fix: normalize bridge errors and support nested group paths

Distinguish invalid KeePass requests from backend failures in the Python bridge, improve nested group path resolution, and add coverage for nested group creation plus payload forwarding.

.memory/project.md

@@ -9,7 +9,8 @@ Provide a TypeScript wrapper around KeePass `.kdbx` databases using a Python bri
 - TypeScript spawns a Python process per request; there is no persistent worker yet.
 - JSON is exchanged over stdin/stdout.
 - Bridge errors, empty output, invalid JSON, missing files, and backend exceptions are surfaced as TypeScript errors.
-- Coverage now includes `keyFile` payload propagation and core API smoke checks.
+- Bridge error reporting now distinguishes invalid KeePass requests from backend errors.
+- Coverage now includes `keyFile` payload propagation, nested group payload shaping, and core API smoke checks.
 
 ## Public API
 - `openKeePassDatabase(path, options)`
@@ -37,7 +38,7 @@ Provide a TypeScript wrapper around KeePass `.kdbx` databases using a Python bri
 - Bundled fixtures: `tests/fixtures/data.kdbx` and `tests/fixtures/empty.kdbx`.
 - Companion JSON fixture: `tests/fixtures/data.kdbx.json` stores the password and expected content.
 - Unit tests in `tests/unit/` mock the child process and validate bridge parsing, error handling, command forwarding, and payload shaping.
-- Integration tests in `tests/integration/` use `data.kdbx` to verify entries, groups, partial search, OTP/TOTP output, and basic write persistence on a temporary copy when `pykeepass` is installed.
+- Integration tests in `tests/integration/` use `data.kdbx` to verify entries, groups, partial search, OTP/TOTP output, write persistence on a temporary copy, and nested group creation when `pykeepass` is installed.
 - The integration test runner checks for `pykeepass` and skips cleanly when it is unavailable.
 - Memory tracking files: `.memory/state.md` and `.memory/todo.md`.
 
@@ -48,4 +49,4 @@ Provide a TypeScript wrapper around KeePass `.kdbx` databases using a Python bri
 - `bun run setup:python`
 
 ## Current direction
-Keep improving failure-path coverage, keep write support minimal and predictable, and continue validating persistence on temporary copies.
+Keep improving failure-path coverage, keep write support minimal and predictable, and continue validating persistence on temporary copies and nested group behavior.

.memory/state.md

@@ -1,5 +1,7 @@
 # State
 
-- Added failure-path, command-forwarding, and keyFile payload unit tests for the bridge.
-- Latest unit and full test runs passed.
+- Hardened bridge error handling and nested group path resolution.
+- Added unit coverage for invalid JSON, empty output, nested group path forwarding, and keyFile payloads.
+- Added integration coverage for creating groups on temporary copies.
+- Latest test run passed: 20 tests, 0 failures.
 - Project renamed to ts-pykeepass-wrapper; current focus remains the TypeScript wrapper + Python bridge for KeePass.

.memory/todo.md

@@ -1,6 +1,5 @@
 # Todo
 
-- Improve failure-path coverage for write operations.
-- Verify and harden nested group path resolution.
-- Keep integration write tests on temporary copies only.
-- Keep API minimal and predictable.
+- Keep write-path behavior predictable and well-documented.
+- Preserve minimal API surface until update/delete/move is required.
+- Consider typed bridge errors in TypeScript if more granularity is needed later.