@zenalexa/unicli 0.217.0 → 0.218.0

package/dist/engine/chromium-cookies-platform.js

@@ -0,0 +1,315 @@
+/**
+ * Per-platform Chromium cookie key derivation, keystore lookup, and decrypt.
+ *
+ * The three platforms diverge meaningfully:
+ *
+ *   macOS  — Keychain `security` CLI → password (≤24 ASCII chars)
+ *            PBKDF2-SHA1(saltysalt, 1003, 16) → 16-byte AES key
+ *            v10/v11 prefix + AES-128-CBC + IV=16×0x20 + PKCS7
+ *            32-byte SHA256 integrity prefix on plaintext (M122+)
+ *
+ *   Linux  — libsecret/KWallet via `secret-tool` → password
+ *              fallback to literal "peanuts" if no keyring (Chromium HEAD)
+ *            PBKDF2-SHA1(saltysalt, **1**, 16) → 16-byte AES key   (CRITICAL)
+ *            v10/v11 prefix + AES-128-CBC + IV=16×0x20 + PKCS7
+ *            NO integrity prefix
+ *
+ *   Windows — `Local State` → os_crypt.encrypted_key (base64)
+ *             strip "DPAPI" 5-byte prefix
+ *             CryptUnprotectData(CurrentUser) via PowerShell → 32-byte master
+ *             v10 prefix + 12-byte nonce + AES-256-GCM(ct + 16-byte tag, master)
+ *             32-byte SHA256 integrity prefix on plaintext
+ *             v20 (Chrome 127+ App-Bound Encryption) is BLOCKED for external
+ *             processes by design; we surface encryption_unsupported and
+ *             suggest CDP fallback rather than ship a brittle bypass.
+ *
+ * All three platforms validate the prefix bytes to detect format drift early.
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { createDecipheriv, pbkdf2Sync } from "node:crypto";
+import { ChromiumCookieError, } from "./chromium-cookies-types.js";
+export function currentPlatform() {
+    const p = process.platform;
+    if (p === "darwin" || p === "linux" || p === "win32")
+        return p;
+    throw new ChromiumCookieError("encryption_unsupported", `unsupported platform: ${p}`, "Direct cookie reads work on macOS, Linux, and Windows. Use CDP fallback elsewhere.");
+}
+/**
+ * Look up a browser's encryption secret. Returns either a passphrase string
+ * (macOS / Linux) or a 32-byte master key Buffer (Windows). The caller's
+ * `deriveKey` knows which to expect based on the platform.
+ *
+ * Result is memoized per (browser, platform, userDataRoot) for the lifetime
+ * of the process — Keychain prompts and DPAPI calls cost ~30-100 ms each, so
+ * an audit walking 135 adapters with the same browser would otherwise spend
+ * seconds re-fetching the same secret. Tests can clear via `_resetSecretCache`.
+ */
+const secretCache = new Map();
+export function _resetSecretCache() {
+    secretCache.clear();
+}
+export function getEncryptionSecret(browser, platform, spec, userDataRoot) {
+    const cacheKey = `${platform}:${browser}:${userDataRoot}`;
+    const cached = secretCache.get(cacheKey);
+    if (cached)
+        return cached;
+    let secret;
+    switch (platform) {
+        case "darwin":
+            secret = macSecurityLookup(browser, spec);
+            break;
+        case "linux":
+            secret = linuxSecretLookup(browser, spec);
+            break;
+        case "win32":
+            secret = winDpapiLookup(browser, spec, userDataRoot);
+            break;
+    }
+    secretCache.set(cacheKey, secret);
+    return secret;
+}
+/* macOS ------------------------------------------------------------------- */
+function macSecurityLookup(browser, spec) {
+    const labels = spec.macLabels ?? [];
+    const accounts = spec.macAccounts ?? [];
+    let lastError = "";
+    for (const label of labels) {
+        for (const account of accounts) {
+            try {
+                const args = ["find-generic-password", "-w", "-s", label];
+                if (account)
+                    args.push("-a", account);
+                const out = execFileSync("/usr/bin/security", args, {
+                    encoding: "utf8",
+                    stdio: ["ignore", "pipe", "pipe"],
+                });
+                const trimmed = out.trim();
+                if (trimmed)
+                    return trimmed;
+            }
+            catch (err) {
+                lastError = err.message;
+            }
+        }
+    }
+    throw new ChromiumCookieError("keychain_denied", `no Safe Storage password for ${browser}: ${lastError || "not found"}`, `Try: security find-generic-password -wa "${accounts[0] ?? browser}" -s "${labels[0] ?? `${browser} Safe Storage`}"`);
+}
+/* Linux ------------------------------------------------------------------- */
+function linuxSecretLookup(_browser, spec) {
+    const app = spec.linuxApp;
+    const schema = spec.linuxSchema ?? "chrome_libsecret_os_crypt_password_v2";
+    if (app) {
+        try {
+            const out = execFileSync("secret-tool", ["lookup", "application", app, "xdg:schema", schema], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+            const trimmed = out.trim();
+            if (trimmed)
+                return trimmed;
+        }
+        catch {
+            // Fall through to peanuts — secret-tool missing or no entry.
+        }
+    }
+    // Chromium HEAD `posix_key_provider.cc` literal: when no keyring backend is
+    // available, the v10 password is the ASCII string "peanuts". That gives us
+    // best-effort access on headless boxes / containers without a keyring.
+    return "peanuts";
+}
+/* Windows ----------------------------------------------------------------- */
+function winDpapiLookup(browser, spec, userDataRoot) {
+    const localStateRel = spec.winLocalStateRel ?? "Local State";
+    const localStatePath = join(userDataRoot, localStateRel);
+    if (!existsSync(localStatePath)) {
+        throw new ChromiumCookieError("keychain_denied", `${browser}: Local State not found at ${localStatePath}`, "Open the browser at least once so it writes its master key, then retry.");
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(localStatePath, "utf8"));
+    }
+    catch (err) {
+        throw new ChromiumCookieError("keychain_denied", `${browser}: cannot parse Local State: ${err.message}`, "Local State is corrupt; close the browser and retry, or reset the profile.");
+    }
+    const enc = parsed.os_crypt?.encrypted_key;
+    if (!enc) {
+        throw new ChromiumCookieError("keychain_denied", `${browser}: Local State has no os_crypt.encrypted_key`, "The browser hasn't written a v10 master key. Sign into a site once, then retry.");
+    }
+    const wrapped = Buffer.from(enc, "base64");
+    // Strip "DPAPI" (5-byte prefix added since M55).
+    if (wrapped.length < 5 ||
+        wrapped.subarray(0, 5).toString("ascii") !== "DPAPI") {
+        throw new ChromiumCookieError("encryption_unsupported", `${browser}: encrypted_key missing DPAPI prefix`, "Likely an app-bound (v20) install. Use CDP via `unicli browser start`.");
+    }
+    const ciphertext = wrapped.subarray(5);
+    return dpapiUnprotect(ciphertext);
+}
+/**
+ * Run DPAPI CryptUnprotectData(CurrentUser) without a native module.
+ * Shells PowerShell to call `[System.Security.Cryptography.ProtectedData]`.
+ * Slow (~80 ms) but zero-install.
+ */
+function dpapiUnprotect(ciphertext) {
+    const b64 = ciphertext.toString("base64");
+    const ps = [
+        "$ErrorActionPreference='Stop'",
+        "Add-Type -AssemblyName System.Security",
+        `$b=[Convert]::FromBase64String('${b64}')`,
+        "$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,'CurrentUser')",
+        "[Convert]::ToBase64String($p)",
+    ].join(";");
+    let out;
+    try {
+        out = execFileSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", ps], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    }
+    catch (err) {
+        throw new ChromiumCookieError("decrypt_failed", `DPAPI unprotect failed: ${err.message}`, "Run as the same user that owns the profile. Cross-user DPAPI is intentionally blocked.");
+    }
+    return Buffer.from(out.trim(), "base64");
+}
+/* -------------------------------------------------------------------------- */
+/*  Key derivation                                                            */
+/* -------------------------------------------------------------------------- */
+const SALT = "saltysalt";
+const KEY_LEN_128 = 16;
+const KEY_LEN_256 = 32;
+/**
+ * Derive the AES key from the platform secret. macOS uses 1003 PBKDF2
+ * iterations; Linux uses **1** iteration (Chromium's
+ * `kEncryptionIterations = 1` for `freedesktop_secret_key_provider.cc`).
+ * Windows passes through — DPAPI already returned a 32-byte master.
+ */
+export function deriveKey(secret, platform) {
+    if (platform === "win32") {
+        if (typeof secret === "string") {
+            throw new ChromiumCookieError("decrypt_failed", "Windows expects a 32-byte master key, got a string", "This is an internal bug; report it.");
+        }
+        if (secret.length !== KEY_LEN_256) {
+            throw new ChromiumCookieError("decrypt_failed", `Windows master key has unexpected length ${secret.length} (want 32)`, "Likely a corrupted Local State; reset the browser profile.");
+        }
+        return secret;
+    }
+    const password = typeof secret === "string" ? secret : secret.toString("utf8");
+    const iterations = platform === "darwin" ? 1003 : 1;
+    return pbkdf2Sync(password, SALT, iterations, KEY_LEN_128, "sha1");
+}
+/* -------------------------------------------------------------------------- */
+/*  Decrypt                                                                   */
+/* -------------------------------------------------------------------------- */
+const IV_CBC = Buffer.alloc(16, 0x20);
+const INTEGRITY_PREFIX_LEN = 32;
+/**
+ * Decrypt a single Chromium-encrypted cookie value.
+ *
+ *  • Empty buffer        → empty string
+ *  • No `vNN` prefix     → raw bytes (legacy unencrypted)
+ *  • `v10`/`v11` macOS   → AES-128-CBC, strip 32-byte SHA256 prefix when present
+ *  • `v10`/`v11` Linux   → AES-128-CBC, NO integrity prefix
+ *  • `v10`        Win    → AES-256-GCM with 12-byte nonce + 16-byte tag,
+ *                          strip 32-byte SHA256 prefix
+ *  • `v20`        Win    → encryption_unsupported (App-Bound Encryption)
+ */
+export function decryptValue(encrypted, key, platform) {
+    if (encrypted.length === 0)
+        return "";
+    const prefix = encrypted.subarray(0, 3).toString("ascii");
+    if (prefix !== "v10" && prefix !== "v11") {
+        if (/^v\d/.test(prefix)) {
+            throw new ChromiumCookieError("encryption_unsupported", `unsupported cookie encryption version "${prefix}"` +
+                (prefix === "v20"
+                    ? " (Chrome 127+ App-Bound Encryption blocks external decrypt)"
+                    : ""), prefix === "v20"
+                ? "Use CDP: `unicli browser start` then `unicli auth import` once Chrome is logged in."
+                : "Open the site in your browser and try CDP fallback, or downgrade the browser.");
+        }
+        return encrypted.toString("utf8");
+    }
+    const body = encrypted.subarray(3);
+    const plain = platform === "win32" ? decryptGcm(body, key) : decryptCbc(body, key);
+    // macOS + Windows prepend a 32-byte SHA256 integrity hash before the value.
+    // Linux does not. Heuristic: if the first 32 bytes contain any non-printable
+    // byte (the SHA256 of any value almost always does), strip them. ASCII-only
+    // first 32 bytes are almost surely real cookie content.
+    if (platform !== "linux" &&
+        plain.length >= INTEGRITY_PREFIX_LEN &&
+        hasNonPrintable(plain.subarray(0, INTEGRITY_PREFIX_LEN))) {
+        return plain.subarray(INTEGRITY_PREFIX_LEN).toString("utf8");
+    }
+    return plain.toString("utf8");
+}
+function decryptCbc(ciphertext, key) {
+    const decipher = createDecipheriv("aes-128-cbc", key, IV_CBC);
+    try {
+        return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    }
+    catch (err) {
+        throw new ChromiumCookieError("decrypt_failed", `AES-128-CBC decrypt failed: ${err.message}`, "The Keychain key may be wrong; revoke and re-grant Keychain access.");
+    }
+}
+function decryptGcm(ciphertext, key) {
+    if (ciphertext.length < 12 + 16) {
+        throw new ChromiumCookieError("decrypt_failed", `GCM ciphertext too short (${ciphertext.length} bytes)`, "Cookie blob is malformed; the Cookies DB may be corrupt.");
+    }
+    const nonce = ciphertext.subarray(0, 12);
+    const tag = ciphertext.subarray(ciphertext.length - 16);
+    const ct = ciphertext.subarray(12, ciphertext.length - 16);
+    const decipher = createDecipheriv("aes-256-gcm", key, nonce);
+    decipher.setAuthTag(tag);
+    try {
+        return Buffer.concat([decipher.update(ct), decipher.final()]);
+    }
+    catch (err) {
+        throw new ChromiumCookieError("decrypt_failed", `AES-256-GCM decrypt failed: ${err.message}`, "The DPAPI master key may be wrong (cross-user DPAPI is blocked) or this is a v20 cookie.");
+    }
+}
+function hasNonPrintable(buf) {
+    for (const b of buf) {
+        if (b < 0x20 || b > 0x7e)
+            return true;
+    }
+    return false;
+}
+/* -------------------------------------------------------------------------- */
+/*  Per-browser keystore specs                                                */
+/* -------------------------------------------------------------------------- */
+export const KEYSTORE_SPECS = {
+    chrome: {
+        macLabels: ["Chrome Safe Storage"],
+        macAccounts: ["Chrome"],
+        linuxApp: "chrome",
+        winLocalStateRel: "Local State",
+    },
+    brave: {
+        macLabels: ["Brave Safe Storage"],
+        macAccounts: ["Brave"],
+        linuxApp: "brave",
+        winLocalStateRel: "Local State",
+    },
+    edge: {
+        macLabels: ["Microsoft Edge Safe Storage"],
+        macAccounts: ["Microsoft Edge"],
+        linuxApp: "microsoft-edge",
+        winLocalStateRel: "Local State",
+    },
+    arc: {
+        macLabels: ["Arc Safe Storage"],
+        macAccounts: ["Arc"],
+        // No Linux/Windows Arc build as of 2026-05.
+        winLocalStateRel: "Local State",
+    },
+    dia: {
+        macLabels: ["Dia Safe Storage"],
+        macAccounts: ["Dia"],
+        winLocalStateRel: "Local State",
+    },
+    atlas: {
+        macLabels: [
+            "Atlas Safe Storage",
+            "ChatGPT Atlas Safe Storage",
+            "OpenAI Atlas Safe Storage",
+            "ChatGPT Safe Storage",
+        ],
+        macAccounts: ["Atlas", "ChatGPT", "OpenAI"],
+        winLocalStateRel: "Local State",
+    },
+};
+//# sourceMappingURL=chromium-cookies-platform.js.map

package/dist/engine/chromium-cookies-platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chromium-cookies-platform.js","sourceRoot":"","sources":["../../src/engine/chromium-cookies-platform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EACL,mBAAmB,GAEpB,MAAM,6BAA6B,CAAC;AAIrC,MAAM,UAAU,eAAe;IAC7B,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC;IAC/D,MAAM,IAAI,mBAAmB,CAC3B,wBAAwB,EACxB,yBAAyB,CAAC,EAAE,EAC5B,oFAAoF,CACrF,CAAC;AACJ,CAAC;AAsBD;;;;;;;;;GASG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEvD,MAAM,UAAU,iBAAiB;IAC/B,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAkB,EAClB,QAAkB,EAClB,IAAkB,EAClB,YAAoB;IAEpB,MAAM,QAAQ,GAAG,GAAG,QAAQ,IAAI,OAAO,IAAI,YAAY,EAAE,CAAC;IAC1D,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,MAAuB,CAAC;IAC5B,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,MAAM,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC1C,MAAM;QACR,KAAK,OAAO;YACV,MAAM,GAAG,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC1C,MAAM;QACR,KAAK,OAAO;YACV,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;YACrD,MAAM;IACV,CAAC;IACD,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,OAAkB,EAAE,IAAkB;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;IACxC,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC1D,IAAI,OAAO;oBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;gBACtC,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,EAAE,IAAI,EAAE;oBAClD,QAAQ,EAAE,MAAM;oBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;iBAClC,CAAC,CAAC;gBACH,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,IAAI,OAAO;oBAAE,OAAO,OAAO,CAAC;YAC9B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAI,GAAa,CAAC,OAAO,CAAC;YACrC,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,IAAI,mBAAmB,CAC3B,iBAAiB,EACjB,gCAAgC,OAAO,KAAK,SAAS,IAAI,WAAW,EAAE,EACtE,4CAA4C,QAAQ,CAAC,CAAC,CAAC,IAAI,OAAO,SAAS,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,eAAe,GAAG,CACrH,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,SAAS,iBAAiB,CAAC,QAAmB,EAAE,IAAkB;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,IAAI,uCAAuC,CAAC;IAC3E,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CACtB,aAAa,EACb,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,EACpD,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACxD,CAAC;YACF,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;IACH,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+EAA+E;AAE/E,SAAS,cAAc,CACrB,OAAkB,EAClB,IAAkB,EAClB,YAAoB;IAEpB,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,IAAI,aAAa,CAAC;IAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;IACzD,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,mBAAmB,CAC3B,iBAAiB,EACjB,GAAG,OAAO,8BAA8B,cAAc,EAAE,EACxD,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,MAAiD,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAkB,CAAC;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAC3B,iBAAiB,EACjB,GAAG,OAAO,+BAAgC,GAAa,CAAC,OAAO,EAAE,EACjE,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;IAC3C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,mBAAmB,CAC3B,iBAAiB,EACjB,GAAG,OAAO,6CAA6C,EACvD,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3C,iDAAiD;IACjD,IACE,OAAO,CAAC,MAAM,GAAG,CAAC;QAClB,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,OAAO,EACpD,CAAC;QACD,MAAM,IAAI,mBAAmB,CAC3B,wBAAwB,EACxB,GAAG,OAAO,sCAAsC,EAChD,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,UAAkB;IACxC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG;QACT,+BAA+B;QAC/B,wCAAwC;QACxC,mCAAmC,GAAG,IAAI;QAC1C,oFAAoF;QACpF,+BAA+B;KAChC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAChB,gBAAgB,EAChB,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,EAAE,CAAC,EACjD,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACxD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,EAChB,2BAA4B,GAAa,CAAC,OAAO,EAAE,EACnD,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,MAAM,IAAI,GAAG,WAAW,CAAC;AACzB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,MAAuB,EAAE,QAAkB;IACnE,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,EAChB,oDAAoD,EACpD,qCAAqC,CACtC,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAClC,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,EAChB,4CAA4C,MAAM,CAAC,MAAM,YAAY,EACrE,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,QAAQ,GACZ,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;AACrE,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;AACtC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAC1B,SAAiB,EACjB,GAAW,EACX,QAAkB;IAElB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACzC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,mBAAmB,CAC3B,wBAAwB,EACxB,0CAA0C,MAAM,GAAG;gBACjD,CAAC,MAAM,KAAK,KAAK;oBACf,CAAC,CAAC,6DAA6D;oBAC/D,CAAC,CAAC,EAAE,CAAC,EACT,MAAM,KAAK,KAAK;gBACd,CAAC,CAAC,qFAAqF;gBACvF,CAAC,CAAC,+EAA+E,CACpF,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,KAAK,GACT,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEvE,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,wDAAwD;IACxD,IACE,QAAQ,KAAK,OAAO;QACpB,KAAK,CAAC,MAAM,IAAI,oBAAoB;QACpC,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,EACxD,CAAC;QACD,OAAO,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,UAAU,CAAC,UAAkB,EAAE,GAAW;IACjD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,EAChB,+BAAgC,GAAa,CAAC,OAAO,EAAE,EACvD,qEAAqE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,UAAkB,EAAE,GAAW;IACjD,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,EAChB,6BAA6B,UAAU,CAAC,MAAM,SAAS,EACvD,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,EAChB,+BAAgC,GAAa,CAAC,OAAO,EAAE,EACvD,0FAA0F,CAC3F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI;YAAE,OAAO,IAAI,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,cAAc,GAAoC;IAC7D,MAAM,EAAE;QACN,SAAS,EAAE,CAAC,qBAAqB,CAAC;QAClC,WAAW,EAAE,CAAC,QAAQ,CAAC;QACvB,QAAQ,EAAE,QAAQ;QAClB,gBAAgB,EAAE,aAAa;KAChC;IACD,KAAK,EAAE;QACL,SAAS,EAAE,CAAC,oBAAoB,CAAC;QACjC,WAAW,EAAE,CAAC,OAAO,CAAC;QACtB,QAAQ,EAAE,OAAO;QACjB,gBAAgB,EAAE,aAAa;KAChC;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,CAAC,6BAA6B,CAAC;QAC1C,WAAW,EAAE,CAAC,gBAAgB,CAAC;QAC/B,QAAQ,EAAE,gBAAgB;QAC1B,gBAAgB,EAAE,aAAa;KAChC;IACD,GAAG,EAAE;QACH,SAAS,EAAE,CAAC,kBAAkB,CAAC;QAC/B,WAAW,EAAE,CAAC,KAAK,CAAC;QACpB,4CAA4C;QAC5C,gBAAgB,EAAE,aAAa;KAChC;IACD,GAAG,EAAE;QACH,SAAS,EAAE,CAAC,kBAAkB,CAAC;QAC/B,WAAW,EAAE,CAAC,KAAK,CAAC;QACpB,gBAAgB,EAAE,aAAa;KAChC;IACD,KAAK,EAAE;QACL,SAAS,EAAE;YACT,oBAAoB;YACpB,4BAA4B;YAC5B,2BAA2B;YAC3B,sBAAsB;SACvB;QACD,WAAW,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;QAC3C,gBAAgB,EAAE,aAAa;KAChC;CACF,CAAC"}

package/dist/engine/chromium-cookies-types.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Shared types for the chromium-cookies module. Split out to break a
+ * circular import between `chromium-cookies.ts` (orchestration) and
+ * `chromium-cookies-platform.ts` (per-platform crypto + keystore).
+ */
+export type BrowserId = "chrome" | "brave" | "edge" | "arc" | "dia" | "atlas";
+export interface CookieRow {
+    host: string;
+    name: string;
+    value: string;
+    path: string;
+    expires: number;
+    secure: boolean;
+    httpOnly: boolean;
+}
+export interface ReadOptions {
+    browser: BrowserId;
+    domain: string;
+    profile?: string;
+}
+export declare class ChromiumCookieError extends Error {
+    readonly code: "browser_not_installed" | "no_profile" | "keychain_denied" | "encryption_unsupported" | "sqlite_failed" | "decrypt_failed" | "platform_unsupported";
+    readonly suggestion?: string | undefined;
+    constructor(code: "browser_not_installed" | "no_profile" | "keychain_denied" | "encryption_unsupported" | "sqlite_failed" | "decrypt_failed" | "platform_unsupported", message: string, suggestion?: string | undefined);
+}
+//# sourceMappingURL=chromium-cookies-types.d.ts.map

package/dist/engine/chromium-cookies-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chromium-cookies-types.d.ts","sourceRoot":"","sources":["../../src/engine/chromium-cookies-types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;AAE9E,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,SAAS,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,mBAAoB,SAAQ,KAAK;aAE1B,IAAI,EAChB,uBAAuB,GACvB,YAAY,GACZ,iBAAiB,GACjB,wBAAwB,GACxB,eAAe,GACf,gBAAgB,GAChB,sBAAsB;aAEV,UAAU,CAAC,EAAE,MAAM;gBATnB,IAAI,EAChB,uBAAuB,GACvB,YAAY,GACZ,iBAAiB,GACjB,wBAAwB,GACxB,eAAe,GACf,gBAAgB,GAChB,sBAAsB,EAC1B,OAAO,EAAE,MAAM,EACC,UAAU,CAAC,EAAE,MAAM,YAAA;CAKtC"}

package/dist/engine/chromium-cookies-types.js

@@ -0,0 +1,16 @@
+/**
+ * Shared types for the chromium-cookies module. Split out to break a
+ * circular import between `chromium-cookies.ts` (orchestration) and
+ * `chromium-cookies-platform.ts` (per-platform crypto + keystore).
+ */
+export class ChromiumCookieError extends Error {
+    code;
+    suggestion;
+    constructor(code, message, suggestion) {
+        super(message);
+        this.code = code;
+        this.suggestion = suggestion;
+        this.name = "ChromiumCookieError";
+    }
+}
+//# sourceMappingURL=chromium-cookies-types.js.map

package/dist/engine/chromium-cookies-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chromium-cookies-types.js","sourceRoot":"","sources":["../../src/engine/chromium-cookies-types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAoBH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAE1B;IASA;IAVlB,YACkB,IAOU,EAC1B,OAAe,EACC,UAAmB;QAEnC,KAAK,CAAC,OAAO,CAAC,CAAC;QAXC,SAAI,GAAJ,IAAI,CAOM;QAEV,eAAU,GAAV,UAAU,CAAS;QAGnC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF"}

package/dist/engine/chromium-cookies.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Direct Chromium cookie reader (macOS / Linux / Windows).
+ *
+ * Reads encrypted cookies from a browser's local SQLite DB and decrypts them
+ * with the browser's platform-native key store. No CDP, no extension, no
+ * browser launch — works whether the browser is open or closed.
+ *
+ *   macOS    keychain `security` CLI → AES-128-CBC + 32-byte SHA256 prefix
+ *   Linux    libsecret `secret-tool` (peanuts fallback) → AES-128-CBC, no prefix, PBKDF2 iter=1
+ *   Windows  Local State + DPAPI → AES-256-GCM + 32-byte SHA256 prefix
+ *            v20 cookies (Chrome 127+ App-Bound) surface as
+ *            encryption_unsupported with a CDP-fallback suggestion
+ *
+ * SQLite is read by copy-then-open via the system `sqlite3` binary so that
+ * an open browser cannot block the read; WAL/SHM siblings are copied too.
+ *
+ * Tests at tests/unit/chromium-cookies.test.ts cover the pure path
+ * (deriveKey vector, decrypt round-trips per platform, profile picker,
+ * resolveCookieDb error codes).
+ */
+import { type BrowserId, type CookieRow, type ReadOptions } from "./chromium-cookies-types.js";
+import { type Platform } from "./chromium-cookies-platform.js";
+export { ChromiumCookieError, type BrowserId, type CookieRow, type ReadOptions, } from "./chromium-cookies-types.js";
+export { decryptValue, deriveKey, type Platform, } from "./chromium-cookies-platform.js";
+/**
+ * Enumerate available profiles for a browser. Returns the directory names
+ * (e.g. "Default", "Profile 1") that contain a Cookies file, sorted by
+ * Cookies-file mtime descending (most-recently-active first).
+ */
+export declare function listProfiles(browser: BrowserId): string[];
+export declare function resolveCookieDb(browser: BrowserId, profile?: string): {
+    dbPath: string;
+    profile: string;
+    userDataRoot: string;
+    platform: Platform;
+};
+/**
+ * Read all cookies for a domain from a browser's local DB.
+ * Returns full structured rows for callers that want secure/httpOnly metadata.
+ */
+export declare function readCookies(opts: ReadOptions): CookieRow[];
+/**
+ * Convenience: read cookies for a domain and flatten to a name→value record,
+ * matching the shape that engine/cookies.ts already passes to fetch headers.
+ * Last-write-wins on duplicate names (later host_key entries override earlier).
+ */
+export declare function readCookiesAsRecord(opts: ReadOptions): Record<string, string>;
+/** All known browser ids in priority order for auto-discovery. */
+export declare const BROWSER_IDS: readonly BrowserId[];
+/**
+ * Find any installed browser whose profile DB exists. Used by the auto path
+ * when the caller doesn't specify --browser. Returns [] if no Chromium
+ * browser is installed locally, or if the platform isn't supported.
+ */
+export declare function detectInstalledBrowsers(): BrowserId[];
+//# sourceMappingURL=chromium-cookies.d.ts.map

package/dist/engine/chromium-cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chromium-cookies.d.ts","sourceRoot":"","sources":["../../src/engine/chromium-cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAcH,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAML,KAAK,QAAQ,EACd,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,mBAAmB,EACnB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,YAAY,EACZ,SAAS,EACT,KAAK,QAAQ,GACd,MAAM,gCAAgC,CAAC;AA6FxC;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,EAAE,CA+BzD;AAkBD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,SAAS,EAClB,OAAO,CAAC,EAAE,MAAM,GACf;IACD,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,QAAQ,CAAC;CACpB,CAmCA;AAuID;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,SAAS,EAAE,CAmC1D;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM7E;AAED,kEAAkE;AAClE,eAAO,MAAM,WAAW,EAAE,SAAS,SAAS,EAOlC,CAAC;AAEX;;;;GAIG;AACH,wBAAgB,uBAAuB,IAAI,SAAS,EAAE,CAWrD"}