@humain/terminal 0.0.2 → 0.0.3-beta.1

package/dist/humain/web-access/vendor/chrome-cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chrome-cookies.d.ts","sourceRoot":"","sources":["../../../../src/humain/web-access/vendor/chrome-cookies.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAgD/C,wBAAgB,6BAA6B,IAAI,MAAM,GAAG,IAAI,CAE7D;AAED,wBAAgB,8BAA8B,IAAI,MAAM,GAAG,IAAI,CAE9D;AAED,wBAAsB,gBAAgB,CACrC,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GACxD,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,IAAI,CAAC,CAQ5D;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,GAAG,CAAA;CAAE,GAClJ,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAiInF","sourcesContent":["import { execFile } from \"node:child_process\";\nimport { pbkdf2Sync, createDecipheriv } from \"node:crypto\";\nimport { copyFileSync, existsSync, mkdtempSync, readdirSync, realpathSync, rmSync } from \"node:fs\";\nimport { tmpdir, homedir } from \"node:os\";\nimport { isAbsolute, join, sep } from \"node:path\";\nimport { isBrowserCookieAccessAllowed } from \"./gemini-web-config.ts\";\n\nexport type CookieMap = Record<string, string>;\n\ninterface BrowserConfig {\n\tname: string;\n\tbaseDir: string;\n\tkeychainService?: string;\n\tkeychainAccount?: string;\n\tsecretToolApp?: string;\n}\n\ntype SqliteRow = Record<string, unknown>;\ntype SqliteFailure = \"unavailable\" | \"query\";\n\ninterface BrowserCookieEntry {\n\tname: string;\n\tvalue: string;\n\tpath: string;\n}\n\nconst GOOGLE_ORIGINS = [\n\t\"https://gemini.google.com\",\n\t\"https://accounts.google.com\",\n\t\"https://www.google.com\",\n];\n\nconst ALL_COOKIE_NAMES = new Set([\n\t\"__Secure-1PSID\", \"__Secure-1PSIDTS\", \"__Secure-1PSIDCC\", \"__Secure-1PAPISID\", \"NID\", \"AEC\", \"SOCS\",\n\t\"__Secure-BUCKET\", \"__Secure-ENID\", \"SID\", \"HSID\", \"SSID\", \"APISID\", \"SAPISID\", \"__Secure-3PSID\",\n\t\"__Secure-3PSIDTS\", \"__Secure-3PAPISID\", \"SIDCC\",\n]);\n\nconst MACOS_BROWSER_CONFIGS: BrowserConfig[] = [\n\t{ name: \"Helium\", baseDir: \"Library/Application Support/net.imput.helium\", keychainService: \"Helium Storage Key\", keychainAccount: \"Helium\" },\n\t{ name: \"Chrome\", baseDir: \"Library/Application Support/Google/Chrome\", keychainService: \"Chrome Safe Storage\", keychainAccount: \"Chrome\" },\n\t{ name: \"Brave\", baseDir: \"Library/Application Support/BraveSoftware/Brave-Browser\", keychainService: \"Brave Safe Storage\", keychainAccount: \"Brave\" },\n\t{ name: \"Arc\", baseDir: \"Library/Application Support/Arc/User Data\", keychainService: \"Arc Safe Storage\", keychainAccount: \"Arc\" },\n];\n\nconst LINUX_BROWSER_CONFIGS: BrowserConfig[] = [\n\t{ name: \"Chromium\", baseDir: \".config/chromium\", secretToolApp: \"chromium\" },\n\t{ name: \"Chrome\", baseDir: \".config/google-chrome\", secretToolApp: \"chrome\" },\n];\n\nconst browserPasswordCache = new Map<string, Promise<string | null>>();\nlet lastCookieDiagnostic: string | null = null;\nlet sqliteModule: typeof import(\"node:sqlite\") | null = null;\nlet sqliteImportAttempted = false;\n\nexport function getLastGoogleCookieDiagnostic(): string | null {\n\treturn lastCookieDiagnostic;\n}\n\nexport function getLastBrowserCookieDiagnostic(): string | null {\n\treturn lastCookieDiagnostic;\n}\n\nexport async function getGoogleCookies(\n\toptions?: { profile?: string; requiredCookies?: string[] },\n): Promise<{ cookies: CookieMap; warnings: string[] } | null> {\n\treturn getBrowserCookiesForHosts({\n\t\thosts: GOOGLE_ORIGINS.map((origin) => new URL(origin).hostname),\n\t\tprofile: options?.profile,\n\t\trequiredCookies: options?.requiredCookies,\n\t\tcookieNames: ALL_COOKIE_NAMES,\n\t\trequiredLabel: \"Gemini\",\n\t});\n}\n\nexport async function getBrowserCookiesForHosts(\n\toptions: { hosts: string[]; profile?: string; requiredCookies?: string[]; cookieNames?: Iterable<string>; requiredLabel?: string; requestUrl?: URL },\n): Promise<{ cookies: CookieMap; warnings: string[]; cookieHeader?: string } | null> {\n\tlastCookieDiagnostic = null;\n\tif (!isBrowserCookieAccessAllowed()) {\n\t\tlastCookieDiagnostic = \"Browser cookie access is disabled; enable allowBrowserCookies to use browser cookies.\";\n\t\treturn null;\n\t}\n\n\tconst currentPlatform = process.platform;\n\tconst configs = currentPlatform === \"darwin\" ? MACOS_BROWSER_CONFIGS : currentPlatform === \"linux\" ? LINUX_BROWSER_CONFIGS : [];\n\tif (configs.length === 0) {\n\t\tlastCookieDiagnostic = \"Chromium cookie extraction is unsupported on this platform.\";\n\t\treturn null;\n\t}\n\n\tconst warningSet = new Set<string>();\n\tconst rawProfile = typeof options.profile === \"string\" ? options.profile.trim() : \"\";\n\tconst requestedProfile = normalizeProfileName(options.profile);\n\tif (rawProfile && !requestedProfile) {\n\t\tlastCookieDiagnostic = \"Configured Chromium profile must be a profile directory name, not a path.\";\n\t\treturn null;\n\t}\n\tconst requiredCookies = normalizeCookieNames(options.requiredCookies);\n\tconst cookieNames = normalizeCookieNames(options.cookieNames ? [...options.cookieNames] : undefined);\n\tconst hosts = normalizeHosts(options.hosts);\n\tif (hosts.length === 0) {\n\t\tlastCookieDiagnostic = \"No valid cookie hosts were requested.\";\n\t\treturn null;\n\t}\n\tconst home = homedir();\n\tlet sawCookieDatabase = false;\n\tlet sawRequiredCookies = false;\n\tlet sawAnyHostCookie = false;\n\tlet sawBackendFailure: SqliteFailure | undefined;\n\tlet sawUnsafeProfilePath = false;\n\n\tfor (const config of configs) {\n\t\tconst profiles = requestedProfile ? [requestedProfile] : listBrowserProfiles(home, config);\n\t\tfor (const profile of profiles) {\n\t\t\tconst profilePath = resolveProfilePath(home, config, profile);\n\t\t\tif (profilePath === \"outside-root\") {\n\t\t\t\tsawUnsafeProfilePath = true;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!profilePath) continue;\n\t\t\tconst cookiesPath = join(profilePath, \"Cookies\");\n\t\t\tsawCookieDatabase = true;\n\n\t\t\tconst tempDir = mkdtempSync(join(tmpdir(), \"pi-chrome-cookies-\"));\n\t\t\ttry {\n\t\t\t\tconst tempDb = join(tempDir, \"Cookies\");\n\t\t\t\tcopyFileSync(cookiesPath, tempDb);\n\t\t\t\tcopySidecar(cookiesPath, tempDb, \"-wal\");\n\t\t\t\tcopySidecar(cookiesPath, tempDb, \"-shm\");\n\n\t\t\t\tif (requiredCookies?.length) {\n\t\t\t\t\tconst preflight = await hasCookieNames(tempDb, hosts, requiredCookies);\n\t\t\t\t\tif (preflight.failure) sawBackendFailure = preflight.failure;\n\t\t\t\t\tif (!preflight.present) continue;\n\t\t\t\t\tsawRequiredCookies = true;\n\t\t\t\t}\n\n\t\t\t\tconst password = await readBrowserPassword(config, currentPlatform);\n\t\t\t\tif (!password) {\n\t\t\t\t\twarningSet.add(`Could not read ${config.name} cookie encryption password`);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\tconst key = pbkdf2Sync(password, \"saltysalt\", currentPlatform === \"darwin\" ? 1003 : 1, 16, \"sha1\");\n\t\t\t\tconst metaVersion = await readMetaVersion(tempDb);\n\t\t\t\tif (metaVersion.failure) sawBackendFailure = metaVersion.failure;\n\t\t\t\tif (metaVersion.value === null) continue;\n\t\t\t\tconst rowsResult = await queryCookieRows(tempDb, hosts, cookieNames ?? null, Boolean(options.requestUrl));\n\t\t\t\tif (rowsResult.status === \"failure\") {\n\t\t\t\t\tsawBackendFailure = rowsResult.failure;\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\tconst entries: BrowserCookieEntry[] = [];\n\t\t\t\tconst cookies: CookieMap = {};\n\t\t\t\tfor (const row of rowsResult.rows) {\n\t\t\t\t\tconst name = typeof row.name === \"string\" ? row.name : \"\";\n\t\t\t\t\tif (!name) continue;\n\t\t\t\t\tlet value = typeof row.value === \"string\" && row.value.length > 0 ? row.value : null;\n\t\t\t\t\tif (!value && typeof row.encrypted_value_hex === \"string\" && /^[0-9a-f]*$/i.test(row.encrypted_value_hex)) {\n\t\t\t\t\t\tvalue = decryptCookieValue(Buffer.from(row.encrypted_value_hex, \"hex\"), key, metaVersion.value >= 24);\n\t\t\t\t\t}\n\t\t\t\t\tif (!value) continue;\n\t\t\t\t\tconst path = typeof row.path === \"string\" && row.path.startsWith(\"/\") ? row.path : \"/\";\n\t\t\t\t\tif (options.requestUrl && !pathMatches(options.requestUrl.pathname || \"/\", path)) continue;\n\t\t\t\t\tentries.push({ name, value, path });\n\t\t\t\t\tif (!cookies[name]) cookies[name] = value;\n\t\t\t\t}\n\n\t\t\t\tif (entries.length > 0) sawAnyHostCookie = true;\n\t\t\t\tif (requiredCookies?.length && !requiredCookies.every((name) => Boolean(cookies[name]))) continue;\n\t\t\t\tif (entries.length === 0) continue;\n\t\t\t\treturn {\n\t\t\t\t\tcookies,\n\t\t\t\t\twarnings: [...warningSet],\n\t\t\t\t\t...(options.requestUrl ? { cookieHeader: buildCookieHeader(entries) } : {}),\n\t\t\t\t};\n\t\t\t} finally {\n\t\t\t\trmSync(tempDir, { recursive: true, force: true });\n\t\t\t}\n\t\t}\n\t}\n\n\tif (sawBackendFailure === \"unavailable\") {\n\t\tlastCookieDiagnostic = \"SQLite backend unavailable: install sqlite3 or use a runtime with SQLite support.\";\n\t} else if (sawBackendFailure === \"query\") {\n\t\tlastCookieDiagnostic = \"SQLite query failed while reading the copied Chromium cookie database.\";\n\t} else if (sawUnsafeProfilePath) {\n\t\tlastCookieDiagnostic = \"Configured Chromium profile must resolve inside the browser profile root.\";\n\t} else if (!sawCookieDatabase) {\n\t\tlastCookieDiagnostic = requestedProfile\n\t\t\t? `Chromium profile '${requestedProfile}' does not contain a cookie database.`\n\t\t\t: \"No detected Chromium profile contains a cookie database.\";\n\t} else if (requiredCookies?.length && !sawRequiredCookies) {\n\t\tlastCookieDiagnostic = `No detected Chromium profile contains the required ${options.requiredLabel ?? \"browser\"} cookies.`;\n\t} else if (!sawAnyHostCookie) {\n\t\tlastCookieDiagnostic = options.requestUrl\n\t\t\t? \"No detected Chromium profile contains cookies for the requested URL.\"\n\t\t\t: \"No detected Chromium profile contains cookies for the requested host.\";\n\t} else if (warningSet.size > 0) {\n\t\tlastCookieDiagnostic = [...warningSet][0];\n\t} else {\n\t\tlastCookieDiagnostic = \"Required Gemini cookies were not available or could not be decrypted.\";\n\t}\n\treturn null;\n}\n\nfunction normalizeProfileName(value: string | undefined): string | undefined {\n\tif (typeof value !== \"string\") return undefined;\n\tconst normalized = value.trim();\n\tif (!normalized) return undefined;\n\tif (isAbsolute(normalized) || normalized === \".\" || normalized === \"..\" || normalized.includes(\"/\") || normalized.includes(\"\\\\\")) {\n\t\treturn undefined;\n\t}\n\treturn normalized;\n}\n\nfunction resolveProfilePath(home: string, config: BrowserConfig, profile: string): string | \"outside-root\" | null {\n\tconst basePath = join(home, config.baseDir);\n\tconst profilePath = join(basePath, profile);\n\tconst cookiesPath = join(profilePath, \"Cookies\");\n\tif (!existsSync(cookiesPath)) return null;\n\ttry {\n\t\tconst baseRealPath = realpathSync(basePath);\n\t\tconst profileRealPath = realpathSync(profilePath);\n\t\tif (profileRealPath !== baseRealPath && !profileRealPath.startsWith(`${baseRealPath}${sep}`)) return \"outside-root\";\n\t\treturn profileRealPath;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction normalizeCookieNames(names: string[] | undefined): string[] | undefined {\n\tif (!names?.length) return undefined;\n\tconst normalized = names.filter((name): name is string => typeof name === \"string\").map((name) => name.trim()).filter(Boolean);\n\treturn normalized.length > 0 ? [...new Set(normalized)] : undefined;\n}\n\nfunction normalizeHosts(hosts: string[]): string[] {\n\treturn [...new Set(hosts.map(host => host.trim().toLowerCase().replace(/^\\[|\\]$/g, \"\").replace(/\\.$/, \"\")).filter(Boolean))];\n}\n\nfunction listBrowserProfiles(home: string, config: BrowserConfig): string[] {\n\tconst basePath = join(home, config.baseDir);\n\tif (!existsSync(basePath)) return [\"Default\"];\n\tconst profiles = new Set<string>();\n\ttry {\n\t\tfor (const entry of readdirSync(basePath, { withFileTypes: true })) {\n\t\t\tif (entry.isDirectory() && existsSync(join(basePath, entry.name, \"Cookies\"))) profiles.add(entry.name);\n\t\t}\n\t} catch {\n\t}\n\tif (profiles.size === 0) return [\"Default\"];\n\treturn [...profiles].sort(compareProfileNames);\n}\n\nfunction compareProfileNames(a: string, b: string): number {\n\tconst key = (name: string): [number, number] => {\n\t\tif (name === \"Default\") return [0, 0];\n\t\tconst profile = /^Profile\\s+(\\d+)$/i.exec(name);\n\t\tif (profile) return [1, Number(profile[1])];\n\t\tconst person = /^Person\\s+(\\d+)$/i.exec(name);\n\t\tif (person) return [2, Number(person[1])];\n\t\treturn [3, Number.MAX_SAFE_INTEGER];\n\t};\n\tconst [ap, ai] = key(a);\n\tconst [bp, bi] = key(b);\n\treturn ap - bp || ai - bi || a.localeCompare(b, undefined, { sensitivity: \"base\", numeric: true });\n}\n\nfunction decryptCookieValue(encrypted: Uint8Array, key: Buffer, stripHash: boolean): string | null {\n\tconst buf = Buffer.from(encrypted);\n\tif (buf.length < 3 || !/^v\\d\\d$/.test(buf.subarray(0, 3).toString(\"utf8\"))) return null;\n\tconst ciphertext = buf.subarray(3);\n\tif (!ciphertext.length) return \"\";\n\ttry {\n\t\tconst decipher = createDecipheriv(\"aes-128-cbc\", key, Buffer.alloc(16, 0x20));\n\t\tdecipher.setAutoPadding(false);\n\t\tconst unpadded = removePkcs7Padding(Buffer.concat([decipher.update(ciphertext), decipher.final()]));\n\t\tconst bytes = stripHash && unpadded.length >= 32 ? unpadded.subarray(32) : unpadded;\n\t\tconst decoded = new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n\t\tlet i = 0;\n\t\twhile (i < decoded.length && decoded.charCodeAt(i) < 0x20) i++;\n\t\treturn decoded.slice(i);\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction removePkcs7Padding(buf: Buffer): Buffer {\n\tif (!buf.length) return buf;\n\tconst padding = buf[buf.length - 1];\n\treturn !padding || padding > 16 ? buf : buf.subarray(0, buf.length - padding);\n}\n\nfunction readBrowserPassword(config: BrowserConfig, currentPlatform: typeof process.platform): Promise<string | null> {\n\tconst cacheKey = `${currentPlatform}:${config.name}`;\n\tconst cached = browserPasswordCache.get(cacheKey);\n\tif (cached) return cached;\n\tconst passwordResult = currentPlatform === \"darwin\"\n\t\t? config.keychainAccount && config.keychainService\n\t\t\t? readKeychainPassword(config.keychainAccount, config.keychainService).then(password => ({ password, cacheable: Boolean(password) }))\n\t\t\t: Promise.resolve({ password: null, cacheable: false })\n\t\t: currentPlatform === \"linux\"\n\t\t\t? readLinuxPassword(config.secretToolApp)\n\t\t\t: Promise.resolve({ password: null, cacheable: false });\n\tconst passwordPromise = passwordResult.then(({ password, cacheable }) => {\n\t\tif (!cacheable) browserPasswordCache.delete(cacheKey);\n\t\treturn password;\n\t}, (error) => {\n\t\tbrowserPasswordCache.delete(cacheKey);\n\t\tthrow error;\n\t});\n\tbrowserPasswordCache.set(cacheKey, passwordPromise);\n\treturn passwordPromise;\n}\n\nfunction readKeychainPassword(account: string, service: string): Promise<string | null> {\n\treturn new Promise((resolve) => {\n\t\texecFile(\"security\", [\"find-generic-password\", \"-w\", \"-a\", account, \"-s\", service], { timeout: 5000 }, (err, stdout) => {\n\t\t\tif (err) { resolve(null); return; }\n\t\t\tresolve(stdout.trim() || null);\n\t\t});\n\t});\n}\n\nfunction readLinuxPassword(secretToolApp: string | undefined): Promise<{ password: string; cacheable: boolean }> {\n\tif (!secretToolApp) return Promise.resolve({ password: \"peanuts\", cacheable: true });\n\treturn new Promise((resolve) => {\n\t\texecFile(\"secret-tool\", [\"lookup\", \"application\", secretToolApp], { timeout: 5000 }, (err, stdout) => {\n\t\t\tif (err) { resolve({ password: \"peanuts\", cacheable: false }); return; }\n\t\t\tconst password = stdout.trim();\n\t\t\tresolve(password ? { password, cacheable: true } : { password: \"peanuts\", cacheable: false });\n\t\t});\n\t});\n}\n\nasync function importSqlite(): Promise<typeof import(\"node:sqlite\") | null> {\n\tif (process.env.PI_WEB_ACCESS_DISABLE_NODE_SQLITE === \"1\") return null;\n\tif (sqliteImportAttempted) return sqliteModule;\n\tsqliteImportAttempted = true;\n\tconst orig = process.emitWarning.bind(process);\n\tprocess.emitWarning = ((warning: string | Error, ...args: unknown[]) => {\n\t\tconst msg = typeof warning === \"string\" ? warning : warning?.message ?? \"\";\n\t\tif (msg.includes(\"SQLite is an experimental feature\")) return;\n\t\treturn (orig as Function)(warning, ...args);\n\t}) as typeof process.emitWarning;\n\ttry {\n\t\tsqliteModule = await import(\"node:sqlite\");\n\t} catch {\n\t\tsqliteModule = null;\n\t} finally {\n\t\tprocess.emitWarning = orig;\n\t}\n\treturn sqliteModule;\n}\n\ntype QueryResult =\n\t| { status: \"success\"; rows: SqliteRow[] }\n\t| { status: \"failure\"; failure: SqliteFailure };\n\nasync function runSqliteQuery(dbPath: string, sql: string): Promise<QueryResult> {\n\tconst sqlite = await importSqlite();\n\tlet queryFailed = false;\n\tif (sqlite) {\n\t\ttry {\n\t\t\tconst db = new sqlite.DatabaseSync(dbPath, { readOnly: true });\n\t\t\ttry {\n\t\t\t\treturn { status: \"success\", rows: db.prepare(sql).all() as SqliteRow[] };\n\t\t\t} finally {\n\t\t\t\tdb.close();\n\t\t\t}\n\t\t} catch {\n\t\t\tqueryFailed = true;\n\t\t}\n\t}\n\n\tconst cli = await runSqliteCli(dbPath, sql);\n\tif (cli.status === \"success\") return cli;\n\tif (cli.failure === \"query\") queryFailed = true;\n\tconst python = await runPythonSqlite(dbPath, sql);\n\tif (python.status === \"success\") return python;\n\tif (python.failure === \"query\") queryFailed = true;\n\treturn { status: \"failure\", failure: queryFailed ? \"query\" : \"unavailable\" };\n}\n\nfunction runSqliteCli(dbPath: string, sql: string): Promise<QueryResult> {\n\treturn new Promise((resolve) => {\n\t\texecFile(\"sqlite3\", [\"-readonly\", \"-json\", dbPath, sql], { timeout: 5000, maxBuffer: 1024 * 1024 }, (err, stdout) => {\n\t\t\tif (err) { resolve({ status: \"failure\", failure: err.code === \"ENOENT\" ? \"unavailable\" : \"query\" }); return; }\n\t\t\ttry {\n\t\t\t\tconst parsed = JSON.parse(stdout || \"[]\");\n\t\t\t\tresolve(Array.isArray(parsed) ? { status: \"success\", rows: parsed as SqliteRow[] } : { status: \"failure\", failure: \"query\" });\n\t\t\t} catch {\n\t\t\t\tresolve({ status: \"failure\", failure: \"query\" });\n\t\t\t}\n\t\t});\n\t});\n}\n\nfunction runPythonSqlite(dbPath: string, sql: string): Promise<QueryResult> {\n\tconst script = \"import json,sqlite3,sys\\ntry:\\n c=sqlite3.connect('file:'+sys.argv[1]+'?mode=ro',uri=True)\\n c.row_factory=sqlite3.Row\\n print(json.dumps([dict(r) for r in c.execute(sys.argv[2]).fetchall()]))\\nexcept Exception:\\n sys.exit(1)\";\n\treturn new Promise((resolve) => {\n\t\texecFile(\"python3\", [\"-c\", script, dbPath, sql], { timeout: 5000, maxBuffer: 1024 * 1024 }, (err, stdout) => {\n\t\t\tif (err) { resolve({ status: \"failure\", failure: err.code === \"ENOENT\" ? \"unavailable\" : \"query\" }); return; }\n\t\t\ttry {\n\t\t\t\tconst parsed = JSON.parse(stdout || \"[]\");\n\t\t\t\tresolve(Array.isArray(parsed) ? { status: \"success\", rows: parsed as SqliteRow[] } : { status: \"failure\", failure: \"query\" });\n\t\t\t} catch {\n\t\t\t\tresolve({ status: \"failure\", failure: \"query\" });\n\t\t\t}\n\t\t});\n\t});\n}\n\nasync function readMetaVersion(dbPath: string): Promise<{ value: number | null; failure?: SqliteFailure }> {\n\tconst result = await runSqliteQuery(dbPath, \"SELECT value FROM meta WHERE key = 'version'\");\n\tif (result.status === \"failure\") {\n\t\treturn result.failure === \"unavailable\"\n\t\t\t? { value: null, failure: result.failure }\n\t\t\t: { value: 0 };\n\t}\n\tconst value = result.rows[0]?.value;\n\tif (typeof value === \"number\") return { value: Math.floor(value) };\n\tif (typeof value === \"string\") return { value: parseInt(value, 10) || 0 };\n\treturn { value: 0 };\n}\n\nasync function hasCookieNames(dbPath: string, hosts: string[], names: string[]): Promise<{ present: boolean; failure?: SqliteFailure }> {\n\tconst result = await runSqliteQuery(dbPath, `SELECT DISTINCT name FROM cookies WHERE ${buildCookieWhere(hosts, names)}`);\n\tif (result.status === \"failure\") return { present: false, failure: result.failure };\n\tconst present = new Set(result.rows.map((row) => typeof row.name === \"string\" ? row.name : \"\"));\n\treturn { present: names.every((name) => present.has(name)) };\n}\n\nasync function queryCookieRows(dbPath: string, hosts: string[], names: Iterable<string> | null, filterExpired: boolean): Promise<QueryResult> {\n\tconst columns = await readCookieColumns(dbPath);\n\tif (columns.status === \"failure\") return columns;\n\tconst pathExpr = columns.columns.has(\"path\") ? \"path\" : \"'/' AS path\";\n\tconst expiresExpr = columns.columns.has(\"expires_utc\") ? \"expires_utc\" : \"0 AS expires_utc\";\n\tconst expiryFilter = filterExpired && columns.columns.has(\"expires_utc\") ? ` AND (expires_utc = 0 OR expires_utc > ${chromeExpiryNowMicros()})` : \"\";\n\tconst partitionFilter = filterExpired ? unpartitionedCookieFilter(columns.columns) : \"\";\n\treturn runSqliteQuery(dbPath, `SELECT name, value, host_key, ${pathExpr}, ${expiresExpr}, hex(encrypted_value) AS encrypted_value_hex FROM cookies WHERE ${buildCookieWhere(hosts, names ?? undefined)}${expiryFilter}${partitionFilter} ORDER BY length(path) DESC, expires_utc ASC`);\n}\n\nasync function readCookieColumns(dbPath: string): Promise<{ status: \"success\"; columns: Set<string> } | { status: \"failure\"; failure: SqliteFailure }> {\n\tconst result = await runSqliteQuery(dbPath, \"PRAGMA table_info(cookies)\");\n\tif (result.status === \"failure\") return result;\n\treturn { status: \"success\", columns: new Set(result.rows.map(row => typeof row.name === \"string\" ? row.name : \"\")) };\n}\n\nfunction chromeExpiryNowMicros(): number {\n\treturn (Date.now() + 11644473600000) * 1000;\n}\n\nfunction unpartitionedCookieFilter(columns: Set<string>): string {\n\tconst clauses: string[] = [];\n\tif (columns.has(\"top_frame_site_key\")) clauses.push(\"(top_frame_site_key IS NULL OR top_frame_site_key = '')\");\n\tif (columns.has(\"partition_key\")) clauses.push(\"(partition_key IS NULL OR partition_key = '')\");\n\tif (columns.has(\"is_partitioned\")) clauses.push(\"(is_partitioned IS NULL OR is_partitioned = 0)\");\n\treturn clauses.length > 0 ? ` AND ${clauses.join(\" AND \")}` : \"\";\n}\n\nfunction buildCookieHeader(entries: BrowserCookieEntry[]): string {\n\treturn entries\n\t\t.sort((a, b) => b.path.length - a.path.length)\n\t\t.map(({ name, value }) => `${name}=${value}`)\n\t\t.join(\"; \");\n}\n\nfunction pathMatches(requestPath: string, cookiePath: string): boolean {\n\tif (requestPath === cookiePath) return true;\n\tif (!requestPath.startsWith(cookiePath)) return false;\n\tif (cookiePath.endsWith(\"/\")) return true;\n\treturn requestPath[cookiePath.length] === \"/\";\n}\n\nfunction buildCookieWhere(hosts: string[], cookieNames?: Iterable<string>): string {\n\tconst hostClauses: string[] = [];\n\tfor (const host of hosts) {\n\t\tconst escapedHost = escapeSqlString(host);\n\t\thostClauses.push(`host_key = '${escapedHost}'`);\n\t\tfor (const candidate of domainCookieHosts(host)) {\n\t\t\thostClauses.push(`host_key = '.${escapeSqlString(candidate)}'`);\n\t\t}\n\t}\n\tlet where = `(${[...new Set(hostClauses)].join(\" OR \")})`;\n\tconst names = cookieNames ? [...cookieNames].filter(Boolean) : [];\n\tif (names.length) where += ` AND name IN (${names.map((name) => `'${escapeSqlString(name)}'`).join(\", \")})`;\n\treturn where;\n}\n\nfunction escapeSqlString(value: string): string {\n\treturn value.replaceAll(\"'\", \"''\");\n}\n\nfunction domainCookieHosts(host: string): string[] {\n\tconst parts = host.split(\".\").filter(Boolean);\n\tif (parts.length <= 1) return [];\n\tconst candidates = new Set<string>();\n\tfor (let i = 0; i <= parts.length - 2; i++) candidates.add(parts.slice(i).join(\".\"));\n\treturn [...candidates];\n}\n\nfunction copySidecar(srcDb: string, targetDb: string, suffix: string): void {\n\tconst sidecar = `${srcDb}${suffix}`;\n\tif (!existsSync(sidecar)) return;\n\ttry {\n\t\tcopyFileSync(sidecar, `${targetDb}${suffix}`);\n\t} catch {\n\t}\n}\n"]}

package/dist/humain/web-access/vendor/chrome-cookies.js

@@ -0,0 +1,522 @@
+import { execFile } from "node:child_process";
+import { pbkdf2Sync, createDecipheriv } from "node:crypto";
+import { copyFileSync, existsSync, mkdtempSync, readdirSync, realpathSync, rmSync } from "node:fs";
+import { tmpdir, homedir } from "node:os";
+import { isAbsolute, join, sep } from "node:path";
+import { isBrowserCookieAccessAllowed } from "./gemini-web-config.js";
+const GOOGLE_ORIGINS = [
+    "https://gemini.google.com",
+    "https://accounts.google.com",
+    "https://www.google.com",
+];
+const ALL_COOKIE_NAMES = new Set([
+    "__Secure-1PSID", "__Secure-1PSIDTS", "__Secure-1PSIDCC", "__Secure-1PAPISID", "NID", "AEC", "SOCS",
+    "__Secure-BUCKET", "__Secure-ENID", "SID", "HSID", "SSID", "APISID", "SAPISID", "__Secure-3PSID",
+    "__Secure-3PSIDTS", "__Secure-3PAPISID", "SIDCC",
+]);
+const MACOS_BROWSER_CONFIGS = [
+    { name: "Helium", baseDir: "Library/Application Support/net.imput.helium", keychainService: "Helium Storage Key", keychainAccount: "Helium" },
+    { name: "Chrome", baseDir: "Library/Application Support/Google/Chrome", keychainService: "Chrome Safe Storage", keychainAccount: "Chrome" },
+    { name: "Brave", baseDir: "Library/Application Support/BraveSoftware/Brave-Browser", keychainService: "Brave Safe Storage", keychainAccount: "Brave" },
+    { name: "Arc", baseDir: "Library/Application Support/Arc/User Data", keychainService: "Arc Safe Storage", keychainAccount: "Arc" },
+];
+const LINUX_BROWSER_CONFIGS = [
+    { name: "Chromium", baseDir: ".config/chromium", secretToolApp: "chromium" },
+    { name: "Chrome", baseDir: ".config/google-chrome", secretToolApp: "chrome" },
+];
+const browserPasswordCache = new Map();
+let lastCookieDiagnostic = null;
+let sqliteModule = null;
+let sqliteImportAttempted = false;
+export function getLastGoogleCookieDiagnostic() {
+    return lastCookieDiagnostic;
+}
+export function getLastBrowserCookieDiagnostic() {
+    return lastCookieDiagnostic;
+}
+export async function getGoogleCookies(options) {
+    return getBrowserCookiesForHosts({
+        hosts: GOOGLE_ORIGINS.map((origin) => new URL(origin).hostname),
+        profile: options?.profile,
+        requiredCookies: options?.requiredCookies,
+        cookieNames: ALL_COOKIE_NAMES,
+        requiredLabel: "Gemini",
+    });
+}
+export async function getBrowserCookiesForHosts(options) {
+    lastCookieDiagnostic = null;
+    if (!isBrowserCookieAccessAllowed()) {
+        lastCookieDiagnostic = "Browser cookie access is disabled; enable allowBrowserCookies to use browser cookies.";
+        return null;
+    }
+    const currentPlatform = process.platform;
+    const configs = currentPlatform === "darwin" ? MACOS_BROWSER_CONFIGS : currentPlatform === "linux" ? LINUX_BROWSER_CONFIGS : [];
+    if (configs.length === 0) {
+        lastCookieDiagnostic = "Chromium cookie extraction is unsupported on this platform.";
+        return null;
+    }
+    const warningSet = new Set();
+    const rawProfile = typeof options.profile === "string" ? options.profile.trim() : "";
+    const requestedProfile = normalizeProfileName(options.profile);
+    if (rawProfile && !requestedProfile) {
+        lastCookieDiagnostic = "Configured Chromium profile must be a profile directory name, not a path.";
+        return null;
+    }
+    const requiredCookies = normalizeCookieNames(options.requiredCookies);
+    const cookieNames = normalizeCookieNames(options.cookieNames ? [...options.cookieNames] : undefined);
+    const hosts = normalizeHosts(options.hosts);
+    if (hosts.length === 0) {
+        lastCookieDiagnostic = "No valid cookie hosts were requested.";
+        return null;
+    }
+    const home = homedir();
+    let sawCookieDatabase = false;
+    let sawRequiredCookies = false;
+    let sawAnyHostCookie = false;
+    let sawBackendFailure;
+    let sawUnsafeProfilePath = false;
+    for (const config of configs) {
+        const profiles = requestedProfile ? [requestedProfile] : listBrowserProfiles(home, config);
+        for (const profile of profiles) {
+            const profilePath = resolveProfilePath(home, config, profile);
+            if (profilePath === "outside-root") {
+                sawUnsafeProfilePath = true;
+                continue;
+            }
+            if (!profilePath)
+                continue;
+            const cookiesPath = join(profilePath, "Cookies");
+            sawCookieDatabase = true;
+            const tempDir = mkdtempSync(join(tmpdir(), "pi-chrome-cookies-"));
+            try {
+                const tempDb = join(tempDir, "Cookies");
+                copyFileSync(cookiesPath, tempDb);
+                copySidecar(cookiesPath, tempDb, "-wal");
+                copySidecar(cookiesPath, tempDb, "-shm");
+                if (requiredCookies?.length) {
+                    const preflight = await hasCookieNames(tempDb, hosts, requiredCookies);
+                    if (preflight.failure)
+                        sawBackendFailure = preflight.failure;
+                    if (!preflight.present)
+                        continue;
+                    sawRequiredCookies = true;
+                }
+                const password = await readBrowserPassword(config, currentPlatform);
+                if (!password) {
+                    warningSet.add(`Could not read ${config.name} cookie encryption password`);
+                    continue;
+                }
+                const key = pbkdf2Sync(password, "saltysalt", currentPlatform === "darwin" ? 1003 : 1, 16, "sha1");
+                const metaVersion = await readMetaVersion(tempDb);
+                if (metaVersion.failure)
+                    sawBackendFailure = metaVersion.failure;
+                if (metaVersion.value === null)
+                    continue;
+                const rowsResult = await queryCookieRows(tempDb, hosts, cookieNames ?? null, Boolean(options.requestUrl));
+                if (rowsResult.status === "failure") {
+                    sawBackendFailure = rowsResult.failure;
+                    continue;
+                }
+                const entries = [];
+                const cookies = {};
+                for (const row of rowsResult.rows) {
+                    const name = typeof row.name === "string" ? row.name : "";
+                    if (!name)
+                        continue;
+                    let value = typeof row.value === "string" && row.value.length > 0 ? row.value : null;
+                    if (!value && typeof row.encrypted_value_hex === "string" && /^[0-9a-f]*$/i.test(row.encrypted_value_hex)) {
+                        value = decryptCookieValue(Buffer.from(row.encrypted_value_hex, "hex"), key, metaVersion.value >= 24);
+                    }
+                    if (!value)
+                        continue;
+                    const path = typeof row.path === "string" && row.path.startsWith("/") ? row.path : "/";
+                    if (options.requestUrl && !pathMatches(options.requestUrl.pathname || "/", path))
+                        continue;
+                    entries.push({ name, value, path });
+                    if (!cookies[name])
+                        cookies[name] = value;
+                }
+                if (entries.length > 0)
+                    sawAnyHostCookie = true;
+                if (requiredCookies?.length && !requiredCookies.every((name) => Boolean(cookies[name])))
+                    continue;
+                if (entries.length === 0)
+                    continue;
+                return {
+                    cookies,
+                    warnings: [...warningSet],
+                    ...(options.requestUrl ? { cookieHeader: buildCookieHeader(entries) } : {}),
+                };
+            }
+            finally {
+                rmSync(tempDir, { recursive: true, force: true });
+            }
+        }
+    }
+    if (sawBackendFailure === "unavailable") {
+        lastCookieDiagnostic = "SQLite backend unavailable: install sqlite3 or use a runtime with SQLite support.";
+    }
+    else if (sawBackendFailure === "query") {
+        lastCookieDiagnostic = "SQLite query failed while reading the copied Chromium cookie database.";
+    }
+    else if (sawUnsafeProfilePath) {
+        lastCookieDiagnostic = "Configured Chromium profile must resolve inside the browser profile root.";
+    }
+    else if (!sawCookieDatabase) {
+        lastCookieDiagnostic = requestedProfile
+            ? `Chromium profile '${requestedProfile}' does not contain a cookie database.`
+            : "No detected Chromium profile contains a cookie database.";
+    }
+    else if (requiredCookies?.length && !sawRequiredCookies) {
+        lastCookieDiagnostic = `No detected Chromium profile contains the required ${options.requiredLabel ?? "browser"} cookies.`;
+    }
+    else if (!sawAnyHostCookie) {
+        lastCookieDiagnostic = options.requestUrl
+            ? "No detected Chromium profile contains cookies for the requested URL."
+            : "No detected Chromium profile contains cookies for the requested host.";
+    }
+    else if (warningSet.size > 0) {
+        lastCookieDiagnostic = [...warningSet][0];
+    }
+    else {
+        lastCookieDiagnostic = "Required Gemini cookies were not available or could not be decrypted.";
+    }
+    return null;
+}
+function normalizeProfileName(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const normalized = value.trim();
+    if (!normalized)
+        return undefined;
+    if (isAbsolute(normalized) || normalized === "." || normalized === ".." || normalized.includes("/") || normalized.includes("\\")) {
+        return undefined;
+    }
+    return normalized;
+}
+function resolveProfilePath(home, config, profile) {
+    const basePath = join(home, config.baseDir);
+    const profilePath = join(basePath, profile);
+    const cookiesPath = join(profilePath, "Cookies");
+    if (!existsSync(cookiesPath))
+        return null;
+    try {
+        const baseRealPath = realpathSync(basePath);
+        const profileRealPath = realpathSync(profilePath);
+        if (profileRealPath !== baseRealPath && !profileRealPath.startsWith(`${baseRealPath}${sep}`))
+            return "outside-root";
+        return profileRealPath;
+    }
+    catch {
+        return null;
+    }
+}
+function normalizeCookieNames(names) {
+    if (!names?.length)
+        return undefined;
+    const normalized = names.filter((name) => typeof name === "string").map((name) => name.trim()).filter(Boolean);
+    return normalized.length > 0 ? [...new Set(normalized)] : undefined;
+}
+function normalizeHosts(hosts) {
+    return [...new Set(hosts.map(host => host.trim().toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "")).filter(Boolean))];
+}
+function listBrowserProfiles(home, config) {
+    const basePath = join(home, config.baseDir);
+    if (!existsSync(basePath))
+        return ["Default"];
+    const profiles = new Set();
+    try {
+        for (const entry of readdirSync(basePath, { withFileTypes: true })) {
+            if (entry.isDirectory() && existsSync(join(basePath, entry.name, "Cookies")))
+                profiles.add(entry.name);
+        }
+    }
+    catch {
+    }
+    if (profiles.size === 0)
+        return ["Default"];
+    return [...profiles].sort(compareProfileNames);
+}
+function compareProfileNames(a, b) {
+    const key = (name) => {
+        if (name === "Default")
+            return [0, 0];
+        const profile = /^Profile\s+(\d+)$/i.exec(name);
+        if (profile)
+            return [1, Number(profile[1])];
+        const person = /^Person\s+(\d+)$/i.exec(name);
+        if (person)
+            return [2, Number(person[1])];
+        return [3, Number.MAX_SAFE_INTEGER];
+    };
+    const [ap, ai] = key(a);
+    const [bp, bi] = key(b);
+    return ap - bp || ai - bi || a.localeCompare(b, undefined, { sensitivity: "base", numeric: true });
+}
+function decryptCookieValue(encrypted, key, stripHash) {
+    const buf = Buffer.from(encrypted);
+    if (buf.length < 3 || !/^v\d\d$/.test(buf.subarray(0, 3).toString("utf8")))
+        return null;
+    const ciphertext = buf.subarray(3);
+    if (!ciphertext.length)
+        return "";
+    try {
+        const decipher = createDecipheriv("aes-128-cbc", key, Buffer.alloc(16, 0x20));
+        decipher.setAutoPadding(false);
+        const unpadded = removePkcs7Padding(Buffer.concat([decipher.update(ciphertext), decipher.final()]));
+        const bytes = stripHash && unpadded.length >= 32 ? unpadded.subarray(32) : unpadded;
+        const decoded = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+        let i = 0;
+        while (i < decoded.length && decoded.charCodeAt(i) < 0x20)
+            i++;
+        return decoded.slice(i);
+    }
+    catch {
+        return null;
+    }
+}
+function removePkcs7Padding(buf) {
+    if (!buf.length)
+        return buf;
+    const padding = buf[buf.length - 1];
+    return !padding || padding > 16 ? buf : buf.subarray(0, buf.length - padding);
+}
+function readBrowserPassword(config, currentPlatform) {
+    const cacheKey = `${currentPlatform}:${config.name}`;
+    const cached = browserPasswordCache.get(cacheKey);
+    if (cached)
+        return cached;
+    const passwordResult = currentPlatform === "darwin"
+        ? config.keychainAccount && config.keychainService
+            ? readKeychainPassword(config.keychainAccount, config.keychainService).then(password => ({ password, cacheable: Boolean(password) }))
+            : Promise.resolve({ password: null, cacheable: false })
+        : currentPlatform === "linux"
+            ? readLinuxPassword(config.secretToolApp)
+            : Promise.resolve({ password: null, cacheable: false });
+    const passwordPromise = passwordResult.then(({ password, cacheable }) => {
+        if (!cacheable)
+            browserPasswordCache.delete(cacheKey);
+        return password;
+    }, (error) => {
+        browserPasswordCache.delete(cacheKey);
+        throw error;
+    });
+    browserPasswordCache.set(cacheKey, passwordPromise);
+    return passwordPromise;
+}
+function readKeychainPassword(account, service) {
+    return new Promise((resolve) => {
+        execFile("security", ["find-generic-password", "-w", "-a", account, "-s", service], { timeout: 5000 }, (err, stdout) => {
+            if (err) {
+                resolve(null);
+                return;
+            }
+            resolve(stdout.trim() || null);
+        });
+    });
+}
+function readLinuxPassword(secretToolApp) {
+    if (!secretToolApp)
+        return Promise.resolve({ password: "peanuts", cacheable: true });
+    return new Promise((resolve) => {
+        execFile("secret-tool", ["lookup", "application", secretToolApp], { timeout: 5000 }, (err, stdout) => {
+            if (err) {
+                resolve({ password: "peanuts", cacheable: false });
+                return;
+            }
+            const password = stdout.trim();
+            resolve(password ? { password, cacheable: true } : { password: "peanuts", cacheable: false });
+        });
+    });
+}
+async function importSqlite() {
+    if (process.env.PI_WEB_ACCESS_DISABLE_NODE_SQLITE === "1")
+        return null;
+    if (sqliteImportAttempted)
+        return sqliteModule;
+    sqliteImportAttempted = true;
+    const orig = process.emitWarning.bind(process);
+    process.emitWarning = ((warning, ...args) => {
+        const msg = typeof warning === "string" ? warning : warning?.message ?? "";
+        if (msg.includes("SQLite is an experimental feature"))
+            return;
+        return orig(warning, ...args);
+    });
+    try {
+        sqliteModule = await import("node:sqlite");
+    }
+    catch {
+        sqliteModule = null;
+    }
+    finally {
+        process.emitWarning = orig;
+    }
+    return sqliteModule;
+}
+async function runSqliteQuery(dbPath, sql) {
+    const sqlite = await importSqlite();
+    let queryFailed = false;
+    if (sqlite) {
+        try {
+            const db = new sqlite.DatabaseSync(dbPath, { readOnly: true });
+            try {
+                return { status: "success", rows: db.prepare(sql).all() };
+            }
+            finally {
+                db.close();
+            }
+        }
+        catch {
+            queryFailed = true;
+        }
+    }
+    const cli = await runSqliteCli(dbPath, sql);
+    if (cli.status === "success")
+        return cli;
+    if (cli.failure === "query")
+        queryFailed = true;
+    const python = await runPythonSqlite(dbPath, sql);
+    if (python.status === "success")
+        return python;
+    if (python.failure === "query")
+        queryFailed = true;
+    return { status: "failure", failure: queryFailed ? "query" : "unavailable" };
+}
+function runSqliteCli(dbPath, sql) {
+    return new Promise((resolve) => {
+        execFile("sqlite3", ["-readonly", "-json", dbPath, sql], { timeout: 5000, maxBuffer: 1024 * 1024 }, (err, stdout) => {
+            if (err) {
+                resolve({ status: "failure", failure: err.code === "ENOENT" ? "unavailable" : "query" });
+                return;
+            }
+            try {
+                const parsed = JSON.parse(stdout || "[]");
+                resolve(Array.isArray(parsed) ? { status: "success", rows: parsed } : { status: "failure", failure: "query" });
+            }
+            catch {
+                resolve({ status: "failure", failure: "query" });
+            }
+        });
+    });
+}
+function runPythonSqlite(dbPath, sql) {
+    const script = "import json,sqlite3,sys\ntry:\n c=sqlite3.connect('file:'+sys.argv[1]+'?mode=ro',uri=True)\n c.row_factory=sqlite3.Row\n print(json.dumps([dict(r) for r in c.execute(sys.argv[2]).fetchall()]))\nexcept Exception:\n sys.exit(1)";
+    return new Promise((resolve) => {
+        execFile("python3", ["-c", script, dbPath, sql], { timeout: 5000, maxBuffer: 1024 * 1024 }, (err, stdout) => {
+            if (err) {
+                resolve({ status: "failure", failure: err.code === "ENOENT" ? "unavailable" : "query" });
+                return;
+            }
+            try {
+                const parsed = JSON.parse(stdout || "[]");
+                resolve(Array.isArray(parsed) ? { status: "success", rows: parsed } : { status: "failure", failure: "query" });
+            }
+            catch {
+                resolve({ status: "failure", failure: "query" });
+            }
+        });
+    });
+}
+async function readMetaVersion(dbPath) {
+    const result = await runSqliteQuery(dbPath, "SELECT value FROM meta WHERE key = 'version'");
+    if (result.status === "failure") {
+        return result.failure === "unavailable"
+            ? { value: null, failure: result.failure }
+            : { value: 0 };
+    }
+    const value = result.rows[0]?.value;
+    if (typeof value === "number")
+        return { value: Math.floor(value) };
+    if (typeof value === "string")
+        return { value: parseInt(value, 10) || 0 };
+    return { value: 0 };
+}
+async function hasCookieNames(dbPath, hosts, names) {
+    const result = await runSqliteQuery(dbPath, `SELECT DISTINCT name FROM cookies WHERE ${buildCookieWhere(hosts, names)}`);
+    if (result.status === "failure")
+        return { present: false, failure: result.failure };
+    const present = new Set(result.rows.map((row) => typeof row.name === "string" ? row.name : ""));
+    return { present: names.every((name) => present.has(name)) };
+}
+async function queryCookieRows(dbPath, hosts, names, filterExpired) {
+    const columns = await readCookieColumns(dbPath);
+    if (columns.status === "failure")
+        return columns;
+    const pathExpr = columns.columns.has("path") ? "path" : "'/' AS path";
+    const expiresExpr = columns.columns.has("expires_utc") ? "expires_utc" : "0 AS expires_utc";
+    const expiryFilter = filterExpired && columns.columns.has("expires_utc") ? ` AND (expires_utc = 0 OR expires_utc > ${chromeExpiryNowMicros()})` : "";
+    const partitionFilter = filterExpired ? unpartitionedCookieFilter(columns.columns) : "";
+    return runSqliteQuery(dbPath, `SELECT name, value, host_key, ${pathExpr}, ${expiresExpr}, hex(encrypted_value) AS encrypted_value_hex FROM cookies WHERE ${buildCookieWhere(hosts, names ?? undefined)}${expiryFilter}${partitionFilter} ORDER BY length(path) DESC, expires_utc ASC`);
+}
+async function readCookieColumns(dbPath) {
+    const result = await runSqliteQuery(dbPath, "PRAGMA table_info(cookies)");
+    if (result.status === "failure")
+        return result;
+    return { status: "success", columns: new Set(result.rows.map(row => typeof row.name === "string" ? row.name : "")) };
+}
+function chromeExpiryNowMicros() {
+    return (Date.now() + 11644473600000) * 1000;
+}
+function unpartitionedCookieFilter(columns) {
+    const clauses = [];
+    if (columns.has("top_frame_site_key"))
+        clauses.push("(top_frame_site_key IS NULL OR top_frame_site_key = '')");
+    if (columns.has("partition_key"))
+        clauses.push("(partition_key IS NULL OR partition_key = '')");
+    if (columns.has("is_partitioned"))
+        clauses.push("(is_partitioned IS NULL OR is_partitioned = 0)");
+    return clauses.length > 0 ? ` AND ${clauses.join(" AND ")}` : "";
+}
+function buildCookieHeader(entries) {
+    return entries
+        .sort((a, b) => b.path.length - a.path.length)
+        .map(({ name, value }) => `${name}=${value}`)
+        .join("; ");
+}
+function pathMatches(requestPath, cookiePath) {
+    if (requestPath === cookiePath)
+        return true;
+    if (!requestPath.startsWith(cookiePath))
+        return false;
+    if (cookiePath.endsWith("/"))
+        return true;
+    return requestPath[cookiePath.length] === "/";
+}
+function buildCookieWhere(hosts, cookieNames) {
+    const hostClauses = [];
+    for (const host of hosts) {
+        const escapedHost = escapeSqlString(host);
+        hostClauses.push(`host_key = '${escapedHost}'`);
+        for (const candidate of domainCookieHosts(host)) {
+            hostClauses.push(`host_key = '.${escapeSqlString(candidate)}'`);
+        }
+    }
+    let where = `(${[...new Set(hostClauses)].join(" OR ")})`;
+    const names = cookieNames ? [...cookieNames].filter(Boolean) : [];
+    if (names.length)
+        where += ` AND name IN (${names.map((name) => `'${escapeSqlString(name)}'`).join(", ")})`;
+    return where;
+}
+function escapeSqlString(value) {
+    return value.replaceAll("'", "''");
+}
+function domainCookieHosts(host) {
+    const parts = host.split(".").filter(Boolean);
+    if (parts.length <= 1)
+        return [];
+    const candidates = new Set();
+    for (let i = 0; i <= parts.length - 2; i++)
+        candidates.add(parts.slice(i).join("."));
+    return [...candidates];
+}
+function copySidecar(srcDb, targetDb, suffix) {
+    const sidecar = `${srcDb}${suffix}`;
+    if (!existsSync(sidecar))
+        return;
+    try {
+        copyFileSync(sidecar, `${targetDb}${suffix}`);
+    }
+    catch {
+    }
+}
+//# sourceMappingURL=chrome-cookies.js.map