fix: enhance cipher login URI handling and import format support

src/handlers/ciphers.ts

@@ -191,7 +191,6 @@ export function normalizeCipherLoginForCompatibility(
   const next = sanitizeEncryptedObject(normalized, ['username', 'password', 'totp', 'uri']);
   if (!next) return null;
   next.uris = normalizeCipherLoginUrisForCompatibility(next.uris, {
-    hasLegacyLoginUri: isValidEncString(next.uri),
     requiresUriChecksum,
     preserveRepairableUris,
   });
@@ -201,7 +200,7 @@ export function normalizeCipherLoginForCompatibility(
 
 function normalizeCipherLoginUrisForCompatibility(
   uris: any,
-  options: { hasLegacyLoginUri?: boolean; requiresUriChecksum?: boolean; preserveRepairableUris?: boolean } = {}
+  options: { requiresUriChecksum?: boolean; preserveRepairableUris?: boolean } = {}
 ): any[] | null {
   if (!Array.isArray(uris) || uris.length === 0) return null;
   const out: any[] = [];
@@ -231,7 +230,7 @@ function normalizeCipherLoginUrisForCompatibility(
       // Bitwarden browser clients using the SDK drop item-key encrypted URIs
       // whose checksum is missing/invalid. User-key encrypted legacy/import
       // entries bypass this validation and can safely keep the URI.
-      if (options.requiresUriChecksum || options.hasLegacyLoginUri) continue;
+      if (options.requiresUriChecksum) continue;
       out.push({ ...next, uriChecksum: null });
       continue;
     }
@@ -833,6 +832,10 @@ export async function handleUpdateCipher(request: Request, env: Env, userId: str
     return errorResponse('The client copy of this cipher is out of date. Resync the client and try again.', 400);
   }
 
+  if (!shouldPreserveRepairableCipherUris(request) && incomingLogin.present && hasMissingLoginUriChecksum(existingCipher)) {
+    return errorResponse('This item has login URIs that must be repaired in NodeWarden Web before updating from this client. Open NodeWarden Web once, then resync.', 400);
+  }
+
   const nextType = Number(cipherData.type) || existingCipher.type;
 
   // Opaque passthrough: merge existing stored data with ALL incoming client fields.