chrome-tools 1.1.15 → 1.1.18

package/dist/index.js

@@ -0,0 +1,2532 @@
+// src/core/chrome.ts
+import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2, statSync as statSync2 } from "node:fs";
+import { basename, join as join4 } from "node:path";
+
+// src/core/platform/darwin.ts
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+// src/core/keychain.ts
+import { execFileSync } from "node:child_process";
+import { pbkdf2Sync } from "node:crypto";
+var PBKDF2_ITERATIONS = 1003;
+var PBKDF2_KEY_LENGTH = 16;
+var PBKDF2_SALT = Buffer.from("saltysalt");
+var DEFAULT_SAFE_STORAGE_SERVICE = "Chrome Safe Storage";
+var SECURITY_EXIT = {
+  ITEM_NOT_FOUND: 44,
+  // errSecItemNotFound
+  INTERACTION_NOT_ALLOWED: 36,
+  // errSecInteractionNotAllowed (SSH / headless / locked)
+  AUTH_FAILED: 45,
+  // errSecAuthFailed
+  USER_CANCELED: 128
+  // user clicked "Deny"/cancelled the GUI authorization prompt
+};
+var KeychainAccessError = class extends Error {
+  service;
+  kind;
+  constructor(message, service, kind) {
+    super(message);
+    this.name = "KeychainAccessError";
+    this.service = service;
+    this.kind = kind;
+  }
+  /** True when the failure means we couldn't get permission to read the key. */
+  get isAccessDenied() {
+    return this.kind === "access-denied";
+  }
+};
+var _cachedPasswords = /* @__PURE__ */ new Map();
+var _cachedDerivedKeys = /* @__PURE__ */ new Map();
+function isLikelyHeadless() {
+  return Boolean(process.env.SSH_CONNECTION || process.env.SSH_TTY) || !process.env.TERM_PROGRAM;
+}
+function parseSecurityError(err) {
+  const e = err;
+  return {
+    status: typeof e?.status === "number" ? e.status : null,
+    stderr: (e?.stderr ?? "").toString().trim()
+  };
+}
+function buildKeychainError(service, status, stderr) {
+  const docs = "See docs/remote-keychain-access.md for non-interactive / SSH setup.";
+  let kind;
+  let hint;
+  if (status === SECURITY_EXIT.ITEM_NOT_FOUND || /could not be found/i.test(stderr)) {
+    kind = "not-found";
+    hint = `No '${service}' item found in the Keychain.
+Run this browser at least once on this machine so it creates the key.`;
+  } else if (status === SECURITY_EXIT.INTERACTION_NOT_ALLOWED || /interaction.*not allowed/i.test(stderr)) {
+    kind = "access-denied";
+    hint = "The Keychain needs a GUI authorization prompt that can't be shown here " + (isLikelyHeadless() ? "(you appear to be on a remote/SSH session).\n" : ".\n") + 'Authorize once from a GUI Terminal (click "Always Allow"), then unlock the\nkeychain in this session:\n  security unlock-keychain ~/Library/Keychains/login.keychain-db\n' + docs;
+  } else if (status === SECURITY_EXIT.AUTH_FAILED) {
+    kind = "access-denied";
+    hint = `Keychain authorization failed (wrong password or denied).
+Try: security unlock-keychain ~/Library/Keychains/login.keychain-db
+${docs}`;
+  } else {
+    kind = "access-denied";
+    hint = `macOS showed a Keychain access prompt that was denied or dismissed.
+Re-run the command and click "Allow" (or "Always Allow"), or authorize once with:
+  security find-generic-password -w -s "${service}"
+${docs}`;
+  }
+  const detail = [
+    status !== null ? `exit ${status}` : null,
+    stderr || null
+  ].filter(Boolean).join(": ");
+  return new KeychainAccessError(
+    `Could not retrieve ${service} key from macOS Keychain.
+${hint}` + (detail ? `
+(security: ${detail})` : ""),
+    service,
+    kind
+  );
+}
+var _passwordProvider = null;
+function getKeychainPasswordProvider() {
+  return _passwordProvider;
+}
+function setKeychainPasswordProvider(provider) {
+  _passwordProvider = provider;
+}
+function getKeychainPassword(service = DEFAULT_SAFE_STORAGE_SERVICE) {
+  const cached = _cachedPasswords.get(service);
+  if (cached !== void 0) {
+    return cached;
+  }
+  let password;
+  if (_passwordProvider) {
+    password = _passwordProvider(service);
+  } else {
+    try {
+      password = execFileSync(
+        "security",
+        ["find-generic-password", "-w", "-s", service],
+        { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
+      ).trim();
+    } catch (err) {
+      const { status, stderr } = parseSecurityError(err);
+      throw buildKeychainError(service, status, stderr);
+    }
+  }
+  if (!password) {
+    throw new KeychainAccessError(
+      `Keychain returned an empty ${service} key.
+The item may exist with no password. Re-run the browser to recreate it.`,
+      service,
+      "empty"
+    );
+  }
+  _cachedPasswords.set(service, password);
+  return password;
+}
+function getChromeKeychainPassword() {
+  return getKeychainPassword(DEFAULT_SAFE_STORAGE_SERVICE);
+}
+function deriveEncryptionKey(service = DEFAULT_SAFE_STORAGE_SERVICE, keychainPassword) {
+  const cached = _cachedDerivedKeys.get(service);
+  if (cached !== void 0) {
+    return cached;
+  }
+  const password = keychainPassword || getKeychainPassword(service);
+  if (!password) {
+    throw new Error("Keychain password cannot be empty for key derivation.");
+  }
+  const key = pbkdf2Sync(
+    password,
+    PBKDF2_SALT,
+    PBKDF2_ITERATIONS,
+    PBKDF2_KEY_LENGTH,
+    "sha1"
+  );
+  _cachedDerivedKeys.set(service, key);
+  return key;
+}
+function clearKeychainCache() {
+  _cachedPasswords.clear();
+  _cachedDerivedKeys.clear();
+}
+
+// src/core/crypto.ts
+import { createDecipheriv } from "node:crypto";
+var AES_IV = Buffer.alloc(16, " ");
+var GCM_NONCE_LENGTH = 12;
+var GCM_TAG_LENGTH = 16;
+function decryptValueBuffer(encryptedBlob, derivedKey) {
+  if (!encryptedBlob || encryptedBlob.length === 0) {
+    return Buffer.alloc(0);
+  }
+  const blob = Buffer.isBuffer(encryptedBlob) ? encryptedBlob : Buffer.from(encryptedBlob);
+  const prefix = blob.subarray(0, 3).toString("utf-8");
+  if (prefix !== "v10" && prefix !== "v11") {
+    return "<unsupported encryption format>";
+  }
+  const ciphertext = blob.subarray(3);
+  try {
+    const decipher = createDecipheriv("aes-128-cbc", derivedKey, AES_IV);
+    let decrypted = decipher.update(ciphertext);
+    decrypted = Buffer.concat([decrypted, decipher.final()]);
+    return decrypted;
+  } catch {
+    return "<decryption failed>";
+  }
+}
+function decryptValueBufferGcm(encryptedBlob, key) {
+  if (!encryptedBlob || encryptedBlob.length === 0) {
+    return Buffer.alloc(0);
+  }
+  const blob = Buffer.isBuffer(encryptedBlob) ? encryptedBlob : Buffer.from(encryptedBlob);
+  const prefix = blob.subarray(0, 3).toString("utf-8");
+  if (prefix !== "v10" && prefix !== "v11") {
+    return "<unsupported encryption format>";
+  }
+  if (blob.length < 3 + GCM_NONCE_LENGTH + GCM_TAG_LENGTH) {
+    return "<decryption failed>";
+  }
+  const nonce = blob.subarray(3, 3 + GCM_NONCE_LENGTH);
+  const tag = blob.subarray(blob.length - GCM_TAG_LENGTH);
+  const ciphertext = blob.subarray(3 + GCM_NONCE_LENGTH, blob.length - GCM_TAG_LENGTH);
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", key, nonce);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  } catch {
+    return "<decryption failed>";
+  }
+}
+function decryptValueBufferGcmV20(encryptedBlob, key) {
+  if (!encryptedBlob || encryptedBlob.length === 0) {
+    return Buffer.alloc(0);
+  }
+  const blob = Buffer.isBuffer(encryptedBlob) ? encryptedBlob : Buffer.from(encryptedBlob);
+  const prefix = blob.subarray(0, 3).toString("utf-8");
+  if (prefix !== "v20") {
+    return "<unsupported encryption format>";
+  }
+  if (blob.length < 3 + GCM_NONCE_LENGTH + GCM_TAG_LENGTH) {
+    return "<decryption failed>";
+  }
+  const nonce = blob.subarray(3, 3 + GCM_NONCE_LENGTH);
+  const tag = blob.subarray(blob.length - GCM_TAG_LENGTH);
+  const ciphertext = blob.subarray(3 + GCM_NONCE_LENGTH, blob.length - GCM_TAG_LENGTH);
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", key, nonce);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  } catch {
+    return "<decryption failed>";
+  }
+}
+function chromeTimeToDate(chromeTimestamp) {
+  if (chromeTimestamp === null || chromeTimestamp === void 0) {
+    return "N/A";
+  }
+  try {
+    const timestampBigInt = BigInt(chromeTimestamp);
+    if (timestampBigInt === 0n) {
+      return "N/A";
+    }
+    const unixMicroseconds = timestampBigInt - 11644473600000000n;
+    const ms = Number(unixMicroseconds / 1000n);
+    const date = new Date(ms);
+    if (isNaN(date.getTime())) {
+      return "N/A";
+    }
+    return date.toLocaleString();
+  } catch {
+    return "N/A";
+  }
+}
+
+// src/core/browsers.ts
+var BROWSERS = {
+  chrome: {
+    id: "chrome",
+    name: "Google Chrome",
+    aliases: ["google-chrome", "google chrome"],
+    safeStorageLabel: "Chrome Safe Storage",
+    linuxSecretApp: "chrome",
+    dirs: {
+      darwin: "Google/Chrome",
+      win32: "Google/Chrome/User Data",
+      linux: "google-chrome"
+    }
+  },
+  "chrome-beta": {
+    id: "chrome-beta",
+    name: "Google Chrome Beta",
+    safeStorageLabel: "Chrome Safe Storage",
+    linuxSecretApp: "chrome",
+    dirs: {
+      darwin: "Google/Chrome Beta",
+      win32: "Google/Chrome Beta/User Data",
+      linux: "google-chrome-beta"
+    }
+  },
+  "chrome-canary": {
+    id: "chrome-canary",
+    name: "Google Chrome Canary",
+    aliases: ["canary"],
+    safeStorageLabel: "Chrome Safe Storage",
+    linuxSecretApp: "chrome",
+    dirs: {
+      darwin: "Google/Chrome Canary",
+      win32: "Google/Chrome SxS/User Data",
+      linux: "google-chrome-unstable"
+    }
+  },
+  chromium: {
+    id: "chromium",
+    name: "Chromium",
+    safeStorageLabel: "Chromium Safe Storage",
+    linuxSecretApp: "chromium",
+    dirs: {
+      darwin: "Chromium",
+      win32: "Chromium/User Data",
+      linux: "chromium"
+    }
+  },
+  edge: {
+    id: "edge",
+    name: "Microsoft Edge",
+    aliases: ["msedge", "microsoft-edge", "microsoft edge"],
+    safeStorageLabel: "Microsoft Edge Safe Storage",
+    linuxSecretApp: "chromium",
+    dirs: {
+      darwin: "Microsoft Edge",
+      win32: "Microsoft/Edge/User Data",
+      linux: "microsoft-edge"
+    }
+  },
+  brave: {
+    id: "brave",
+    name: "Brave",
+    aliases: ["brave-browser"],
+    safeStorageLabel: "Brave Safe Storage",
+    linuxSecretApp: "chrome",
+    dirs: {
+      darwin: "BraveSoftware/Brave-Browser",
+      win32: "BraveSoftware/Brave-Browser/User Data",
+      linux: "BraveSoftware/Brave-Browser"
+    }
+  },
+  comet: {
+    id: "comet",
+    name: "Comet",
+    aliases: ["perplexity", "perplexity-comet"],
+    safeStorageLabel: "Comet Safe Storage",
+    linuxSecretApp: "chromium",
+    // macOS dir verified (~/Library/Application Support/Comet); Win/Linux best-effort.
+    dirs: {
+      darwin: "Comet",
+      win32: "Perplexity/Comet/User Data",
+      linux: "comet"
+    }
+  },
+  vivaldi: {
+    id: "vivaldi",
+    name: "Vivaldi",
+    // Vivaldi reuses Chrome's Keychain item rather than minting its own.
+    safeStorageLabel: "Chrome Safe Storage",
+    linuxSecretApp: "chrome",
+    dirs: {
+      darwin: "Vivaldi",
+      win32: "Vivaldi/User Data",
+      linux: "vivaldi"
+    }
+  },
+  opera: {
+    id: "opera",
+    name: "Opera",
+    safeStorageLabel: "Opera Safe Storage",
+    linuxSecretApp: "chromium",
+    // Opera's product dir *is* the user-data root (no nested "User Data").
+    // Profiles are usually still under Default/; some layouts are flat at root —
+    // discoverProfiles handles both.
+    dirs: {
+      darwin: "com.operasoftware.Opera",
+      win32: "Opera Software/Opera Stable",
+      win32Base: "roaming",
+      linux: "opera"
+    }
+  }
+};
+var DEFAULT_BROWSER = "chrome";
+function listBrowsers() {
+  return Object.values(BROWSERS);
+}
+function resolveBrowser(idOrName) {
+  if (!idOrName) return null;
+  const needle = idOrName.trim().toLowerCase();
+  for (const b of listBrowsers()) {
+    if (b.id.toLowerCase() === needle) return b;
+    if (b.name.toLowerCase() === needle) return b;
+    if (b.aliases?.some((a) => a.toLowerCase() === needle)) return b;
+  }
+  return null;
+}
+function requireBrowser(idOrName) {
+  const resolved = resolveBrowser(idOrName);
+  if (resolved) return resolved;
+  throw new Error(
+    `Unknown browser "${idOrName}". Supported: ${listBrowsers().map((b) => b.id).join(", ")}.`
+  );
+}
+var _active = BROWSERS[DEFAULT_BROWSER];
+function getActiveBrowser() {
+  return _active;
+}
+function setActiveBrowser(idOrName) {
+  if (!idOrName || !idOrName.trim()) {
+    _active = BROWSERS[DEFAULT_BROWSER];
+    return _active;
+  }
+  _active = requireBrowser(idOrName);
+  return _active;
+}
+
+// src/core/platform/darwin.ts
+var darwin = {
+  name: "darwin",
+  getDefaultChromeDir(browser = getActiveBrowser()) {
+    return join(
+      homedir(),
+      "Library",
+      "Application Support",
+      ...browser.dirs.darwin.split("/")
+    );
+  },
+  getDecryptionKey(_chromeDir, browser = getActiveBrowser()) {
+    return deriveEncryptionKey(browser.safeStorageLabel);
+  },
+  decrypt(blob, key) {
+    return decryptValueBuffer(blob, key);
+  },
+  clearCache() {
+    clearKeychainCache();
+  }
+};
+
+// src/core/platform/win32.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { copyFileSync, existsSync, mkdirSync, readFileSync, statSync } from "node:fs";
+import { dirname, join as join2 } from "node:path";
+var DPAPI_PREFIX = Buffer.from("DPAPI", "ascii");
+var APPB_PREFIX = Buffer.from("APPB", "ascii");
+var _cachedKeys = /* @__PURE__ */ new Map();
+var _cachedABEKeys = /* @__PURE__ */ new Map();
+var _lastResolvedDir;
+var _lastResolvedBrowser;
+var ABE_BROWSER_MAP = {
+  chrome: "chrome",
+  "chrome-beta": "chrome-beta",
+  "chrome-canary": "chrome",
+  chromium: "chrome",
+  brave: "brave",
+  edge: "edge",
+  vivaldi: "chrome",
+  comet: "chrome",
+  opera: "chrome"
+};
+function dpapiDecrypt(encrypted) {
+  const script = [
+    "$ErrorActionPreference='Stop';",
+    "Add-Type -AssemblyName System.Security;",
+    "$b=[Console]::In.ReadToEnd().Trim();",
+    "$enc=[Convert]::FromBase64String($b);",
+    "$dec=[System.Security.Cryptography.ProtectedData]::Unprotect($enc,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);",
+    "[Console]::Out.Write([Convert]::ToBase64String($dec));"
+  ].join(" ");
+  let out;
+  try {
+    out = execFileSync2(
+      "powershell.exe",
+      ["-NoProfile", "-NonInteractive", "-Command", script],
+      { input: encrypted.toString("base64"), encoding: "utf-8" }
+    );
+  } catch (err) {
+    throw new Error(
+      `DPAPI decryption via PowerShell failed.
+The encrypted_key can only be unprotected by the same Windows user that created it. Run as that user on the same machine.
+(powershell: ${err?.message ?? err})`
+    );
+  }
+  return Buffer.from(out.trim(), "base64");
+}
+function resolveLocalStateDir(requestedDir) {
+  const parentDir = dirname(requestedDir);
+  return existsSync(join2(requestedDir, "Local State")) ? requestedDir : parentDir !== requestedDir && existsSync(join2(parentDir, "Local State")) ? parentDir : requestedDir;
+}
+function findABEHelper() {
+  const base = import.meta.dirname ?? "";
+  const candidates = [
+    join2(base, "chrome_abe_decrypt.exe"),
+    join2(base, "..", "..", "..", "bin", "chrome_abe_decrypt.exe"),
+    join2(base, "..", "..", "..", "..", "bin", "chrome_abe_decrypt.exe"),
+    join2(base, "..", "..", "..", "..", "src", "native", "chrome_abe_decrypt.exe")
+  ];
+  for (const p of candidates) {
+    if (existsSync(p)) return p;
+  }
+  try {
+    execFileSync2("where", ["chrome_abe_decrypt.exe"], { encoding: "utf-8", stdio: "pipe" });
+    return "chrome_abe_decrypt.exe";
+  } catch {
+    return null;
+  }
+}
+function getBrowserTempDirs(browserId) {
+  const dirs = [];
+  const progFiles = process.env["ProgramFiles"] || "C:\\Program Files";
+  const progFilesX86 = process.env["ProgramFiles(x86)"] || "C:\\Program Files (x86)";
+  const localAppData = process.env.LOCALAPPDATA || (process.env.USERPROFILE ? join2(process.env.USERPROFILE, "AppData", "Local") : "");
+  const subpaths = {
+    chrome: ["Google\\Chrome"],
+    "chrome-beta": ["Google\\Chrome Beta"],
+    "chrome-canary": ["Google\\Chrome SxS"],
+    chromium: ["Chromium"],
+    edge: ["Microsoft\\Edge"],
+    brave: ["BraveSoftware\\Brave-Browser"],
+    vivaldi: ["Vivaldi"]
+  };
+  const rels = subpaths[browserId] || ["Google\\Chrome"];
+  for (const rel of rels) {
+    dirs.push(join2(progFiles, rel, "Temp"));
+    dirs.push(join2(progFilesX86, rel, "Temp"));
+    if (localAppData) {
+      dirs.push(join2(localAppData, rel, "Temp"));
+    }
+  }
+  return dirs;
+}
+function findOrStageABEHelper(browserId) {
+  const sourceExe = findABEHelper();
+  if (!sourceExe) return null;
+  const targetDirs = getBrowserTempDirs(browserId);
+  for (const targetDir of targetDirs) {
+    try {
+      if (!existsSync(targetDir)) {
+        mkdirSync(targetDir, { recursive: true });
+      }
+      const stagedExe = join2(targetDir, "chrome_abe_decrypt.exe");
+      if (!existsSync(stagedExe) || statSync(stagedExe).size !== statSync(sourceExe).size) {
+        copyFileSync(sourceExe, stagedExe);
+      }
+      return stagedExe;
+    } catch {
+      continue;
+    }
+  }
+  return sourceExe;
+}
+var _abeWarningShown = false;
+function abeDecrypt(rawEncryptedBytes, browserId) {
+  const helperExe = findOrStageABEHelper(browserId);
+  if (!helperExe) {
+    if (!_abeWarningShown) {
+      _abeWarningShown = true;
+      process.stderr.write(
+        "[chrome-tools] chrome_abe_decrypt.exe not found. Chrome 127+ v20-encrypted\ncookies/passwords cannot be decrypted.\n"
+      );
+    }
+    return null;
+  }
+  const comBrowser = ABE_BROWSER_MAP[browserId] || "chrome";
+  try {
+    const out = execFileSync2(
+      helperExe,
+      [comBrowser],
+      {
+        input: rawEncryptedBytes.toString("base64"),
+        encoding: "utf-8",
+        timeout: 3e4,
+        stdio: ["pipe", "pipe", "pipe"],
+        cwd: dirname(helperExe)
+      }
+    );
+    return Buffer.from(out.trim(), "base64");
+  } catch {
+    return null;
+  }
+}
+var win32 = {
+  name: "win32",
+  getDefaultChromeDir(browser = getActiveBrowser()) {
+    const roaming = browser.dirs.win32Base === "roaming";
+    const appData = roaming ? process.env.APPDATA || (process.env.USERPROFILE ? join2(process.env.USERPROFILE, "AppData", "Roaming") : "") : process.env.LOCALAPPDATA || (process.env.USERPROFILE ? join2(process.env.USERPROFILE, "AppData", "Local") : "");
+    if (!appData) {
+      throw new Error("Could not resolve the Windows application-data directory.");
+    }
+    return join2(appData, ...browser.dirs.win32.split("/"));
+  },
+  getDecryptionKey(chromeDir, browser = getActiveBrowser()) {
+    const requestedDir = chromeDir || this.getDefaultChromeDir(browser);
+    const dir = resolveLocalStateDir(requestedDir);
+    _lastResolvedDir = dir;
+    _lastResolvedBrowser = browser;
+    const cached = _cachedKeys.get(dir);
+    if (cached !== void 0) {
+      if (!_cachedABEKeys.has(dir)) {
+        try {
+          this.getAppBoundKey?.(dir, browser);
+        } catch {
+        }
+      }
+      return cached;
+    }
+    const localStatePath = join2(dir, "Local State");
+    if (!existsSync(localStatePath)) {
+      throw new Error(
+        `Could not find Chrome's "Local State" at ${localStatePath}.
+Run Google Chrome at least once so it creates the encryption key.`
+      );
+    }
+    let encryptedKeyB64;
+    try {
+      const raw = readFileSync(localStatePath, "utf-8");
+      encryptedKeyB64 = JSON.parse(raw)?.os_crypt?.encrypted_key;
+    } catch (err) {
+      throw new Error(`Failed to read os_crypt.encrypted_key from Local State: ${err.message}`);
+    }
+    if (!encryptedKeyB64) {
+      throw new Error(
+        "No os_crypt.encrypted_key found in Local State.\nThis profile may predate Chrome's encrypted-key scheme."
+      );
+    }
+    const encryptedKey = Buffer.from(encryptedKeyB64, "base64");
+    if (!encryptedKey.subarray(0, DPAPI_PREFIX.length).equals(DPAPI_PREFIX)) {
+      throw new Error('Unexpected encrypted_key format (missing "DPAPI" prefix).');
+    }
+    const key = dpapiDecrypt(encryptedKey.subarray(DPAPI_PREFIX.length));
+    _cachedKeys.set(dir, key);
+    try {
+      this.getAppBoundKey?.(dir, browser);
+    } catch {
+    }
+    return key;
+  },
+  getAppBoundKey(chromeDir, browser = _lastResolvedBrowser ?? getActiveBrowser()) {
+    const requestedDir = chromeDir || _lastResolvedDir || this.getDefaultChromeDir(browser);
+    const dir = resolveLocalStateDir(requestedDir);
+    _lastResolvedDir = dir;
+    _lastResolvedBrowser = browser;
+    const cached = _cachedABEKeys.get(dir);
+    if (cached !== void 0) {
+      return cached;
+    }
+    const localStatePath = join2(dir, "Local State");
+    if (!existsSync(localStatePath)) return void 0;
+    let appBoundKeyB64;
+    try {
+      const raw = readFileSync(localStatePath, "utf-8");
+      appBoundKeyB64 = JSON.parse(raw)?.os_crypt?.app_bound_encrypted_key;
+    } catch {
+      return void 0;
+    }
+    if (!appBoundKeyB64) return void 0;
+    const appBoundKey = Buffer.from(appBoundKeyB64, "base64");
+    if (!appBoundKey.subarray(0, APPB_PREFIX.length).equals(APPB_PREFIX)) {
+      return void 0;
+    }
+    const abeKey = abeDecrypt(appBoundKey.subarray(APPB_PREFIX.length), browser.id);
+    if (!abeKey) return void 0;
+    const key = abeKey.length > 32 ? abeKey.subarray(abeKey.length - 32) : abeKey;
+    _cachedABEKeys.set(dir, key);
+    return key;
+  },
+  decrypt(blob, key) {
+    const prefix = blob.subarray(0, 3).toString("utf-8");
+    if (prefix === "v20") {
+      const abeKey = this.getAppBoundKey?.(_lastResolvedDir, _lastResolvedBrowser);
+      if (!abeKey) {
+        return "<v20 app-bound encryption - requires chrome_abe_decrypt.exe>";
+      }
+      return decryptValueBufferGcmV20(blob, abeKey);
+    }
+    return decryptValueBufferGcm(blob, key);
+  },
+  clearCache() {
+    _cachedKeys.clear();
+    _cachedABEKeys.clear();
+    _lastResolvedDir = void 0;
+    _lastResolvedBrowser = void 0;
+  }
+};
+
+// src/core/platform/linux.ts
+import { execFileSync as execFileSync3 } from "node:child_process";
+import { homedir as homedir2 } from "node:os";
+import { join as join3 } from "node:path";
+import { pbkdf2Sync as pbkdf2Sync2 } from "node:crypto";
+var PBKDF2_ITERATIONS2 = 1;
+var PBKDF2_KEY_LENGTH2 = 16;
+var PBKDF2_SALT2 = Buffer.from("saltysalt");
+var FALLBACK_PASSWORD = "peanuts";
+var _cachedKeys2 = /* @__PURE__ */ new Map();
+function getStoragePassword(application) {
+  const provider = getKeychainPasswordProvider();
+  if (provider) {
+    return provider(application);
+  }
+  try {
+    const out = execFileSync3(
+      "secret-tool",
+      ["lookup", "application", application],
+      { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }
+    ).trim();
+    if (out) return out;
+  } catch {
+  }
+  return FALLBACK_PASSWORD;
+}
+var linux = {
+  name: "linux",
+  getDefaultChromeDir(browser = getActiveBrowser()) {
+    const configHome = process.env.XDG_CONFIG_HOME || join3(homedir2(), ".config");
+    return join3(configHome, ...browser.dirs.linux.split("/"));
+  },
+  getDecryptionKey(_chromeDir, browser = getActiveBrowser()) {
+    const application = browser.linuxSecretApp || "chrome";
+    const cached = _cachedKeys2.get(application);
+    if (cached !== void 0) {
+      return cached;
+    }
+    const key = pbkdf2Sync2(
+      getStoragePassword(application),
+      PBKDF2_SALT2,
+      PBKDF2_ITERATIONS2,
+      PBKDF2_KEY_LENGTH2,
+      "sha1"
+    );
+    _cachedKeys2.set(application, key);
+    return key;
+  },
+  decrypt(blob, key) {
+    return decryptValueBuffer(blob, key);
+  },
+  clearCache() {
+    _cachedKeys2.clear();
+  }
+};
+
+// src/core/platform/index.ts
+var _active2 = null;
+function selectPlatform() {
+  if (_active2) return _active2;
+  switch (process.platform) {
+    case "darwin":
+      _active2 = darwin;
+      break;
+    case "win32":
+      _active2 = win32;
+      break;
+    case "linux":
+      _active2 = linux;
+      break;
+    default:
+      throw new Error(
+        `Unsupported platform: ${process.platform}. chrome-tools supports macOS, Windows, and Linux.`
+      );
+  }
+  return _active2;
+}
+function getPlatformChromeDir(browser) {
+  return selectPlatform().getDefaultChromeDir(resolveTargetBrowser(browser));
+}
+function deriveEncryptionKey2(chromeDir, browser) {
+  return selectPlatform().getDecryptionKey(chromeDir, resolveTargetBrowser(browser));
+}
+function decryptValueBuffer2(blob, key) {
+  if (!blob || blob.length === 0) {
+    return Buffer.alloc(0);
+  }
+  const buf = Buffer.isBuffer(blob) ? blob : Buffer.from(blob);
+  return selectPlatform().decrypt(buf, key);
+}
+function decryptValue(blob, key) {
+  const decrypted = decryptValueBuffer2(blob, key);
+  return Buffer.isBuffer(decrypted) ? decrypted.toString("utf-8") : decrypted;
+}
+function clearKeyCache() {
+  selectPlatform().clearCache();
+}
+function resolveTargetBrowser(browser) {
+  if (!browser) return getActiveBrowser();
+  return typeof browser === "string" ? requireBrowser(browser) : browser;
+}
+
+// src/core/chrome.ts
+var PROFILE_INDICATORS = [
+  "Login Data",
+  "History",
+  "Bookmarks",
+  "Cookies",
+  "Web Data",
+  "Local Storage",
+  "Preferences"
+];
+function resolveCookiesDatabasePath(profilePath) {
+  const networkPath = join4(profilePath, "Network", "Cookies");
+  return existsSync2(networkPath) ? networkPath : join4(profilePath, "Cookies");
+}
+function isProfileDirectory(dir) {
+  return PROFILE_INDICATORS.some((file) => existsSync2(join4(dir, file))) || existsSync2(resolveCookiesDatabasePath(dir));
+}
+function getDefaultChromeDir(browser) {
+  return getPlatformChromeDir(browser);
+}
+function detectInstalledBrowsers({ includeMissing = false } = {}) {
+  const out = [];
+  for (const browser of listBrowsers()) {
+    const chromeDir = getDefaultChromeDir(browser);
+    const installed = existsSync2(chromeDir);
+    if (!installed && !includeMissing) continue;
+    out.push({
+      browser,
+      chromeDir,
+      installed,
+      profileCount: installed ? discoverProfiles(chromeDir).length : 0
+    });
+  }
+  return out;
+}
+function discoverProfiles(chromeDir) {
+  const dir = chromeDir || getDefaultChromeDir();
+  if (!dir || !existsSync2(dir)) {
+    return [];
+  }
+  try {
+    const entries = readdirSync(dir, { withFileTypes: true });
+    const profiles = [];
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      if (entry.name === "Network") continue;
+      const profilePath = join4(dir, entry.name);
+      if (isProfileDirectory(profilePath)) {
+        profiles.push({ name: entry.name, path: profilePath });
+      }
+    }
+    if (profiles.length === 0 && isProfileDirectory(dir)) {
+      const name = basename(dir) || "Default";
+      profiles.push({ name, path: dir });
+    }
+    return profiles;
+  } catch {
+    return [];
+  }
+}
+function getProfileMetadata(chromeDir) {
+  const dir = chromeDir || getDefaultChromeDir();
+  const localStatePath = join4(dir, "Local State");
+  if (!existsSync2(localStatePath)) {
+    return [];
+  }
+  try {
+    const raw = readFileSync2(localStatePath, "utf-8");
+    const localState = JSON.parse(raw);
+    const infoCache = localState?.profile?.info_cache;
+    if (!infoCache || typeof infoCache !== "object") {
+      return [];
+    }
+    return Object.entries(infoCache).map(([dirName, infoAny]) => {
+      const info = infoAny;
+      return {
+        directory: dirName,
+        name: info.name || dirName,
+        gaiaName: info.gaia_name || "",
+        userName: info.user_name || "",
+        email: info.user_name || "",
+        avatarIcon: info.avatar_icon || "",
+        isUsingDefaultName: info.is_using_default_name ?? true,
+        isEphemeral: info.is_ephemeral ?? false,
+        activeTime: info.active_time || 0
+      };
+    });
+  } catch {
+    return [];
+  }
+}
+function getProfileStates(chromeDir) {
+  const dir = chromeDir || getDefaultChromeDir();
+  const discovered = discoverProfiles(dir);
+  const metadata = getProfileMetadata(dir);
+  const metaMap = /* @__PURE__ */ new Map();
+  for (const m of metadata) {
+    metaMap.set(m.directory, m);
+  }
+  return discovered.map((profile) => {
+    const meta = metaMap.get(profile.name);
+    const profilePath = profile.path;
+    const dataFiles = {};
+    for (const file of PROFILE_INDICATORS) {
+      dataFiles[file.replace(/\s+/g, "_").toLowerCase()] = existsSync2(
+        join4(profilePath, file)
+      );
+    }
+    dataFiles.cookies = existsSync2(resolveCookiesDatabasePath(profilePath));
+    dataFiles.top_sites = existsSync2(join4(profilePath, "Top Sites"));
+    dataFiles.extensions = existsSync2(join4(profilePath, "Extensions"));
+    return {
+      directory: profile.name,
+      path: profilePath,
+      displayName: meta?.name || profile.name,
+      gaiaName: meta?.gaiaName || "",
+      email: meta?.email || "",
+      avatarIcon: meta?.avatarIcon || "",
+      isEphemeral: meta?.isEphemeral ?? false,
+      activeTime: meta?.activeTime || 0,
+      dataFiles
+    };
+  });
+}
+function resolveProfilePath(chromeDir, profileName) {
+  const dir = chromeDir || getDefaultChromeDir();
+  const profilePath = join4(dir, profileName);
+  return existsSync2(profilePath) ? profilePath : null;
+}
+function resolveTargetProfiles({
+  profilePath,
+  chromeDir,
+  profile,
+  browser
+} = {}) {
+  const targetBrowser = browser ? requireBrowser(browser) : void 0;
+  const dir = profilePath || chromeDir || getDefaultChromeDir(targetBrowser);
+  const allProfiles = discoverProfiles(dir);
+  if (profile) {
+    const match = allProfiles.filter((p) => p.name === profile);
+    if (match.length === 0) {
+      throw new Error(`Profile "${profile}" not found in ${dir}`);
+    }
+    return match;
+  }
+  return allProfiles;
+}
+
+// src/core/db.ts
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { copyFileSync as copyFileSync2, existsSync as existsSync3, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join5, basename as basename2 } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+var SQLITE_BUSY = 5;
+var SQLITE_LOCKED = 6;
+var SQLITE_CANTOPEN = 14;
+function shouldCopyDatabase(err) {
+  const errcode = err?.errcode;
+  if (typeof errcode === "number") {
+    const primary = errcode & 255;
+    if (primary === SQLITE_BUSY || primary === SQLITE_LOCKED || primary === SQLITE_CANTOPEN) {
+      return true;
+    }
+  }
+  const message = err instanceof Error ? err.message : String(err);
+  return /database is locked|database is busy|unable to open database file/i.test(message);
+}
+function toCallerTypes(rows) {
+  return rows.map((row) => {
+    const plain = {};
+    for (const key of Object.keys(row)) {
+      const value = row[key];
+      if (typeof value === "bigint") {
+        plain[key] = Number(value);
+      } else if (value instanceof Uint8Array && !Buffer.isBuffer(value)) {
+        plain[key] = Buffer.from(value.buffer, value.byteOffset, value.byteLength);
+      } else {
+        plain[key] = value;
+      }
+    }
+    return plain;
+  });
+}
+function findLockedCopyHelper() {
+  const base = import.meta.dirname ?? "";
+  const candidates = [
+    join5(base, "chrome_abe_decrypt.exe"),
+    join5(base, "..", "bin", "chrome_abe_decrypt.exe"),
+    join5(base, "..", "..", "bin", "chrome_abe_decrypt.exe"),
+    join5(base, "..", "..", "..", "bin", "chrome_abe_decrypt.exe"),
+    join5(base, "..", "..", "src", "native", "chrome_abe_decrypt.exe")
+  ];
+  for (const p of candidates) {
+    if (existsSync3(p)) return p;
+  }
+  return null;
+}
+function copyLockedFileWindows(src, dst) {
+  const helper = findLockedCopyHelper();
+  if (helper) {
+    try {
+      execFileSync4(helper, ["--copy-locked", src, dst], {
+        stdio: ["pipe", "pipe", "pipe"],
+        windowsHide: true,
+        timeout: 15e3
+      });
+      if (existsSync3(dst)) return;
+    } catch {
+    }
+  }
+  const psScript = `
+$ErrorActionPreference = "Stop";
+$in = [Console]::In.ReadToEnd() | ConvertFrom-Json;
+$src = $in.src;
+$dst = $in.dst;
+$code = @"
+using System;
+using System.IO;
+using System.Text;
+using System.Collections.Generic;
+using System.Runtime.InteropServices;
+using Microsoft.Win32.SafeHandles;
+
+public class LockedFileCopier {
+    [DllImport("rstrtmgr.dll", CharSet = CharSet.Unicode)]
+    static extern int RmStartSession(out uint pSessionHandle, int dwSessionFlags, string strSessionKey);
+
+    [DllImport("rstrtmgr.dll")]
+    static extern int RmEndSession(uint pSessionHandle);
+
+    [DllImport("rstrtmgr.dll", CharSet = CharSet.Unicode)]
+    static extern int RmRegisterResources(uint pSessionHandle, uint nFiles, string[] rgsFilenames,
+        uint nApplications, [In] uint[] rgApplications, uint nServices, string[] rgsServiceNames);
+
+    [DllImport("rstrtmgr.dll")]
+    static extern int RmGetList(uint pSessionHandle, out uint pnProcInfoNeeded,
+        ref uint pnProcInfo, [In, Out] RM_PROCESS_INFO[] rgAffectedApps, ref uint lpdwRebootReasons);
+
+    [StructLayout(LayoutKind.Sequential)]
+    struct RM_UNIQUE_PROCESS {
+        public int dwProcessId;
+        public System.Runtime.InteropServices.ComTypes.FILETIME ProcessStartTime;
+    }
+
+    [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+    struct RM_PROCESS_INFO {
+        public RM_UNIQUE_PROCESS Process;
+        [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 256)]
+        public string strAppName;
+        [MarshalAs(UnmanagedType.ByValTStr, SizeConst = 64)]
+        public string strServiceShortName;
+        public int ApplicationType;
+        public uint AppStatus;
+        public uint TSSessionId;
+        [MarshalAs(UnmanagedType.Bool)]
+        public bool bRestartable;
+    }
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern IntPtr OpenProcess(int processAccess, bool bInheritHandle, int processId);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool DuplicateHandle(
+        IntPtr hSourceProcessHandle,
+        IntPtr hSourceHandle,
+        IntPtr hTargetProcessHandle,
+        out IntPtr lpTargetHandle,
+        uint dwDesiredAccess,
+        [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle,
+        uint dwOptions);
+
+    [DllImport("kernel32.dll", SetLastError = true, CharSet = CharSet.Auto)]
+    public static extern uint GetFinalPathNameByHandle(IntPtr hFile, [Out] StringBuilder lpszFilePath, uint cchFilePath, uint dwFlags);
+
+    [DllImport("kernel32.dll", SetLastError = true)]
+    public static extern bool CloseHandle(IntPtr hObject);
+
+    [DllImport("ntdll.dll")]
+    public static extern int NtQuerySystemInformation(int SystemInformationClass, IntPtr SystemInformation, int SystemInformationLength, out int ReturnLength);
+
+    [StructLayout(LayoutKind.Sequential)]
+    public struct SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX {
+        public IntPtr Object;
+        public IntPtr UniqueProcessId;
+        public IntPtr HandleValue;
+        public uint GrantedAccess;
+        public ushort CreatorBackTraceIndex;
+        public ushort ObjectTypeIndex;
+        public uint HandleAttributes;
+        public uint Reserved;
+    }
+
+    public static bool CopyLockedFile(string sourcePath, string destPath) {
+        uint sessionHandle;
+        string sessionKey = Guid.NewGuid().ToString();
+        int res = RmStartSession(out sessionHandle, 0, sessionKey);
+        if (res != 0) return false;
+
+        List<int> pids = new List<int>();
+        try {
+            string[] resources = new string[] { sourcePath };
+            res = RmRegisterResources(sessionHandle, (uint)resources.Length, resources, 0, null, 0, null);
+            if (res == 0) {
+                uint nNeeded = 0;
+                uint nProcInfo = 0;
+                uint rebootReasons = 0;
+                res = RmGetList(sessionHandle, out nNeeded, ref nProcInfo, null, ref rebootReasons);
+                if (res == 234 && nNeeded > 0) {
+                    RM_PROCESS_INFO[] procInfo = new RM_PROCESS_INFO[nNeeded];
+                    nProcInfo = nNeeded;
+                    res = RmGetList(sessionHandle, out nNeeded, ref nProcInfo, procInfo, ref rebootReasons);
+                    if (res == 0) {
+                        for (int i = 0; i < nProcInfo; i++) {
+                            pids.Add(procInfo[i].Process.dwProcessId);
+                        }
+                    }
+                }
+            }
+        } finally {
+            RmEndSession(sessionHandle);
+        }
+
+        if (pids.Count == 0) return false;
+
+        int infoLength = 0x10000;
+        IntPtr infoPtr = Marshal.AllocHGlobal(infoLength);
+        int retLen;
+        while (NtQuerySystemInformation(64, infoPtr, infoLength, out retLen) == unchecked((int)0xc0000004)) {
+            Marshal.FreeHGlobal(infoPtr);
+            infoLength = retLen + 0x10000;
+            infoPtr = Marshal.AllocHGlobal(infoLength);
+        }
+
+        long handleCount = Marshal.ReadInt64(infoPtr);
+        IntPtr currentPtr = new IntPtr(infoPtr.ToInt64() + 16);
+        int entrySize = Marshal.SizeOf(typeof(SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX));
+        string normSource = Path.GetFullPath(sourcePath);
+
+        bool success = false;
+        foreach (int pid in pids) {
+            IntPtr hProcess = OpenProcess(0x0040 | 0x0400, false, pid);
+            if (hProcess == IntPtr.Zero) continue;
+
+            try {
+                IntPtr entryPtr = currentPtr;
+                for (long i = 0; i < handleCount; i++) {
+                    SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX entry = (SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX)Marshal.PtrToStructure(entryPtr, typeof(SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX));
+                    entryPtr = new IntPtr(entryPtr.ToInt64() + entrySize);
+
+                    if (entry.UniqueProcessId.ToInt64() == pid) {
+                        IntPtr dupHandle;
+                        if (DuplicateHandle(hProcess, entry.HandleValue, new IntPtr(-1), out dupHandle, 0, false, 2)) {
+                            StringBuilder sb = new StringBuilder(1024);
+                            uint len = GetFinalPathNameByHandle(dupHandle, sb, (uint)sb.Capacity, 0);
+                            if (len > 0) {
+                                string filePath = sb.ToString();
+                                if (filePath.StartsWith(@"\\\\?\\")) filePath = filePath.Substring(4);
+                                if (string.Equals(filePath, normSource, StringComparison.OrdinalIgnoreCase)) {
+                                    try {
+                                        using (FileStream fsIn = new FileStream(new SafeFileHandle(dupHandle, false), FileAccess.Read))
+                                        using (FileStream fsOut = new FileStream(destPath, FileMode.Create, FileAccess.Write)) {
+                                            fsIn.Position = 0;
+                                            fsIn.CopyTo(fsOut);
+                                        }
+                                        success = true;
+                                        CloseHandle(dupHandle);
+                                        break;
+                                    } catch {}
+                                }
+                            }
+                            CloseHandle(dupHandle);
+                        }
+                    }
+                }
+            } finally {
+                CloseHandle(hProcess);
+            }
+            if (success) break;
+        }
+
+        Marshal.FreeHGlobal(infoPtr);
+        return success;
+    }
+}
+"@;
+Add-Type -TypeDefinition $code;
+$res = [LockedFileCopier]::CopyLockedFile($src, $dst);
+if (-not $res) { exit 1 }
+`;
+  execFileSync4(
+    "powershell.exe",
+    ["-NoProfile", "-NonInteractive", "-Command", psScript],
+    {
+      input: JSON.stringify({ src, dst }),
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"],
+      windowsHide: true,
+      timeout: 3e4
+    }
+  );
+}
+function copySingleFileWithFallback(src, dst) {
+  try {
+    copyFileSync2(src, dst);
+  } catch (err) {
+    if (process.platform === "win32" && (err.code === "EBUSY" || err.code === "EPERM")) {
+      copyLockedFileWindows(src, dst);
+      return;
+    }
+    throw err;
+  }
+}
+function copyLockedDatabase(dbFilePath, tmpDb) {
+  copySingleFileWithFallback(dbFilePath, tmpDb);
+  for (const suffix of ["-wal", "-shm", "-journal"]) {
+    const sidecar = `${dbFilePath}${suffix}`;
+    if (existsSync3(sidecar)) {
+      try {
+        copySingleFileWithFallback(sidecar, `${tmpDb}${suffix}`);
+      } catch {
+      }
+    }
+  }
+}
+function queryDatabase(dbFilePath, sql, params = []) {
+  if (!existsSync3(dbFilePath)) {
+    throw new Error(`Database file not found: ${dbFilePath}`);
+  }
+  const tmpDir = mkdtempSync(join5(tmpdir(), "chrome-tools-"));
+  const tmpDb = join5(tmpDir, basename2(dbFilePath));
+  let sourceDb;
+  try {
+    sourceDb = new DatabaseSync(dbFilePath, {
+      // `readOnly`, not `readonly`. An unrecognized option is *ignored* rather
+      // than rejected, so the lowercase spelling — which is what better-sqlite3
+      // called it, and what this line used to say — silently hands back a
+      // writable handle onto the user's live browser profile.
+      readOnly: true,
+      // No `fileMustExist` equivalent, and none needed: a read-only open will
+      // not create the file, and the `existsSync` guard above is the explicit
+      // check that turns a missing store into a message worth reading.
+      //
+      // No wait. A running Chrome holds these stores in `locking_mode =
+      // EXCLUSIVE` for as long as it is open, so a busy timeout here buys
+      // nothing that waiting longer would win — the lock is not transient, and
+      // the copy below is the answer to it either way. Five seconds *per store*
+      // was the whole cost of reading a saved login while the browser was up:
+      // two stores, ten seconds, spent to arrive at the fallback that then
+      // succeeded instantly.
+      timeout: 0
+    });
+    sourceDb.prepare("VACUUM INTO ?").run(tmpDb);
+  } catch (err) {
+    if (!shouldCopyDatabase(err)) {
+      cleanupTmp(tmpDir);
+      throw new Error(`Failed to snapshot database file '${basename2(dbFilePath)}': ${err.message}`);
+    }
+    try {
+      copyLockedDatabase(dbFilePath, tmpDb);
+    } catch (copyErr) {
+      cleanupTmp(tmpDir);
+      throw new Error(
+        `Failed to snapshot database file '${basename2(dbFilePath)}': ${err.message} (copying it instead also failed: ${copyErr.message})`
+      );
+    }
+  } finally {
+    if (sourceDb) {
+      try {
+        sourceDb.close();
+      } catch {
+      }
+    }
+  }
+  let db;
+  try {
+    db = new DatabaseSync(tmpDb, { readOnly: true, timeout: 5e3 });
+    const stmt = db.prepare(sql);
+    stmt.setReadBigInts(true);
+    return toCallerTypes(
+      params.length > 0 ? stmt.all(...params) : stmt.all()
+    );
+  } catch (err) {
+    throw new Error(`Database query failed on '${basename2(dbFilePath)}': ${err.message}`);
+  } finally {
+    if (db) {
+      try {
+        db.close();
+      } catch {
+      }
+    }
+    cleanupTmp(tmpDir);
+  }
+}
+function tableExists(dbFilePath, tableName) {
+  try {
+    const rows = queryDatabase(
+      dbFilePath,
+      `SELECT name FROM sqlite_master WHERE type='table' AND name=?`,
+      [tableName]
+    );
+    return rows.length > 0;
+  } catch {
+    return false;
+  }
+}
+function cleanupTmp(tmpDir) {
+  try {
+    rmSync(tmpDir, { recursive: true, force: true });
+  } catch {
+  }
+}
+
+// src/modules/passwords.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { join as join6 } from "node:path";
+var PASSWORD_STORES = [
+  { file: "Login Data", source: "device" },
+  { file: "Login Data For Account", source: "account" }
+];
+var AUTOMATION_DIR = join6(homedir3(), ".chrome_cdp_profile");
+var AUTOMATION_CONFIG = join6(homedir3(), ".config", "chrome-cdp-manager", "config.json");
+var AUTOMATION_OFF = ["0", "off", "none", "false"];
+function automationChromeDir() {
+  const override = process.env.CHROME_AUTOMATION_DIR?.trim();
+  if (override && AUTOMATION_OFF.includes(override.toLowerCase())) return void 0;
+  const dir = override || configuredAutomationDir() || AUTOMATION_DIR;
+  return discoverProfiles(dir).length > 0 ? dir : void 0;
+}
+function configuredAutomationDir() {
+  try {
+    const stored = JSON.parse(readFileSync3(AUTOMATION_CONFIG, "utf-8"));
+    return typeof stored.profileDir === "string" && stored.profileDir ? stored.profileDir : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function passwordRoots(userDataDir, browser) {
+  const roots = [];
+  const automation = userDataDir || browser ? void 0 : automationChromeDir();
+  if (automation) roots.push(automation);
+  roots.push(userDataDir);
+  return roots;
+}
+function describePasswordStores({
+  chromeDir,
+  profilePath,
+  profile,
+  browser
+} = {}) {
+  const userDataDir = profilePath || chromeDir;
+  const reports = [];
+  for (const root of passwordRoots(userDataDir, browser)) {
+    let profiles;
+    try {
+      profiles = resolveTargetProfiles({ chromeDir: root, profile, browser });
+    } catch (error) {
+      reports.push({
+        root: root ?? "default",
+        profile: profile ?? "*",
+        file: "*",
+        source: "device",
+        exists: false,
+        rows: null,
+        error: error instanceof Error ? error.message : String(error)
+      });
+      continue;
+    }
+    for (const p of profiles) {
+      for (const store of PASSWORD_STORES) {
+        const dbPath = join6(p.path, store.file);
+        const report = {
+          root: root ?? "default",
+          profile: p.name,
+          file: store.file,
+          source: store.source,
+          exists: existsSync4(dbPath),
+          rows: null
+        };
+        try {
+          report.rows = queryDatabase(dbPath, "SELECT COUNT(*) AS n FROM logins")[0]?.n ?? 0;
+        } catch (error) {
+          report.error = error instanceof Error ? error.message : String(error);
+        }
+        reports.push(report);
+      }
+    }
+  }
+  return reports;
+}
+function getPasswords({
+  chromeDir,
+  profilePath,
+  profile,
+  search,
+  browser,
+  decryptionKey
+} = {}) {
+  const userDataDir = profilePath || chromeDir;
+  const roots = passwordRoots(userDataDir, browser);
+  const results = [];
+  const term = search?.toLowerCase();
+  let refusal;
+  let resolved = false;
+  for (const root of roots) {
+    let profiles;
+    try {
+      profiles = resolveTargetProfiles({ chromeDir: root, profile, browser });
+    } catch (error) {
+      refusal ??= error;
+      continue;
+    }
+    resolved = true;
+    let derivedKey = decryptionKey;
+    for (const p of profiles) {
+      for (const store of PASSWORD_STORES) {
+        const dbPath = join6(p.path, store.file);
+        try {
+          const rows = queryDatabase(
+            dbPath,
+            `SELECT origin_url, username_value, password_value, date_last_used
+             FROM logins ORDER BY origin_url`
+          );
+          for (const row of rows) {
+            if (term && !(row.origin_url && row.origin_url.toLowerCase().includes(term)) && !(row.username_value && row.username_value.toLowerCase().includes(term))) {
+              continue;
+            }
+            results.push({
+              profile: p.name,
+              source: store.source,
+              url: row.origin_url,
+              username: row.username_value,
+              password: row.password_value?.length > 0 ? decryptValue(
+                row.password_value,
+                derivedKey ??= deriveEncryptionKey2(root, browser)
+              ) : "",
+              lastUsed: chromeTimeToDate(row.date_last_used || 0)
+            });
+          }
+        } catch {
+        }
+      }
+    }
+  }
+  if (!resolved && refusal) throw refusal;
+  return results;
+}
+
+// src/modules/bookmarks.ts
+import { existsSync as existsSync5, readFileSync as readFileSync4 } from "node:fs";
+import { join as join7 } from "node:path";
+function flattenBookmarks(node, folderPath = "") {
+  const results = [];
+  if (!node) return results;
+  const currentPath = folderPath ? `${folderPath}/${node.name || ""}` : node.name || "";
+  if (node.type === "url") {
+    results.push({
+      title: node.name || "",
+      url: node.url || "",
+      folder: folderPath,
+      dateAdded: chromeTimeToDate(node.date_added),
+      dateLastUsed: chromeTimeToDate(node.date_last_used),
+      id: node.id,
+      guid: node.guid || ""
+    });
+  }
+  if (node.children && Array.isArray(node.children)) {
+    for (const child of node.children) {
+      results.push(...flattenBookmarks(child, currentPath));
+    }
+  }
+  return results;
+}
+function getBookmarks({
+  chromeDir,
+  profilePath,
+  profile,
+  folder,
+  search,
+  browser
+} = {}) {
+  const profiles = resolveTargetProfiles({ chromeDir, profilePath, profile, browser });
+  const results = [];
+  for (const p of profiles) {
+    const bookmarksPath = join7(p.path, "Bookmarks");
+    if (!existsSync5(bookmarksPath)) continue;
+    try {
+      const raw = readFileSync4(bookmarksPath, "utf-8");
+      const data = JSON.parse(raw);
+      const roots = data.roots;
+      if (!roots) continue;
+      const rootNames = ["bookmark_bar", "other", "synced"];
+      for (const rootName of rootNames) {
+        if (roots[rootName]) {
+          const bookmarks = flattenBookmarks(roots[rootName], "");
+          for (const bm of bookmarks) {
+            bm.profile = p.name;
+            results.push(bm);
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  let filtered = results;
+  if (folder) {
+    const term = folder.toLowerCase();
+    filtered = filtered.filter((b) => b.folder.toLowerCase().includes(term));
+  }
+  if (search) {
+    const term = search.toLowerCase();
+    filtered = filtered.filter(
+      (b) => b.title.toLowerCase().includes(term) || b.url.toLowerCase().includes(term)
+    );
+  }
+  return filtered;
+}
+
+// src/modules/history.ts
+import { join as join8 } from "node:path";
+
+// src/core/limit.ts
+function normalizeLimit(limit) {
+  if (limit === void 0) return void 0;
+  const parsed = Math.trunc(Number(limit));
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : void 0;
+}
+function limitResults(results, limit) {
+  const normalized = normalizeLimit(limit);
+  return normalized === void 0 ? results : results.slice(0, normalized);
+}
+
+// src/core/sql.ts
+function sqlLikePattern(term) {
+  return `%${term.replace(/([%_\\])/g, "\\$1")}%`;
+}
+
+// src/modules/history.ts
+function getHistory({
+  chromeDir,
+  profilePath,
+  profile,
+  search,
+  limit = 100,
+  browser
+} = {}) {
+  const profiles = resolveTargetProfiles({ chromeDir, profilePath, profile, browser });
+  const results = [];
+  const rowLimit = normalizeLimit(limit);
+  for (const p of profiles) {
+    const dbPath = join8(p.path, "History");
+    try {
+      let sql = `SELECT url, title, visit_count, last_visit_time FROM urls`;
+      const params = [];
+      if (search) {
+        sql += ` WHERE url LIKE ? ESCAPE '\\' OR IFNULL(title, '') LIKE ? ESCAPE '\\'`;
+        const like = sqlLikePattern(search);
+        params.push(like, like);
+      }
+      sql += ` ORDER BY last_visit_time DESC`;
+      if (rowLimit) {
+        sql += ` LIMIT ${rowLimit}`;
+      }
+      const rows = queryDatabase(dbPath, sql, params);
+      for (const row of rows) {
+        results.push({
+          profile: p.name,
+          url: row.url,
+          title: row.title || "",
+          visitCount: row.visit_count || 0,
+          lastVisit: chromeTimeToDate(row.last_visit_time || 0)
+        });
+      }
+    } catch {
+    }
+  }
+  return limitResults(results, limit);
+}
+function getSearchTerms({
+  chromeDir,
+  profilePath,
+  profile,
+  limit = 100,
+  browser
+} = {}) {
+  const profiles = resolveTargetProfiles({ chromeDir, profilePath, profile, browser });
+  const results = [];
+  const rowLimit = normalizeLimit(limit);
+  for (const p of profiles) {
+    const dbPath = join8(p.path, "History");
+    try {
+      let sql = `SELECT kst.term, u.url
+                 FROM keyword_search_terms kst
+                 JOIN urls u ON kst.url_id = u.id
+                 ORDER BY u.last_visit_time DESC`;
+      if (rowLimit) {
+        sql += ` LIMIT ${rowLimit}`;
+      }
+      const rows = queryDatabase(dbPath, sql);
+      for (const row of rows) {
+        results.push({
+          profile: p.name,
+          term: row.term || "",
+          url: row.url || ""
+        });
+      }
+    } catch {
+    }
+  }
+  return limitResults(results, limit);
+}
+
+// src/modules/cookies.ts
+import { existsSync as existsSync6 } from "node:fs";
+import { createHash } from "node:crypto";
+function decodeCookieValue(encryptedValue, derivedKey, hostKey) {
+  const decrypted = decryptValueBuffer2(encryptedValue, derivedKey);
+  if (!Buffer.isBuffer(decrypted)) {
+    return decrypted;
+  }
+  const hostHash = createHash("sha256").update(hostKey).digest();
+  const valueBytes = decrypted.length >= hostHash.length && decrypted.subarray(0, hostHash.length).equals(hostHash) ? decrypted.subarray(hostHash.length) : decrypted;
+  return valueBytes.toString("utf-8");
+}
+function parseURL(urlStr) {
+  if (!urlStr) return null;
+  try {
+    return new URL(urlStr);
+  } catch {
+    try {
+      if (!/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(urlStr)) {
+        return new URL("https://" + urlStr);
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function getPossibleHostKeys(hostname) {
+  const keys = /* @__PURE__ */ new Set();
+  keys.add(hostname);
+  keys.add("." + hostname);
+  const parts = hostname.split(".");
+  for (let i = 1; i < parts.length; i++) {
+    const suffix = parts.slice(i).join(".");
+    keys.add(suffix);
+    keys.add("." + suffix);
+  }
+  return Array.from(keys);
+}
+function domainMatch(hostname, hostKey) {
+  if (hostname === hostKey) {
+    return true;
+  }
+  if (hostKey.startsWith(".")) {
+    if (hostname === hostKey.slice(1) || hostname.endsWith(hostKey)) {
+      return true;
+    }
+  }
+  return false;
+}
+function pathMatch(urlPath, cookiePath) {
+  const uPath = urlPath || "/";
+  const cPath = cookiePath || "/";
+  if (cPath === "/") {
+    return true;
+  }
+  if (uPath === cPath) {
+    return true;
+  }
+  if (uPath.startsWith(cPath)) {
+    if (cPath.endsWith("/") || uPath[cPath.length] === "/") {
+      return true;
+    }
+  }
+  return false;
+}
+function getCookies({
+  chromeDir,
+  profilePath,
+  profile,
+  browser,
+  domain,
+  url,
+  decrypt = true,
+  limit = 100,
+  decryptionKey
+} = {}) {
+  const userDataDir = profilePath || chromeDir;
+  const profiles = resolveTargetProfiles({ chromeDir, profilePath, profile, browser });
+  let derivedKey = decryptionKey;
+  const results = [];
+  const parsedUrl = parseURL(url);
+  const rowLimit = normalizeLimit(limit);
+  let firstReadError;
+  for (const p of profiles) {
+    const dbPath = resolveCookiesDatabasePath(p.path);
+    if (!existsSync6(dbPath)) continue;
+    try {
+      let sql = `SELECT host_key, name, value, encrypted_value, path,
+                        expires_utc, is_secure, is_httponly, samesite,
+                        creation_utc, last_access_utc
+                 FROM cookies`;
+      const conditions = [];
+      const params = [];
+      if (domain) {
+        conditions.push(`host_key LIKE ?`);
+        params.push(`%${domain}%`);
+      } else if (parsedUrl) {
+        const hostKeys = getPossibleHostKeys(parsedUrl.hostname);
+        const placeholders = hostKeys.map(() => "?").join(", ");
+        conditions.push(`host_key IN (${placeholders})`);
+        params.push(...hostKeys);
+      }
+      if (conditions.length > 0) {
+        sql += ` WHERE ${conditions.join(" AND ")}`;
+      }
+      sql += ` ORDER BY host_key, name`;
+      if (rowLimit && !url) {
+        sql += ` LIMIT ${rowLimit}`;
+      }
+      const rows = queryDatabase(dbPath, sql, params);
+      for (const row of rows) {
+        if (parsedUrl) {
+          if (!domainMatch(parsedUrl.hostname, row.host_key || "")) continue;
+          if (!pathMatch(parsedUrl.pathname || "/", row.path || "/")) continue;
+          if (row.is_secure && parsedUrl.protocol !== "https:") continue;
+        }
+        let cookieValue = row.value || "";
+        if (!cookieValue && row.encrypted_value?.length > 0 && decrypt) {
+          cookieValue = decodeCookieValue(
+            row.encrypted_value,
+            derivedKey ??= deriveEncryptionKey2(userDataDir, browser),
+            row.host_key || ""
+          );
+        }
+        results.push({
+          profile: p.name,
+          domain: row.host_key || "",
+          name: row.name || "",
+          value: cookieValue,
+          path: row.path || "/",
+          expires: chromeTimeToDate(row.expires_utc || 0),
+          secure: Boolean(row.is_secure),
+          httpOnly: Boolean(row.is_httponly),
+          sameSite: ["unspecified", "lax", "strict", "none"][row.samesite] || "unspecified",
+          created: chromeTimeToDate(row.creation_utc || 0),
+          lastAccessed: chromeTimeToDate(row.last_access_utc || 0)
+        });
+      }
+    } catch (error) {
+      firstReadError ??= new Error(
+        `Could not read cookies for profile "${p.name}" at ${dbPath}: ` + (error instanceof Error ? error.message : String(error))
+      );
+    }
+  }
+  if (results.length === 0 && firstReadError) throw firstReadError;
+  return limitResults(results, limit);
+}
+
+// src/modules/local-storage.ts
+import { cpSync, existsSync as existsSync7, mkdtempSync as mkdtempSync2, readdirSync as readdirSync2, readFileSync as readFileSync5, rmSync as rmSync2 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { basename as basename3, join as join9 } from "node:path";
+var TABLE_MAGIC = 0xdb4775248b80fb57n;
+var LOG_BLOCK_SIZE = 32768;
+var VALUE_TYPE_DELETION = 0;
+var VALUE_TYPE_VALUE = 1;
+function getLocalStorage({
+  chromeDir,
+  profilePath,
+  profile,
+  browser,
+  origin,
+  url,
+  key,
+  search,
+  limit = 100
+} = {}) {
+  const profiles = resolveTargetProfiles({ chromeDir, profilePath, profile, browser });
+  const results = [];
+  const originFilter = normalizeOriginFilter(url || origin);
+  const keyFilter = key?.toLowerCase();
+  const searchFilter = search?.toLowerCase();
+  for (const p of profiles) {
+    const dbPath = join9(p.path, "Local Storage", "leveldb");
+    if (!existsSync7(dbPath)) continue;
+    let tmpPath = null;
+    try {
+      tmpPath = copyLevelDBToTemp(dbPath);
+      const rawRecords = readLevelDBRecords(tmpPath);
+      for (const record of rawRecords.values()) {
+        if (record.deleted || !record.value) continue;
+        const parsed = parseLocalStorageRecord(record.key, record.value);
+        if (!parsed) continue;
+        const entry = {
+          profile: p.name,
+          origin: parsed.origin,
+          key: parsed.key,
+          value: parsed.value
+        };
+        if (originFilter && !entry.origin.toLowerCase().includes(originFilter)) {
+          continue;
+        }
+        if (keyFilter && !entry.key.toLowerCase().includes(keyFilter)) {
+          continue;
+        }
+        if (searchFilter) {
+          const haystack = `${entry.origin}
+${entry.key}
+${entry.value}`.toLowerCase();
+          if (!haystack.includes(searchFilter)) continue;
+        }
+        results.push(entry);
+      }
+    } catch {
+    } finally {
+      if (tmpPath) {
+        rmSync2(tmpPath, { recursive: true, force: true });
+      }
+    }
+  }
+  results.sort(
+    (a, b) => a.profile.localeCompare(b.profile) || a.origin.localeCompare(b.origin) || a.key.localeCompare(b.key)
+  );
+  return limitResults(results, limit);
+}
+function copyLevelDBToTemp(dbPath) {
+  const tmpPath = mkdtempSync2(join9(tmpdir2(), "chrome-local-storage-"));
+  cpSync(dbPath, tmpPath, {
+    recursive: true,
+    force: true,
+    filter: (source) => basename3(source) !== "LOCK"
+  });
+  return tmpPath;
+}
+function readLevelDBRecords(dbPath) {
+  const records = /* @__PURE__ */ new Map();
+  const files = readdirSync2(dbPath).filter((file) => /\.(log|ldb|sst)$/i.test(file)).sort();
+  for (const file of files) {
+    const filePath = join9(dbPath, file);
+    const data = readFileSync5(filePath);
+    if (/\.(ldb|sst)$/i.test(file)) {
+      for (const record of parseTableRecords(data)) {
+        applyLevelDBRecord(records, record);
+      }
+    }
+  }
+  for (const file of files) {
+    if (!/\.log$/i.test(file)) continue;
+    const filePath = join9(dbPath, file);
+    const data = readFileSync5(filePath);
+    for (const record of parseLogRecords(data)) {
+      applyLevelDBRecord(records, record);
+    }
+  }
+  return records;
+}
+function applyLevelDBRecord(records, record) {
+  const id = record.key.toString("hex");
+  const existing = records.get(id);
+  if (existing && existing.sequence > record.sequence) return;
+  records.set(id, record);
+}
+function parseLocalStorageRecord(rawKey, rawValue) {
+  if (rawKey.length < 3 || rawKey[0] !== 95) return null;
+  const separator = rawKey.indexOf(0, 1);
+  if (separator === -1) return null;
+  const origin = rawKey.subarray(1, separator).toString("utf8");
+  const key = decodeLocalStorageString(rawKey.subarray(separator + 1));
+  const value = decodeLocalStorageString(rawValue);
+  if (!origin || !key) return null;
+  return { origin, key, value };
+}
+function decodeLocalStorageString(data) {
+  if (data.length === 0) return "";
+  const format = data[0];
+  const body = data.subarray(1);
+  if (format === 0 && body.length % 2 === 0) {
+    return body.toString("utf16le");
+  }
+  if (format === 1) {
+    return body.toString("latin1");
+  }
+  return data.toString("utf8");
+}
+function normalizeOriginFilter(input) {
+  if (!input) return void 0;
+  try {
+    return new URL(input).origin.toLowerCase();
+  } catch {
+    return input.toLowerCase();
+  }
+}
+function parseLogRecords(data) {
+  const records = [];
+  let offset = 0;
+  let fragments = [];
+  while (offset + 7 <= data.length) {
+    const blockRemaining = LOG_BLOCK_SIZE - offset % LOG_BLOCK_SIZE;
+    if (blockRemaining < 7) {
+      offset += blockRemaining;
+      continue;
+    }
+    const length = data.readUInt16LE(offset + 4);
+    const type = data[offset + 6];
+    offset += 7;
+    if (type === 0 && length === 0) {
+      offset += length;
+      continue;
+    }
+    if (length > data.length - offset || length > blockRemaining - 7) {
+      break;
+    }
+    const payload = data.subarray(offset, offset + length);
+    offset += length;
+    if (type === 1) {
+      records.push(...parseWriteBatch(payload));
+      fragments = [];
+    } else if (type === 2) {
+      fragments = [Buffer.from(payload)];
+    } else if (type === 3 && fragments.length > 0) {
+      fragments.push(Buffer.from(payload));
+    } else if (type === 4 && fragments.length > 0) {
+      fragments.push(Buffer.from(payload));
+      records.push(...parseWriteBatch(Buffer.concat(fragments)));
+      fragments = [];
+    }
+  }
+  return records;
+}
+function parseWriteBatch(batch) {
+  if (batch.length < 12) return [];
+  const records = [];
+  const startSequence = readUInt64LE(batch, 0);
+  const count = batch.readUInt32LE(8);
+  let offset = 12;
+  let seen = 0;
+  while (offset < batch.length && seen < count) {
+    const tag = batch[offset++];
+    const keyPart = readLengthPrefixedSlice(batch, offset);
+    if (!keyPart) break;
+    offset = keyPart.nextOffset;
+    const sequence = startSequence + BigInt(seen);
+    if (tag === VALUE_TYPE_VALUE) {
+      const valuePart = readLengthPrefixedSlice(batch, offset);
+      if (!valuePart) break;
+      offset = valuePart.nextOffset;
+      records.push({ key: keyPart.value, value: valuePart.value, sequence, deleted: false });
+    } else if (tag === VALUE_TYPE_DELETION) {
+      records.push({ key: keyPart.value, sequence, deleted: true });
+    } else {
+      break;
+    }
+    seen++;
+  }
+  return records;
+}
+function parseTableRecords(data) {
+  const records = [];
+  if (data.length < 48) return records;
+  const magic = data.readBigUInt64LE(data.length - 8);
+  if (magic !== TABLE_MAGIC) return records;
+  const footer = data.subarray(data.length - 48, data.length - 8);
+  const metaHandle = readBlockHandle(footer, 0);
+  if (!metaHandle) return records;
+  const indexHandle = readBlockHandle(footer, metaHandle.bytesRead);
+  if (!indexHandle) return records;
+  const indexBlock = readBlock(data, indexHandle);
+  if (!indexBlock) return records;
+  for (const indexEntry of parseBlockEntries(indexBlock)) {
+    const dataHandle = readBlockHandle(indexEntry.value, 0);
+    if (!dataHandle) continue;
+    const dataBlock = readBlock(data, dataHandle);
+    if (!dataBlock) continue;
+    for (const entry of parseBlockEntries(dataBlock)) {
+      if (entry.key.length < 8) continue;
+      const internalKey = entry.key;
+      const tagOffset = internalKey.length - 8;
+      const type = internalKey[tagOffset];
+      const sequence = readSequence(internalKey.subarray(tagOffset));
+      const key = internalKey.subarray(0, tagOffset);
+      if (type === VALUE_TYPE_VALUE) {
+        records.push({ key, value: entry.value, sequence, deleted: false });
+      } else if (type === VALUE_TYPE_DELETION) {
+        records.push({ key, sequence, deleted: true });
+      }
+    }
+  }
+  return records;
+}
+function readBlock(data, handle) {
+  const trailerOffset = handle.offset + handle.size;
+  if (handle.offset < 0 || handle.size < 0 || trailerOffset + 5 > data.length) {
+    return null;
+  }
+  const block = data.subarray(handle.offset, trailerOffset);
+  const compressionType = data[trailerOffset];
+  if (compressionType === 0) {
+    return block;
+  }
+  if (compressionType === 1) {
+    try {
+      return snappyUncompress(block);
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function parseBlockEntries(block) {
+  if (block.length < 4) return [];
+  const restartCount = block.readUInt32LE(block.length - 4);
+  const restartsSize = restartCount * 4 + 4;
+  if (restartCount < 1 || restartsSize > block.length) return [];
+  const entriesEnd = block.length - restartsSize;
+  const entries = [];
+  let offset = 0;
+  let previousKey = Buffer.alloc(0);
+  while (offset < entriesEnd) {
+    const shared = readVarint32(block, offset);
+    if (!shared) break;
+    offset = shared.nextOffset;
+    const nonShared = readVarint32(block, offset);
+    if (!nonShared) break;
+    offset = nonShared.nextOffset;
+    const valueLength = readVarint32(block, offset);
+    if (!valueLength) break;
+    offset = valueLength.nextOffset;
+    if (shared.value > previousKey.length || offset + nonShared.value + valueLength.value > entriesEnd) {
+      break;
+    }
+    const key = Buffer.concat([
+      previousKey.subarray(0, shared.value),
+      block.subarray(offset, offset + nonShared.value)
+    ]);
+    offset += nonShared.value;
+    const value = Buffer.from(block.subarray(offset, offset + valueLength.value));
+    offset += valueLength.value;
+    entries.push({ key, value });
+    previousKey = key;
+  }
+  return entries;
+}
+function readBlockHandle(data, offset) {
+  const blockOffset = readVarint64(data, offset);
+  if (!blockOffset) return null;
+  const blockSize = readVarint64(data, blockOffset.nextOffset);
+  if (!blockSize) return null;
+  if (blockOffset.value > BigInt(Number.MAX_SAFE_INTEGER) || blockSize.value > BigInt(Number.MAX_SAFE_INTEGER)) {
+    return null;
+  }
+  return {
+    offset: Number(blockOffset.value),
+    size: Number(blockSize.value),
+    bytesRead: blockSize.nextOffset - offset
+  };
+}
+function readLengthPrefixedSlice(data, offset) {
+  const length = readVarint32(data, offset);
+  if (!length) return null;
+  const end = length.nextOffset + length.value;
+  if (end > data.length) return null;
+  return { value: Buffer.from(data.subarray(length.nextOffset, end)), nextOffset: end };
+}
+function readVarint32(data, offset) {
+  let result = 0;
+  let shift = 0;
+  for (let i = offset; i < data.length && i < offset + 5; i++) {
+    const byte = data[i];
+    result |= (byte & 127) << shift;
+    if ((byte & 128) === 0) {
+      return { value: result >>> 0, nextOffset: i + 1 };
+    }
+    shift += 7;
+  }
+  return null;
+}
+function readVarint64(data, offset) {
+  let result = 0n;
+  let shift = 0n;
+  for (let i = offset; i < data.length && i < offset + 10; i++) {
+    const byte = data[i];
+    result |= BigInt(byte & 127) << shift;
+    if ((byte & 128) === 0) {
+      return { value: result, nextOffset: i + 1 };
+    }
+    shift += 7n;
+  }
+  return null;
+}
+function readUInt64LE(data, offset) {
+  let value = 0n;
+  for (let i = 0; i < 8; i++) {
+    value |= BigInt(data[offset + i] || 0) << BigInt(i * 8);
+  }
+  return value;
+}
+function readSequence(tagBytes) {
+  let sequence = 0n;
+  for (let i = 1; i < 8; i++) {
+    sequence |= BigInt(tagBytes[i] || 0) << BigInt((i - 1) * 8);
+  }
+  return sequence;
+}
+function snappyUncompress(input) {
+  const expectedLength = readVarint32(input, 0);
+  if (!expectedLength) throw new Error("Invalid Snappy length");
+  const output = Buffer.alloc(expectedLength.value);
+  let ip = expectedLength.nextOffset;
+  let op = 0;
+  while (ip < input.length && op < output.length) {
+    const tag = input[ip++];
+    const type = tag & 3;
+    if (type === 0) {
+      let literalLength = tag >> 2;
+      if (literalLength < 60) {
+        literalLength += 1;
+      } else {
+        const bytesToRead = literalLength - 59;
+        if (ip + bytesToRead > input.length) throw new Error("Invalid Snappy literal");
+        literalLength = 1;
+        for (let i = 0; i < bytesToRead; i++) {
+          literalLength += input[ip++] << i * 8;
+        }
+      }
+      if (ip + literalLength > input.length || op + literalLength > output.length) {
+        throw new Error("Invalid Snappy literal length");
+      }
+      input.copy(output, op, ip, ip + literalLength);
+      ip += literalLength;
+      op += literalLength;
+      continue;
+    }
+    let copyLength;
+    let copyOffset;
+    if (type === 1) {
+      if (ip >= input.length) throw new Error("Invalid Snappy copy");
+      copyLength = (tag >> 2 & 7) + 4;
+      copyOffset = (tag & 224) << 3 | input[ip++];
+    } else if (type === 2) {
+      if (ip + 2 > input.length) throw new Error("Invalid Snappy copy");
+      copyLength = (tag >> 2) + 1;
+      copyOffset = input.readUInt16LE(ip);
+      ip += 2;
+    } else {
+      if (ip + 4 > input.length) throw new Error("Invalid Snappy copy");
+      copyLength = (tag >> 2) + 1;
+      copyOffset = input.readUInt32LE(ip);
+      ip += 4;
+    }
+    if (copyOffset <= 0 || copyOffset > op || op + copyLength > output.length) {
+      throw new Error("Invalid Snappy offset");
+    }
+    for (let i = 0; i < copyLength; i++) {
+      output[op] = output[op - copyOffset];
+      op++;
+    }
+  }
+  if (op !== output.length) throw new Error("Truncated Snappy stream");
+  return output;
+}
+
+// src/modules/autofill.ts
+import { join as join10 } from "node:path";
+function getAutofillEntries({
+  chromeDir,
+  profilePath,
+  profile,
+  browser,
+  search,
+  limit = 100
+} = {}) {
+  const profiles = resolveTargetProfiles({ chromeDir, profilePath, profile, browser });
+  const results = [];
+  const rowLimit = normalizeLimit(limit);
+  for (const p of profiles) {
+    const dbPath = join10(p.path, "Web Data");
+    try {
+      let sql = `SELECT name, value, date_created, date_last_used, count FROM autofill`;
+      const params = [];
+      if (search) {
+        sql += ` WHERE IFNULL(name, '') LIKE ? ESCAPE '\\' OR IFNULL(value, '') LIKE ? ESCAPE '\\'`;
+        const like = sqlLikePattern(search);
+        params.push(like, like);
+      }
+      sql += ` ORDER BY date_last_used DESC`;
+      if (rowLimit) {
+        sql += ` LIMIT ${rowLimit}`;
+      }
+      const rows = queryDatabase(dbPath, sql, params);
+      for (const row of rows) {
+        results.push({
+          profile: p.name,
+          name: row.name || "",
+          value: row.value || "",
+          dateCreated: chromeTimeToDate(row.date_created ? BigInt(row.date_created) * 1000000n + 11644473600000000n : 0),
+          dateLastUsed: chromeTimeToDate(row.date_last_used ? BigInt(row.date_last_used) * 1000000n + 11644473600000000n : 0),
+          count: row.count || 0
+        });
+      }
+    } catch {
+    }
+  }
+  return limitResults(results, limit);
+}
+function getCreditCards({
+  chromeDir,
+  profilePath,
+  profile,
+  browser,
+  decryptionKey
+} = {}) {
+  const userDataDir = profilePath || chromeDir;
+  const profiles = resolveTargetProfiles({ chromeDir, profilePath, profile, browser });
+  let derivedKey = decryptionKey;
+  const results = [];
+  for (const p of profiles) {
+    const dbPath = join10(p.path, "Web Data");
+    try {
+      const rows = queryDatabase(
+        dbPath,
+        `SELECT guid, name_on_card, expiration_month, expiration_year,
+                card_number_encrypted, date_modified, origin, use_count,
+                nickname
+         FROM credit_cards ORDER BY use_date DESC`
+      );
+      for (const row of rows) {
+        let cardNumber = "";
+        if (row.card_number_encrypted?.length > 0) {
+          cardNumber = decryptValue(
+            row.card_number_encrypted,
+            derivedKey ??= deriveEncryptionKey2(userDataDir, browser)
+          );
+        }
+        results.push({
+          profile: p.name,
+          guid: row.guid || "",
+          nameOnCard: row.name_on_card || "",
+          expirationMonth: row.expiration_month || 0,
+          expirationYear: row.expiration_year || 0,
+          cardNumber,
+          nickname: row.nickname || "",
+          origin: row.origin || "",
+          useCount: row.use_count || 0,
+          dateModified: chromeTimeToDate(row.date_modified ? BigInt(row.date_modified) * 1000000n + 11644473600000000n : 0)
+        });
+      }
+    } catch {
+    }
+  }
+  return results;
+}
+function getAddresses({ chromeDir, profilePath, profile, browser } = {}) {
+  const profiles = resolveTargetProfiles({ chromeDir, profilePath, profile, browser });
+  const results = [];
+  for (const p of profiles) {
+    const dbPath = join10(p.path, "Web Data");
+    try {
+      const profileRows = queryDatabase(
+        dbPath,
+        `SELECT guid, company_name, street_address,
+                city, state, zipcode, country_code, date_modified,
+                origin, use_count
+         FROM autofill_profiles ORDER BY use_date DESC`
+      );
+      let nameRows = [];
+      let emailRows = [];
+      let phoneRows = [];
+      try {
+        nameRows = queryDatabase(
+          dbPath,
+          `SELECT guid, first_name, middle_name, last_name, full_name FROM autofill_profile_names`
+        );
+      } catch {
+      }
+      try {
+        emailRows = queryDatabase(
+          dbPath,
+          `SELECT guid, email FROM autofill_profile_emails`
+        );
+      } catch {
+      }
+      try {
+        phoneRows = queryDatabase(
+          dbPath,
+          `SELECT guid, number FROM autofill_profile_phones`
+        );
+      } catch {
+      }
+      const nameMap = /* @__PURE__ */ new Map();
+      for (const n of nameRows) {
+        nameMap.set(n.guid, n.full_name || [n.first_name, n.middle_name, n.last_name].filter(Boolean).join(" "));
+      }
+      const emailMap = /* @__PURE__ */ new Map();
+      for (const e of emailRows) {
+        emailMap.set(e.guid, e.email || "");
+      }
+      const phoneMap = /* @__PURE__ */ new Map();
+      for (const ph of phoneRows) {
+        phoneMap.set(ph.guid, ph.number || "");
+      }
+      for (const row of profileRows) {
+        results.push({
+          profile: p.name,
+          guid: row.guid || "",
+          fullName: nameMap.get(row.guid) || "",
+          email: emailMap.get(row.guid) || "",
+          phone: phoneMap.get(row.guid) || "",
+          companyName: row.company_name || "",
+          streetAddress: row.street_address || "",
+          city: row.city || "",
+          state: row.state || "",
+          zipcode: row.zipcode || "",
+          countryCode: row.country_code || "",
+          origin: row.origin || "",
+          useCount: row.use_count || 0,
+          dateModified: chromeTimeToDate(row.date_modified ? BigInt(row.date_modified) * 1000000n + 11644473600000000n : 0)
+        });
+      }
+    } catch {
+    }
+  }
+  return results;
+}
+
+// src/modules/downloads.ts
+import { join as join11 } from "node:path";
+var DOWNLOAD_STATES = {
+  0: "in_progress",
+  1: "complete",
+  2: "cancelled",
+  3: "interrupted"
+};
+var DANGER_TYPES = {
+  0: "not_dangerous",
+  1: "dangerous_file",
+  2: "dangerous_url",
+  3: "dangerous_content",
+  4: "maybe_dangerous_content",
+  5: "uncommon_content",
+  6: "user_validated",
+  7: "dangerous_host",
+  8: "potentially_unwanted",
+  9: "allowlisted_by_policy"
+};
+function getDownloads({
+  chromeDir,
+  profilePath,
+  profile,
+  browser,
+  search,
+  limit = 100
+} = {}) {
+  const profiles = resolveTargetProfiles({ chromeDir, profilePath, profile, browser });
+  const results = [];
+  const rowLimit = normalizeLimit(limit);
+  for (const p of profiles) {
+    const dbPath = join11(p.path, "History");
+    try {
+      let sql = `SELECT target_path, tab_url, total_bytes, received_bytes,
+                        start_time, end_time, mime_type, original_mime_type,
+                        state, danger_type, opened, referrer, site_url
+                 FROM downloads`;
+      const params = [];
+      if (search) {
+        sql += ` WHERE IFNULL(target_path, '') LIKE ? ESCAPE '\\'
+                    OR IFNULL(tab_url, '') LIKE ? ESCAPE '\\'`;
+        const like = sqlLikePattern(search);
+        params.push(like, like);
+      }
+      sql += ` ORDER BY start_time DESC`;
+      if (rowLimit) {
+        sql += ` LIMIT ${rowLimit}`;
+      }
+      const rows = queryDatabase(dbPath, sql, params);
+      for (const row of rows) {
+        results.push({
+          profile: p.name,
+          targetPath: row.target_path || "",
+          url: row.tab_url || "",
+          siteUrl: row.site_url || "",
+          referrer: row.referrer || "",
+          totalBytes: row.total_bytes || 0,
+          receivedBytes: row.received_bytes || 0,
+          mimeType: row.mime_type || row.original_mime_type || "",
+          state: DOWNLOAD_STATES[row.state] || `unknown(${row.state})`,
+          dangerType: DANGER_TYPES[row.danger_type] || `unknown(${row.danger_type})`,
+          opened: Boolean(row.opened),
+          startTime: chromeTimeToDate(row.start_time || 0),
+          endTime: chromeTimeToDate(row.end_time || 0)
+        });
+      }
+    } catch {
+    }
+  }
+  return limitResults(results, limit);
+}
+
+// src/modules/extensions.ts
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "node:fs";
+import { join as join12 } from "node:path";
+function getExtensions({
+  chromeDir,
+  profilePath,
+  profile,
+  search,
+  browser
+} = {}) {
+  const profiles = resolveTargetProfiles({ chromeDir, profilePath, profile, browser });
+  const results = [];
+  for (const p of profiles) {
+    let settings = null;
+    for (const filename of ["Secure Preferences", "Preferences"]) {
+      const prefsPath = join12(p.path, filename);
+      if (existsSync8(prefsPath)) {
+        try {
+          const prefs = JSON.parse(readFileSync6(prefsPath, "utf-8"));
+          const candidate = prefs?.extensions?.settings;
+          if (candidate && typeof candidate === "object") {
+            settings = candidate;
+            break;
+          }
+        } catch {
+          continue;
+        }
+      }
+    }
+    if (!settings) continue;
+    for (const [extId, extDataAny] of Object.entries(settings)) {
+      const extData = extDataAny;
+      if (extData.location === 5 || extData.location === 10) continue;
+      const manifest = extData.manifest || {};
+      const entry = {
+        profile: p.name,
+        id: extId,
+        name: manifest.name || extData.name || extId,
+        version: manifest.version || extData.version || "unknown",
+        description: manifest.description || "",
+        enabled: extData.state === 1,
+        homepageUrl: manifest.homepage_url || "",
+        updateUrl: manifest.update_url || "",
+        installTime: extData.install_time || "",
+        fromWebstore: extData.from_webstore || false,
+        location: extData.location || 0
+      };
+      if (entry.name.startsWith("__MSG_")) {
+        entry.name = extId;
+      }
+      if (entry.description.startsWith("__MSG_")) {
+        entry.description = "";
+      }
+      if (search) {
+        const term = search.toLowerCase();
+        if (!(entry.name && entry.name.toLowerCase().includes(term)) && !(entry.id && entry.id.toLowerCase().includes(term))) {
+          continue;
+        }
+      }
+      results.push(entry);
+    }
+  }
+  return results;
+}
+
+// src/modules/search-engines.ts
+import { join as join13 } from "node:path";
+function getSearchEngines({
+  chromeDir,
+  profilePath,
+  profile,
+  browser
+} = {}) {
+  const profiles = resolveTargetProfiles({ chromeDir, profilePath, profile, browser });
+  const results = [];
+  for (const p of profiles) {
+    const dbPath = join13(p.path, "Web Data");
+    try {
+      const rows = queryDatabase(
+        dbPath,
+        `SELECT id, short_name, keyword, url, suggestions_url,
+                favicon_url, prepopulate_id, is_active
+         FROM keywords ORDER BY short_name`
+      );
+      for (const row of rows) {
+        results.push({
+          profile: p.name,
+          id: row.id,
+          name: row.short_name || "",
+          keyword: row.keyword || "",
+          url: row.url || "",
+          suggestionsUrl: row.suggestions_url || "",
+          faviconUrl: row.favicon_url || "",
+          isDefault: row.prepopulate_id === 1,
+          isActive: row.is_active === 1
+        });
+      }
+    } catch {
+    }
+  }
+  return results;
+}
+
+// src/modules/top-sites.ts
+import { join as join14 } from "node:path";
+function getTopSites({ chromeDir, profilePath, profile, browser } = {}) {
+  const profiles = resolveTargetProfiles({ chromeDir, profilePath, profile, browser });
+  const results = [];
+  for (const p of profiles) {
+    const dbPath = join14(p.path, "Top Sites");
+    try {
+      const rows = queryDatabase(
+        dbPath,
+        `SELECT url, url_rank, title, redirects
+         FROM top_sites ORDER BY url_rank ASC`
+      );
+      for (const row of rows) {
+        results.push({
+          profile: p.name,
+          url: row.url || "",
+          title: row.title || "",
+          rank: row.url_rank ?? 0,
+          redirects: row.redirects || ""
+        });
+      }
+    } catch {
+    }
+  }
+  return results;
+}
+export {
+  BROWSERS,
+  chromeTimeToDate,
+  clearKeyCache,
+  clearKeychainCache,
+  decryptValue,
+  decryptValueBuffer2 as decryptValueBuffer,
+  deriveEncryptionKey2 as deriveEncryptionKey,
+  describePasswordStores,
+  detectInstalledBrowsers,
+  discoverProfiles,
+  getActiveBrowser,
+  getAddresses,
+  getAutofillEntries,
+  getBookmarks,
+  getChromeKeychainPassword,
+  getCookies,
+  getCreditCards,
+  getDefaultChromeDir,
+  getDownloads,
+  getExtensions,
+  getHistory,
+  getKeychainPassword,
+  getKeychainPasswordProvider,
+  getLocalStorage,
+  getPasswords,
+  getPlatformChromeDir,
+  getProfileMetadata,
+  getProfileStates,
+  getSearchEngines,
+  getSearchTerms,
+  getTopSites,
+  listBrowsers,
+  queryDatabase,
+  requireBrowser,
+  resolveBrowser,
+  resolveProfilePath,
+  resolveTargetProfiles,
+  selectPlatform,
+  setActiveBrowser,
+  setKeychainPasswordProvider,
+  tableExists
+};