zapier-platform-cli 18.0.0 → 18.0.5

package/oclif.manifest.json

@@ -2555,5 +2555,5 @@
       ]
     }
   },
-  "version": "18.0.0"
+  "version": "18.0.5"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zapier-platform-cli",
-  "version": "18.0.0",
+  "version": "18.0.5",
   "description": "The CLI for managing integrations in Zapier Developer Platform.",
   "repository": "zapier/zapier-platform",
   "homepage": "https://platform.zapier.com/",
@@ -13,7 +13,6 @@
     "/src/generators/",
     "/src/oclif/",
     "/src/bin/",
-    "/src/bin/run.cmd",
     "/src/utils/",
     "/scaffold/",
     "/oclif.manifest.json"
@@ -21,24 +20,6 @@
   "engines": {
     "node": ">=18.20"
   },
-  "scripts": {
-    "docs": "ZAPIER_BASE_ENDPOINT='' node scripts/docs.js",
-    "preversion": "git pull && yarn validate",
-    "prepack": "oclif manifest",
-    "postpack": "rimraf oclif.manifest.json",
-    "precommit": "yarn docs && git add docs",
-    "version": "yarn docs && git add docs/*",
-    "postversion": "git push && git push --tags",
-    "lint": "eslint src",
-    "lint:fix": "eslint --fix src",
-    "test": "cross-env NODE_ENV=test mocha -t 200s --recursive src/tests --exit",
-    "test:debug": "cross-env NODE_ENV=test node inspect ../../node_modules/.bin/mocha -t 200s --recursive src/tests --exit",
-    "smoke-test": "cross-env NODE_ENV=test mocha -t 6m --recursive src/smoke-tests --exit",
-    "smoke-test:debug": "cross-env NODE_ENV=test node inspect ../../node_modules/.bin/mocha -t 6m --recursive src/smoke-tests --exit",
-    "validate-templates": "./scripts/validate-app-templates.js",
-    "set-template-versions": "./scripts/set-app-template-versions.js",
-    "validate": "yarn test && yarn smoke-test && yarn lint"
-  },
   "dependencies": {
     "@oclif/core": "4.5.2",
     "@oclif/plugin-autocomplete": "3.2.34",
@@ -51,7 +32,7 @@
     "cli-table3": "0.6.5",
     "colors": "1.4.0",
     "debug": "4.4.1",
-    "decompress": "4.2.1",
+    "decompress-unzip": "4.0.1",
     "dotenv": "17.2.1",
     "esbuild": "0.25.8",
     "fs-extra": "11.3.1",
@@ -91,7 +72,7 @@
     "yamljs": "0.3.0"
   },
   "bin": {
-    "zapier": "./src/bin/run-deprecated",
+    "zapier": "./src/bin/run",
     "zapier-platform": "./src/bin/run"
   },
   "oclif": {
@@ -137,5 +118,21 @@
         "description": "Add, remove, or get invited users of your integration."
       }
     }
+  },
+  "scripts": {
+    "build-docs": "ZAPIER_BASE_ENDPOINT='' node scripts/docs.js",
+    "preversion": "git pull && pnpm validate",
+    "precommit": "pnpm build-docs && git add docs",
+    "version": "pnpm build-docs && git add docs/*",
+    "postversion": "git push && git push --tags",
+    "lint": "eslint src",
+    "lint:fix": "eslint --fix src",
+    "test": "cross-env NODE_ENV=test mocha -t 200s --recursive src/tests --exit",
+    "test:debug": "cross-env NODE_ENV=test node inspect ../../node_modules/.bin/mocha -t 200s --recursive src/tests --exit",
+    "smoke-test": "cross-env NODE_ENV=test mocha -t 6m --recursive src/smoke-tests --exit",
+    "smoke-test:debug": "cross-env NODE_ENV=test node inspect ../../node_modules/.bin/mocha -t 6m --recursive src/smoke-tests --exit",
+    "validate-templates": "./scripts/validate-app-templates.js",
+    "set-template-versions": "./scripts/set-app-template-versions.js",
+    "validate": "pnpm test && pnpm smoke-test && pnpm lint"
   }
-}
+}

package/src/bin/run

@@ -1,6 +1,30 @@
 #!/usr/bin/env node
 
+const path = require('node:path');
+
 (async () => {
   const oclif = await import('@oclif/core');
   await oclif.execute({ development: false, dir: __dirname });
+
+  // Show deprecation warning for the old "zapier" binary name
+  // Users can suppress this warning by setting ZAPIER_SUPPRESS_DEPRECATION_WARNING
+  if (!process.env.ZAPIER_SUPPRESS_DEPRECATION_WARNING) {
+    const msg =
+      'The "zapier" command is deprecated and will be removed in a future version. ' +
+      'Please use "zapier-platform" instead.\n' +
+      'To suppress this warning, set ZAPIER_SUPPRESS_DEPRECATION_WARNING in your environment.\n';
+    
+    if (process.platform === 'win32') {
+      // On Windows, we cannot reliably detect which wrapper was invoked (zapier vs zapier-platform)
+      // because both wrappers point to the same script. Show a generic deprecation notice instead of a warning..
+      console.warn('\n[DEPRECATION NOTICE] ' + msg);
+    } else {
+      // On Unix, we can detect which symlink was used
+      const scriptPath = process.argv[1] || '';
+      const binName = path.basename(scriptPath, path.extname(scriptPath));
+      if (binName === 'zapier') {
+        console.warn('\n[DEPRECATION WARNING] ' + msg);
+      }
+    }
+  }
 })();

package/src/generators/templates/README.template.md

@@ -6,7 +6,7 @@ These are what you normally do next:
 
 ```bash
 # Install dependencies
-npm install  # or you can use yarn
+npm install  # or you can use pnpm or yarn
 
 # Run tests
 zapier test

package/src/generators/templates/gitignore

@@ -4,6 +4,7 @@ logs
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
+pnpm-debug.log*
 
 # Runtime data
 pids
@@ -61,3 +62,5 @@ typings/
 
 # next.js build output
 .next
+
+.pnpm-store/

package/src/utils/build.js

@@ -12,7 +12,7 @@ const colors = require('colors/safe');
 const esbuild = require('esbuild');
 const fse = require('fs-extra');
 const { createUpdateNotifier } = require('./esm-wrapper');
-const decompress = require('decompress');
+const decompress = require('./decompress');
 
 const {
   BUILD_DIR,

package/src/utils/decompress.js

@@ -0,0 +1,121 @@
+// This is a modernized version of the decompress package.
+// Instead of letting decompress import many of its plugins, such as
+// decompress-unzip, decompress-tar, etc, we extracted only the unzip part,
+// so we only depend on decompress-unzip.
+// Original source: https://github.com/kevva/decompress/blob/84a8c104/index.js
+
+const fsP = require('node:fs/promises');
+const path = require('node:path');
+
+const decompressUnzip = require('decompress-unzip');
+
+const safeMakeDir = async (dir, realOutputPath) => {
+  let resolvedPathToCheck;
+
+  try {
+    resolvedPathToCheck = await fsP.realpath(dir);
+  } catch (error) {
+    const parent = path.dirname(dir);
+    resolvedPathToCheck = await safeMakeDir(parent, realOutputPath);
+  }
+
+  // Security check for zip slip vulnerability
+  if (!resolvedPathToCheck.startsWith(realOutputPath)) {
+    throw new Error('Refusing to create a directory outside the output path.');
+  }
+
+  await fsP.mkdir(dir, { recursive: true });
+  return await fsP.realpath(dir);
+};
+
+const preventWritingThroughSymlink = async (destination, realOutputPath) => {
+  let symlinkPointsTo;
+  try {
+    symlinkPointsTo = await fsP.readlink(destination);
+  } catch (error) {
+    // Either no file exists, or it's not a symlink. In either case, this is
+    // not an escape we need to worry about in this phase.
+  }
+
+  if (symlinkPointsTo) {
+    throw new Error('Refusing to write into a symlink');
+  }
+};
+
+const extractItem = async (item, realOutputPath) => {
+  const dest = path.join(realOutputPath, item.path);
+  const mode = item.mode & ~process.umask();
+  const now = new Date();
+
+  if (item.type === 'directory') {
+    await safeMakeDir(dest, realOutputPath);
+    await fsP.utimes(dest, now, item.mtime);
+    return item;
+  }
+
+  await safeMakeDir(path.dirname(dest), realOutputPath);
+
+  if (item.type === 'file') {
+    await preventWritingThroughSymlink(dest, realOutputPath);
+  }
+
+  const realDestinationDir = await fsP.realpath(path.dirname(dest));
+  if (!realDestinationDir.startsWith(realOutputPath)) {
+    throw new Error(
+      'Refusing to write outside output directory: ' + realDestinationDir,
+    );
+  }
+
+  if (item.type === 'symlink') {
+    // Security check to block symlinks pointing outside output directory,
+    // like evil_link -> ../../../../../etc/passwd. We don't throw an error
+    // here, just skip creating the symlink, because there are known zip files
+    // containing such symlinks (such as .editorconfig) that are not essential
+    // to the integration.
+    const absTargetPath = path.resolve(realDestinationDir, item.linkname);
+    const relTargetPath = path.relative(realOutputPath, absTargetPath);
+    if (!relTargetPath.startsWith('..')) {
+      // Windows will have issues with the following line, since creating a
+      // symlink on Windows requires Administrator privilege. But that's fine
+      // because we only run decompress on Windows in CI tests, which do run
+      // with Administrator privilege.
+      await fsP.symlink(item.linkname, dest);
+    }
+  } else {
+    await fsP.writeFile(dest, item.data, { mode });
+    await fsP.utimes(dest, now, item.mtime);
+  }
+
+  return item;
+};
+
+const decompress = async (input, output) => {
+  if (typeof input !== 'string') {
+    throw new TypeError('input must be a file path (string)');
+  }
+
+  if (typeof output !== 'string') {
+    throw new TypeError('output must be a directory path (string)');
+  }
+
+  let fd, buf;
+  try {
+    fd = await fsP.open(input);
+    buf = await fd.readFile();
+  } finally {
+    await fd?.close();
+  }
+
+  // Ensure output directory exists
+  await fsP.mkdir(output, { recursive: true });
+  const realOutputPath = await fsP.realpath(output);
+
+  const items = await decompressUnzip()(buf);
+  return await Promise.all(
+    items.map(async (x) => {
+      return await extractItem(x, realOutputPath);
+    }),
+  );
+};
+
+module.exports = decompress;

package/src/bin/run-deprecated

@@ -1,14 +0,0 @@
-#!/usr/bin/env node
-
-const path = require('node:path');
-
-(async () => {
-  const oclif = await import('@oclif/core');
-  await oclif.execute({ development: false, dir: __dirname });
-
-  console.warn(
-    '[DEPRECATION WARNING] ' +
-      'The executable name "zapier" is deprecated and will be removed in a future version. ' +
-      'Please use "zapier-platform" instead.',
-  );
-})();

package/src/generators/templates/search-or-create/.gitignore

@@ -1,6 +0,0 @@
-build
-docs
-node_modules
-*.log
-.environment
-lib.env