@zapier/zapier-sdk-cli 0.62.0 → 0.63.0

package/dist/cli.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { Command, CommanderError, Option } from 'commander';
 import { z } from 'zod';
-import { definePlugin, createPluginMethod, OutputPropertySchema, ZapierBundleError, DEFAULT_CONFIG_PATH, ZapierValidationError, ZapierUnknownError, ZapierReleaseTriggerMessageSignal, injectCliLogin, BaseSdkOptionsSchema, getOrCreateApiClient, isPermanentHttpError, invalidateCachedToken, batch, toSnakeCase, ZapierAbortDrainSignal, createZapierSdkStack as createZapierSdkStack$1, createSdk as createSdk$1, defineLegacyMerge as defineLegacyMerge$1, zapierSdkPlugin as zapierSdkPlugin$1, addPlugin as addPlugin$1, ZapierError, isCredentialsObject, buildApplicationLifecycleEvent, AuthMechanism, ZapierAuthenticationError, DEPRECATION_NOTICE_EVENT, runWithCallerContext, isPositional, createController, CoreCancelledSignal, runWithTelemetryContext, buildCapabilityMessage, formatErrorMessage, getOsInfo, getPlatformVersions, getAgent, getTtyContext, getCiPlatform, isCi, getReleaseId, getCurrentTimestamp, generateEventId, ZapierApprovalError } from '@zapier/zapier-sdk';
+import { definePlugin, createPluginMethod, OutputPropertySchema, ZapierBundleError, DEFAULT_CONFIG_PATH, ZapierValidationError, ZapierUnknownError, ZapierReleaseTriggerMessageSignal, injectCliLogin, BaseSdkOptionsSchema, isPermanentHttpError, invalidateCachedToken, batch, toSnakeCase, ZapierAbortDrainSignal, createZapierSdkStack as createZapierSdkStack$1, createSdk as createSdk$1, defineLegacyMerge as defineLegacyMerge$1, zapierSdkPlugin as zapierSdkPlugin$1, addPlugin as addPlugin$1, ZapierError, getOrCreateApiClient, isCredentialsObject, ZapierAuthenticationError, buildApplicationLifecycleEvent, AuthMechanism, DEPRECATION_NOTICE_EVENT, runWithCallerContext, isPositional, createController, CoreCancelledSignal, runWithTelemetryContext, buildCapabilityMessage, formatErrorMessage, getOsInfo, getPlatformVersions, getAgent, getTtyContext, getCiPlatform, isCi, getReleaseId, getCurrentTimestamp, generateEventId, ZapierApprovalError } from '@zapier/zapier-sdk';
 import inquirer from 'inquirer';
 import search from '@inquirer/search';
 import chalk from 'chalk';
@@ -9,7 +9,7 @@ import ora from 'ora';
 import util from 'util';
 import wrapAnsi from 'wrap-ansi';
 import * as jwt from 'jsonwebtoken';
-import { deletePassword, setPassword, getKeyring, getPassword } from 'cross-keychain';
+import { deletePassword, getKeyring, setPassword, getPassword } from 'cross-keychain';
 import Conf from 'conf';
 import * as fs from 'fs';
 import { promises, createWriteStream, existsSync, readdirSync, rmSync, mkdirSync, writeFileSync, copyFileSync, readFileSync } from 'fs';
@@ -1684,7 +1684,7 @@ var SHARED_COMMAND_CLI_OPTIONS = [
 
 // package.json
 var package_default = {
-  version: "0.62.0"};
+  version: "0.63.0"};
 
 // src/telemetry/builders.ts
 function createCliBaseEvent(context = {}) {
@@ -1739,7 +1739,9 @@ function buildCliCommandExecutedEvent({
     files_created_count: data.files_created_count ?? null,
     files_processed_size_bytes: data.files_processed_size_bytes ?? null,
     cpu_time_ms: data.cpu_time_ms ?? null,
-    subprocess_count: data.subprocess_count ?? null
+    subprocess_count: data.subprocess_count ?? null,
+    used_non_interactive_mode: data.used_non_interactive_mode ?? null,
+    is_headless: data.is_headless ?? null
   };
 }
 function getApprovalReason(error) {
@@ -2108,14 +2110,13 @@ function createInteractiveRenderer(context = {}) {
   };
 }
 
-// src/utils/cli-generator.ts
-var CLI_COMMAND_EXECUTED_EVENT_SUBJECT = "platform.sdk.CliCommandExecutedEvent";
-var PAGINATION_PARAM_NAMES = /* @__PURE__ */ new Set(["maxItems", "pageSize", "cursor"]);
+// src/utils/cli-argument-sanitizer.ts
 var SENSITIVE_FLAGS = [
   "--credentials",
   "--credentials-client-secret",
   "--credentials-client-id",
   "--credentials-base-url",
+  "--callback-url",
   "--user",
   "--header",
   "-H",
@@ -2141,6 +2142,15 @@ function sanitizeCliArguments(args) {
   }
   return sanitized;
 }
+
+// src/utils/non-interactive.ts
+function resolveNonInteractive(options) {
+  return options.nonInteractive === true || options.skipPrompts === true || !process.stdin.isTTY || !process.stdout.isTTY;
+}
+
+// src/utils/cli-generator.ts
+var CLI_COMMAND_EXECUTED_EVENT_SUBJECT = "platform.sdk.CliCommandExecutedEvent";
+var PAGINATION_PARAM_NAMES = /* @__PURE__ */ new Set(["maxItems", "pageSize", "cursor"]);
 function getNormalizedResult(result, { isListCommand }) {
   if (result instanceof Response) {
     return { kind: "response", value: result };
@@ -2269,8 +2279,24 @@ function resolveOutputMode({
   if (hasUserSpecifiedMaxItems) return "collect";
   return "paginate";
 }
+function getSchemaMetadata(schema) {
+  return schema?.meta?.();
+}
 function getSchemaAliases(schema) {
-  return schema?.meta?.()?.aliases;
+  return getSchemaMetadata(schema)?.aliases;
+}
+function getAuthFlowTelemetryMetadata(schema) {
+  return getSchemaMetadata(schema)?.cliTelemetry?.authFlow;
+}
+function getAuthFlowIsHeadless({
+  options,
+  authFlowTelemetry
+}) {
+  if (!authFlowTelemetry) return null;
+  const isHeadless = options[authFlowTelemetry.headlessParam] === true;
+  const isCallbackResume = options[authFlowTelemetry.callbackUrlParam] !== void 0;
+  if (isCallbackResume && !isHeadless) return null;
+  return isHeadless;
 }
 function analyzeZodSchema(schema, functionInfo) {
   const parameters = [];
@@ -2702,6 +2728,7 @@ ${confirmMessageAfter}`));
       }
     } finally {
       try {
+        const authFlowTelemetry = getAuthFlowTelemetryMetadata(schema);
         const event = buildCliCommandExecutedEvent({
           data: {
             cli_primary_command: cliCommandName,
@@ -2711,7 +2738,15 @@ ${confirmMessageAfter}`));
             error_message: errorMessage,
             command_category: functionInfo.categories?.[0] ?? null,
             requires_auth: null,
-            cli_arguments: sanitizeCliArguments(process.argv.slice(2))
+            cli_arguments: sanitizeCliArguments(process.argv.slice(2)),
+            used_non_interactive_mode: authFlowTelemetry ? options[authFlowTelemetry.callbackUrlParam] !== void 0 || resolveNonInteractive({
+              nonInteractive: options[authFlowTelemetry.nonInteractiveParam] === true,
+              skipPrompts: authFlowTelemetry.skipPromptsParam !== void 0 && options[authFlowTelemetry.skipPromptsParam] === true
+            }) : null,
+            is_headless: getAuthFlowIsHeadless({
+              options,
+              authFlowTelemetry
+            })
           },
           context: {
             selected_api: resolvedParams.app ?? null
@@ -3776,11 +3811,6 @@ async function resolveCredentialsBaseUrl(context) {
   return getBaseUrlFromResolvedCredentials(resolvedCredentials) ?? getBaseUrlFromOptionsCredentials(context.options?.credentials) ?? context.options?.baseUrl;
 }
 
-// src/utils/non-interactive.ts
-function resolveNonInteractive(options) {
-  return options.nonInteractive === true || options.skipPrompts === true || !process.stdin.isTTY || !process.stdout.isTTY;
-}
-
 // src/utils/auth/client-credentials.ts
 var CREDENTIALS_SCOPES = ["external", "credentials"];
 var EMPTY_POLICY = {
@@ -4095,6 +4125,14 @@ var client_default = api;
 
 // src/utils/auth/oauth-transaction.ts
 var OAUTH_LOOPBACK_HOST = "localhost";
+var OauthTransactionSchema = z.object({
+  browserAuthUrl: z.string(),
+  clientId: z.string(),
+  codeVerifier: z.string(),
+  redirectUri: z.string(),
+  state: z.string(),
+  tokenUrl: z.string()
+});
 function buildBrowserAuthUrl({
   authorizeUrl,
   entryPoint = "login"
@@ -4183,8 +4221,51 @@ async function exchangeOauthCode({
     expiresIn: data.expires_in
   };
 }
+var PENDING_OAUTH_TRANSACTION_KEY = "pending_oauth_transaction";
+var PendingOauthTransactionSchema = z.object({
+  version: z.literal(1),
+  entryPoint: z.enum(["login", "signup"]),
+  expiresAt: z.number(),
+  credentialsBaseUrl: z.string().optional(),
+  credentialName: z.string().optional(),
+  useApprovals: z.boolean(),
+  headless: z.boolean().default(false),
+  transaction: OauthTransactionSchema
+});
+function savePendingOauthTransaction({
+  entryPoint,
+  transaction,
+  expiresAt,
+  credentialsBaseUrl: credentialsBaseUrl2,
+  credentialName,
+  useApprovals,
+  headless
+}) {
+  const pendingTransaction = {
+    version: 1,
+    entryPoint,
+    expiresAt,
+    useApprovals,
+    headless,
+    transaction,
+    ...credentialsBaseUrl2 !== void 0 && { credentialsBaseUrl: credentialsBaseUrl2 },
+    ...credentialName !== void 0 && { credentialName }
+  };
+  getConfig().set(PENDING_OAUTH_TRANSACTION_KEY, pendingTransaction);
+  return pendingTransaction;
+}
+function getPendingOauthTransaction() {
+  const result = PendingOauthTransactionSchema.safeParse(
+    getConfig().get(PENDING_OAUTH_TRANSACTION_KEY)
+  );
+  return result.success ? result.data : void 0;
+}
+function clearPendingOauthTransaction() {
+  getConfig().delete(PENDING_OAUTH_TRANSACTION_KEY);
+}
 
 // src/utils/auth/oauth-flow.ts
+var PENDING_OAUTH_RECOVERY_MESSAGE = "Start a new non-interactive login or signup flow to generate a fresh URL.";
 var LOGIN_OAUTH_COPY = {
   flowName: "Login",
   action: "log in",
@@ -4240,6 +4321,95 @@ async function runSignupOauthFlow(options) {
     copy: SIGNUP_OAUTH_COPY
   });
 }
+async function startPendingOauthFlow({
+  timeoutMs = LOGIN_TIMEOUT_MS,
+  pkceCredentials,
+  baseUrl: baseUrl2,
+  entryPoint,
+  credentialName,
+  useApprovals,
+  headless
+}) {
+  const copy = entryPoint === "signup" ? SIGNUP_OAUTH_COPY : LOGIN_OAUTH_COPY;
+  const port = LOGIN_PORTS[0];
+  const transaction = await prepareOauthTransaction({
+    pkceCredentials,
+    baseUrl: baseUrl2,
+    redirectUri: `http://${OAUTH_LOOPBACK_HOST}:${port}/oauth`,
+    entryPoint
+  });
+  const pending = savePendingOauthTransaction({
+    entryPoint,
+    transaction,
+    expiresAt: Date.now() + timeoutMs,
+    credentialsBaseUrl: baseUrl2,
+    credentialName,
+    useApprovals,
+    headless
+  });
+  process.stderr.write(
+    `Open this ${copy.urlLabel} in a browser to continue:
+`
+  );
+  console.log(transaction.browserAuthUrl);
+  if (!headless) {
+    process.stderr.write(`Opening your browser to ${entryPoint}.
+`);
+    try {
+      await open(transaction.browserAuthUrl);
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      process.stderr.write(
+        `Browser did not open automatically to ${entryPoint}: ${reason}
+`
+      );
+    }
+  }
+  process.stderr.write(
+    `After authorizing, finish with \`zapier-sdk ${entryPoint} --callback-url <final-url>\`.
+`
+  );
+  return pending;
+}
+function getPendingOauthFlow({
+  entryPoint
+}) {
+  const pending = getPendingOauthTransaction();
+  if (!pending) {
+    throw new ZapierCliValidationError(
+      `No pending ${entryPoint} OAuth flow found. ${PENDING_OAUTH_RECOVERY_MESSAGE}`
+    );
+  }
+  if (Date.now() > pending.expiresAt) {
+    clearPendingOauthTransaction();
+    throw new ZapierCliValidationError(
+      `Pending ${pending.entryPoint} OAuth flow has expired. ${PENDING_OAUTH_RECOVERY_MESSAGE}`
+    );
+  }
+  if (pending.entryPoint !== entryPoint) {
+    throw new ZapierCliValidationError(
+      `Pending OAuth flow is for ${pending.entryPoint}, not ${entryPoint}. ${PENDING_OAUTH_RECOVERY_MESSAGE}`
+    );
+  }
+  return pending;
+}
+async function resumePendingOauthFlow({
+  pending,
+  callbackUrl,
+  onProgress
+}) {
+  const code = getCallbackCode({
+    callbackUrl,
+    transaction: pending.transaction
+  });
+  onProgress?.({ type: "callback_accepted" });
+  process.stderr.write("Exchanging authorization code for tokens...\n");
+  onProgress?.({ type: "token_exchange_started" });
+  const tokens = await exchangeOauthCode({ ...pending.transaction, code });
+  clearPendingOauthTransaction();
+  onProgress?.({ type: "token_exchange_completed" });
+  return tokens;
+}
 function runOauthFlowForEntryPoint({
   options,
   entryPoint,
@@ -4775,12 +4945,19 @@ async function saveClientCredentials({
 function emitAccountAuthSuccess({
   sdk,
   profile,
-  clientId
+  clientId,
+  isNonInteractive,
+  isHeadless
 }) {
   sdk.context.eventEmission.emit(
     "platform.sdk.ApplicationLifecycleEvent",
     buildApplicationLifecycleEvent(
-      { lifecycle_event_type: "login_success" },
+      {
+        lifecycle_event_type: "login_success",
+        used_non_interactive_mode: isNonInteractive,
+        is_headless: isHeadless,
+        process_argv: sanitizeCliArguments(process.argv.slice(2))
+      },
       {
         customuser_id: profile.user_id,
         account_id: profile.roles[0]?.account_id ?? null,
@@ -4791,11 +4968,18 @@ function emitAccountAuthSuccess({
   );
 }
 function emitSignupSuccess({
-  sdk
+  sdk,
+  isNonInteractive,
+  isHeadless
 }) {
   sdk.context.eventEmission.emit(
     "platform.sdk.ApplicationLifecycleEvent",
-    buildApplicationLifecycleEvent({ lifecycle_event_type: "signup_success" })
+    buildApplicationLifecycleEvent({
+      lifecycle_event_type: "signup_success",
+      used_non_interactive_mode: isNonInteractive,
+      is_headless: isHeadless,
+      process_argv: sanitizeCliArguments(process.argv.slice(2))
+    })
   );
 }
 async function runOauthWithRedaction(runOauth) {
@@ -4826,7 +5010,11 @@ async function runOauthForEntryPoint({
         recoveryMessage: headless ? HEADLESS_SIGNUP_RECOVERY_MESSAGE : SIGNUP_RECOVERY_MESSAGE,
         onProgress: (event) => {
           if (event.type === "callback_accepted") {
-            emitSignupSuccess({ sdk });
+            emitSignupSuccess({
+              sdk,
+              isNonInteractive: false,
+              isHeadless: headless === true
+            });
           }
         }
       })
@@ -4843,11 +5031,124 @@ async function runOauthForEntryPoint({
     })
   );
 }
+async function provisionAccountCredentials({
+  sdk,
+  entryPoint,
+  accessToken,
+  credentialsBaseUrl: credentialsBaseUrl2,
+  credentialName,
+  interactive,
+  useApprovals,
+  isNonInteractive,
+  isHeadless
+}) {
+  const scopedApi = getOrCreateApiClient({
+    credentials: accessToken,
+    baseUrl: credentialsBaseUrl2,
+    callerPackage: sdk.context.options?.callerPackage
+  });
+  const profile = await getProfile(scopedApi);
+  process.stderr.write(`${getProfileMessage(entryPoint, profile.email)}
+`);
+  process.stderr.write(
+    "\nGenerating credentials so this machine can make authenticated requests on your behalf.\n"
+  );
+  const resolvedCredentialName = credentialName ?? await resolveCredentialName({
+    email: profile.email,
+    interactive,
+    baseUrl: credentialsBaseUrl2,
+    entryPoint
+  });
+  const { clientId } = await saveClientCredentials({
+    api: scopedApi,
+    name: resolvedCredentialName,
+    credentialsBaseUrl: credentialsBaseUrl2,
+    useApprovals,
+    cleanupLogPrefix: entryPoint
+  });
+  process.stderr.write(
+    `\u2705 Credentials "${resolvedCredentialName}" created and set as default. You are ready to use the Zapier SDK.
+`
+  );
+  if (useApprovals) {
+    process.stderr.write("\u{1F510} Approvals are enabled for these credentials.\n");
+  }
+  emitAccountAuthSuccess({
+    sdk,
+    profile,
+    clientId,
+    isNonInteractive,
+    isHeadless
+  });
+}
 async function runAccountAuth({
   sdk,
   options,
   entryPoint
 }) {
+  if (options.callbackUrl !== void 0) {
+    const { callbackUrl } = options;
+    const pending = getPendingOauthFlow({ entryPoint });
+    const finishName = options.name !== void 0 ? validateCredentialsName(options.name) : void 0;
+    if (finishName !== void 0 && finishName !== pending.credentialName) {
+      throw new ZapierCliValidationError(
+        "Cannot change --name while completing a pending OAuth flow. Start a new non-interactive login with the desired --name."
+      );
+    }
+    if (options.useApprovals === true && !pending.useApprovals) {
+      throw new ZapierCliValidationError(
+        "Cannot add --use-approvals while completing a pending OAuth flow. Start a new non-interactive flow with --use-approvals."
+      );
+    }
+    if (pending.credentialName !== void 0) {
+      const activeCredentials = getActiveCredentials({
+        baseUrl: pending.credentialsBaseUrl
+      });
+      if (activeCredentials?.name !== pending.credentialName && credentialNameExists({
+        name: pending.credentialName,
+        baseUrl: pending.credentialsBaseUrl
+      })) {
+        throw new ZapierCliValidationError(
+          `A credential named "${pending.credentialName}" already exists. Choose a different --name.`
+        );
+      }
+    }
+    if (!await clearExistingAuthState({
+      sdk,
+      baseUrl: pending.credentialsBaseUrl,
+      interactive: false,
+      entryPoint
+    })) {
+      return;
+    }
+    const { accessToken: accessToken2 } = await runOauthWithRedaction(async () => {
+      return resumePendingOauthFlow({
+        callbackUrl,
+        pending,
+        onProgress: (event) => {
+          if (entryPoint === "signup" && event.type === "callback_accepted") {
+            emitSignupSuccess({
+              sdk,
+              isNonInteractive: true,
+              isHeadless: pending.headless
+            });
+          }
+        }
+      });
+    });
+    await provisionAccountCredentials({
+      sdk,
+      entryPoint,
+      accessToken: accessToken2,
+      credentialsBaseUrl: pending.credentialsBaseUrl,
+      credentialName: pending.credentialName,
+      interactive: false,
+      useApprovals: pending.useApprovals,
+      isNonInteractive: true,
+      isHeadless: pending.headless
+    });
+    return;
+  }
   const timeoutSeconds = parseTimeoutSeconds(options.timeout);
   const interactive = !resolveNonInteractive(options);
   const resolvedCredentials = await sdk.context.resolveCredentials();
@@ -4876,6 +5177,19 @@ async function runAccountAuth({
   })) {
     return;
   }
+  const useApprovals = options.useApprovals === true;
+  if (!interactive) {
+    await startPendingOauthFlow({
+      entryPoint,
+      timeoutMs: timeoutSeconds * 1e3,
+      pkceCredentials,
+      baseUrl: credentialsBaseUrl2,
+      credentialName: providedName,
+      useApprovals,
+      headless
+    });
+    return;
+  }
   const { accessToken } = await runOauthForEntryPoint({
     sdk,
     entryPoint,
@@ -4885,39 +5199,17 @@ async function runAccountAuth({
     headless,
     interactive
   });
-  const scopedApi = getOrCreateApiClient({
-    credentials: accessToken,
-    baseUrl: credentialsBaseUrl2,
-    callerPackage: sdk.context.options?.callerPackage
-  });
-  const profile = await getProfile(scopedApi);
-  process.stderr.write(`${getProfileMessage(entryPoint, profile.email)}
-`);
-  process.stderr.write(
-    "\nGenerating credentials so this machine can make authenticated requests on your behalf.\n"
-  );
-  const credentialName = providedName ?? await resolveCredentialName({
-    email: profile.email,
-    interactive,
-    baseUrl: credentialsBaseUrl2,
-    entryPoint
-  });
-  const useApprovals = options.useApprovals === true;
-  const { clientId } = await saveClientCredentials({
-    api: scopedApi,
-    name: credentialName,
+  await provisionAccountCredentials({
+    sdk,
+    entryPoint,
+    accessToken,
     credentialsBaseUrl: credentialsBaseUrl2,
+    credentialName: providedName,
+    interactive,
     useApprovals,
-    cleanupLogPrefix: entryPoint
+    isNonInteractive: false,
+    isHeadless: headless
   });
-  process.stderr.write(
-    `\u2705 Credentials "${credentialName}" created and set as default. You are ready to use the Zapier SDK.
-`
-  );
-  if (useApprovals) {
-    process.stderr.write("\u{1F510} Approvals are enabled for these credentials.\n");
-  }
-  emitAccountAuthSuccess({ sdk, profile, clientId });
 }
 var LoginSchema = z.object({
   name: z.string().optional().describe(
@@ -4937,8 +5229,20 @@ var LoginSchema = z.object({
   }),
   headless: z.boolean().optional().describe(
     "Use when logging in from a machine that has no browser. Prints a login link to open elsewhere, then accepts the pasted loopback callback URL."
+  ),
+  callbackUrl: z.string().optional().describe(
+    "Resume a pending non-interactive login with the final OAuth callback URL from your browser."
   )
-}).describe("Log in to Zapier to access your account");
+}).describe("Log in to Zapier to access your account").meta({
+  cliTelemetry: {
+    authFlow: {
+      callbackUrlParam: "callbackUrl",
+      headlessParam: "headless",
+      nonInteractiveParam: "nonInteractive",
+      skipPromptsParam: "skipPrompts"
+    }
+  }
+});
 
 // src/plugins/login/index.ts
 var loginPlugin = definePlugin(
@@ -4967,8 +5271,20 @@ var SignupSchema = z.object({
   }),
   headless: z.boolean().optional().describe(
     "Use when signing up from a machine that has no browser. Prints a signup link to open elsewhere, then accepts the pasted loopback callback URL."
+  ),
+  callbackUrl: z.string().optional().describe(
+    "Resume a pending non-interactive signup with the final OAuth callback URL from your browser."
   )
-}).describe("Set up Zapier account access and SDK credentials");
+}).describe("Set up Zapier account access and SDK credentials").meta({
+  cliTelemetry: {
+    authFlow: {
+      callbackUrlParam: "callbackUrl",
+      headlessParam: "headless",
+      nonInteractiveParam: "nonInteractive",
+      skipPromptsParam: "skipPrompts"
+    }
+  }
+});
 
 // src/plugins/signup/index.ts
 var signupPlugin = definePlugin(
@@ -7569,7 +7885,7 @@ function buildBoxLines(message) {
 // package.json with { type: 'json' }
 var package_default2 = {
   name: "@zapier/zapier-sdk-cli",
-  version: "0.62.0"};
+  version: "0.63.0"};
 
 // src/sdk.ts
 injectCliLogin(login_exports);