@settlemint/dalp-cli 3.1.32-main.42600267094 → 3.1.32-main.42608383459

package/dist/dalp.js

@@ -53056,7 +53056,7 @@ async function runCommand(context, operation, errorContext = UNKNOWN_COMMAND_ERR
 // package.json
 var package_default = {
   name: "@settlemint/dalp-cli",
-  version: "3.1.32-main.42600267094",
+  version: "3.1.32-main.42608383459",
   private: false,
   description: "CLI for the Digital Asset Lifecycle Platform \u2014 manage tokens, identities, compliance, and more from the command line.",
   homepage: "https://settlemint.com",
@@ -53268,6 +53268,9 @@ import path8 from "path";
 var KEYCHAIN_ENTRY_SEPARATOR_PATTERN = /\n(?=keychain:)/u;
 var ACCOUNT_PATTERN = /"acct"<blob>="([^"]*)"/u;
 var SERVICE_NAME = "dalp-cli";
+var SECURITY_INTERACTIVE_MAX_LINE_BYTES = 4094;
+var SECURITY_QUOTED_ESCAPE_PATTERN = /["\\]/gu;
+var SECURITY_LINE_BREAK_PATTERN = /[\n\r\0]/u;
 var StoredCredentialsSchema = object({
   apiKey: string2().min(1),
   apiKeyId: string2().min(1),
@@ -53276,8 +53279,12 @@ var StoredCredentialsSchema = object({
   activeOrgId: string2().min(1).optional(),
   apiUrl: url()
 });
-var defaultRunSecurity = async (args) => {
-  const proc = Bun.spawn(["security", ...args], { stdout: "pipe", stderr: "pipe" });
+var defaultRunSecurity = async (args, stdin) => {
+  const proc = Bun.spawn(["security", ...args], {
+    stdin: stdin === undefined ? "ignore" : new TextEncoder().encode(stdin),
+    stdout: "pipe",
+    stderr: "pipe"
+  });
   const [stdout, exitCode] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
   return { exitCode, stdout };
 };
@@ -53313,6 +53320,35 @@ async function deleteKeychainAccount(runSecurity, account) {
     });
   }
 }
+function quoteSecurityArgument(value) {
+  return `"${value.replaceAll(SECURITY_QUOTED_ESCAPE_PATTERN, (character) => `\\${character}`)}"`;
+}
+async function addKeychainPassword(runSecurity, account, password) {
+  const command = [
+    "add-generic-password",
+    "-s",
+    quoteSecurityArgument(SERVICE_NAME),
+    "-a",
+    quoteSecurityArgument(account),
+    "-X",
+    Buffer.from(password, "utf8").toString("hex"),
+    "-U"
+  ].join(" ");
+  if (SECURITY_LINE_BREAK_PATTERN.test(account) || Buffer.byteLength(command, "utf8") > SECURITY_INTERACTIVE_MAX_LINE_BYTES) {
+    throw makeCliError({
+      code: "kit.cli.CREDENTIAL_STORE_FAILED",
+      message: `The ${SERVICE_NAME} keychain item for ${JSON.stringify(account)} cannot be passed to the macOS security tool as one command line.`
+    });
+  }
+  const result = await runSecurity(["-i"], `${command}
+`);
+  if (result.exitCode !== 0) {
+    throw makeCliError({
+      code: "kit.cli.CREDENTIAL_STORE_FAILED",
+      message: `Keychain save failed with exit code ${result.exitCode}`
+    });
+  }
+}
 function resolvePlatform(options) {
   if (options.platform !== undefined) {
     return options.platform;
@@ -53331,22 +53367,7 @@ async function saveCredentials(credentials, options = {}) {
   const encoded = JSON.stringify(parsed);
   if (platform === "darwin") {
     const existing = await keychainAccounts(runSecurity);
-    const result = await runSecurity([
-      "add-generic-password",
-      "-s",
-      SERVICE_NAME,
-      "-a",
-      parsed.userEmail,
-      "-w",
-      encoded,
-      "-U"
-    ]);
-    if (result.exitCode !== 0) {
-      throw makeCliError({
-        code: "kit.cli.CREDENTIAL_STORE_FAILED",
-        message: `Keychain save failed with exit code ${result.exitCode}`
-      });
-    }
+    await addKeychainPassword(runSecurity, parsed.userEmail, encoded);
     try {
       for (const account of existing.filter((name) => name !== parsed.userEmail)) {
         await deleteKeychainAccount(runSecurity, account);
@@ -55013,4 +55034,4 @@ if (false) {}
 // src/bin.ts
 await cli.serve();
 
-//# debugId=9A6D1338301FCC5464756E2164756E21
+//# debugId=62F81022351D668364756E2164756E21