bwx 0.4.1 → 0.6.0

package/src/bw/totp.ts

@@ -0,0 +1,246 @@
+import { createHmac } from "node:crypto";
+import { CliError, ExitCode } from "../cli/errors.ts";
+
+/**
+ * TOTP handling, kept local so a code costs no extra `bw` spawn and can be
+ * reported with the time it has left.
+ *
+ * Only shapes this module can compute *exactly* are computed here. Anything
+ * else — a `steam://` secret, an unknown algorithm, a seed that will not decode
+ * — is reported as unsupported so the caller can fall back to `bw get totp`.
+ * A wrong six-digit code is indistinguishable from a right one until the login
+ * fails, so guessing is never the safer option.
+ */
+
+/** RFC 4648 base32, minus the padding and separators authenticators sprinkle in. */
+const BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+
+const STEAM_PREFIX = "steam://";
+
+export const DEFAULT_PERIOD = 30;
+export const DEFAULT_DIGITS = 6;
+export const DEFAULT_ALGORITHM = "SHA1";
+
+const SUPPORTED_ALGORITHMS: Record<string, string> = {
+	SHA1: "sha1",
+	SHA256: "sha256",
+	SHA512: "sha512",
+};
+
+export interface TotpConfig {
+	/** Normalized base32 secret, without padding or separators. */
+	secret: string;
+	period: number;
+	digits: number;
+	/** Uppercase name as it appears in an `otpauth://` URI. */
+	algorithm: string;
+}
+
+export interface TotpCode {
+	code: string;
+	period: number;
+	/** Whole seconds this code stays valid, counting the current one. */
+	secondsRemaining: number;
+}
+
+/** Why a stored secret cannot be computed locally, for the fallback path. */
+export class TotpUnsupportedError extends Error {}
+
+/**
+ * Reads a stored `login.totp` value. Bitwarden accepts a bare base32 secret, a
+ * full `otpauth://` URI, or a `steam://` secret, and all three turn up in real
+ * vaults.
+ */
+export function parseTotpSecret(raw: string): TotpConfig {
+	const value = raw.trim();
+
+	if (value.length === 0) {
+		throw new TotpUnsupportedError("secret is empty");
+	}
+
+	if (value.toLowerCase().startsWith(STEAM_PREFIX)) {
+		// Steam's alphabet and digit count differ from RFC 6238, and bwx has no
+		// way to verify its output against a real Steam login.
+		throw new TotpUnsupportedError("steam:// secrets are computed by bw");
+	}
+
+	const config = value.toLowerCase().startsWith("otpauth://")
+		? parseOtpauthUri(value)
+		: {
+				secret: normalizeBase32(value),
+				period: DEFAULT_PERIOD,
+				digits: DEFAULT_DIGITS,
+				algorithm: DEFAULT_ALGORITHM,
+			};
+
+	if (!(config.algorithm in SUPPORTED_ALGORITHMS)) {
+		throw new TotpUnsupportedError(`unsupported algorithm ${config.algorithm}`);
+	}
+
+	if (!isBase32(config.secret)) {
+		throw new TotpUnsupportedError("secret is not base32");
+	}
+
+	return config;
+}
+
+function parseOtpauthUri(value: string): TotpConfig {
+	let url: URL;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new TotpUnsupportedError("otpauth URI does not parse");
+	}
+
+	if (url.host.toLowerCase() !== "totp") {
+		throw new TotpUnsupportedError(`otpauth type "${url.host}" is not totp`);
+	}
+
+	const secret = url.searchParams.get("secret");
+	if (!secret) throw new TotpUnsupportedError("otpauth URI has no secret");
+
+	return {
+		secret: normalizeBase32(secret),
+		period: readPositiveInt(url, "period", DEFAULT_PERIOD),
+		digits: readPositiveInt(url, "digits", DEFAULT_DIGITS),
+		algorithm: (url.searchParams.get("algorithm") ?? DEFAULT_ALGORITHM).toUpperCase(),
+	};
+}
+
+function readPositiveInt(url: URL, name: string, fallback: number): number {
+	const raw = url.searchParams.get(name);
+	if (raw === null) return fallback;
+
+	const value = Number(raw);
+	if (!Number.isInteger(value) || value <= 0) {
+		throw new TotpUnsupportedError(`otpauth ${name}="${raw}" is not a positive integer`);
+	}
+	return value;
+}
+
+/** Uppercases and drops the spaces, hyphens, and padding authenticators show. */
+export function normalizeBase32(value: string): string {
+	return value.replace(/[\s-]/g, "").replace(/=+$/, "").toUpperCase();
+}
+
+function isBase32(value: string): boolean {
+	return value.length > 0 && /^[A-Z2-7]+$/.test(value);
+}
+
+/**
+ * Decodes base32 into bytes, discarding the trailing bits when the secret is not
+ * a whole number of bytes. Real secrets do this — a 29-character seed carries
+ * 145 bits and yields 18 bytes — and bw resolves them the same way, so rejecting
+ * them or padding them out would produce codes that quietly disagree with bw's.
+ */
+export function base32Decode(value: string): Buffer {
+	const bytes: number[] = [];
+	let accumulator = 0;
+	let bits = 0;
+
+	for (const char of value) {
+		const index = BASE32_ALPHABET.indexOf(char);
+		if (index === -1) {
+			throw new TotpUnsupportedError(`invalid base32 character "${char}"`);
+		}
+
+		accumulator = (accumulator << 5) | index;
+		bits += 5;
+
+		if (bits >= 8) {
+			bits -= 8;
+			bytes.push((accumulator >> bits) & 0xff);
+		}
+	}
+
+	if (bytes.length === 0) {
+		throw new TotpUnsupportedError("secret decodes to no bytes");
+	}
+
+	return Buffer.from(bytes);
+}
+
+/** Seconds left in the window `at` falls in, counting the current second. */
+export function secondsRemaining(period: number, at: number = Date.now()): number {
+	return period - (Math.floor(at / 1000) % period);
+}
+
+export function generateTotp(config: TotpConfig, at: number = Date.now()): TotpCode {
+	const key = base32Decode(config.secret);
+	const counter = Math.floor(at / 1000 / config.period);
+
+	const message = Buffer.alloc(8);
+	message.writeUInt32BE(Math.floor(counter / 2 ** 32), 0);
+	message.writeUInt32BE(counter >>> 0, 4);
+
+	const digest = createHmac(SUPPORTED_ALGORITHMS[config.algorithm]!, key)
+		.update(message)
+		.digest();
+
+	// RFC 6238 dynamic truncation: the low nibble of the last byte picks the
+	// four-byte window, and the high bit is masked off to stay sign-agnostic.
+	const offset = digest[digest.length - 1]! & 0x0f;
+	const binary = digest.readUInt32BE(offset) & 0x7fffffff;
+
+	return {
+		code: String(binary % 10 ** config.digits).padStart(config.digits, "0"),
+		period: config.period,
+		secondsRemaining: secondsRemaining(config.period, at),
+	};
+}
+
+/**
+ * Validates a secret on its way *into* the vault. A seed is only ever exercised
+ * at login, so a typo accepted here surfaces when the caller is already locked
+ * out — the one moment they cannot fix it. Returns the value to store.
+ */
+export function normalizeTotpInput(raw: string): string {
+	const value = raw.trim();
+
+	if (value.length === 0) {
+		throw new CliError("TOTP secret cannot be empty", ExitCode.BadArgs);
+	}
+
+	// Stored verbatim: bw owns these, and bwx would only mangle them.
+	if (value.toLowerCase().startsWith(STEAM_PREFIX)) return value;
+
+	if (value.toLowerCase().startsWith("otpauth://")) {
+		try {
+			parseTotpSecret(value);
+		} catch (err) {
+			throw new CliError(
+				`Invalid otpauth URI: ${describe(err)}`,
+				ExitCode.BadArgs,
+			);
+		}
+		return value;
+	}
+
+	const secret = normalizeBase32(value);
+	if (!isBase32(secret)) {
+		throw new CliError(
+			`Invalid TOTP secret: expected base32 (A-Z, 2-7) or an otpauth:// URI, got "${redact(value)}"`,
+			ExitCode.BadArgs,
+		);
+	}
+
+	// A secret shorter than a byte cannot key an HMAC.
+	try {
+		base32Decode(secret);
+	} catch (err) {
+		throw new CliError(`Invalid TOTP secret: ${describe(err)}`, ExitCode.BadArgs);
+	}
+
+	return secret;
+}
+
+/** Keeps a rejected secret out of logs while still showing what was wrong with it. */
+function redact(value: string): string {
+	const bad = value.replace(/[A-Za-z0-9\s=-]/g, "");
+	if (bad.length > 0) return `…contains "${[...new Set(bad)].join("")}"`;
+	return `…${value.length} characters`;
+}
+
+function describe(err: unknown): string {
+	return err instanceof Error ? err.message : String(err);
+}

package/src/cli/commands/config.ts

@@ -7,6 +7,7 @@ import {
 	loadConfig,
 	saveConfig,
 } from "../../config/store.ts";
+import { readLine } from "../input.ts";
 
 export function registerConfig(program: Command): void {
 	const configCmd = program
@@ -161,13 +162,3 @@ function redactSensitive(value: unknown): unknown {
 function isSensitiveKey(key: string): boolean {
 	return SENSITIVE_KEY_RE.some((pattern) => pattern.test(key));
 }
-
-async function readLine(): Promise<string> {
-	const chunks: Uint8Array[] = [];
-	for await (const chunk of Bun.stdin.stream()) {
-		chunks.push(chunk);
-		const text = Buffer.concat(chunks).toString();
-		if (text.includes("\n")) return text.split("\n")[0]!.trim();
-	}
-	return Buffer.concat(chunks).toString().trim();
-}

package/src/cli/commands/create.ts

@@ -5,6 +5,8 @@ import { CliError, ExitCode } from "../errors.ts";
 import { runBwOrThrow } from "../../bw/runner.ts";
 import { withSession } from "../../bw/session.ts";
 import { buildNewItem, bwEncode } from "../../bw/encoding.ts";
+import { generateSecret } from "../../bw/generate.ts";
+import { resolveFolderRef } from "../../bw/folders.ts";
 import {
 	assertSingleStdinSource,
 	collect,
@@ -15,6 +17,7 @@ import {
 	StdinReader,
 	type ItemTextInputs,
 } from "../input.ts";
+import { redactGeneratedPassword } from "./generate.ts";
 
 interface CreateOptions extends ItemTextInputs {
 	type: string;
@@ -27,8 +30,23 @@ interface CreateOptions extends ItemTextInputs {
 	folder?: string;
 	favorite?: boolean;
 	fromJson?: boolean;
+	generateLength?: number;
 }
 
+/** Flags a secure note has nowhere to store — see {@link assertLoginFlags}. */
+const LOGIN_ONLY_FLAGS: Array<[keyof CreateOptions, string]> = [
+	["username", "--username"],
+	["password", "--password"],
+	["passwordStdin", "--password-stdin"],
+	["passwordFile", "--password-file"],
+	["passwordEnv", "--password-env"],
+	["passwordGenerate", "--password-generate"],
+	["totp", "--totp"],
+	["totpStdin", "--totp-stdin"],
+	["totpFile", "--totp-file"],
+	["totpEnv", "--totp-env"],
+];
+
 export function registerCreate(program: Command): void {
 	program
 		.command("create").alias("add")
@@ -42,11 +60,17 @@ export function registerCreate(program: Command): void {
 		.option("--password-stdin", "Read password from stdin")
 		.option("--password-file <path>", "Read password from file (use - for stdin)")
 		.option("--password-env <name>", "Read password from environment variable")
+		.option("--password-generate", "Generate the password; it is never printed")
+		.option("--generate-length <n>", "Length for --password-generate", parseInt)
+		.option("--totp <secret>", "TOTP secret: base32 or otpauth:// URI (login type)")
+		.option("--totp-stdin", "Read the TOTP secret from stdin")
+		.option("--totp-file <path>", "Read the TOTP secret from file (use - for stdin)")
+		.option("--totp-env <name>", "Read the TOTP secret from environment variable")
 		.option("--uri <url>", "URI (repeatable)", collect, [])
 		.option("--field <kv>", "Custom field k=v (repeatable)", collect, [])
 		.option("--field-file <kv>", "Custom field value from file k=path (repeatable)", collect, [])
 		.option("--field-env <kv>", "Custom field value from env var k=ENV (repeatable)", collect, [])
-		.option("--folder <id>", "Folder ID")
+		.option("--folder <name|id>", "Folder name or ID")
 		.option("--favorite", "Mark as favorite")
 		.option("--from-json", "Read full item JSON from stdin")
 		.action(async function (
@@ -57,6 +81,7 @@ export function registerCreate(program: Command): void {
 			const stdin = new StdinReader();
 
 			let encoded: string;
+			let generated = false;
 
 			if (localOpts.fromJson) {
 				const stdinText = await stdin.read();
@@ -82,6 +107,8 @@ export function registerCreate(program: Command): void {
 					);
 				}
 
+				assertLoginFlags(localOpts);
+
 				const explicitStdinSources = listExplicitStdinInputs({
 					...localOpts,
 					fieldFileFlag: "--field-file",
@@ -89,7 +116,10 @@ export function registerCreate(program: Command): void {
 				});
 				assertSingleStdinSource(explicitStdinSources);
 
-				const textInputs = await resolveItemTextInputs(localOpts, stdin);
+				const textInputs = await resolveItemTextInputs(localOpts, stdin, () =>
+					generateSecret({ length: localOpts.generateLength }),
+				);
+				generated = textInputs.passwordGenerated ?? false;
 				let notes = textInputs.notes;
 
 				// Backward compatibility: piped create input becomes note content.
@@ -117,9 +147,12 @@ export function registerCreate(program: Command): void {
 					notes: notes ?? null,
 					username: localOpts.username ?? null,
 					password: textInputs.password ?? null,
+					totp: textInputs.totp ?? null,
 					uris: localOpts.uri,
 					fields,
-					folderId: localOpts.folder ?? null,
+					folderId: localOpts.folder
+						? await resolveFolderRef(localOpts.folder, opts)
+						: null,
 					favorite: localOpts.favorite ?? false,
 				});
 
@@ -132,11 +165,33 @@ export function registerCreate(program: Command): void {
 
 			const created = JSON.parse(result);
 			if (opts.json) {
-				emitData(created, opts);
+				emitData(redactGeneratedPassword(created, generated), opts);
 			} else if (opts.plain) {
 				emitData(created.id, opts);
 			} else {
-				emitSuccess(`Created "${created.name}" (${created.id})`, opts);
+				const note = generated ? " — password generated (not printed)" : "";
+				emitSuccess(`Created "${created.name}" (${created.id})${note}`, opts);
 			}
 		});
 }
+
+/**
+ * A secure note has no login object, so `buildNewItem` drops usernames,
+ * passwords, and URIs on the floor. Accepting them silently means a caller can
+ * "store" a credential, get exit 0, and end up with an item that never held it.
+ */
+function assertLoginFlags(localOpts: CreateOptions): void {
+	if (localOpts.type === "login") return;
+
+	const used = LOGIN_ONLY_FLAGS.filter(([key]) => Boolean(localOpts[key])).map(
+		([, flag]) => flag,
+	);
+	if (localOpts.uri.length > 0) used.push("--uri");
+
+	if (used.length > 0) {
+		throw new CliError(
+			`${used.join(", ")} ${used.length > 1 ? "need" : "needs"} --type login (a note cannot store them).`,
+			ExitCode.BadArgs,
+		);
+	}
+}

package/src/cli/commands/delete.ts

@@ -4,6 +4,8 @@ import { emitData, emitSuccess } from "../io.ts";
 import { CliError, ExitCode } from "../errors.ts";
 import { runBwOrThrow } from "../../bw/runner.ts";
 import { withSession } from "../../bw/session.ts";
+import { readLine } from "../input.ts";
+import type { GlobalOptions } from "../types.ts";
 import pc from "picocolors";
 
 export function registerDelete(program: Command): void {
@@ -12,7 +14,7 @@ export function registerDelete(program: Command): void {
 		.description("Delete a vault item")
 		.argument("<item>", "Item name or ID")
 		.option("--permanent", "Permanently delete (no trash)")
-		.option("--force", "Skip confirmation prompt")
+		.option("--force", "Skip confirmation prompt (required when not interactive)")
 		.action(async function (
 			this: Command,
 			item: string,
@@ -28,17 +30,7 @@ export function registerDelete(program: Command): void {
 			const itemId: string = current.id;
 			const itemName: string = current.name;
 
-			// Confirm unless --force, --json, or --plain
-			if (!localOpts.force && !opts.json && !opts.plain && process.stdin.isTTY) {
-				const label = localOpts.permanent ? "permanently delete" : "delete";
-				process.stderr.write(
-					`${pc.yellow("?")} ${label} "${itemName}" (${itemId})? [y/N] `,
-				);
-				const answer = await readLine();
-				if (answer.toLowerCase() !== "y") {
-					throw new CliError("Cancelled", ExitCode.UserCancelled);
-				}
-			}
+			await confirmDelete(itemName, itemId, localOpts, opts);
 
 			const args = ["delete", "item", itemId];
 			if (localOpts.permanent) args.push("--permanent");
@@ -46,22 +38,57 @@ export function registerDelete(program: Command): void {
 			await withSession(opts, () => runBwOrThrow(args));
 
 			if (opts.json) {
-				emitData({ id: itemId, name: itemName, deleted: true }, opts);
+				emitData(
+					{
+						id: itemId,
+						name: itemName,
+						deleted: true,
+						permanent: localOpts.permanent ?? false,
+					},
+					opts,
+				);
 			} else if (opts.plain) {
 				emitData(itemId, opts);
 			} else {
 				const label = localOpts.permanent ? "Permanently deleted" : "Deleted";
-				emitSuccess(`${label} "${itemName}" (${itemId})`, opts);
+				const undo = localOpts.permanent
+					? ""
+					: ` — undo with ${pc.dim(`bwx restore ${itemId}`)}`;
+				emitSuccess(`${label} "${itemName}" (${itemId})${undo}`, opts);
 			}
 		});
+
 }
 
-async function readLine(): Promise<string> {
-	const chunks: Uint8Array[] = [];
-	for await (const chunk of Bun.stdin.stream()) {
-		chunks.push(chunk);
-		const text = Buffer.concat(chunks).toString();
-		if (text.includes("\n")) return text.split("\n")[0]!.trim();
+/**
+ * A prompt only guards a human at a terminal. The common caller here is a script
+ * or an agent, where the prompt never renders — so anything non-interactive must
+ * say `--force` out loud instead of being deleted on the strength of a flag that
+ * silently did nothing.
+ */
+async function confirmDelete(
+	itemName: string,
+	itemId: string,
+	localOpts: { permanent?: boolean; force?: boolean },
+	opts: GlobalOptions,
+): Promise<void> {
+	if (localOpts.force) return;
+
+	const interactive = process.stdin.isTTY && !opts.json && !opts.plain;
+	const label = localOpts.permanent ? "permanently delete" : "delete";
+
+	if (!interactive) {
+		throw new CliError(
+			`Refusing to ${label} "${itemName}" (${itemId}) without confirmation. Pass --force.`,
+			ExitCode.BadArgs,
+		);
+	}
+
+	process.stderr.write(
+		`${pc.yellow("?")} ${label} "${itemName}" (${itemId})? [y/N] `,
+	);
+	const answer = await readLine();
+	if (answer.toLowerCase() !== "y") {
+		throw new CliError("Cancelled", ExitCode.UserCancelled);
 	}
-	return Buffer.concat(chunks).toString().trim();
 }

package/src/cli/commands/edit.ts

@@ -5,6 +5,9 @@ import { CliError, ExitCode } from "../errors.ts";
 import { runBwOrThrow } from "../../bw/runner.ts";
 import { withSession } from "../../bw/session.ts";
 import { patchItem, bwEncode } from "../../bw/encoding.ts";
+import { generateSecret } from "../../bw/generate.ts";
+import { resolveFolderRef } from "../../bw/folders.ts";
+import { BwItemType } from "../../bw/types.ts";
 import {
 	assertSingleStdinSource,
 	collect,
@@ -14,6 +17,7 @@ import {
 	StdinReader,
 	type ItemTextInputs,
 } from "../input.ts";
+import { redactGeneratedPassword } from "./generate.ts";
 
 interface EditOptions extends ItemTextInputs {
 	name?: string;
@@ -23,11 +27,27 @@ interface EditOptions extends ItemTextInputs {
 	addFieldFile: string[];
 	addFieldEnv: string[];
 	rmField: string[];
+	rmTotp?: boolean;
 	folder?: string;
 	favorite?: boolean;
 	fromJson?: boolean;
+	generateLength?: number;
 }
 
+const LOGIN_ONLY_FLAGS: Array<[keyof EditOptions, string]> = [
+	["username", "--username"],
+	["password", "--password"],
+	["passwordStdin", "--password-stdin"],
+	["passwordFile", "--password-file"],
+	["passwordEnv", "--password-env"],
+	["passwordGenerate", "--password-generate"],
+	["totp", "--totp"],
+	["totpStdin", "--totp-stdin"],
+	["totpFile", "--totp-file"],
+	["totpEnv", "--totp-env"],
+	["rmTotp", "--rm-totp"],
+];
+
 export function registerEdit(program: Command): void {
 	program
 		.command("edit")
@@ -41,12 +61,19 @@ export function registerEdit(program: Command): void {
 		.option("--password-stdin", "Read password from stdin")
 		.option("--password-file <path>", "Read password from file (use - for stdin)")
 		.option("--password-env <name>", "Read password from environment variable")
+		.option("--password-generate", "Generate the password; it is never printed")
+		.option("--generate-length <n>", "Length for --password-generate", parseInt)
+		.option("--totp <secret>", "Set TOTP secret: base32 or otpauth:// URI")
+		.option("--totp-stdin", "Read the TOTP secret from stdin")
+		.option("--totp-file <path>", "Read the TOTP secret from file (use - for stdin)")
+		.option("--totp-env <name>", "Read the TOTP secret from environment variable")
+		.option("--rm-totp", "Remove the stored TOTP secret")
 		.option("--uri <url>", "Set URIs (repeatable, replaces all)", collect, [])
 		.option("--add-field <kv>", "Add/update field k=v", collect, [])
 		.option("--add-field-file <kv>", "Add/update field value from file k=path", collect, [])
 		.option("--add-field-env <kv>", "Add/update field value from env var k=ENV", collect, [])
 		.option("--rm-field <name>", "Remove field by name", collect, [])
-		.option("--folder <id>", "Move to folder")
+		.option("--folder <name|id>", "Move to folder ('none' to unfile)")
 		.option("--favorite", "Set favorite")
 		.option("--no-favorite", "Unset favorite")
 		.option("--from-json", "Read full item JSON from stdin (replaces item)")
@@ -57,6 +84,7 @@ export function registerEdit(program: Command): void {
 		) {
 			const opts = getGlobalOpts(this);
 			const stdin = new StdinReader();
+			let generated = false;
 
 			const result = await withSession(opts, async () => {
 				// Fetch current item
@@ -73,6 +101,9 @@ export function registerEdit(program: Command): void {
 					}
 					encoded = bwEncode(stdinText);
 				} else {
+					assertLoginFlags(localOpts, current);
+					assertTotpIntent(localOpts);
+
 					assertSingleStdinSource(
 						listExplicitStdinInputs({
 							...localOpts,
@@ -81,7 +112,10 @@ export function registerEdit(program: Command): void {
 						}),
 					);
 
-					const textInputs = await resolveItemTextInputs(localOpts, stdin);
+					const textInputs = await resolveItemTextInputs(localOpts, stdin, () =>
+						generateSecret({ length: localOpts.generateLength }),
+					);
+					generated = textInputs.passwordGenerated ?? false;
 
 					const addFields = await resolveFieldSources({
 						inline: localOpts.addField,
@@ -97,10 +131,13 @@ export function registerEdit(program: Command): void {
 						notes: textInputs.notes,
 						username: localOpts.username,
 						password: textInputs.password,
+						totp: localOpts.rmTotp ? null : textInputs.totp,
 						uris: localOpts.uri.length > 0 ? localOpts.uri : undefined,
 						addFields,
 						rmFields: localOpts.rmField,
-						folderId: localOpts.folder,
+						folderId: localOpts.folder
+							? await resolveFolderRef(localOpts.folder, opts)
+							: undefined,
 						favorite: localOpts.favorite,
 					});
 					encoded = bwEncode(JSON.stringify(patched));
@@ -111,11 +148,57 @@ export function registerEdit(program: Command): void {
 
 			const updated = JSON.parse(result);
 			if (opts.json) {
-				emitData(updated, opts);
+				emitData(redactGeneratedPassword(updated, generated), opts);
 			} else if (opts.plain) {
 				emitData(updated.id, opts);
 			} else {
-				emitSuccess(`Updated "${updated.name}" (${updated.id})`, opts);
+				const note = generated ? " — password generated (not printed)" : "";
+				emitSuccess(`Updated "${updated.name}" (${updated.id})${note}`, opts);
 			}
 		});
 }
+
+/**
+ * Setting and clearing the same secret in one call has no sensible winner, and
+ * picking one silently would either drop a seed or fail to remove one.
+ */
+function assertTotpIntent(localOpts: EditOptions): void {
+	if (!localOpts.rmTotp) return;
+
+	const setters = [
+		localOpts.totp !== undefined ? "--totp" : null,
+		localOpts.totpStdin ? "--totp-stdin" : null,
+		localOpts.totpFile !== undefined ? "--totp-file" : null,
+		localOpts.totpEnv !== undefined ? "--totp-env" : null,
+	].filter((flag): flag is string => flag !== null);
+
+	if (setters.length > 0) {
+		throw new CliError(
+			`--rm-totp cannot be combined with ${setters.join(", ")}.`,
+			ExitCode.BadArgs,
+		);
+	}
+}
+
+/**
+ * Same trap as `create`: only a login item has somewhere to put a password, so
+ * setting one on a note would be accepted and then quietly lost.
+ */
+function assertLoginFlags(
+	localOpts: EditOptions,
+	current: Record<string, unknown>,
+): void {
+	if (current.type === BwItemType.Login) return;
+
+	const used = LOGIN_ONLY_FLAGS.filter(([key]) => Boolean(localOpts[key])).map(
+		([, flag]) => flag,
+	);
+	if (localOpts.uri.length > 0) used.push("--uri");
+
+	if (used.length === 0) return;
+
+	throw new CliError(
+		`${used.join(", ")} ${used.length > 1 ? "need" : "needs"} a login item, but "${String(current.name)}" is not one.`,
+		ExitCode.BadArgs,
+	);
+}