@wilm-ai/wilma-cli 2.3.2 → 2.5.0

package/dist/cli-output.js

@@ -62,7 +62,9 @@ export function newsLine(item) {
 export function messageLine(msg) {
     const sender = msg.senderName ? ` — ${compactText(msg.senderName)}` : "";
     const replies = msg.replyCount ? ` [${msg.replyCount} ${msg.replyCount === 1 ? "reply" : "replies"}]` : "";
-    return `${finnishDay(msg.sentAt)} ${compactText(msg.subject)}${sender}${msg.unread ? " [new]" : ""}${replies} (id ${msg.wilmaId})`;
+    // An invitation's answer in Wilma's own word ("Applied 29.05.2026 13:00").
+    const answer = msg.invitationStatus ? ` [${compactText([msg.invitationStatus, msg.invitationInfo].filter(Boolean).join(" "))}]` : "";
+    return `${finnishDay(msg.sentAt)} ${compactText(msg.subject)}${sender}${msg.unread ? " [new]" : ""}${replies}${answer} (id ${msg.wilmaId})`;
 }
 function lessonNoteLine(note, withDate) {
     const date = withDate ? `${note.date} ` : "";
@@ -116,15 +118,27 @@ export function formatText(command, action, result) {
         case "summary":
             return perStudent(result, "summary", (s) => summaryLines(s));
         case "schedule": {
-            const period = result.weekStart ? `${result.weekStart} – ${result.weekEnd}` : result.date;
+            const period = result.from ? `${result.from} – ${result.to}` : result.weekStart ? `${result.weekStart} – ${result.weekEnd}` : result.date;
             return titled(`Schedule ${period}`, result, perStudent(result, "lessons", scheduleLines));
         }
         case "homework":
             return perStudent(result, "homework", (items) => items.length ? items.map((h) => `  ${h.date}  ${h.subject}: ${compactText(h.homework)}`) : ["  No recent homework."]);
         case "exams":
             return perStudent(result, "exams", (items) => (items.length ? items.map((e) => `  ${examLine(e)}`) : ["  No upcoming exams."]));
-        case "grades":
-            return perStudent(result, "grades", (items) => items.length ? items.map((g) => `  ${g.date}  ${g.subject}: ${g.name} — ${g.grade}`) : ["  No exam grades."]);
+        case "grades": {
+            const lines = (items) => items.length
+                ? items.map((g) => `  ${g.date}  ${g.subject}: ${g.name} — ${g.grade ?? "no grade yet"}${g.verbalGrade ? ` (${compactText(g.verbalGrade)})` : ""}`)
+                : [result.from ? "  No exams in this period." : "  No exam grades."];
+            const grades = perStudent(result, "grades", lines);
+            return result.from ? titled(`Exams ${result.from} – ${result.to}`, result, grades) : grades;
+        }
+        case "contacts":
+            return perStudent(result, "contacts", (c) => [
+                `  Class: ${c.className ?? "not shown"}`,
+                ...c.supervisors.map((s) => `  ${compactText(s.role)}: ${s.name}`),
+                ...(c.teachers.length ? ["  Teachers:", ...c.teachers.map((t) => `    ${t.name}${t.subjects.length ? ` — ${t.subjects.join(", ")}` : ""}`)] : []),
+                ...(c.unavailable?.length ? [`  (Not available from Wilma right now: ${c.unavailable.join(", ")})`] : []),
+            ]);
         case "gradebook":
             return perStudent(result, "gradebook", (entries) => gradebookLines(entries));
         case "notes": {
@@ -178,7 +192,7 @@ export function formatText(command, action, result) {
             return perStudent(result, "printouts", (items) => items.length ? [...items.map((p) => `  ${compactText(p.title)} (id ${p.id})`)] : ["  No printouts."]);
         case "students":
             return result.students
-                .map((s) => `${s.studentNumber}  ${s.name}${s.wilma ? `  (${s.wilma})` : ""}`)
+                .map((s) => `${s.studentNumber}  ${s.name}${s.wilma ? `  (${s.wilma})` : ""}${s.role === "student" ? "  [own login]" : ""}`)
                 .join("\n");
         default:
             return JSON.stringify(result, null, 2);

package/dist/config.d.ts

@@ -3,23 +3,53 @@ export interface StoredProfile {
     tenantUrl: string;
     tenantName?: string | null;
     username: string;
-    passwordObfuscated: string;
+    /** Scrambled password: a login kept in this file (absent for a keychain login). */
+    passwordObfuscated?: string;
     totpSecretObfuscated?: string | null;
-    students?: {
-        studentNumber: string;
-        name: string;
-    }[];
+    /** "keychain": the password and authenticator key are in the OS keychain, entry `secretId`. Absent: in this file. */
+    secrets?: "keychain" | string;
+    /** The login's keychain entry (random; also kept in CliConfig.keychainLogins). */
+    secretId?: string;
+    /** Random, new whenever the login's secrets change; not secret. Part of a keychain login's pool key. */
+    credentialsStamp?: string;
+    /** Whether an authenticator key is saved (so listings don't read the keychain). */
+    hasTotp?: boolean;
+    /** When moving the login to the keychain last failed (background moves wait a day). */
+    moveFailedAt?: string;
+    /** The children the login lists; `role` says whose login it is for each (a guardian's, or the student's own). */
+    students?: SavedStudent[];
+    /** Student numbers of children unticked on the login page (a profile Wilma lists twice): not read. */
+    hidden?: string[];
     lastStudentNumber?: string | null;
     lastStudentName?: string | null;
     lastUsedAt: string;
 }
+export interface SavedStudent {
+    studentNumber: string;
+    name: string;
+    role?: "guardian" | "student";
+}
+/** A child as saved with a login: the number, the name, and the role when Wilma says it. */
+export declare function savedStudent(s: SavedStudent): SavedStudent;
 export interface CliConfig {
     profiles: StoredProfile[];
     lastProfileId?: string | null;
+    /** Where new secrets go: "file" (default), "auto" or "keychain" (`wilma config secrets`). */
+    secretStore?: string;
+    /** Every keychain entry this config made, by login id, written before the entry itself. */
+    keychainLogins?: Record<string, string>;
 }
 export declare function getConfigPath(): string;
 export declare function loadConfig(): Promise<CliConfig>;
 export declare function saveConfig(config: CliConfig): Promise<void>;
+/**
+ * Change the saved config from a fresh read, so a save never overwrites what
+ * another process wrote meanwhile (moves, logins, refreshed child lists).
+ * `edit` returns false to leave the file as it is.
+ */
+export declare function editConfig(edit: (config: CliConfig) => boolean | void | Promise<boolean | void>): Promise<CliConfig>;
+/** The config as far as it can be read, or null (for `wilma config clear`, the way out of a damaged file). */
+export declare function loadConfigLenient(): Promise<CliConfig | null>;
 export declare function clearConfig(): Promise<void>;
 export declare function obfuscateSecret(value: string): string;
-export declare function revealSecret(value: string): string | null;
+export declare function revealSecret(value: string | null | undefined): string | null;

package/dist/config.js

@@ -2,6 +2,10 @@ import { chmod, mkdir, readFile, rename, stat, writeFile, rm } from "node:fs/pro
 import { randomBytes } from "node:crypto";
 import { dirname, resolve } from "node:path";
 import { homedir } from "node:os";
+/** A child as saved with a login: the number, the name, and the role when Wilma says it. */
+export function savedStudent(s) {
+    return { studentNumber: s.studentNumber, name: s.name, ...(s.role ? { role: s.role } : {}) };
+}
 const SALT = "wilmai::";
 export function getConfigPath() {
     const override = process.env.WILMAI_CONFIG_PATH;
@@ -85,6 +89,26 @@ export async function saveConfig(config) {
     await writeFile(tmp, JSON.stringify(config, null, 2) + "\n", { encoding: "utf-8", mode: 0o600 });
     await rename(tmp, path);
 }
+/**
+ * Change the saved config from a fresh read, so a save never overwrites what
+ * another process wrote meanwhile (moves, logins, refreshed child lists).
+ * `edit` returns false to leave the file as it is.
+ */
+export async function editConfig(edit) {
+    const config = await loadConfig();
+    if ((await edit(config)) !== false)
+        await saveConfig(config);
+    return config;
+}
+/** The config as far as it can be read, or null (for `wilma config clear`, the way out of a damaged file). */
+export async function loadConfigLenient() {
+    try {
+        return await loadConfig();
+    }
+    catch {
+        return null;
+    }
+}
 export async function clearConfig() {
     const path = getConfigPath();
     await rm(path, { force: true });
@@ -93,6 +117,8 @@ export function obfuscateSecret(value) {
     return Buffer.from(SALT + value, "utf-8").toString("base64");
 }
 export function revealSecret(value) {
+    if (!value)
+        return null;
     try {
         const decoded = Buffer.from(value, "base64").toString("utf-8");
         if (!decoded.startsWith(SALT)) {

package/dist/credentials.d.ts

@@ -1,5 +1,7 @@
 import { WilmaClient, type MfaCallback, type StudentInfo, type WilmaProfile } from "@wilm-ai/wilma-client";
 import { type CliConfig, type StoredProfile } from "./config.js";
+import { type LoginSecrets } from "./secret-store.js";
+import { type SessionKeys } from "./session-keys.js";
 /**
  * Environment variables for agents that keep secrets in their own store
  * (cloud VMs, CI-like sandboxes) instead of a config file.
@@ -11,8 +13,15 @@ export declare const ENV_VARS: {
     readonly totpSecret: "WILMA_TOTP_SECRET";
 };
 export interface ActiveAccount {
+    /** For a keychain login the password is empty here: `secrets` reads it, only when Wilma needs a new login. */
     profile: WilmaProfile;
     totpSecret?: string;
+    /** A keychain login's (or an unreadable login's) password and authenticator key, read only when needed. */
+    secrets?: () => Promise<LoginSecrets>;
+    /** Whether an authenticator key is saved (for `secrets` logins, without reading it). */
+    hasTotp?: boolean;
+    /** Where its session is saved and pooled (v1 for file and environment logins, v2 for keychain logins). */
+    keys: SessionKeys;
     /** Present when the account comes from the saved config. */
     stored?: StoredProfile;
     source: "config" | "env";
@@ -34,12 +43,18 @@ export declare function mfaCallbackFor(totpSecret?: string | null, clock?: {
     now: () => number;
     sleep: (ms: number) => Promise<void>;
 }): MfaCallback | undefined;
+/** A saved login as an account: its password from the file, or (keychain logins) read only when needed. */
+export declare function accountFor(stored: StoredProfile): ActiveAccount;
+/** The password and authenticator key of an account now (reading the keychain for a keychain login). */
+export declare function accountSecrets(account: ActiveAccount): Promise<LoginSecrets>;
 /** Environment variables win over the saved config when all three are set. */
 export declare function resolveAccount(config: CliConfig, env?: NodeJS.ProcessEnv): Promise<ActiveAccount | null>;
 /**
  * Every Wilma login the family has. Environment variables give exactly one;
  * otherwise all saved logins, the active one first. Families with children on
  * different Wilmas (e.g. a city school and a private school) save one login each.
+ * A login whose password can't be read is kept: it fails with a clear message
+ * when used, instead of looking like no login at all.
  */
 export declare function resolveAccounts(config: CliConfig, env?: NodeJS.ProcessEnv): Promise<ActiveAccount[]>;
 /**
@@ -55,7 +70,32 @@ export declare function verifyLoginSession(input: {
     client: WilmaClient;
     students: StudentInfo[];
 }>;
-/** Save a verified login as the active profile, replacing any profile with the same tenant and username. */
+/** Where a login's secrets go, decided before Wilma is contacted (section 5 of docs/secret-store.md). */
+export interface StoreChoice {
+    store: "file" | "keychain";
+    /** The keychain entry to use (a login's own, or one this config already reserved for it). */
+    secretId?: string;
+    /** Said to the user: e.g. saved in the file because no keychain can be used here. */
+    note?: string;
+}
+/**
+ * Decide where a login's secrets go and check the keychain can be used,
+ * before anything is sent to Wilma: a login that can't be saved then costs no
+ * Wilma login, no ended browser session and no used code. A login saved
+ * again keeps its store while that store can be used here; otherwise the
+ * setting decides (`auto` and `file`: the file; `keychain`: refused).
+ */
+export declare function chooseSecretStore(config: CliConfig, tenantUrl: string, username: string): Promise<StoreChoice>;
+/**
+ * Save a verified login as the active profile, replacing any profile with the
+ * same tenant and username, in the store chosen by chooseSecretStore. A
+ * keychain entry is recorded in `keychainLogins` before it is written (reusing
+ * one another process reserved meanwhile), and read back before the login
+ * points at it. Under `auto`, a keychain that fails here falls back to the
+ * file (the returned note says so). The keychain calls come first; the
+ * profile is then saved onto a fresh read of the config, so a move or a login
+ * another process saved meanwhile isn't undone. `config` is updated to match.
+ */
 export declare function saveLogin(config: CliConfig, input: {
     tenantUrl: string;
     tenantName?: string | null;
@@ -63,7 +103,14 @@ export declare function saveLogin(config: CliConfig, input: {
     password: string;
     totpSecret?: string | null;
     students: StudentInfo[];
-}): Promise<StoredProfile>;
+}, choice?: StoreChoice): Promise<StoredProfile & {
+    note?: string;
+}>;
+/**
+ * Save an authenticator key for a saved login (the interactive "Save TOTP
+ * secret"): into its keychain entry for a keychain login, never the file.
+ */
+export declare function saveTotpSecret(id: string, totpSecret: string): Promise<void>;
 /** The client reports a rejected one-time code as an AuthenticationError starting "MFA verification failed". */
 export declare function isMfaFailure(err: unknown): boolean;
 export { AuthenticationError } from "@wilm-ai/wilma-client";

package/dist/credentials.js

@@ -1,5 +1,7 @@
 import { AuthenticationError, MfaRequiredError, WilmaClient, } from "@wilm-ai/wilma-client";
-import { obfuscateSecret, revealSecret, saveConfig, } from "./config.js";
+import { editConfig, loadConfig, obfuscateSecret, revealSecret, savedStudent, } from "./config.js";
+import { effectiveSecretStore, keychainProblem, newCredentialsStamp, newSecretId, readBackLoginSecrets, readLoginSecrets, SecretStoreError, secretErrorMessage, writeLoginSecrets, } from "./secret-store.js";
+import { fileLoginKeys, keychainLoginKeys } from "./session-keys.js";
 import { generateTOTP, parseTotpSecret, TOTP_PERIOD_MS, totpCounter } from "./totp.js";
 import { normalizeTenantUrl, resolveTenant } from "./tenant-search.js";
 /**
@@ -67,43 +69,75 @@ export function mfaCallbackFor(totpSecret, clock = {
 function hasEnvAccount(env = process.env) {
     return Boolean(env[ENV_VARS.tenant] && env[ENV_VARS.username] && env[ENV_VARS.password]);
 }
+/** A saved login as an account: its password from the file, or (keychain logins) read only when needed. */
+export function accountFor(stored) {
+    const profile = {
+        baseUrl: stored.tenantUrl,
+        username: stored.username,
+        password: "",
+        studentNumber: stored.lastStudentNumber ?? undefined,
+    };
+    const wilma = stored.tenantName ?? stored.tenantUrl;
+    const base = { stored, source: "config" };
+    if (stored.secrets === "keychain" && stored.secretId) {
+        const ref = { secretId: stored.secretId, credentialsStamp: stored.credentialsStamp, wilma };
+        return {
+            ...base,
+            profile,
+            secrets: () => readLoginSecrets(ref),
+            hasTotp: Boolean(stored.hasTotp),
+            keys: keychainLoginKeys(stored.tenantUrl, stored.username, stored.credentialsStamp),
+        };
+    }
+    if (stored.secrets) {
+        // Kept somewhere this version doesn't know (a newer WilmAI saved it).
+        const error = new SecretStoreError("unavailable", secretErrorMessage("unavailable", wilma));
+        return { ...base, profile, secrets: () => Promise.reject(error), keys: keychainLoginKeys(stored.tenantUrl, stored.username, stored.credentialsStamp) };
+    }
+    const password = revealSecret(stored.passwordObfuscated);
+    if (!password) {
+        // Reported when used, not skipped: a skipped login looks like "not logged in" and invites a second login.
+        const error = new SecretStoreError("missing", `The saved password for ${wilma} can't be read. Log in again (\`wilma login\`).`);
+        return { ...base, profile, secrets: () => Promise.reject(error), keys: keychainLoginKeys(stored.tenantUrl, stored.username, null) };
+    }
+    const totpSecret = revealSecret(stored.totpSecretObfuscated) ?? undefined;
+    return {
+        ...base,
+        profile: { ...profile, password },
+        totpSecret,
+        hasTotp: Boolean(totpSecret),
+        keys: fileLoginKeys(stored.tenantUrl, stored.username, password),
+    };
+}
+/** The password and authenticator key of an account now (reading the keychain for a keychain login). */
+export async function accountSecrets(account) {
+    if (account.secrets)
+        return account.secrets();
+    return { password: account.profile.password, totpSecret: account.totpSecret ?? null };
+}
 /** Environment variables win over the saved config when all three are set. */
 export async function resolveAccount(config, env = process.env) {
     if (hasEnvAccount(env)) {
         const tenant = await resolveTenant(env[ENV_VARS.tenant]);
+        const username = env[ENV_VARS.username];
+        const password = env[ENV_VARS.password];
         return {
-            profile: {
-                baseUrl: tenant.url,
-                username: env[ENV_VARS.username],
-                password: env[ENV_VARS.password],
-            },
+            profile: { baseUrl: tenant.url, username, password },
             totpSecret: env[ENV_VARS.totpSecret] || undefined,
+            hasTotp: Boolean(env[ENV_VARS.totpSecret]),
+            keys: fileLoginKeys(tenant.url, username, password),
             source: "env",
         };
     }
     const stored = config.profiles.find((p) => p.id === config.lastProfileId);
-    if (!stored)
-        return null;
-    const password = revealSecret(stored.passwordObfuscated);
-    if (!password) {
-        throw new Error("Stored password could not be decoded. Run `wilma login` again.");
-    }
-    return {
-        profile: {
-            baseUrl: stored.tenantUrl,
-            username: stored.username,
-            password,
-            studentNumber: stored.lastStudentNumber ?? undefined,
-        },
-        totpSecret: stored.totpSecretObfuscated ? revealSecret(stored.totpSecretObfuscated) ?? undefined : undefined,
-        stored,
-        source: "config",
-    };
+    return stored ? accountFor(stored) : null;
 }
 /**
  * Every Wilma login the family has. Environment variables give exactly one;
  * otherwise all saved logins, the active one first. Families with children on
  * different Wilmas (e.g. a city school and a private school) save one login each.
+ * A login whose password can't be read is kept: it fails with a clear message
+ * when used, instead of looking like no login at all.
  */
 export async function resolveAccounts(config, env = process.env) {
     if (hasEnvAccount(env)) {
@@ -119,20 +153,7 @@ export async function resolveAccounts(config, env = process.env) {
         if (seen.has(key))
             continue;
         seen.add(key);
-        const password = revealSecret(stored.passwordObfuscated);
-        if (!password)
-            continue;
-        accounts.push({
-            profile: {
-                baseUrl: stored.tenantUrl,
-                username: stored.username,
-                password,
-                studentNumber: stored.lastStudentNumber ?? undefined,
-            },
-            totpSecret: stored.totpSecretObfuscated ? revealSecret(stored.totpSecretObfuscated) ?? undefined : undefined,
-            stored,
-            source: "config",
-        });
+        accounts.push(accountFor(stored));
     }
     return accounts;
 }
@@ -155,37 +176,151 @@ export async function verifyLoginSession(input) {
         throw err;
     }
 }
-/** Save a verified login as the active profile, replacing any profile with the same tenant and username. */
-export async function saveLogin(config, input) {
+const sameAccountAs = (tenantUrl, username) => (p) => normalizeTenantUrl(p.tenantUrl) === normalizeTenantUrl(tenantUrl) && p.username.toLowerCase() === username.toLowerCase();
+const FILE_FALLBACK_NOTE = "Saved in WilmAI's file on this computer: there is no keychain WilmAI can use here.";
+/**
+ * Decide where a login's secrets go and check the keychain can be used,
+ * before anything is sent to Wilma: a login that can't be saved then costs no
+ * Wilma login, no ended browser session and no used code. A login saved
+ * again keeps its store while that store can be used here; otherwise the
+ * setting decides (`auto` and `file`: the file; `keychain`: refused).
+ */
+export async function chooseSecretStore(config, tenantUrl, username) {
+    const setting = effectiveSecretStore(config.secretStore);
+    const previous = config.profiles.find(sameAccountAs(tenantUrl, username));
+    const id = previous?.id ?? `${normalizeTenantUrl(tenantUrl)}|${username}`;
+    const reserved = config.keychainLogins?.[id];
+    // A saved keychain login stays in the keychain; a saved file login moves only by the saved setting (the
+    // environment variable decides only where new logins go); a new login follows the setting in effect.
+    const wantsKeychain = previous?.secrets === "keychain" ||
+        (previous ? effectiveSecretStore(config.secretStore, {}) !== "file" : setting !== "file");
+    if (!wantsKeychain)
+        return { store: "file" };
+    const problem = await keychainProblem();
+    if (!problem)
+        return { store: "keychain", secretId: previous?.secretId ?? reserved ?? newSecretId() };
+    if (setting === "keychain") {
+        throw new SecretStoreError("unavailable", `WilmAI is set to keep passwords in the keychain, but there's no keychain it can use on this computer (${problem}). Nothing was sent to Wilma.`);
+    }
+    return { store: "file", note: FILE_FALLBACK_NOTE };
+}
+/** The authenticator key a login already has, so logging in again without one keeps it. */
+async function previousTotp(previous) {
+    if (!previous)
+        return null;
+    if (previous.secrets === "keychain" && previous.secretId && previous.hasTotp) {
+        return (await readBackLoginSecrets(previous.secretId).catch(() => null))?.totpSecret ?? null;
+    }
+    return revealSecret(previous.totpSecretObfuscated);
+}
+/**
+ * Save a verified login as the active profile, replacing any profile with the
+ * same tenant and username, in the store chosen by chooseSecretStore. A
+ * keychain entry is recorded in `keychainLogins` before it is written (reusing
+ * one another process reserved meanwhile), and read back before the login
+ * points at it. Under `auto`, a keychain that fails here falls back to the
+ * file (the returned note says so). The keychain calls come first; the
+ * profile is then saved onto a fresh read of the config, so a move or a login
+ * another process saved meanwhile isn't undone. `config` is updated to match.
+ */
+export async function saveLogin(config, input, choice = { store: "file" }) {
     const tenantUrl = normalizeTenantUrl(input.tenantUrl);
     // Wilma usernames are case-insensitive: "Matti.M" and "matti.m" are one account
     // (saving it twice would make two sessions that keep cancelling each other).
-    const sameAccount = (p) => normalizeTenantUrl(p.tenantUrl) === tenantUrl && p.username.toLowerCase() === input.username.toLowerCase();
-    const previous = config.profiles.find(sameAccount);
-    const id = previous?.id ?? `${tenantUrl}|${input.username}`;
-    const keepLast = previous?.lastStudentNumber
-        ? input.students.find((s) => s.studentNumber === previous.lastStudentNumber)
-        : undefined;
-    const lastStudent = keepLast ?? input.students[0];
-    const stored = {
-        id,
-        tenantUrl,
-        tenantName: input.tenantName ?? previous?.tenantName ?? tenantUrl,
-        username: input.username,
-        passwordObfuscated: obfuscateSecret(input.password),
-        totpSecretObfuscated: input.totpSecret ? obfuscateSecret(input.totpSecret.trim()) : previous?.totpSecretObfuscated ?? null,
-        students: input.students.map((s) => ({ studentNumber: s.studentNumber, name: s.name })),
-        lastStudentNumber: lastStudent?.studentNumber ?? null,
-        lastStudentName: lastStudent?.name ?? null,
-        lastUsedAt: new Date().toISOString(),
+    const sameAccount = sameAccountAs(tenantUrl, input.username);
+    const id = config.profiles.find(sameAccount)?.id ?? `${tenantUrl}|${input.username}`;
+    const totpSecret = input.totpSecret?.trim() || (await previousTotp(config.profiles.find(sameAccount)));
+    const secrets = { password: input.password, totpSecret };
+    let note = choice.note;
+    let secretFields;
+    let secretId;
+    if (choice.store === "keychain") {
+        try {
+            // Recorded before the entry exists, so no entry is ever unknown to the config.
+            await editConfig((fresh) => {
+                secretId = fresh.keychainLogins?.[id] ?? choice.secretId ?? newSecretId();
+                if (fresh.keychainLogins?.[id] === secretId)
+                    return false;
+                fresh.keychainLogins = { ...fresh.keychainLogins, [id]: secretId };
+            });
+            await writeLoginSecrets(secretId, secrets);
+            const back = await readBackLoginSecrets(secretId);
+            if (back?.password !== secrets.password || (back?.totpSecret ?? null) !== (secrets.totpSecret ?? null)) {
+                throw new SecretStoreError("refused", "The keychain didn't keep the password as saved.");
+            }
+            secretFields = { secrets: "keychain", secretId, hasTotp: Boolean(totpSecret) };
+        }
+        catch (err) {
+            // `keychain` never quietly saves to the file; `auto` and `file` do, and say so.
+            if (effectiveSecretStore(config.secretStore) === "keychain")
+                throw err;
+            note = FILE_FALLBACK_NOTE;
+            secretFields = fileSecretFields(secrets);
+        }
+    }
+    else {
+        secretFields = fileSecretFields(secrets);
+    }
+    let stored;
+    const fresh = await editConfig((latest) => {
+        const previous = latest.profiles.find(sameAccount);
+        const keepLast = previous?.lastStudentNumber
+            ? input.students.find((s) => s.studentNumber === previous.lastStudentNumber)
+            : undefined;
+        const lastStudent = keepLast ?? input.students[0];
+        stored = {
+            id: previous?.id ?? id,
+            tenantUrl,
+            tenantName: input.tenantName ?? previous?.tenantName ?? tenantUrl,
+            username: input.username,
+            ...secretFields,
+            credentialsStamp: newCredentialsStamp(),
+            students: input.students.map(savedStudent),
+            lastStudentNumber: lastStudent?.studentNumber ?? null,
+            lastStudentName: lastStudent?.name ?? null,
+            lastUsedAt: new Date().toISOString(),
+        };
+        // Logging in again keeps the login's place in the list (`wilma accounts` numbers stay put).
+        const at = latest.profiles.findIndex(sameAccount);
+        const others = latest.profiles.filter((p) => !sameAccount(p));
+        latest.profiles = at === -1 ? [...others, stored] : [...others.slice(0, at), stored, ...others.slice(at)];
+        latest.lastProfileId = stored.id;
+    });
+    Object.assign(config, fresh);
+    return note ? { ...stored, note } : stored;
+}
+function fileSecretFields(secrets) {
+    return {
+        passwordObfuscated: obfuscateSecret(secrets.password),
+        totpSecretObfuscated: secrets.totpSecret ? obfuscateSecret(secrets.totpSecret.trim()) : null,
+        hasTotp: Boolean(secrets.totpSecret),
     };
-    // Logging in again keeps the login's place in the list (`wilma accounts` numbers stay put).
-    const at = config.profiles.findIndex(sameAccount);
-    const others = config.profiles.filter((p) => !sameAccount(p));
-    config.profiles = at === -1 ? [...others, stored] : [...others.slice(0, at), stored, ...others.slice(at)];
-    config.lastProfileId = id;
-    await saveConfig(config);
-    return stored;
+}
+/**
+ * Save an authenticator key for a saved login (the interactive "Save TOTP
+ * secret"): into its keychain entry for a keychain login, never the file.
+ */
+export async function saveTotpSecret(id, totpSecret) {
+    const key = totpSecret.trim();
+    const target = (await loadConfig()).profiles.find((p) => p.id === id);
+    if (target?.secrets === "keychain" && target.secretId) {
+        const current = await readBackLoginSecrets(target.secretId);
+        if (!current)
+            throw new SecretStoreError("missing", secretErrorMessage("missing", target.tenantName));
+        await writeLoginSecrets(target.secretId, { ...current, totpSecret: key });
+    }
+    await editConfig((config) => {
+        const profile = config.profiles.find((p) => p.id === id);
+        if (!profile)
+            return false;
+        if (profile.secrets === "keychain")
+            profile.hasTotp = true;
+        else {
+            profile.totpSecretObfuscated = obfuscateSecret(key);
+            profile.hasTotp = true;
+        }
+        profile.credentialsStamp = newCredentialsStamp();
+    });
 }
 /** The client reports a rejected one-time code as an AuthenticationError starting "MFA verification failed". */
 export function isMfaFailure(err) {