# OpenSpec Change: enterprise-password-formats

- **Change ID**: enterprise-password-formats
- **Package**: `@suaveplan/password-formats`
- **Category**: universal
- **Target path**: `universal/auth/password-formats`
- **Status**: PROPOSED
- **Date**: 2026-04-19
- **Reference spec**: `/mnt/s/web/suaveplan/enterprise/password-formats.md`

## Summary
Universal import/export layer for common password-manager export formats — Apple Passwords CSV, Bitwarden JSON, Chrome CSV, KeePass XML, LastPass CSV, 1Password `.1pux` archive and CSV. Produces a normalised `PasswordEntry[]` plus reverse CSV export.

## Current-state audit (genesis)
Package does not exist yet — fresh build.

## Dependencies
- Workspace: none (leaf)
- External (via catalog): `zod`, `papaparse`, `fast-xml-parser`, `fflate` → appropriate catalogs; `tslib`; `@opentelemetry/api`
- Dev (via catalog): `vitest`, `@vitest/coverage-istanbul`, `fast-check`, `mitata`

## Preserved public surface
- `detect(input): PasswordFormat` — sniff format from filename/content
- `parse(input, format?): Promise<PasswordEntry[]>` — unified parse entry point
- `validate(entries): ValidationResult` — structural validation
- `exportToCsv(entries): string`
- Format-specific parsers: `parseApplePasswordsCsv`, `parseBitwardenJson`, `parseChromeCsv`, `parseKeePassXml`, `parseLastPassCsv`, `parseOnePassword1Pux`, `parseOnePasswordCsv`
- Types: `PasswordEntry`, `PasswordFormat`, `ValidationResult`, `ParseOptions`

## New genesis additions
- Codes: `PASSWORD_FORMATS.UNKNOWN_FORMAT`, `PASSWORD_FORMATS.PARSE_ERROR`, `PASSWORD_FORMATS.VALIDATION_FAILED`, `PASSWORD_FORMATS.ENCRYPTED_INPUT`.
- Zod schema for `PasswordEntry` (+ per-format raw-row schemas).
- OTel histogram `password_formats.parse.duration_ms{format}`; counter `password_formats.entries.total{format}`.
- Property tests: CSV round-trip (`parse(exportToCsv(entries))` ≈ `entries` after normalisation).

## Impact
- Adds one new package: `universal/auth/password-formats`
- Adds one new spec capability: `password-formats`