[PM-30584] Implement key-connector migration in SDK

[quexten]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/PM-30584
bitwarden/server#7136
#809
bitwarden/clients#19360

📔 Objective

We do not want to keep the same master-key that was used during password derivation, but use a separately sampled key - named "key-connector-key". This means that the conversion flow now requires:

• Posting the key to key-connector
• Setting the "key" field on the user to "key-connector-key-wrapped-user-key"

A new request endpoint is used compared to the previous key-connector-migration endpoint. This new endpoint always requires the key-connector-key-wrapped-user-key in the request body.

This will unblock setting the master-key to state during unlock and login, which will improve unlock time, since we can remove double-kdf-derivation.

📸 Screenshots

[github-actions]

Checkmarx One – Scan Summary & Details – f9b8cfcf-3c4d-4d7a-9740-037266f2cf6b

Great job! No new security vulnerabilities introduced in this pull request

[github-actions]

🔍 SDK Breaking Change Detection Results

SDK Version: km/key-connector-management-api (db9d693)
Completed: 2026-03-12 10:47:46 UTC
Total Time: 246s

Client	Status	Details
typescript	❌ Breaking changes detected	TypeScript compilation failed with new SDK version - View Details

---

Breaking change detection completed. View SDK workflow

[codecov]

Codecov Report

❌ Patch coverage is 93.70861% with 19 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.49%. Comparing base (9e3be8a) to head (db9d693).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
...r-crypto-management/src/key_connector_migration.rs	92.98%	19 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #809      +/-   ##
==========================================
+ Coverage   82.40%   82.49%   +0.08%     
==========================================
  Files         350      351       +1     
  Lines       41751    42053     +302     
==========================================
+ Hits        34404    34690     +286     
- Misses       7347     7363      +16     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Thomas-Avery]

Nice work the structure of these are easy to follow. One concern I found to take a look at.

[quexten]

@Thomas-Avery I've change the PR a bit to also implement key-context based wrap/unwrap for key-connector which should make this a bit more readable on the business logic side.

[quexten]

Also, added better docs for what is happening here.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Thomas-Avery]

Nice the refactor is even better!