@settlemint/dalp-cli 3.1.32-main.42600267094 → 3.1.32-main.42608383459

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@settlemint/dalp-cli",
-  "version": "3.1.32-main.42600267094",
+  "version": "3.1.32-main.42608383459",
   "private": false,
   "description": "CLI for the Digital Asset Lifecycle Platform — manage tokens, identities, compliance, and more from the command line.",
   "homepage": "https://settlemint.com",
@@ -50,14 +50,14 @@
   },
   "dependencies": {
     "@modelcontextprotocol/server": "2.4.0",
-    "@settlemint/dalp-sdk": "3.1.32-main.42600267094",
+    "@settlemint/dalp-sdk": "3.1.32-main.42608383459",
     "incur": "0.7.1",
     "zod": "4.6.7"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.5",
-    "@testkit/effect-bun-test": "3.1.32-main.42600267094",
-    "@tools/typescript-config": "3.1.32-main.42600267094",
+    "@testkit/effect-bun-test": "3.1.32-main.42608383459",
+    "@tools/typescript-config": "3.1.32-main.42608383459",
     "@types/bun": "1.4.4",
     "publint": "0.3.25"
   },

package/src/lib/credential-store.ts

@@ -8,6 +8,9 @@ const KEYCHAIN_ENTRY_SEPARATOR_PATTERN = /\n(?=keychain:)/u;
 const ACCOUNT_PATTERN = /"acct"<blob>="([^"]*)"/u;
 
 const SERVICE_NAME = "dalp-cli";
+const SECURITY_INTERACTIVE_MAX_LINE_BYTES = 4094;
+const SECURITY_QUOTED_ESCAPE_PATTERN = /["\\]/gu;
+const SECURITY_LINE_BREAK_PATTERN = /[\n\r\0]/u;
 
 const StoredCredentialsSchema = z.object({
   apiKey: z.string().min(1),
@@ -24,14 +27,20 @@ export interface CredentialStoreOptions {
   readonly configDir?: string;
   readonly platform?: NodeJS.Platform;
   readonly runSecurity?: (
-    args: ReadonlyArray<string>
+    args: ReadonlyArray<string>,
+    stdin?: string
   ) => Promise<{ readonly exitCode: number; readonly stdout: string }>;
 }
 
 const defaultRunSecurity = async (
-  args: ReadonlyArray<string>
+  args: ReadonlyArray<string>,
+  stdin?: string
 ): Promise<{ readonly exitCode: number; readonly stdout: string }> => {
-  const proc = Bun.spawn(["security", ...args], { stdout: "pipe", stderr: "pipe" });
+  const proc = Bun.spawn(["security", ...args], {
+    stdin: stdin === undefined ? "ignore" : new TextEncoder().encode(stdin),
+    stdout: "pipe",
+    stderr: "pipe",
+  });
   const [stdout, exitCode] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
   return { exitCode, stdout };
 };
@@ -76,6 +85,43 @@ async function deleteKeychainAccount(
   }
 }
 
+function quoteSecurityArgument(value: string): string {
+  return `"${value.replaceAll(SECURITY_QUOTED_ESCAPE_PATTERN, (character) => `\\${character}`)}"`;
+}
+
+async function addKeychainPassword(
+  runSecurity: NonNullable<CredentialStoreOptions["runSecurity"]>,
+  account: string,
+  password: string
+): Promise<void> {
+  const command = [
+    "add-generic-password",
+    "-s",
+    quoteSecurityArgument(SERVICE_NAME),
+    "-a",
+    quoteSecurityArgument(account),
+    "-X",
+    Buffer.from(password, "utf8").toString("hex"),
+    "-U",
+  ].join(" ");
+  if (
+    SECURITY_LINE_BREAK_PATTERN.test(account) ||
+    Buffer.byteLength(command, "utf8") > SECURITY_INTERACTIVE_MAX_LINE_BYTES
+  ) {
+    throw makeCliError({
+      code: "kit.cli.CREDENTIAL_STORE_FAILED",
+      message: `The ${SERVICE_NAME} keychain item for ${JSON.stringify(account)} cannot be passed to the macOS security tool as one command line.`,
+    });
+  }
+  const result = await runSecurity(["-i"], `${command}\n`);
+  if (result.exitCode !== 0) {
+    throw makeCliError({
+      code: "kit.cli.CREDENTIAL_STORE_FAILED",
+      message: `Keychain save failed with exit code ${result.exitCode}`,
+    });
+  }
+}
+
 function resolvePlatform(options: CredentialStoreOptions): NodeJS.Platform {
   if (options.platform !== undefined) {
     return options.platform;
@@ -99,22 +145,7 @@ export async function saveCredentials(
 
   if (platform === "darwin") {
     const existing = await keychainAccounts(runSecurity);
-    const result = await runSecurity([
-      "add-generic-password",
-      "-s",
-      SERVICE_NAME,
-      "-a",
-      parsed.userEmail,
-      "-w",
-      encoded,
-      "-U",
-    ]);
-    if (result.exitCode !== 0) {
-      throw makeCliError({
-        code: "kit.cli.CREDENTIAL_STORE_FAILED",
-        message: `Keychain save failed with exit code ${result.exitCode}`,
-      });
-    }
+    await addKeychainPassword(runSecurity, parsed.userEmail, encoded);
     try {
       for (const account of existing.filter((name) => name !== parsed.userEmail)) {
         await deleteKeychainAccount(runSecurity, account);