@zapier/zapier-sdk-cli 0.60.0 → 0.61.1

package/dist/cli.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { Command, CommanderError, Option } from 'commander';
 import { z } from 'zod';
-import { definePlugin, createPluginMethod, OutputPropertySchema, ZapierBundleError, DEFAULT_CONFIG_PATH, ZapierValidationError, ZapierUnknownError, ZapierReleaseTriggerMessageSignal, injectCliLogin, BaseSdkOptionsSchema, getOrCreateApiClient, isPermanentHttpError, invalidateCachedToken, batch, toSnakeCase, ZapierAbortDrainSignal, createZapierSdkStack as createZapierSdkStack$1, createSdk as createSdk$1, defineLegacyMerge as defineLegacyMerge$1, zapierSdkPlugin as zapierSdkPlugin$1, addPlugin as addPlugin$1, ZapierError, isCredentialsObject, buildApplicationLifecycleEvent, AuthMechanism, ZapierAuthenticationError, DEPRECATION_NOTICE_EVENT, runWithCallerContext, isPositional, runWithTelemetryContext, buildCapabilityMessage, formatErrorMessage, getOsInfo, getPlatformVersions, getAgent, getTtyContext, getCiPlatform, isCi, getReleaseId, getCurrentTimestamp, generateEventId, ZapierApprovalError } from '@zapier/zapier-sdk';
+import { definePlugin, createPluginMethod, OutputPropertySchema, ZapierBundleError, DEFAULT_CONFIG_PATH, ZapierValidationError, ZapierUnknownError, ZapierReleaseTriggerMessageSignal, injectCliLogin, BaseSdkOptionsSchema, getOrCreateApiClient, isPermanentHttpError, invalidateCachedToken, batch, toSnakeCase, ZapierAbortDrainSignal, createZapierSdkStack as createZapierSdkStack$1, createSdk as createSdk$1, defineLegacyMerge as defineLegacyMerge$1, zapierSdkPlugin as zapierSdkPlugin$1, addPlugin as addPlugin$1, ZapierError, isCredentialsObject, buildApplicationLifecycleEvent, AuthMechanism, ZapierAuthenticationError, DEPRECATION_NOTICE_EVENT, runWithCallerContext, isPositional, createController, CoreCancelledSignal, runWithTelemetryContext, buildCapabilityMessage, formatErrorMessage, getOsInfo, getPlatformVersions, getAgent, getTtyContext, getCiPlatform, isCi, getReleaseId, getCurrentTimestamp, generateEventId, ZapierApprovalError } from '@zapier/zapier-sdk';
 import inquirer from 'inquirer';
 import search from '@inquirer/search';
 import chalk from 'chalk';
@@ -59,12 +59,18 @@ var ZapierCliExitError = class extends ZapierCliError {
     this.exitCode = exitCode;
   }
 };
-var ZapierCliValidationError = class extends ZapierCliError {
-  constructor(message) {
+var ZapierCliValidationError = class _ZapierCliValidationError extends ZapierCliError {
+  constructor(message, options = {}) {
     super(message);
-    this.name = "ZapierCliValidationError";
-    this.code = "ZAPIER_CLI_VALIDATION_ERROR";
     this.exitCode = 1;
+    this.name = options.name ?? "ZapierCliValidationError";
+    this.code = options.code ?? "ZAPIER_CLI_VALIDATION_ERROR";
+  }
+  withMessage(message) {
+    return new _ZapierCliValidationError(message, {
+      name: this.name,
+      code: this.code
+    });
   }
 };
 var ZapierCliMissingParametersError = class extends ZapierCliError {
@@ -1505,6 +1511,148 @@ Optional fields${pathContext}:`));
     return constants;
   }
 };
+function offers(question, action) {
+  return question.actions.some((a) => a.action === action);
+}
+function isActionRow(value) {
+  return typeof value === "object" && value !== null && "action" in value;
+}
+async function promptText({
+  message,
+  password
+}) {
+  const { value } = await inquirer.prompt([
+    { type: password ? "password" : "input", name: "value", message }
+  ]);
+  return value;
+}
+async function answerSelect(question, field) {
+  const display = (c) => c.hint ? `${c.label} ${chalk.dim(`(${c.hint})`)}` : c.label;
+  if (question.multiple) {
+    const choices = [
+      ...question.choices.map((c) => ({ name: display(c), value: c.value })),
+      ...offers(question, "more") ? [
+        {
+          name: chalk.dim("Load more\u2026"),
+          value: { action: "more" }
+        }
+      ] : [],
+      ...(question.notes ?? []).map((note) => ({
+        name: chalk.dim(note),
+        value: note,
+        disabled: true
+      }))
+    ];
+    const { values } = await inquirer.prompt([
+      { type: "checkbox", name: "values", message: question.message, choices }
+    ]);
+    const selected = values;
+    if (selected.some(isActionRow)) return { type: "more" };
+    if (selected.length === 0 && offers(question, "skip")) {
+      return { type: "skip" };
+    }
+    return { type: "choose", value: selected };
+  }
+  const row = (name, action) => ({
+    name,
+    value: { action }
+  });
+  const value = await search({
+    message: question.message,
+    source: (term) => {
+      const t = (term ?? "").trim().toLowerCase();
+      const matched = t ? question.choices.filter(
+        (c) => `${c.label} ${c.hint ?? ""}`.toLowerCase().includes(t)
+      ) : question.choices;
+      const rows = matched.map((c) => ({
+        name: display(c),
+        value: c.value
+      }));
+      if (offers(question, "search"))
+        rows.push(row(chalk.cyan("Search\u2026"), "search"));
+      if (offers(question, "more"))
+        rows.push(row(chalk.dim("Load more\u2026"), "more"));
+      if (offers(question, "custom"))
+        rows.push(row(chalk.dim("Enter a value manually\u2026"), "custom"));
+      if (offers(question, "retry"))
+        rows.push(row(chalk.yellow("Retry"), "retry"));
+      if (offers(question, "skip"))
+        rows.push(row(chalk.dim("Skip (optional)"), "skip"));
+      if (offers(question, "cancel"))
+        rows.push(row(chalk.dim("Cancel"), "cancel"));
+      for (const note of question.notes ?? [])
+        rows.push({ name: chalk.dim(note), value: note, disabled: true });
+      return rows;
+    }
+  });
+  if (!isActionRow(value)) {
+    return { type: "choose", value };
+  }
+  switch (value.action) {
+    case "search": {
+      const term = await promptText({
+        message: `Search ${field}:`,
+        password: false
+      });
+      return { type: "search", term };
+    }
+    case "custom": {
+      const custom = await promptText({
+        message: `Enter ${field}:`,
+        password: false
+      });
+      return { type: "custom", value: custom };
+    }
+    case "more":
+      return { type: "more" };
+    case "retry":
+      return { type: "retry" };
+    case "skip":
+      return { type: "skip" };
+    case "cancel":
+      return { type: "cancel" };
+  }
+}
+async function answerInput(question) {
+  const value = await promptText({
+    message: question.message,
+    password: question.inputType === "password"
+  });
+  if (value === "" && offers(question, "skip")) {
+    return { type: "skip" };
+  }
+  return { type: "custom", value };
+}
+async function answerCollection(question) {
+  if (!offers(question, "done")) {
+    return { type: "add" };
+  }
+  const { again } = await inquirer.prompt([
+    {
+      type: "confirm",
+      name: "again",
+      message: question.message,
+      default: false
+    }
+  ]);
+  return again ? { type: "add" } : { type: "done" };
+}
+var answerViaCli = ({ state, result }) => {
+  if (result.error !== void 0) {
+    const message = typeof result.error === "string" ? result.error : result.error.message;
+    console.log(chalk.yellow(`! ${message}`));
+  }
+  const field = state.current?.join(".") ?? "value";
+  const question = result.question;
+  switch (question.type) {
+    case "select":
+      return answerSelect(question, field);
+    case "input":
+      return answerInput(question);
+    case "collection":
+      return answerCollection(question);
+  }
+};
 
 // src/utils/cli-options.ts
 var RESERVED_CLI_OPTIONS = [
@@ -1536,7 +1684,7 @@ var SHARED_COMMAND_CLI_OPTIONS = [
 
 // package.json
 var package_default = {
-  version: "0.60.0"};
+  version: "0.61.1"};
 
 // src/telemetry/builders.ts
 function createCliBaseEvent(context = {}) {
@@ -1611,7 +1759,7 @@ async function formatItemsFromSchema(_functionInfo, items, startingNumber = 0, o
   if (options?.formatter) {
     const formatter = options.formatter;
     const input = options.input ?? {};
-    const context = formatter.fetchContext ? await formatter.fetchContext({ items, input }) : void 0;
+    const context = formatter.getContext ? await formatter.getContext({ items, input }) : void 0;
     items.forEach((item, index) => {
       const formatted = formatter.format({ item, input, context });
       formatSingleItem(formatted, startingNumber + index);
@@ -2206,7 +2354,7 @@ function analyzeZodField(name, schema, functionInfo) {
     paramType = "object";
   }
   let paramHasResolver = false;
-  if (functionInfo?.resolvers?.[name]) {
+  if (functionInfo?.resolvers?.[name] || functionInfo?.boundResolvers?.[name]) {
     paramHasResolver = true;
   }
   return {
@@ -2365,6 +2513,9 @@ function createCommandConfig(cliCommandName, functionInfo, sdk) {
   const usesInputParameters = !functionInfo.inputSchema && !!functionInfo.inputParameters;
   const schema = functionInfo.inputSchema;
   const parameters = usesInputParameters ? analyzeInputParameters(functionInfo.inputParameters, functionInfo) : analyzeZodSchema(schema, functionInfo);
+  if (functionInfo.boundResolvers && Object.keys(functionInfo.boundResolvers).length > 0) {
+    for (const param of parameters) param.hasResolver = true;
+  }
   const schemaAliases = getSchemaAliases(schema);
   if (schemaAliases) {
     const aliasedNames = new Set(Object.keys(schemaAliases));
@@ -2417,7 +2568,35 @@ function createCommandConfig(cliCommandName, functionInfo, sdk) {
           }
         }
       }
-      if (schema && !usesInputParameters) {
+      const boundResolvers = functionInfo.boundResolvers;
+      if (boundResolvers && Object.keys(boundResolvers).length > 0) {
+        const seedInput = Object.fromEntries(
+          Object.entries(rawParams).filter(([, v]) => v !== void 0)
+        );
+        const controller = createController(sdk);
+        let resolved;
+        try {
+          resolved = await controller.resolve({
+            method: functionInfo.name,
+            input: seedInput,
+            answer: interactiveMode ? answerViaCli : ({ state }) => {
+              throw new ZapierCliMissingParametersError([
+                {
+                  name: state.current?.join(".") ?? "value",
+                  isPositional: false
+                }
+              ]);
+            },
+            interactive: interactiveMode
+          });
+        } catch (err) {
+          if (err instanceof CoreCancelledSignal) {
+            throw new ZapierCliUserCancellationError();
+          }
+          throw err;
+        }
+        Object.assign(resolvedParams, resolved);
+      } else if (schema && !usesInputParameters) {
         const resolver = new SchemaParameterResolver();
         const resolved = await resolver.resolveParameters(
           schema,
@@ -2510,7 +2689,7 @@ ${confirmMessageAfter}`));
         }
       }
     } catch (error) {
-      success = false;
+      success = error instanceof ZapierCliError ? error.exitCode === 0 : false;
       errorMessage = error instanceof Error ? error.message : String(error);
       if (error instanceof ZapierCliMissingParametersError) {
         renderer.renderError(error);
@@ -3722,41 +3901,165 @@ var spinPromise = async (promise, text) => {
   }
 };
 
+// src/utils/auth/oauth-errors.ts
+var OauthFlowTimeoutError = class _OauthFlowTimeoutError extends ZapierCliValidationError {
+  constructor({
+    timeoutMs,
+    message = "OAuth flow timed out"
+  }) {
+    super(message, {
+      name: "OauthFlowTimeoutError",
+      code: "ZAPIER_OAUTH_FLOW_TIMEOUT"
+    });
+    this.timeoutMs = timeoutMs;
+  }
+  withMessage(message) {
+    return new _OauthFlowTimeoutError({ timeoutMs: this.timeoutMs, message });
+  }
+};
+var OauthAuthorizationDeniedError = class _OauthAuthorizationDeniedError extends ZapierCliValidationError {
+  constructor({
+    reason,
+    message = "OAuth authorization denied"
+  }) {
+    super(message, {
+      name: "OauthAuthorizationDeniedError",
+      code: "ZAPIER_OAUTH_AUTHORIZATION_DENIED"
+    });
+    this.reason = reason;
+  }
+  withMessage(message) {
+    return new _OauthAuthorizationDeniedError({
+      reason: this.reason,
+      message
+    });
+  }
+};
+var OauthFlowError = class _OauthFlowError extends ZapierCliValidationError {
+  constructor({ message }) {
+    super(message, {
+      name: "OauthFlowError",
+      code: "ZAPIER_OAUTH_FLOW"
+    });
+  }
+  withMessage(message) {
+    return new _OauthFlowError({ message });
+  }
+};
+var OauthCallbackError = class _OauthCallbackError extends ZapierCliValidationError {
+  constructor({ kind, message }) {
+    super(message, {
+      name: "OauthCallbackError",
+      code: "ZAPIER_OAUTH_CALLBACK"
+    });
+    this.kind = kind;
+  }
+  withMessage(message) {
+    return new _OauthCallbackError({ kind: this.kind, message });
+  }
+};
+var OauthTokenExchangeError = class _OauthTokenExchangeError extends ZapierCliValidationError {
+  constructor({ message }) {
+    super(message, {
+      name: "OauthTokenExchangeError",
+      code: "ZAPIER_OAUTH_TOKEN_EXCHANGE"
+    });
+  }
+  withMessage(message) {
+    return new _OauthTokenExchangeError({ message });
+  }
+};
+var SENSITIVE_OAUTH_FIELDS = [
+  "access_token",
+  "refresh_token",
+  "id_token",
+  "client_secret",
+  "code_verifier",
+  "code_challenge"
+];
+function getErrorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function toCamelCase(field) {
+  return field.replace(
+    /_([a-z])/g,
+    (_match, letter) => letter.toUpperCase()
+  );
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var sensitiveOauthFieldPattern = Array.from(
+  new Set(
+    SENSITIVE_OAUTH_FIELDS.flatMap((field) => [field, toCamelCase(field)])
+  )
+).map(escapeRegExp).join("|");
+var sensitiveQueryParamPattern = new RegExp(
+  `([?&])(${sensitiveOauthFieldPattern})(=)[^&#\\s"'<>]*`,
+  "gi"
+);
+function redactSensitiveOauthErrorMessage(message) {
+  return message.replace(
+    sensitiveQueryParamPattern,
+    (_match, prefix, key, separator) => `${prefix}${key}${separator}[REDACTED]`
+  ).replace(
+    new RegExp(`"(${sensitiveOauthFieldPattern})"(\\s*:\\s*)"[^"]*"`, "g"),
+    (_match, key, separator) => `"${key}"${separator}"[REDACTED]"`
+  );
+}
+function toRedactedOauthError(error) {
+  const message = redactSensitiveOauthErrorMessage(getErrorMessage(error));
+  if (error instanceof ZapierCliValidationError) {
+    return error.withMessage(message);
+  }
+  return new OauthFlowError({ message });
+}
+function toOauthTokenExchangeError(error) {
+  return new OauthTokenExchangeError({
+    message: redactSensitiveOauthErrorMessage(getErrorMessage(error))
+  });
+}
+
 // src/utils/auth/oauth-callback.ts
 function getCallbackCode({
   callbackUrl,
-  transaction,
-  recoveryMessage
+  transaction
 }) {
   let parsed;
   try {
     parsed = new URL(callbackUrl.trim());
   } catch {
-    throw new ZapierCliValidationError(
-      "Paste the final OAuth callback URL from your browser."
-    );
+    throw new OauthCallbackError({
+      kind: "invalid_url",
+      message: "Paste the final OAuth callback URL from your browser."
+    });
   }
   const expected = new URL(transaction.redirectUri);
   if (parsed.protocol !== "http:" || parsed.hostname !== expected.hostname || parsed.pathname !== expected.pathname || parsed.port !== expected.port) {
-    throw new ZapierCliValidationError(
-      `Expected the final OAuth callback URL to start with ${transaction.redirectUri}.`
-    );
+    throw new OauthCallbackError({
+      kind: "redirect_mismatch",
+      message: `Expected the final OAuth callback URL to start with ${transaction.redirectUri}.`
+    });
   }
   if (parsed.searchParams.get("state") !== transaction.state) {
-    throw new ZapierCliValidationError(
-      `OAuth state mismatch.${recoveryMessage ? ` ${recoveryMessage}` : ""}`
-    );
+    throw new OauthCallbackError({
+      kind: "state_mismatch",
+      message: "OAuth state mismatch."
+    });
   }
   if (parsed.searchParams.has("error")) {
-    throw new ZapierCliValidationError(
-      `Authorization denied: ${parsed.searchParams.get("error_description") ?? parsed.searchParams.get("error")}.${recoveryMessage ? ` ${recoveryMessage}` : ""}`
-    );
+    throw new OauthAuthorizationDeniedError({
+      reason: String(
+        parsed.searchParams.get("error_description") ?? parsed.searchParams.get("error")
+      )
+    });
   }
   const code = parsed.searchParams.get("code");
   if (!code) {
-    throw new ZapierCliValidationError(
-      "No authorization code found in the pasted callback URL."
-    );
+    throw new OauthCallbackError({
+      kind: "missing_code",
+      message: "No authorization code found in the pasted callback URL."
+    });
   }
   return code;
 }
@@ -3871,7 +4174,9 @@ async function exchangeOauthCode({
         "Content-Type": "application/x-www-form-urlencoded"
       }
     }
-  );
+  ).catch((error) => {
+    throw toOauthTokenExchangeError(error);
+  });
   return {
     accessToken: data.access_token,
     refreshToken: data.refresh_token,
@@ -3880,19 +4185,15 @@ async function exchangeOauthCode({
 }
 
 // src/utils/auth/oauth-flow.ts
-var OauthFlowTimeoutError = class extends Error {
-  constructor(timeoutMs) {
-    super("OAuth flow timed out");
-    this.timeoutMs = timeoutMs;
-    this.name = "OauthFlowTimeoutError";
-  }
+var LOGIN_OAUTH_COPY = {
+  flowName: "Login",
+  action: "log in",
+  urlLabel: "login URL"
 };
-var OauthAuthorizationDeniedError = class extends Error {
-  constructor(reason) {
-    super("OAuth authorization denied");
-    this.reason = reason;
-    this.name = "OauthAuthorizationDeniedError";
-  }
+var SIGNUP_OAUTH_COPY = {
+  flowName: "Signup",
+  action: "sign up",
+  urlLabel: "signup URL"
 };
 function findAvailablePort() {
   return new Promise((resolve4, reject) => {
@@ -3907,70 +4208,86 @@ function findAvailablePort() {
           tryPort(LOGIN_PORTS[portIndex++]);
         } else if (err.code === "EADDRINUSE") {
           reject(
-            new Error(
-              `All configured OAuth callback ports are busy: ${LOGIN_PORTS.join(", ")}. Please try again later or close applications using these ports.`
-            )
+            new OauthFlowError({
+              message: `All configured OAuth callback ports are busy: ${LOGIN_PORTS.join(", ")}. Please try again later or close applications using these ports.`
+            })
           );
         } else {
           reject(err);
         }
       });
     };
-    if (LOGIN_PORTS.length > 0) tryPort(LOGIN_PORTS[portIndex++]);
-    else reject(new Error("No OAuth callback ports configured"));
+    if (LOGIN_PORTS.length > 0) {
+      tryPort(LOGIN_PORTS[portIndex++]);
+      return;
+    }
+    reject(
+      new OauthFlowError({ message: "No OAuth callback ports configured" })
+    );
   });
 }
 async function runLoginOauthFlow(options) {
-  return runOauthFlowEntryPoint({
-    ...options,
+  return runOauthFlowForEntryPoint({
+    options,
     entryPoint: "login",
-    authAction: "log in",
-    flowName: "Login"
+    copy: LOGIN_OAUTH_COPY
   });
 }
 async function runSignupOauthFlow(options) {
+  return runOauthFlowForEntryPoint({
+    options,
+    entryPoint: "signup",
+    copy: SIGNUP_OAUTH_COPY
+  });
+}
+function runOauthFlowForEntryPoint({
+  options,
+  entryPoint,
+  copy
+}) {
   if (options.headless) {
     return runOauthFlowEntryPoint({
       ...options,
-      entryPoint: "signup",
-      authAction: "sign up",
-      flowName: "Signup",
-      headless: true
+      entryPoint,
+      headless: true,
+      copy
     });
   }
   return runOauthFlowEntryPoint({
     ...options,
-    entryPoint: "signup",
-    authAction: "sign up",
-    flowName: "Signup"
+    entryPoint,
+    copy,
+    headless: false
   });
 }
-async function runOauthFlowEntryPoint({
-  flowName,
-  ...options
-}) {
+async function runOauthFlowEntryPoint(options) {
   try {
-    return options.headless ? await runHeadlessSignupOauthFlow(options) : await runOauthFlow(options);
+    return options.headless ? await runHeadlessOauthFlow(options) : await runOauthFlow(options);
   } catch (error) {
     if (error instanceof OauthFlowTimeoutError) {
-      throw new Error(
+      throw error.withMessage(
         withRecoveryMessage(
-          `${flowName} timed out after ${Math.round(error.timeoutMs / 1e3)} seconds.`,
+          `${options.copy.flowName} timed out after ${Math.round(error.timeoutMs / 1e3)} seconds.`,
           options.recoveryMessage
         )
       );
     }
     if (error instanceof OauthAuthorizationDeniedError) {
-      throw new Error(
+      throw error.withMessage(
         withRecoveryMessage(
           `Authorization denied: ${error.reason}.`,
           options.recoveryMessage
         )
       );
     }
+    if (error instanceof OauthCallbackError && options.recoveryMessage) {
+      throw error.withMessage(
+        withRecoveryMessage(error.message, options.recoveryMessage)
+      );
+    }
     if (error instanceof ZapierCliUserCancellationError && !options.silent) {
       log_default.info(`
-\u274C ${flowName} cancelled by user`);
+\u274C ${options.copy.flowName} cancelled by user`);
     }
     throw error;
   }
@@ -3978,12 +4295,22 @@ async function runOauthFlowEntryPoint({
 function withRecoveryMessage(message, recoveryMessage) {
   return recoveryMessage ? `${message} ${recoveryMessage}` : message;
 }
+function createMissingHeadlessCallbackUrlError() {
+  return new OauthCallbackError({
+    kind: "missing_callback_url",
+    message: "Paste the final OAuth callback URL from your browser."
+  });
+}
+function writeHeadlessOauthStatus(message) {
+  process.stderr.write(`${message}
+`);
+}
 async function runOauthFlow({
   timeoutMs = LOGIN_TIMEOUT_MS,
   pkceCredentials,
   baseUrl: baseUrl2,
   entryPoint,
-  authAction,
+  copy,
   silent = false,
   onProgress
 }) {
@@ -3998,7 +4325,7 @@ async function runOauthFlow({
   const code = await collectLocalCallbackCode({
     transaction,
     timeoutMs,
-    authAction,
+    action: copy.action,
     silent,
     onProgress
   });
@@ -4012,92 +4339,104 @@ async function runOauthFlow({
 }
 async function readHeadlessCallbackUrl({
   timeoutMs,
-  interactive,
-  recoveryMessage
+  interactive
 }) {
-  const timeoutMessage = withRecoveryMessage(
-    `Signup timed out after ${Math.round(timeoutMs / 1e3)} seconds.`,
-    recoveryMessage
-  );
-  const missingCallbackUrlMessage = withRecoveryMessage(
-    "Paste the final OAuth callback URL from your browser.",
-    recoveryMessage
-  );
   const rl = createInterface({ input: process.stdin, output: process.stderr });
   const abortController = new AbortController();
   const timeoutTimer = setTimeout(() => abortController.abort(), timeoutMs);
-  const readUrl = interactive ? rl.question("Paste the final OAuth callback URL: ", {
-    signal: abortController.signal
-  }) : new Promise((resolve4, reject) => {
+  const readUrl = new Promise((resolve4, reject) => {
     let settled = false;
-    const settleResolve = (value) => {
+    const handleLine = (value) => settleResolve(value);
+    const handleAbort = () => settleReject(new OauthFlowTimeoutError({ timeoutMs }));
+    const handleClose = () => settleReject(createMissingHeadlessCallbackUrlError());
+    const handleError = (error) => settleReject(error);
+    const handleCancellation = () => settleReject(new ZapierCliUserCancellationError());
+    const cleanupListeners = () => {
+      abortController.signal.removeEventListener("abort", handleAbort);
+      rl.off("line", handleLine);
+      rl.off("close", handleClose);
+      rl.off("error", handleError);
+      rl.off("SIGINT", handleCancellation);
+      process.off("SIGINT", handleCancellation);
+      process.off("SIGTERM", handleCancellation);
+    };
+    function settleResolve(value) {
+      if (settled) return;
       settled = true;
+      cleanupListeners();
       resolve4(value);
-    };
-    const settleReject = (error) => {
+    }
+    function settleReject(error) {
       if (settled) return;
       settled = true;
+      cleanupListeners();
       reject(error);
-    };
-    abortController.signal.addEventListener(
-      "abort",
-      () => settleReject(new Error(timeoutMessage)),
-      { once: true }
-    );
-    rl.once("line", settleResolve);
-    rl.once(
-      "close",
-      () => settleReject(new ZapierCliValidationError(missingCallbackUrlMessage))
-    );
-    rl.once("error", settleReject);
+    }
+    abortController.signal.addEventListener("abort", handleAbort, {
+      once: true
+    });
+    rl.once("close", handleClose);
+    rl.once("error", handleError);
+    rl.once("SIGINT", handleCancellation);
+    process.once("SIGINT", handleCancellation);
+    process.once("SIGTERM", handleCancellation);
+    if (interactive) {
+      void rl.question("Paste the final OAuth callback URL: ", {
+        signal: abortController.signal
+      }).then(settleResolve).catch((error) => {
+        if (error instanceof Error && error.name === "AbortError") {
+          settleReject(new OauthFlowTimeoutError({ timeoutMs }));
+          return;
+        }
+        settleReject(error);
+      });
+      return;
+    }
+    rl.once("line", handleLine);
   });
   try {
-    return await readUrl.catch((error) => {
-      if (error instanceof Error && error.name === "AbortError") {
-        throw new Error(timeoutMessage);
-      }
-      throw error;
-    });
+    return await readUrl;
   } finally {
     clearTimeout(timeoutTimer);
     rl.close();
   }
 }
-async function runHeadlessSignupOauthFlow({
+async function runHeadlessOauthFlow({
   timeoutMs = LOGIN_TIMEOUT_MS,
   pkceCredentials,
   baseUrl: baseUrl2,
+  entryPoint,
   interactive = true,
   onProgress,
-  recoveryMessage
+  copy
 }) {
   const port = LOGIN_PORTS[0];
   const transaction = await prepareOauthTransaction({
     pkceCredentials,
     baseUrl: baseUrl2,
     redirectUri: `http://${OAUTH_LOOPBACK_HOST}:${port}/oauth`,
-    entryPoint: "signup"
+    entryPoint
   });
-  console.log(
-    "Use this mode when signing up from a machine that has no browser."
+  writeHeadlessOauthStatus(
+    `Use this mode to ${copy.action} from a machine that has no browser.`
+  );
+  writeHeadlessOauthStatus(
+    `Open this ${copy.urlLabel} in a browser on another machine:`
   );
-  console.log("Open this signup URL in a browser on another machine:");
   console.log(transaction.browserAuthUrl);
-  console.log(
+  writeHeadlessOauthStatus(
     `When the browser lands on ${transaction.redirectUri} and cannot connect, paste the full final URL back here.`
   );
   const callbackUrl = await readHeadlessCallbackUrl({
     timeoutMs,
-    interactive,
-    recoveryMessage
+    interactive
   });
   const code = getCallbackCode({
     callbackUrl,
-    transaction,
-    recoveryMessage
+    transaction
   });
   onProgress?.({ type: "callback_accepted" });
-  console.log("Exchanging authorization code for tokens...");
+  writeHeadlessOauthStatus("Exchanging authorization code for tokens...");
   onProgress?.({ type: "token_exchange_started" });
   const tokens = await exchangeOauthCode({ ...transaction, code });
   onProgress?.({ type: "token_exchange_completed" });
@@ -4106,7 +4445,7 @@ async function runHeadlessSignupOauthFlow({
 async function collectLocalCallbackCode({
   transaction,
   timeoutMs,
-  authAction,
+  action,
   silent,
   onProgress
 }) {
@@ -4114,21 +4453,26 @@ async function collectLocalCallbackCode({
   const app = express();
   app.get("/oauth", (req, res) => {
     res.setHeader("Connection", "close");
-    if (req.query.state !== transaction.state) {
-      res.status(400).end("Invalid state. You can close this tab.");
-    } else if (req.query.error) {
-      reject(
-        new OauthAuthorizationDeniedError(
-          String(req.query.error_description ?? req.query.error)
-        )
-      );
-      res.end("Authorization was denied. You can close this tab.");
-    } else if (!req.query.code) {
-      reject(new Error("No authorization code received"));
-      res.end("No authorization code received. You can close this tab.");
-    } else {
-      resolve4(String(req.query.code));
+    try {
+      const code = getCallbackCode({
+        callbackUrl: new URL(
+          req.originalUrl,
+          transaction.redirectUri
+        ).toString(),
+        transaction
+      });
+      resolve4(code);
       res.end("You can now close this tab and return to the CLI.");
+    } catch (error) {
+      if (error instanceof OauthCallbackError && error.kind === "state_mismatch") {
+        res.status(400).end("Invalid state. You can close this tab.");
+      } else if (error instanceof OauthAuthorizationDeniedError) {
+        reject(error);
+        res.end("Authorization was denied. You can close this tab.");
+      } else {
+        reject(error);
+        res.end("No authorization code received. You can close this tab.");
+      }
     }
   });
   const server = app.listen(
@@ -4149,19 +4493,19 @@ async function collectLocalCallbackCode({
   let timeoutTimer;
   try {
     await waitForServerListening(server);
-    await openBrowser({ transaction, authAction, silent, onProgress });
+    await openBrowser({ transaction, action, silent, onProgress });
     const waitForCode = Promise.race([
       promise,
       new Promise((_resolve, rejectTimeout) => {
         timeoutTimer = setTimeout(() => {
-          rejectTimeout(new OauthFlowTimeoutError(timeoutMs));
+          rejectTimeout(new OauthFlowTimeoutError({ timeoutMs }));
         }, timeoutMs);
       })
     ]);
     onProgress?.({ type: "callback_waiting" });
     return silent ? await waitForCode : await spinPromise(
       waitForCode,
-      `Waiting for you to ${authAction} and authorize`
+      `Waiting for you to ${action} and authorize`
     );
   } finally {
     if (timeoutTimer) clearTimeout(timeoutTimer);
@@ -4191,12 +4535,12 @@ async function waitForServerListening(server) {
 }
 async function openBrowser({
   transaction,
-  authAction,
+  action,
   silent,
   onProgress
 }) {
   if (!silent) {
-    log_default.info(`Opening your browser to ${authAction}.`);
+    log_default.info(`Opening your browser to ${action}.`);
     log_default.info("If it doesn't open, visit:", transaction.browserAuthUrl);
   }
   onProgress?.({ type: "browser_opening", url: transaction.browserAuthUrl });
@@ -4206,9 +4550,7 @@ async function openBrowser({
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
     if (!silent) {
-      log_default.info(
-        `Browser did not open automatically to ${authAction}: ${reason}`
-      );
+      log_default.info(`Browser did not open automatically to ${action}: ${reason}`);
       log_default.info("Visit this URL manually:", transaction.browserAuthUrl);
     }
     onProgress?.({
@@ -4237,61 +4579,10 @@ async function closeServer({
   });
 }
 
-// src/utils/auth/oauth-errors.ts
-var SENSITIVE_OAUTH_FIELDS = [
-  "access_token",
-  "refresh_token",
-  "id_token",
-  "client_secret",
-  "code_verifier",
-  "code_challenge"
-];
-function getErrorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-function toCamelCase(field) {
-  return field.replace(
-    /_([a-z])/g,
-    (_match, letter) => letter.toUpperCase()
-  );
-}
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-var sensitiveOauthFieldPattern = Array.from(
-  new Set(
-    SENSITIVE_OAUTH_FIELDS.flatMap((field) => [field, toCamelCase(field)])
-  )
-).map(escapeRegExp).join("|");
-var sensitiveQueryParamPattern = new RegExp(
-  `([?&])(${sensitiveOauthFieldPattern})(=)[^&#\\s"'<>]*`,
-  "gi"
-);
-function redactSensitiveOauthErrorMessage(message) {
-  return message.replace(
-    sensitiveQueryParamPattern,
-    (_match, prefix, key, separator) => `${prefix}${key}${separator}[REDACTED]`
-  ).replace(
-    new RegExp(`"(${sensitiveOauthFieldPattern})"(\\s*:\\s*)"[^"]*"`, "g"),
-    (_match, key, separator) => `"${key}"${separator}"[REDACTED]"`
-  );
-}
-function toRedactedOauthError(error) {
-  const message = redactSensitiveOauthErrorMessage(getErrorMessage(error));
-  if (error instanceof ZapierCliValidationError) {
-    return new ZapierCliValidationError(message);
-  }
-  if (error instanceof Error) {
-    const redactedError = new Error(message);
-    redactedError.name = error.name;
-    return redactedError;
-  }
-  return new ZapierCliValidationError(message);
-}
-
 // src/utils/auth/account-auth.ts
 var LEGACY_JWT_UPGRADE_PROMPT = "We're upgrading your login to client credentials for a simpler, more reliable experience and to support future security controls. Older Zapier SDK/CLI versions on this machine may stop working after the upgrade. Continue?";
 var SIGNUP_RECOVERY_MESSAGE = "Restart `zapier-sdk signup` to generate a fresh signup URL and try again.";
+var HEADLESS_LOGIN_RECOVERY_MESSAGE = "Restart `zapier-sdk login --headless` to generate a fresh login URL and try again.";
 var HEADLESS_SIGNUP_RECOVERY_MESSAGE = "Restart `zapier-sdk signup --headless` to generate a fresh signup URL and try again.";
 function getEntryPointLabel(entryPoint) {
   return entryPoint === "signup" ? "Signup" : "Login";
@@ -4411,7 +4702,8 @@ Logging out will delete these credentials and may interrupt other Zapier SDK or
 Log out and ${getActiveCredentialsAction(entryPoint)}?`
     }) : promptlessCredentialResetError(activeCredentials);
     if (!confirmed) {
-      console.log(`${flowLabel} cancelled.`);
+      process.stderr.write(`${flowLabel} cancelled.
+`);
       return false;
     }
     try {
@@ -4430,7 +4722,8 @@ Log out and ${getActiveCredentialsAction(entryPoint)}?`
         message: `${flowLabel} cleanup failed. Reset local session state and continue?`
       });
       if (!reset) {
-        console.log(`${flowLabel} cancelled.`);
+        process.stderr.write(`${flowLabel} cancelled.
+`);
         return false;
       }
       await deleteStoredClientCredentials({
@@ -4444,7 +4737,8 @@ Log out and ${getActiveCredentialsAction(entryPoint)}?`
       message: LEGACY_JWT_UPGRADE_PROMPT
     }) : promptlessLegacyJwtUpgradeError();
     if (!confirmed) {
-      console.log(`${flowLabel} cancelled.`);
+      process.stderr.write(`${flowLabel} cancelled.
+`);
       return false;
     }
   }
@@ -4539,7 +4833,14 @@ async function runOauthForEntryPoint({
     );
   }
   return runOauthWithRedaction(
-    () => runLoginOauthFlow({ timeoutMs, pkceCredentials, baseUrl: baseUrl2 })
+    () => runLoginOauthFlow({
+      timeoutMs,
+      pkceCredentials,
+      baseUrl: baseUrl2,
+      headless,
+      interactive,
+      recoveryMessage: headless ? HEADLESS_LOGIN_RECOVERY_MESSAGE : void 0
+    })
   );
 }
 async function runAccountAuth({
@@ -4551,6 +4852,7 @@ async function runAccountAuth({
   const interactive = !resolveNonInteractive(options);
   const resolvedCredentials = await sdk.context.resolveCredentials();
   const pkceCredentials = toPkceCredentials(resolvedCredentials);
+  const headless = options.headless === true;
   const credentialsBaseUrl2 = await resolveCredentialsBaseUrl({
     ...sdk.context,
     resolvedCredentials
@@ -4580,7 +4882,7 @@ async function runAccountAuth({
     timeoutMs: timeoutSeconds * 1e3,
     pkceCredentials,
     baseUrl: credentialsBaseUrl2,
-    headless: options.headless === true,
+    headless,
     interactive
   });
   const scopedApi = getOrCreateApiClient({
@@ -4588,9 +4890,10 @@ async function runAccountAuth({
     baseUrl: credentialsBaseUrl2
   });
   const profile = await getProfile(scopedApi);
-  console.log(getProfileMessage(entryPoint, profile.email));
-  console.log(
-    "\nGenerating credentials so this machine can make authenticated requests on your behalf."
+  process.stderr.write(`${getProfileMessage(entryPoint, profile.email)}
+`);
+  process.stderr.write(
+    "\nGenerating credentials so this machine can make authenticated requests on your behalf.\n"
   );
   const credentialName = providedName ?? await resolveCredentialName({
     email: profile.email,
@@ -4606,11 +4909,12 @@ async function runAccountAuth({
     useApprovals,
     cleanupLogPrefix: entryPoint
   });
-  console.log(
-    `\u2705 Credentials "${credentialName}" created and set as default. You are ready to use the Zapier SDK.`
+  process.stderr.write(
+    `\u2705 Credentials "${credentialName}" created and set as default. You are ready to use the Zapier SDK.
+`
   );
   if (useApprovals) {
-    console.log("\u{1F510} Approvals are enabled for these credentials.");
+    process.stderr.write("\u{1F510} Approvals are enabled for these credentials.\n");
   }
   emitAccountAuthSuccess({ sdk, profile, clientId });
 }
@@ -4629,7 +4933,10 @@ var LoginSchema = z.object({
   skipPrompts: z.boolean().optional().meta({
     deprecated: true,
     deprecationMessage: "Use --non-interactive instead."
-  })
+  }),
+  headless: z.boolean().optional().describe(
+    "Use when logging in from a machine that has no browser. Prints a login link to open elsewhere, then accepts the pasted loopback callback URL."
+  )
 }).describe("Log in to Zapier to access your account");
 
 // src/plugins/login/index.ts
@@ -7261,7 +7568,7 @@ function buildBoxLines(message) {
 // package.json with { type: 'json' }
 var package_default2 = {
   name: "@zapier/zapier-sdk-cli",
-  version: "0.60.0"};
+  version: "0.61.1"};
 
 // src/sdk.ts
 injectCliLogin(login_exports);
@@ -7338,6 +7645,9 @@ function createZapierCliSdk2(options = {}) {
 
 // src/utils/extensions.ts
 var ENV_VAR = "ZAPIER_SDK_EXTENSIONS";
+function isModelPlugin(value) {
+  return typeof value === "object" && value !== null && "pluginType" in value && typeof value.pluginType === "string";
+}
 async function resolveExtensions() {
   const seen = /* @__PURE__ */ new Set();
   const specs = readEnvSpecs().filter((spec) => {
@@ -7370,8 +7680,11 @@ function normalizeExtension(exported) {
   if (typeof exported === "function") {
     return [exported];
   }
+  if (isModelPlugin(exported)) {
+    return [exported];
+  }
   if (Array.isArray(exported)) {
-    if (exported.every((e) => typeof e === "function")) {
+    if (exported.every((e) => typeof e === "function" || isModelPlugin(e))) {
       return exported;
     }
     return null;