chrome-tools 1.1.15 → 1.1.16

package/dist/src/core/crypto.js

@@ -1,152 +0,0 @@
-import { createDecipheriv } from "node:crypto";
-const AES_IV = Buffer.alloc(16, " "); // 16 spaces (0x20)
-// Windows AES-256-GCM layout: "v10" prefix + 12-byte nonce + ciphertext + 16-byte tag.
-const GCM_NONCE_LENGTH = 12;
-const GCM_TAG_LENGTH = 16;
-/**
- * Decrypts a password/value buffer encrypted by Chrome on macOS or Linux.
- * Chrome v10+ prefixes the encrypted blob with "v10" or "v11", followed by
- * AES-128-CBC ciphertext. (Windows uses AES-256-GCM — see decryptValueBufferGcm.)
- *
- * @param encryptedBlob - The encrypted blob from the database.
- * @param derivedKey - The derived 16-byte key.
- * @returns The decrypted plaintext, or an error placeholder.
- */
-export function decryptValue(encryptedBlob, derivedKey) {
-    const decrypted = decryptValueBuffer(encryptedBlob, derivedKey);
-    return Buffer.isBuffer(decrypted) ? decrypted.toString("utf-8") : decrypted;
-}
-/**
- * Decrypts a Chrome encrypted blob and returns the raw plaintext bytes.
- *
- * @param encryptedBlob - The encrypted blob from the database.
- * @param derivedKey - The derived 16-byte key.
- * @returns The decrypted plaintext bytes, or an error placeholder.
- */
-export function decryptValueBuffer(encryptedBlob, derivedKey) {
-    if (!encryptedBlob || encryptedBlob.length === 0) {
-        return Buffer.alloc(0);
-    }
-    const blob = Buffer.isBuffer(encryptedBlob)
-        ? encryptedBlob
-        : Buffer.from(encryptedBlob);
-    const prefix = blob.subarray(0, 3).toString("utf-8");
-    if (prefix !== "v10" && prefix !== "v11") {
-        return "<unsupported encryption format>";
-    }
-    const ciphertext = blob.subarray(3);
-    try {
-        const decipher = createDecipheriv("aes-128-cbc", derivedKey, AES_IV);
-        let decrypted = decipher.update(ciphertext);
-        decrypted = Buffer.concat([decrypted, decipher.final()]);
-        return decrypted;
-    }
-    catch {
-        return "<decryption failed>";
-    }
-}
-/**
- * Decrypts a Windows Chrome `v10` blob using AES-256-GCM.
- *
- * Unlike the macOS/Linux CBC scheme, Windows blobs carry their own 12-byte
- * nonce after the version prefix and a 16-byte GCM auth tag at the end. The
- * `key` is the 32-byte AES key recovered from `Local State` via DPAPI.
- *
- * @param encryptedBlob - The encrypted blob from the database.
- * @param key - The 32-byte AES-256 key.
- * @returns The decrypted plaintext bytes, or a placeholder string.
- */
-export function decryptValueBufferGcm(encryptedBlob, key) {
-    if (!encryptedBlob || encryptedBlob.length === 0) {
-        return Buffer.alloc(0);
-    }
-    const blob = Buffer.isBuffer(encryptedBlob)
-        ? encryptedBlob
-        : Buffer.from(encryptedBlob);
-    const prefix = blob.subarray(0, 3).toString("utf-8");
-    if (prefix !== "v10" && prefix !== "v11") {
-        // Pre-v10 values are raw DPAPI blobs (no app-level key); not handled here.
-        return "<unsupported encryption format>";
-    }
-    if (blob.length < 3 + GCM_NONCE_LENGTH + GCM_TAG_LENGTH) {
-        return "<decryption failed>";
-    }
-    const nonce = blob.subarray(3, 3 + GCM_NONCE_LENGTH);
-    const tag = blob.subarray(blob.length - GCM_TAG_LENGTH);
-    const ciphertext = blob.subarray(3 + GCM_NONCE_LENGTH, blob.length - GCM_TAG_LENGTH);
-    try {
-        const decipher = createDecipheriv("aes-256-gcm", key, nonce);
-        decipher.setAuthTag(tag);
-        return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-    }
-    catch {
-        return "<decryption failed>";
-    }
-}
-/**
- * Decrypts a Windows Chrome 127+ `v20` blob using AES-256-GCM.
- *
- * App-Bound Encryption uses the same AES-256-GCM layout as `v10`/`v11` but
- * with a `"v20"` prefix and a key obtained from Chrome's Elevation Service
- * (IElevator COM) instead of plain DPAPI.
- *
- * Layout: "v20" (3 bytes) + 12-byte nonce + ciphertext + 16-byte GCM tag
- *
- * @param encryptedBlob - The encrypted blob from the database.
- * @param key - The 32-byte AES-256 key from ABE decryption.
- * @returns The decrypted plaintext bytes, or a placeholder string.
- */
-export function decryptValueBufferGcmV20(encryptedBlob, key) {
-    if (!encryptedBlob || encryptedBlob.length === 0) {
-        return Buffer.alloc(0);
-    }
-    const blob = Buffer.isBuffer(encryptedBlob)
-        ? encryptedBlob
-        : Buffer.from(encryptedBlob);
-    const prefix = blob.subarray(0, 3).toString("utf-8");
-    if (prefix !== "v20") {
-        return "<unsupported encryption format>";
-    }
-    if (blob.length < 3 + GCM_NONCE_LENGTH + GCM_TAG_LENGTH) {
-        return "<decryption failed>";
-    }
-    const nonce = blob.subarray(3, 3 + GCM_NONCE_LENGTH);
-    const tag = blob.subarray(blob.length - GCM_TAG_LENGTH);
-    const ciphertext = blob.subarray(3 + GCM_NONCE_LENGTH, blob.length - GCM_TAG_LENGTH);
-    try {
-        const decipher = createDecipheriv("aes-256-gcm", key, nonce);
-        decipher.setAuthTag(tag);
-        return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-    }
-    catch {
-        return "<decryption failed>";
-    }
-}
-/**
- * Converts a Chrome/Webkit timestamp (microseconds since 1601-01-01)
- * to a readable local Date string.
- *
- * @param chromeTimestamp - Timestamp in microseconds.
- * @returns Human-readable date-time string, or "N/A".
- */
-export function chromeTimeToDate(chromeTimestamp) {
-    if (chromeTimestamp === null || chromeTimestamp === undefined) {
-        return "N/A";
-    }
-    try {
-        const timestampBigInt = BigInt(chromeTimestamp);
-        if (timestampBigInt === 0n) {
-            return "N/A";
-        }
-        const unixMicroseconds = timestampBigInt - 11644473600000000n;
-        const ms = Number(unixMicroseconds / 1000n);
-        const date = new Date(ms);
-        if (isNaN(date.getTime())) {
-            return "N/A";
-        }
-        return date.toLocaleString();
-    }
-    catch {
-        return "N/A";
-    }
-}

package/dist/src/core/db.d.ts

@@ -1,22 +0,0 @@
-/**
- * Creates a transactionally consistent snapshot of a Chrome SQLite database,
- * executes a query against it, and cleans up. `VACUUM INTO` reads through
- * SQLite itself, so live WAL contents are included without racing raw file
- * copies while Chrome is writing. A store the browser holds exclusively cannot
- * be opened that way at all, and falls back to a file copy (see below).
- *
- * @param dbFilePath - Absolute path to the Chrome database file.
- * @param sql - SQL query to execute.
- * @param params - Bound parameters for the query.
- * @returns Query result rows.
- * @throws If the file doesn't exist or query fails.
- */
-export declare function queryDatabase(dbFilePath: string, sql: string, params?: unknown[]): any[];
-/**
- * Checks whether a specific table exists in the given database file.
- *
- * @param dbFilePath - Absolute path to the database file.
- * @param tableName - Name of the table to check.
- * @returns True if the table exists.
- */
-export declare function tableExists(dbFilePath: string, tableName: string): boolean;

package/dist/src/core/db.js

@@ -1,227 +0,0 @@
-import { copyFileSync, existsSync, mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join, basename } from "node:path";
-import { DatabaseSync } from "node:sqlite";
-/** SQLite result codes meaning "someone else owns this database right now". */
-const SQLITE_BUSY = 5;
-const SQLITE_LOCKED = 6;
-/**
- * Whether a failure is "another process owns this database", not a broken one.
- *
- * `node:sqlite` reports *every* failure as `code: "ERR_SQLITE_ERROR"` and puts
- * the SQLite result code in `errcode`, so the `code` property is useless as a
- * discriminator here — reading it is what an obvious port of this function from
- * `better-sqlite3` (which set `code: "SQLITE_BUSY"`) would do, and it would call
- * every locked store a corrupt one.
- *
- * Masked to the low byte because SQLite may report an *extended* code — 517
- * (`SQLITE_BUSY_SNAPSHOT`) and 262 (`SQLITE_LOCKED_SHAREDCACHE`) are the same
- * two conditions with detail attached, and both must take the copy path.
- *
- * The message check stays as the fallback: it is what caught this before
- * `errcode` existed, and it costs nothing to keep for a build that leaves the
- * field unset.
- */
-function isLocked(err) {
-    const errcode = err?.errcode;
-    if (typeof errcode === "number") {
-        const primary = errcode & 0xff;
-        if (primary === SQLITE_BUSY || primary === SQLITE_LOCKED)
-            return true;
-    }
-    const message = err instanceof Error ? err.message : String(err);
-    return /database is locked|database is busy/i.test(message);
-}
-/**
- * Puts a row back into the shape callers have always been handed: an ordinary
- * object, holding plain numbers, with `Buffer` for a BLOB.
- *
- * `queryDatabase` is exported from the package root, so all three of these are
- * public API rather than internal detail — a caller running its own SQL against
- * `Login Data` gets whatever this returns.
- *
- * **The object itself.** `node:sqlite` builds each row with a null prototype,
- * where better-sqlite3 returned an ordinary object. `Object.keys`, `in`, and
- * `JSON.stringify` all still work, which is why this hides so well — but
- * `row.hasOwnProperty(…)` is a `TypeError`, and so is anything that coerces the
- * row to a string, including `String(row)` and dropping it in a template
- * literal. Rebuilt here rather than re-prototyped: the loop that has to visit
- * every cell anyway is the cheapest place to do it.
- *
- * **Integers.** This is the whole reason the statement is put in BigInt mode.
- * `node:sqlite` does not quietly lose precision past `Number.MAX_SAFE_INTEGER`
- * the way better-sqlite3 did — it **throws** `ERR_OUT_OF_RANGE` partway through
- * reading the row. Chrome writes every timestamp as microseconds since 1601,
- * which lands around 1.3e16 and is therefore *always* past that line, so in the
- * default number mode a `History`, `Login Data`, or `Cookies` row cannot be read
- * at all. Not an edge case: it is every row with a time on it. BigInt mode is
- * the only mode that can read those columns, and this undoes the widening so
- * nothing downstream has to learn a second numeric type. The precision that
- * costs is precision better-sqlite3 was already dropping — sub-2-microsecond
- * detail on a 400-year-old epoch.
- *
- * **Blobs.** `node:sqlite` hands back a bare `Uint8Array` where better-sqlite3
- * gave a `Buffer`, and the difference is not a type-checking nicety: it fails
- * *silently*. `Buffer` is a `Uint8Array`, so an `instanceof` guard still passes
- * and nothing throws — but `blob.toString("utf-8")` on the bare array ignores
- * the encoding and returns the decimal bytes joined by commas, so a caller
- * decoding `password_value` or `encrypted_value` gets `"118,49,48,…"` and no
- * error to notice. `Buffer.isBuffer` also flips to false, and the read helpers
- * (`readUInt32BE`, `equals`, …) are simply absent.
- *
- * Wrapped rather than copied: each row owns its own `ArrayBuffer` here, so
- * re-using the memory is safe and a large blob is not duplicated to change its
- * prototype. An actual `Buffer` is left alone.
- */
-function toCallerTypes(rows) {
-    return rows.map((row) => {
-        const plain = {};
-        for (const key of Object.keys(row)) {
-            const value = row[key];
-            if (typeof value === "bigint") {
-                plain[key] = Number(value);
-            }
-            else if (value instanceof Uint8Array && !Buffer.isBuffer(value)) {
-                plain[key] = Buffer.from(value.buffer, value.byteOffset, value.byteLength);
-            }
-            else {
-                plain[key] = value;
-            }
-        }
-        return plain;
-    });
-}
-/**
- * Copies a database SQLite will not open, alongside the sidecars that make it
- * readable: `-wal` holds commits not yet folded into the main file, and `-shm`
- * is its index. Copying the main file alone would silently drop the most recent
- * writes — a password saved a minute ago being exactly the kind that matters.
- */
-function copyLockedDatabase(dbFilePath, tmpDb) {
-    copyFileSync(dbFilePath, tmpDb);
-    for (const suffix of ["-wal", "-shm"]) {
-        const sidecar = `${dbFilePath}${suffix}`;
-        if (existsSync(sidecar))
-            copyFileSync(sidecar, `${tmpDb}${suffix}`);
-    }
-}
-/**
- * Creates a transactionally consistent snapshot of a Chrome SQLite database,
- * executes a query against it, and cleans up. `VACUUM INTO` reads through
- * SQLite itself, so live WAL contents are included without racing raw file
- * copies while Chrome is writing. A store the browser holds exclusively cannot
- * be opened that way at all, and falls back to a file copy (see below).
- *
- * @param dbFilePath - Absolute path to the Chrome database file.
- * @param sql - SQL query to execute.
- * @param params - Bound parameters for the query.
- * @returns Query result rows.
- * @throws If the file doesn't exist or query fails.
- */
-export function queryDatabase(dbFilePath, sql, params = []) {
-    if (!existsSync(dbFilePath)) {
-        throw new Error(`Database file not found: ${dbFilePath}`);
-    }
-    const tmpDir = mkdtempSync(join(tmpdir(), "chrome-tools-"));
-    const tmpDb = join(tmpDir, basename(dbFilePath));
-    let sourceDb;
-    try {
-        sourceDb = new DatabaseSync(dbFilePath, {
-            // `readOnly`, not `readonly`. An unrecognized option is *ignored* rather
-            // than rejected, so the lowercase spelling — which is what better-sqlite3
-            // called it, and what this line used to say — silently hands back a
-            // writable handle onto the user's live browser profile.
-            readOnly: true,
-            // No `fileMustExist` equivalent, and none needed: a read-only open will
-            // not create the file, and the `existsSync` guard above is the explicit
-            // check that turns a missing store into a message worth reading.
-            //
-            // No wait. A running Chrome holds these stores in `locking_mode =
-            // EXCLUSIVE` for as long as it is open, so a busy timeout here buys
-            // nothing that waiting longer would win — the lock is not transient, and
-            // the copy below is the answer to it either way. Five seconds *per store*
-            // was the whole cost of reading a saved login while the browser was up:
-            // two stores, ten seconds, spent to arrive at the fallback that then
-            // succeeded instantly.
-            timeout: 0,
-        });
-        sourceDb.prepare("VACUUM INTO ?").run(tmpDb);
-    }
-    catch (err) {
-        // A running Chrome holds its stores in `locking_mode = EXCLUSIVE`, which
-        // refuses every other connection — SQLite cannot even open them to read.
-        // That is not a corrupt or missing database, it is a browser that happens
-        // to be open, and it made a profile with saved passwords in it report none.
-        // Falling back to the file itself is what a locked store leaves: the OS
-        // copies bytes regardless of an advisory lock the copier never takes.
-        if (!isLocked(err)) {
-            cleanupTmp(tmpDir);
-            throw new Error(`Failed to snapshot database file '${basename(dbFilePath)}': ${err.message}`);
-        }
-        try {
-            copyLockedDatabase(dbFilePath, tmpDb);
-        }
-        catch (copyErr) {
-            cleanupTmp(tmpDir);
-            throw new Error(`Failed to snapshot database file '${basename(dbFilePath)}': ${err.message} ` +
-                `(copying it instead also failed: ${copyErr.message})`);
-        }
-    }
-    finally {
-        if (sourceDb) {
-            try {
-                sourceDb.close();
-            }
-            catch {
-                /* ignore */
-            }
-        }
-    }
-    let db;
-    try {
-        db = new DatabaseSync(tmpDb, { readOnly: true, timeout: 5000 });
-        const stmt = db.prepare(sql);
-        // Read wide, hand back narrow. See `toCallerTypes` — without this, every
-        // query that touches a Chrome timestamp throws instead of returning rows.
-        stmt.setReadBigInts(true);
-        return toCallerTypes(params.length > 0 ? stmt.all(...params) : stmt.all());
-    }
-    catch (err) {
-        throw new Error(`Database query failed on '${basename(dbFilePath)}': ${err.message}`);
-    }
-    finally {
-        if (db) {
-            try {
-                db.close();
-            }
-            catch {
-                /* ignore */
-            }
-        }
-        cleanupTmp(tmpDir);
-    }
-}
-/**
- * Checks whether a specific table exists in the given database file.
- *
- * @param dbFilePath - Absolute path to the database file.
- * @param tableName - Name of the table to check.
- * @returns True if the table exists.
- */
-export function tableExists(dbFilePath, tableName) {
-    try {
-        const rows = queryDatabase(dbFilePath, `SELECT name FROM sqlite_master WHERE type='table' AND name=?`, [tableName]);
-        return rows.length > 0;
-    }
-    catch {
-        return false;
-    }
-}
-function cleanupTmp(tmpDir) {
-    try {
-        rmSync(tmpDir, { recursive: true, force: true });
-    }
-    catch {
-        /* ignore */
-    }
-}

package/dist/src/core/keychain.d.ts

@@ -1,57 +0,0 @@
-/** How a Keychain read failed, so callers (and the CLI) can react specifically. */
-export type KeychainErrorKind = "access-denied" | "not-found" | "empty" | "unknown";
-/**
- * Error thrown when a browser's Safe Storage key cannot be read from the
- * Keychain. Carries the failing `service` and a `kind` so the CLI can show a
- * clear "No keychain access" message instead of a generic failure.
- */
-export declare class KeychainAccessError extends Error {
-    readonly service: string;
-    readonly kind: KeychainErrorKind;
-    constructor(message: string, service: string, kind: KeychainErrorKind);
-    /** True when the failure means we couldn't get permission to read the key. */
-    get isAccessDenied(): boolean;
-}
-/**
- * Narrows an unknown error to a {@link KeychainAccessError} caused by missing
- * Keychain permission (denied/dismissed prompt, locked, or non-interactive).
- */
-export declare function isKeychainAccessDenied(err: unknown): err is KeychainAccessError;
-export type KeychainPasswordProvider = (service: string) => string;
-/**
- * Returns the current global keychain password provider hook.
- */
-export declare function getKeychainPasswordProvider(): KeychainPasswordProvider | null;
-/**
- * Sets the global keychain password provider hook, allowing downstream apps (like Electron)
- * to intercept keychain password lookups and resolve them (e.g. via native node-keytar).
- */
-export declare function setKeychainPasswordProvider(provider: KeychainPasswordProvider | null): void;
-/**
- * Retrieves a browser's "Safe Storage" password from the macOS Keychain.
- * Caches the result per service for subsequent calls within the same process.
- *
- * @param service - Keychain service name, e.g. "Chrome Safe Storage".
- * @returns The raw keychain password.
- * @throws If the password could not be retrieved.
- */
-export declare function getKeychainPassword(service?: string): string;
-/**
- * Backward-compatible alias for {@link getKeychainPassword} using Chrome's item.
- * @deprecated Prefer {@link getKeychainPassword} with an explicit service name.
- */
-export declare function getChromeKeychainPassword(): string;
-/**
- * Derives the AES-128-CBC key from a browser's Keychain password using PBKDF2.
- * Caches the result per service.
- *
- * @param service - Keychain service name. Defaults to Chrome's.
- * @param keychainPassword - The raw password. If omitted, fetched from Keychain.
- * @returns The derived 16-byte key.
- */
-export declare function deriveEncryptionKey(service?: string, keychainPassword?: string): Buffer;
-/**
- * Clears cached keychain data for all browsers. Useful for testing or
- * re-authentication.
- */
-export declare function clearKeychainCache(): void;

package/dist/src/core/keychain.js

@@ -1,191 +0,0 @@
-import { execFileSync } from "node:child_process";
-import { pbkdf2Sync } from "node:crypto";
-const PBKDF2_ITERATIONS = 1003;
-const PBKDF2_KEY_LENGTH = 16;
-const PBKDF2_SALT = Buffer.from("saltysalt");
-/** Chrome's Keychain item, used when no browser-specific label is supplied. */
-const DEFAULT_SAFE_STORAGE_SERVICE = "Chrome Safe Storage";
-/**
- * Exit codes returned by the macOS `security` CLI (mapped from OSStatus).
- * Only the ones we explicitly handle are listed here.
- */
-const SECURITY_EXIT = {
-    ITEM_NOT_FOUND: 44, // errSecItemNotFound
-    INTERACTION_NOT_ALLOWED: 36, // errSecInteractionNotAllowed (SSH / headless / locked)
-    AUTH_FAILED: 45, // errSecAuthFailed
-    USER_CANCELED: 128, // user clicked "Deny"/cancelled the GUI authorization prompt
-};
-/**
- * Error thrown when a browser's Safe Storage key cannot be read from the
- * Keychain. Carries the failing `service` and a `kind` so the CLI can show a
- * clear "No keychain access" message instead of a generic failure.
- */
-export class KeychainAccessError extends Error {
-    service;
-    kind;
-    constructor(message, service, kind) {
-        super(message);
-        this.name = "KeychainAccessError";
-        this.service = service;
-        this.kind = kind;
-    }
-    /** True when the failure means we couldn't get permission to read the key. */
-    get isAccessDenied() {
-        return this.kind === "access-denied";
-    }
-}
-/**
- * Narrows an unknown error to a {@link KeychainAccessError} caused by missing
- * Keychain permission (denied/dismissed prompt, locked, or non-interactive).
- */
-export function isKeychainAccessDenied(err) {
-    return err instanceof KeychainAccessError && err.isAccessDenied;
-}
-// Caches keyed by Keychain service name so multiple browsers can be read in one
-// process (e.g. `--all-browsers`) without the cache returning the wrong key.
-const _cachedPasswords = new Map();
-const _cachedDerivedKeys = new Map();
-/** Heuristic: are we running without an interactive GUI (Aqua) session? */
-function isLikelyHeadless() {
-    return Boolean(process.env.SSH_CONNECTION || process.env.SSH_TTY) || !process.env.TERM_PROGRAM;
-}
-/** Normalizes the unknown error thrown by execFileSync into the bits we care about. */
-function parseSecurityError(err) {
-    const e = err;
-    return {
-        status: typeof e?.status === "number" ? e.status : null,
-        stderr: (e?.stderr ?? "").toString().trim(),
-    };
-}
-/** Builds a cause-specific, actionable error for a failed keychain read. */
-function buildKeychainError(service, status, stderr) {
-    const docs = "See docs/remote-keychain-access.md for non-interactive / SSH setup.";
-    let kind;
-    let hint;
-    if (status === SECURITY_EXIT.ITEM_NOT_FOUND || /could not be found/i.test(stderr)) {
-        kind = "not-found";
-        hint =
-            `No '${service}' item found in the Keychain.\n` +
-                "Run this browser at least once on this machine so it creates the key.";
-    }
-    else if (status === SECURITY_EXIT.INTERACTION_NOT_ALLOWED ||
-        /interaction.*not allowed/i.test(stderr)) {
-        kind = "access-denied";
-        hint =
-            "The Keychain needs a GUI authorization prompt that can't be shown here " +
-                (isLikelyHeadless() ? "(you appear to be on a remote/SSH session).\n" : ".\n") +
-                "Authorize once from a GUI Terminal (click \"Always Allow\"), then unlock the\n" +
-                "keychain in this session:\n" +
-                "  security unlock-keychain ~/Library/Keychains/login.keychain-db\n" +
-                docs;
-    }
-    else if (status === SECURITY_EXIT.AUTH_FAILED) {
-        kind = "access-denied";
-        hint =
-            "Keychain authorization failed (wrong password or denied).\n" +
-                `Try: security unlock-keychain ~/Library/Keychains/login.keychain-db\n${docs}`;
-    }
-    else {
-        // The remaining case — including user-cancelled prompts (exit 128) — is a
-        // denied/dismissed authorization, i.e. we simply don't have access.
-        kind = "access-denied";
-        hint =
-            "macOS showed a Keychain access prompt that was denied or dismissed.\n" +
-                `Re-run the command and click "Allow" (or "Always Allow"), or authorize once with:\n` +
-                `  security find-generic-password -w -s "${service}"\n${docs}`;
-    }
-    const detail = [
-        status !== null ? `exit ${status}` : null,
-        stderr || null,
-    ]
-        .filter(Boolean)
-        .join(": ");
-    return new KeychainAccessError(`Could not retrieve ${service} key from macOS Keychain.\n${hint}` +
-        (detail ? `\n(security: ${detail})` : ""), service, kind);
-}
-let _passwordProvider = null;
-/**
- * Returns the current global keychain password provider hook.
- */
-export function getKeychainPasswordProvider() {
-    return _passwordProvider;
-}
-/**
- * Sets the global keychain password provider hook, allowing downstream apps (like Electron)
- * to intercept keychain password lookups and resolve them (e.g. via native node-keytar).
- */
-export function setKeychainPasswordProvider(provider) {
-    _passwordProvider = provider;
-}
-/**
- * Retrieves a browser's "Safe Storage" password from the macOS Keychain.
- * Caches the result per service for subsequent calls within the same process.
- *
- * @param service - Keychain service name, e.g. "Chrome Safe Storage".
- * @returns The raw keychain password.
- * @throws If the password could not be retrieved.
- */
-export function getKeychainPassword(service = DEFAULT_SAFE_STORAGE_SERVICE) {
-    const cached = _cachedPasswords.get(service);
-    if (cached !== undefined) {
-        return cached;
-    }
-    let password;
-    if (_passwordProvider) {
-        password = _passwordProvider(service);
-    }
-    else {
-        try {
-            // execFileSync (no shell) avoids any quoting/injection concern around the
-            // service name, which now comes from the browser registry.
-            password = execFileSync("security", ["find-generic-password", "-w", "-s", service], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-        }
-        catch (err) {
-            const { status, stderr } = parseSecurityError(err);
-            throw buildKeychainError(service, status, stderr);
-        }
-    }
-    if (!password) {
-        // Command succeeded (exit 0) but returned nothing — treat as a usable failure.
-        throw new KeychainAccessError(`Keychain returned an empty ${service} key.\n` +
-            "The item may exist with no password. Re-run the browser to recreate it.", service, "empty");
-    }
-    _cachedPasswords.set(service, password);
-    return password;
-}
-/**
- * Backward-compatible alias for {@link getKeychainPassword} using Chrome's item.
- * @deprecated Prefer {@link getKeychainPassword} with an explicit service name.
- */
-export function getChromeKeychainPassword() {
-    return getKeychainPassword(DEFAULT_SAFE_STORAGE_SERVICE);
-}
-/**
- * Derives the AES-128-CBC key from a browser's Keychain password using PBKDF2.
- * Caches the result per service.
- *
- * @param service - Keychain service name. Defaults to Chrome's.
- * @param keychainPassword - The raw password. If omitted, fetched from Keychain.
- * @returns The derived 16-byte key.
- */
-export function deriveEncryptionKey(service = DEFAULT_SAFE_STORAGE_SERVICE, keychainPassword) {
-    const cached = _cachedDerivedKeys.get(service);
-    if (cached !== undefined) {
-        return cached;
-    }
-    const password = keychainPassword || getKeychainPassword(service);
-    if (!password) {
-        throw new Error("Keychain password cannot be empty for key derivation.");
-    }
-    const key = pbkdf2Sync(password, PBKDF2_SALT, PBKDF2_ITERATIONS, PBKDF2_KEY_LENGTH, "sha1");
-    _cachedDerivedKeys.set(service, key);
-    return key;
-}
-/**
- * Clears cached keychain data for all browsers. Useful for testing or
- * re-authentication.
- */
-export function clearKeychainCache() {
-    _cachedPasswords.clear();
-    _cachedDerivedKeys.clear();
-}

package/dist/src/core/limit.d.ts

@@ -1,4 +0,0 @@
-/** Normalizes the public limit option. Zero, negatives, and non-finite values mean unlimited. */
-export declare function normalizeLimit(limit: number | undefined): number | undefined;
-/** Applies a limit to the final combined result set across every profile. */
-export declare function limitResults<T>(results: T[], limit: number | undefined): T[];

package/dist/src/core/limit.js

@@ -1,12 +0,0 @@
-/** Normalizes the public limit option. Zero, negatives, and non-finite values mean unlimited. */
-export function normalizeLimit(limit) {
-    if (limit === undefined)
-        return undefined;
-    const parsed = Math.trunc(Number(limit));
-    return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
-}
-/** Applies a limit to the final combined result set across every profile. */
-export function limitResults(results, limit) {
-    const normalized = normalizeLimit(limit);
-    return normalized === undefined ? results : results.slice(0, normalized);
-}

package/dist/src/core/platform/darwin.d.ts

@@ -1,12 +0,0 @@
-import type { ChromePlatform } from "./types.js";
-/**
- * macOS backend.
- *
- * Key source: the active browser's "<Browser> Safe Storage" password from the
- * login Keychain (e.g. "Chrome Safe Storage", "Microsoft Edge Safe Storage"),
- * stretched with PBKDF2 (1003 iterations) — implemented in `core/keychain.ts`.
- * Cipher: AES-128-CBC with a fixed 16-space IV — implemented in `core/crypto.ts`.
- * The browser only changes *which* Keychain item and data dir are used; the
- * crypto is identical across all Chromium forks.
- */
-export declare const darwin: ChromePlatform;