delete all CJK code: 9 crypto modules + tests, CJKImport view, all UI references in App/Lock/Import/Settings, CSS rules, and stale comments; rename peach-cjk-qr-card to peach-passkey-card; bump 2.7.0

@@ -1,108 +0,0 @@1-/**2- * CJK encode/decode vectors (spec §10.1).3- */4-5-import { describe, expect, it } from "vitest";6-7-import {8-  ALPHABET_END,9-  ALPHABET_SIZE,10-  ALPHABET_START,11-  cjkDecode,12-  cjkEncode,13-  isValidPhraseCharset,14-  remainingBits,15-} from "./cjk";16-17-describe("cjkEncode", () => {18-  it("encodes 0x00 to U+4E00 (first character of the alphabet)", () => {19-    // 0x00 = 8 bits, padded left into a 14-bit slot → index 020-    expect(cjkEncode(new Uint8Array([0x00]))).toBe("\u4E00");21-  });22-23-  it("encodes 0xFF to U+8DC0 (verified programmatically)", () => {24-    // 0xFF = 8 bits = 11111111; left-padded to 14 = 11111111_000000 = 0x3FC025-    // 0x4E00 + 0x3FC0 = 0x8DC0. Spec's Vector 1 second line cites U+6A3F,26-    // which is incorrect — this test asserts the real value.27-    expect(cjkEncode(new Uint8Array([0xFF]))).toBe("\u8DC0");28-  });29-30-  it("encodes 0xAB 0xCD to [U+78F3, U+5E00]", () => {31-    // 0xAB=10101011, 0xCD=11001101 → 1010101111001101 (16 bits)32-    // First 14 bits → 0x2AF3; first char = 0x4E00 + 0x2AF3 = 0x78F333-    // Remaining 2 bits = 01, left-padded → 0x1000; second = 0x4E00 + 0x1000 = 0x5E0034-    expect(cjkEncode(new Uint8Array([0xAB, 0xCD]))).toBe("\u78F3\u5E00");35-  });36-37-  it("produces only characters within the 16384-entry alphabet", () => {38-    const bytes = new Uint8Array(256);39-    for (let i = 0; i < 256; i++) bytes[i] = i;40-    const encoded = cjkEncode(bytes);41-    for (const ch of encoded) {42-      const cp = ch.codePointAt(0)!;43-      expect(cp).toBeGreaterThanOrEqual(ALPHABET_START);44-      expect(cp).toBeLessThanOrEqual(ALPHABET_END);45-    }46-  });47-});48-49-describe("cjkEncode / cjkDecode round-trip", () => {50-  it("round-trips every single-byte value", () => {51-    for (let b = 0; b <= 255; b++) {52-      const original = new Uint8Array([b]);53-      const encoded = cjkEncode(original);54-      const decoded = cjkDecode(encoded, remainingBits(1));55-      expect(decoded).toEqual(original);56-    }57-  });58-59-  it("round-trips random buffers of length 1..200", () => {60-    for (let len = 1; len <= 200; len++) {61-      const original = new Uint8Array(len);62-      crypto.getRandomValues(original);63-      const encoded = cjkEncode(original);64-      const rb = remainingBits(len);65-      const decoded = cjkDecode(encoded, rb);66-      expect(decoded).toEqual(original);67-    }68-  });69-});70-71-describe("remainingBits", () => {72-  it("returns zero when bytes * 8 is a multiple of 14", () => {73-    // 7 bytes = 56 bits = 4 chars exactly74-    expect(remainingBits(7)).toBe(0);75-    // 14 bytes = 112 bits = 8 chars exactly76-    expect(remainingBits(14)).toBe(0);77-  });78-79-  it("returns the non-zero remainder otherwise", () => {80-    expect(remainingBits(1)).toBe(8);81-    expect(remainingBits(2)).toBe(2);82-    expect(remainingBits(3)).toBe(10);83-  });84-});85-86-describe("isValidPhraseCharset", () => {87-  it("accepts the alphabet bounds", () => {88-    expect(isValidPhraseCharset("\u4E00")).toBe(true);89-    expect(isValidPhraseCharset("\u8DFF")).toBe(true);90-  });91-92-  it("rejects characters just outside the alphabet", () => {93-    expect(isValidPhraseCharset("\u4DFF")).toBe(false); // one below start94-    expect(isValidPhraseCharset("\u8E00")).toBe(false); // one above end95-  });96-97-  it("rejects non-CJK characters", () => {98-    expect(isValidPhraseCharset("a")).toBe(false);99-    expect(isValidPhraseCharset("一二 三")).toBe(false); // contains space100-  });101-});102-103-describe("alphabet constants", () => {104-  it("has 16,384 entries so each character packs exactly 14 bits", () => {105-    expect(ALPHABET_SIZE).toBe(2 ** 14);106-    expect(ALPHABET_END - ALPHABET_START + 1).toBe(ALPHABET_SIZE);107-  });108-});

@@ -1,173 +0,0 @@1-/**2- * CJK Phrase Encoding3- * -------------------4- *5- * Packs arbitrary binary data into a sequence of CJK Unified Ideographs.6- *7- * Each character encodes exactly 14 bits. The alphabet is the first 16,3848- * code points starting at U+4E00 (一), ending at U+8DFF. This is a fixed9- * power-of-two subset chosen for maximum font coverage across desktop and10- * mobile operating systems.11- *12- * Power-of-two alignment (2^14 = 16,384) means there is no modulo bias, no13- * padding at the character level, and `codepoint = ALPHABET_START + index`14- * is a direct arithmetic mapping — no lookup table required.15- *16- * NOTE ON SPEC DEVIATION: The implementation spec cites ALPHABET_END as17- * U+87FF, which is inconsistent with ALPHABET_SIZE = 16384 (U+4E00 + 1638418- * lands at U+8DFF, not U+87FF). The power-of-two invariant is load-bearing,19- * so this file treats U+8DFF as the correct upper bound. See the project20- * summary note for details.21- */22-23-export const ALPHABET_START = 0x4e00;24-export const ALPHABET_SIZE = 16384; // 2^14 — every character packs exactly 14 bits25-export const ALPHABET_END = ALPHABET_START + ALPHABET_SIZE - 1; // 0x8DFF26-27-/**28- * Number of meaningful bits in the final CJK character of an encoding.29- * `totalBits = byteCount * 8`. If that is an exact multiple of 14 the last30- * character is fully used and this returns 0. Otherwise it returns the31- * remainder in the range 1..13.32- */33-export function remainingBits(byteCount: number): number {34-  const r = (byteCount * 8) % 14;35-  return r;36-}37-38-/**39- * Encode a byte array into a CJK phrase string.40- *41- * Bytes are fed into a bit accumulator 8 bits at a time. Whenever the42- * accumulator holds at least 14 bits, the top 14 are extracted and emitted43- * as one character. Any leftover bits at the end become the most significant44- * bits of one final character, with the low bits zero-padded. The decoder45- * uses `remainingBits` to discard that padding.46- */47-export function cjkEncode(bytes: Uint8Array): string {48-  let bits = 0; // number of meaningful bits currently in the accumulator49-  let buffer = 0; // bit accumulator — at peak can hold up to 21 bits50-  const out: string[] = [];51-52-  for (let i = 0; i < bytes.length; i++) {53-    buffer = (buffer << 8) | bytes[i];54-    bits += 8;55-56-    while (bits >= 14) {57-      bits -= 14;58-      const index = (buffer >>> bits) & 0x3fff;59-      out.push(String.fromCodePoint(ALPHABET_START + index));60-    }61-  }62-63-  if (bits > 0) {64-    // Leftover 1..13 bits: left-align into a 14-bit slot (zero-pad low bits)65-    const index = (buffer << (14 - bits)) & 0x3fff;66-    out.push(String.fromCodePoint(ALPHABET_START + index));67-  }68-69-  return out.join("");70-}71-72-/**73- * Decode a CJK phrase string back into bytes. `remainingBitsValue` must be74- * the value computed by `remainingBits(originalByteLength)` at encode time,75- * and is stored in the binary header at §2.1.76- *77- * Throws on any character outside the 16,384-entry alphabet, or if the78- * phrase length is inconsistent with `remainingBitsValue`.79- */80-export function cjkDecode(phrase: string, remainingBitsValue: number): Uint8Array {81-  let bits = 0;82-  let buffer = 0;83-  const out: number[] = [];84-85-  // Spread handles surrogate pairs safely — every CJK ideograph in our86-  // alphabet fits in a single BMP code unit but we spread defensively.87-  const chars = [...phrase];88-  const lastIdx = chars.length - 1;89-90-  for (let i = 0; i < chars.length; i++) {91-    const cp = chars[i].codePointAt(0)!;92-    const index = cp - ALPHABET_START;93-94-    if (index < 0 || index >= ALPHABET_SIZE) {95-      throw new Error(96-        `INVALID_CHARACTER: U+${cp.toString(16).toUpperCase().padStart(4, "0")} at position ${i}`97-      );98-    }99-100-    const isLast = i === lastIdx;101-    const bitsInThisChar = isLast && remainingBitsValue > 0 ? remainingBitsValue : 14;102-103-    // The encoder left-aligned partial bits into the 14-bit slot; undo that104-    // by right-shifting to discard the zero-padding on the last character.105-    const value =106-      isLast && remainingBitsValue > 0 ? index >>> (14 - remainingBitsValue) : index;107-108-    buffer = (buffer << bitsInThisChar) | value;109-    bits += bitsInThisChar;110-111-    while (bits >= 8) {112-      bits -= 8;113-      out.push((buffer >>> bits) & 0xff);114-    }115-  }116-117-  if (bits !== 0) {118-    throw new Error("DECODE_ALIGNMENT_ERROR: residual bits after full decode");119-  }120-121-  return new Uint8Array(out);122-}123-124-/**125- * True if every code point in `phrase` is within the 16,384-entry alphabet.126- * Used by the paste-validator before attempting a full decode.127- */128-export function isValidPhraseCharset(phrase: string): boolean {129-  for (const ch of phrase) {130-    const cp = ch.codePointAt(0)!;131-    if (cp < ALPHABET_START || cp > ALPHABET_END) return false;132-  }133-  return true;134-}135-136-/**137- * Decode the first `charCount` characters of a phrase assuming they all use138- * the full 14 bits (remaining_bits = 0), and return whatever bytes fully139- * accumulated. Residual sub-byte bits are discarded — this is the bootstrap140- * path used by the import pipeline to read the binary header before the141- * true `remaining_bits` value is available.142- *143- * Throws on any character outside the alphabet. Unlike `cjkDecode` this does144- * NOT enforce that the accumulator lands on an 8-bit boundary, because the145- * caller is slicing out of the middle of a longer phrase.146- */147-export function cjkDecodeBootstrap(phrase: string, charCount: number): Uint8Array {148-  let bits = 0;149-  let buffer = 0;150-  const out: number[] = [];151-152-  const chars = [...phrase];153-  const n = Math.min(charCount, chars.length);154-155-  for (let i = 0; i < n; i++) {156-    const cp = chars[i].codePointAt(0)!;157-    const index = cp - ALPHABET_START;158-    if (index < 0 || index >= ALPHABET_SIZE) {159-      throw new Error(160-        `INVALID_CHARACTER: U+${cp.toString(16).toUpperCase().padStart(4, "0")} at position ${i}`161-      );162-    }163-    buffer = (buffer << 14) | index;164-    bits += 14;165-166-    while (bits >= 8) {167-      bits -= 8;168-      out.push((buffer >>> bits) & 0xff);169-    }170-  }171-172-  return new Uint8Array(out);173-}

@@ -1,234 +0,0 @@1-/**2- * Export pipeline for a CJK phrase backup (spec §4.1, §5).3- *4- * The 12 steps defined in the spec must execute in order. Each one has a5- * reason the next one depends on. `exportToCJK` is the public entry point;6- * the sub-helpers are exported for direct use by the test vectors.7- */8-9-import { argon2id } from "hash-wasm";10-11-import { cjkEncode } from "./cjk";12-import {13-  buildHeader,14-  finalisePayload,15-  NONCE_LEN,16-  PAYLOAD_FLAGS,17-  PAYLOAD_VERSION,18-  remainingBitsForCiphertextLen,19-  SALT_LEN,20-  type HeaderFields,21-} from "./cjkPayload";22-import { serialiseVault } from "./cjkSerialise";23-import { compressZstd } from "./zstd";24-import type { PeachLicenseExport, VaultEntry } from "../shared/types";25-import type { VaultSettings } from "../background/vault";26-27-// ---------------------------------------------------------------------------28-// Argon2id parameter sets29-// ---------------------------------------------------------------------------30-31-export interface Argon2Params {32-  memoryKiB: number;33-  iterations: number;34-  parallelism: number;35-}36-37-/** Default set — ~1 second on modern hardware. */38-export const ARGON2_DEFAULT: Argon2Params = {39-  memoryKiB: 65536,40-  iterations: 3,41-  parallelism: 4,42-};43-44-/** High-security set — ~3 seconds, 256 MB memory. */45-export const ARGON2_HIGH_SECURITY: Argon2Params = {46-  memoryKiB: 262144,47-  iterations: 4,48-  parallelism: 4,49-};50-51-// ---------------------------------------------------------------------------52-// Low-level helpers used by both the export pipeline and the test vectors53-// ---------------------------------------------------------------------------54-55-export async function deriveKdfKey(56-  passphrase: string,57-  salt: Uint8Array,58-  params: Argon2Params59-): Promise<Uint8Array> {60-  return argon2id({61-    password: passphrase,62-    salt,63-    parallelism: params.parallelism,64-    iterations: params.iterations,65-    memorySize: params.memoryKiB,66-    hashLength: 32,67-    outputType: "binary",68-  });69-}70-71-export async function encryptBinary(72-  key: Uint8Array,73-  nonce: Uint8Array,74-  plaintext: Uint8Array75-): Promise<{ ciphertext: Uint8Array; authTag: Uint8Array }> {76-  const cryptoKey = await crypto.subtle.importKey(77-    "raw",78-    key.buffer.slice(key.byteOffset, key.byteOffset + key.byteLength) as ArrayBuffer,79-    { name: "AES-GCM" },80-    false,81-    ["encrypt"]82-  );83-84-  // AES-GCM with no AAD (spec §4.1 Step 6 — the header version byte is85-  // protected by the BLAKE3 checksum, not by AEAD-AAD binding).86-  const combined = await crypto.subtle.encrypt(87-    { name: "AES-GCM", iv: nonce.buffer as ArrayBuffer, tagLength: 128 },88-    cryptoKey,89-    plaintext.buffer.slice(90-      plaintext.byteOffset,91-      plaintext.byteOffset + plaintext.byteLength92-    ) as ArrayBuffer93-  );94-95-  const combinedBytes = new Uint8Array(combined);96-  const ciphertext = combinedBytes.slice(0, combinedBytes.length - 16);97-  const authTag = combinedBytes.slice(combinedBytes.length - 16);98-  return { ciphertext, authTag };99-}100-101-// ---------------------------------------------------------------------------102-// Phrase formatting103-// ---------------------------------------------------------------------------104-105-const LINE_WIDTH = 60;106-107-function buildHeaderLine(entryCount: number): string {108-  return `peach:v${PAYLOAD_VERSION}:entries=${entryCount}:zstd:aes256gcm:argon2id`;109-}110-111-function countsByType(entries: VaultEntry[]): {112-  logins: number;113-  notes: number;114-  passkeys: number;115-} {116-  let logins = 0;117-  let notes = 0;118-  let passkeys = 0;119-  for (const e of entries) {120-    if (e.type === "passkey") passkeys += 1;121-    else if (e.type === "note") notes += 1;122-    else logins += 1;123-  }124-  return { logins, notes, passkeys };125-}126-127-export function formatPhrase(cjkChars: string, entryCount: number): string {128-  const lines: string[] = [buildHeaderLine(entryCount)];129-  for (let i = 0; i < cjkChars.length; i += LINE_WIDTH) {130-    lines.push(cjkChars.slice(i, i + LINE_WIDTH));131-  }132-  return lines.join("\n");133-}134-135-// ---------------------------------------------------------------------------136-// Top-level export137-// ---------------------------------------------------------------------------138-139-export interface ExportInput {140-  entries: VaultEntry[];141-  settings?: VaultSettings;142-  license?: PeachLicenseExport;143-  passphrase: string;144-  argon2?: Argon2Params;145-}146-147-export interface ExportResult {148-  phrase: string;149-  /** Total entries in the export, including trashed. */150-  entryCount: number;151-  cjkCharCount: number;152-  /** Active (non-trashed) login count. */153-  loginCount: number;154-  /** Active (non-trashed) note count. */155-  noteCount: number;156-  /** Active (non-trashed) passkey count. */157-  passkeyCount: number;158-  /** Entries with deletedAt set — land back in trash on import. */159-  trashedCount: number;160-  /** The raw binary that `cjkEncode` processed (checksum appended). Useful for tests. */161-  binary: Uint8Array;162-}163-164-/**165- * Run the full export pipeline end-to-end. Includes all entries — active166- * and trashed — so a restore is a complete, lossless round-trip. Trashed167- * entries arrive back in trash (deletedAt preserved). `settings` is168- * round-tripped verbatim so a restore carries theme, auto-lock, etc.169- */170-export async function exportToCJK(input: ExportInput): Promise<ExportResult> {171-  const params = input.argon2 ?? ARGON2_DEFAULT;172-173-  const allEntries = input.entries;174-  const activeEntries = allEntries.filter((e) => !e.deletedAt);175-  const { logins, notes, passkeys } = countsByType(activeEntries);176-  const trashedCount = allEntries.length - activeEntries.length;177-178-  const serialised = serialiseVault(allEntries, input.settings ?? {}, input.license);179-180-  // Step 3: compress181-  const compressed = await compressZstd(serialised, 19);182-183-  // Step 4: fresh salt and nonce — independent of the at-rest vault184-  const salt = crypto.getRandomValues(new Uint8Array(SALT_LEN));185-  const nonce = crypto.getRandomValues(new Uint8Array(NONCE_LEN));186-187-  // Step 5: derive key188-  const key = await deriveKdfKey(input.passphrase, salt, params);189-  try {190-    // Step 6: encrypt (no AAD)191-    const { ciphertext, authTag } = await encryptBinary(key, nonce, compressed);192-193-    // Step 10 (resolved): remaining_bits derives from the final byte count194-    const remainingBitsValue = remainingBitsForCiphertextLen(ciphertext.length);195-196-    // Step 7: assemble header197-    const headerFields: HeaderFields = {198-      entryCount: allEntries.length,199-      argon2Memory: params.memoryKiB,200-      argon2Time: params.iterations,201-      argon2Parallel: params.parallelism,202-      salt,203-      remainingBitsValue,204-    };205-    const header = buildHeader(headerFields);206-207-    // Step 8+9: finalise (concat + BLAKE3 checksum append)208-    const binary = await finalisePayload(header, nonce, ciphertext, authTag);209-210-    // Step 11: encode211-    const cjkChars = cjkEncode(binary);212-213-    // Step 12: format214-    const phrase = formatPhrase(cjkChars, allEntries.length);215-216-    return {217-      phrase,218-      entryCount: allEntries.length,219-      cjkCharCount: [...cjkChars].length,220-      loginCount: logins,221-      noteCount: notes,222-      passkeyCount: passkeys,223-      trashedCount,224-      binary,225-    };226-  } finally {227-    // Zero the derived key promptly. The underlying Uint8Array was produced228-    // by hash-wasm and is not referenced anywhere else after encryptBinary.229-    key.fill(0);230-  }231-}232-233-// Re-export flag constants callers may want for assertions234-export { PAYLOAD_FLAGS, PAYLOAD_VERSION };

@@ -1,385 +0,0 @@1-/**2- * Import pipeline for a CJK phrase backup (spec §4.2, §9).3- *4- * The order matters for security and UX both:5- *6- *   1. Parse and validate the ASCII header line.7- *   2. Strip header + whitespace to get pure CJK content.8- *   3. Bootstrap-decode the first 18 chars (= 31 bytes, exactly the header9- *      length) so we can read `remaining_bits` before doing the full decode.10- *   4. Full `cjkDecode` with the correct remaining_bits.11- *   5. `extractFields` — layout validation, version/flags check.12- *   6. BLAKE3 checksum verify. If this fails, stop BEFORE prompting for a13- *      passphrase: a corrupt phrase is never worth asking the user to type14- *      their master phrase for.15- *   7. Argon2id key derivation using the parameters stored in the header.16- *   8. AES-256-GCM decrypt. AEAD failure is surfaced as DECRYPT_FAILED.17- *   9. zstd decompress.18- *  10. `deserialiseVault` — the entry count from the binary header drives19- *      the loop. Afterwards we cross-check against the ASCII header line's20- *      `entries=N` value (spec §4.2 Step 10).21- *22- * Every error path uses the exact error codes listed in §9 so the UI layer23- * (§8) can map them to the prescribed user-facing copy.24- */25-26-import { cjkDecode, cjkDecodeBootstrap, isValidPhraseCharset } from "./cjk";27-import {28-  AUTH_TAG_LEN,29-  CHECKSUM_LEN,30-  computeBlake3,31-  concatBytes,32-  constantTimeEqual,33-  extractFields,34-  HEADER_LEN,35-  MIN_PAYLOAD_LEN,36-  NONCE_LEN,37-  PAYLOAD_VERSION,38-  type ExtractedFields,39-} from "./cjkPayload";40-import { deriveKdfKey, type Argon2Params } from "./cjkExport";41-import { deserialiseVault, type VaultBackupPayload } from "./cjkSerialise";42-import { decompressZstd } from "./zstd";43-import type { VaultEntry } from "../shared/types";44-import type { VaultSettings } from "../background/vault";45-46-// ---------------------------------------------------------------------------47-// Bounds on the Argon2 parameters we'll accept from a header. A malicious or48-// corrupt phrase could advertise "400 GB of memory, 1 billion iterations" and49-// hang the browser before the user could cancel. The ceilings here are above50-// the spec's ARGON2_HIGH_SECURITY set (256 MB / 4 iter / 4 lanes) with51-// headroom for future tuning.52-// ---------------------------------------------------------------------------53-54-const ARGON2_MAX_MEMORY_KIB = 1024 * 1024; // 1 GB55-const ARGON2_MAX_ITERATIONS = 32;56-const ARGON2_MAX_PARALLELISM = 16;57-const ARGON2_MIN_MEMORY_KIB = 1024; // 1 MB floor to reject nonsense low values58-const ARGON2_MIN_ITERATIONS = 1;59-const ARGON2_MIN_PARALLELISM = 1;60-61-// Bootstrap: 18 CJK chars × 14 bits = 252 bits = 31 full bytes + 4 residual62-// bits. 31 is exactly HEADER_LEN, so the bootstrap yields the complete header63-// without needing any special handling for the residual bits (they're64-// discarded by cjkDecodeBootstrap because it doesn't enforce alignment).65-const BOOTSTRAP_CHAR_COUNT = 18;66-67-// ---------------------------------------------------------------------------68-// Public types69-// ---------------------------------------------------------------------------70-71-export interface ParsedHeaderLine {72-  version: number;73-  entryCount: number;74-}75-76-export interface ImportResult {77-  entries: VaultEntry[];78-  settings: VaultSettings;79-  /** License key from the backup, if the backup was a Pro export. */80-  licenseKey?: string;81-  /** Activation timestamp from the backup license, if present. */82-  licenseActivatedAt?: number;83-  /** The entry count advertised by the ASCII header line. */84-  announcedEntryCount: number;85-  /** The entry count recorded in the binary header. */86-  binaryEntryCount: number;87-}88-89-// ---------------------------------------------------------------------------90-// Step 1: ASCII header line91-// ---------------------------------------------------------------------------92-93-const HEADER_LINE_RE =94-  /^peach:v(\d+):entries=(\d+):zstd:aes256gcm:argon2id$/;95-96-/**97- * Parse the first line of a phrase. Returns { version, entryCount }.98- *99- * Throws INVALID_HEADER for anything unparseable — including wrong cipher100- * tags, wrong KDF tag, non-numeric entry count, or a version number whose101- * format is right but whose value we don't support.102- */103-export function parseHeaderLine(line: string): ParsedHeaderLine {104-  const m = HEADER_LINE_RE.exec(line.trim());105-  if (!m) {106-    throw new Error("INVALID_HEADER");107-  }108-  const version = Number.parseInt(m[1], 10);109-  const entryCount = Number.parseInt(m[2], 10);110-  if (!Number.isFinite(version) || !Number.isFinite(entryCount)) {111-    throw new Error("INVALID_HEADER");112-  }113-  return { version, entryCount };114-}115-116-/**117- * Split a pasted phrase into its ASCII header line and its pure CJK content118- * (newlines and any other whitespace stripped from the body). Any empty119- * lines after the header are tolerated — common copy/paste artefacts.120- */121-export function splitPhrase(phrase: string): {122-  headerLine: string;123-  cjkContent: string;124-} {125-  const firstNewline = phrase.indexOf("\n");126-  if (firstNewline === -1) {127-    throw new Error("INVALID_HEADER");128-  }129-  const headerLine = phrase.slice(0, firstNewline).replace(/\r$/, "");130-  const body = phrase.slice(firstNewline + 1);131-  // Strip ALL whitespace from the body — spaces, tabs, CR, LF. The encoder132-  // emits 60-char lines joined with "\n" but we don't rely on that here.133-  const cjkContent = body.replace(/\s+/g, "");134-  return { headerLine, cjkContent };135-}136-137-/**138- * Fast pre-flight used by the paste-validator in §8.3. Verifies the header139- * line parses AND every body character is within the CJK alphabet. Returns140- * true/false instead of throwing so the UI can show a green/red dot live141- * as the user pastes.142- */143-export function validatePhraseStructure(phrase: string): boolean {144-  try {145-    const { headerLine, cjkContent } = splitPhrase(phrase);146-    const parsed = parseHeaderLine(headerLine);147-    if (parsed.version !== PAYLOAD_VERSION) return false;148-    if (cjkContent.length === 0) return false;149-    return isValidPhraseCharset(cjkContent);150-  } catch {151-    return false;152-  }153-}154-155-// ---------------------------------------------------------------------------156-// Steps 2–5: phrase → binary → extracted fields157-// ---------------------------------------------------------------------------158-159-/**160- * Decode a CJK phrase body to its raw binary payload. Two-pass:161- *   pass A: bootstrap-decode 18 chars to read remaining_bits from the header162- *   pass B: full decode with the correct remaining_bits163- *164- * Separated from `extractFields` so the UI can run a cheap structural check165- * before the (slower) alignment-enforcing full decode.166- */167-export function decodePhraseToBytes(cjkContent: string): Uint8Array {168-  if (cjkContent.length < BOOTSTRAP_CHAR_COUNT) {169-    throw new Error("PAYLOAD_TOO_SHORT");170-  }171-172-  // Pass A: get the first 31 bytes — exactly the header.173-  const headerBytes = cjkDecodeBootstrap(cjkContent, BOOTSTRAP_CHAR_COUNT);174-  if (headerBytes.length < HEADER_LEN) {175-    // Impossible in practice — 18 chars give 31 full bytes — but guard for176-    // the `cjkDecodeBootstrap` contract in case the caller changes it.177-    throw new Error("PAYLOAD_TOO_SHORT");178-  }179-180-  // Version gate before full decode. Catching UNSUPPORTED_VERSION here lets181-  // us avoid burning a full-decode pass on a phrase we'd reject anyway.182-  const version = headerBytes[0];183-  if (version !== PAYLOAD_VERSION) {184-    throw new Error(`UNSUPPORTED_VERSION: ${version}`);185-  }186-187-  // remaining_bits lives at offset 13 (u16 LE).188-  const view = new DataView(189-    headerBytes.buffer,190-    headerBytes.byteOffset,191-    headerBytes.byteLength192-  );193-  const remainingBitsValue = view.getUint16(13, true);194-  if (remainingBitsValue > 13) {195-    // Valid values are 0..13 (remainder of totalBits % 14). Anything else196-    // means the header is garbage.197-    throw new Error("INVALID_HEADER");198-  }199-200-  // Pass B: full decode. cjkDecode enforces the 8-bit alignment invariant.201-  return cjkDecode(cjkContent, remainingBitsValue);202-}203-204-/**205- * Verify the BLAKE3 checksum appended to the binary payload. Uses206- * constant-time equality to avoid leaking how many leading bytes matched.207- * This runs BEFORE the passphrase prompt so a corrupt or truncated phrase208- * fails fast — spec §4.2 Step 4.209- */210-export async function verifyIntegrity(binary: Uint8Array): Promise<ExtractedFields> {211-  if (binary.length < MIN_PAYLOAD_LEN) {212-    throw new Error("PAYLOAD_TOO_SHORT");213-  }214-  const fields = extractFields(binary);215-  const computed = await computeBlake3(fields.payloadForChecksum);216-  if (!constantTimeEqual(computed, fields.storedChecksum)) {217-    throw new Error("CHECKSUM_FAILED");218-  }219-  return fields;220-}221-222-// ---------------------------------------------------------------------------223-// Steps 6–10: decrypt, decompress, deserialise224-// ---------------------------------------------------------------------------225-226-function argon2ParamsFromFields(fields: ExtractedFields): Argon2Params {227-  const memoryKiB = fields.argon2Memory;228-  const iterations = fields.argon2Time;229-  const parallelism = fields.argon2Parallel;230-231-  if (232-    memoryKiB < ARGON2_MIN_MEMORY_KIB ||233-    memoryKiB > ARGON2_MAX_MEMORY_KIB ||234-    iterations < ARGON2_MIN_ITERATIONS ||235-    iterations > ARGON2_MAX_ITERATIONS ||236-    parallelism < ARGON2_MIN_PARALLELISM ||237-    parallelism > ARGON2_MAX_PARALLELISM238-  ) {239-    throw new Error("INVALID_HEADER");240-  }241-242-  return { memoryKiB, iterations, parallelism };243-}244-245-async function decryptBinary(246-  key: Uint8Array,247-  nonce: Uint8Array,248-  ciphertext: Uint8Array,249-  authTag: Uint8Array250-): Promise<Uint8Array> {251-  const cryptoKey = await crypto.subtle.importKey(252-    "raw",253-    key.buffer.slice(key.byteOffset, key.byteOffset + key.byteLength) as ArrayBuffer,254-    { name: "AES-GCM" },255-    false,256-    ["decrypt"]257-  );258-259-  // WebCrypto wants ciphertext || authTag as a single buffer.260-  const combined = concatBytes([ciphertext, authTag]);261-262-  try {263-    const plaintext = await crypto.subtle.decrypt(264-      {265-        name: "AES-GCM",266-        iv: nonce.buffer.slice(267-          nonce.byteOffset,268-          nonce.byteOffset + nonce.byteLength269-        ) as ArrayBuffer,270-        tagLength: 128,271-      },272-      cryptoKey,273-      combined.buffer.slice(274-        combined.byteOffset,275-        combined.byteOffset + combined.byteLength276-      ) as ArrayBuffer277-    );278-    return new Uint8Array(plaintext);279-  } catch {280-    // WebCrypto surfaces AEAD failure as a plain OperationError with no281-    // distinguishing info. Per spec §9 we normalise all AEAD failures to a282-    // single DECRYPT_FAILED code — do not leak more than that.283-    throw new Error("DECRYPT_FAILED");284-  }285-}286-287-/**288- * Decrypt + decompress + deserialise. Takes the already-verified header289- * extraction so callers can't accidentally skip the checksum step. The290- * derived key is zeroed in a `finally` block regardless of success.291- * Returns the full backup payload — entries AND settings.292- */293-export async function decryptAndDeserialise(294-  fields: ExtractedFields,295-  passphrase: string296-): Promise<VaultBackupPayload> {297-  const params = argon2ParamsFromFields(fields);298-  const key = await deriveKdfKey(passphrase, fields.salt, params);299-  try {300-    const compressed = await decryptBinary(301-      key,302-      fields.nonce,303-      fields.ciphertext,304-      fields.authTag305-    );306-307-    let serialised: Uint8Array;308-    try {309-      serialised = await decompressZstd(compressed);310-    } catch {311-      // A corrupt zstd frame after a successful AEAD tag check means the312-      // key was right but the plaintext is damaged. Exceedingly unlikely313-      // given AES-GCM's integrity guarantees, but if it happens we treat314-      // it as a decrypt failure rather than a silent empty vault.315-      throw new Error("DECRYPT_FAILED");316-    }317-318-    return deserialiseVault(serialised);319-  } finally {320-    key.fill(0);321-  }322-}323-324-// ---------------------------------------------------------------------------325-// Top-level orchestration326-// ---------------------------------------------------------------------------327-328-/**329- * Run the full import pipeline end-to-end. This is the convenience entry330- * point for tests and for callers that already have the passphrase in hand.331- *332- * For the real UI flow, prefer composing `decodePhraseToBytes` +333- * `verifyIntegrity` up front (to detect corruption before prompting the334- * user for a passphrase), then calling `decryptAndDeserialise` after the335- * prompt. The structural enforcement comes from the type signature: you336- * must hold an `ExtractedFields` to call the second step, and the only337- * way to get one is via `verifyIntegrity`.338- */339-export async function importFromCJK(340-  phrase: string,341-  passphrase: string342-): Promise<ImportResult> {343-  const { headerLine, cjkContent } = splitPhrase(phrase);344-  const parsed = parseHeaderLine(headerLine);345-346-  if (parsed.version !== PAYLOAD_VERSION) {347-    throw new Error(`UNSUPPORTED_VERSION: ${parsed.version}`);348-  }349-350-  const binary = decodePhraseToBytes(cjkContent);351-  const fields = await verifyIntegrity(binary);352-353-  // Cross-check: the ASCII header's entry count must match the binary354-  // header's. A mismatch means the phrase was edited across layers —355-  // someone swapped the CJK body but left the ASCII header, or vice versa.356-  if (parsed.entryCount !== fields.entryCount) {357-    throw new Error("HEADER_COUNT_MISMATCH");358-  }359-360-  const payload = await decryptAndDeserialise(fields, passphrase);361-362-  // Final cross-check (spec §4.2 Step 10): the JSON entry count must match363-  // the binary header's entry_count. A mismatch means someone edited one364-  // layer without the other.365-  if (payload.entries.length !== fields.entryCount) {366-    throw new Error("ENTRY_COUNT_MISMATCH");367-  }368-369-  return {370-    entries: payload.entries,371-    settings: payload.settings,372-    ...(payload.license?.key ? { licenseKey: payload.license.key, licenseActivatedAt: payload.license.activatedAt } : {}),373-    announcedEntryCount: parsed.entryCount,374-    binaryEntryCount: fields.entryCount,375-  };376-}377-378-// Re-export types and utilities the UI layer needs379-export {380-  AUTH_TAG_LEN,381-  CHECKSUM_LEN,382-  HEADER_LEN,383-  MIN_PAYLOAD_LEN,384-  NONCE_LEN,385-};

@@ -1,174 +0,0 @@1-/**2- * Binary payload assembly and extraction (spec §2, §10.2).3- */4-5-import { describe, expect, it } from "vitest";6-7-import {8-  AUTH_TAG_LEN,9-  buildHeader,10-  CHECKSUM_LEN,11-  computeBlake3,12-  concatBytes,13-  constantTimeEqual,14-  extractFields,15-  finalisePayload,16-  HEADER_LEN,17-  MIN_PAYLOAD_LEN,18-  NONCE_LEN,19-  PAYLOAD_FLAGS,20-  PAYLOAD_VERSION,21-  remainingBitsForCiphertextLen,22-  SALT_LEN,23-  type HeaderFields,24-} from "./cjkPayload";25-26-function makeFields(overrides: Partial<HeaderFields> = {}): HeaderFields {27-  return {28-    entryCount: 1,29-    argon2Memory: 65536,30-    argon2Time: 3,31-    argon2Parallel: 4,32-    salt: new Uint8Array(SALT_LEN).fill(0x42),33-    remainingBitsValue: 0,34-    ...overrides,35-  };36-}37-38-describe("buildHeader", () => {39-  it("writes the exact byte layout from §2.1", () => {40-    const ciphertextLen = 128;41-    const rb = remainingBitsForCiphertextLen(ciphertextLen);42-43-    const header = buildHeader(44-      makeFields({ remainingBitsValue: rb, entryCount: 1 })45-    );46-47-    expect(header.length).toBe(HEADER_LEN);48-    const view = new DataView(49-      header.buffer,50-      header.byteOffset,51-      header.byteLength52-    );53-54-    expect(header[0]).toBe(PAYLOAD_VERSION);55-    expect(view.getUint16(1, true)).toBe(1); // entry_count56-    expect(header[3]).toBe(PAYLOAD_FLAGS);57-    expect(view.getUint32(4, true)).toBe(65536); // argon2_memory58-    expect(view.getUint32(8, true)).toBe(3); // argon2_time59-    expect(header[12]).toBe(4); // argon2_parallel60-    expect(view.getUint16(13, true)).toBe(rb);61-    for (let i = 0; i < SALT_LEN; i++) {62-      expect(header[15 + i]).toBe(0x42);63-    }64-  });65-66-  it("rejects wrongly-sized salts", () => {67-    expect(() =>68-      buildHeader(makeFields({ salt: new Uint8Array(8) }))69-    ).toThrow(/SALT_LEN/);70-  });71-72-  it("rejects entryCounts that overflow uint16", () => {73-    expect(() =>74-      buildHeader(makeFields({ entryCount: 70000 }))75-    ).toThrow(/uint16/);76-  });77-});78-79-describe("finalisePayload + extractFields round-trip", () => {80-  it("assembles header|nonce|ct|tag|checksum and extracts each field", async () => {81-    const ciphertext = new Uint8Array(64);82-    crypto.getRandomValues(ciphertext);83-    const authTag = new Uint8Array(AUTH_TAG_LEN).fill(0xAA);84-    const nonce = new Uint8Array(NONCE_LEN).fill(0x13);85-    const rb = remainingBitsForCiphertextLen(ciphertext.length);86-87-    const header = buildHeader(88-      makeFields({ entryCount: 2, remainingBitsValue: rb })89-    );90-91-    const full = await finalisePayload(header, nonce, ciphertext, authTag);92-93-    // Length sanity94-    expect(full.length).toBe(95-      HEADER_LEN + NONCE_LEN + ciphertext.length + AUTH_TAG_LEN + CHECKSUM_LEN96-    );97-98-    const extracted = extractFields(full);99-100-    expect(extracted.entryCount).toBe(2);101-    expect(extracted.argon2Memory).toBe(65536);102-    expect(extracted.argon2Time).toBe(3);103-    expect(extracted.argon2Parallel).toBe(4);104-    expect(extracted.remainingBitsValue).toBe(rb);105-    expect(extracted.salt).toEqual(new Uint8Array(SALT_LEN).fill(0x42));106-    expect(extracted.nonce).toEqual(nonce);107-    expect(extracted.ciphertext).toEqual(ciphertext);108-    expect(extracted.authTag).toEqual(authTag);109-110-    // Stored checksum must match a fresh BLAKE3 over the payload-minus-checksum111-    const recomputed = await computeBlake3(extracted.payloadForChecksum);112-    expect(constantTimeEqual(recomputed, extracted.storedChecksum)).toBe(true);113-  });114-115-  it("rejects a truncated payload", () => {116-    const tiny = new Uint8Array(MIN_PAYLOAD_LEN - 1);117-    expect(() => extractFields(tiny)).toThrow(/PAYLOAD_TOO_SHORT/);118-  });119-120-  it("rejects an unsupported version byte", async () => {121-    const ciphertext = new Uint8Array(16);122-    const authTag = new Uint8Array(AUTH_TAG_LEN);123-    const nonce = new Uint8Array(NONCE_LEN);124-    const rb = remainingBitsForCiphertextLen(ciphertext.length);125-    const header = buildHeader(makeFields({ remainingBitsValue: rb }));126-127-    const full = await finalisePayload(header, nonce, ciphertext, authTag);128-    full[0] = 0x99; // corrupt version byte129-    expect(() => extractFields(full)).toThrow(/UNSUPPORTED_VERSION/);130-  });131-132-  it("rejects unsupported flags", async () => {133-    const ciphertext = new Uint8Array(16);134-    const authTag = new Uint8Array(AUTH_TAG_LEN);135-    const nonce = new Uint8Array(NONCE_LEN);136-    const rb = remainingBitsForCiphertextLen(ciphertext.length);137-    const header = buildHeader(makeFields({ remainingBitsValue: rb }));138-139-    const full = await finalisePayload(header, nonce, ciphertext, authTag);140-    full[3] = 0x05; // corrupt flags byte141-    expect(() => extractFields(full)).toThrow(/UNSUPPORTED_FLAGS/);142-  });143-});144-145-describe("constantTimeEqual", () => {146-  it("returns true for identical buffers", () => {147-    const a = new Uint8Array([1, 2, 3, 4]);148-    const b = new Uint8Array([1, 2, 3, 4]);149-    expect(constantTimeEqual(a, b)).toBe(true);150-  });151-152-  it("returns false when any byte differs", () => {153-    const a = new Uint8Array([1, 2, 3, 4]);154-    const b = new Uint8Array([1, 2, 3, 5]);155-    expect(constantTimeEqual(a, b)).toBe(false);156-  });157-158-  it("returns false for different lengths", () => {159-    expect(160-      constantTimeEqual(new Uint8Array([1, 2]), new Uint8Array([1, 2, 3]))161-    ).toBe(false);162-  });163-});164-165-describe("concatBytes", () => {166-  it("concatenates in order", () => {167-    const out = concatBytes([168-      new Uint8Array([1, 2]),169-      new Uint8Array([3]),170-      new Uint8Array([4, 5, 6]),171-    ]);172-    expect(out).toEqual(new Uint8Array([1, 2, 3, 4, 5, 6]));173-  });174-});