dsh-vault 1.4.0-rc.8 → 1.4.0

package/README-zh.md

@@ -61,7 +61,6 @@ dsh-vault 是一个面向 DeepSeek Harness 的安全加密插件：把你在使
 | `vault_health` | 保险库健康扫描：弱密码/复用凭据、未启用 2FA、不安全的 http:// 站点,以及整体安全评分（0–100） |
 | `vault_breach_check` | Watchtower 风格泄露扫描：对接 Have I Been Pwned（k-anonymity,仅发送 SHA-1 前缀）,附离线常见密码兜底 |
 | `vault_integrity` | 校验磁盘上的保险库文件可正确解密并与内存中的 store 一致 |
-| `vault_integrity` | 校验磁盘上的保险库文件可正确解密并与内存中的 store 一致 |
 | `vault_merge` | 合并一个条目到另一个；`keepSource: true` 保留源条目 |
 | `vault_quick_add` | 快速录入（标题 + 一个密钥），支持 tags/notes |
 | `vault_expiry` | 设置/清除过期（`expiresAt: 0` 移除） |
@@ -73,7 +72,14 @@ dsh-vault 是一个面向 DeepSeek Harness 的安全加密插件：把你在使
 | `vault_fill` | 按 host/URL/用户名/标题匹配条目并返回其凭据 |
 | `vault_env` | 把标记 env 的条目（tags 含 `env`）渲染为 `KEY=VALUE` 行 |
 | `vault_export_bitwarden` / `vault_import_bitwarden` | Bitwarden/Vaultwarden JSON 互通（完整字段映射,支持覆盖） |
-| `vault_import_chrome` / `vault_import_keychain` | 从 Chrome Login Data（经 macOS 钥匙串密钥解密）或 macOS 钥匙串导入密码（会话缓存 + 预览,避免授权弹窗轰炸） |
+| `vault_import_bitwarden_encrypted` | 解密 Bitwarden 口令保护 JSON 导出（PBKDF2/Argon2id + HKDF → AES-256-CBC + HMAC）并导入,需提供导出口令 |
+| `vault_import_manager_csv` | 密码管理器 CSV 自动识别表头：Bitwarden（login_uri/login_username/…）、1Password 8、Dashlane、NordPass、Keeper、LastPass（fav/grouping/extra）；支持 dryRun 预览 |
+| `vault_import_kdbx` | KeePass KDBX：3.1 与 4.x、AES-KDF 或 Argon2（RFC 9106）、AES-256-CBC 或 ChaCha20 载荷、支持 keyfile |
+| `vault_import_1password` / `vault_import_1pif` | 1Password 1PUX（ZIP）与旧版 1PIF 文本导出 |
+| `vault_import_enpass` | Enpass JSON 导出（文件夹→标签、类型化字段、TOTP） |
+| `vault_import_keepass_xml` | KeePass 2.x XML 导出（明文或 ****** 掩码值） |
+| `vault_import_chrome` / `vault_import_keychain` | 从 Chrome Login Data（macOS 钥匙串 / Linux 钥匙环或 peanuts / Windows DPAPI）或 macOS 钥匙串导入密码（会话缓存 + 预览,避免授权弹窗轰炸）；所有文件导入均支持 dryRun 预览 |
+| `vault_import_firefox` | Firefox 配置导入（logins.json + key4.db,NSS 3DES / PBES2-AES,支持主密码） |
 | `vault_search_system` | 在 Chrome / 钥匙串中搜索站点与用户名——绝不暴露密码 |
 | `vault_copy` | 复制条目（含密钥）到另一个命名保险库 |
 | `vault_templates` | 内建 + 用户自定义模板（save/list/remove,KeePassXC 风格） |

package/README.md

@@ -63,7 +63,6 @@ Each record has a `title`, an optional `kind`, and any combination of fields:
 | `vault_health` | Vault health scan: weak/reused passwords, missing 2FA, insecure http:// sites, and an overall security score (0–100) |
 | `vault_breach_check` | Watchtower-style breach scan against Have I Been Pwned (k-anonymity: only the SHA-1 prefix leaves the machine), with an offline common-password fallback |
 | `vault_integrity` | Verify the on-disk vault file decrypts correctly and matches the in-memory store |
-| `vault_integrity` | Verify the on-disk vault file decrypts correctly and matches the in-memory store |
 | `vault_merge` | Merge one entry into another; `keepSource: true` keeps the source after merging |
 | `vault_quick_add` | Fast capture (title + one secret) with optional tags/notes |
 | `vault_expiry` | Set/clear expiry (`expiresAt: 0` removes it) |
@@ -75,7 +74,14 @@ Each record has a `title`, an optional `kind`, and any combination of fields:
 | `vault_fill` | Find the entry matching a host/URL/username/title and return its credentials |
 | `vault_env` | Render env-flagged entries (tags contain `env`) as `KEY=VALUE` lines |
 | `vault_export_bitwarden` / `vault_import_bitwarden` | Bitwarden/Vaultwarden JSON interop (full field mapping, overwrite support) |
-| `vault_import_chrome` / `vault_import_keychain` | Import passwords from Chrome's Login Data (decrypted via the macOS keychain key) or the macOS Keychain (session cache + preview, no prompt spam) |
+| `vault_import_bitwarden_encrypted` | Decrypt a Bitwarden password-protected JSON export (PBKDF2/Argon2id + HKDF → AES-256-CBC + HMAC) and import it; pass the export passphrase |
+| `vault_import_manager_csv` | Password-manager CSV auto-detected by header: Bitwarden (`login_uri`/`login_username`/…), 1Password 8, Dashlane, NordPass, Keeper, LastPass (`fav`/`grouping`/`extra`); dryRun preview |
+| `vault_import_kdbx` | KeePass KDBX: 3.1 and 4.x, AES-KDF or Argon2 (RFC 9106), AES-256-CBC or ChaCha20 payload, keyfile support |
+| `vault_import_1password` / `vault_import_1pif` | 1Password 1PUX (ZIP) and legacy 1PIF text exports |
+| `vault_import_enpass` | Enpass JSON export (folders → tags, typed fields, TOTP) |
+| `vault_import_keepass_xml` | KeePass 2.x XML export (plaintext or `********` masked values) |
+| `vault_import_chrome` / `vault_import_keychain` | Import passwords from Chrome's Login Data (macOS keychain / Linux keyring or `peanuts` / Windows DPAPI) or the macOS Keychain (session cache + preview, no prompt spam); every file import supports `dryRun` preview |
+| `vault_import_firefox` | Firefox profile import (logins.json + key4.db, NSS 3DES / PBES2-AES, primary-password aware) |
 | `vault_search_system` | Search Chrome / Keychain for sites & usernames — never exposes passwords |
 | `vault_copy` | Copy an entry (secrets included) into another named vault |
 | `vault_templates` | Built-in + user-defined templates (save/list/remove), KeePassXC-style |

package/lib/client.js

@@ -17,89 +17,89 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag);
 		}
 		var VaultSection_module_css_default = {
-			"toolbar": "t_j5va_toolbar",
-			"status": "t_j5va_status",
-			"genOptRow": "t_j5va_genOptRow",
-			"editorActions": "t_j5va_editorActions",
-			"lockedBanner": "t_j5va_lockedBanner",
-			"badgeWarn": "t_j5va_badgeWarn",
-			"reportBox": "t_j5va_reportBox",
+			"checkField": "t_j5va_checkField",
+			"tab": "t_j5va_tab",
 			"detailBox": "t_j5va_detailBox",
-			"editorBody": "t_j5va_editorBody",
-			"resultCount": "t_j5va_resultCount",
-			"tabPane": "t_j5va_tabPane",
-			"rowActions": "t_j5va_rowActions",
-			"srOnly": "t_j5va_srOnly",
-			"highBadge": "t_j5va_highBadge",
-			"auditIssues": "t_j5va_auditIssues",
-			"policyBar": "t_j5va_policyBar",
-			"dupGroup": "t_j5va_dupGroup",
-			"kindChip": "t_j5va_kindChip",
-			"addButton": "t_j5va_addButton",
-			"saveButton": "t_j5va_saveButton",
-			"row": "t_j5va_row",
+			"pwBar": "t_j5va_pwBar",
 			"genHist": "t_j5va_genHist",
-			"sortButton": "t_j5va_sortButton",
-			"backupButton": "t_j5va_backupButton",
+			"policyBar": "t_j5va_policyBar",
+			"retryButton": "t_j5va_retryButton",
 			"genOpts": "t_j5va_genOpts",
-			"tab": "t_j5va_tab",
-			"pinStar": "t_j5va_pinStar",
-			"section": "t_j5va_section",
-			"rowMain": "t_j5va_rowMain",
-			"badgeOk": "t_j5va_badgeOk",
-			"dangerButton": "t_j5va_dangerButton",
+			"backupButton": "t_j5va_backupButton",
 			"empty": "t_j5va_empty",
-			"pwMeter": "t_j5va_pwMeter",
+			"field": "t_j5va_field",
+			"dupNames": "t_j5va_dupNames",
+			"copied": "t_j5va_copied",
+			"searchBox": "t_j5va_searchBox",
 			"dueBadge": "t_j5va_dueBadge",
-			"title": "t_j5va_title",
-			"emptyHint": "t_j5va_emptyHint",
-			"error": "t_j5va_error",
-			"checkField": "t_j5va_checkField",
-			"modeAuto": "t_j5va_modeAuto",
-			"tabActive": "t_j5va_tabActive",
-			"totp": "t_j5va_totp",
 			"lockedTag": "t_j5va_lockedTag",
-			"pwWeak": "t_j5va_pwWeak",
-			"list": "t_j5va_list",
-			"totpRing": "t_j5va_totpRing",
-			"auditRow": "t_j5va_auditRow",
-			"retryButton": "t_j5va_retryButton",
-			"copied": "t_j5va_copied",
+			"reportLine": "t_j5va_reportLine",
+			"editor": "t_j5va_editor",
+			"reportSub": "t_j5va_reportSub",
+			"detailItem": "t_j5va_detailItem",
 			"modeReadonly": "t_j5va_modeReadonly",
-			"emptyBox": "t_j5va_emptyBox",
-			"searchBox": "t_j5va_searchBox",
-			"dupMerge": "t_j5va_dupMerge",
-			"badgeDanger": "t_j5va_badgeDanger",
-			"footer": "t_j5va_footer",
-			"kindIcon": "t_j5va_kindIcon",
-			"intro": "t_j5va_intro",
+			"badgeOk": "t_j5va_badgeOk",
+			"status": "t_j5va_status",
+			"list": "t_j5va_list",
+			"reportBox": "t_j5va_reportBox",
+			"modeAuto": "t_j5va_modeAuto",
+			"rowMain": "t_j5va_rowMain",
+			"dangerButton": "t_j5va_dangerButton",
+			"sortButton": "t_j5va_sortButton",
+			"emptyHint": "t_j5va_emptyHint",
+			"title": "t_j5va_title",
+			"secretField": "t_j5va_secretField",
+			"pinStar": "t_j5va_pinStar",
+			"pwFair": "t_j5va_pwFair",
 			"pwStrong": "t_j5va_pwStrong",
-			"reportSub": "t_j5va_reportSub",
-			"tabs": "t_j5va_tabs",
+			"uriCode": "t_j5va_uriCode",
+			"emptyBox": "t_j5va_emptyBox",
+			"tabActive": "t_j5va_tabActive",
+			"reportTitle": "t_j5va_reportTitle",
+			"badgeWarn": "t_j5va_badgeWarn",
+			"revealButton": "t_j5va_revealButton",
+			"kindChip": "t_j5va_kindChip",
+			"row": "t_j5va_row",
+			"auditRow": "t_j5va_auditRow",
 			"modeAsk": "t_j5va_modeAsk",
-			"identity": "t_j5va_identity",
-			"editor": "t_j5va_editor",
-			"field": "t_j5va_field",
-			"trashButton": "t_j5va_trashButton",
+			"section": "t_j5va_section",
+			"clearButton": "t_j5va_clearButton",
+			"toolbar": "t_j5va_toolbar",
+			"srOnly": "t_j5va_srOnly",
 			"badge": "t_j5va_badge",
-			"detailItem": "t_j5va_detailItem",
-			"pwLabel": "t_j5va_pwLabel",
-			"healthBar": "t_j5va_healthBar",
-			"dupNames": "t_j5va_dupNames",
-			"policyField": "t_j5va_policyField",
-			"scoreRing": "t_j5va_scoreRing",
-			"pwFair": "t_j5va_pwFair",
 			"rowExpired": "t_j5va_rowExpired",
-			"revealButton": "t_j5va_revealButton",
-			"pwBar": "t_j5va_pwBar",
 			"kindFilter": "t_j5va_kindFilter",
-			"reportLine": "t_j5va_reportLine",
-			"deleteButton": "t_j5va_deleteButton",
-			"secretField": "t_j5va_secretField",
 			"rowDue": "t_j5va_rowDue",
-			"uriCode": "t_j5va_uriCode",
-			"clearButton": "t_j5va_clearButton",
-			"reportTitle": "t_j5va_reportTitle"
+			"tabPane": "t_j5va_tabPane",
+			"kindIcon": "t_j5va_kindIcon",
+			"rowActions": "t_j5va_rowActions",
+			"policyField": "t_j5va_policyField",
+			"deleteButton": "t_j5va_deleteButton",
+			"lockedBanner": "t_j5va_lockedBanner",
+			"auditIssues": "t_j5va_auditIssues",
+			"intro": "t_j5va_intro",
+			"identity": "t_j5va_identity",
+			"totpRing": "t_j5va_totpRing",
+			"editorBody": "t_j5va_editorBody",
+			"footer": "t_j5va_footer",
+			"scoreRing": "t_j5va_scoreRing",
+			"pwLabel": "t_j5va_pwLabel",
+			"badgeDanger": "t_j5va_badgeDanger",
+			"tabs": "t_j5va_tabs",
+			"dupGroup": "t_j5va_dupGroup",
+			"resultCount": "t_j5va_resultCount",
+			"saveButton": "t_j5va_saveButton",
+			"totp": "t_j5va_totp",
+			"dupMerge": "t_j5va_dupMerge",
+			"trashButton": "t_j5va_trashButton",
+			"highBadge": "t_j5va_highBadge",
+			"pwMeter": "t_j5va_pwMeter",
+			"genOptRow": "t_j5va_genOptRow",
+			"editorActions": "t_j5va_editorActions",
+			"pwWeak": "t_j5va_pwWeak",
+			"addButton": "t_j5va_addButton",
+			"healthBar": "t_j5va_healthBar",
+			"error": "t_j5va_error"
 		};
 		//#endregion
 		//#region src/client/VaultSection.tsx
@@ -248,7 +248,7 @@ window.__ModuleLoader__.load({
 		}
 		/** Render the Vault settings section. */
 		function VaultSection(props) {
-			const { t, config, setAccessMode, setAutoCapture, list, search, get, add, update, remove, trash, rotation, health, duplicates, duplicateGroups, merge, history, stats, backupStatus, backup, recent, restore, undeleteAll, totp, status, switchVault, listVaults, touch, verifyAll, breachCheck, generatePassword, strength, generateUsername, templates, saveTemplate, lock, totpUri, tags, renameTag, generatorHistory, backups, restoreBackup, importChrome, importFirefox, import1password, importManagerCsv, importEnpass, importBitwarden, import1pif, importKeePassXml, keychainImport, searchSystem } = props;
+			const { t, config, setAccessMode, setAutoCapture, list, search, get, add, update, remove, trash, rotation, health, duplicates, duplicateGroups, merge, history, stats, backupStatus, backup, recent, restore, undeleteAll, totp, status, switchVault, listVaults, touch, verifyAll, breachCheck, generatePassword, strength, generateUsername, templates, saveTemplate, lock, totpUri, tags, renameTag, generatorHistory, backups, restoreBackup, importChrome, importFirefox, import1password, importManagerCsv, importEnpass, importBitwarden, import1pif, importKeePassXml, importBitwardenEncrypted, keychainImport, searchSystem } = props;
 			const searchId = (0, react.useId)();
 			const [query, setQuery] = (0, react.useState)("");
 			const [state, setState] = (0, react.useState)({ status: "loading" });
@@ -454,6 +454,25 @@ window.__ModuleLoader__.load({
 					setBusy(false);
 				}
 			}
+			/** Preview a file import (dry run) — reports counts without writing. */
+			async function runImportPreview(run) {
+				setBusy(true);
+				setMessage(null);
+				try {
+					const r = await run();
+					setMessage(`${t("previewLabel")} ${r.note}`);
+				} catch {
+					setMessage(t("error"));
+				} finally {
+					setBusy(false);
+				}
+			}
+			/** Preview a file-based import: prompt for the path, then dry-run. */
+			async function runFilePreview(promptKey, run) {
+				const path = window.prompt(t(promptKey));
+				if (path === null || path.trim() === "") return;
+				await runImportPreview(() => run(path.trim()));
+			}
 			/** Import a password-manager CSV file (Dashlane/NordPass/Keeper). */
 			async function runImportManagerCsv() {
 				const path = window.prompt(t("importManagerCsvPrompt"));
@@ -499,6 +518,23 @@ window.__ModuleLoader__.load({
 					setBusy(false);
 				}
 			}
+			/** Import a Bitwarden password-protected JSON export (asks for the export passphrase). */
+			async function runImportBitwardenEncrypted() {
+				const path = window.prompt(t("importBitwardenEncryptedPrompt"));
+				if (path === null || path.trim() === "") return;
+				const password = window.prompt(t("importBitwardenEncryptedPasswordPrompt"));
+				if (password === null) return;
+				setBusy(true);
+				setMessage(null);
+				try {
+					setMessage((await importBitwardenEncrypted(path.trim(), password, false)).note);
+					refresh();
+				} catch {
+					setMessage(t("error"));
+				} finally {
+					setBusy(false);
+				}
+			}
 			/** Import a legacy 1Password 1PIF export. */
 			async function runImport1pif() {
 				const path = window.prompt(t("import1pifPrompt"));
@@ -1417,81 +1453,154 @@ window.__ModuleLoader__.load({
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 									className: VaultSection_module_css_default.dupGroup,
-									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-										className: VaultSection_module_css_default.dupNames,
-										children: t("import1passwordDesc")
-									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-										type: "button",
-										className: VaultSection_module_css_default.dupMerge,
-										onClick: () => void runImport1password(),
-										disabled: busy || readonly || locked,
-										children: t("import1password")
-									})]
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: VaultSection_module_css_default.dupNames,
+											children: t("import1passwordDesc")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											className: VaultSection_module_css_default.dupMerge,
+											onClick: () => void runImport1password(),
+											disabled: busy || readonly || locked,
+											children: t("import1password")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											className: VaultSection_module_css_default.dupMerge,
+											onClick: () => void runFilePreview("import1passwordPrompt", import1password),
+											disabled: busy || readonly || locked,
+											children: t("preview")
+										})
+									]
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 									className: VaultSection_module_css_default.dupGroup,
-									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-										className: VaultSection_module_css_default.dupNames,
-										children: t("importManagerCsvDesc")
-									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-										type: "button",
-										className: VaultSection_module_css_default.dupMerge,
-										onClick: () => void runImportManagerCsv(),
-										disabled: busy || readonly || locked,
-										children: t("importManagerCsv")
-									})]
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: VaultSection_module_css_default.dupNames,
+											children: t("importManagerCsvDesc")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											className: VaultSection_module_css_default.dupMerge,
+											onClick: () => void runImportManagerCsv(),
+											disabled: busy || readonly || locked,
+											children: t("importManagerCsv")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											className: VaultSection_module_css_default.dupMerge,
+											onClick: () => void runFilePreview("importManagerCsvPrompt", importManagerCsv),
+											disabled: busy || readonly || locked,
+											children: t("preview")
+										})
+									]
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 									className: VaultSection_module_css_default.dupGroup,
-									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-										className: VaultSection_module_css_default.dupNames,
-										children: t("importEnpassDesc")
-									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-										type: "button",
-										className: VaultSection_module_css_default.dupMerge,
-										onClick: () => void runImportEnpass(),
-										disabled: busy || readonly || locked,
-										children: t("importEnpass")
-									})]
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: VaultSection_module_css_default.dupNames,
+											children: t("importEnpassDesc")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											className: VaultSection_module_css_default.dupMerge,
+											onClick: () => void runImportEnpass(),
+											disabled: busy || readonly || locked,
+											children: t("importEnpass")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											className: VaultSection_module_css_default.dupMerge,
+											onClick: () => void runFilePreview("importEnpassPrompt", importEnpass),
+											disabled: busy || readonly || locked,
+											children: t("preview")
+										})
+									]
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 									className: VaultSection_module_css_default.dupGroup,
-									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-										className: VaultSection_module_css_default.dupNames,
-										children: t("importBitwardenDesc")
-									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-										type: "button",
-										className: VaultSection_module_css_default.dupMerge,
-										onClick: () => void runImportBitwarden(),
-										disabled: busy || readonly || locked,
-										children: t("importBitwarden")
-									})]
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: VaultSection_module_css_default.dupNames,
+											children: t("importBitwardenDesc")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											className: VaultSection_module_css_default.dupMerge,
+											onClick: () => void runImportBitwarden(),
+											disabled: busy || readonly || locked,
+											children: t("importBitwarden")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											className: VaultSection_module_css_default.dupMerge,
+											onClick: () => void runFilePreview("importBitwardenPrompt", importBitwarden),
+											disabled: busy || readonly || locked,
+											children: t("preview")
+										})
+									]
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 									className: VaultSection_module_css_default.dupGroup,
 									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 										className: VaultSection_module_css_default.dupNames,
-										children: t("import1pifDesc")
+										children: t("importBitwardenEncryptedDesc")
 									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
 										type: "button",
 										className: VaultSection_module_css_default.dupMerge,
-										onClick: () => void runImport1pif(),
+										onClick: () => void runImportBitwardenEncrypted(),
 										disabled: busy || readonly || locked,
-										children: t("import1pif")
+										children: t("importBitwardenEncrypted")
 									})]
 								}),
 								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 									className: VaultSection_module_css_default.dupGroup,
-									children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-										className: VaultSection_module_css_default.dupNames,
-										children: t("importKeePassXmlDesc")
-									}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-										type: "button",
-										className: VaultSection_module_css_default.dupMerge,
-										onClick: () => void runImportKeePassXml(),
-										disabled: busy || readonly || locked,
-										children: t("importKeePassXml")
-									})]
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: VaultSection_module_css_default.dupNames,
+											children: t("import1pifDesc")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											className: VaultSection_module_css_default.dupMerge,
+											onClick: () => void runImport1pif(),
+											disabled: busy || readonly || locked,
+											children: t("import1pif")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											className: VaultSection_module_css_default.dupMerge,
+											onClick: () => void runFilePreview("import1pifPrompt", import1pif),
+											disabled: busy || readonly || locked,
+											children: t("preview")
+										})
+									]
+								}),
+								/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+									className: VaultSection_module_css_default.dupGroup,
+									children: [
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+											className: VaultSection_module_css_default.dupNames,
+											children: t("importKeePassXmlDesc")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											className: VaultSection_module_css_default.dupMerge,
+											onClick: () => void runImportKeePassXml(),
+											disabled: busy || readonly || locked,
+											children: t("importKeePassXml")
+										}),
+										/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+											type: "button",
+											className: VaultSection_module_css_default.dupMerge,
+											onClick: () => void runFilePreview("importKeePassXmlPrompt", importKeePassXml),
+											disabled: busy || readonly || locked,
+											children: t("preview")
+										})
+									]
 								})
 							]
 						})]
@@ -2578,6 +2687,8 @@ window.__ModuleLoader__.load({
 			importKeychain: "Import Keychain",
 			importKeychainDesc: "macOS Keychain (generic passwords)",
 			keychainPreview: "Preview",
+			preview: "Preview",
+			previewLabel: "Preview —",
 			keychainPromptWarn: "Importing from the Keychain may prompt macOS for authorization for each entry. First time: choose \"Always Allow\" to consent once for this process. Continue?",
 			systemSearch: "Search system stores",
 			sysSearchPlaceholder: "Search Chrome / Keychain…",
@@ -2597,6 +2708,10 @@ window.__ModuleLoader__.load({
 			importBitwarden: "Import Bitwarden",
 			importBitwardenDesc: "Bitwarden JSON export (.json)",
 			importBitwardenPrompt: "Path to the Bitwarden .json export:",
+			importBitwardenEncrypted: "Import Bitwarden (encrypted)",
+			importBitwardenEncryptedDesc: "Bitwarden password-protected JSON export (.json)",
+			importBitwardenEncryptedPrompt: "Path to the encrypted Bitwarden .json export:",
+			importBitwardenEncryptedPasswordPrompt: "Export passphrase (the one chosen when creating the encrypted export):",
 			import1pif: "Import 1Password 1PIF",
 			import1pifDesc: "Legacy 1Password 1PIF export (.1pif)",
 			import1pifPrompt: "Path to the .1pif file:",
@@ -2784,6 +2899,8 @@ window.__ModuleLoader__.load({
 			importKeychain: "导入钥匙串",
 			importKeychainDesc: "macOS 钥匙串（通用密码）",
 			keychainPreview: "预览",
+			preview: "预览",
+			previewLabel: "预览 —",
 			keychainPromptWarn: "从钥匙串导入时 macOS 可能为每条凭据弹出授权框。首次请在弹窗中选择“始终允许”一次性授权本进程。是否继续？",
 			systemSearch: "搜索系统凭据库",
 			sysSearchPlaceholder: "搜索 Chrome / 钥匙串…",
@@ -2803,6 +2920,10 @@ window.__ModuleLoader__.load({
 			importBitwarden: "导入 Bitwarden",
 			importBitwardenDesc: "Bitwarden JSON 导出（.json）",
 			importBitwardenPrompt: "请输入 Bitwarden JSON 导出文件路径：",
+			importBitwardenEncrypted: "导入 Bitwarden（加密）",
+			importBitwardenEncryptedDesc: "Bitwarden 加密 JSON 导出（.json）",
+			importBitwardenEncryptedPrompt: "请输入加密 Bitwarden JSON 导出文件路径：",
+			importBitwardenEncryptedPasswordPrompt: "导出口令（创建加密导出时设置的口令）：",
 			import1pif: "导入 1Password 1PIF",
 			import1pifDesc: "旧版 1Password 1PIF 导出（.1pif）",
 			import1pifPrompt: "请输入 .1pif 文件路径：",
@@ -2962,29 +3083,41 @@ window.__ModuleLoader__.load({
 					overwrite: overwrite ?? false
 				}),
 				keychainImport: (options) => invoke("keychainImport", { ...options ?? {} }),
-				import1password: (path, overwrite) => invoke("import1password", {
+				import1password: (path, overwrite, dryRun) => invoke("import1password", {
 					path,
-					overwrite: overwrite ?? false
+					overwrite: overwrite ?? false,
+					dryRun: dryRun ?? false
 				}),
-				importManagerCsv: (path, overwrite) => invoke("importManagerCsv", {
+				importManagerCsv: (path, overwrite, dryRun) => invoke("importManagerCsv", {
 					path,
-					overwrite: overwrite ?? false
+					overwrite: overwrite ?? false,
+					dryRun: dryRun ?? false
 				}),
-				importEnpass: (path, overwrite) => invoke("importEnpass", {
+				importEnpass: (path, overwrite, dryRun) => invoke("importEnpass", {
 					path,
-					overwrite: overwrite ?? false
+					overwrite: overwrite ?? false,
+					dryRun: dryRun ?? false
 				}),
-				importBitwarden: (path, overwrite) => invoke("importBitwarden", {
+				importBitwarden: (path, overwrite, dryRun) => invoke("importBitwarden", {
 					path,
-					overwrite: overwrite ?? false
+					overwrite: overwrite ?? false,
+					dryRun: dryRun ?? false
 				}),
-				import1pif: (path, overwrite) => invoke("import1pif", {
+				import1pif: (path, overwrite, dryRun) => invoke("import1pif", {
 					path,
-					overwrite: overwrite ?? false
+					overwrite: overwrite ?? false,
+					dryRun: dryRun ?? false
 				}),
-				importKeePassXml: (path, overwrite) => invoke("importKeePassXml", {
+				importBitwardenEncrypted: (path, password, overwrite, dryRun) => invoke("importBitwardenEncrypted", {
 					path,
-					overwrite: overwrite ?? false
+					password,
+					overwrite: overwrite ?? false,
+					dryRun: dryRun ?? false
+				}),
+				importKeePassXml: (path, overwrite, dryRun) => invoke("importKeePassXml", {
+					path,
+					overwrite: overwrite ?? false,
+					dryRun: dryRun ?? false
 				}),
 				searchSystem: (query, source, limit) => invoke("searchSystem", {
 					query,