@camstack/system 1.2.441 → 1.2.443

package/dist/builtins/local-auth/local-auth.addon.js

@@ -3,10 +3,10 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
+const require_dist = require("../../dist-D9qT3jHr.js");
 const require_safe_buffer$1 = require("../../safe-buffer-D3aoa-7X.js");
 const require_ms$1 = require("../../ms-LB3giGoU.js");
-const require_device_ca = require("../../device-ca-196DAEZT.js");
+const require_device_ca = require("../../device-ca-DGayRmC0.js");
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 let crypto$1 = require("crypto");
@@ -8293,7 +8293,7 @@ var OAUTH_SESSIONS_COLLECTION = "oauth_sessions";
 * = null`) is INACTIVE — `verifyTotp` returns false until confirmation.
 *
 * @durable class=config owner=local-auth
-*   write="`setup` inserts a fresh secret for the user (deleting any pending row
+*   write="`setup` inserts a keychain marker for the user's seed (D878; deleting any pending row
 *     first); `confirm` flips `confirmedAt` once a valid code proves possession"
 *   retention="`disable` deletes the row, and `setup` deletes before re-inserting.
 *     Nothing else prunes — deleting a USER does not cascade here, so their
@@ -10912,6 +10912,16 @@ function d(t) {
 * we do NOT reuse the old secret on re-enroll (avoids the case where a
 * leaked secret stays valid after a "rotation").
 *
+* ## Where the seed lives (D878)
+*
+* The seed is a keychain secret (owner `system`, ref
+* `secret://system/row/user_totp/<userId>/secret`); the row's `secret` column
+* holds the JSON keychain marker, never the seed. A row written before D878
+* still holds the seed inline and keeps working until the operator's
+* `migrateRawSecrets` moves it (nothing migrates at boot). A seed the keychain
+* cannot serve makes `confirm`/`verify` THROW {@link TotpSecretUnavailableError}:
+* 2FA fails closed, never accepts a code and never reads as "not enrolled".
+*
 * `otplib` v13's functional API (`generateSync`/`verifySync`) uses RFC 6238
 * TOTP with a default 30-second period. We pass a per-call `epochTolerance`
 * of one step in either direction (±30 s) — operator clock skew is the usual
@@ -10937,13 +10947,52 @@ function parseRow(data) {
 		createdAt
 	};
 }
+/**
+* The seed cannot be used right now. The message is what a not-yet-logged-in
+* caller sees, so it is generic; `reason` (keychain detail) is for the server log only.
+*/
+var TotpSecretUnavailableError = class extends Error {
+	reason;
+	constructor(reason) {
+		super("two-factor verification is temporarily unavailable; try again later or ask an administrator");
+		this.reason = reason;
+		this.name = "TotpSecretUnavailableError";
+	}
+};
+/** A seed cannot be stored: setup is refused, never written as plaintext. */
+var TotpSecretStorageUnavailableError = class extends Error {
+	constructor(reason) {
+		super(`two-factor setup is unavailable: the TOTP seed cannot be stored in the keychain (${reason}).`);
+		this.name = "TotpSecretStorageUnavailableError";
+	}
+};
+/** What the stored column is: a keychain marker, a pre-D878 inline seed, or garbage (never an inline seed). */
+function classify(column) {
+	if (column.length === 0) return { kind: "invalid" };
+	if (!column.startsWith("{")) return { kind: "inline" };
+	try {
+		const parsed = JSON.parse(column);
+		return require_dist.isSecretMarker(parsed) ? {
+			kind: "marker",
+			ref: parsed.$secret
+		} : { kind: "invalid" };
+	} catch {
+		return { kind: "invalid" };
+	}
+}
 var TotpManager = class {
 	store;
 	/** ±N steps of clock-skew tolerance, expressed in seconds for otplib v13's
 	*  per-call `epochTolerance`. Default window 1 = ±30 s. */
 	epochTolerance;
+	secrets;
+	logger;
+	/** Per-user queue: setup / confirm / disable / migration never interleave on one user. */
+	chains = /* @__PURE__ */ new Map();
 	constructor(store, opts = {}) {
 		this.store = store;
+		this.secrets = opts.secrets ?? null;
+		this.logger = opts.logger ?? null;
 		this.epochTolerance = (opts.window ?? 1) * TOTP_PERIOD_SECONDS;
 	}
 	/**
@@ -10955,23 +11004,35 @@ var TotpManager = class {
 	* the account name; we use the supplied `username` for human-readable
 	* recognition. `ISSUER` is the CamStack brand.
 	*/
-	async setup(userId, username) {
+	setup(userId, username) {
+		return this.serialize(userId, () => this.setupLocked(userId, username));
+	}
+	async setupLocked(userId, username) {
 		const secret = I();
 		const otpauthUrl = T({
 			secret,
 			label: username,
 			issuer: ISSUER
 		});
+		const ref = this.refFor(userId);
+		if (this.secrets === null || ref === null) throw new TotpSecretStorageUnavailableError("this process has no keychain door");
+		const state = await this.secrets.state().catch(() => null);
+		if (state === null || state.state !== "ready") throw new TotpSecretStorageUnavailableError("the keychain is locked");
+		await this.store.delete.mutate({
+			collection: TOTP_COLLECTION,
+			key: userId
+		});
+		try {
+			await this.secrets.put(ref, secret);
+		} catch (err) {
+			throw new TotpSecretStorageUnavailableError(err instanceof Error ? err.message : String(err));
+		}
 		const row = {
 			userId,
-			secret,
+			secret: JSON.stringify(require_dist.makeSecretMarker(ref)),
 			confirmedAt: null,
 			createdAt: Date.now()
 		};
-		await this.store.delete.mutate({
-			collection: TOTP_COLLECTION,
-			key: userId
-		});
 		await this.store.insert.mutate({
 			collection: TOTP_COLLECTION,
 			record: {
@@ -10991,12 +11052,15 @@ var TotpManager = class {
 	* rows: re-confirming a valid code just succeeds with no state
 	* change.
 	*/
-	async confirm(userId, code) {
+	confirm(userId, code) {
+		return this.serialize(userId, () => this.confirmLocked(userId, code));
+	}
+	async confirmLocked(userId, code) {
 		const row = await this.find(userId);
 		if (!row) return false;
 		if (!d({
 			token: code,
-			secret: row.secret,
+			secret: await this.seedOf(row),
 			epochTolerance: this.epochTolerance
 		}).valid) return false;
 		if (row.confirmedAt === null) {
@@ -11015,11 +11079,23 @@ var TotpManager = class {
 	/**
 	* Remove enrollment. Idempotent — no error if the user had no row.
 	*/
-	async disable(userId) {
-		await this.store.delete.mutate({
-			collection: TOTP_COLLECTION,
-			key: userId
+	disable(userId) {
+		return this.serialize(userId, async () => {
+			await this.store.delete.mutate({
+				collection: TOTP_COLLECTION,
+				key: userId
+			});
+			await this.dropSeed(userId);
+		});
+	}
+	serialize(userId, fn) {
+		const run = (this.chains.get(userId) ?? Promise.resolve()).then(fn, fn);
+		const tail = run.catch(() => void 0);
+		this.chains.set(userId, tail);
+		tail.then(() => {
+			if (this.chains.get(userId) === tail) this.chains.delete(userId);
 		});
+		return run;
 	}
 	/**
 	* Verify a code against the confirmed secret. Returns `false` when:
@@ -11033,7 +11109,7 @@ var TotpManager = class {
 		if (row.confirmedAt === null) return false;
 		return d({
 			token: code,
-			secret: row.secret,
+			secret: await this.seedOf(row),
 			epochTolerance: this.epochTolerance
 		}).valid;
 	}
@@ -11052,6 +11128,132 @@ var TotpManager = class {
 			confirmedAt: row.confirmedAt
 		};
 	}
+	refFor(userId) {
+		return this.secrets === null ? null : this.secrets.ref({
+			kind: "row",
+			collection: TOTP_COLLECTION,
+			rowId: userId
+		}, "secret");
+	}
+	/** A refused read: generic to the caller, the keychain detail to the server log. */
+	unavailable(userId, reason) {
+		this.logger?.warn("TOTP seed unavailable", {
+			tags: { userId },
+			meta: { reason }
+		});
+		return new TotpSecretUnavailableError(reason);
+	}
+	/** The seed in clear: from the keychain for a marker row, inline for a pre-D878 row. Throws when unreadable. */
+	async seedOf(row) {
+		const column = classify(row.secret);
+		if (column.kind === "inline") return row.secret;
+		if (column.kind === "invalid") throw this.unavailable(row.userId, "malformed seed column");
+		if (this.secrets === null || column.ref !== this.refFor(row.userId)) throw this.unavailable(row.userId, "marker does not belong to this user");
+		let answer;
+		try {
+			answer = (await this.secrets.resolve([column.ref]))[column.ref];
+		} catch (err) {
+			throw this.unavailable(row.userId, err instanceof Error ? err.message : String(err));
+		}
+		if (answer?.kind === "value") return answer.value;
+		throw this.unavailable(row.userId, answer?.kind === "unavailable" ? answer.reason : answer?.kind ?? "no-answer");
+	}
+	/** Remove a user's seed from the keychain; a miss leaves an orphan the Secrets page shows. */
+	async dropSeed(userId) {
+		const ref = this.refFor(userId);
+		if (ref === null) return;
+		try {
+			await this.secrets?.delete([ref]);
+		} catch {}
+	}
+	/**
+	* D878: move every inline seed into the keychain. Dry run unless `apply`.
+	* Per row: put -> read back and compare -> only then rewrite the row with the
+	* marker, so the inline seed is cleared by the verified move and nowhere
+	* else. Counts only; idempotent.
+	*/
+	async migrateRawSecrets(apply) {
+		const rows = await this.readAll();
+		let raw = 0;
+		let markers = 0;
+		let migrated = 0;
+		let failed = 0;
+		for (const row of rows) {
+			const kind = classify(row.secret).kind;
+			if (kind === "marker") {
+				markers += 1;
+				continue;
+			}
+			if (kind !== "inline") continue;
+			raw += 1;
+			if (!apply) continue;
+			if (await this.moveRow(row)) migrated += 1;
+			else failed += 1;
+		}
+		let remainingRaw = 0;
+		let unresolvedMarkers = 0;
+		for (const row of await this.readAll()) {
+			if (classify(row.secret).kind === "inline") {
+				remainingRaw += 1;
+				continue;
+			}
+			try {
+				await this.seedOf(row);
+			} catch {
+				unresolvedMarkers += 1;
+			}
+		}
+		return {
+			apply,
+			rows: rows.length,
+			raw,
+			markers,
+			migrated,
+			failed,
+			remainingRaw,
+			unresolvedMarkers,
+			verified: remainingRaw === 0 && unresolvedMarkers === 0
+		};
+	}
+	/**
+	* Compare-and-set under the user's queue: the row is re-read and moved only if
+	* it still holds the very inline seed we planned to move, so a concurrent
+	* `setup` (its seed and marker) is never overwritten. The ref is always the
+	* user's own, never taken from the row.
+	*/
+	moveRow(planned) {
+		return this.serialize(planned.userId, async () => {
+			const ref = this.refFor(planned.userId);
+			if (this.secrets === null || ref === null) return false;
+			try {
+				const current = await this.find(planned.userId);
+				if (current === null || current.secret !== planned.secret) return false;
+				await this.secrets.put(ref, planned.secret);
+				const back = (await this.secrets.resolve([ref]))[ref];
+				if (back?.kind !== "value" || back.value !== planned.secret) return false;
+				const next = {
+					...current,
+					secret: JSON.stringify(require_dist.makeSecretMarker(ref))
+				};
+				await this.store.update.mutate({
+					collection: TOTP_COLLECTION,
+					id: planned.userId,
+					data: { ...next }
+				});
+				return true;
+			} catch {
+				return false;
+			}
+		});
+	}
+	async readAll() {
+		const results = await this.store.query.query({ collection: TOTP_COLLECTION });
+		const out = [];
+		for (const r of results) try {
+			out.push(parseRow(r.data));
+		} catch {}
+		return out;
+	}
 	async find(userId) {
 		const results = await this.store.query.query({
 			collection: TOTP_COLLECTION,
@@ -11549,7 +11751,10 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 			this.apiKeyManager = new ApiKeyManager(storageAccess);
 			this.scopedTokenManager = new ScopedTokenManager(store);
 			this.oauthSessionManager = new OauthSessionManager(store);
-			this.totpManager = new TotpManager(store);
+			this.totpManager = new TotpManager(store, {
+				secrets: forOwner === null ? null : forOwner("system"),
+				logger: this.ctx.logger
+			});
 			this.externalIdentities = new ExternalIdentityManager(store);
 			this.loginSessions = new LoginSessionManager(store, { logger: this.ctx.logger });
 			await this.loginSessions.load();
@@ -11791,6 +11996,10 @@ var LocalAuthAddon = class extends require_dist.BaseAddon {
 				};
 				return this.totpManager.getStatus(input.userId);
 			},
+			migrateRawSecrets: async (input) => {
+				if (!this.totpManager) throw new Error("TOTP management not available");
+				return this.totpManager.migrateRawSecrets(input.apply);
+			},
 			verifyTotp: async (input) => {
 				if (!this.totpManager) return { valid: false };
 				return { valid: await this.totpManager.verify(input.userId, input.code) };

package/dist/builtins/local-auth/local-auth.addon.mjs

@@ -1,8 +1,8 @@
 import { i as __require, o as __toESM, t as __commonJSMin } from "../../chunk-CNf5ZN-e.mjs";
-import { E as DEVICE_NONCE_TTL_MS, It as deviceCredentialsCapability, Q as SsoBridgeClaimsSchema, T as DEVICE_ENROLLMENT_TTL_MS, X as ScopedTokenSchema, Zt as formatDeviceRevoker, a as ApiKeyRecordSchema, cr as userManagementCapability, ct as authProviderCapability, jr as BaseAddon, mt as buildDeviceSignatureMessage, pt as buildDeviceEnrollmentLink, rt as UserRecordSchema, xi as userError } from "../../dist-BWvkuc31.mjs";
+import { E as DEVICE_NONCE_TTL_MS, It as deviceCredentialsCapability, Q as SsoBridgeClaimsSchema, T as DEVICE_ENROLLMENT_TTL_MS, Ti as userError, X as ScopedTokenSchema, Zt as formatDeviceRevoker, a as ApiKeyRecordSchema, cr as userManagementCapability, ct as authProviderCapability, jr as BaseAddon, li as makeSecretMarker, mt as buildDeviceSignatureMessage, oi as isSecretMarker, pt as buildDeviceEnrollmentLink, rt as UserRecordSchema } from "../../dist-Bxt_S-9a.mjs";
 import { t as require_safe_buffer } from "../../safe-buffer-B1OjL1I9.mjs";
 import { t as require_ms } from "../../ms-CgH2OFlD.mjs";
-import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-D8Ri9TVz.mjs";
+import { _ as setProcessJwtSigningKey, a as importDevicePublicKey, c as rebuildDeviceCaCertificate, d as JWT_SIGNING_KEY_REF, g as processJwtSigningKey, h as loadJwtSigningKey, i as generateDeviceCa, l as verifyDeviceLeaf, m as getProcessJwtSigningKeyState, n as DEVICE_CA_KEY_REF, o as issueDeviceLeaf, r as DEVICE_CA_SETTINGS_SECTION, s as loadDeviceCa, t as DEVICE_CA_FIELD, u as verifyDeviceSignature } from "../../device-ca-DBfiJ_SB.mjs";
 import * as crypto$1 from "node:crypto";
 import { X509Certificate, createHash, randomUUID, timingSafeEqual } from "node:crypto";
 import nodeCrypto from "crypto";
@@ -8283,7 +8283,7 @@ var OAUTH_SESSIONS_COLLECTION = "oauth_sessions";
 * = null`) is INACTIVE — `verifyTotp` returns false until confirmation.
 *
 * @durable class=config owner=local-auth
-*   write="`setup` inserts a fresh secret for the user (deleting any pending row
+*   write="`setup` inserts a keychain marker for the user's seed (D878; deleting any pending row
 *     first); `confirm` flips `confirmedAt` once a valid code proves possession"
 *   retention="`disable` deletes the row, and `setup` deletes before re-inserting.
 *     Nothing else prunes — deleting a USER does not cascade here, so their
@@ -10902,6 +10902,16 @@ function d(t) {
 * we do NOT reuse the old secret on re-enroll (avoids the case where a
 * leaked secret stays valid after a "rotation").
 *
+* ## Where the seed lives (D878)
+*
+* The seed is a keychain secret (owner `system`, ref
+* `secret://system/row/user_totp/<userId>/secret`); the row's `secret` column
+* holds the JSON keychain marker, never the seed. A row written before D878
+* still holds the seed inline and keeps working until the operator's
+* `migrateRawSecrets` moves it (nothing migrates at boot). A seed the keychain
+* cannot serve makes `confirm`/`verify` THROW {@link TotpSecretUnavailableError}:
+* 2FA fails closed, never accepts a code and never reads as "not enrolled".
+*
 * `otplib` v13's functional API (`generateSync`/`verifySync`) uses RFC 6238
 * TOTP with a default 30-second period. We pass a per-call `epochTolerance`
 * of one step in either direction (±30 s) — operator clock skew is the usual
@@ -10927,13 +10937,52 @@ function parseRow(data) {
 		createdAt
 	};
 }
+/**
+* The seed cannot be used right now. The message is what a not-yet-logged-in
+* caller sees, so it is generic; `reason` (keychain detail) is for the server log only.
+*/
+var TotpSecretUnavailableError = class extends Error {
+	reason;
+	constructor(reason) {
+		super("two-factor verification is temporarily unavailable; try again later or ask an administrator");
+		this.reason = reason;
+		this.name = "TotpSecretUnavailableError";
+	}
+};
+/** A seed cannot be stored: setup is refused, never written as plaintext. */
+var TotpSecretStorageUnavailableError = class extends Error {
+	constructor(reason) {
+		super(`two-factor setup is unavailable: the TOTP seed cannot be stored in the keychain (${reason}).`);
+		this.name = "TotpSecretStorageUnavailableError";
+	}
+};
+/** What the stored column is: a keychain marker, a pre-D878 inline seed, or garbage (never an inline seed). */
+function classify(column) {
+	if (column.length === 0) return { kind: "invalid" };
+	if (!column.startsWith("{")) return { kind: "inline" };
+	try {
+		const parsed = JSON.parse(column);
+		return isSecretMarker(parsed) ? {
+			kind: "marker",
+			ref: parsed.$secret
+		} : { kind: "invalid" };
+	} catch {
+		return { kind: "invalid" };
+	}
+}
 var TotpManager = class {
 	store;
 	/** ±N steps of clock-skew tolerance, expressed in seconds for otplib v13's
 	*  per-call `epochTolerance`. Default window 1 = ±30 s. */
 	epochTolerance;
+	secrets;
+	logger;
+	/** Per-user queue: setup / confirm / disable / migration never interleave on one user. */
+	chains = /* @__PURE__ */ new Map();
 	constructor(store, opts = {}) {
 		this.store = store;
+		this.secrets = opts.secrets ?? null;
+		this.logger = opts.logger ?? null;
 		this.epochTolerance = (opts.window ?? 1) * TOTP_PERIOD_SECONDS;
 	}
 	/**
@@ -10945,23 +10994,35 @@ var TotpManager = class {
 	* the account name; we use the supplied `username` for human-readable
 	* recognition. `ISSUER` is the CamStack brand.
 	*/
-	async setup(userId, username) {
+	setup(userId, username) {
+		return this.serialize(userId, () => this.setupLocked(userId, username));
+	}
+	async setupLocked(userId, username) {
 		const secret = I();
 		const otpauthUrl = T({
 			secret,
 			label: username,
 			issuer: ISSUER
 		});
+		const ref = this.refFor(userId);
+		if (this.secrets === null || ref === null) throw new TotpSecretStorageUnavailableError("this process has no keychain door");
+		const state = await this.secrets.state().catch(() => null);
+		if (state === null || state.state !== "ready") throw new TotpSecretStorageUnavailableError("the keychain is locked");
+		await this.store.delete.mutate({
+			collection: TOTP_COLLECTION,
+			key: userId
+		});
+		try {
+			await this.secrets.put(ref, secret);
+		} catch (err) {
+			throw new TotpSecretStorageUnavailableError(err instanceof Error ? err.message : String(err));
+		}
 		const row = {
 			userId,
-			secret,
+			secret: JSON.stringify(makeSecretMarker(ref)),
 			confirmedAt: null,
 			createdAt: Date.now()
 		};
-		await this.store.delete.mutate({
-			collection: TOTP_COLLECTION,
-			key: userId
-		});
 		await this.store.insert.mutate({
 			collection: TOTP_COLLECTION,
 			record: {
@@ -10981,12 +11042,15 @@ var TotpManager = class {
 	* rows: re-confirming a valid code just succeeds with no state
 	* change.
 	*/
-	async confirm(userId, code) {
+	confirm(userId, code) {
+		return this.serialize(userId, () => this.confirmLocked(userId, code));
+	}
+	async confirmLocked(userId, code) {
 		const row = await this.find(userId);
 		if (!row) return false;
 		if (!d({
 			token: code,
-			secret: row.secret,
+			secret: await this.seedOf(row),
 			epochTolerance: this.epochTolerance
 		}).valid) return false;
 		if (row.confirmedAt === null) {
@@ -11005,11 +11069,23 @@ var TotpManager = class {
 	/**
 	* Remove enrollment. Idempotent — no error if the user had no row.
 	*/
-	async disable(userId) {
-		await this.store.delete.mutate({
-			collection: TOTP_COLLECTION,
-			key: userId
+	disable(userId) {
+		return this.serialize(userId, async () => {
+			await this.store.delete.mutate({
+				collection: TOTP_COLLECTION,
+				key: userId
+			});
+			await this.dropSeed(userId);
+		});
+	}
+	serialize(userId, fn) {
+		const run = (this.chains.get(userId) ?? Promise.resolve()).then(fn, fn);
+		const tail = run.catch(() => void 0);
+		this.chains.set(userId, tail);
+		tail.then(() => {
+			if (this.chains.get(userId) === tail) this.chains.delete(userId);
 		});
+		return run;
 	}
 	/**
 	* Verify a code against the confirmed secret. Returns `false` when:
@@ -11023,7 +11099,7 @@ var TotpManager = class {
 		if (row.confirmedAt === null) return false;
 		return d({
 			token: code,
-			secret: row.secret,
+			secret: await this.seedOf(row),
 			epochTolerance: this.epochTolerance
 		}).valid;
 	}
@@ -11042,6 +11118,132 @@ var TotpManager = class {
 			confirmedAt: row.confirmedAt
 		};
 	}
+	refFor(userId) {
+		return this.secrets === null ? null : this.secrets.ref({
+			kind: "row",
+			collection: TOTP_COLLECTION,
+			rowId: userId
+		}, "secret");
+	}
+	/** A refused read: generic to the caller, the keychain detail to the server log. */
+	unavailable(userId, reason) {
+		this.logger?.warn("TOTP seed unavailable", {
+			tags: { userId },
+			meta: { reason }
+		});
+		return new TotpSecretUnavailableError(reason);
+	}
+	/** The seed in clear: from the keychain for a marker row, inline for a pre-D878 row. Throws when unreadable. */
+	async seedOf(row) {
+		const column = classify(row.secret);
+		if (column.kind === "inline") return row.secret;
+		if (column.kind === "invalid") throw this.unavailable(row.userId, "malformed seed column");
+		if (this.secrets === null || column.ref !== this.refFor(row.userId)) throw this.unavailable(row.userId, "marker does not belong to this user");
+		let answer;
+		try {
+			answer = (await this.secrets.resolve([column.ref]))[column.ref];
+		} catch (err) {
+			throw this.unavailable(row.userId, err instanceof Error ? err.message : String(err));
+		}
+		if (answer?.kind === "value") return answer.value;
+		throw this.unavailable(row.userId, answer?.kind === "unavailable" ? answer.reason : answer?.kind ?? "no-answer");
+	}
+	/** Remove a user's seed from the keychain; a miss leaves an orphan the Secrets page shows. */
+	async dropSeed(userId) {
+		const ref = this.refFor(userId);
+		if (ref === null) return;
+		try {
+			await this.secrets?.delete([ref]);
+		} catch {}
+	}
+	/**
+	* D878: move every inline seed into the keychain. Dry run unless `apply`.
+	* Per row: put -> read back and compare -> only then rewrite the row with the
+	* marker, so the inline seed is cleared by the verified move and nowhere
+	* else. Counts only; idempotent.
+	*/
+	async migrateRawSecrets(apply) {
+		const rows = await this.readAll();
+		let raw = 0;
+		let markers = 0;
+		let migrated = 0;
+		let failed = 0;
+		for (const row of rows) {
+			const kind = classify(row.secret).kind;
+			if (kind === "marker") {
+				markers += 1;
+				continue;
+			}
+			if (kind !== "inline") continue;
+			raw += 1;
+			if (!apply) continue;
+			if (await this.moveRow(row)) migrated += 1;
+			else failed += 1;
+		}
+		let remainingRaw = 0;
+		let unresolvedMarkers = 0;
+		for (const row of await this.readAll()) {
+			if (classify(row.secret).kind === "inline") {
+				remainingRaw += 1;
+				continue;
+			}
+			try {
+				await this.seedOf(row);
+			} catch {
+				unresolvedMarkers += 1;
+			}
+		}
+		return {
+			apply,
+			rows: rows.length,
+			raw,
+			markers,
+			migrated,
+			failed,
+			remainingRaw,
+			unresolvedMarkers,
+			verified: remainingRaw === 0 && unresolvedMarkers === 0
+		};
+	}
+	/**
+	* Compare-and-set under the user's queue: the row is re-read and moved only if
+	* it still holds the very inline seed we planned to move, so a concurrent
+	* `setup` (its seed and marker) is never overwritten. The ref is always the
+	* user's own, never taken from the row.
+	*/
+	moveRow(planned) {
+		return this.serialize(planned.userId, async () => {
+			const ref = this.refFor(planned.userId);
+			if (this.secrets === null || ref === null) return false;
+			try {
+				const current = await this.find(planned.userId);
+				if (current === null || current.secret !== planned.secret) return false;
+				await this.secrets.put(ref, planned.secret);
+				const back = (await this.secrets.resolve([ref]))[ref];
+				if (back?.kind !== "value" || back.value !== planned.secret) return false;
+				const next = {
+					...current,
+					secret: JSON.stringify(makeSecretMarker(ref))
+				};
+				await this.store.update.mutate({
+					collection: TOTP_COLLECTION,
+					id: planned.userId,
+					data: { ...next }
+				});
+				return true;
+			} catch {
+				return false;
+			}
+		});
+	}
+	async readAll() {
+		const results = await this.store.query.query({ collection: TOTP_COLLECTION });
+		const out = [];
+		for (const r of results) try {
+			out.push(parseRow(r.data));
+		} catch {}
+		return out;
+	}
 	async find(userId) {
 		const results = await this.store.query.query({
 			collection: TOTP_COLLECTION,
@@ -11539,7 +11741,10 @@ var LocalAuthAddon = class extends BaseAddon {
 			this.apiKeyManager = new ApiKeyManager(storageAccess);
 			this.scopedTokenManager = new ScopedTokenManager(store);
 			this.oauthSessionManager = new OauthSessionManager(store);
-			this.totpManager = new TotpManager(store);
+			this.totpManager = new TotpManager(store, {
+				secrets: forOwner === null ? null : forOwner("system"),
+				logger: this.ctx.logger
+			});
 			this.externalIdentities = new ExternalIdentityManager(store);
 			this.loginSessions = new LoginSessionManager(store, { logger: this.ctx.logger });
 			await this.loginSessions.load();
@@ -11781,6 +11986,10 @@ var LocalAuthAddon = class extends BaseAddon {
 				};
 				return this.totpManager.getStatus(input.userId);
 			},
+			migrateRawSecrets: async (input) => {
+				if (!this.totpManager) throw new Error("TOTP management not available");
+				return this.totpManager.migrateRawSecrets(input.apply);
+			},
 			verifyTotp: async (input) => {
 				if (!this.totpManager) return { valid: false };
 				return { valid: await this.totpManager.verify(input.userId, input.code) };

package/dist/builtins/local-network/local-network.addon.js

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-BiTCcaf-.js");
-const require_hub_mdns_ciao = require("../../hub-mdns-ciao-DOBTq8qr.js");
+const require_dist = require("../../dist-D9qT3jHr.js");
+const require_hub_mdns_ciao = require("../../hub-mdns-ciao-B-wk9nzx.js");
 let zod = require("zod");
 let node_net = require("node:net");
 let node_os = require("node:os");