@zapier/zapier-sdk-cli 0.61.3 → 0.63.0

package/dist/experimental.mjs

@@ -1,5 +1,5 @@
 import * as jwt from 'jsonwebtoken';
-import { deletePassword, setPassword, getKeyring, getPassword } from 'cross-keychain';
+import { deletePassword, getKeyring, setPassword, getPassword } from 'cross-keychain';
 import Conf from 'conf';
 import * as fs from 'fs';
 import { promises, createWriteStream, existsSync, readdirSync, rmSync, mkdirSync, writeFileSync, copyFileSync, readFileSync } from 'fs';
@@ -7,7 +7,7 @@ import crypto, { createHash } from 'crypto';
 import * as path from 'path';
 import { resolve, join, dirname, basename, relative, extname } from 'path';
 import * as lockfile from 'proper-lockfile';
-import { definePlugin, createPluginMethod, OutputPropertySchema, ZapierBundleError, DEFAULT_CONFIG_PATH, ZapierValidationError, ZapierUnknownError, ZapierReleaseTriggerMessageSignal, getOrCreateApiClient, isPermanentHttpError, invalidateCachedToken, batch, toSnakeCase, ZapierAbortDrainSignal, isCredentialsObject, buildApplicationLifecycleEvent, AuthMechanism, ZapierAuthenticationError, ZapierError, DEPRECATION_NOTICE_EVENT } from '@zapier/zapier-sdk';
+import { definePlugin, createPluginMethod, OutputPropertySchema, ZapierBundleError, DEFAULT_CONFIG_PATH, ZapierValidationError, ZapierUnknownError, ZapierReleaseTriggerMessageSignal, isPermanentHttpError, invalidateCachedToken, batch, toSnakeCase, ZapierAbortDrainSignal, getOrCreateApiClient, isCredentialsObject, ZapierAuthenticationError, ZapierError, buildApplicationLifecycleEvent, AuthMechanism, DEPRECATION_NOTICE_EVENT } from '@zapier/zapier-sdk';
 import { z } from 'zod';
 import { injectCliLogin, createZapierSdkStack, createSdk, defineLegacyMerge, zapierSdkPlugin, addPlugin } from '@zapier/zapier-sdk/experimental';
 import { hostname } from 'os';
@@ -955,6 +955,39 @@ async function resolveCredentialsBaseUrl(context) {
   return getBaseUrlFromResolvedCredentials(resolvedCredentials) ?? getBaseUrlFromOptionsCredentials(context.options?.credentials) ?? context.options?.baseUrl;
 }
 
+// src/utils/cli-argument-sanitizer.ts
+var SENSITIVE_FLAGS = [
+  "--credentials",
+  "--credentials-client-secret",
+  "--credentials-client-id",
+  "--credentials-base-url",
+  "--callback-url",
+  "--user",
+  "--header",
+  "-H",
+  "-u"
+];
+function sanitizeCliArguments(args) {
+  const sanitized = [];
+  let skipNext = false;
+  for (const arg of args) {
+    if (skipNext) {
+      skipNext = false;
+      sanitized.push("[REDACTED]");
+      continue;
+    }
+    if (SENSITIVE_FLAGS.some((flag) => arg.startsWith(flag + "="))) {
+      sanitized.push(arg.split("=")[0] + "=[REDACTED]");
+    } else if (SENSITIVE_FLAGS.includes(arg)) {
+      sanitized.push(arg);
+      skipNext = true;
+    } else {
+      sanitized.push(arg);
+    }
+  }
+  return sanitized;
+}
+
 // src/utils/non-interactive.ts
 function resolveNonInteractive(options) {
   return options.nonInteractive === true || options.skipPrompts === true || !process.stdin.isTTY || !process.stdout.isTTY;
@@ -1274,6 +1307,14 @@ var client_default = api;
 
 // src/utils/auth/oauth-transaction.ts
 var OAUTH_LOOPBACK_HOST = "localhost";
+var OauthTransactionSchema = z.object({
+  browserAuthUrl: z.string(),
+  clientId: z.string(),
+  codeVerifier: z.string(),
+  redirectUri: z.string(),
+  state: z.string(),
+  tokenUrl: z.string()
+});
 function buildBrowserAuthUrl({
   authorizeUrl,
   entryPoint = "login"
@@ -1362,8 +1403,51 @@ async function exchangeOauthCode({
     expiresIn: data.expires_in
   };
 }
+var PENDING_OAUTH_TRANSACTION_KEY = "pending_oauth_transaction";
+var PendingOauthTransactionSchema = z.object({
+  version: z.literal(1),
+  entryPoint: z.enum(["login", "signup"]),
+  expiresAt: z.number(),
+  credentialsBaseUrl: z.string().optional(),
+  credentialName: z.string().optional(),
+  useApprovals: z.boolean(),
+  headless: z.boolean().default(false),
+  transaction: OauthTransactionSchema
+});
+function savePendingOauthTransaction({
+  entryPoint,
+  transaction,
+  expiresAt,
+  credentialsBaseUrl,
+  credentialName,
+  useApprovals,
+  headless
+}) {
+  const pendingTransaction = {
+    version: 1,
+    entryPoint,
+    expiresAt,
+    useApprovals,
+    headless,
+    transaction,
+    ...credentialsBaseUrl !== void 0 && { credentialsBaseUrl },
+    ...credentialName !== void 0 && { credentialName }
+  };
+  getConfig().set(PENDING_OAUTH_TRANSACTION_KEY, pendingTransaction);
+  return pendingTransaction;
+}
+function getPendingOauthTransaction() {
+  const result = PendingOauthTransactionSchema.safeParse(
+    getConfig().get(PENDING_OAUTH_TRANSACTION_KEY)
+  );
+  return result.success ? result.data : void 0;
+}
+function clearPendingOauthTransaction() {
+  getConfig().delete(PENDING_OAUTH_TRANSACTION_KEY);
+}
 
 // src/utils/auth/oauth-flow.ts
+var PENDING_OAUTH_RECOVERY_MESSAGE = "Start a new non-interactive login or signup flow to generate a fresh URL.";
 var LOGIN_OAUTH_COPY = {
   flowName: "Login",
   action: "log in",
@@ -1419,6 +1503,95 @@ async function runSignupOauthFlow(options) {
     copy: SIGNUP_OAUTH_COPY
   });
 }
+async function startPendingOauthFlow({
+  timeoutMs = LOGIN_TIMEOUT_MS,
+  pkceCredentials,
+  baseUrl,
+  entryPoint,
+  credentialName,
+  useApprovals,
+  headless
+}) {
+  const copy = entryPoint === "signup" ? SIGNUP_OAUTH_COPY : LOGIN_OAUTH_COPY;
+  const port = LOGIN_PORTS[0];
+  const transaction = await prepareOauthTransaction({
+    pkceCredentials,
+    baseUrl,
+    redirectUri: `http://${OAUTH_LOOPBACK_HOST}:${port}/oauth`,
+    entryPoint
+  });
+  const pending = savePendingOauthTransaction({
+    entryPoint,
+    transaction,
+    expiresAt: Date.now() + timeoutMs,
+    credentialsBaseUrl: baseUrl,
+    credentialName,
+    useApprovals,
+    headless
+  });
+  process.stderr.write(
+    `Open this ${copy.urlLabel} in a browser to continue:
+`
+  );
+  console.log(transaction.browserAuthUrl);
+  if (!headless) {
+    process.stderr.write(`Opening your browser to ${entryPoint}.
+`);
+    try {
+      await open(transaction.browserAuthUrl);
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      process.stderr.write(
+        `Browser did not open automatically to ${entryPoint}: ${reason}
+`
+      );
+    }
+  }
+  process.stderr.write(
+    `After authorizing, finish with \`zapier-sdk ${entryPoint} --callback-url <final-url>\`.
+`
+  );
+  return pending;
+}
+function getPendingOauthFlow({
+  entryPoint
+}) {
+  const pending = getPendingOauthTransaction();
+  if (!pending) {
+    throw new ZapierCliValidationError(
+      `No pending ${entryPoint} OAuth flow found. ${PENDING_OAUTH_RECOVERY_MESSAGE}`
+    );
+  }
+  if (Date.now() > pending.expiresAt) {
+    clearPendingOauthTransaction();
+    throw new ZapierCliValidationError(
+      `Pending ${pending.entryPoint} OAuth flow has expired. ${PENDING_OAUTH_RECOVERY_MESSAGE}`
+    );
+  }
+  if (pending.entryPoint !== entryPoint) {
+    throw new ZapierCliValidationError(
+      `Pending OAuth flow is for ${pending.entryPoint}, not ${entryPoint}. ${PENDING_OAUTH_RECOVERY_MESSAGE}`
+    );
+  }
+  return pending;
+}
+async function resumePendingOauthFlow({
+  pending,
+  callbackUrl,
+  onProgress
+}) {
+  const code = getCallbackCode({
+    callbackUrl,
+    transaction: pending.transaction
+  });
+  onProgress?.({ type: "callback_accepted" });
+  process.stderr.write("Exchanging authorization code for tokens...\n");
+  onProgress?.({ type: "token_exchange_started" });
+  const tokens = await exchangeOauthCode({ ...pending.transaction, code });
+  clearPendingOauthTransaction();
+  onProgress?.({ type: "token_exchange_completed" });
+  return tokens;
+}
 function runOauthFlowForEntryPoint({
   options,
   entryPoint,
@@ -1954,12 +2127,19 @@ async function saveClientCredentials({
 function emitAccountAuthSuccess({
   sdk,
   profile,
-  clientId
+  clientId,
+  isNonInteractive,
+  isHeadless
 }) {
   sdk.context.eventEmission.emit(
     "platform.sdk.ApplicationLifecycleEvent",
     buildApplicationLifecycleEvent(
-      { lifecycle_event_type: "login_success" },
+      {
+        lifecycle_event_type: "login_success",
+        used_non_interactive_mode: isNonInteractive,
+        is_headless: isHeadless,
+        process_argv: sanitizeCliArguments(process.argv.slice(2))
+      },
       {
         customuser_id: profile.user_id,
         account_id: profile.roles[0]?.account_id ?? null,
@@ -1970,11 +2150,18 @@ function emitAccountAuthSuccess({
   );
 }
 function emitSignupSuccess({
-  sdk
+  sdk,
+  isNonInteractive,
+  isHeadless
 }) {
   sdk.context.eventEmission.emit(
     "platform.sdk.ApplicationLifecycleEvent",
-    buildApplicationLifecycleEvent({ lifecycle_event_type: "signup_success" })
+    buildApplicationLifecycleEvent({
+      lifecycle_event_type: "signup_success",
+      used_non_interactive_mode: isNonInteractive,
+      is_headless: isHeadless,
+      process_argv: sanitizeCliArguments(process.argv.slice(2))
+    })
   );
 }
 async function runOauthWithRedaction(runOauth) {
@@ -2005,7 +2192,11 @@ async function runOauthForEntryPoint({
         recoveryMessage: headless ? HEADLESS_SIGNUP_RECOVERY_MESSAGE : SIGNUP_RECOVERY_MESSAGE,
         onProgress: (event) => {
           if (event.type === "callback_accepted") {
-            emitSignupSuccess({ sdk });
+            emitSignupSuccess({
+              sdk,
+              isNonInteractive: false,
+              isHeadless: headless === true
+            });
           }
         }
       })
@@ -2022,11 +2213,124 @@ async function runOauthForEntryPoint({
     })
   );
 }
+async function provisionAccountCredentials({
+  sdk,
+  entryPoint,
+  accessToken,
+  credentialsBaseUrl,
+  credentialName,
+  interactive,
+  useApprovals,
+  isNonInteractive,
+  isHeadless
+}) {
+  const scopedApi = getOrCreateApiClient({
+    credentials: accessToken,
+    baseUrl: credentialsBaseUrl,
+    callerPackage: sdk.context.options?.callerPackage
+  });
+  const profile = await getProfile(scopedApi);
+  process.stderr.write(`${getProfileMessage(entryPoint, profile.email)}
+`);
+  process.stderr.write(
+    "\nGenerating credentials so this machine can make authenticated requests on your behalf.\n"
+  );
+  const resolvedCredentialName = credentialName ?? await resolveCredentialName({
+    email: profile.email,
+    interactive,
+    baseUrl: credentialsBaseUrl,
+    entryPoint
+  });
+  const { clientId } = await saveClientCredentials({
+    api: scopedApi,
+    name: resolvedCredentialName,
+    credentialsBaseUrl,
+    useApprovals,
+    cleanupLogPrefix: entryPoint
+  });
+  process.stderr.write(
+    `\u2705 Credentials "${resolvedCredentialName}" created and set as default. You are ready to use the Zapier SDK.
+`
+  );
+  if (useApprovals) {
+    process.stderr.write("\u{1F510} Approvals are enabled for these credentials.\n");
+  }
+  emitAccountAuthSuccess({
+    sdk,
+    profile,
+    clientId,
+    isNonInteractive,
+    isHeadless
+  });
+}
 async function runAccountAuth({
   sdk,
   options,
   entryPoint
 }) {
+  if (options.callbackUrl !== void 0) {
+    const { callbackUrl } = options;
+    const pending = getPendingOauthFlow({ entryPoint });
+    const finishName = options.name !== void 0 ? validateCredentialsName(options.name) : void 0;
+    if (finishName !== void 0 && finishName !== pending.credentialName) {
+      throw new ZapierCliValidationError(
+        "Cannot change --name while completing a pending OAuth flow. Start a new non-interactive login with the desired --name."
+      );
+    }
+    if (options.useApprovals === true && !pending.useApprovals) {
+      throw new ZapierCliValidationError(
+        "Cannot add --use-approvals while completing a pending OAuth flow. Start a new non-interactive flow with --use-approvals."
+      );
+    }
+    if (pending.credentialName !== void 0) {
+      const activeCredentials = getActiveCredentials({
+        baseUrl: pending.credentialsBaseUrl
+      });
+      if (activeCredentials?.name !== pending.credentialName && credentialNameExists({
+        name: pending.credentialName,
+        baseUrl: pending.credentialsBaseUrl
+      })) {
+        throw new ZapierCliValidationError(
+          `A credential named "${pending.credentialName}" already exists. Choose a different --name.`
+        );
+      }
+    }
+    if (!await clearExistingAuthState({
+      sdk,
+      baseUrl: pending.credentialsBaseUrl,
+      interactive: false,
+      entryPoint
+    })) {
+      return;
+    }
+    const { accessToken: accessToken2 } = await runOauthWithRedaction(async () => {
+      return resumePendingOauthFlow({
+        callbackUrl,
+        pending,
+        onProgress: (event) => {
+          if (entryPoint === "signup" && event.type === "callback_accepted") {
+            emitSignupSuccess({
+              sdk,
+              isNonInteractive: true,
+              isHeadless: pending.headless
+            });
+          }
+        }
+      });
+    });
+    await provisionAccountCredentials({
+      sdk,
+      entryPoint,
+      accessToken: accessToken2,
+      credentialsBaseUrl: pending.credentialsBaseUrl,
+      credentialName: pending.credentialName,
+      interactive: false,
+      useApprovals: pending.useApprovals,
+      isNonInteractive: true,
+      isHeadless: pending.headless
+    });
+    return;
+  }
   const timeoutSeconds = parseTimeoutSeconds(options.timeout);
   const interactive = !resolveNonInteractive(options);
   const resolvedCredentials = await sdk.context.resolveCredentials();
@@ -2055,6 +2359,19 @@ async function runAccountAuth({
   })) {
     return;
   }
+  const useApprovals = options.useApprovals === true;
+  if (!interactive) {
+    await startPendingOauthFlow({
+      entryPoint,
+      timeoutMs: timeoutSeconds * 1e3,
+      pkceCredentials,
+      baseUrl: credentialsBaseUrl,
+      credentialName: providedName,
+      useApprovals,
+      headless
+    });
+    return;
+  }
   const { accessToken } = await runOauthForEntryPoint({
     sdk,
     entryPoint,
@@ -2064,39 +2381,17 @@ async function runAccountAuth({
     headless,
     interactive
   });
-  const scopedApi = getOrCreateApiClient({
-    credentials: accessToken,
-    baseUrl: credentialsBaseUrl,
-    callerPackage: sdk.context.options?.callerPackage
-  });
-  const profile = await getProfile(scopedApi);
-  process.stderr.write(`${getProfileMessage(entryPoint, profile.email)}
-`);
-  process.stderr.write(
-    "\nGenerating credentials so this machine can make authenticated requests on your behalf.\n"
-  );
-  const credentialName = providedName ?? await resolveCredentialName({
-    email: profile.email,
-    interactive,
-    baseUrl: credentialsBaseUrl,
-    entryPoint
-  });
-  const useApprovals = options.useApprovals === true;
-  const { clientId } = await saveClientCredentials({
-    api: scopedApi,
-    name: credentialName,
+  await provisionAccountCredentials({
+    sdk,
+    entryPoint,
+    accessToken,
     credentialsBaseUrl,
+    credentialName: providedName,
+    interactive,
     useApprovals,
-    cleanupLogPrefix: entryPoint
+    isNonInteractive: false,
+    isHeadless: headless
   });
-  process.stderr.write(
-    `\u2705 Credentials "${credentialName}" created and set as default. You are ready to use the Zapier SDK.
-`
-  );
-  if (useApprovals) {
-    process.stderr.write("\u{1F510} Approvals are enabled for these credentials.\n");
-  }
-  emitAccountAuthSuccess({ sdk, profile, clientId });
 }
 var LoginSchema = z.object({
   name: z.string().optional().describe(
@@ -2116,8 +2411,20 @@ var LoginSchema = z.object({
   }),
   headless: z.boolean().optional().describe(
     "Use when logging in from a machine that has no browser. Prints a login link to open elsewhere, then accepts the pasted loopback callback URL."
+  ),
+  callbackUrl: z.string().optional().describe(
+    "Resume a pending non-interactive login with the final OAuth callback URL from your browser."
   )
-}).describe("Log in to Zapier to access your account");
+}).describe("Log in to Zapier to access your account").meta({
+  cliTelemetry: {
+    authFlow: {
+      callbackUrlParam: "callbackUrl",
+      headlessParam: "headless",
+      nonInteractiveParam: "nonInteractive",
+      skipPromptsParam: "skipPrompts"
+    }
+  }
+});
 
 // src/plugins/login/index.ts
 var loginPlugin = definePlugin(
@@ -2146,8 +2453,20 @@ var SignupSchema = z.object({
   }),
   headless: z.boolean().optional().describe(
     "Use when signing up from a machine that has no browser. Prints a signup link to open elsewhere, then accepts the pasted loopback callback URL."
+  ),
+  callbackUrl: z.string().optional().describe(
+    "Resume a pending non-interactive signup with the final OAuth callback URL from your browser."
   )
-}).describe("Set up Zapier account access and SDK credentials");
+}).describe("Set up Zapier account access and SDK credentials").meta({
+  cliTelemetry: {
+    authFlow: {
+      callbackUrlParam: "callbackUrl",
+      headlessParam: "headless",
+      nonInteractiveParam: "nonInteractive",
+      skipPromptsParam: "skipPrompts"
+    }
+  }
+});
 
 // src/plugins/signup/index.ts
 var signupPlugin = definePlugin(
@@ -4705,7 +5024,7 @@ function collectDeprecationNoticeAndForward(event, onEvent) {
 // package.json with { type: 'json' }
 var package_default = {
   name: "@zapier/zapier-sdk-cli",
-  version: "0.61.3"};
+  version: "0.63.0"};
 
 // src/experimental.ts
 injectCliLogin(login_exports);

package/dist/{extensions-DggdwXJF.d.mts → extensions-N27h0wrp.d.mts}

@@ -543,6 +543,7 @@ declare const signupPlugin: (sdk: {
         nonInteractive?: boolean | undefined;
         skipPrompts?: boolean | undefined;
         headless?: boolean | undefined;
+        callbackUrl?: string | undefined;
     } | undefined) => Promise<void>;
 } & {
     context: {

package/dist/{extensions-DggdwXJF.d.ts → extensions-N27h0wrp.d.ts}

@@ -543,6 +543,7 @@ declare const signupPlugin: (sdk: {
         nonInteractive?: boolean | undefined;
         skipPrompts?: boolean | undefined;
         headless?: boolean | undefined;
+        callbackUrl?: string | undefined;
     } | undefined) => Promise<void>;
 } & {
     context: {