⚠️ IMPORTANT (Correctness): PASSWORD_NOT_FOUND is hardcoded as "Password not found." in this JavaScript wrapper, but the actual error message originates from desktop_core::password functions, propagated through napi::Error::from_reason(e.to_string()) in lib.rs. If desktop_core returns a different error string (e.g., "password not found", "No password found", or a platform-specific message), the comparison e.message === passwords.PASSWORD_NOT_FOUND in both NativeSecureStorageService and ElectronRendererSecureStorageService will never match.

The consequence is that get() will throw an error instead of returning null for missing keys, and remove() will throw instead of silently succeeding. This would break credential lookups for any key not yet stored and could cause startup failures.

Consider one of:

1. Export the constant from the Rust side so the string is defined in one place:

   #[napi]
   pub const PASSWORD_NOT_FOUND: &str = "Password not found.";

   Then reference it in index.js via nativeBinding.PASSWORD_NOT_FOUND.

2. Use a structured error approach (error codes instead of message string comparison) so the contract is not dependent on exact text matching.

⚠️ IMPORTANT (Correctness): The credential migration only covers the 6 directory-service credential keys, but the migrateStateFrom1To2 method (lines 168-178) stores all SecureStorageKeys values in secure storage with a ${userId}_ prefix. This means the following keys may also exist in the Windows credential store in the old keytar UTF-8 format and would not be migrated:

• ${userId}_directoryConfig_ (from SecureStorageKeys.directoryConfigPrefix)
• ${userId}_syncConfig (from SecureStorageKeys.sync)
• ${userId}_directoryType (from SecureStorageKeys.directoryType)
• ${userId}_organizationId (from SecureStorageKeys.organizationId)

Reading these unmigrated credentials through desktop_core on Windows would produce garbled UTF-16 output, the same corruption this migration is designed to prevent.

🎨 SUGGESTED: This service name is now hardcoded in three separate locations:

1. Here in ElectronRendererSecureStorageService
2. In stateMigration.service.ts line 190 (const serviceName = "Bitwarden Directory Connector")
3. In bwdc.ts line 63 (const applicationName = "Bitwarden Directory Connector")

If any of these drift out of sync, credentials written by one path would be invisible to another. Consider extracting this to a shared constant (e.g., in a constants file) to make the coupling explicit and prevent future inconsistencies.