- validateEntry no longer requires encryptedPassword; only title is required
(schema.js). encryptedPassword documented as optional.
- EntryForm: decrypt-guards empty password on edit; stores empty string (no
encryption) when the password field is blank; label is 'Password' (no *).
- EntryDetail: only renders the Password field when the entry has one;
decrypt guards empty.
- Tests: schema validation updated (password optional); 143 total pass.
- exportSelected(groupIds, { vaultKey, password, useExistingPassword }) replaces the
positional (groupIds, vaultKey, exportPassword) form. Protection is now an explicit
choice, never an ambiguous optional field.
- password mode: re-key entries under a fresh export-derived key (unchanged semantics).
- reuseExistingPassword mode: seal with the vault's own key, keep vault salt embedded,
so import derives the key from the vault master password. No second password required.
- ImportExport.svelte: replaces the long-placeholder free-text field with two radio
options (Use a new password / Reuse my vault password); short placeholder, with
client-side validation that a new password isn't empty.
- Cryptography importAll unchanged: derives the envelope key from the supplied password +
embedded salt, which covers both sealed modes; wrong password still rejects import.
- Tests: updated call sites to options object; added round-trip + wrong-password tests for
reuseExistingPassword.
