@zapier/zapier-sdk-cli 0.59.1 → 0.59.2

package/dist/src/login/credentials-store.js

@@ -1,181 +0,0 @@
-import { createHash } from "crypto";
-import { getPassword, setPassword, deletePassword } from "cross-keychain";
-import { z } from "zod";
-import { DEFAULT_AUTH_BASE_URL, getConfig } from "./config";
-import { enqueue, getBackendInfo } from "./keychain";
-import { ZapierCliValidationError } from "../utils/errors";
-const SERVICE = "zapier-sdk-cli";
-const CREDENTIALS_KEY = "credentials";
-const REGISTRY_KEY = "credentialsRegistry";
-const CredentialsEntrySchema = z.object({
-    name: z.string(),
-    clientId: z.string(),
-    createdAt: z.number(),
-    scopes: z.array(z.string()),
-    baseUrl: z.string(),
-});
-function normalizeBaseUrl(baseUrl) {
-    return baseUrl ?? DEFAULT_AUTH_BASE_URL;
-}
-function keychainAccount(key) {
-    return createHash("sha256").update(key).digest("hex");
-}
-function buildKeychainKey(clientId, scopes, baseUrl) {
-    const sortedScopes = [...scopes].sort().join(",");
-    return `zapier-sdk/client-credentials-secret/${clientId}:${sortedScopes}:${baseUrl}`;
-}
-function findEntry(registry, name, baseUrl) {
-    return registry.find((e) => e.name === name && e.baseUrl === baseUrl);
-}
-function readRegistry() {
-    const stored = getConfig().get(REGISTRY_KEY);
-    if (!Array.isArray(stored))
-        return [];
-    return stored.flatMap((entry) => {
-        const result = CredentialsEntrySchema.safeParse(entry);
-        return result.success ? [result.data] : [];
-    });
-}
-export function getActiveCredentials(options) {
-    const name = getConfig().get(CREDENTIALS_KEY);
-    if (!name)
-        return undefined;
-    return findEntry(readRegistry(), name, normalizeBaseUrl(options?.baseUrl));
-}
-const MAX_CREDENTIAL_NAME_ATTEMPTS = 500;
-/**
- * Pick the first credential name not already present in `taken`. Returns
- * `baseName` if it is free, otherwise appends an incrementing `-1`, `-2`, …
- * suffix to the literal base — a base ending in a digit is left intact, so
- * `acme-1` collides into `acme-1-1`. Storing a credential under a name that
- * already exists locally silently replaces that entry (and deletes its
- * keychain secret), so non-interactive login uses this to avoid clobbering a
- * dormant credential of the same name.
- */
-export function firstAvailableCredentialName({ baseName, taken, }) {
-    if (!taken.has(baseName))
-        return baseName;
-    for (let i = 1; i <= MAX_CREDENTIAL_NAME_ATTEMPTS; i++) {
-        const candidate = `${baseName}-${i}`;
-        if (!taken.has(candidate))
-            return candidate;
-    }
-    throw new ZapierCliValidationError(`Could not find an available credential name for "${baseName}" after ${MAX_CREDENTIAL_NAME_ATTEMPTS} attempts.`);
-}
-/**
- * Resolve a locally-unique credential name for the given baseUrl. Local
- * credentials are keyed by (name, baseUrl), so name collisions — and the
- * suffixing that avoids them — are scoped per baseUrl.
- */
-export function resolveAvailableCredentialName({ baseName, baseUrl, }) {
-    const resolvedBaseUrl = normalizeBaseUrl(baseUrl);
-    const taken = new Set(readRegistry()
-        .filter((e) => e.baseUrl === resolvedBaseUrl)
-        .map((e) => e.name));
-    return firstAvailableCredentialName({ baseName, taken });
-}
-/**
- * Whether a credential with this exact (name, baseUrl) is already stored
- * locally. Used to reject an explicitly-supplied login name that would
- * otherwise silently overwrite a dormant credential of the same name.
- */
-export function credentialNameExists({ name, baseUrl, }) {
-    const resolvedBaseUrl = normalizeBaseUrl(baseUrl);
-    return readRegistry().some((e) => e.name === name && e.baseUrl === resolvedBaseUrl);
-}
-export async function storeClientCredentials({ name, clientId, clientSecret, scopes, baseUrl, }) {
-    if (!name || typeof name !== "string") {
-        throw new Error("storeClientCredentials: name is required");
-    }
-    if (!clientId || typeof clientId !== "string") {
-        throw new Error("storeClientCredentials: clientId is required");
-    }
-    if (!clientSecret || typeof clientSecret !== "string") {
-        throw new Error("storeClientCredentials: clientSecret is required");
-    }
-    if (!Array.isArray(scopes) || scopes.length === 0) {
-        throw new Error("storeClientCredentials: scopes must be a non-empty array");
-    }
-    const sortedScopes = [...scopes].sort();
-    const resolvedBaseUrl = normalizeBaseUrl(baseUrl);
-    const keychainKey = buildKeychainKey(clientId, sortedScopes, resolvedBaseUrl);
-    const existingEntry = findEntry(readRegistry(), name, resolvedBaseUrl);
-    const existingKeychainKey = existingEntry
-        ? buildKeychainKey(existingEntry.clientId, existingEntry.scopes, existingEntry.baseUrl)
-        : undefined;
-    await enqueue(async () => {
-        await getBackendInfo();
-        await setPassword(SERVICE, keychainAccount(keychainKey), clientSecret);
-    });
-    const entry = {
-        name,
-        clientId,
-        createdAt: Date.now(),
-        scopes: sortedScopes,
-        baseUrl: resolvedBaseUrl,
-    };
-    const registry = readRegistry().filter((e) => !(e.name === name && e.baseUrl === resolvedBaseUrl));
-    registry.push(entry);
-    const cfg = getConfig();
-    cfg.set(REGISTRY_KEY, registry);
-    cfg.set(CREDENTIALS_KEY, name);
-    if (existingEntry && existingKeychainKey !== keychainKey) {
-        await deleteKeychainSecret(existingEntry);
-    }
-}
-export async function getStoredClientCredentials(options) {
-    const entry = options?.name
-        ? findEntry(readRegistry(), options.name, normalizeBaseUrl(options.baseUrl))
-        : getActiveCredentials(options);
-    if (!entry)
-        return undefined;
-    const keychainKey = buildKeychainKey(entry.clientId, entry.scopes, entry.baseUrl);
-    const clientSecret = await enqueue(async () => {
-        await getBackendInfo();
-        return getPassword(SERVICE, keychainAccount(keychainKey));
-    });
-    if (!clientSecret)
-        return undefined;
-    return {
-        type: "client_credentials",
-        clientId: entry.clientId,
-        clientSecret,
-        baseUrl: entry.baseUrl,
-        scope: [...entry.scopes].sort().join(" "),
-    };
-}
-function deleteRegistryEntry(registry, name, baseUrl) {
-    const idx = registry.findIndex((e) => e.name === name && e.baseUrl === baseUrl);
-    if (idx === -1)
-        return undefined;
-    const [removed] = registry.splice(idx, 1);
-    return removed;
-}
-function unsetMatchingCredentialsKey(cfg, name) {
-    const activeName = cfg.get(CREDENTIALS_KEY);
-    if (activeName === name && !readRegistry().some((e) => e.name === name)) {
-        cfg.delete(CREDENTIALS_KEY);
-    }
-}
-async function deleteKeychainSecret(entry) {
-    const keychainKey = buildKeychainKey(entry.clientId, entry.scopes, entry.baseUrl);
-    try {
-        await enqueue(async () => {
-            await getBackendInfo();
-            await deletePassword(SERVICE, keychainAccount(keychainKey));
-        });
-    }
-    catch {
-        // Best-effort; key may already be gone.
-    }
-}
-export async function deleteStoredClientCredentials({ name, baseUrl, }) {
-    const registry = readRegistry();
-    const removed = deleteRegistryEntry(registry, name, normalizeBaseUrl(baseUrl));
-    if (!removed)
-        return;
-    const cfg = getConfig();
-    cfg.set(REGISTRY_KEY, registry);
-    unsetMatchingCredentialsKey(cfg, name);
-    await deleteKeychainSecret(removed);
-}

package/dist/src/login/filesystem-cache.d.ts

@@ -1,25 +0,0 @@
-/**
- * Default filesystem + OS keychain cache adapter for the SDK.
- *
- * Conforms to the generic ZapierCache interface that the SDK defines.
- * Secrets go to the OS keychain via cross-keychain; non-secret values
- * and the identity metadata (expires_at, secret flag) go to the
- * existing zapier-sdk-cli Conf file. A proper-lockfile lock wraps the
- * exchange/persist critical section so N concurrent CLI invocations
- * collapse to a single network exchange.
- *
- * The SDK treats this (like any ZapierCache) as a cache — values may
- * disappear, and the caller must always be able to recreate them.
- */
-export declare function createCache(): {
-    get(key: string): Promise<{
-        value: string;
-        expiresAt?: number;
-    } | undefined>;
-    set(key: string, value: string, options?: {
-        secret?: boolean;
-        ttl?: number;
-    }): Promise<void>;
-    delete(key: string): Promise<void>;
-    withLock<T>(key: string, fn: () => Promise<T>): Promise<T>;
-};

package/dist/src/login/filesystem-cache.js

@@ -1,195 +0,0 @@
-/**
- * Default filesystem + OS keychain cache adapter for the SDK.
- *
- * Conforms to the generic ZapierCache interface that the SDK defines.
- * Secrets go to the OS keychain via cross-keychain; non-secret values
- * and the identity metadata (expires_at, secret flag) go to the
- * existing zapier-sdk-cli Conf file. A proper-lockfile lock wraps the
- * exchange/persist critical section so N concurrent CLI invocations
- * collapse to a single network exchange.
- *
- * The SDK treats this (like any ZapierCache) as a cache — values may
- * disappear, and the caller must always be able to recreate them.
- */
-import { createHash } from "crypto";
-import { dirname } from "path";
-import { existsSync, mkdirSync, writeFileSync } from "fs";
-import { getPassword, setPassword, deletePassword } from "cross-keychain";
-import * as lockfile from "proper-lockfile";
-import { getConfig } from "./index";
-import { enqueue, getBackendInfo } from "./keychain";
-const SERVICE = "zapier-sdk-cache";
-const CONFIG_KEY = "cache";
-const LOCK_UPDATE_MS = 5000;
-const LOCK_STALE_MS = 10000;
-const LOCK_RETRY_WAIT_MS = 100;
-const LOCK_RETRY_MAX_WAIT_MS = 1000;
-const LOCK_RETRY_COUNT = 120; // ~2 min worst-case wait under heavy contention
-/**
- * cross-keychain's native macOS backend restricts account names to
- * alphanumeric + . _ @ -. Hash arbitrary SDK keys to a hex digest to
- * stay inside that alphabet.
- */
-function keychainAccount(key) {
-    return createHash("sha256").update(key).digest("hex");
-}
-function readConfigMap() {
-    const cfg = getConfig();
-    const stored = cfg.get(CONFIG_KEY);
-    if (stored && typeof stored === "object") {
-        return stored;
-    }
-    return {};
-}
-function writeConfigMap(map) {
-    getConfig().set(CONFIG_KEY, map);
-}
-function entryIsExpired(entry) {
-    return entry.expires_at !== undefined && entry.expires_at <= Date.now();
-}
-export function createCache() {
-    return {
-        async get(key) {
-            const entry = readConfigMap()[key];
-            if (!entry)
-                return undefined;
-            if (entryIsExpired(entry))
-                return undefined;
-            if (entry.secret) {
-                const stored = await enqueue(async () => {
-                    await getBackendInfo();
-                    return getPassword(SERVICE, keychainAccount(key));
-                });
-                if (!stored) {
-                    // Config claims a secret exists but keychain doesn't have it.
-                    // Treat as a miss so the caller re-produces the value.
-                    return undefined;
-                }
-                return { value: stored, expiresAt: entry.expires_at };
-            }
-            if (entry.value === undefined)
-                return undefined;
-            return { value: entry.value, expiresAt: entry.expires_at };
-        },
-        async set(key, value, options) {
-            const secret = options?.secret ?? false;
-            const expiresAt = options?.ttl
-                ? Date.now() + options.ttl * 1000
-                : undefined;
-            if (secret) {
-                // Keychain first so a failed keychain write doesn't leave a
-                // dangling config pointer to a non-existent secret.
-                try {
-                    await enqueue(async () => {
-                        await getBackendInfo();
-                        await setPassword(SERVICE, keychainAccount(key), value);
-                    });
-                }
-                catch {
-                    // No keychain available (headless CI, sandboxed env). Skip
-                    // the config write too so subsequent reads cleanly miss.
-                    return;
-                }
-                const map = readConfigMap();
-                map[key] = { secret: true, expires_at: expiresAt };
-                try {
-                    writeConfigMap(map);
-                }
-                catch {
-                    // Config is read-only; orphan the keychain entry. Reads find
-                    // no config pointer and treat as a miss — self-healing on the
-                    // next successful write.
-                }
-            }
-            else {
-                const map = readConfigMap();
-                map[key] = { secret: false, value, expires_at: expiresAt };
-                try {
-                    writeConfigMap(map);
-                }
-                catch {
-                    // Nothing we can do; next write for this key is the next
-                    // chance to persist.
-                }
-            }
-        },
-        async delete(key) {
-            // Config first: an orphan keychain entry with no config pointer
-            // is unreachable via `get`, which is better than a stuck stale
-            // value if the keychain delete succeeds but config write fails.
-            const map = readConfigMap();
-            const entry = map[key];
-            if (entry) {
-                delete map[key];
-                try {
-                    writeConfigMap(map);
-                }
-                catch {
-                    // ignore
-                }
-            }
-            if (entry?.secret) {
-                try {
-                    await enqueue(async () => {
-                        await getBackendInfo();
-                        await deletePassword(SERVICE, keychainAccount(key));
-                    });
-                }
-                catch {
-                    // Best-effort
-                }
-            }
-        },
-        async withLock(_key, fn) {
-            // Global lock on the Conf file: Conf writes the whole file
-            // atomically, so a per-key lock wouldn't prevent sibling keys
-            // from clobbering each other. Fleet-wide serialization is fine
-            // at CLI scale (<1 request/second sustained per machine).
-            const cfg = getConfig();
-            const lockTarget = `${cfg.path}.cache-lock`;
-            try {
-                mkdirSync(dirname(lockTarget), { recursive: true });
-                if (!existsSync(lockTarget)) {
-                    writeFileSync(lockTarget, "");
-                }
-            }
-            catch {
-                // Can't create the lock file (read-only fs, no HOME, etc.).
-                // Proceed unsynchronized — correctness is maintained at the
-                // cost of possibly N exchanges in the worst case, same as
-                // before this MR.
-                return fn();
-            }
-            let release = null;
-            try {
-                release = await lockfile.lock(lockTarget, {
-                    stale: LOCK_STALE_MS,
-                    update: LOCK_UPDATE_MS,
-                    retries: {
-                        retries: LOCK_RETRY_COUNT,
-                        factor: 1.2,
-                        minTimeout: LOCK_RETRY_WAIT_MS,
-                        maxTimeout: LOCK_RETRY_MAX_WAIT_MS,
-                    },
-                });
-            }
-            catch {
-                // Lock is genuinely unavailable. Same graceful-degrade as above.
-                return fn();
-            }
-            try {
-                return await fn();
-            }
-            finally {
-                try {
-                    await release();
-                }
-                catch {
-                    // If release fails (e.g. the lockfile was reclaimed as stale
-                    // while we held it), there's nothing useful to do — the next
-                    // acquirer will handle it.
-                }
-            }
-        },
-    };
-}

package/dist/src/login/index.d.ts

@@ -1,110 +0,0 @@
-/**
- * Zapier SDK CLI Login Package
- *
- * Handles login, logout, token cache and refresh for Zapier SDK CLI.
- * Provides getToken function that can be optionally imported by zapier-sdk.
- */
-export { DEFAULT_AUTH_BASE_URL, getConfig } from "./config";
-export { createCache } from "./filesystem-cache";
-export { ZapierAuthenticationError } from "@zapier/zapier-sdk";
-export interface PkceCredentials {
-    type: "pkce";
-    clientId: string;
-    baseUrl?: string;
-    scope?: string;
-}
-export interface AuthOptions {
-    onEvent?: (event: {
-        type: string;
-        payload: Record<string, unknown>;
-        timestamp: number;
-    }) => void;
-    fetch?: typeof globalThis.fetch;
-    /** Credentials object from SDK. Contains clientId and resolved auth baseUrl. */
-    credentials?: PkceCredentials;
-    /** Enable debug logging for fetch requests and config operations. */
-    debug?: boolean;
-}
-export interface LoginData {
-    access_token: string;
-    refresh_token: string;
-    expires_in: number;
-}
-export declare const AUTH_MODE_HEADER = "X-Auth";
-/**
- * Gets the OAuth token endpoint URL.
- * baseUrl should be the auth base URL (e.g., https://zapier.com), already resolved by SDK.
- */
-export declare function getAuthTokenUrl(options?: {
-    baseUrl?: string;
-}): string;
-/**
- * Gets the OAuth authorization endpoint URL.
- * baseUrl should be the auth base URL (e.g., https://zapier.com), already resolved by SDK.
- */
-export declare function getAuthAuthorizeUrl(options?: {
-    baseUrl?: string;
-}): string;
-/**
- * Configuration needed for PKCE login flow.
- */
-export interface PkceLoginConfig {
-    clientId: string;
-    tokenUrl: string;
-    authorizeUrl: string;
-}
-/**
- * Gets all configuration needed for the PKCE login flow.
- * Credentials should have baseUrl already resolved by SDK.
- * baseUrl is a fallback used when credentials carry no baseUrl of their own.
- */
-export declare function getPkceLoginConfig(options?: {
-    credentials?: PkceCredentials;
-    baseUrl?: string;
-}): PkceLoginConfig;
-export type LoginStorageMode = "keychain" | "config";
-/**
- * Drops the cached Conf instance so the next getConfig() call re-initializes
- * from disk (including re-running the pre-existing file detection).
- */
-export declare function unloadConfig(): void;
-export declare function updateLogin(loginData: LoginData, options?: {
-    storage?: LoginStorageMode;
-    debug?: boolean;
-}): Promise<void>;
-/**
- * Main function exported for zapier-sdk to optionally use.
- * Returns the stored token from CLI configuration (with auto-refresh).
- *
- * Note: Environment variable handling (ZAPIER_CREDENTIALS, ZAPIER_TOKEN)
- * is done by the SDK before calling this function.
- *
- * Returns undefined if no valid token is found.
- */
-export declare function getToken(options?: AuthOptions): Promise<string | undefined>;
-/**
- * Gets the logged-in user information from JWT token.
- * Automatically refreshes token if expired.
- */
-export declare function getLoggedInUser(options?: AuthOptions): Promise<{
-    accountId: number;
-    customUserId: number;
-    email: string;
-}>;
-/**
- * Checks config to determine current cache mode without reading keychain.
- * Credential keys in config are ground truth — if login_jwt exists, we're in
- * config mode regardless of the marker. The marker only matters when no
- * credential keys are present (e.g. after logout or when using keychain).
- */
-export declare function getLoginStorageMode(): LoginStorageMode;
-/**
- * Clears stored login information.
- */
-export declare function logout(options?: Pick<AuthOptions, "onEvent">): Promise<void>;
-/**
- * Gets the path to the configuration file.
- */
-export declare function getConfigPath(): string;
-export { getStoredClientCredentials, getActiveCredentials, } from "./credentials-store";
-export { clearTokensFromKeychain } from "./keychain";