[theodosiskats]

Summary

• Rebased onto current dev. The pull request was 92 commits behind, and the old branch could not merge.
• Safari signs in through the Mac app, because Safari cannot finish https://authenticator.cc/oauth itself. The client id and secret in credentials.ts stay empty. Dropbox and OneDrive stay hidden on Safari.
• The Argon2id vault-key rewrite from the first version of this branch is not included. Current dev already stores keys differently, and that old wrap does not fit it.

Test plan

• npm run safari compiles on current dev.
• Sign-in still fails until the release script fills the Drive client id and secret.
• A signed Mac build still has to catch the callback. This repository does not include that app.

[brunnojob]

The Safari migration treats any local-storage key as proof that credentials already exist locally. A normal sync user already has local.UserSettings: UserSettings.commitItems() stores the local-only settings (including storageLocation) there even when credential storage is Sync.

For that normal state, localKeys.length > 0 marks safariStorageMigrated: true and returns without copying the sync entries. getStorageLocation() then changes storageLocation to Local unconditionally. The existing OTP entries remain in sync storage while subsequent account reads use local storage, so the user sees an empty vault, and the completion flag prevents a retry.

I ran the exact migrateSyncToLocal() body with in-memory Chrome storage stubs:

• input local keys: ['UserSettings'], with storageLocation: 'sync';
• input sync keys: ['entry1'], a fake OTP fixture;
• result local keys: ['UserSettings', 'safariStorageMigrated'];
• result sync keys: ['entry1'], with no local credential copy and the completion flag set to true.

Please distinguish local settings/metadata from actual vault entries, copy and verify the intended credential data before switching the active store, and cover this existing-sync-user state in a regression test. Preserve the local-only settings when reconciling the two stores.

Validation: isolated JavaScript execution of this head's migration body, with only its TypeScript method signature removed; no real vault or Safari profile was accessed. Head: dd6a4c9e696b9b3a4988e44d94e6a416034d75a1. Prepared with AI assistance.