refactor: drop pre-live compatibility formats (v5.0.0)

@@ -1,7 +1,7 @@11 {22   "manifest_version": 3,33   "name": "Peach Password Manager",4-  "version": "4.10.43",4+  "version": "5.0.0",55   "description": "Zero-knowledge password manager",66   "browser_specific_settings": {77     "gecko": {

@@ -2,7 +2,7 @@22   "manifest_version": 3,33   "minimum_chrome_version": "116",44   "name": "Peach Password Manager",5-  "version": "4.10.43",5+  "version": "5.0.0",66   "description": "Zero-knowledge password manager",77   "action": {88     "default_popup": "src/popup/index.html",

@@ -1,6 +1,6 @@11 {22   "name": "peach",3-  "version": "4.10.43",3+  "version": "5.0.0",44   "description": "Zero-knowledge password manager",55   "license": "GPL-3.0-only",66   "type": "module",

@@ -6,11 +6,8 @@66  * redirect its imports here. All ciphertext in the vault slots is produced77  * by `encrypt`/`decrypt` below with a fresh random 96-bit nonce.88  *9- * AAD (additionalData) carries an optional aadTag string for slot-scope10- * domain separation (L15/SEC-009). The legacy single-byte version AAD is11- * still accepted on decrypt-fallback so pre-L15 vaults open without a12- * migration write — callers that want hardened AAD just pass an aadTag13- * (e.g. "slot_a_v1") on both encrypt and decrypt.9+ * AAD (additionalData) carries an aadTag string for slot-scope domain10+ * separation (L15/SEC-009). Current vaults always use an explicit tag.1411  */1512 1613 const VERSION_BYTE = new Uint8Array([1]);@@ -92,18 +89,7 @@9289       await decryptWithAadBytes(keyBytes, nonce, ciphertext, tag, aad),9390     );9491 95-  try {96-    return await tryDecrypt(aadFor(aadTag));97-  } catch (err) {98-    // L15 migration: legacy ciphertext was sealed with VERSION_BYTE only.99-    // If a tagged decrypt fails, fall back so pre-L15 vaults still open.100-    // The caller is responsible for re-sealing with the new AAD on next101-    // write (which happens naturally — every vault mutation calls encrypt).102-    if (aadTag) {103-      return await tryDecrypt(VERSION_BYTE);104-    }105-    throw err;106-  }92+  return await tryDecrypt(aadFor(aadTag));10793 }10894 10995 async function decryptWithAadBytes(

@@ -115,7 +115,7 @@115115   const slotB = slotBRaw ? JSON.stringify(slotBRaw) : null;116116   const lastModified = typeof lastModRaw === "string" ? lastModRaw : null;117117 118-  // Recovery words exist only on v2.12+ vaults that have completed migration.118+  // Recovery words are present on every supported vault.119119   // A missing root key throws; treat that as "no words available" rather than120120   // a hard error so the Codex can still print without them.121121   let recoveryWords: string[] | null = null;

@@ -51,18 +51,6 @@5151     (globalThis as { chrome?: typeof chrome }).chrome = chromeMock;5252   });5353 54-  it("migrates_legacy_sync_id_to_local_and_removes_from_sync", async () => {55-    sync[DEVICE_ID_KEY] = "legacy-roamed-id";56-    const { getOrCreateDeviceId } = await import("./device-identity");57-58-    const id = await getOrCreateDeviceId();59-60-    expect(id).toBe("legacy-roamed-id");61-    expect(local[DEVICE_ID_KEY]).toBe("legacy-roamed-id");62-    expect(syncRemove).toHaveBeenCalledWith(DEVICE_ID_KEY);63-    expect(sync[DEVICE_ID_KEY]).toBeUndefined();64-  });65-6654   it("fresh_install_writes_id_to_local_only", async () => {6755     const { getOrCreateDeviceId } = await import("./device-identity");6856 

@@ -3,8 +3,7 @@33 // `deviceId` is a stable UUID v4 generated on first call and persisted in44 // `chrome.storage.local`. It is deliberately device-local and must NOT roam:55 // it is the only symmetry-breaker in the sync-identity HKDF (see PCH-01-004),6-// so a shared id across profiles would collide derived sync keys. A first-read7-// migration moves any legacy value out of `chrome.storage.sync`.6+// so a shared id across profiles would collide derived sync keys.87 //98 // `deviceName` defaults to a short, friendly browser+OS description and109 // can be overridden by the user from Settings → Sync.@@ -43,17 +42,6 @@4342   const local = await chrome.storage.local.get(DEVICE_ID_KEY);4443   const localId = (local as Record<string, unknown>)[DEVICE_ID_KEY];4544   if (typeof localId === "string" && localId.length > 0) return localId;46-47-  // First-read migration: adopt a value previously stored in sync, then evict it48-  // from sync so a sibling profile cannot re-roam it back. Idempotent — once the49-  // id lives in local, this branch never runs again.50-  const synced = await chrome.storage.sync.get(DEVICE_ID_KEY);51-  const syncedId = (synced as Record<string, unknown>)[DEVICE_ID_KEY];52-  if (typeof syncedId === "string" && syncedId.length > 0) {53-    await chrome.storage.local.set({ [DEVICE_ID_KEY]: syncedId });54-    await chrome.storage.sync.remove(DEVICE_ID_KEY);55-    return syncedId;56-  }5745 5846   const fresh = generateUuidV4();5947   await chrome.storage.local.set({ [DEVICE_ID_KEY]: fresh });

@@ -389,7 +389,6 @@389389           const words = await vault.getRecoveryWords();390390           return { ok: true, data: words };391391         } catch {392-          // pre-v2.12 vault that hasn't migrated393392           return { ok: false, error: "recovery_not_setup" };394393         }395394       }@@ -780,7 +779,7 @@780779         if (seed) {781780           try {782781             // PCH-01-019: honour stored algorithm/digits/period (defaults apply783-            // when these are undefined, i.e. legacy bare-seed entries).782+            // when these are undefined, i.e. RFC-default bare-seed entries).784783             const generated = generateTOTP(seed, totpAlgorithm, totpDigits, totpPeriod);785784             totpCode = generated.code;786785             totpRemaining = generated.remaining;

@@ -485,41 +485,5 @@485485       expect(after).toEqual(original);486486     });487487 488-    it('pre-v2.12 vault (no recovery escrow) gets recovery words after first unlock', async () => {489-      // Build a slot A that has *no* recovery_* fields and *no* pw_root_*.490-      // The migration path in unlock() should populate both.491-      await setupUnlockedVault();492-      const slot = rawSlotA();493-      const legacy: StoredVault = {494-        version: slot.version,495-        salt: slot.salt,496-        nonce: slot.nonce,497-        ciphertext: slot.ciphertext,498-        tag: slot.tag,499-      };500-      storage.peach_vault_a = legacy;501-      await lockVault();502-503-      const unlocked = await dispatch({504-        type: 'UNLOCK',505-        payload: { password: 'test-pass-12345' },506-      });507-      expect(unlocked.ok).toBe(true);508-509-      const result = await dispatch({ type: 'GET_RECOVERY_WORDS', payload: { password: 'test-pass-12345' } });510-      expect(result.ok).toBe(true);511-      const words = (result as { data: string[] }).data;512-      expect(words).toHaveLength(12);513-514-      // Migration must surface the recovery-pending flag so the popup515-      // re-presents the words for confirmation.516-      expect(storage.peach_recovery_pending).toBe('1');517-518-      // Slot A must now have both wrappings persisted.519-      const slotAfter = storage.peach_vault_a as StoredVault;520-      expect(slotAfter.recovery_salt).toBeTruthy();521-      expect(slotAfter.recovery_wrapped_root_key).toBeTruthy();522-      expect(slotAfter.pw_root_ciphertext).toBeTruthy();523-    });524488   });525489 });

@@ -34,14 +34,9 @@3434   };3535 });3636 37-describe("sync settings migration", () => {37+describe("sync settings", () => {3838   it("defaults to public relay with nothing stored", async () => {3939     expect(await getSyncSettings()).toEqual({ mode: "public", relayUrl: DEFAULT_RELAY_URL });40-  });41-42-  it("maps the retired lanOnly flag to off, never to public", async () => {43-    store.peach_sync_lan_only_v1 = true;44-    expect((await getSyncSettings()).mode).toBe("off");4540   });4641 4742   it("maps a configured custom relay with no stored mode to private", async () => {

@@ -26,15 +26,12 @@2626 2727 const RELAY_URL_KEY = "peach_relay_url_v1";2828 const SYNC_MODE_KEY = "peach_sync_mode_v1";29-/** Retired `lanOnly` flag, read once for migration and never written again. */30-const LEGACY_LAN_ONLY_KEY = "peach_sync_lan_only_v1";3129 3230 export async function getSyncSettings(): Promise<SyncSettings> {3331   try {3432     const values = (await chrome.storage.local.get([3533       RELAY_URL_KEY,3634       SYNC_MODE_KEY,37-      LEGACY_LAN_ONLY_KEY,3835     ])) as Record<string, unknown>;3936 4037     const storedUrl =@@ -47,16 +44,11 @@4744       return { mode: stored, relayUrl: relayFor(stored, storedUrl) };4845     }4946 50-    // Migration. Someone who set lanOnly chose "no relay involved", and LAN is51-    // now gone, so the honest landing spot is `off` rather than silently52-    // enrolling them in a relay they opted out of. Everyone else lands on53-    // public/private by whether they had configured a custom URL.47+    // A missing mode is a fresh install or an incomplete local store. Infer the48+    // current mode from the configured relay; retired LAN settings are no49+    // longer interpreted.5450     const mode: SyncMode =55-      values[LEGACY_LAN_ONLY_KEY] === true56-        ? "off"57-        : storedUrl === DEFAULT_RELAY_URL58-          ? "public"59-          : "private";51+      storedUrl === DEFAULT_RELAY_URL ? "public" : "private";6052     return { mode, relayUrl: relayFor(mode, storedUrl) };6153   } catch {6254     return { mode: "public", relayUrl: DEFAULT_RELAY_URL };

@@ -72,7 +72,7 @@7272     // — sync identity derives from rootKey, not derivedKey. The previous7373     // restoreFromSession only set rootKey when the slot had recovery_salt +7474     // recovery_wrapped_root_key; for any vault that hadn't been through75-    // migrateToRecovery, rootKey was silently null and the runner returned75+    // the recovery bootstrap, rootKey was silently null and the runner returned7676     // VAULT_LOCKED. The fix is to always derive rootKey from pw_root_* (which7777     // are present on every vault since createVault).7878     const v1 = await import("./vault");

@@ -257,30 +257,6 @@257257     expect(await vault.isDuressEnabled()).toBe(false);258258   });259259 260-  it("migrates legacy peach_vault / peach_decoy_vault / peach_duress schema", async () => {261-    // Arrange: set up storage as if from pre-A-2 (v1.4.24 and earlier).262-    const firstVault = await import("./vault");263-    await firstVault.createVault("legacy-password-abcde");264-    const legacySlotA = storage.peach_vault_a as StoredVault;265-    storage.peach_vault = legacySlotA;266-    delete storage.peach_vault_a;267-    delete storage.peach_vault_b;268-    storage.peach_duress = { enabled: true };269-    storage.peach_decoy_vault = legacySlotA; // reuse shape for test270-    vi.resetModules();271-272-    // Act: fresh module load triggers migration on next vault access.273-    const vault = await import("./vault");274-    await vault.hasVault();275-276-    // Assert: legacy keys removed, new keys present.277-    expect(storage.peach_vault).toBeUndefined();278-    expect(storage.peach_decoy_vault).toBeUndefined();279-    expect(storage.peach_duress).toBeUndefined();280-    expect(storage.peach_vault_a).toBeDefined();281-    expect(storage.peach_vault_b).toBeDefined();282-  });283-284260   it("soft deletes entries while keeping deletedAt in encrypted storage", async () => {285261     const vault = await import("./vault");286262 @@ -1094,24 +1070,6 @@10941070     expect(vault.getRootKeyHex()).toBe(rootBefore);10951071   });10961072 1097-  it("unlock_with_key_succeeds_without_escrow (PCH-01-009)", async () => {1098-    const vault = await import("./vault");1099-    await vault.createVault("legacy-pass-12345");1100-    const keyHex = vault.getDerivedKeyHex();1101-    vault.lock();1102-    // Strip the recovery escrow to mimic a pre-v2.12 slot — unlock must still1103-    // succeed (non-fatal), leaving rootKey null.1104-    const slot = storage.peach_vault_a as Record<string, unknown>;1105-    delete slot.recovery_salt;1106-    delete slot.recovery_wrapped_root_key;1107-    delete slot.pw_root_ciphertext;1108-    delete slot.pw_root_nonce;1109-    delete slot.pw_root_tag;1110-    const r = await vault.unlockWithKey(keyHex);1111-    expect(r.ok).toBe(true);1112-    expect(vault.getRootKeyHex()).toBeNull();1113-  });1114-11151073   it("duress keeps both slots equal length at rest, even as the real vault grows (audit MEDIUM)", async () => {11161074     const vault = await import("./vault");11171075     await vault.createVault("duress-real-pass-aaaa");@@ -1346,35 +1304,6 @@13461304       expect(vault.getEntries().some((e) => e.id === "e4")).toBe(false);13471305     });13481306 1349-    it("migrates a pre-v2.11 flat-passkey backup entry into the passkey sub-object", async () => {1350-      const vault = await import("./vault");1351-      await vault.createVault("correct horse battery staple");1352-      await vault.restoreEntries(1353-        [1354-          {1355-            id: "e5",1356-            type: "passkey",1357-            title: "Legacy Passkey",1358-            createdAt: 1,1359-            modifiedAt: 2,1360-            rpId: "example.com",1361-            rpName: "Example",1362-            credentialId: "cred-123",1363-            publicKeyCose: "cose-blob",1364-            userHandle: "uh",1365-            userName: "june",1366-            userDisplayName: "June",1367-            algorithm: -7,1368-          } as unknown as import("../shared/types").VaultEntry,1369-        ],1370-        "replace",1371-      );1372-      const restored = vault.getEntries().find((e) => e.id === "e5")!;1373-      expect(restored).toBeDefined();1374-      expect(restored.passkey?.credentialId).toBe("cred-123");1375-      // Flat legacy fields are not kept as top-level keys.1376-      expect((restored as unknown as Record<string, unknown>).credentialId).toBeUndefined();1377-    });13781307   });13791308 13801309   describe("MV-8 rotateSyncIdentity", () => {@@ -1450,26 +1379,6 @@14501379       expect(await vault.unlock(PW_NFC)).toBe(true);14511380     });14521381 1453-    it("a legacy vault sealed with raw non-NFC bytes still unlocks and is healed to NFC", async () => {1454-      const vault = await import("./vault");1455-      const { deriveKeyRaw, generateSalt } = await import("../crypto/argon2");1456-      await vault.createVault("base-password-12345");1457-1458-      // Simulate a pre-LV-1 vault: re-seal slot A under the RAW (un-normalized)1459-      // NFD bytes, which the NFC chokepoint would never reproduce.1460-      const rawSalt = generateSalt();1461-      const rawKey = await deriveKeyRaw(PW_NFD, rawSalt);1462-      await vault.changePasswordWithNewKey(rawSalt, rawKey);1463-      vault.lock();1464-1465-      // Normal NFC derive can't open the raw seal — the legacy-raw fallback must.1466-      expect(await vault.unlock(PW_NFD)).toBe(true);1467-1468-      // Healed: the slot is now NFC-sealed, so a second unlock takes the1469-      // normal path (and the NFC form opens it too).1470-      vault.lock();1471-      expect(await vault.unlock(PW_NFC)).toBe(true);1472-    });14731382   });14741383 14751384   describe("LV-7 updateSettings proto-pollution filter", () => {

@@ -9,7 +9,7 @@99  * Projects.md §3.2–§3.6.1010  */1111 12-import { deriveKey, deriveKeyRaw, generateSalt } from "../crypto/argon2";12+import { deriveKey, generateSalt } from "../crypto/argon2";1313 import { extractDomain } from "../shared/domain";1414 import { clampSyncTimestamp } from "../shared/sync-limits";1515 import { computeVaultId } from "../shared/sync-identity";@@ -25,7 +25,6 @@2525 import type {2626   AccentColorName,2727   Canary,28-  LegacyVaultEntry,2928   ManualSummonRecord,3029   PasskeyData,3130   SavedIdentity,@@ -50,11 +49,6 @@5049 const SLOT_A = "peach_vault_a";5150 const SLOT_B = "peach_vault_b";5251 53-// Legacy keys, migrated away on first access.54-const LEGACY_MAIN = "peach_vault";55-const LEGACY_DECOY = "peach_decoy_vault";56-const LEGACY_DURESS_FLAG = "peach_duress";57-5852 // Plaintext is padded to the next multiple of this size before encryption.5953 // This coarsens ciphertext-length leakage into 1 KiB buckets.6054 const PAD_BLOCK = 1024;@@ -93,8 +87,6 @@9387 // this stays false because we never see slot A's plaintext.9488 let duressConfigured = false;9589 96-let migrationRan = false;97-9890 // Set to a corruption reason during the last unlock() attempt when both slots9991 // decrypted but failed schema validation. Consumed and cleared by10092 // consumeLastUnlockFailureReason() so messages.ts can surface vault_corrupted@@ -588,7 +580,7 @@588580   // Refresh pw_root_* under the new key so deriveRootKeyFromDerivedKey works589581   // on the next unlock (H2/COR-006). If rootKey is missing — recovery flow590582   // should have populated it — fall back silently rather than blowing up the591-  // recovery path; migrateToRecovery will rehydrate on the next unlock.583+  // recovery path; the escrow is already present on every supported vault.592584   if (rootKey) {593585     const slotAfter = await loadSlot(SLOT_A);594586     if (slotAfter) {@@ -621,10 +613,7 @@621613  * the user re-entering their recovery phrase: the same root key bytes —622614  * and therefore the same 12 words — survive every unlock.623615  *624- * Returns null when the pw_root fields are absent (pre-v2.12 vault that625- * hasn't been migrated yet) or when decryption fails (wrong derived key,626- * tampered ciphertext). On null the caller should fall through to627- * migrateToRecovery() to populate the fields.616+ * Returns null when the escrow is absent or decryption fails.628617  */629618 async function deriveRootKeyFromDerivedKey(630619   derivedKeyBytes: Uint8Array,@@ -661,54 +650,10 @@661650   };662651 }663652 664-/**665- * For vaults created before v2.12 (no recovery_salt/recovery_wrapped_root_key),666- * generate the root key, wrap it under the recovery words, and persist the667- * recovery escrow into slot A. The caller must show the recovery words to the668- * user before calling this — once called, those words are the vault's recovery669- * path. This runs once, on the first unlock of an upgraded vault.670- */671-export async function migrateToRecovery(): Promise<void> {672-  if (!derivedKey || vaultMode !== "real") {673-    throw new Error("vault must be unlocked in real mode");674-  }675-  const slotA = await loadSlot(SLOT_A);676-  if (!slotA) throw new Error("missing slot A");677-  const hasRecoveryEscrow =678-    !!slotA.recovery_salt && !!slotA.recovery_wrapped_root_key;679-  const hasPwRoot = !!slotA.pw_root_ciphertext && !!slotA.pw_root_nonce;680-  if (hasRecoveryEscrow && hasPwRoot) return; // already done681-682-  // If recovery escrow already exists but pw_root doesn't, we cannot recover683-  // the original rootKey without the user's words. The least-surprising path684-  // is to rotate to a fresh root key — the user's old recovery words become685-  // invalid but we surface peach_recovery_pending so the popup re-presents686-  // the words. The unlock-path callers all set that flag.687-  const { rawRootKey, recoverySalt, wrappedRootKey, wrappedNonce, wrappedTag } =688-    await generateAndWrapRootKey();689-  rootKey = unhex(rawRootKey);690-691-  const pwRoot = await wrapRootKeyForDerivedKey(derivedKey, rootKey);692-  const nextSlotA: StoredVault = {693-    ...slotA,694-    recovery_salt: recoverySalt,695-    recovery_wrapped_root_key: wrappedRootKey,696-    recovery_nonce: wrappedNonce,697-    recovery_tag: wrappedTag,698-    ...pwRoot,699-  };700-  await writeSlot(SLOT_A, nextSlotA);701-  await stampLocalVaultMutation();702-}703-704-/**705- * Returns the 12 recovery words for the current session's root key.706- * Must be called while the vault is unlocked. Throws if recovery has not707- * been set up (pre-v2.12 vault that hasn't migrated yet).708- */653+/** Returns the 12 recovery words for the current session's root key. */709654 export async function getRecoveryWords(): Promise<string[]> {710655   if (!rootKey) {711-    throw new Error("recovery not set up — vault may need migration");656+    throw new Error("recovery not set up");712657   }713658   return rootKeyToWords(rootKey);714659 }@@ -800,59 +745,6 @@800745   });801746 }802747 803-/**804- * One-shot migration from the pre-A-2 schema (peach_vault + peach_decoy_vault805- * + peach_duress flag) to the slot-neutral schema (peach_vault_a +806- * peach_vault_b). Runs at most once per session; safe to call repeatedly.807- */808-async function ensureMigrated(): Promise<void> {809-  if (migrationRan) return;810-  migrationRan = true;811-812-  const keys = [LEGACY_MAIN, LEGACY_DECOY, LEGACY_DURESS_FLAG, SLOT_A, SLOT_B];813-  const raw = await chrome.storage.local.get(keys);814-  const slotAExists = raw[SLOT_A] !== undefined;815-  const slotBExists = raw[SLOT_B] !== undefined;816-  const legacyMain = raw[LEGACY_MAIN] as StoredVault | undefined;817-  const legacyDecoy = raw[LEGACY_DECOY] as StoredVault | undefined;818-819-  // Fresh install with nothing in storage — nothing to do; createVault() sets up both slots.820-  if (!slotAExists && !legacyMain) return;821-822-  // Already migrated.823-  if (slotAExists && slotBExists && !legacyMain && !legacyDecoy) return;824-825-  let didMigrate = false;826-  if (legacyMain && !slotAExists) {827-    await writeSlot(SLOT_A, legacyMain);828-    didMigrate = true;829-  }830-831-  // If slot B isn't set, populate it: use legacy decoy when present, else noise.832-  if (!slotBExists) {833-    const target = (legacyMain ?? raw[SLOT_A]) as StoredVault | undefined;834-    if (legacyDecoy) {835-      await writeSlot(SLOT_B, legacyDecoy);836-      didMigrate = true;837-    } else if (target) {838-      await writeSlot(SLOT_B, generateNoiseBlob(target.ciphertext.length / 2));839-      didMigrate = true;840-    }841-  }842-843-  const toRemove: string[] = [];844-  if (legacyMain) toRemove.push(LEGACY_MAIN);845-  if (legacyDecoy) toRemove.push(LEGACY_DECOY);846-  if (raw[LEGACY_DURESS_FLAG] !== undefined) toRemove.push(LEGACY_DURESS_FLAG);847-  if (toRemove.length > 0) {848-    await chrome.storage.local.remove(toRemove);849-    didMigrate = true;850-  }851-  if (didMigrate) {852-    await stampLocalVaultMutation();853-  }854-}855-856748 // ---------------------------------------------------------------------------857749 // Padding + noise helpers858750 // ---------------------------------------------------------------------------@@ -922,12 +814,6 @@922814   entries: VaultEntry[];923815   tombstones: Map<string, number>;924816   duressConfigured: boolean;925-  /**926-   * True when the on-disk payload needs a one-time rewrite: either an entry927-   * had a legacy shape or the payload predates the tombstone ledger. The928-   * unlock path persists the normalized shape immediately.929-   */930-  migratedFromLegacy: boolean;931817 };932818 933819 function encodePayload(entries: VaultEntry[], duress: boolean, minBytes = 0): string {@@ -975,55 +861,23 @@975861   }976862 }977863 978-function rawNeedsMigration(raw: VaultEntry | LegacyVaultEntry): boolean {979-  if ("created" in raw || "updated" in raw) return true;980-  const flat = raw as Partial<VaultEntry>;981-  if (flat.type === "passkey") return true;982-  // Flat rpId without a passkey sub-object means pre-v2.11.0 schema.983-  if (flat.rpId !== undefined && flat.passkey === undefined) return true;984-  return false;985-}986-987864 function decodePayload(plain: string): DecryptedPayload {988-  const parsed = JSON.parse(plain) as989-    | Array<VaultEntry | LegacyVaultEntry>990-    | VaultPayload;991-992-  const rawEntries = Array.isArray(parsed) ? parsed : parsed.entries ?? [];993-  const flatMigrationNeeded = rawEntries.some(rawNeedsMigration);994-995-  const normalized = rawEntries.map(normalizeEntry);996-  const { merged } = mergePasskeyOnlyIntoLogins(normalized);997-  const decodedTombstones = decodeTombstones(998-    Array.isArray(parsed) ? undefined : parsed.tombstones,999-    normalized,1000-  );1001-1002-  if (Array.isArray(parsed)) {1003-    return {1004-      entries: normalized,1005-      tombstones: decodedTombstones,1006-      duressConfigured: false,1007-      migratedFromLegacy: true, // pre-A-2 array shape always needs save1008-    };865+  const parsed = JSON.parse(plain) as VaultPayload;866+  if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.entries)) {867+    throw new Error("invalid vault payload");1009868   }1010-869+  const normalized = parsed.entries.map(normalizeEntry);1011870   return {1012871     entries: normalized,1013-    tombstones: decodedTombstones,872+    tombstones: decodeTombstones(parsed.tombstones, normalized),1014873     duressConfigured: parsed.duressConfigured === true,1015-    migratedFromLegacy:1016-      flatMigrationNeeded || merged || !Object.hasOwn(parsed, "tombstones"),1017874   };1018875 }1019876 1020877 /**1021- * One-time consolidation pass run alongside the legacy passkey migration.878+ * Consolidate duplicate passkey records after registration.1022879  *1023- * Pre-v2.11.0 the Chrome passkey path always created a fresh `type:"passkey"`1024- * entry per registration — so users who tested registration multiple times1025- * accumulated several passkey-bearing entries for the same RP, and the1026- * migration to the unified shape carried that duplication forward. This880+ * Multiple registrations for one RP can leave duplicate passkey records. This1027881  * pass collapses the duplicates:1028882  *1029883  *   1. Group passkey-bearing (and not deleted) entries by `passkey.rpId`.@@ -1208,8 +1062,6 @@12081062 }12091063 12101064 export async function createVault(password: string): Promise<void> {1211-  await ensureMigrated();1212-12131065   const salt = generateSalt();12141066   derivedKey = await deriveKey(password, salt);12151067   entries = [];@@ -1277,7 +1129,6 @@12771129   let nextDerivedKey: Uint8Array | null = null;12781130   let sessionRootKey: Uint8Array | null = null;12791131   try {1280-    await ensureMigrated();12811132     if ((await loadSlot(SLOT_A)) !== null) {12821133       throw new Error("ADOPT_VAULT_ALREADY_EXISTS");12831134     }@@ -1332,7 +1183,6 @@13321183 }13331184 13341185 export async function hasVault(): Promise<boolean> {1335-  await ensureMigrated();13361186   return (await loadSlot(SLOT_A)) !== null;13371187 }13381188 @@ -1349,8 +1199,6 @@13491199   if (!derivedKey || vaultMode !== "real") {13501200     throw new Error("vault must be unlocked in real mode");13511201   }1352-  await ensureMigrated();1353-13541202   // Encrypt the decoy payload (empty entries) under the duress key. Pad to13551203   // at least the current slot A ciphertext size so the two slots look the13561204   // same at rest at setup time.@@ -1387,8 +1235,6 @@13871235   if (!derivedKey || vaultMode !== "real") {13881236     throw new Error("vault must be unlocked in real mode");13891237   }1390-  await ensureMigrated();1391-13921238   // Overwrite slot B with fresh noise that matches slot A's size. The slot13931239   // remains occupied so its mere existence does not signal that duress was13941240   // ever configured.@@ -1408,7 +1254,6 @@14081254 // password by guessing it, and the asymmetry in error timing is acceptable14091255 // because duress mode is opt-in and the user knows their own decoy key.14101256 export async function verifyMainPassword(password: string): Promise<boolean> {1411-  await ensureMigrated();14121257   const slotA = await loadSlot(SLOT_A);14131258   if (!slotA) return false;14141259   const key = await deriveKey(password, unhex(slotA.salt));@@ -1420,39 +1265,15 @@14201265 }14211266 14221267 export async function unlock(password: string): Promise<boolean> {1423-  // LV-1: the normal path NFC-normalizes inside deriveKey. If that fails and1424-  // the supplied password is not already in NFC form, the vault may have been1425-  // sealed (pre-LV-1) with the raw, un-normalized bytes — retry with those.1426-  if (await attemptUnlockWithDerive(password, deriveKey)) return true;1427-1428-  const nfc = password.normalize("NFC");1429-  if (password === nfc) return false; // ASCII/NFC password — no legacy form to try1430-1431-  if (await attemptUnlockWithDerive(password, deriveKeyRaw)) {1432-    // Heal: re-seal the real slot under the NFC-normalized key so every1433-    // future unlock takes the normal path. Only the real vault is re-sealed;1434-    // a non-NFC duress password keeps working through this fallback.1435-    if (vaultMode === "real") {1436-      try {1437-        const newSalt = generateSalt();1438-        const newKey = await deriveKey(password, newSalt);1439-        await changePasswordWithNewKey(newSalt, newKey);1440-      } catch (healErr) {1441-        console.warn("[Peach] LV-1 NFC heal failed:", healErr);1442-      }1443-    }1444-    return true;1445-  }1446-  return false;1268+  return attemptUnlockWithDerive(password, deriveKey);14471269 }14481270 14491271 async function attemptUnlockWithDerive(14501272   password: string,14511273   derive: typeof deriveKey,14521274 ): Promise<boolean> {1453-  await ensureMigrated();1454-1455-  // Load both slots in parallel. Both always exist post-migration; the1275+  // Load both current-format slots in parallel. Both exist on a supported1276+  // install; the14561277   // parallel load and the parallel derivation below keep wall-clock time14571278   // constant regardless of which slot's passphrase (real or decoy) the14581279   // caller supplied, so a timing side channel cannot distinguish the@@ -1494,38 +1315,14 @@14941315     touchAutoLock();14951316     if (keyB) zeroKey(keyB);14961317 1497-    // slotA is non-null when payloadA is truthy (keyA was derived from slotA).1498-    if (slotA) {1499-      const needsRecoverySetup =1500-        !slotA.recovery_salt || !slotA.recovery_wrapped_root_key;1501-      if (!needsRecoverySetup) {1502-        rootKey = await deriveRootKeyFromDerivedKey(keyA, slotA);1503-      }1504-      // Pre-v2.12 vault, or a vault whose pw_root_* fields haven't been written1505-      // yet: generate the recovery escrow and seed pw_root_* so subsequent1506-      // unlocks can rehydrate rootKey without the user's recovery words.1507-      // Best-effort — a failure here must not block unlock.1508-      if (needsRecoverySetup || !rootKey) {1509-        try {1510-          await migrateToRecovery();1511-          if (needsRecoverySetup) {1512-            // String "1" matches the popup's existing peach_recovery_pending1513-            // check; surfaced so the user re-confirms recovery words after a1514-            // legacy-vault unlock (H2/COR-006).1515-            await chrome.storage.local.set({ peach_recovery_pending: '1' });1516-          }1517-        } catch (migrationErr) {1518-          console.warn('[Peach] recovery migration failed:', migrationErr);1519-        }1520-      }1318+    // Current vaults always carry a password-wrapped root key. Older vaults1319+    // without this escrow are outside the supported storage format.1320+    rootKey = slotA ? await deriveRootKeyFromDerivedKey(keyA, slotA) : null;1321+    if (!rootKey) {1322+      lock();1323+      return false;15211324     }15221325 1523-    // If the payload had a pre-v2.11.0 shape (legacy passkey type, flat1524-    // passkey fields, or pre-A-2 created/updated keys), rewrite it now so1525-    // the next save uses the new format and migration doesn't re-run forever.1526-    if (payloadA.migratedFromLegacy) {1527-      await persistSlotA();1528-    }15291326     await lockedSyncUnlockHook?.().catch((error) => {15301327       console.warn("[Peach sync] locked inbox drain failed:", error);15311328     });@@ -1608,20 +1405,13 @@16081405   await loadSettings();16091406   touchAutoLock();16101407 1611-  // The rootKey is what identity/sync derivations use. deriveRootKeyFromDerivedKey1612-  // pulls it from the pw_root_* fields on the slot — set on every createVault +1613-  // re-set on every password change (H2/COR-006). The previous gate on1614-  // recovery_salt + recovery_wrapped_root_key silently left rootKey unset for1615-  // any vault that hadn't been through migrateToRecovery, which broke background1616-  // sync: the SW re-woke from the alarm, isUnlocked() was true (the session key1617-  // restored derivedKey + entries), but getRootKeyHex() returned null and the1618-  // runner returned VAULT_LOCKED. The fix is to always try the pw_root path1619-  // when the slot has those fields — the recovery fields are independent.1408+  // Rehydrate the root key used by sync identity derivation from the password1409+  // escrow stored on the current vault format.16201410   if (entry.mode === "real") {1621-    try {1622-      rootKey = await deriveRootKeyFromDerivedKey(key, slot);1623-    } catch {1624-      /* non-fatal — sync identity will still skip on the runner's null-rootKey check */1411+    rootKey = await deriveRootKeyFromDerivedKey(key, slot);1412+    if (!rootKey) {1413+      lock();1414+      return false;16251415     }16261416   }16271417 @@ -1686,15 +1476,10 @@16861476     await loadSettings();16871477     touchAutoLock();16881478 1689-    // PCH-01-009: the biometric path skips Argon2id but must still rehydrate the1690-    // root key, exactly like attemptUnlockWithDerive and restoreFromSession.1691-    // Without it, rootKey stays null after a biometric unlock and sync +1692-    // GET_RECOVERY_WORDS report the open vault as locked. Guarded and non-fatal:1693-    // a missing/legacy escrow must not fail the unlock itself.1694-    if (stored.recovery_salt && stored.recovery_wrapped_root_key) {1695-      try {1696-        rootKey = await deriveRootKeyFromDerivedKey(masterKeyBytes, stored);1697-      } catch { /* non-fatal — unlock still succeeds without rootKey */ }1479+    rootKey = await deriveRootKeyFromDerivedKey(masterKeyBytes, stored);1480+    if (!rootKey) {1481+      lock();1482+      return { ok: false, error: "invalid_key" };16981483     }16991484     return { ok: true, entries };17001485   } catch {@@ -1711,7 +1496,6 @@17111496  */17121497 export async function exportDuressSlotForAdoption(): Promise<string | null> {17131498   if (!(await isDuressEnabled())) return null;1714-  await ensureMigrated();17151499   const slotB = await loadSlot(SLOT_B);17161500   if (!slotB) return null;17171501   return JSON.stringify(slotB);@@ -1850,8 +1634,8 @@18501634  * other's entries after either side rotates its master password (SEV-2-B).18511635  *18521636  * Returns null rather than throwing so sync callers degrade to VAULT_LOCKED1853- * instead of crashing; rootKey is populated on every real-mode unlock via1854- * deriveRootKeyFromDerivedKey / migrateToRecovery.1637+ * instead of crashing; rootKey is populated on every supported real-mode1638+ * unlock via deriveRootKeyFromDerivedKey.18551639  */18561640 export function getRootKeyHex(): string | null {18571641   return rootKey ? hex(rootKey) : null;@@ -2021,10 +1805,8 @@20211805   const createdAt = typeof entry.createdAt === "number" ? entry.createdAt : now;20221806   const modifiedAt = typeof entry.modifiedAt === "number" ? entry.modifiedAt : createdAt;20231807 2024-  // normalizeEntry whitelists every known VaultEntry field and runs the2025-  // same legacy-passkey migration as the on-disk read path — pre-v2.11.02026-  // backups with flat passkey fields still import correctly because the2027-  // legacy flat fields are themselves whitelisted VaultEntry members.1808+  // normalizeEntry whitelists every known VaultEntry field before the entry1809+  // reaches the live vault.20281810   const normalized = normalizeEntry({20291811     ...entry,20301812     id,@@ -2631,8 +2413,8 @@26312413 ): Promise<void> {26322414   if (!derivedKey) throw new Error("vault_locked");26332415 2634-  // Reconcile direct soft-delete callers (clear/deduplicate and legacy2635-  // migration) while restoring the previous map if storage rejects the save.2416+  // Reconcile direct soft-delete callers while restoring the previous map if2417+  // storage rejects the save.26362418   const previousTombstones = tombstones;26372419   tombstones = new Map(tombstones);26382420   reconcileTombstones();@@ -2667,11 +2449,7 @@26672449 26682450 function sanitizeEntryDraft(entry: EntryDraft): EntryDraft {26692451   const title = entry.title.trim();2670-  // Accept legacy `type:"passkey"` drafts but rewrite to "login" — the new2671-  // model is "any entry, optionally with a passkey sub-object." Imports and2672-  // any in-flight callers from before v2.11.0 keep working without throwing.2673-  let type: VaultEntry["type"] = entry.type ?? "login";2674-  if (type === "passkey") type = "login";2452+  const type: VaultEntry["type"] = entry.type ?? "login";26752453 26762454   if (!title) throw new Error("title is required");26772455 @@ -2791,8 +2569,7 @@27912569   }27922570 27932571   if ("passkey" in patch) {2794-    // Passkey sub-object replaces all the legacy flat passkey fields. A2795-    // patch with `passkey: undefined` removes the credential from the entry2572+    // A patch with `passkey: undefined` removes the credential from the entry27962573     // (used by "remove passkey" without deleting the whole entry).27972574     if (patch.passkey === undefined || patch.passkey === null) {27982575       nextPatch.passkey = undefined;@@ -2837,17 +2614,13 @@28372614   return nextPatch;28382615 }28392616 2840-function normalizeEntry(entry: VaultEntry | LegacyVaultEntry): VaultEntry {2841-  const createdAt = "createdAt" in entry ? entry.createdAt : entry.created;2842-  const modifiedAt =2843-    "modifiedAt" in entry ? entry.modifiedAt : entry.updated;2844-2617+function normalizeEntry(entry: VaultEntry): VaultEntry {28452618   const base: VaultEntry = {28462619     id: entry.id,2847-    type: "type" in entry ? entry.type : "login",2620+    type: entry.type,28482621     title: entry.title,28492622     username: entry.username,2850-    email: "email" in entry ? entry.email : undefined,2623+    email: entry.email,28512624     password: entry.password,28522625     url: entry.url,28532626     additionalUrls:@@ -2873,12 +2646,12 @@28732646       "passwordHistory" in entry && Array.isArray(entry.passwordHistory)28742647         ? entry.passwordHistory28752648         : undefined,2876-    canary: "canary" in entry ? entry.canary : undefined,2877-    passkey: "passkey" in entry ? entry.passkey : undefined,2878-    createdAt,2879-    modifiedAt,2649+    canary: entry.canary,2650+    passkey: entry.passkey,2651+    createdAt: entry.createdAt,2652+    modifiedAt: entry.modifiedAt,28802653     deletedAt: entry.deletedAt,2881-    tags: "tags" in entry ? entry.tags : undefined,2654+    tags: entry.tags,28822655     cardholderName: "cardholderName" in entry ? entry.cardholderName : undefined,28832656     cardNumber: "cardNumber" in entry ? entry.cardNumber : undefined,28842657     expMonth: "expMonth" in entry ? entry.expMonth : undefined,@@ -2889,58 +2662,6 @@28892662     last4: "last4" in entry ? entry.last4 : undefined,28902663   };28912664 2892-  return migrateLegacyPasskey(base, entry);2893-}2894-2895-/**2896- * v2.11.0 read migration. Pre-v2.11.0 passkey entries used `type:"passkey"`2897- * with flat top-level fields (rpId, credentialId, etc.). This converts them2898- * to the new shape — `type:"login"` with a `passkey` sub-object — so all2899- * downstream consumers can rely on the new model. The result is rewritten2900- * to disk on next vault save (hasLegacyShape detects the un-migrated case).2901- */2902-function migrateLegacyPasskey(2903-  base: VaultEntry,2904-  raw: VaultEntry | LegacyVaultEntry2905-): VaultEntry {2906-  if (base.passkey) return base;2907-  const flat = raw as Partial<VaultEntry>;2908-  const isPasskeyType = base.type === "passkey";2909-  const hasFlatPasskeyFields =2910-    typeof flat.rpId === "string" &&2911-    typeof flat.credentialId === "string" &&2912-    typeof flat.publicKeyCose === "string" &&2913-    typeof flat.userHandle === "string" &&2914-    typeof flat.userName === "string";2915-  if (!isPasskeyType && !hasFlatPasskeyFields) return base;2916-  if (!hasFlatPasskeyFields) return base;2917-2918-  const algorithm: -7 | -8 = flat.algorithm === -8 ? -8 : -7;2919-  base.passkey = {2920-    rpId: flat.rpId!,2921-    rpName: flat.rpName ?? flat.rpId!,2922-    credentialId: flat.credentialId!,2923-    publicKeyCose: flat.publicKeyCose!,2924-    privateKeyJwk: flat.privateKeyJwk,2925-    userHandle: flat.userHandle!,2926-    userName: flat.userName!,2927-    userDisplayName: flat.userDisplayName ?? flat.userName!,2928-    algorithm,2929-    signCount: flat.signCount ?? 0,2930-    aaguid: flat.aaguid ?? "",2931-    backupEligible: flat.backupEligible === true,2932-    backupState: flat.backupState === true,2933-    lastUsedAt: flat.lastUsedAt,2934-    browser: flat.browser,2935-    transports: flat.transports,2936-    createdAt: base.createdAt,2937-  };2938-  // Promote to "login" so the unified Entry view renders. Username gets2939-  // populated from the passkey's userName so the entry is searchable in the2940-  // existing autofill flow without a separate code path.2941-  if (isPasskeyType) base.type = "login";2942-  if (!base.username) base.username = flat.userName;2943-  if (!base.url) base.url = `https://${flat.rpId}`;29442665   return base;29452666 }29462667 @@ -3192,7 +2913,7 @@31922913  * CONSEQUENCE THE UI MUST SURFACE: the 12 recovery words also derive from31932914  * the root key, so rotation INVALIDATES the old recovery phrase. The flow31942915  * sets peach_recovery_pending so the popup re-presents the new words for3195- * confirmation, same as the migrateToRecovery rotate path.2916+ * confirmation, same as the initial recovery-word confirmation path.31962917  */31972918 export async function rotateSyncIdentity(): Promise<{ ok: boolean; error?: string }> {31982919   if (!derivedKey || vaultMode !== "real") {

@@ -1,6 +1,6 @@11 import { describe, expect, it } from "vitest";22 3-import { deriveKey, deriveKeyRaw, generateSalt } from "./argon2";3+import { deriveKey, generateSalt } from "./argon2";44 55 // Same glyph "café" decomposed (e + U+0301) and composed (U+00E9). Both are66 // derived from one base literal via normalize(), so the stored byte form of the@@ -39,20 +39,6 @@3939     const salt = generateSalt();4040     expect(CAFE_NFC).not.toBe(CAFE_NFD);4141     expect(await deriveKey(CAFE_NFC, salt)).toEqual(await deriveKey(CAFE_NFD, salt));42-  });43-44-  it("LV-1: deriveKeyRaw does NOT normalize (composed vs decomposed differ)", async () => {45-    const salt = generateSalt();46-    expect(await deriveKeyRaw(CAFE_NFC, salt)).not.toEqual(47-      await deriveKeyRaw(CAFE_NFD, salt),48-    );49-  });50-51-  it("LV-1: ASCII passwords are unaffected — deriveKey equals deriveKeyRaw", async () => {52-    const salt = generateSalt();53-    expect(await deriveKey("correct-pass-12345", salt)).toEqual(54-      await deriveKeyRaw("correct-pass-12345", salt),55-    );5642   });5743 5844   it("generateSalt returns 16 bytes", () => {

@@ -32,18 +32,6 @@3232   return argon2idDerive(password.normalize("NFC"), salt);3333 }3434 35-/**36- * LV-1 legacy fallback ONLY: derive WITHOUT normalization, for unlocking a37- * vault sealed before NFC normalization existed with a non-NFC password.38- * Every normal path uses {@link deriveKey}. Do not use this elsewhere.39- */40-export async function deriveKeyRaw(41-  password: string,42-  salt: Uint8Array43-): Promise<Uint8Array> {44-  return argon2idDerive(password, salt);45-}46-4735 // Per-vault salt: 16 bytes from the OS CSPRNG. A fresh salt is generated at4836 // vault creation and on every changePassword. Prevents cross-user4937 // precomputation attacks against the same master passphrase.

@@ -36,7 +36,7 @@3636 //     console.log(Buffer.from(h).toString("hex"));3737 3838 import { describe, expect, it } from "vitest";39-import { deriveKey, deriveKeyRaw } from "./argon2";39+import { deriveKey } from "./argon2";4040 4141 // ---------------------------------------------------------------------------4242 // KAT vector@@ -120,19 +120,4 @@120120     expect(keyComposed).toEqual(keyDecomposed);121121   });122122 123-  // T-019f: deriveKeyRaw (legacy LV-1 fallback) does NOT apply NFC normalization.124-  // The raw path is used only to unlock pre-LV-1 vaults. It must produce a125-  // different key from deriveKey for NFD inputs.126-  it("T-019f: deriveKeyRaw and deriveKey differ for NFD passwords (raw skips NFC)", async () => {127-    const salt = new Uint8Array(16).fill(0x66);128-    const nfdPassword = "café"; // NFD form — NFC would normalize to U+00E9129-    if (nfdPassword === nfdPassword.normalize("NFC")) {130-      // If the runtime auto-normalizes string literals, this test can't131-      // distinguish the two paths. Skip rather than silently pass.132-      return;133-    }134-    const keyNormalized = await deriveKey(nfdPassword, salt);135-    const keyRaw = await deriveKeyRaw(nfdPassword, salt);136-    expect(keyNormalized).not.toEqual(keyRaw);137-  });138123 });

@@ -60,19 +60,22 @@6060     id: crypto.randomUUID(),6161     type: "passkey",6262     title: "github passkey",63-    rpId: "github.com",64-    rpName: "GitHub",65-    credentialId: "abc123",66-    publicKeyCose: "a401020326...",67-    privateKeyJwk: { kty: "EC", crv: "P-256", x: "x", y: "y", d: "d" },68-    userHandle: "user-handle",69-    userName: "june",70-    userDisplayName: "June",71-    algorithm: -7,72-    signCount: 5,73-    aaguid: "AAAAAAAAAAAAAAAAAAAAAA",74-    backupEligible: true,75-    backupState: false,63+    passkey: {64+      rpId: "github.com",65+      rpName: "GitHub",66+      credentialId: "abc123",67+      publicKeyCose: "a401020326...",68+      privateKeyJwk: { kty: "EC", crv: "P-256", x: "x", y: "y", d: "d" },69+      userHandle: "user-handle",70+      userName: "june",71+      userDisplayName: "June",72+      algorithm: -7,73+      signCount: 5,74+      aaguid: "AAAAAAAAAAAAAAAAAAAAAA",75+      backupEligible: true,76+      backupState: false,77+      createdAt: 1700000000000,78+    },7679     createdAt: 1700000000000,7780     modifiedAt: 1700000000000,7881     ...over,@@ -152,12 +155,12 @@152155 153156     const gotPk = out.entries.find((e) => e.id === passkey.id)!;154157     expect(gotPk.type).toBe("passkey");155-    expect(gotPk.rpId).toBe("github.com");156-    expect(gotPk.privateKeyJwk).toEqual(passkey.privateKeyJwk);157-    expect(gotPk.algorithm).toBe(-7);158-    expect(gotPk.signCount).toBe(5);159-    expect(gotPk.backupEligible).toBe(true);160-    expect(gotPk.backupState).toBe(false);158+    expect(gotPk.passkey?.rpId).toBe("github.com");159+    expect(gotPk.passkey?.privateKeyJwk).toEqual(passkey.passkey?.privateKeyJwk);160+    expect(gotPk.passkey?.algorithm).toBe(-7);161+    expect(gotPk.passkey?.signCount).toBe(5);162+    expect(gotPk.passkey?.backupEligible).toBe(true);163+    expect(gotPk.passkey?.backupState).toBe(false);161164   });162165 163166   test("passkey-bearing login entry round-trips ALL login fields (SEV-1-B)", async () => {@@ -211,11 +214,9 @@211214     expect(got.passwordChangedAt).toBe(entry.passwordChangedAt);212215     expect(got.breach).toBe(2);213216     expect(got.password).toBe(entry.password);214-    // The passkey credential still round-trips (decoded as the flat legacy215-    // shape; vault import re-nests it into the passkey sub-object).216-    expect(got.credentialId).toBe("dGVzdC1pZA");217-    expect(got.signCount).toBe(42);218-    expect(got.privateKeyJwk).toEqual(entry.passkey!.privateKeyJwk);217+    expect(got.passkey?.credentialId).toBe("dGVzdC1pZA");218+    expect(got.passkey?.signCount).toBe(42);219+    expect(got.passkey?.privateKeyJwk).toEqual(entry.passkey!.privateKeyJwk);219220   });220221 221222   test("string table deduplicates shared domains", async () => {@@ -421,18 +422,6 @@421422       settings: {},422423       passphrase: NFC_PASS,423424     });424-    const out = await parsePayload(env, NFD_PASS);425-    expect(out.entries[0].title).toBe("github");426-  });427-428-  test("legacy_raw_fallback_opens_old_backup", async () => {429-    // Mint a pre-fix export sealed under the RAW (un-normalized) NFD bytes via430-    // the test seam, then confirm post-fix parsePayload opens it through the431-    // raw fallback (normalized key fails, raw key succeeds).432-    const env = await buildPayload(433-      { entries: [loginEntry()], settings: {}, passphrase: NFD_PASS },434-      { raw: true },435-    );436425     const out = await parsePayload(env, NFD_PASS);437426     expect(out.entries[0].title).toBe("github");438427   });