@settlemint/dalp-cli 3.1.32-main.42593324632 → 3.1.32-main.42608383459

package/dist/dalp.js

@@ -53056,7 +53056,7 @@ async function runCommand(context, operation, errorContext = UNKNOWN_COMMAND_ERR
 // package.json
 var package_default = {
   name: "@settlemint/dalp-cli",
-  version: "3.1.32-main.42593324632",
+  version: "3.1.32-main.42608383459",
   private: false,
   description: "CLI for the Digital Asset Lifecycle Platform \u2014 manage tokens, identities, compliance, and more from the command line.",
   homepage: "https://settlemint.com",
@@ -53268,6 +53268,9 @@ import path8 from "path";
 var KEYCHAIN_ENTRY_SEPARATOR_PATTERN = /\n(?=keychain:)/u;
 var ACCOUNT_PATTERN = /"acct"<blob>="([^"]*)"/u;
 var SERVICE_NAME = "dalp-cli";
+var SECURITY_INTERACTIVE_MAX_LINE_BYTES = 4094;
+var SECURITY_QUOTED_ESCAPE_PATTERN = /["\\]/gu;
+var SECURITY_LINE_BREAK_PATTERN = /[\n\r\0]/u;
 var StoredCredentialsSchema = object({
   apiKey: string2().min(1),
   apiKeyId: string2().min(1),
@@ -53276,8 +53279,12 @@ var StoredCredentialsSchema = object({
   activeOrgId: string2().min(1).optional(),
   apiUrl: url()
 });
-var defaultRunSecurity = async (args) => {
-  const proc = Bun.spawn(["security", ...args], { stdout: "pipe", stderr: "pipe" });
+var defaultRunSecurity = async (args, stdin) => {
+  const proc = Bun.spawn(["security", ...args], {
+    stdin: stdin === undefined ? "ignore" : new TextEncoder().encode(stdin),
+    stdout: "pipe",
+    stderr: "pipe"
+  });
   const [stdout, exitCode] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
   return { exitCode, stdout };
 };
@@ -53313,6 +53320,35 @@ async function deleteKeychainAccount(runSecurity, account) {
     });
   }
 }
+function quoteSecurityArgument(value) {
+  return `"${value.replaceAll(SECURITY_QUOTED_ESCAPE_PATTERN, (character) => `\\${character}`)}"`;
+}
+async function addKeychainPassword(runSecurity, account, password) {
+  const command = [
+    "add-generic-password",
+    "-s",
+    quoteSecurityArgument(SERVICE_NAME),
+    "-a",
+    quoteSecurityArgument(account),
+    "-X",
+    Buffer.from(password, "utf8").toString("hex"),
+    "-U"
+  ].join(" ");
+  if (SECURITY_LINE_BREAK_PATTERN.test(account) || Buffer.byteLength(command, "utf8") > SECURITY_INTERACTIVE_MAX_LINE_BYTES) {
+    throw makeCliError({
+      code: "kit.cli.CREDENTIAL_STORE_FAILED",
+      message: `The ${SERVICE_NAME} keychain item for ${JSON.stringify(account)} cannot be passed to the macOS security tool as one command line.`
+    });
+  }
+  const result = await runSecurity(["-i"], `${command}
+`);
+  if (result.exitCode !== 0) {
+    throw makeCliError({
+      code: "kit.cli.CREDENTIAL_STORE_FAILED",
+      message: `Keychain save failed with exit code ${result.exitCode}`
+    });
+  }
+}
 function resolvePlatform(options) {
   if (options.platform !== undefined) {
     return options.platform;
@@ -53331,22 +53367,7 @@ async function saveCredentials(credentials, options = {}) {
   const encoded = JSON.stringify(parsed);
   if (platform === "darwin") {
     const existing = await keychainAccounts(runSecurity);
-    const result = await runSecurity([
-      "add-generic-password",
-      "-s",
-      SERVICE_NAME,
-      "-a",
-      parsed.userEmail,
-      "-w",
-      encoded,
-      "-U"
-    ]);
-    if (result.exitCode !== 0) {
-      throw makeCliError({
-        code: "kit.cli.CREDENTIAL_STORE_FAILED",
-        message: `Keychain save failed with exit code ${result.exitCode}`
-      });
-    }
+    await addKeychainPassword(runSecurity, parsed.userEmail, encoded);
     try {
       for (const account of existing.filter((name) => name !== parsed.userEmail)) {
         await deleteKeychainAccount(runSecurity, account);
@@ -53528,6 +53549,15 @@ var apiKeyResponseSchema = object({
 var MAX_LOGIN_RESPONSE_BYTES = 1024 * 1024;
 var CLI_API_KEY_EXPIRES_IN_SECONDS = 90 * 24 * 60 * 60;
 var DEVICE_CLIENT_ID = "dalp-cli";
+var SERVER_API_KEY_NAME_MAX_LENGTH = 32;
+var cliApiKeyName = (machine) => {
+  const name = `${DEVICE_CLIENT_ID} (${machine})`;
+  if (name.length <= SERVER_API_KEY_NAME_MAX_LENGTH) {
+    return name;
+  }
+  const room = SERVER_API_KEY_NAME_MAX_LENGTH - `${DEVICE_CLIENT_ID} (\u2026)`.length;
+  return `${DEVICE_CLIENT_ID} (${machine.slice(0, room)}\u2026)`;
+};
 var isLoopbackHost = (host) => host === "localhost" || host === "127.0.0.1" || host === "::1" || host === "[::1]";
 function validateLoginBaseUrl(apiUrl) {
   let parsed;
@@ -53757,7 +53787,7 @@ Open this URL in your browser:
       }
       const { walletFactor } = c.options;
       const walletCode = await readWalletCode(walletFactor, c.env.DALP_WALLET_CODE, c.agent === true);
-      const apiKeyName = `dalp-cli (${hostname3()})`;
+      const apiKeyName = cliApiKeyName(hostname3());
       const apiKeyResponse = await postJson(`${baseUrl}/api/auth/api-key/create`, {
         name: apiKeyName,
         expiresIn: CLI_API_KEY_EXPIRES_IN_SECONDS,
@@ -55004,4 +55034,4 @@ if (false) {}
 // src/bin.ts
 await cli.serve();
 
-//# debugId=57E788197DD2D10364756E2164756E21
+//# debugId=62F81022351D668364756E2164756E21