabel} cleanup failed. Reset local session state and continue?`
       });
       if (!reset) {
-        console.log(`${flowLabel} cancelled.`);
+        process.stderr.write(`${flowLabel} cancelled.
+`);
         return false;
       }
       await deleteStoredClientCredentials({
@@ -4444,7 +4564,8 @@ Log out and ${getActiveCredentialsAction(entryPoint)}?`
       message: LEGACY_JWT_UPGRADE_PROMPT
     }) : promptlessLegacyJwtUpgradeError();
     if (!confirmed) {
-      console.log(`${flowLabel} cancelled.`);
+      process.stderr.write(`${flowLabel} cancelled.
+`);
       return false;
     }
   }
@@ -4539,7 +4660,14 @@ async function runOauthForEntryPoint({
     );
   }
   return runOauthWithRedaction(
-    () => runLoginOauthFlow({ timeoutMs, pkceCredentials, baseUrl: baseUrl2 })
+    () => runLoginOauthFlow({
+      timeoutMs,
+      pkceCredentials,
+      baseUrl: baseUrl2,
+      headless,
+      interactive,
+      recoveryMessage: headless ? HEADLESS_LOGIN_RECOVERY_MESSAGE : void 0
+    })
   );
 }
 async function runAccountAuth({
@@ -4551,6 +4679,7 @@ async function runAccountAuth({
   const interactive = !resolveNonInteractive(options);
   const resolvedCredentials = await sdk.context.resolveCredentials();
   const pkceCredentials = toPkceCredentials(resolvedCredentials);
+  const headless = options.headless === true;
   const credentialsBaseUrl2 = await resolveCredentialsBaseUrl({
     ...sdk.context,
     resolvedCredentials
@@ -4580,7 +4709,7 @@ async function runAccountAuth({
     timeoutMs: timeoutSeconds * 1e3,
     pkceCredentials,
     baseUrl: credentialsBaseUrl2,
-    headless: options.headless === true,
+    headless,
     interactive
   });
   const scopedApi = getOrCreateApiClient({
@@ -4588,9 +4717,10 @@ async function runAccountAuth({
     baseUrl: credentialsBaseUrl2
   });
   const profile = await getProfile(scopedApi);
-  console.log(getProfileMessage(entryPoint, profile.email));
-  console.log(
-    "\nGenerating credentials so this machine can make authenticated requests on your behalf."
+  process.stderr.write(`${getProfileMessage(entryPoint, profile.email)}
+`);
+  process.stderr.write(
+    "\nGenerating credentials so this machine can make authenticated requests on your behalf.\n"
   );
   const credentialName = providedName ?? await resolveCredentialName({
     email: profile.email,
@@ -4606,11 +4736,12 @@ async function runAccountAuth({
     useApprovals,
     cleanupLogPrefix: entryPoint
   });
-  console.log(
-    `\u2705 Credentials "${credentialName}" created and set as default. You are ready to use the Zapier SDK.`
+  process.stderr.write(
+    `\u2705 Credentials "${credentialName}" created and set as default. You are ready to use the Zapier SDK.
+`
   );
   if (useApprovals) {
-    console.log("\u{1F510} Approvals are enabled for these credentials.");
+    process.stderr.write("\u{1F510} Approvals are enabled for these credentials.\n");
   }
   emitAccountAuthSuccess({ sdk, profile, clientId });
 }
@@ -4629,7 +4760,10 @@ var LoginSchema = z.object({
   skipPrompts: z.boolean().optional().meta({
     deprecated: true,
     deprecationMessage: "Use --non-interactive instead."
-  })
+  }),
+  headless: z.boolean().optional().describe(
+    "Use when logging in from a machine that has no browser. Prints a login link to open elsewhere, then accepts the pasted loopback callback URL."
+  )
 }).describe("Log in to Zapier to access your account");
 
 // src/plugins/login/index.ts
@@ -7219,11 +7353,49 @@ var watchTriggerInboxCliPlugin = definePlugin(
     };
   }
 );
+var BOX_WIDTH = 72;
+var BOX_TITLE = "ZAPIER SDK DEPRECATION NOTICE";
+var activeNotices = /* @__PURE__ */ new Map();
+function collectDeprecationNotice(event) {
+  if (event.type !== DEPRECATION_NOTICE_EVENT) return;
+  const { id, message } = event.payload ?? {};
+  if (typeof id === "string" && typeof message === "string") {
+    activeNotices.set(id, message);
+  }
+}
+function collectDeprecationNoticeAndForward(event, onEvent) {
+  collectDeprecationNotice(event);
+  return onEvent?.(event);
+}
+function renderDeprecationNotices() {
+  const messages = [...activeNotices.values()];
+  activeNotices.clear();
+  if (messages.length === 0) return;
+  console.error();
+  for (const message of messages) {
+    for (const line of buildBoxLines(message)) {
+      console.error(chalk.red.bold(line));
+    }
+    console.error();
+  }
+}
+function buildBoxLines(message) {
+  const innerWidth = BOX_WIDTH - 4;
+  const pad = (line) => `\u2502 ${line.padEnd(innerWidth)} \u2502`;
+  const wrapped = wrapAnsi(message, innerWidth, { hard: true }).split("\n");
+  return [
+    `\u256D${"\u2500".repeat(BOX_WIDTH - 2)}\u256E`,
+    pad(BOX_TITLE),
+    pad(""),
+    ...wrapped.map(pad),
+    `\u2570${"\u2500".repeat(BOX_WIDTH - 2)}\u256F`
+  ];
+}
 
 // package.json with { type: 'json' }
 var package_default2 = {
   name: "@zapier/zapier-sdk-cli",
-  version: "0.59.3"};
+  version: "0.61.0"};
 
 // src/sdk.ts
 injectCliLogin(login_exports);
@@ -7235,7 +7407,11 @@ function createZapierCliSdk(options = {}) {
   const stack = createZapierSdkStack$1({
     ...sdkOptions,
     eventEmission: { ...sdkOptions.eventEmission, callContext: "cli" },
-    callerPackage: { name: package_default2.name, version: package_default2.version }
+    callerPackage: { name: package_default2.name, version: package_default2.version },
+    // Collected for the boxed stderr warning rendered in the exit path. The
+    // box is additive: the SDK's own inline warn still fires, so the notice
+    // cannot be hidden by any rendering path.
+    onEvent: (event) => collectDeprecationNoticeAndForward(event, sdkOptions.onEvent)
   }).use(extensionsContextPlugin).use(generateAppTypesPlugin).use(buildManifestPlugin).use(bundleCodePlugin).use(getLoginConfigPathPlugin).use(addAppsPlugin).use(feedbackPlugin).use(curlPlugin).use(initPlugin).use(mcpPlugin).use(loginPlugin).use(signupPlugin).use(logoutPlugin).use(cliOverridesPlugin, { override: true });
   const sdk = createSdk$1(
     defineLegacyMerge$1({
@@ -7268,7 +7444,11 @@ function createZapierCliSdk2(options = {}) {
   const stack = createZapierSdkStack({
     ...sdkOptions,
     eventEmission: { ...sdkOptions.eventEmission, callContext: "cli" },
-    callerPackage: { name: package_default2.name, version: package_default2.version }
+    callerPackage: { name: package_default2.name, version: package_default2.version },
+    // Collected for the boxed stderr warning rendered in the exit path. The
+    // box is additive: the SDK's own inline warn still fires, so the notice
+    // cannot be hidden by any rendering path.
+    onEvent: (event) => collectDeprecationNoticeAndForward(event, sdkOptions.onEvent)
   }).use(extensionsContextPlugin).use(experimentalContextPlugin).use(generateAppTypesPlugin).use(buildManifestPlugin).use(bundleCodePlugin).use(getLoginConfigPathPlugin).use(addAppsPlugin).use(feedbackPlugin).use(curlPlugin).use(initPlugin).use(drainTriggerInboxCliPlugin, { override: true }).use(watchTriggerInboxCliPlugin, { override: true }).use(mcpPlugin).use(loginPlugin).use(signupPlugin).use(logoutPlugin).use(cliOverridesPlugin, { override: true });
   const sdk = createSdk(
     defineLegacyMerge({
@@ -7852,6 +8032,7 @@ program.exitOverride();
   }
   await versionCheckPromise;
   await sdk.context.eventEmission.close(exitCode);
+  renderDeprecationNotices();
   const exitTimeout = setTimeout(
     () => process.exit(exitCode),
     EXIT_GRACE_PERIOD_MS