@sriinnu/runic 1.0.0

package/Packages/Silo/Sources/Silo/ChromiumCookieReader.swift

@@ -0,0 +1,240 @@
+import Foundation
+import SQLite3
+
+/// Shared Chromium cookie reader for all platforms.
+/// Platform-specific decryptors are injected via `ChromiumCookieDecrypting`.
+protocol ChromiumCookieDecrypting: Sendable {
+    var hasKey: Bool { get }
+    func decrypt(data: Data) -> String?
+}
+
+/// Reads Chromium-based cookie stores and returns normalized cookie records.
+struct ChromiumCookieReader {
+    func readCookies(
+        store: BrowserCookieStore,
+        browser: Browser,
+        decryptor: ChromiumCookieDecrypting,
+        decryptionFailurePolicy: BrowserCookieDecryptionFailurePolicy,
+        requireKeyForEncrypted: Bool) throws -> [BrowserCookieRecord]
+    {
+        guard let databaseURL = store.databaseURL else {
+            throw BrowserCookieError.notFound(
+                browser: browser,
+                details: "Missing cookie database URL.")
+        }
+
+        let snapshot = SQLiteSnapshot.prepare(from: databaseURL)
+        defer { snapshot.cleanup() }
+
+        var db: OpaquePointer?
+        if sqlite3_open_v2(snapshot.readURL.path, &db, SQLITE_OPEN_READONLY, nil) != SQLITE_OK {
+            throw BrowserCookieError.loadFailed(
+                browser: browser,
+                details: "Unable to open cookies database.")
+        }
+        defer { sqlite3_close(db) }
+
+        let availableColumns = Self.fetchColumns(db: db, table: "cookies")
+        let select = Self.selectColumns(available: availableColumns)
+        let query = "SELECT \(select.columns.joined(separator: ", ")) FROM cookies"
+        var statement: OpaquePointer?
+        guard sqlite3_prepare_v2(db, query, -1, &statement, nil) == SQLITE_OK else {
+            throw BrowserCookieError.loadFailed(
+                browser: browser,
+                details: "Unable to read cookies table.")
+        }
+        defer { sqlite3_finalize(statement) }
+
+        let index = select.index
+        let partitionKeyColumn = select.partitionKeyColumn
+        var records: [BrowserCookieRecord] = []
+        var usedEncryptedValues = false
+        var failedDecryptions = 0
+
+        while sqlite3_step(statement) == SQLITE_ROW {
+            let hostKey = columnText(statement, index["host_key"] ?? 0) ?? ""
+            let name = columnText(statement, index["name"] ?? 1) ?? ""
+            let path = columnText(statement, index["path"] ?? 2) ?? ""
+            let value = columnText(statement, index["value"] ?? 3) ?? ""
+            let encrypted = columnBlob(statement, index["encrypted_value"] ?? 4)
+            let encryptedLength = columnBlobLength(statement, index["encrypted_value"] ?? 4)
+            let expiresUtc = columnInt64(statement, index["expires_utc"] ?? 5) ?? 0
+            let isSecure = (columnInt(statement, index["is_secure"] ?? 6) ?? 0) != 0
+            let isHttpOnly = (columnInt(statement, index["is_httponly"] ?? 7) ?? 0) != 0
+            let sameSiteValue = columnInt(statement, index["samesite"] ?? 8) ?? 0
+
+            let decryptedValue: String
+            if value.isEmpty, let encrypted = encrypted, encryptedLength > 0 {
+                usedEncryptedValues = true
+                let data = Data(bytes: encrypted, count: encryptedLength)
+                if let decrypted = decryptor.decrypt(data: data) {
+                    decryptedValue = decrypted
+                } else {
+                    failedDecryptions += 1
+                    continue
+                }
+            } else {
+                decryptedValue = value
+            }
+
+            if hostKey.isEmpty || name.isEmpty {
+                continue
+            }
+
+            let expires = Self.date(fromChromiumTimestamp: expiresUtc)
+            let sameSite = Self.sameSite(from: sameSiteValue)
+            let createdAt = columnInt64(statement, index["creation_utc"]).flatMap(Self.date(fromChromiumTimestamp:))
+            let lastAccessedAt = columnInt64(statement, index["last_access_utc"]).flatMap(Self.date(fromChromiumTimestamp:))
+            let priorityValue = columnInt(statement, index["priority"]).map { Int($0) }
+            let priority = priorityValue.map(BrowserCookiePriority.init(rawValue:))
+            let isSameParty = columnInt(statement, index["is_same_party"]).map { $0 != 0 }
+            let partitionKey = partitionKeyColumn.flatMap { columnText(statement, index[$0]) }
+
+            records.append(BrowserCookieRecord(
+                domain: hostKey,
+                name: name,
+                path: path.isEmpty ? "/" : path,
+                value: decryptedValue,
+                expires: expires,
+                createdAt: createdAt,
+                lastAccessedAt: lastAccessedAt,
+                isSecure: isSecure,
+                isHTTPOnly: isHttpOnly,
+                sameSite: sameSite,
+                priority: priority,
+                partitionKey: partitionKey,
+                isSameParty: isSameParty))
+        }
+
+        if usedEncryptedValues, requireKeyForEncrypted, !decryptor.hasKey {
+            throw BrowserCookieError.accessDenied(
+                browser: browser,
+                details: "Keychain access required to decrypt cookies.")
+        }
+
+        if failedDecryptions > 0 {
+            if decryptionFailurePolicy == .strict {
+                throw BrowserCookieError.loadFailed(
+                    browser: browser,
+                    details: "Failed to decrypt \(failedDecryptions) cookie value(s).")
+            }
+            if usedEncryptedValues, records.isEmpty {
+                throw BrowserCookieError.loadFailed(
+                    browser: browser,
+                    details: "Unable to decrypt cookie values.")
+            }
+        }
+
+        return records
+    }
+
+    static func date(fromChromiumTimestamp timestamp: Int64) -> Date? {
+        guard timestamp > 0 else { return nil }
+        let seconds = Double(timestamp) / 1_000_000
+        return chromiumEpoch.addingTimeInterval(seconds)
+    }
+
+    static func sameSite(from value: Int32) -> BrowserCookieSameSite? {
+        switch value {
+        case 1:
+            return .lax
+        case 2:
+            return .strict
+        case 3:
+            return BrowserCookieSameSite.none
+        default:
+            return nil
+        }
+    }
+
+    private static let chromiumEpoch: Date = {
+        var components = DateComponents()
+        components.year = 1601
+        components.month = 1
+        components.day = 1
+        components.calendar = Calendar(identifier: .gregorian)
+        components.timeZone = TimeZone(secondsFromGMT: 0)
+        return components.date ?? Date(timeIntervalSince1970: 0)
+    }()
+
+    private struct ChromiumSelect {
+        let columns: [String]
+        let index: [String: Int]
+        let partitionKeyColumn: String?
+    }
+
+    private static func fetchColumns(db: OpaquePointer?, table: String) -> Set<String> {
+        guard let db else { return [] }
+        var columns = Set<String>()
+        let query = "PRAGMA table_info(\(table));"
+        var statement: OpaquePointer?
+        if sqlite3_prepare_v2(db, query, -1, &statement, nil) == SQLITE_OK {
+            while sqlite3_step(statement) == SQLITE_ROW {
+                if let name = sqlite3_column_text(statement, 1) {
+                    columns.insert(String(cString: name))
+                }
+            }
+        }
+        sqlite3_finalize(statement)
+        return columns
+    }
+
+    private static func selectColumns(available: Set<String>) -> ChromiumSelect {
+        var columns = [
+            "host_key",
+            "name",
+            "path",
+            "value",
+            "encrypted_value",
+            "expires_utc",
+            "is_secure",
+            "is_httponly",
+            "samesite",
+        ]
+
+        for name in ["creation_utc", "last_access_utc", "priority", "is_same_party"] {
+            if available.contains(name) {
+                columns.append(name)
+            }
+        }
+
+        var partitionKeyColumn: String?
+        if available.contains("partition_key") {
+            partitionKeyColumn = "partition_key"
+            columns.append("partition_key")
+        } else if available.contains("top_frame_site_key") {
+            partitionKeyColumn = "top_frame_site_key"
+            columns.append("top_frame_site_key")
+        }
+
+        let index = Dictionary(uniqueKeysWithValues: columns.enumerated().map { ($1, $0) })
+        return ChromiumSelect(columns: columns, index: index, partitionKeyColumn: partitionKeyColumn)
+    }
+
+    private func columnText(_ statement: OpaquePointer?, _ index: Int?) -> String? {
+        guard let index, sqlite3_column_type(statement, Int32(index)) != SQLITE_NULL,
+              let text = sqlite3_column_text(statement, Int32(index)) else {
+            return nil
+        }
+        let value = String(cString: text)
+        return value.isEmpty ? nil : value
+    }
+
+    private func columnInt(_ statement: OpaquePointer?, _ index: Int?) -> Int32? {
+        guard let index, sqlite3_column_type(statement, Int32(index)) != SQLITE_NULL else { return nil }
+        return sqlite3_column_int(statement, Int32(index))
+    }
+
+    private func columnInt64(_ statement: OpaquePointer?, _ index: Int?) -> Int64? {
+        guard let index, sqlite3_column_type(statement, Int32(index)) != SQLITE_NULL else { return nil }
+        return sqlite3_column_int64(statement, Int32(index))
+    }
+
+    private func columnBlob(_ statement: OpaquePointer?, _ index: Int) -> UnsafeRawPointer? {
+        sqlite3_column_blob(statement, Int32(index))
+    }
+
+    private func columnBlobLength(_ statement: OpaquePointer?, _ index: Int) -> Int {
+        Int(sqlite3_column_bytes(statement, Int32(index)))
+    }
+}

package/Packages/Silo/Sources/Silo/CryptoSupport.swift

@@ -0,0 +1,86 @@
+import Foundation
+
+#if canImport(CommonCrypto)
+import CommonCrypto
+#endif
+
+#if canImport(CryptoKit)
+import CryptoKit
+#elseif canImport(CryptoSwift)
+import CryptoSwift
+#endif
+
+enum CryptoSupport {
+    static func decryptAESCBC(payload: Data, key: Data, iv: Data) -> Data? {
+        #if canImport(CommonCrypto)
+        var outLength: size_t = 0
+        var outData = Data(count: payload.count + kCCBlockSizeAES128)
+        let outCapacity = outData.count
+        let status = outData.withUnsafeMutableBytes { outBytes in
+            payload.withUnsafeBytes { payloadBytes in
+                iv.withUnsafeBytes { ivBytes in
+                    key.withUnsafeBytes { keyBytes in
+                        CCCrypt(
+                            CCOperation(kCCDecrypt),
+                            CCAlgorithm(kCCAlgorithmAES),
+                            CCOptions(kCCOptionPKCS7Padding),
+                            keyBytes.baseAddress,
+                            key.count,
+                            ivBytes.baseAddress,
+                            payloadBytes.baseAddress,
+                            payload.count,
+                            outBytes.baseAddress,
+                            outCapacity,
+                            &outLength)
+                    }
+                }
+            }
+        }
+        guard status == kCCSuccess else { return nil }
+        outData.removeSubrange(outLength..<outData.count)
+        return outData
+        #elseif canImport(CryptoSwift)
+        do {
+            let aes = try AES(
+                key: Array(key),
+                blockMode: CBC(iv: Array(iv)),
+                padding: .pkcs7)
+            let decrypted = try aes.decrypt(Array(payload))
+            return Data(decrypted)
+        } catch {
+            return nil
+        }
+        #else
+        return nil
+        #endif
+    }
+
+    static func decryptAESGCM(payload: Data, key: Data) -> Data? {
+        guard payload.count >= 12 + 16 else { return nil }
+        let nonce = payload.prefix(12)
+        let cipherTag = payload.dropFirst(12)
+        let ciphertext = cipherTag.dropLast(16)
+        let tag = cipherTag.suffix(16)
+        #if canImport(CryptoKit)
+        do {
+            let nonce = try AES.GCM.Nonce(data: nonce)
+            let sealedBox = try AES.GCM.SealedBox(nonce: nonce, ciphertext: ciphertext, tag: tag)
+            return try AES.GCM.open(sealedBox, using: SymmetricKey(data: key))
+        } catch {
+            return nil
+        }
+        #elseif canImport(CryptoSwift)
+        do {
+            let gcm = GCM(iv: Array(nonce), mode: .combined)
+            let aes = try AES(key: Array(key), blockMode: gcm, padding: .noPadding)
+            let combined = Array(ciphertext) + Array(tag)
+            let decrypted = try aes.decrypt(combined)
+            return Data(decrypted)
+        } catch {
+            return nil
+        }
+        #else
+        return nil
+        #endif
+    }
+}

package/Packages/Silo/Sources/Silo/FirefoxCookieReader.swift

@@ -0,0 +1,172 @@
+import Foundation
+import SQLite3
+
+/// Shared Firefox cookie reader for all platforms.
+struct FirefoxCookieReader {
+    func readCookies(store: BrowserCookieStore) throws -> [BrowserCookieRecord] {
+        guard let databaseURL = store.databaseURL else {
+            throw BrowserCookieError.notFound(
+                browser: store.browser,
+                details: "Missing cookie database URL.")
+        }
+        let snapshot = SQLiteSnapshot.prepare(from: databaseURL)
+        defer { snapshot.cleanup() }
+
+        var db: OpaquePointer?
+        if sqlite3_open_v2(snapshot.readURL.path, &db, SQLITE_OPEN_READONLY, nil) != SQLITE_OK {
+            throw BrowserCookieError.loadFailed(
+                browser: store.browser,
+                details: "Unable to open cookies database.")
+        }
+        defer { sqlite3_close(db) }
+
+        let availableColumns = Self.fetchColumns(db: db, table: "moz_cookies")
+        let hostOnlyColumn = Self.hostOnlyColumn(in: availableColumns)
+        let selectColumns = Self.selectColumns(hostOnlyColumn: hostOnlyColumn, available: availableColumns)
+        let query = "SELECT \(selectColumns.joined(separator: ", ")) FROM moz_cookies"
+        var statement: OpaquePointer?
+        guard sqlite3_prepare_v2(db, query, -1, &statement, nil) == SQLITE_OK else {
+            throw BrowserCookieError.loadFailed(
+                browser: store.browser,
+                details: "Unable to read cookies table.")
+        }
+        defer { sqlite3_finalize(statement) }
+
+        let index = Dictionary(uniqueKeysWithValues: selectColumns.enumerated().map { ($1, $0) })
+        let hostOnlyIndex = hostOnlyColumn.flatMap { index[$0] }
+        var records: [BrowserCookieRecord] = []
+        while sqlite3_step(statement) == SQLITE_ROW {
+            let host = columnText(statement, index["host"] ?? 0) ?? ""
+            let name = columnText(statement, index["name"] ?? 1) ?? ""
+            let path = columnText(statement, index["path"] ?? 2) ?? ""
+            let value = columnText(statement, index["value"] ?? 3) ?? ""
+            let expirySeconds = columnInt64(statement, index["expiry"] ?? 4) ?? 0
+            let isSecure = (columnInt(statement, index["isSecure"] ?? 5) ?? 0) != 0
+            let isHttpOnly = (columnInt(statement, index["isHttpOnly"] ?? 6) ?? 0) != 0
+            let sameSiteValue = columnInt(statement, index["sameSite"] ?? 7) ?? 0
+            let isHostOnlyOverride: Bool?
+            if hostOnlyColumn == "isHostOnly", let index = hostOnlyIndex {
+                isHostOnlyOverride = (columnInt(statement, index) ?? 0) != 0
+            } else if hostOnlyColumn == "isDomain", let index = hostOnlyIndex {
+                let isDomain = (columnInt(statement, index) ?? 0) != 0
+                isHostOnlyOverride = !isDomain
+            } else {
+                isHostOnlyOverride = nil
+            }
+
+            if host.isEmpty || name.isEmpty {
+                continue
+            }
+
+            let expires = expirySeconds > 0 ? Date(timeIntervalSince1970: Double(expirySeconds)) : nil
+            let sameSite = Self.sameSite(from: sameSiteValue)
+            let createdAt = columnInt64(statement, index["creationTime"]).flatMap(Self.date(fromFirefoxTimestamp:))
+            let lastAccessedAt = columnInt64(statement, index["lastAccessed"]).flatMap(Self.date(fromFirefoxTimestamp:))
+            let priorityValue = columnInt(statement, index["priority"]).map { Int($0) }
+            let priority = priorityValue.map(BrowserCookiePriority.init(rawValue:))
+            let partitionKey = columnText(statement, index["partitionKey"])
+            let isSameParty = columnInt(statement, index["isSameParty"]).map { $0 != 0 }
+
+            records.append(BrowserCookieRecord(
+                domain: host,
+                name: name,
+                path: path.isEmpty ? "/" : path,
+                value: value,
+                expires: expires,
+                createdAt: createdAt,
+                lastAccessedAt: lastAccessedAt,
+                isSecure: isSecure,
+                isHTTPOnly: isHttpOnly,
+                isHostOnly: isHostOnlyOverride,
+                sameSite: sameSite,
+                priority: priority,
+                partitionKey: partitionKey,
+                isSameParty: isSameParty))
+        }
+
+        return records
+    }
+
+    private static func sameSite(from value: Int32) -> BrowserCookieSameSite? {
+        switch value {
+        case 0:
+            return BrowserCookieSameSite.none
+        case 1:
+            return .lax
+        case 2:
+            return .strict
+        default:
+            return nil
+        }
+    }
+
+    private static func fetchColumns(db: OpaquePointer?, table: String) -> Set<String> {
+        guard let db else { return [] }
+        var columns = Set<String>()
+        let query = "PRAGMA table_info(\(table));"
+        var statement: OpaquePointer?
+        if sqlite3_prepare_v2(db, query, -1, &statement, nil) == SQLITE_OK {
+            while sqlite3_step(statement) == SQLITE_ROW {
+                if let name = sqlite3_column_text(statement, 1) {
+                    columns.insert(String(cString: name))
+                }
+            }
+        }
+        sqlite3_finalize(statement)
+        return columns
+    }
+
+    private static func hostOnlyColumn(in columns: Set<String>) -> String? {
+        if columns.contains("isHostOnly") {
+            return "isHostOnly"
+        }
+        if columns.contains("isDomain") {
+            return "isDomain"
+        }
+        return nil
+    }
+
+    private static func selectColumns(hostOnlyColumn: String?, available: Set<String>) -> [String] {
+        var columns = [
+            "host",
+            "name",
+            "path",
+            "value",
+            "expiry",
+            "isSecure",
+            "isHttpOnly",
+            "sameSite",
+        ]
+        if let hostOnlyColumn {
+            columns.append(hostOnlyColumn)
+        }
+        for name in ["creationTime", "lastAccessed", "priority", "partitionKey", "isSameParty"] where available.contains(name) {
+            columns.append(name)
+        }
+        return columns
+    }
+
+    private static func date(fromFirefoxTimestamp timestamp: Int64) -> Date? {
+        guard timestamp > 0 else { return nil }
+        return Date(timeIntervalSince1970: Double(timestamp) / 1_000_000)
+    }
+
+    private func columnText(_ statement: OpaquePointer?, _ index: Int?) -> String? {
+        guard let index, sqlite3_column_type(statement, Int32(index)) != SQLITE_NULL,
+              let text = sqlite3_column_text(statement, Int32(index)) else {
+            return nil
+        }
+        let value = String(cString: text)
+        return value.isEmpty ? nil : value
+    }
+
+    private func columnInt(_ statement: OpaquePointer?, _ index: Int?) -> Int32? {
+        guard let index, sqlite3_column_type(statement, Int32(index)) != SQLITE_NULL else { return nil }
+        return sqlite3_column_int(statement, Int32(index))
+    }
+
+    private func columnInt64(_ statement: OpaquePointer?, _ index: Int?) -> Int64? {
+        guard let index, sqlite3_column_type(statement, Int32(index)) != SQLITE_NULL else { return nil }
+        return sqlite3_column_int64(statement, Int32(index))
+    }
+}

package/Packages/Silo/Sources/Silo/LinuxChromiumCookieReader.swift

@@ -0,0 +1,172 @@
+#if os(Linux)
+import Foundation
+import SQLite3
+#if canImport(CryptoSwift)
+import CryptoSwift
+#endif
+
+struct LinuxChromiumCookieReader {
+    func readCookies(
+        store: BrowserCookieStore,
+        decryptionFailurePolicy: BrowserCookieDecryptionFailurePolicy = .bestEffort) throws -> [BrowserCookieRecord]
+    {
+        let reader = ChromiumCookieReader()
+        let decryptor = LinuxChromiumDecryptor(browser: store.browser, databaseURL: store.databaseURL)
+        return try reader.readCookies(
+            store: store,
+            browser: store.browser,
+            decryptor: decryptor,
+            decryptionFailurePolicy: decryptionFailurePolicy,
+            requireKeyForEncrypted: false)
+    }
+}
+
+private struct LinuxChromiumDecryptor: ChromiumCookieDecrypting {
+    private static let salt = "saltysalt".data(using: .utf8) ?? Data()
+    private static let iterations: Int = 1
+    private static let keyLength: Int = 16
+
+    let legacyKey: Data?
+    let gcmKey: Data?
+
+    var hasKey: Bool { legacyKey != nil || gcmKey != nil }
+
+    init(browser: Browser, databaseURL: URL?) {
+        let password = Self.safeStoragePassword(for: browser)
+        self.legacyKey = password.flatMap { Self.deriveKey(from: $0) }
+        if let databaseURL {
+            self.gcmKey = Self.readLocalStateKey(databaseURL: databaseURL, legacyKey: self.legacyKey)
+        } else {
+            self.gcmKey = nil
+        }
+    }
+
+    func decrypt(data: Data) -> String? {
+        guard data.count > 3 else { return nil }
+        let prefix = data.prefix(3)
+        guard let prefixString = String(data: prefix, encoding: .utf8),
+              prefixString == "v10" || prefixString == "v11" else {
+            return nil
+        }
+
+        let payload = Data(data.dropFirst(3))
+        if let gcmKey, let plaintext = Self.decryptGCM(payload: payload, key: gcmKey) {
+            return plaintext
+        }
+        if let legacyKey, let plaintext = Self.decryptCBC(payload: payload, key: legacyKey) {
+            return plaintext
+        }
+        return nil
+    }
+
+    private static func decryptCBC(payload: Data, key: Data) -> String? {
+        let iv = Data(repeating: 0x20, count: 16)
+        guard let data = CryptoSupport.decryptAESCBC(payload: payload, key: key, iv: iv) else { return nil }
+        return String(decoding: data, as: UTF8.self)
+    }
+
+    private static func decryptGCM(payload: Data, key: Data) -> String? {
+        guard let data = CryptoSupport.decryptAESGCM(payload: payload, key: key) else { return nil }
+        return String(decoding: data, as: UTF8.self)
+    }
+
+    private static func safeStoragePassword(for browser: Browser) -> String? {
+        if let env = ProcessInfo.processInfo.environment["SILO_CHROME_SAFE_STORAGE"], !env.isEmpty {
+            return env
+        }
+        let candidates = secretServiceNames(for: browser)
+        if let value = LinuxSecretService.lookupPassword(applications: candidates) {
+            return value
+        }
+        if allowInsecureFallback() {
+            return "peanuts"
+        }
+        return nil
+    }
+
+    private static func secretServiceNames(for browser: Browser) -> [String] {
+        switch browser {
+        case .chrome, .chromeBeta, .chromeCanary:
+            return ["chrome", "google-chrome", "Chrome"]
+        case .chromium:
+            return ["chromium", "Chromium"]
+        case .brave, .braveBeta, .braveNightly:
+            return ["brave", "Brave"]
+        case .edge, .edgeBeta, .edgeCanary:
+            return ["edge", "microsoft-edge", "Edge"]
+        case .vivaldi:
+            return ["vivaldi", "Vivaldi"]
+        case .helium:
+            return ["Helium"]
+        case .arc, .arcBeta, .arcCanary, .chatgptAtlas, .safari, .firefox:
+            return ["chromium"]
+        }
+    }
+
+    private static func allowInsecureFallback() -> Bool {
+        let value = ProcessInfo.processInfo.environment["SILO_ALLOW_INSECURE_CHROMIUM_FALLBACK"] ?? ""
+        let normalized = value.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
+        return ["1", "true", "yes"].contains(normalized)
+    }
+
+    private static func deriveKey(from password: String) -> Data? {
+        #if canImport(CryptoSwift)
+        do {
+            let key = try PKCS5.PBKDF2(
+                password: Array(password.utf8),
+                salt: Array(salt),
+                iterations: iterations,
+                keyLength: keyLength,
+                variant: .sha1).calculate()
+            return Data(key)
+        } catch {
+            return nil
+        }
+        #else
+        return nil
+        #endif
+    }
+
+    private static func readLocalStateKey(databaseURL: URL, legacyKey: Data?) -> Data? {
+        guard let localStateURL = localStateURL(for: databaseURL),
+              let data = try? Data(contentsOf: localStateURL),
+              let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
+              let osCrypt = json["os_crypt"] as? [String: Any],
+              let encryptedKeyBase64 = osCrypt["encrypted_key"] as? String,
+              let encryptedKeyData = Data(base64Encoded: encryptedKeyBase64) else {
+            return nil
+        }
+
+        var keyData = encryptedKeyData
+        let dpapiPrefix = "DPAPI".data(using: .utf8) ?? Data()
+        if keyData.starts(with: dpapiPrefix) {
+            keyData = Data(keyData.dropFirst(dpapiPrefix.count))
+        }
+
+        if keyData.count == 32 {
+            return keyData
+        }
+
+        if keyData.count >= 3,
+           let prefix = String(data: keyData.prefix(3), encoding: .utf8),
+           (prefix == "v10" || prefix == "v11"),
+           let legacyKey,
+           let decrypted = CryptoSupport.decryptAESCBC(
+                payload: Data(keyData.dropFirst(3)),
+                key: legacyKey,
+                iv: Data(repeating: 0x20, count: 16)) {
+            return decrypted.count == 32 ? decrypted : nil
+        }
+
+        return nil
+    }
+
+    private static func localStateURL(for databaseURL: URL) -> URL? {
+        let parent = databaseURL.deletingLastPathComponent()
+        let profileURL = parent.lastPathComponent == "Network" ? parent.deletingLastPathComponent() : parent
+        let rootURL = profileURL.deletingLastPathComponent()
+        let localStateURL = rootURL.appendingPathComponent("Local State")
+        return FileManager.default.fileExists(atPath: localStateURL.path) ? localStateURL : nil
+    }
+}
+#endif