@topolo/sdk 0.21.0 → 0.21.2

package/dist/node/credential-store.cjs

@@ -481,6 +481,24 @@ var import_node_fs = require("fs");
 var import_node_os = require("os");
 var import_node_path = require("path");
 var KEYCHAIN_SERVICE = "topolo-external-agent-installation";
+var MACOS_KEYCHAIN_CHUNK_SIZE = 96;
+var MACOS_KEYCHAIN_CHUNK_PREFIX = "topolo-keychain-chunks:v1:";
+var MACOS_KEYCHAIN_WRITE_SCRIPT = [
+  "log_user 0",
+  "set timeout 10",
+  "set secret [gets stdin]",
+  "spawn -noecho /usr/bin/security add-generic-password -U -a $env(TOPOLO_KEYCHAIN_ACCOUNT) -s $env(TOPOLO_KEYCHAIN_SERVICE) -w",
+  "for {set prompt 0} {$prompt < 2} {incr prompt} {",
+  "  expect {",
+  '    -re {(?i)password} { send -- "$secret\\r" }',
+  "    timeout { exit 70 }",
+  "    eof { exit 71 }",
+  "  }",
+  "}",
+  "expect eof",
+  "set result [wait]",
+  "exit [lindex $result 3]"
+].join("\n");
 function installationStorePath() {
   const override = process.env.TOPOLO_INSTALLATIONS_PATH?.trim();
   if (override) return override;
@@ -505,40 +523,73 @@ function createPlatformInstallationSecretBackend(options = {}) {
   const spawn = options.spawn ?? ((command, args, spawnOptions) => (0, import_node_child_process.spawnSync)(command, args, spawnOptions));
   const root = options.root ?? installationStorePath();
   if (platform2 === "darwin") {
+    const write = (account, value) => runOrThrow(spawn("/usr/bin/expect", ["-c", MACOS_KEYCHAIN_WRITE_SCRIPT], {
+      input: `${value}
+`,
+      encoding: "utf8",
+      env: {
+        ...process.env,
+        TOPOLO_KEYCHAIN_ACCOUNT: account,
+        TOPOLO_KEYCHAIN_SERVICE: KEYCHAIN_SERVICE
+      }
+    }), "macOS Keychain write");
+    const read = (account) => {
+      const result = spawn("security", [
+        "find-generic-password",
+        "-a",
+        account,
+        "-s",
+        KEYCHAIN_SERVICE,
+        "-w"
+      ], { encoding: "utf8" });
+      if (result.status === 44) return null;
+      return runOrThrow(result, "macOS Keychain read");
+    };
+    const remove = (account) => {
+      const result = spawn("security", [
+        "delete-generic-password",
+        "-a",
+        account,
+        "-s",
+        KEYCHAIN_SERVICE
+      ], { encoding: "utf8" });
+      if (result.status !== 44) runOrThrow(result, "macOS Keychain delete");
+    };
+    const chunkAccount = (account, index) => `${account}:chunk:${index}`;
+    const chunkCount = (value) => {
+      if (!value?.startsWith(MACOS_KEYCHAIN_CHUNK_PREFIX)) return 0;
+      const count = Number(value.slice(MACOS_KEYCHAIN_CHUNK_PREFIX.length));
+      if (!Number.isSafeInteger(count) || count < 1) throw new Error("macOS Keychain chunk manifest is invalid.");
+      return count;
+    };
     return {
       async set(account, value) {
-        runOrThrow(spawn("security", [
-          "add-generic-password",
-          "-U",
-          "-a",
-          account,
-          "-s",
-          KEYCHAIN_SERVICE,
-          "-w"
-        ], { input: `${value}
-`, encoding: "utf8" }), "macOS Keychain write");
+        const previousCount = chunkCount(read(account));
+        const chunks = Array.from(
+          { length: Math.max(1, Math.ceil(value.length / MACOS_KEYCHAIN_CHUNK_SIZE)) },
+          (_, index) => value.slice(index * MACOS_KEYCHAIN_CHUNK_SIZE, (index + 1) * MACOS_KEYCHAIN_CHUNK_SIZE)
+        );
+        try {
+          chunks.forEach((chunk, index) => write(chunkAccount(account, index), chunk));
+          write(account, `${MACOS_KEYCHAIN_CHUNK_PREFIX}${chunks.length}`);
+          for (let index = chunks.length; index < previousCount; index += 1) remove(chunkAccount(account, index));
+        } catch (error) {
+          chunks.forEach((_, index) => remove(chunkAccount(account, index)));
+          throw error;
+        }
       },
       async get(account) {
-        const result = spawn("security", [
-          "find-generic-password",
-          "-a",
-          account,
-          "-s",
-          KEYCHAIN_SERVICE,
-          "-w"
-        ], { encoding: "utf8" });
-        if (result.status === 44) return null;
-        return runOrThrow(result, "macOS Keychain read");
+        const manifest = read(account);
+        const count = chunkCount(manifest);
+        if (!count) return manifest;
+        const chunks = Array.from({ length: count }, (_, index) => read(chunkAccount(account, index)));
+        if (chunks.some((chunk) => chunk === null)) throw new Error("macOS Keychain installation secret is incomplete.");
+        return chunks.join("");
       },
       async delete(account) {
-        const result = spawn("security", [
-          "delete-generic-password",
-          "-a",
-          account,
-          "-s",
-          KEYCHAIN_SERVICE
-        ], { encoding: "utf8" });
-        if (result.status !== 44) runOrThrow(result, "macOS Keychain delete");
+        const count = chunkCount(read(account));
+        for (let index = 0; index < count; index += 1) remove(chunkAccount(account, index));
+        remove(account);
       }
     };
   }

package/dist/node/credential-store.js

@@ -428,6 +428,24 @@ import { existsSync } from "fs";
 import { homedir, platform as hostPlatform } from "os";
 import { dirname, join } from "path";
 var KEYCHAIN_SERVICE = "topolo-external-agent-installation";
+var MACOS_KEYCHAIN_CHUNK_SIZE = 96;
+var MACOS_KEYCHAIN_CHUNK_PREFIX = "topolo-keychain-chunks:v1:";
+var MACOS_KEYCHAIN_WRITE_SCRIPT = [
+  "log_user 0",
+  "set timeout 10",
+  "set secret [gets stdin]",
+  "spawn -noecho /usr/bin/security add-generic-password -U -a $env(TOPOLO_KEYCHAIN_ACCOUNT) -s $env(TOPOLO_KEYCHAIN_SERVICE) -w",
+  "for {set prompt 0} {$prompt < 2} {incr prompt} {",
+  "  expect {",
+  '    -re {(?i)password} { send -- "$secret\\r" }',
+  "    timeout { exit 70 }",
+  "    eof { exit 71 }",
+  "  }",
+  "}",
+  "expect eof",
+  "set result [wait]",
+  "exit [lindex $result 3]"
+].join("\n");
 function installationStorePath() {
   const override = process.env.TOPOLO_INSTALLATIONS_PATH?.trim();
   if (override) return override;
@@ -452,40 +470,73 @@ function createPlatformInstallationSecretBackend(options = {}) {
   const spawn = options.spawn ?? ((command, args, spawnOptions) => spawnSync(command, args, spawnOptions));
   const root = options.root ?? installationStorePath();
   if (platform2 === "darwin") {
+    const write = (account, value) => runOrThrow(spawn("/usr/bin/expect", ["-c", MACOS_KEYCHAIN_WRITE_SCRIPT], {
+      input: `${value}
+`,
+      encoding: "utf8",
+      env: {
+        ...process.env,
+        TOPOLO_KEYCHAIN_ACCOUNT: account,
+        TOPOLO_KEYCHAIN_SERVICE: KEYCHAIN_SERVICE
+      }
+    }), "macOS Keychain write");
+    const read = (account) => {
+      const result = spawn("security", [
+        "find-generic-password",
+        "-a",
+        account,
+        "-s",
+        KEYCHAIN_SERVICE,
+        "-w"
+      ], { encoding: "utf8" });
+      if (result.status === 44) return null;
+      return runOrThrow(result, "macOS Keychain read");
+    };
+    const remove = (account) => {
+      const result = spawn("security", [
+        "delete-generic-password",
+        "-a",
+        account,
+        "-s",
+        KEYCHAIN_SERVICE
+      ], { encoding: "utf8" });
+      if (result.status !== 44) runOrThrow(result, "macOS Keychain delete");
+    };
+    const chunkAccount = (account, index) => `${account}:chunk:${index}`;
+    const chunkCount = (value) => {
+      if (!value?.startsWith(MACOS_KEYCHAIN_CHUNK_PREFIX)) return 0;
+      const count = Number(value.slice(MACOS_KEYCHAIN_CHUNK_PREFIX.length));
+      if (!Number.isSafeInteger(count) || count < 1) throw new Error("macOS Keychain chunk manifest is invalid.");
+      return count;
+    };
     return {
       async set(account, value) {
-        runOrThrow(spawn("security", [
-          "add-generic-password",
-          "-U",
-          "-a",
-          account,
-          "-s",
-          KEYCHAIN_SERVICE,
-          "-w"
-        ], { input: `${value}
-`, encoding: "utf8" }), "macOS Keychain write");
+        const previousCount = chunkCount(read(account));
+        const chunks = Array.from(
+          { length: Math.max(1, Math.ceil(value.length / MACOS_KEYCHAIN_CHUNK_SIZE)) },
+          (_, index) => value.slice(index * MACOS_KEYCHAIN_CHUNK_SIZE, (index + 1) * MACOS_KEYCHAIN_CHUNK_SIZE)
+        );
+        try {
+          chunks.forEach((chunk, index) => write(chunkAccount(account, index), chunk));
+          write(account, `${MACOS_KEYCHAIN_CHUNK_PREFIX}${chunks.length}`);
+          for (let index = chunks.length; index < previousCount; index += 1) remove(chunkAccount(account, index));
+        } catch (error) {
+          chunks.forEach((_, index) => remove(chunkAccount(account, index)));
+          throw error;
+        }
       },
       async get(account) {
-        const result = spawn("security", [
-          "find-generic-password",
-          "-a",
-          account,
-          "-s",
-          KEYCHAIN_SERVICE,
-          "-w"
-        ], { encoding: "utf8" });
-        if (result.status === 44) return null;
-        return runOrThrow(result, "macOS Keychain read");
+        const manifest = read(account);
+        const count = chunkCount(manifest);
+        if (!count) return manifest;
+        const chunks = Array.from({ length: count }, (_, index) => read(chunkAccount(account, index)));
+        if (chunks.some((chunk) => chunk === null)) throw new Error("macOS Keychain installation secret is incomplete.");
+        return chunks.join("");
       },
       async delete(account) {
-        const result = spawn("security", [
-          "delete-generic-password",
-          "-a",
-          account,
-          "-s",
-          KEYCHAIN_SERVICE
-        ], { encoding: "utf8" });
-        if (result.status !== 44) runOrThrow(result, "macOS Keychain delete");
+        const count = chunkCount(read(account));
+        for (let index = 0; index < count; index += 1) remove(chunkAccount(account, index));
+        remove(account);
       }
     };
   }

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@topolo/sdk",
   "packageManager": "pnpm@10.17.1",
-  "version": "0.21.0",
-  "topoloPublishedVersion": "0.21.0",
+  "version": "0.21.2",
+  "topoloPublishedVersion": "0.21.2",
   "description": "Typed client SDK for the Topolo platform. Used by TopoloCli, TopoloMCP, and third-party agents.",
   "license": "UNLICENSED",
   "author": "Topolo",