@zapier/zapier-sdk-cli 0.52.10 → 0.53.0

package/dist/src/plugins/signup/index.d.ts

@@ -0,0 +1,25 @@
+import { type AccountAuthCliContext } from "../../utils/auth/account-auth";
+export declare const signupPlugin: (sdk: {
+    context: import("@zapier/zapier-sdk").EventEmissionContext;
+} & {
+    context: AccountAuthCliContext;
+} & {
+    context: {
+        meta: Record<string, import("@zapier/zapier-sdk").PluginMeta>;
+    };
+}) => {
+    signup: (options?: {
+        timeout?: string | undefined;
+        useApprovals?: boolean | undefined;
+        nonInteractive?: boolean | undefined;
+        skipPrompts?: boolean | undefined;
+        headless?: boolean | undefined;
+    } | undefined) => Promise<void>;
+} & {
+    context: {
+        meta: {
+            signup: import("@zapier/zapier-sdk").PluginMeta<unknown>;
+        };
+    };
+};
+export type SignupPluginProvides = ReturnType<typeof signupPlugin>;

package/dist/src/plugins/signup/index.js

@@ -0,0 +1,12 @@
+import { createPluginMethod, definePlugin, } from "@zapier/zapier-sdk";
+import { runAccountAuth, } from "../../utils/auth/account-auth";
+import { SignupSchema } from "./schemas";
+export const signupPlugin = definePlugin((sdk) => createPluginMethod(sdk, {
+    name: "signup",
+    categories: ["account"],
+    inputSchema: SignupSchema,
+    supportsJsonOutput: false,
+    handler: async ({ sdk, options }) => {
+        await runAccountAuth({ sdk, options, entryPoint: "signup" });
+    },
+}));

package/dist/src/plugins/signup/schemas.d.ts

@@ -0,0 +1,9 @@
+import { z } from "zod";
+export declare const SignupSchema: z.ZodObject<{
+    timeout: z.ZodOptional<z.ZodString>;
+    useApprovals: z.ZodOptional<z.ZodBoolean>;
+    nonInteractive: z.ZodOptional<z.ZodBoolean>;
+    skipPrompts: z.ZodOptional<z.ZodBoolean>;
+    headless: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type SignupOptions = z.infer<typeof SignupSchema>;

package/dist/src/plugins/signup/schemas.js

@@ -0,0 +1,26 @@
+import { z } from "zod";
+export const SignupSchema = z
+    .object({
+    timeout: z
+        .string()
+        .optional()
+        .describe("Signup timeout in seconds (default: 300)"),
+    useApprovals: z
+        .boolean()
+        .optional()
+        .describe("Require approvals for actions performed with these credentials"),
+    nonInteractive: z
+        .boolean()
+        .optional()
+        .describe("Skip interactive prompts. Uses defaults where possible; errors instead of prompting when input is required. Useful in CI, piped output, or environments where TTY detection is unreliable."),
+    /** @deprecated Use `nonInteractive` instead. */
+    skipPrompts: z.boolean().optional().meta({
+        deprecated: true,
+        deprecationMessage: "Use --non-interactive instead.",
+    }),
+    headless: z
+        .boolean()
+        .optional()
+        .describe("Use when signing up from a machine that has no browser. Prints a signup link to open elsewhere, then accepts the pasted loopback callback URL."),
+})
+    .describe("Set up Zapier account access and SDK credentials");

package/dist/src/plugins/signup/test-harness.d.ts

@@ -0,0 +1,34 @@
+import { type EventEmissionContext, type EventEmissionProvides } from "@zapier/zapier-sdk";
+import type { vi } from "vitest";
+import type { CliContext } from "../../utils/auth/account-auth";
+import { type SignupPluginProvides } from "./index";
+type Vi = typeof vi;
+type EventEmit = EventEmissionProvides["context"]["eventEmission"]["emit"];
+type SignupTestContext = CliContext & EventEmissionContext;
+interface SpyWithCalls {
+    mock: {
+        calls: unknown[][];
+    };
+}
+export interface SignupTestTtyState {
+    stdinIsTty: boolean | undefined;
+    stdoutIsTty: boolean | undefined;
+}
+export declare function getSignupTestTty(): SignupTestTtyState;
+export declare function setSignupTestTty(value: boolean): void;
+export declare function restoreSignupTestTty(state: SignupTestTtyState): void;
+export declare function getSignupTestOutput(spy: SpyWithCalls): string;
+export declare function getSignupTestLogs(spy: SpyWithCalls): string;
+export declare function existingSignupCredentials(): {
+    name: string;
+    clientId: string;
+    createdAt: number;
+    scopes: string[];
+    baseUrl: string;
+};
+export declare function buildSignupTestContext(vi: Vi, mockEmit?: EventEmit): SignupTestContext;
+export declare function createSignupTestSdk({ vi, context, }: {
+    vi: Vi;
+    context?: SignupTestContext;
+}): SignupPluginProvides;
+export {};

package/dist/src/plugins/signup/test-harness.js

@@ -0,0 +1,74 @@
+import { createSdk, } from "@zapier/zapier-sdk";
+import { signupPlugin } from "./index";
+export function getSignupTestTty() {
+    return {
+        stdinIsTty: process.stdin.isTTY,
+        stdoutIsTty: process.stdout.isTTY,
+    };
+}
+export function setSignupTestTty(value) {
+    const descriptor = { value, configurable: true, writable: true };
+    Object.defineProperty(process.stdin, "isTTY", descriptor);
+    Object.defineProperty(process.stdout, "isTTY", descriptor);
+}
+export function restoreSignupTestTty(state) {
+    Object.defineProperty(process.stdin, "isTTY", {
+        value: state.stdinIsTty,
+        configurable: true,
+        writable: true,
+    });
+    Object.defineProperty(process.stdout, "isTTY", {
+        value: state.stdoutIsTty,
+        configurable: true,
+        writable: true,
+    });
+}
+export function getSignupTestOutput(spy) {
+    return spy.mock.calls.map((call) => String(call[0])).join("");
+}
+export function getSignupTestLogs(spy) {
+    return spy.mock.calls.map((call) => call.map(String).join(" ")).join("\n");
+}
+export function existingSignupCredentials() {
+    return {
+        name: "existing",
+        clientId: "old-id",
+        createdAt: 1,
+        scopes: ["external"],
+        baseUrl: "https://zapier.com",
+    };
+}
+async function emptyApiResult() {
+    return undefined;
+}
+function createSignupTestApi() {
+    return {
+        get: emptyApiResult,
+        post: emptyApiResult,
+        put: emptyApiResult,
+        patch: emptyApiResult,
+        delete: emptyApiResult,
+        poll: emptyApiResult,
+        fetch: () => Promise.resolve(new Response()),
+    };
+}
+export function buildSignupTestContext(vi, mockEmit = () => undefined) {
+    return {
+        resolveCredentials: vi.fn().mockResolvedValue(undefined),
+        api: createSignupTestApi(),
+        eventEmission: {
+            transport: { emit: vi.fn(), close: vi.fn() },
+            config: { enabled: true },
+            emit: mockEmit,
+            createBaseEvent: vi.fn().mockResolvedValue({}),
+            flush: vi.fn().mockResolvedValue(undefined),
+            close: vi.fn().mockResolvedValue(undefined),
+        },
+        hooks: { onMethodEnd: vi.fn() },
+    };
+}
+export function createSignupTestSdk({ vi, context = buildSignupTestContext(vi), }) {
+    return createSdk()
+        .addPlugin(() => ({ context }))
+        .addPlugin(signupPlugin);
+}

package/dist/src/sdk.js

@@ -1,6 +1,6 @@
 import * as cliLogin from "./login";
-import { createZapierSdk, injectCliLogin, } from "@zapier/zapier-sdk";
-import { loginPlugin, logoutPlugin, mcpPlugin, bundleCodePlugin, getLoginConfigPathPlugin, addPlugin, generateAppTypesPlugin, buildManifestPlugin, feedbackPlugin, curlPlugin, cliOverridesPlugin, initPlugin,
+import { addPlugin, createZapierSdkStack, injectCliLogin, } from "@zapier/zapier-sdk";
+import { loginPlugin, signupPlugin, logoutPlugin, mcpPlugin, bundleCodePlugin, getLoginConfigPathPlugin, addAppsPlugin, generateAppTypesPlugin, buildManifestPlugin, feedbackPlugin, curlPlugin, cliOverridesPlugin, initPlugin,
 // drainTriggerInboxForeverCliPlugin is experimental — registered only
 // in `./experimental.ts`. See the "Experimental gating" section in
 // `docs/design/2026-05-01-triggers-in-sdk.md`.
@@ -19,37 +19,49 @@ export function createZapierCliSdk(options = {}) {
     const extensionsContextPlugin = () => ({
         context: { extensions },
     });
-    let chain = createZapierSdk({
+    const sdk = createZapierSdkStack({
         ...sdkOptions,
         eventEmission: { ...sdkOptions.eventEmission, callContext: "cli" },
         callerPackage: { name: packageJson.name, version: packageJson.version },
     })
-        .addPlugin(extensionsContextPlugin)
-        .addPlugin(generateAppTypesPlugin)
-        .addPlugin(buildManifestPlugin)
-        .addPlugin(bundleCodePlugin)
-        .addPlugin(getLoginConfigPathPlugin)
-        .addPlugin(addPlugin)
-        .addPlugin(feedbackPlugin)
-        .addPlugin(curlPlugin)
-        .addPlugin(initPlugin)
-        .addPlugin(mcpPlugin)
-        .addPlugin(loginPlugin)
-        .addPlugin(logoutPlugin)
-        .addPlugin(cliOverridesPlugin);
+        .use(extensionsContextPlugin)
+        .use(generateAppTypesPlugin)
+        .use(buildManifestPlugin)
+        .use(bundleCodePlugin)
+        .use(getLoginConfigPathPlugin)
+        .use(addAppsPlugin)
+        .use(feedbackPlugin)
+        .use(curlPlugin)
+        .use(initPlugin)
+        .use(mcpPlugin)
+        .use(loginPlugin)
+        .use(signupPlugin)
+        .use(logoutPlugin)
+        // cliOverridesPlugin patches existing meta entries (e.g. flags `fetch`
+        // as deprecated) without re-registering the method. `.use` throws on
+        // meta-key collisions by default, so the intent has to be explicit.
+        .use(cliOverridesPlugin, { override: true })
+        .toSdk();
     // Construct extensions defensively. The loader (`utils/extensions.ts`)
     // already isolates *load*-time failures (failed dynamic imports);
     // here we cover the second failure mode — a successfully-imported
     // plugin that throws during construction (bad context lookup, schema
-    // build error, composePlugins collision, etc.). Honors the
-    // design-doc promise that "a broken extension does not kill the CLI."
+    // build error, plugin collision, etc.). Honors the design-doc promise
+    // that "a broken extension does not kill the CLI."
+    //
+    // `addPlugin` mutates `sdk` in place and `mergeContribution` is
+    // atomic (validate-all-then-apply), so a failed extension leaves
+    // the sdk in its prior consistent state. Base plugins run exactly
+    // once regardless of how many extensions are installed, so the
+    // `eventEmission` startup payload reaches the wire once per
+    // process.
     for (const ext of extensions) {
         try {
-            chain = chain.addPlugin(ext);
+            addPlugin(sdk, ext);
         }
         catch (err) {
             console.warn(`Extension plugin failed to construct: ${err.message}; skipping.`);
         }
     }
-    return chain;
+    return sdk;
 }

package/dist/src/types/sdk.d.ts

@@ -2,4 +2,5 @@ import type { ZapierSdk } from "@zapier/zapier-sdk";
 import type { BuildManifestPluginProvides } from "../plugins/buildManifest";
 import type { FeedbackPluginProvides } from "../plugins/feedback";
 import type { GenerateAppTypesPluginProvides } from "../plugins/generateAppTypes";
-export type ZapierSdkCli = ZapierSdk & BuildManifestPluginProvides & FeedbackPluginProvides & GenerateAppTypesPluginProvides;
+import type { SignupPluginProvides } from "../plugins/signup";
+export type ZapierSdkCli = ZapierSdk & BuildManifestPluginProvides & FeedbackPluginProvides & GenerateAppTypesPluginProvides & SignupPluginProvides;

package/dist/src/utils/auth/account-auth.d.ts

@@ -0,0 +1,32 @@
+import { type ApiClient, type EventEmissionProvides, type ResolvedCredentials } from "@zapier/zapier-sdk";
+export type AccountAuthEntryPoint = "login" | "signup";
+export interface AccountAuthOptions {
+    timeout?: string;
+    useApprovals?: boolean;
+    nonInteractive?: boolean;
+    /** @deprecated Use `nonInteractive` instead. */
+    skipPrompts?: boolean;
+    headless?: boolean;
+}
+export interface AccountAuthCliContext {
+    session_id?: string | null;
+    selected_api?: string | null;
+    app_id?: number | null;
+    app_version_id?: number | null;
+    resolveCredentials: () => Promise<ResolvedCredentials | undefined>;
+    api: ApiClient;
+    options?: {
+        baseUrl?: string;
+        credentials?: unknown;
+    };
+}
+export type CliContext = AccountAuthCliContext;
+interface RunAccountAuthOptions<TOptions extends AccountAuthOptions> {
+    sdk: EventEmissionProvides & {
+        context: AccountAuthCliContext;
+    };
+    options: TOptions;
+    entryPoint: AccountAuthEntryPoint;
+}
+export declare function runAccountAuth<TOptions extends AccountAuthOptions>({ sdk, options, entryPoint, }: RunAccountAuthOptions<TOptions>): Promise<void>;
+export {};

package/dist/src/utils/auth/account-auth.js

@@ -0,0 +1,265 @@
+import { hostname } from "node:os";
+import inquirer from "inquirer";
+import { buildApplicationLifecycleEvent, getOrCreateApiClient, isCredentialsObject, } from "@zapier/zapier-sdk";
+import { revokeCredentials } from "../../login/credentials-revoke";
+import { deleteStoredClientCredentials, getActiveCredentials, } from "../../login/credentials-store";
+import { clearLegacyJwtState, hasLegacyJwtConfig, } from "../../login/legacy-jwt";
+import { resolveCredentialsBaseUrl } from "../../plugins/auth/credentials-base-url";
+import { resolveNonInteractive } from "../non-interactive";
+import { ZapierCliUserCancellationError, ZapierCliValidationError, } from "../errors";
+import { EMPTY_POLICY, setupClientCredentials } from "./client-credentials";
+import { runLoginOauthFlow, runSignupOauthFlow, } from "./oauth-flow";
+import { toRedactedOauthError } from "./oauth-errors";
+const LEGACY_JWT_UPGRADE_PROMPT = "We're upgrading your login to client credentials for a simpler, more reliable experience and to support future security controls. Older Zapier SDK/CLI versions on this machine may stop working after the upgrade. Continue?";
+const SIGNUP_RECOVERY_MESSAGE = "Restart `zapier-sdk signup` to generate a fresh signup URL and try again.";
+const HEADLESS_SIGNUP_RECOVERY_MESSAGE = "Restart `zapier-sdk signup --headless` to generate a fresh signup URL and try again.";
+function getEntryPointLabel(entryPoint) {
+    return entryPoint === "signup" ? "Signup" : "Login";
+}
+function getActiveCredentialsAction(entryPoint) {
+    return entryPoint === "signup" ? "continue signup" : "log in again";
+}
+function getCredentialsPromptMessage(entryPoint) {
+    return entryPoint === "signup"
+        ? "Enter a name to identify these credentials:"
+        : "Enter a name to identify them:";
+}
+function getProfileMessage(entryPoint, email) {
+    return entryPoint === "signup"
+        ? `👤 Authenticated as ${email}`
+        : `👤 Logged in as ${email}`;
+}
+function defaultCredentialsName(email) {
+    return `${email}@${hostname()}`;
+}
+function validateCredentialsName(name) {
+    const trimmedName = name.trim();
+    if (!trimmedName)
+        throw new ZapierCliValidationError("Name cannot be empty");
+    return trimmedName;
+}
+async function promptCredentialsName({ email, promptMessage, }) {
+    const { credentialName } = await inquirer.prompt([
+        {
+            type: "input",
+            name: "credentialName",
+            message: promptMessage,
+            default: defaultCredentialsName(email),
+            validate: (input) => {
+                try {
+                    validateCredentialsName(input);
+                    return true;
+                }
+                catch (err) {
+                    return err instanceof Error ? err.message : String(err);
+                }
+            },
+        },
+    ]);
+    return validateCredentialsName(credentialName);
+}
+function resolveDefaultCredentialsName({ email, }) {
+    return validateCredentialsName(defaultCredentialsName(email));
+}
+function toPkceCredentials(credentials) {
+    if (credentials &&
+        isCredentialsObject(credentials) &&
+        !("clientSecret" in credentials)) {
+        return {
+            type: "pkce",
+            clientId: credentials.clientId,
+            baseUrl: credentials.baseUrl,
+            scope: credentials.scope,
+        };
+    }
+    return undefined;
+}
+function parseTimeoutSeconds(timeout) {
+    if (timeout === undefined)
+        return 300;
+    const timeoutSeconds = Number(timeout);
+    if (!Number.isInteger(timeoutSeconds) || timeoutSeconds <= 0) {
+        throw new ZapierCliValidationError("Timeout must be a positive integer (seconds).");
+    }
+    return timeoutSeconds;
+}
+async function promptConfirm({ message, defaultValue, }) {
+    const { confirmed } = await inquirer.prompt([
+        { type: "confirm", name: "confirmed", message, default: defaultValue },
+    ]);
+    return confirmed;
+}
+function promptlessCredentialResetError(credentials) {
+    throw new ZapierCliValidationError(`Already logged in as "${credentials.name}". Run \`logout\` first or use an interactive terminal to re-authenticate.`);
+}
+function promptlessLegacyJwtUpgradeError() {
+    throw new ZapierCliValidationError("Legacy JWT login detected. Run `logout` first or use an interactive terminal to migrate to client credentials.");
+}
+async function clearExistingAuthState({ sdk, baseUrl, interactive, entryPoint, }) {
+    const activeCredentials = getActiveCredentials({ baseUrl });
+    const flowLabel = getEntryPointLabel(entryPoint);
+    if (activeCredentials) {
+        const confirmed = interactive
+            ? await promptConfirm({
+                defaultValue: false,
+                message: `You are already logged in as "${activeCredentials.name}".\n` +
+                    "Logging out will delete these credentials and may interrupt other Zapier SDK or CLI sessions using them.\n" +
+                    `Log out and ${getActiveCredentialsAction(entryPoint)}?`,
+            })
+            : promptlessCredentialResetError(activeCredentials);
+        if (!confirmed) {
+            console.log(`${flowLabel} cancelled.`);
+            return false;
+        }
+        try {
+            await revokeCredentials({
+                api: sdk.context.api,
+                credentials: activeCredentials,
+            });
+        }
+        catch {
+            if (!interactive) {
+                throw new ZapierCliValidationError(`${flowLabel} cleanup failed and cannot be reset without confirmation. Re-run with an interactive terminal.`);
+            }
+            const reset = await promptConfirm({
+                defaultValue: false,
+                message: `${flowLabel} cleanup failed. Reset local session state and continue?`,
+            });
+            if (!reset) {
+                console.log(`${flowLabel} cancelled.`);
+                return false;
+            }
+            await deleteStoredClientCredentials({
+                name: activeCredentials.name,
+                baseUrl: activeCredentials.baseUrl,
+            });
+        }
+    }
+    else if (hasLegacyJwtConfig()) {
+        const confirmed = interactive
+            ? await promptConfirm({
+                defaultValue: true,
+                message: LEGACY_JWT_UPGRADE_PROMPT,
+            })
+            : promptlessLegacyJwtUpgradeError();
+        if (!confirmed) {
+            console.log(`${flowLabel} cancelled.`);
+            return false;
+        }
+    }
+    return true;
+}
+async function getProfile(api) {
+    return api.get("/zapier/api/v4/profile/", {
+        authRequired: true,
+    });
+}
+async function saveClientCredentials({ api, name, credentialsBaseUrl, useApprovals, cleanupLogPrefix, }) {
+    await setupClientCredentials({
+        api,
+        name,
+        credentialsBaseUrl,
+        ...(useApprovals && { policy: EMPTY_POLICY }),
+    });
+    try {
+        await clearLegacyJwtState();
+    }
+    catch (err) {
+        console.error(`[${cleanupLogPrefix}] Best-effort legacy JWT cleanup failed:`, err);
+    }
+}
+function emitAccountAuthSuccess({ sdk, profile, }) {
+    sdk.context.eventEmission.emit("platform.sdk.ApplicationLifecycleEvent", buildApplicationLifecycleEvent({ lifecycle_event_type: "login_success" }, {
+        customuser_id: profile.user_id,
+        account_id: profile.roles[0]?.account_id ?? null,
+    }));
+}
+function emitSignupSuccess({ sdk, }) {
+    // `signup_success` tracks a valid signup OAuth callback being accepted.
+    // It does not mean a new Zapier account was created or local credentials were provisioned.
+    sdk.context.eventEmission.emit("platform.sdk.ApplicationLifecycleEvent", buildApplicationLifecycleEvent({ lifecycle_event_type: "signup_success" }));
+}
+async function runOauthWithRedaction(runOauth) {
+    try {
+        return await runOauth();
+    }
+    catch (error) {
+        if (error instanceof ZapierCliUserCancellationError)
+            throw error;
+        throw toRedactedOauthError(error);
+    }
+}
+async function runOauthForEntryPoint({ sdk, entryPoint, timeoutMs, pkceCredentials, baseUrl, headless, interactive, }) {
+    if (entryPoint === "signup") {
+        return runOauthWithRedaction(() => runSignupOauthFlow({
+            timeoutMs,
+            pkceCredentials,
+            baseUrl,
+            headless,
+            interactive,
+            recoveryMessage: headless
+                ? HEADLESS_SIGNUP_RECOVERY_MESSAGE
+                : SIGNUP_RECOVERY_MESSAGE,
+            onProgress: (event) => {
+                if (event.type === "callback_accepted") {
+                    emitSignupSuccess({ sdk });
+                }
+            },
+        }));
+    }
+    return runOauthWithRedaction(() => runLoginOauthFlow({ timeoutMs, pkceCredentials, baseUrl }));
+}
+export async function runAccountAuth({ sdk, options, entryPoint, }) {
+    const timeoutSeconds = parseTimeoutSeconds(options.timeout);
+    const interactive = !resolveNonInteractive(options);
+    const resolvedCredentials = await sdk.context.resolveCredentials();
+    const pkceCredentials = toPkceCredentials(resolvedCredentials);
+    const credentialsBaseUrl = await resolveCredentialsBaseUrl({
+        ...sdk.context,
+        resolvedCredentials,
+    });
+    if (!(await clearExistingAuthState({
+        sdk,
+        baseUrl: credentialsBaseUrl,
+        interactive,
+        entryPoint,
+    }))) {
+        return;
+    }
+    const { accessToken } = await runOauthForEntryPoint({
+        sdk,
+        entryPoint,
+        timeoutMs: timeoutSeconds * 1000,
+        pkceCredentials,
+        baseUrl: credentialsBaseUrl,
+        headless: options.headless === true,
+        interactive,
+    });
+    const scopedApi = getOrCreateApiClient({
+        credentials: accessToken,
+        baseUrl: credentialsBaseUrl,
+    });
+    const profile = await getProfile(scopedApi);
+    console.log(getProfileMessage(entryPoint, profile.email));
+    console.log("\nGenerating credentials so this machine can make authenticated requests on your behalf.");
+    const resolveCredentialsName = interactive
+        ? ({ email }) => promptCredentialsName({
+            email,
+            promptMessage: getCredentialsPromptMessage(entryPoint),
+        })
+        : resolveDefaultCredentialsName;
+    const credentialName = await resolveCredentialsName({ email: profile.email });
+    const useApprovals = options.useApprovals === true;
+    await saveClientCredentials({
+        api: scopedApi,
+        name: credentialName,
+        credentialsBaseUrl,
+        useApprovals,
+        cleanupLogPrefix: entryPoint,
+    });
+    console.log(`✅ Credentials "${credentialName}" created and set as default. You are ready to use the Zapier SDK.`);
+    if (useApprovals) {
+        console.log("🔐 Approvals are enabled for these credentials.");
+    }
+    emitAccountAuthSuccess({ sdk, profile });
+}

package/dist/src/utils/auth/oauth-callback.d.ts

@@ -0,0 +1,6 @@
+import type { OauthTransaction } from "./oauth-transaction";
+export declare function getCallbackCode({ callbackUrl, transaction, recoveryMessage, }: {
+    callbackUrl: string;
+    transaction: Pick<OauthTransaction, "redirectUri" | "state">;
+    recoveryMessage?: string;
+}): string;

package/dist/src/utils/auth/oauth-callback.js

@@ -0,0 +1,28 @@
+import { ZapierCliValidationError } from "../errors";
+export function getCallbackCode({ callbackUrl, transaction, recoveryMessage, }) {
+    let parsed;
+    try {
+        parsed = new URL(callbackUrl.trim());
+    }
+    catch {
+        throw new ZapierCliValidationError("Paste the final OAuth callback URL from your browser.");
+    }
+    const expected = new URL(transaction.redirectUri);
+    if (parsed.protocol !== "http:" ||
+        parsed.hostname !== expected.hostname ||
+        parsed.pathname !== expected.pathname ||
+        parsed.port !== expected.port) {
+        throw new ZapierCliValidationError(`Expected the final OAuth callback URL to start with ${transaction.redirectUri}.`);
+    }
+    if (parsed.searchParams.get("state") !== transaction.state) {
+        throw new ZapierCliValidationError(`OAuth state mismatch.${recoveryMessage ? ` ${recoveryMessage}` : ""}`);
+    }
+    if (parsed.searchParams.has("error")) {
+        throw new ZapierCliValidationError(`Authorization denied: ${parsed.searchParams.get("error_description") ?? parsed.searchParams.get("error")}.${recoveryMessage ? ` ${recoveryMessage}` : ""}`);
+    }
+    const code = parsed.searchParams.get("code");
+    if (!code) {
+        throw new ZapierCliValidationError("No authorization code found in the pasted callback URL.");
+    }
+    return code;
+}

package/dist/src/utils/auth/oauth-errors.d.ts

@@ -0,0 +1,2 @@
+export declare function redactSensitiveOauthErrorMessage(message: string): string;
+export declare function toRedactedOauthError(error: unknown): Error;

package/dist/src/utils/auth/oauth-errors.js

@@ -0,0 +1,39 @@
+import { ZapierCliValidationError } from "../errors";
+const SENSITIVE_OAUTH_FIELDS = [
+    "access_token",
+    "refresh_token",
+    "id_token",
+    "client_secret",
+    "code_verifier",
+    "code_challenge",
+];
+function getErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function toCamelCase(field) {
+    return field.replace(/_([a-z])/g, (_match, letter) => letter.toUpperCase());
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+const sensitiveOauthFieldPattern = Array.from(new Set(SENSITIVE_OAUTH_FIELDS.flatMap((field) => [field, toCamelCase(field)])))
+    .map(escapeRegExp)
+    .join("|");
+const sensitiveQueryParamPattern = new RegExp(`([?&])(${sensitiveOauthFieldPattern})(=)[^&#\\s"'<>]*`, "gi");
+export function redactSensitiveOauthErrorMessage(message) {
+    return message
+        .replace(sensitiveQueryParamPattern, (_match, prefix, key, separator) => `${prefix}${key}${separator}[REDACTED]`)
+        .replace(new RegExp(`"(${sensitiveOauthFieldPattern})"(\\s*:\\s*)"[^"]*"`, "g"), (_match, key, separator) => `"${key}"${separator}"[REDACTED]"`);
+}
+export function toRedactedOauthError(error) {
+    const message = redactSensitiveOauthErrorMessage(getErrorMessage(error));
+    if (error instanceof ZapierCliValidationError) {
+        return new ZapierCliValidationError(message);
+    }
+    if (error instanceof Error) {
+        const redactedError = new Error(message);
+        redactedError.name = error.name;
+        return redactedError;
+    }
+    return new ZapierCliValidationError(message);
+}