@puffle/cookiejar 0.1.0

package/dist/core/browsers/firefox.js

@@ -0,0 +1,53 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { withCookieDb } from './sqlite.js';
+function profileRoots() {
+    const home = os.homedir();
+    return process.platform === 'darwin'
+        ? [path.join(home, 'Library/Application Support/Firefox/Profiles')]
+        : [path.join(home, '.mozilla/firefox'), path.join(home, 'snap/firefox/common/.mozilla/firefox')];
+}
+export function discoverFirefoxProfiles() {
+    const profiles = [];
+    for (const root of profileRoots()) {
+        if (!fs.existsSync(root))
+            continue;
+        for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+            if (!entry.isDirectory())
+                continue;
+            const cookies = path.join(root, entry.name, 'cookies.sqlite');
+            if (!fs.existsSync(cookies))
+                continue;
+            const name = entry.name.replace(/^[a-z0-9]+\./i, '');
+            profiles.push({
+                browser: 'firefox',
+                id: `firefox:${entry.name}`,
+                label: `Firefox — ${name || entry.name}`,
+                path: cookies,
+            });
+        }
+    }
+    return profiles;
+}
+const sameSiteFromFirefox = (value) => value === 0 ? 'None' : value === 1 ? 'Lax' : value === 2 ? 'Strict' : 'Unspecified';
+export function readFirefoxCookies(profile) {
+    return withCookieDb(profile.path, (db) => {
+        const rows = db
+            .prepare(`SELECT host, name, value, path, expiry, isSecure, isHttpOnly, sameSite FROM moz_cookies ORDER BY host, name`)
+            .all();
+        return rows.map((row) => ({
+            name: String(row.name),
+            value: String(row.value ?? ''),
+            domain: String(row.host),
+            path: String(row.path ?? '/'),
+            expires: Number(row.expiry ?? 0),
+            secure: Boolean(row.isSecure),
+            httpOnly: Boolean(row.isHttpOnly),
+            sameSite: sameSiteFromFirefox(Number(row.sameSite ?? -1)),
+            profileId: profile.id,
+            browser: profile.browser,
+        }));
+    });
+}
+//# sourceMappingURL=firefox.js.map

package/dist/core/browsers/firefox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firefox.js","sourceRoot":"","sources":["../../../src/core/browsers/firefox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,SAAS,YAAY;IACnB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAClC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,8CAA8C,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,sCAAsC,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,SAAS;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YAC9D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,SAAS;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,SAAS;gBAClB,EAAE,EAAE,WAAW,KAAK,CAAC,IAAI,EAAE;gBAC3B,KAAK,EAAE,aAAa,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE;gBACxC,IAAI,EAAE,OAAO;aACd,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAA6B,EAAE,CACvE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC;AAEtF,MAAM,UAAU,kBAAkB,CAAC,OAAuB;IACxD,OAAO,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,EAAE;aACZ,OAAO,CAAC,6GAA6G,CAAC;aACtH,GAAG,EAAoC,CAAC;QAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxB,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YACtB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YACxB,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC;YAC7B,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;YAChC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC7B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;YACjC,QAAQ,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;YACzD,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/browsers/index.js

@@ -0,0 +1,37 @@
+import { discoverChromiumProfiles, readChromiumCookies } from './chromium.js';
+import { discoverFirefoxProfiles, readFirefoxCookies } from './firefox.js';
+import { discoverSafariProfiles, readSafariCookies } from './safari.js';
+export function discoverProfiles() {
+    return [...discoverChromiumProfiles(), ...discoverFirefoxProfiles(), ...discoverSafariProfiles()];
+}
+export function findProfile(profileId) {
+    const profile = discoverProfiles().find((p) => p.id === profileId);
+    if (!profile)
+        throw new Error(`no such browser profile: ${profileId}`);
+    return profile;
+}
+export function readCookies(profile) {
+    if (profile.browser === 'firefox')
+        return readFirefoxCookies(profile);
+    if (profile.browser === 'safari')
+        return readSafariCookies(profile);
+    return readChromiumCookies(profile);
+}
+/** Reads every discovered profile, reporting per-profile failures instead of throwing. */
+export function readAllProfiles(profileIds) {
+    return discoverProfiles()
+        .filter((profile) => !profileIds || profileIds.includes(profile.id))
+        .map((profile) => {
+        try {
+            return { profile, cookies: readCookies(profile) };
+        }
+        catch (error) {
+            return { profile, cookies: [], error: error instanceof Error ? error.message : String(error) };
+        }
+    });
+}
+export function toMeta(cookie) {
+    const { value, ...rest } = cookie;
+    return { ...rest, valueLength: value.length };
+}
+//# sourceMappingURL=index.js.map

package/dist/core/browsers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/browsers/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGxE,MAAM,UAAU,gBAAgB;IAC9B,OAAO,CAAC,GAAG,wBAAwB,EAAE,EAAE,GAAG,uBAAuB,EAAE,EAAE,GAAG,sBAAsB,EAAE,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,SAAS,EAAE,CAAC,CAAC;IACvE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAuB;IACjD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpE,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAQD,0FAA0F;AAC1F,MAAM,UAAU,eAAe,CAAC,UAAqB;IACnD,OAAO,gBAAgB,EAAE;SACtB,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,UAAU,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;SACnE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACf,IAAI,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACjG,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,MAAqB;IAC1C,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAClC,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AAChD,CAAC"}

package/dist/core/browsers/safari.js

@@ -0,0 +1,79 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+const MAC_EPOCH_OFFSET = 978_307_200; // 2001-01-01 → 1970-01-01
+export class FullDiskAccessError extends Error {
+    constructor(file) {
+        super(`cannot read ${file}. macOS protects Safari's cookies: grant Full Disk Access to the terminal (or app) running cookiejar in System Settings → Privacy & Security → Full Disk Access.`);
+    }
+}
+export function discoverSafariProfiles() {
+    if (process.platform !== 'darwin')
+        return [];
+    const home = os.homedir();
+    const candidates = [
+        path.join(home, 'Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies'),
+        path.join(home, 'Library/Cookies/Cookies.binarycookies'),
+    ];
+    const file = candidates.find((p) => fs.existsSync(p));
+    if (!file)
+        return [];
+    return [{ browser: 'safari', id: 'safari:default', label: 'Safari', path: file }];
+}
+/** Reads Apple's undocumented-but-stable `Cookies.binarycookies` container. */
+export function parseBinaryCookies(buf, profile) {
+    if (buf.subarray(0, 4).toString('latin1') !== 'cook')
+        throw new Error('not a binarycookies file');
+    const pageCount = buf.readUInt32BE(4);
+    const pageSizes = [];
+    for (let i = 0; i < pageCount; i++)
+        pageSizes.push(buf.readUInt32BE(8 + i * 4));
+    const cookies = [];
+    let cursor = 8 + pageCount * 4;
+    for (const size of pageSizes) {
+        const page = buf.subarray(cursor, cursor + size);
+        cursor += size;
+        const cookieCount = page.readUInt32LE(4);
+        for (let i = 0; i < cookieCount; i++) {
+            const offset = page.readUInt32LE(8 + i * 4);
+            const record = page.subarray(offset);
+            const flags = record.readUInt32LE(8);
+            const readString = (at) => {
+                const end = record.indexOf(0, at);
+                return record.subarray(at, end === -1 ? undefined : end).toString('utf8');
+            };
+            const domain = readString(record.readUInt32LE(16));
+            const name = readString(record.readUInt32LE(20));
+            const cookiePath = readString(record.readUInt32LE(24));
+            const value = readString(record.readUInt32LE(28));
+            const expires = Math.max(0, Math.floor(record.readDoubleLE(40) + MAC_EPOCH_OFFSET));
+            cookies.push({
+                name,
+                value,
+                domain,
+                path: cookiePath || '/',
+                expires,
+                secure: (flags & 0x1) !== 0,
+                httpOnly: (flags & 0x4) !== 0,
+                sameSite: 'Unspecified',
+                profileId: profile.id,
+                browser: 'safari',
+            });
+        }
+    }
+    return cookies;
+}
+export function readSafariCookies(profile) {
+    let buf;
+    try {
+        buf = fs.readFileSync(profile.path);
+    }
+    catch (error) {
+        if (error.code === 'EPERM' || error.code === 'EACCES') {
+            throw new FullDiskAccessError(profile.path);
+        }
+        throw error;
+    }
+    return parseBinaryCookies(buf, profile);
+}
+//# sourceMappingURL=safari.js.map

package/dist/core/browsers/safari.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safari.js","sourceRoot":"","sources":["../../../src/core/browsers/safari.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,0BAA0B;AAEhE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,IAAY;QACtB,KAAK,CACH,eAAe,IAAI,kKAAkK,CACtL,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB;IACpC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gFAAgF,CAAC;QACjG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,uCAAuC,CAAC;KACzD,CAAC;IACF,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,OAAuB;IACrE,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAClG,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE;QAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAEhF,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,IAAI,MAAM,GAAG,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;QACjD,MAAM,IAAI,IAAI,CAAC;QACf,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,UAAU,GAAG,CAAC,EAAU,EAAU,EAAE;gBACxC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClC,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC5E,CAAC,CAAC;YACF,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;YAClD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC;YACpF,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI;gBACJ,KAAK;gBACL,MAAM;gBACN,IAAI,EAAE,UAAU,IAAI,GAAG;gBACvB,OAAO;gBACP,MAAM,EAAE,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;gBAC3B,QAAQ,EAAE,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;gBAC7B,QAAQ,EAAE,aAAa;gBACvB,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,OAAO,EAAE,QAAQ;aAClB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAuB;IACvD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,OAAO,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5G,MAAM,IAAI,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC"}

package/dist/core/browsers/sqlite.js

@@ -0,0 +1,38 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { DatabaseSync } from 'node:sqlite';
+/**
+ * Browsers hold a write lock on their cookie stores while running, so read from
+ * a throwaway copy (including the WAL, or recent cookies go missing).
+ */
+export function withCookieDb(dbPath, fn) {
+    const scratch = fs.mkdtempSync(path.join(os.tmpdir(), `cookiejar-${crypto.randomBytes(4).toString('hex')}-`));
+    const copy = path.join(scratch, path.basename(dbPath));
+    try {
+        fs.copyFileSync(dbPath, copy);
+        for (const suffix of ['-wal', '-shm']) {
+            if (fs.existsSync(dbPath + suffix))
+                fs.copyFileSync(dbPath + suffix, copy + suffix);
+        }
+        const db = new DatabaseSync(copy, { readOnly: false });
+        try {
+            return fn(db);
+        }
+        finally {
+            db.close();
+        }
+    }
+    finally {
+        fs.rmSync(scratch, { recursive: true, force: true });
+    }
+}
+/** Chromium stores timestamps as microseconds since 1601-01-01. */
+export function webkitToUnix(micros) {
+    const value = typeof micros === 'bigint' ? Number(micros) : micros;
+    if (!value)
+        return 0;
+    return Math.max(0, Math.floor(value / 1_000_000 - 11_644_473_600));
+}
+//# sourceMappingURL=sqlite.js.map

package/dist/core/browsers/sqlite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite.js","sourceRoot":"","sources":["../../../src/core/browsers/sqlite.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAI,MAAc,EAAE,EAA2B;IACzE,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,aAAa,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9G,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9B,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YACtC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC;gBAAE,EAAE,CAAC,YAAY,CAAC,MAAM,GAAG,MAAM,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC;IACH,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,MAAuB;IAClD,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACnE,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC;IACrB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/core/bundles.js

@@ -0,0 +1,116 @@
+import { readAllProfiles } from './browsers/index.js';
+export const bareDomain = (domain) => domain.replace(/^\./, '').toLowerCase();
+/** True when `host` is the selector domain or a subdomain of it. */
+export function domainCovers(selectorDomain, cookieDomain) {
+    const target = bareDomain(selectorDomain);
+    const host = bareDomain(cookieDomain);
+    return host === target || host.endsWith(`.${target}`);
+}
+/** Cookie-spec host matching: `.example.com` cookies are sent to subdomains. */
+export function cookieAppliesToHost(cookie, host) {
+    const cookieHost = bareDomain(cookie.domain);
+    const target = host.toLowerCase();
+    if (cookie.domain.startsWith('.'))
+        return target === cookieHost || target.endsWith(`.${cookieHost}`);
+    return target === cookieHost;
+}
+export function cookieAppliesToPath(cookie, pathname) {
+    const cookiePath = cookie.path || '/';
+    if (cookiePath === '/')
+        return true;
+    if (!pathname.startsWith(cookiePath))
+        return false;
+    return cookiePath.endsWith('/') || pathname.length === cookiePath.length || pathname[cookiePath.length] === '/';
+}
+export const isExpired = (cookie, now = Date.now() / 1000) => cookie.expires !== 0 && cookie.expires < now;
+function matchesSelector(selector, cookie) {
+    if (cookie.profileId !== selector.profileId)
+        return false;
+    if (!domainCovers(selector.domain, cookie.domain))
+        return false;
+    return selector.names.length === 0 || selector.names.includes(cookie.name);
+}
+/**
+ * Reads the bundle's cookies live from the browsers. Nothing is cached, so a
+ * bundle always reflects the current login state and re-authenticating in the
+ * browser is enough to "refresh" an agent's access.
+ */
+export function resolveBundle(bundle, opts = {}) {
+    const profileIds = [...new Set(bundle.selectors.map((s) => s.profileId))];
+    const reads = readAllProfiles(profileIds);
+    const available = reads.flatMap((read) => read.cookies);
+    const seen = new Set();
+    const cookies = [];
+    const emptySelectors = [];
+    for (const selector of bundle.selectors) {
+        const matched = available.filter((cookie) => matchesSelector(selector, cookie));
+        if (matched.length === 0)
+            emptySelectors.push(selector);
+        for (const cookie of matched) {
+            if (!opts.includeExpired && isExpired(cookie))
+                continue;
+            const key = `${cookie.profileId}|${cookie.domain}|${cookie.path}|${cookie.name}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            cookies.push(cookie);
+        }
+    }
+    return {
+        cookies,
+        emptySelectors,
+        errors: reads.filter((r) => r.error).map((r) => ({ profileId: r.profile.id, error: r.error })),
+    };
+}
+/** `curl -b` / yt-dlp / requests compatible cookie jar. */
+export function toNetscape(cookies) {
+    const lines = ['# Netscape HTTP Cookie File', '# Generated by cookiejar. Treat this file as a password.', ''];
+    for (const cookie of cookies) {
+        const includeSubdomains = cookie.domain.startsWith('.') ? 'TRUE' : 'FALSE';
+        const prefix = cookie.httpOnly ? '#HttpOnly_' : '';
+        lines.push([
+            `${prefix}${cookie.domain}`,
+            includeSubdomains,
+            cookie.path || '/',
+            cookie.secure ? 'TRUE' : 'FALSE',
+            String(cookie.expires),
+            cookie.name,
+            cookie.value,
+        ].join('\t'));
+    }
+    return `${lines.join('\n')}\n`;
+}
+/** Playwright / Puppeteer `storageState` shape. */
+export function toStorageState(cookies) {
+    return JSON.stringify({
+        cookies: cookies.map((cookie) => ({
+            name: cookie.name,
+            value: cookie.value,
+            domain: cookie.domain,
+            path: cookie.path || '/',
+            expires: cookie.expires === 0 ? -1 : cookie.expires,
+            httpOnly: cookie.httpOnly,
+            secure: cookie.secure,
+            sameSite: cookie.sameSite === 'Unspecified' ? 'Lax' : cookie.sameSite,
+        })),
+        origins: [],
+    }, null, 2);
+}
+export function cookieHeaderFor(cookies, url) {
+    const target = new URL(url);
+    const https = target.protocol === 'https:';
+    const applicable = cookies
+        .filter((cookie) => cookieAppliesToHost(cookie, target.hostname))
+        .filter((cookie) => cookieAppliesToPath(cookie, target.pathname))
+        .filter((cookie) => (cookie.secure ? https : true))
+        .filter((cookie) => !isExpired(cookie));
+    // A bundle can hold the same cookie name from two browsers; a request may only
+    // carry one, so the first (longest path wins, as browsers do) is used.
+    const byName = new Map();
+    for (const cookie of [...applicable].sort((a, b) => (b.path || '/').length - (a.path || '/').length)) {
+        if (!byName.has(cookie.name))
+            byName.set(cookie.name, cookie);
+    }
+    return [...byName.values()].map((cookie) => `${cookie.name}=${cookie.value}`).join('; ');
+}
+//# sourceMappingURL=bundles.js.map

package/dist/core/bundles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundles.js","sourceRoot":"","sources":["../../src/core/bundles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGtD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAE9F,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAAC,cAAsB,EAAE,YAAoB;IACvE,MAAM,MAAM,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACtC,OAAO,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,IAAY;IAC9D,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,KAAK,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;IACrG,OAAO,MAAM,KAAK,UAAU,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,QAAgB;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC;IACtC,IAAI,UAAU,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,OAAO,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC;AAClH,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAW,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC;AAE5H,SAAS,eAAe,CAAC,QAAwB,EAAE,MAAqB;IACtE,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC7E,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,OAAqC,EAAE;IACnF,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,cAAc,GAAqB,EAAE,CAAC;IAE5C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAChF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC,MAAM,CAAC;gBAAE,SAAS;YACxD,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YACjF,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO;QACP,cAAc;QACd,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAM,EAAE,CAAC,CAAC;KAChG,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,UAAU,CAAC,OAAiB;IAC1C,MAAM,KAAK,GAAG,CAAC,6BAA6B,EAAE,0DAA0D,EAAE,EAAE,CAAC,CAAC;IAC9G,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3E,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,KAAK,CAAC,IAAI,CACR;YACE,GAAG,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE;YAC3B,iBAAiB;YACjB,MAAM,CAAC,IAAI,IAAI,GAAG;YAClB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YAChC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;YACtB,MAAM,CAAC,IAAI;YACX,MAAM,CAAC,KAAK;SACb,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,cAAc,CAAC,OAAiB;IAC9C,OAAO,IAAI,CAAC,SAAS,CACnB;QACE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,GAAG;YACxB,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO;YACnD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ;SACtE,CAAC,CAAC;QACH,OAAO,EAAE,EAAE;KACZ,EACD,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAiB,EAAE,GAAW;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC3C,MAAM,UAAU,GAAG,OAAO;SACvB,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;SAChE,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;SAChE,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SAClD,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,+EAA+E;IAC/E,uEAAuE;IACvE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACrG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3F,CAAC"}

package/dist/core/crypto.js

@@ -0,0 +1,51 @@
+import crypto from 'node:crypto';
+const SCRYPT_PARAMS = { N: 2 ** 17, r: 8, p: 1, maxmem: 256 * 1024 * 1024 };
+const KEY_BYTES = 32;
+// Unicode form used before hashing, so the same typed passphrase always derives the same key.
+const NORMALIZATION = 'NFKC';
+export function deriveKey(passphrase, salt) {
+    return crypto.scryptSync(passphrase.normalize(NORMALIZATION), salt, KEY_BYTES, SCRYPT_PARAMS);
+}
+export function seal(plaintext, key, salt) {
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+    const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    return {
+        kdf: 'scrypt',
+        N: SCRYPT_PARAMS.N,
+        r: SCRYPT_PARAMS.r,
+        p: SCRYPT_PARAMS.p,
+        salt: salt.toString('base64'),
+        iv: iv.toString('base64'),
+        tag: cipher.getAuthTag().toString('base64'),
+        ciphertext: ciphertext.toString('base64'),
+    };
+}
+export function open(box, passphrase) {
+    const salt = Buffer.from(box.salt, 'base64');
+    const key = crypto.scryptSync(passphrase.normalize(NORMALIZATION), salt, KEY_BYTES, {
+        N: box.N,
+        r: box.r,
+        p: box.p,
+        maxmem: SCRYPT_PARAMS.maxmem,
+    });
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, Buffer.from(box.iv, 'base64'));
+    decipher.setAuthTag(Buffer.from(box.tag, 'base64'));
+    const plaintext = Buffer.concat([decipher.update(Buffer.from(box.ciphertext, 'base64')), decipher.final()]).toString('utf8');
+    return { plaintext, key, salt };
+}
+export function newSalt() {
+    return crypto.randomBytes(16);
+}
+export function newToken(prefix = 'cjr') {
+    return `${prefix}_${crypto.randomBytes(24).toString('base64url')}`;
+}
+export function hashToken(token) {
+    return crypto.createHash('sha256').update(token).digest('hex');
+}
+export function tokenMatches(token, hash) {
+    const a = Buffer.from(hashToken(token), 'hex');
+    const b = Buffer.from(hash, 'hex');
+    return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+//# sourceMappingURL=crypto.js.map

package/dist/core/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/core/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAW,CAAC;AACrF,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,8FAA8F;AAC9F,MAAM,aAAa,GAAuC,MAAM,CAAC;AAajE,MAAM,UAAU,SAAS,CAAC,UAAkB,EAAE,IAAY;IACxD,OAAO,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,SAAiB,EAAE,GAAW,EAAE,IAAY;IAC/D,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACrF,OAAO;QACL,GAAG,EAAE,QAAQ;QACb,CAAC,EAAE,aAAa,CAAC,CAAC;QAClB,CAAC,EAAE,aAAa,CAAC,CAAC;QAClB,CAAC,EAAE,aAAa,CAAC,CAAC;QAClB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7B,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC3C,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,GAAc,EAAE,UAAkB;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE;QAClF,CAAC,EAAE,GAAG,CAAC,CAAC;QACR,CAAC,EAAE,GAAG,CAAC,CAAC;QACR,CAAC,EAAE,GAAG,CAAC,CAAC;QACR,MAAM,EAAE,aAAa,CAAC,MAAM;KAC7B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5F,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7H,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,OAAO,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAM,GAAG,KAAK;IACrC,OAAO,GAAG,MAAM,IAAI,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,IAAY;IACtD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/core/paths.js

@@ -0,0 +1,20 @@
+import { homedir } from 'node:os';
+import path from 'node:path';
+import fs from 'node:fs';
+/** Everything cookiejar persists lives under this directory, and nowhere else. */
+export function configDir() {
+    return process.env.COOKIEJAR_HOME ?? path.join(homedir(), '.cookiejar');
+}
+export function vaultPath() {
+    return path.join(configDir(), 'vault.json');
+}
+export function auditPath() {
+    return path.join(configDir(), 'audit.log');
+}
+export function ensureConfigDir() {
+    const dir = configDir();
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    fs.chmodSync(dir, 0o700);
+    return dir;
+}
+//# sourceMappingURL=paths.js.map

package/dist/core/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/core/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,kFAAkF;AAClF,MAAM,UAAU,SAAS;IACvB,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,YAAY,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,WAAW,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/core/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/core/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":""}

package/dist/core/vault.js

@@ -0,0 +1,108 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { ensureConfigDir, vaultPath } from './paths.js';
+import { deriveKey, newSalt, open, seal } from './crypto.js';
+const EMPTY = { version: 1, bundles: [] };
+export class VaultLockedError extends Error {
+    constructor() {
+        super('vault is locked');
+    }
+}
+export class BadPasswordError extends Error {
+    constructor() {
+        super('wrong master password');
+    }
+}
+/**
+ * The encrypted store of bundle definitions and grants. Cookie *values* are
+ * never kept here: they are read live from the browsers on each access, so a
+ * stolen vault file leaks nothing but bundle names and domains.
+ */
+export class Vault {
+    key = null;
+    salt = null;
+    data = null;
+    get exists() {
+        return fs.existsSync(vaultPath());
+    }
+    get unlocked() {
+        return this.key !== null;
+    }
+    create(password) {
+        if (this.exists)
+            throw new Error('vault already exists');
+        this.salt = newSalt();
+        this.key = deriveKey(password, this.salt);
+        this.data = structuredClone(EMPTY);
+        this.persist();
+    }
+    unlock(password) {
+        const file = JSON.parse(fs.readFileSync(vaultPath(), 'utf8'));
+        let opened;
+        try {
+            opened = open(file.box, password);
+        }
+        catch {
+            throw new BadPasswordError();
+        }
+        this.data = JSON.parse(opened.plaintext);
+        this.key = opened.key;
+        this.salt = opened.salt;
+    }
+    lock() {
+        this.key?.fill(0);
+        this.key = null;
+        this.salt = null;
+        this.data = null;
+    }
+    read() {
+        if (!this.data)
+            throw new VaultLockedError();
+        return this.data;
+    }
+    /** Mutates the decrypted data and re-seals the file atomically. */
+    write(mutate) {
+        const data = this.read();
+        mutate(data);
+        this.persist();
+        return data;
+    }
+    bundle(id) {
+        const found = this.read().bundles.find((b) => b.id === id);
+        if (!found)
+            throw new Error(`no such bundle: ${id}`);
+        return found;
+    }
+    changePassword(current, next) {
+        this.unlock(current);
+        const data = this.read();
+        this.salt = newSalt();
+        this.key = deriveKey(next, this.salt);
+        this.data = data;
+        this.persist();
+    }
+    persist() {
+        if (!this.key || !this.salt || !this.data)
+            throw new VaultLockedError();
+        ensureConfigDir();
+        const file = {
+            format: 'cookiejar-vault',
+            createdAt: new Date().toISOString(),
+            box: seal(JSON.stringify(this.data), this.key, this.salt),
+        };
+        const target = vaultPath();
+        const tmp = path.join(path.dirname(target), `.vault.${crypto.randomUUID()}.tmp`);
+        fs.writeFileSync(tmp, JSON.stringify(file, null, 2), { mode: 0o600 });
+        fs.renameSync(tmp, target);
+    }
+}
+export function newBundleId(name) {
+    const slug = name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-|-$/g, '')
+        .slice(0, 32);
+    return `${slug || 'bundle'}-${crypto.randomBytes(3).toString('hex')}`;
+}
+//# sourceMappingURL=vault.js.map

package/dist/core/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/core/vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAkB,MAAM,aAAa,CAAC;AAS7E,MAAM,KAAK,GAAc,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAErD,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC;QACE,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC3B,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC;QACE,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACjC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,KAAK;IACR,GAAG,GAAkB,IAAI,CAAC;IAC1B,IAAI,GAAkB,IAAI,CAAC;IAC3B,IAAI,GAAqB,IAAI,CAAC;IAEtC,IAAI,MAAM;QACR,OAAO,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,QAAgB;QACrB,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,MAAM,CAAC,QAAgB;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAc,CAAC;QAC3E,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAc,CAAC;QACtD,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;IAED,IAAI;QACF,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;QAChB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,IAAI;QACF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,MAAiC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,CAAC;QACb,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,EAAU;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,cAAc,CAAC,OAAe,EAAE,IAAY;QAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;QACxE,eAAe,EAAE,CAAC;QAClB,MAAM,IAAI,GAAc;YACtB,MAAM,EAAE,iBAAiB;YACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC;SAC1D,CAAC;QACF,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjF,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,IAAI,GAAG,IAAI;SACd,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,GAAG,IAAI,IAAI,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACxE,CAAC"}