chrome-tools 1.1.15 → 1.1.16

package/dist/src/modules/local-storage.js

@@ -1,455 +0,0 @@
-import { cpSync, existsSync, mkdtempSync, readdirSync, readFileSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { basename, join } from "node:path";
-import { resolveTargetProfiles } from "../core/chrome.js";
-import { limitResults } from "../core/limit.js";
-const TABLE_MAGIC = 0xdb4775248b80fb57n;
-const LOG_BLOCK_SIZE = 32768;
-const VALUE_TYPE_DELETION = 0;
-const VALUE_TYPE_VALUE = 1;
-/**
- * Reads localStorage key/value pairs from Chrome's Local Storage LevelDB store.
- *
- * @param options - Targeting and filtering options.
- * @returns Array of localStorage entries.
- */
-export function getLocalStorage({ chromeDir, profilePath, profile, browser, origin, url, key, search, limit = 100, } = {}) {
-    const profiles = resolveTargetProfiles({ chromeDir, profilePath, profile, browser });
-    const results = [];
-    const originFilter = normalizeOriginFilter(url || origin);
-    const keyFilter = key?.toLowerCase();
-    const searchFilter = search?.toLowerCase();
-    for (const p of profiles) {
-        const dbPath = join(p.path, "Local Storage", "leveldb");
-        if (!existsSync(dbPath))
-            continue;
-        let tmpPath = null;
-        try {
-            tmpPath = copyLevelDBToTemp(dbPath);
-            const rawRecords = readLevelDBRecords(tmpPath);
-            for (const record of rawRecords.values()) {
-                if (record.deleted || !record.value)
-                    continue;
-                const parsed = parseLocalStorageRecord(record.key, record.value);
-                if (!parsed)
-                    continue;
-                const entry = {
-                    profile: p.name,
-                    origin: parsed.origin,
-                    key: parsed.key,
-                    value: parsed.value,
-                };
-                if (originFilter && !entry.origin.toLowerCase().includes(originFilter)) {
-                    continue;
-                }
-                if (keyFilter && !entry.key.toLowerCase().includes(keyFilter)) {
-                    continue;
-                }
-                if (searchFilter) {
-                    const haystack = `${entry.origin}\n${entry.key}\n${entry.value}`.toLowerCase();
-                    if (!haystack.includes(searchFilter))
-                        continue;
-                }
-                results.push(entry);
-            }
-        }
-        catch {
-            // Skip profiles with unreadable or partially-corrupt LevelDB files.
-        }
-        finally {
-            if (tmpPath) {
-                rmSync(tmpPath, { recursive: true, force: true });
-            }
-        }
-    }
-    results.sort((a, b) => a.profile.localeCompare(b.profile) ||
-        a.origin.localeCompare(b.origin) ||
-        a.key.localeCompare(b.key));
-    return limitResults(results, limit);
-}
-function copyLevelDBToTemp(dbPath) {
-    const tmpPath = mkdtempSync(join(tmpdir(), "chrome-local-storage-"));
-    cpSync(dbPath, tmpPath, {
-        recursive: true,
-        force: true,
-        filter: (source) => basename(source) !== "LOCK",
-    });
-    return tmpPath;
-}
-function readLevelDBRecords(dbPath) {
-    const records = new Map();
-    const files = readdirSync(dbPath)
-        .filter((file) => /\.(log|ldb|sst)$/i.test(file))
-        .sort();
-    for (const file of files) {
-        const filePath = join(dbPath, file);
-        const data = readFileSync(filePath);
-        if (/\.(ldb|sst)$/i.test(file)) {
-            for (const record of parseTableRecords(data)) {
-                applyLevelDBRecord(records, record);
-            }
-        }
-    }
-    for (const file of files) {
-        if (!/\.log$/i.test(file))
-            continue;
-        const filePath = join(dbPath, file);
-        const data = readFileSync(filePath);
-        for (const record of parseLogRecords(data)) {
-            applyLevelDBRecord(records, record);
-        }
-    }
-    return records;
-}
-function applyLevelDBRecord(records, record) {
-    const id = record.key.toString("hex");
-    const existing = records.get(id);
-    if (existing && existing.sequence > record.sequence)
-        return;
-    records.set(id, record);
-}
-function parseLocalStorageRecord(rawKey, rawValue) {
-    if (rawKey.length < 3 || rawKey[0] !== 0x5f)
-        return null;
-    const separator = rawKey.indexOf(0x00, 1);
-    if (separator === -1)
-        return null;
-    const origin = rawKey.subarray(1, separator).toString("utf8");
-    const key = decodeLocalStorageString(rawKey.subarray(separator + 1));
-    const value = decodeLocalStorageString(rawValue);
-    if (!origin || !key)
-        return null;
-    return { origin, key, value };
-}
-function decodeLocalStorageString(data) {
-    if (data.length === 0)
-        return "";
-    const format = data[0];
-    const body = data.subarray(1);
-    if (format === 0x00 && body.length % 2 === 0) {
-        return body.toString("utf16le");
-    }
-    if (format === 0x01) {
-        return body.toString("latin1");
-    }
-    return data.toString("utf8");
-}
-function normalizeOriginFilter(input) {
-    if (!input)
-        return undefined;
-    try {
-        return new URL(input).origin.toLowerCase();
-    }
-    catch {
-        return input.toLowerCase();
-    }
-}
-function parseLogRecords(data) {
-    const records = [];
-    let offset = 0;
-    let fragments = [];
-    while (offset + 7 <= data.length) {
-        const blockRemaining = LOG_BLOCK_SIZE - (offset % LOG_BLOCK_SIZE);
-        if (blockRemaining < 7) {
-            offset += blockRemaining;
-            continue;
-        }
-        const length = data.readUInt16LE(offset + 4);
-        const type = data[offset + 6];
-        offset += 7;
-        if (type === 0 && length === 0) {
-            offset += length;
-            continue;
-        }
-        if (length > data.length - offset || length > blockRemaining - 7) {
-            break;
-        }
-        const payload = data.subarray(offset, offset + length);
-        offset += length;
-        if (type === 1) {
-            records.push(...parseWriteBatch(payload));
-            fragments = [];
-        }
-        else if (type === 2) {
-            fragments = [Buffer.from(payload)];
-        }
-        else if (type === 3 && fragments.length > 0) {
-            fragments.push(Buffer.from(payload));
-        }
-        else if (type === 4 && fragments.length > 0) {
-            fragments.push(Buffer.from(payload));
-            records.push(...parseWriteBatch(Buffer.concat(fragments)));
-            fragments = [];
-        }
-    }
-    return records;
-}
-function parseWriteBatch(batch) {
-    if (batch.length < 12)
-        return [];
-    const records = [];
-    const startSequence = readUInt64LE(batch, 0);
-    const count = batch.readUInt32LE(8);
-    let offset = 12;
-    let seen = 0;
-    while (offset < batch.length && seen < count) {
-        const tag = batch[offset++];
-        const keyPart = readLengthPrefixedSlice(batch, offset);
-        if (!keyPart)
-            break;
-        offset = keyPart.nextOffset;
-        const sequence = startSequence + BigInt(seen);
-        if (tag === VALUE_TYPE_VALUE) {
-            const valuePart = readLengthPrefixedSlice(batch, offset);
-            if (!valuePart)
-                break;
-            offset = valuePart.nextOffset;
-            records.push({ key: keyPart.value, value: valuePart.value, sequence, deleted: false });
-        }
-        else if (tag === VALUE_TYPE_DELETION) {
-            records.push({ key: keyPart.value, sequence, deleted: true });
-        }
-        else {
-            break;
-        }
-        seen++;
-    }
-    return records;
-}
-function parseTableRecords(data) {
-    const records = [];
-    if (data.length < 48)
-        return records;
-    const magic = data.readBigUInt64LE(data.length - 8);
-    if (magic !== TABLE_MAGIC)
-        return records;
-    const footer = data.subarray(data.length - 48, data.length - 8);
-    const metaHandle = readBlockHandle(footer, 0);
-    if (!metaHandle)
-        return records;
-    const indexHandle = readBlockHandle(footer, metaHandle.bytesRead);
-    if (!indexHandle)
-        return records;
-    const indexBlock = readBlock(data, indexHandle);
-    if (!indexBlock)
-        return records;
-    for (const indexEntry of parseBlockEntries(indexBlock)) {
-        const dataHandle = readBlockHandle(indexEntry.value, 0);
-        if (!dataHandle)
-            continue;
-        const dataBlock = readBlock(data, dataHandle);
-        if (!dataBlock)
-            continue;
-        for (const entry of parseBlockEntries(dataBlock)) {
-            if (entry.key.length < 8)
-                continue;
-            const internalKey = entry.key;
-            const tagOffset = internalKey.length - 8;
-            const type = internalKey[tagOffset];
-            const sequence = readSequence(internalKey.subarray(tagOffset));
-            const key = internalKey.subarray(0, tagOffset);
-            if (type === VALUE_TYPE_VALUE) {
-                records.push({ key, value: entry.value, sequence, deleted: false });
-            }
-            else if (type === VALUE_TYPE_DELETION) {
-                records.push({ key, sequence, deleted: true });
-            }
-        }
-    }
-    return records;
-}
-function readBlock(data, handle) {
-    const trailerOffset = handle.offset + handle.size;
-    if (handle.offset < 0 || handle.size < 0 || trailerOffset + 5 > data.length) {
-        return null;
-    }
-    const block = data.subarray(handle.offset, trailerOffset);
-    const compressionType = data[trailerOffset];
-    if (compressionType === 0) {
-        return block;
-    }
-    if (compressionType === 1) {
-        try {
-            return snappyUncompress(block);
-        }
-        catch {
-            return null;
-        }
-    }
-    return null;
-}
-function parseBlockEntries(block) {
-    if (block.length < 4)
-        return [];
-    const restartCount = block.readUInt32LE(block.length - 4);
-    const restartsSize = restartCount * 4 + 4;
-    if (restartCount < 1 || restartsSize > block.length)
-        return [];
-    const entriesEnd = block.length - restartsSize;
-    const entries = [];
-    let offset = 0;
-    let previousKey = Buffer.alloc(0);
-    while (offset < entriesEnd) {
-        const shared = readVarint32(block, offset);
-        if (!shared)
-            break;
-        offset = shared.nextOffset;
-        const nonShared = readVarint32(block, offset);
-        if (!nonShared)
-            break;
-        offset = nonShared.nextOffset;
-        const valueLength = readVarint32(block, offset);
-        if (!valueLength)
-            break;
-        offset = valueLength.nextOffset;
-        if (shared.value > previousKey.length || offset + nonShared.value + valueLength.value > entriesEnd) {
-            break;
-        }
-        const key = Buffer.concat([
-            previousKey.subarray(0, shared.value),
-            block.subarray(offset, offset + nonShared.value),
-        ]);
-        offset += nonShared.value;
-        const value = Buffer.from(block.subarray(offset, offset + valueLength.value));
-        offset += valueLength.value;
-        entries.push({ key, value });
-        previousKey = key;
-    }
-    return entries;
-}
-function readBlockHandle(data, offset) {
-    const blockOffset = readVarint64(data, offset);
-    if (!blockOffset)
-        return null;
-    const blockSize = readVarint64(data, blockOffset.nextOffset);
-    if (!blockSize)
-        return null;
-    if (blockOffset.value > BigInt(Number.MAX_SAFE_INTEGER) || blockSize.value > BigInt(Number.MAX_SAFE_INTEGER)) {
-        return null;
-    }
-    return {
-        offset: Number(blockOffset.value),
-        size: Number(blockSize.value),
-        bytesRead: blockSize.nextOffset - offset,
-    };
-}
-function readLengthPrefixedSlice(data, offset) {
-    const length = readVarint32(data, offset);
-    if (!length)
-        return null;
-    const end = length.nextOffset + length.value;
-    if (end > data.length)
-        return null;
-    return { value: Buffer.from(data.subarray(length.nextOffset, end)), nextOffset: end };
-}
-function readVarint32(data, offset) {
-    let result = 0;
-    let shift = 0;
-    for (let i = offset; i < data.length && i < offset + 5; i++) {
-        const byte = data[i];
-        result |= (byte & 0x7f) << shift;
-        if ((byte & 0x80) === 0) {
-            return { value: result >>> 0, nextOffset: i + 1 };
-        }
-        shift += 7;
-    }
-    return null;
-}
-function readVarint64(data, offset) {
-    let result = 0n;
-    let shift = 0n;
-    for (let i = offset; i < data.length && i < offset + 10; i++) {
-        const byte = data[i];
-        result |= BigInt(byte & 0x7f) << shift;
-        if ((byte & 0x80) === 0) {
-            return { value: result, nextOffset: i + 1 };
-        }
-        shift += 7n;
-    }
-    return null;
-}
-function readUInt64LE(data, offset) {
-    let value = 0n;
-    for (let i = 0; i < 8; i++) {
-        value |= BigInt(data[offset + i] || 0) << BigInt(i * 8);
-    }
-    return value;
-}
-function readSequence(tagBytes) {
-    let sequence = 0n;
-    for (let i = 1; i < 8; i++) {
-        sequence |= BigInt(tagBytes[i] || 0) << BigInt((i - 1) * 8);
-    }
-    return sequence;
-}
-function snappyUncompress(input) {
-    const expectedLength = readVarint32(input, 0);
-    if (!expectedLength)
-        throw new Error("Invalid Snappy length");
-    const output = Buffer.alloc(expectedLength.value);
-    let ip = expectedLength.nextOffset;
-    let op = 0;
-    while (ip < input.length && op < output.length) {
-        const tag = input[ip++];
-        const type = tag & 0x03;
-        if (type === 0) {
-            let literalLength = tag >> 2;
-            if (literalLength < 60) {
-                literalLength += 1;
-            }
-            else {
-                const bytesToRead = literalLength - 59;
-                if (ip + bytesToRead > input.length)
-                    throw new Error("Invalid Snappy literal");
-                literalLength = 1;
-                for (let i = 0; i < bytesToRead; i++) {
-                    literalLength += input[ip++] << (i * 8);
-                }
-            }
-            if (ip + literalLength > input.length || op + literalLength > output.length) {
-                throw new Error("Invalid Snappy literal length");
-            }
-            input.copy(output, op, ip, ip + literalLength);
-            ip += literalLength;
-            op += literalLength;
-            continue;
-        }
-        let copyLength;
-        let copyOffset;
-        if (type === 1) {
-            if (ip >= input.length)
-                throw new Error("Invalid Snappy copy");
-            copyLength = ((tag >> 2) & 0x07) + 4;
-            copyOffset = ((tag & 0xe0) << 3) | input[ip++];
-        }
-        else if (type === 2) {
-            if (ip + 2 > input.length)
-                throw new Error("Invalid Snappy copy");
-            copyLength = (tag >> 2) + 1;
-            copyOffset = input.readUInt16LE(ip);
-            ip += 2;
-        }
-        else {
-            if (ip + 4 > input.length)
-                throw new Error("Invalid Snappy copy");
-            copyLength = (tag >> 2) + 1;
-            copyOffset = input.readUInt32LE(ip);
-            ip += 4;
-        }
-        if (copyOffset <= 0 || copyOffset > op || op + copyLength > output.length) {
-            throw new Error("Invalid Snappy offset");
-        }
-        for (let i = 0; i < copyLength; i++) {
-            output[op] = output[op - copyOffset];
-            op++;
-        }
-    }
-    if (op !== output.length)
-        throw new Error("Truncated Snappy stream");
-    return output;
-}
-export const _test = {
-    decodeLocalStorageString,
-    parseLocalStorageRecord,
-    parseLogRecords,
-};

package/dist/src/modules/passwords.d.ts

@@ -1,50 +0,0 @@
-import { type ResolveProfilesOptions } from "../core/chrome.js";
-export interface PasswordOptions extends ResolveProfilesOptions {
-    search?: string;
-    decryptionKey?: Buffer;
-}
-/** Which on-disk store a password came from. */
-export type PasswordSource = "device" | "account";
-export interface PasswordEntry {
-    profile: string;
-    /** "device" = local "Login Data"; "account" = synced "Login Data For Account". */
-    source?: PasswordSource;
-    url?: string;
-    username?: string;
-    password?: string;
-    lastUsed?: string;
-    error?: string;
-}
-/** What a single password store looked like when it was read. */
-export interface PasswordStoreReport {
-    /** The User Data directory searched; "default" when the platform picked it. */
-    root: string;
-    profile: string;
-    /** "Login Data" (device) or "Login Data For Account" (synced). */
-    file: string;
-    source: PasswordSource;
-    exists: boolean;
-    /** Rows in `logins`, before any search filter. Null when the read failed. */
-    rows: number | null;
-    /** Why the read failed, when it did. No credential value is ever included. */
-    error?: string;
-}
-/**
- * Reports what a `getPasswords` call would read, and what it could not.
- *
- * `getPasswords` skips a store it cannot open — a missing file, a schema it does
- * not know, a database another process is holding — and an empty result cannot
- * tell "nothing saved here" from "could not look". This runs the same profile
- * resolution and opens the same databases, and answers with row counts and
- * errors only. It decrypts nothing, so no password value can escape through it.
- */
-export declare function describePasswordStores({ chromeDir, profilePath, profile, browser, }?: PasswordOptions): PasswordStoreReport[];
-/**
- * Extracts and decrypts saved passwords from Chrome's password databases.
- * Reads both the device-local and account-synced stores, labelling each entry
- * with its `source` (no de-duplication across the two).
- *
- * @param options - Options for profile selection and filtering.
- * @returns Array of decrypted password entries.
- */
-export declare function getPasswords({ chromeDir, profilePath, profile, search, browser, decryptionKey, }?: PasswordOptions): PasswordEntry[];

package/dist/src/modules/passwords.js

@@ -1,198 +0,0 @@
-import { existsSync, readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { discoverProfiles, resolveTargetProfiles, } from "../core/chrome.js";
-import { deriveEncryptionKey, decryptValue } from "../core/platform/index.js";
-import { chromeTimeToDate } from "../core/crypto.js";
-import { queryDatabase } from "../core/db.js";
-/**
- * Chrome stores saved passwords in two SQLite files per profile:
- *   - "Login Data"             — passwords kept on this device only.
- *   - "Login Data For Account" — passwords synced to the signed-in Google Account.
- * Both share the same `logins` schema and v10 encryption, so we read both and
- * tag each entry with its source.
- */
-const PASSWORD_STORES = [
-    { file: "Login Data", source: "device" },
-    { file: "Login Data For Account", source: "account" },
-];
-/** Where a CDP launcher keeps the User Data directory it drives Chrome with. */
-const AUTOMATION_DIR = join(homedir(), ".chrome_cdp_profile");
-/** …and where it records a relocated one. */
-const AUTOMATION_CONFIG = join(homedir(), ".config", "chrome-cdp-manager", "config.json");
-/** `CHROME_AUTOMATION_DIR` values meaning "do not look there at all". */
-const AUTOMATION_OFF = ["0", "off", "none", "false"];
-/**
- * The automation profile tree, on a machine that has one.
- *
- * Most machines do not: no CDP launcher is installed, the directory was never
- * created, or it exists but holds no profile yet. All three answer undefined,
- * which leaves the search exactly as it was before this existed — the everyday
- * profile, alone. Nothing here is required for a plain Chrome install.
- *
- * `CHROME_AUTOMATION_DIR` names the tree explicitly, and `off` (or `0`, `none`,
- * `false`) skips it even where one exists.
- */
-function automationChromeDir() {
-    const override = process.env.CHROME_AUTOMATION_DIR?.trim();
-    if (override && AUTOMATION_OFF.includes(override.toLowerCase()))
-        return undefined;
-    const dir = override || configuredAutomationDir() || AUTOMATION_DIR;
-    // Holding a profile is what makes it a tree worth reading — an absent or
-    // empty directory would otherwise add a root every lookup searches for
-    // nothing, and turn a missing `--profile` into a spurious refusal.
-    return discoverProfiles(dir).length > 0 ? dir : undefined;
-}
-/** The profile directory a CDP launcher was configured with, if it says. */
-function configuredAutomationDir() {
-    try {
-        const stored = JSON.parse(readFileSync(AUTOMATION_CONFIG, "utf-8"));
-        return typeof stored.profileDir === "string" && stored.profileDir ? stored.profileDir : undefined;
-    }
-    catch {
-        // No launcher config, or an unreadable one: fall back to its default path.
-        return undefined;
-    }
-}
-/**
- * The User Data directories a lookup reads, in order.
- *
- * The automation tree first, then the everyday one. A Chrome driven over CDP
- * keeps its own profile tree, so a login saved while signing in to that window
- * is stored there and nowhere else — looking only at the everyday tree could
- * not find it. Naming a directory or a browser answers "which tree?" outright,
- * and is used as given.
- */
-function passwordRoots(userDataDir, browser) {
-    const roots = [];
-    const automation = userDataDir || browser ? undefined : automationChromeDir();
-    if (automation)
-        roots.push(automation);
-    roots.push(userDataDir);
-    return roots;
-}
-/**
- * Reports what a `getPasswords` call would read, and what it could not.
- *
- * `getPasswords` skips a store it cannot open — a missing file, a schema it does
- * not know, a database another process is holding — and an empty result cannot
- * tell "nothing saved here" from "could not look". This runs the same profile
- * resolution and opens the same databases, and answers with row counts and
- * errors only. It decrypts nothing, so no password value can escape through it.
- */
-export function describePasswordStores({ chromeDir, profilePath, profile, browser, } = {}) {
-    const userDataDir = profilePath || chromeDir;
-    const reports = [];
-    for (const root of passwordRoots(userDataDir, browser)) {
-        let profiles;
-        try {
-            profiles = resolveTargetProfiles({ chromeDir: root, profile, browser });
-        }
-        catch (error) {
-            reports.push({
-                root: root ?? "default",
-                profile: profile ?? "*",
-                file: "*",
-                source: "device",
-                exists: false,
-                rows: null,
-                error: error instanceof Error ? error.message : String(error),
-            });
-            continue;
-        }
-        for (const p of profiles) {
-            for (const store of PASSWORD_STORES) {
-                const dbPath = join(p.path, store.file);
-                const report = {
-                    root: root ?? "default",
-                    profile: p.name,
-                    file: store.file,
-                    source: store.source,
-                    exists: existsSync(dbPath),
-                    rows: null,
-                };
-                try {
-                    report.rows = queryDatabase(dbPath, "SELECT COUNT(*) AS n FROM logins")[0]?.n ?? 0;
-                }
-                catch (error) {
-                    report.error = error instanceof Error ? error.message : String(error);
-                }
-                reports.push(report);
-            }
-        }
-    }
-    return reports;
-}
-/**
- * Extracts and decrypts saved passwords from Chrome's password databases.
- * Reads both the device-local and account-synced stores, labelling each entry
- * with its `source` (no de-duplication across the two).
- *
- * @param options - Options for profile selection and filtering.
- * @returns Array of decrypted password entries.
- */
-export function getPasswords({ chromeDir, profilePath, profile, search, browser, decryptionKey, } = {}) {
-    const userDataDir = profilePath || chromeDir;
-    const roots = passwordRoots(userDataDir, browser);
-    const results = [];
-    const term = search?.toLowerCase();
-    // A named profile missing from one tree is not a failure while another is
-    // still to come — but a profile in none of them is still an error, so the
-    // first refusal is kept and raised if no tree resolved at all.
-    let refusal;
-    let resolved = false;
-    for (const root of roots) {
-        let profiles;
-        try {
-            profiles = resolveTargetProfiles({ chromeDir: root, profile, browser });
-        }
-        catch (error) {
-            refusal ??= error;
-            continue;
-        }
-        resolved = true;
-        // Per root: on Windows the key comes from that tree's own Local State.
-        let derivedKey = decryptionKey;
-        for (const p of profiles) {
-            for (const store of PASSWORD_STORES) {
-                const dbPath = join(p.path, store.file);
-                try {
-                    const rows = queryDatabase(dbPath, `SELECT origin_url, username_value, password_value, date_last_used
-             FROM logins ORDER BY origin_url`);
-                    for (const row of rows) {
-                        // Matched before anything is decrypted. Both columns the search
-                        // looks at — the origin and the username — are stored in the clear,
-                        // so a row that cannot match never needs its password read at all.
-                        //
-                        // Decrypting first cost one platform decryption per stored login on
-                        // the way to finding one: a store with a few hundred entries spent
-                        // upwards of ten seconds answering "what is the password for this
-                        // one site", and every one of those decryptions was thrown away by
-                        // the filter immediately below.
-                        if (term &&
-                            !(row.origin_url && row.origin_url.toLowerCase().includes(term)) &&
-                            !(row.username_value && row.username_value.toLowerCase().includes(term))) {
-                            continue;
-                        }
-                        results.push({
-                            profile: p.name,
-                            source: store.source,
-                            url: row.origin_url,
-                            username: row.username_value,
-                            password: row.password_value?.length > 0
-                                ? decryptValue(row.password_value, derivedKey ??= deriveEncryptionKey(root, browser))
-                                : "",
-                            lastUsed: chromeTimeToDate(row.date_last_used || 0),
-                        });
-                    }
-                }
-                catch {
-                    // Skip missing or unreadable stores and continue with the others.
-                }
-            }
-        }
-    }
-    if (!resolved && refusal)
-        throw refusal;
-    return results;
-}