chrome-tools 1.1.15 → 1.1.18

package/dist/src/core/platform/darwin.js

@@ -1,31 +0,0 @@
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { deriveEncryptionKey, clearKeychainCache } from "../keychain.js";
-import { decryptValueBuffer } from "../crypto.js";
-import { getActiveBrowser } from "../browsers.js";
-/**
- * macOS backend.
- *
- * Key source: the active browser's "<Browser> Safe Storage" password from the
- * login Keychain (e.g. "Chrome Safe Storage", "Microsoft Edge Safe Storage"),
- * stretched with PBKDF2 (1003 iterations) — implemented in `core/keychain.ts`.
- * Cipher: AES-128-CBC with a fixed 16-space IV — implemented in `core/crypto.ts`.
- * The browser only changes *which* Keychain item and data dir are used; the
- * crypto is identical across all Chromium forks.
- */
-export const darwin = {
-    name: "darwin",
-    getDefaultChromeDir(browser = getActiveBrowser()) {
-        return join(homedir(), "Library", "Application Support", ...browser.dirs.darwin.split("/"));
-    },
-    getDecryptionKey(_chromeDir, browser = getActiveBrowser()) {
-        // The Keychain item is global to the machine, so chromeDir is irrelevant here.
-        return deriveEncryptionKey(browser.safeStorageLabel);
-    },
-    decrypt(blob, key) {
-        return decryptValueBuffer(blob, key);
-    },
-    clearCache() {
-        clearKeychainCache();
-    },
-};

package/dist/src/core/platform/index.d.ts

@@ -1,30 +0,0 @@
-/**
- * Platform selection + facades.
- *
- * This is the ONLY place that reads `process.platform`. Everything else in the
- * codebase imports the facades below (`getPlatformChromeDir`, `deriveEncryptionKey`,
- * `decryptValue`, `decryptValueBuffer`, `clearKeyCache`) and stays OS-agnostic.
- */
-import type { ChromePlatform } from "./types.js";
-import { type BrowserDescriptor } from "../browsers.js";
-export type { ChromePlatform } from "./types.js";
-export { BROWSERS, listBrowsers, resolveBrowser, requireBrowser, getActiveBrowser, setActiveBrowser, type BrowserId, type BrowserDescriptor, } from "../browsers.js";
-export { KeychainAccessError, isKeychainAccessDenied, type KeychainErrorKind, } from "../keychain.js";
-/**
- * Returns the backend for the current OS, cached after first call.
- * @throws On an unsupported platform.
- */
-export declare function selectPlatform(): ChromePlatform;
-/** Default Chrome User Data directory for the current OS. */
-export declare function getPlatformChromeDir(browser?: string | BrowserDescriptor): string;
-/**
- * Returns the symmetric key for decrypting this profile's secrets.
- * @param chromeDir - Needed on Windows, where the key lives in `Local State`.
- */
-export declare function deriveEncryptionKey(chromeDir?: string, browser?: string | BrowserDescriptor): Buffer;
-/** Decrypts a Chrome blob and returns the plaintext bytes (or a placeholder string). */
-export declare function decryptValueBuffer(blob: Buffer | Uint8Array | null | undefined, key: Buffer): Buffer | string;
-/** Decrypts a Chrome blob and returns the plaintext as a UTF-8 string. */
-export declare function decryptValue(blob: Buffer | Uint8Array | null | undefined, key: Buffer): string;
-/** Clears the active backend's cached key material. */
-export declare function clearKeyCache(): void;

package/dist/src/core/platform/index.js

@@ -1,69 +0,0 @@
-import { darwin } from "./darwin.js";
-import { win32 } from "./win32.js";
-import { linux } from "./linux.js";
-import { getActiveBrowser, requireBrowser } from "../browsers.js";
-// Browser selection is orthogonal to platform selection: the backends above
-// read the active browser's data dir + Safe Storage label from the registry.
-// Re-exported here so the rest of the codebase has one import site for both
-// "which OS" and "which browser".
-export { BROWSERS, listBrowsers, resolveBrowser, requireBrowser, getActiveBrowser, setActiveBrowser, } from "../browsers.js";
-// Keychain access failures (macOS) surface a typed error so the CLI can show a
-// clear "No keychain access" message instead of a generic failure.
-export { KeychainAccessError, isKeychainAccessDenied, } from "../keychain.js";
-let _active = null;
-/**
- * Returns the backend for the current OS, cached after first call.
- * @throws On an unsupported platform.
- */
-export function selectPlatform() {
-    if (_active)
-        return _active;
-    switch (process.platform) {
-        case "darwin":
-            _active = darwin;
-            break;
-        case "win32":
-            _active = win32;
-            break;
-        case "linux":
-            _active = linux;
-            break;
-        default:
-            throw new Error(`Unsupported platform: ${process.platform}. ` +
-                "chrome-tools supports macOS, Windows, and Linux.");
-    }
-    return _active;
-}
-/** Default Chrome User Data directory for the current OS. */
-export function getPlatformChromeDir(browser) {
-    return selectPlatform().getDefaultChromeDir(resolveTargetBrowser(browser));
-}
-/**
- * Returns the symmetric key for decrypting this profile's secrets.
- * @param chromeDir - Needed on Windows, where the key lives in `Local State`.
- */
-export function deriveEncryptionKey(chromeDir, browser) {
-    return selectPlatform().getDecryptionKey(chromeDir, resolveTargetBrowser(browser));
-}
-/** Decrypts a Chrome blob and returns the plaintext bytes (or a placeholder string). */
-export function decryptValueBuffer(blob, key) {
-    if (!blob || blob.length === 0) {
-        return Buffer.alloc(0);
-    }
-    const buf = Buffer.isBuffer(blob) ? blob : Buffer.from(blob);
-    return selectPlatform().decrypt(buf, key);
-}
-/** Decrypts a Chrome blob and returns the plaintext as a UTF-8 string. */
-export function decryptValue(blob, key) {
-    const decrypted = decryptValueBuffer(blob, key);
-    return Buffer.isBuffer(decrypted) ? decrypted.toString("utf-8") : decrypted;
-}
-/** Clears the active backend's cached key material. */
-export function clearKeyCache() {
-    selectPlatform().clearCache();
-}
-function resolveTargetBrowser(browser) {
-    if (!browser)
-        return getActiveBrowser();
-    return typeof browser === "string" ? requireBrowser(browser) : browser;
-}

package/dist/src/core/platform/linux.d.ts

@@ -1,10 +0,0 @@
-import type { ChromePlatform } from "./types.js";
-/**
- * Linux backend.
- *
- * Key source: the active browser's "Safe Storage" password from the Secret
- * Service (gnome-keyring / KWallet) via `secret-tool`, or the hardcoded
- * "peanuts" fallback, stretched with PBKDF2 (1 iteration).
- * Cipher: AES-128-CBC with a fixed 16-space IV (same primitive as macOS).
- */
-export declare const linux: ChromePlatform;

package/dist/src/core/platform/linux.js

@@ -1,64 +0,0 @@
-import { execFileSync } from "node:child_process";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { pbkdf2Sync } from "node:crypto";
-import { decryptValueBuffer } from "../crypto.js";
-import { getActiveBrowser } from "../browsers.js";
-import { getKeychainPasswordProvider } from "../keychain.js";
-// Linux uses the same CBC scheme as macOS but with a single PBKDF2 iteration.
-const PBKDF2_ITERATIONS = 1;
-const PBKDF2_KEY_LENGTH = 16;
-const PBKDF2_SALT = Buffer.from("saltysalt");
-// Chrome's hardcoded fallback when no secret service (gnome-keyring/kwallet) is
-// available — yields the "Basic" (effectively unencrypted) storage scheme.
-const FALLBACK_PASSWORD = "peanuts";
-// Keyed by Secret Service `application` attribute so different browsers cache
-// independently (e.g. under `--all-browsers`).
-const _cachedKeys = new Map();
-/** Looks up the "Safe Storage" password via libsecret, falling back to "peanuts". */
-function getStoragePassword(application) {
-    const provider = getKeychainPasswordProvider();
-    if (provider) {
-        return provider(application);
-    }
-    try {
-        const out = execFileSync("secret-tool", ["lookup", "application", application], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
-        if (out)
-            return out;
-    }
-    catch {
-        // secret-tool missing, or no keyring / no entry — fall through to default.
-    }
-    return FALLBACK_PASSWORD;
-}
-/**
- * Linux backend.
- *
- * Key source: the active browser's "Safe Storage" password from the Secret
- * Service (gnome-keyring / KWallet) via `secret-tool`, or the hardcoded
- * "peanuts" fallback, stretched with PBKDF2 (1 iteration).
- * Cipher: AES-128-CBC with a fixed 16-space IV (same primitive as macOS).
- */
-export const linux = {
-    name: "linux",
-    getDefaultChromeDir(browser = getActiveBrowser()) {
-        const configHome = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
-        return join(configHome, ...browser.dirs.linux.split("/"));
-    },
-    getDecryptionKey(_chromeDir, browser = getActiveBrowser()) {
-        const application = browser.linuxSecretApp || "chrome";
-        const cached = _cachedKeys.get(application);
-        if (cached !== undefined) {
-            return cached;
-        }
-        const key = pbkdf2Sync(getStoragePassword(application), PBKDF2_SALT, PBKDF2_ITERATIONS, PBKDF2_KEY_LENGTH, "sha1");
-        _cachedKeys.set(application, key);
-        return key;
-    },
-    decrypt(blob, key) {
-        return decryptValueBuffer(blob, key);
-    },
-    clearCache() {
-        _cachedKeys.clear();
-    },
-};

package/dist/src/core/platform/types.d.ts

@@ -1,45 +0,0 @@
-import type { BrowserDescriptor } from "../browsers.js";
-/**
- * The platform-specific backend contract.
- *
- * Everything that differs between operating systems is bundled here because the
- * three concerns are coupled — a Windows key only works with the Windows cipher,
- * etc. Each backend (darwin/win32/linux) implements this once; the rest of the
- * codebase stays platform-agnostic and talks to the selected backend through the
- * facades in `./index.ts`.
- */
-export interface ChromePlatform {
-    /** Node platform identifier this backend handles (e.g. "darwin", "win32", "linux"). */
-    readonly name: string;
-    /** Absolute path to Chrome's User Data directory for this OS. */
-    getDefaultChromeDir(browser?: BrowserDescriptor): string;
-    /**
-     * Returns the symmetric key used to decrypt this profile's secrets, ready to
-     * hand to {@link decrypt}. May read the OS key store and is cached internally.
-     *
-     * @param chromeDir - User Data dir, needed on platforms (Windows) where the
-     *   key lives inside `Local State`. Defaults to {@link getDefaultChromeDir}.
-     * @throws An actionable Error if the key cannot be obtained.
-     */
-    getDecryptionKey(chromeDir?: string, browser?: BrowserDescriptor): Buffer;
-    /**
-     * Returns the App-Bound Encryption key for Chrome 127+ on Windows.
-     * Only the win32 backend implements this; others return `undefined`.
-     *
-     * @param chromeDir - User Data dir containing the `Local State` file.
-     * @param browser - Browser to target (needed to select the COM CLSID).
-     * @returns The decrypted 32-byte AES key, or `undefined` if ABE is
-     *   unavailable or unsupported on this platform.
-     */
-    getAppBoundKey?(chromeDir?: string, browser?: BrowserDescriptor): Buffer | undefined;
-    /**
-     * Decrypts a single Chrome `v10`/`v11`/`v20` blob using this platform's
-     * scheme (AES-128-CBC on macOS/Linux, AES-256-GCM on Windows).
-     *
-     * @returns The plaintext bytes, or a `<...>` placeholder string on a
-     *   recognized but undecryptable blob (never throws).
-     */
-    decrypt(blob: Buffer, key: Buffer): Buffer | string;
-    /** Clears any cached key material. Useful for tests / re-authentication. */
-    clearCache(): void;
-}

package/dist/src/core/platform/types.js

@@ -1 +0,0 @@
-export {};

package/dist/src/core/platform/win32.d.ts

@@ -1,13 +0,0 @@
-import type { ChromePlatform } from "./types.js";
-/**
- * Windows backend.
- *
- * Key source: `os_crypt.encrypted_key` in Local State — base64, "DPAPI"-prefixed,
- * unprotected via DPAPI into a raw 32-byte AES-256 key (no PBKDF2 on Windows).
- * Cipher: AES-256-GCM (nonce + tag carried in each blob).
- *
- * Chrome 127+ adds `os_crypt.app_bound_encrypted_key` — base64, "APPB"-prefixed.
- * It is passed directly to Chrome's IElevator COM service via the native helper
- * to obtain the 32-byte AES-256 key for "v20" blobs.
- */
-export declare const win32: ChromePlatform;

package/dist/src/core/platform/win32.js

@@ -1,329 +0,0 @@
-import { execFileSync } from "node:child_process";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, statSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { decryptValueBufferGcm, decryptValueBufferGcmV20 } from "../crypto.js";
-import { getActiveBrowser } from "../browsers.js";
-// Chrome base64-encodes the DPAPI-protected AES key in Local State, prefixed
-// with the ASCII bytes "DPAPI".
-const DPAPI_PREFIX = Buffer.from("DPAPI", "ascii");
-// Chrome 127+ uses App-Bound Encryption. The key in Local State is prefixed
-// with "APPB" and requires the IElevator COM service to decrypt.
-const APPB_PREFIX = Buffer.from("APPB", "ascii");
-// Keyed by User Data dir so different browsers (each with its own Local State)
-// cache independently (e.g. under `--all-browsers`).
-const _cachedKeys = new Map();
-const _cachedABEKeys = new Map();
-let _lastResolvedDir;
-let _lastResolvedBrowser;
-// Maps browser ids to the COM service identifier used by the native helper.
-const ABE_BROWSER_MAP = {
-    chrome: "chrome",
-    "chrome-beta": "chrome-beta",
-    "chrome-canary": "chrome",
-    chromium: "chrome",
-    brave: "brave",
-    edge: "edge",
-    vivaldi: "chrome",
-    comet: "chrome",
-    opera: "chrome",
-};
-/**
- * Unprotects a DPAPI blob for the current user.
- *
- * Node has no binding for `CryptUnprotectData`, so we shell out to PowerShell's
- * `ProtectedData.Unprotect`. This needs no native build step. For a faster,
- * dependency-light alternative, swap this for the optional `win-dpapi` addon.
- */
-function dpapiDecrypt(encrypted) {
-    const script = [
-        "$ErrorActionPreference='Stop';",
-        "Add-Type -AssemblyName System.Security;",
-        "$b=[Console]::In.ReadToEnd().Trim();",
-        "$enc=[Convert]::FromBase64String($b);",
-        "$dec=[System.Security.Cryptography.ProtectedData]::Unprotect($enc,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);",
-        "[Console]::Out.Write([Convert]::ToBase64String($dec));",
-    ].join(" ");
-    let out;
-    try {
-        out = execFileSync("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { input: encrypted.toString("base64"), encoding: "utf-8" });
-    }
-    catch (err) {
-        throw new Error("DPAPI decryption via PowerShell failed.\n" +
-            "The encrypted_key can only be unprotected by the same Windows user that " +
-            "created it. Run as that user on the same machine.\n" +
-            `(powershell: ${err?.message ?? err})`);
-    }
-    return Buffer.from(out.trim(), "base64");
-}
-/**
- * Resolves the Local State directory from a profile/chromeDir path.
- * `profilePath` may point directly at .../Default. Local State belongs to
- * the parent User Data directory.
- */
-function resolveLocalStateDir(requestedDir) {
-    const parentDir = dirname(requestedDir);
-    return existsSync(join(requestedDir, "Local State"))
-        ? requestedDir
-        : parentDir !== requestedDir && existsSync(join(parentDir, "Local State"))
-            ? parentDir
-            : requestedDir;
-}
-/**
- * Finds the source chrome_abe_decrypt helper executable.
- * Searches in order:
- *   1. Next to compiled output (dist/bin/)
- *   2. In the package bin/ directory
- *   3. In src/native/ (development)
- *   4. On PATH
- */
-function findABEHelper() {
-    const base = import.meta.dirname ?? "";
-    const candidates = [
-        join(base, "..", "..", "..", "bin", "chrome_abe_decrypt.exe"),
-        join(base, "..", "..", "..", "..", "bin", "chrome_abe_decrypt.exe"),
-        join(base, "..", "..", "..", "..", "src", "native", "chrome_abe_decrypt.exe"),
-    ];
-    for (const p of candidates) {
-        if (existsSync(p))
-            return p;
-    }
-    // Try on PATH
-    try {
-        execFileSync("where", ["chrome_abe_decrypt.exe"], { encoding: "utf-8", stdio: "pipe" });
-        return "chrome_abe_decrypt.exe";
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Candidate directories for staging the helper binary to satisfy Chrome's
- * Elevation Service caller validation.
- *
- * In Chromium's `caller_validation.cc`, `MaybeTrimProcessPath()` strips the
- * executable name and trailing 'Temp' or 'Application' folders. Executing the
- * helper from `<BrowserRoot>\Temp\chrome_abe_decrypt.exe` matches the browser's
- * validated root without requiring administrative privileges.
- */
-function getBrowserTempDirs(browserId) {
-    const dirs = [];
-    const progFiles = process.env["ProgramFiles"] || "C:\\Program Files";
-    const progFilesX86 = process.env["ProgramFiles(x86)"] || "C:\\Program Files (x86)";
-    const localAppData = process.env.LOCALAPPDATA ||
-        (process.env.USERPROFILE ? join(process.env.USERPROFILE, "AppData", "Local") : "");
-    const subpaths = {
-        chrome: ["Google\\Chrome"],
-        "chrome-beta": ["Google\\Chrome Beta"],
-        "chrome-canary": ["Google\\Chrome SxS"],
-        chromium: ["Chromium"],
-        edge: ["Microsoft\\Edge"],
-        brave: ["BraveSoftware\\Brave-Browser"],
-        vivaldi: ["Vivaldi"],
-    };
-    const rels = subpaths[browserId] || ["Google\\Chrome"];
-    for (const rel of rels) {
-        dirs.push(join(progFiles, rel, "Temp"));
-        dirs.push(join(progFilesX86, rel, "Temp"));
-        if (localAppData) {
-            dirs.push(join(localAppData, rel, "Temp"));
-        }
-    }
-    return dirs;
-}
-/**
- * Ensures the helper binary is located in a path that passes the browser
- * elevation service's validation checks. Stages a copy to the browser's Temp
- * folder if necessary.
- */
-function findOrStageABEHelper(browserId) {
-    const sourceExe = findABEHelper();
-    if (!sourceExe)
-        return null;
-    const targetDirs = getBrowserTempDirs(browserId);
-    for (const targetDir of targetDirs) {
-        try {
-            if (!existsSync(targetDir)) {
-                mkdirSync(targetDir, { recursive: true });
-            }
-            const stagedExe = join(targetDir, "chrome_abe_decrypt.exe");
-            if (!existsSync(stagedExe) || statSync(stagedExe).size !== statSync(sourceExe).size) {
-                copyFileSync(sourceExe, stagedExe);
-            }
-            return stagedExe;
-        }
-        catch {
-            // Permission denied or path not found, try next candidate
-            continue;
-        }
-    }
-    // Fallback to the original binary location
-    return sourceExe;
-}
-let _abeWarningShown = false;
-/**
- * Decrypts an app_bound_encrypted_key using Chrome's IElevator COM service
- * via the native helper binary.
- *
- * Note: App-Bound Encryption does NOT use standard user DPAPI. The raw
- * encrypted payload (with the 4-byte 'APPB' prefix removed) is passed directly
- * to the IElevator COM service, which executes the elevated decryption.
- */
-function abeDecrypt(rawEncryptedBytes, browserId) {
-    const helperExe = findOrStageABEHelper(browserId);
-    if (!helperExe) {
-        if (!_abeWarningShown) {
-            _abeWarningShown = true;
-            process.stderr.write("[chrome-tools] chrome_abe_decrypt.exe not found. Chrome 127+ v20-encrypted\n" +
-                "cookies/passwords cannot be decrypted.\n");
-        }
-        return null;
-    }
-    const comBrowser = ABE_BROWSER_MAP[browserId] || "chrome";
-    try {
-        const out = execFileSync(helperExe, [comBrowser], {
-            input: rawEncryptedBytes.toString("base64"),
-            encoding: "utf-8",
-            timeout: 30000,
-            stdio: ["pipe", "pipe", "pipe"],
-            cwd: dirname(helperExe),
-        });
-        return Buffer.from(out.trim(), "base64");
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Windows backend.
- *
- * Key source: `os_crypt.encrypted_key` in Local State — base64, "DPAPI"-prefixed,
- * unprotected via DPAPI into a raw 32-byte AES-256 key (no PBKDF2 on Windows).
- * Cipher: AES-256-GCM (nonce + tag carried in each blob).
- *
- * Chrome 127+ adds `os_crypt.app_bound_encrypted_key` — base64, "APPB"-prefixed.
- * It is passed directly to Chrome's IElevator COM service via the native helper
- * to obtain the 32-byte AES-256 key for "v20" blobs.
- */
-export const win32 = {
-    name: "win32",
-    getDefaultChromeDir(browser = getActiveBrowser()) {
-        const roaming = browser.dirs.win32Base === "roaming";
-        const appData = roaming
-            ? process.env.APPDATA ||
-                (process.env.USERPROFILE
-                    ? join(process.env.USERPROFILE, "AppData", "Roaming")
-                    : "")
-            : process.env.LOCALAPPDATA ||
-                (process.env.USERPROFILE
-                    ? join(process.env.USERPROFILE, "AppData", "Local")
-                    : "");
-        if (!appData) {
-            throw new Error("Could not resolve the Windows application-data directory.");
-        }
-        return join(appData, ...browser.dirs.win32.split("/"));
-    },
-    getDecryptionKey(chromeDir, browser = getActiveBrowser()) {
-        const requestedDir = chromeDir || this.getDefaultChromeDir(browser);
-        const dir = resolveLocalStateDir(requestedDir);
-        _lastResolvedDir = dir;
-        _lastResolvedBrowser = browser;
-        const cached = _cachedKeys.get(dir);
-        if (cached !== undefined) {
-            // Also pre-cache ABE key if not yet cached
-            if (!_cachedABEKeys.has(dir)) {
-                try {
-                    this.getAppBoundKey?.(dir, browser);
-                }
-                catch {
-                    // Ignore
-                }
-            }
-            return cached;
-        }
-        const localStatePath = join(dir, "Local State");
-        if (!existsSync(localStatePath)) {
-            throw new Error(`Could not find Chrome's "Local State" at ${localStatePath}.\n` +
-                "Run Google Chrome at least once so it creates the encryption key.");
-        }
-        let encryptedKeyB64;
-        try {
-            const raw = readFileSync(localStatePath, "utf-8");
-            encryptedKeyB64 = JSON.parse(raw)?.os_crypt?.encrypted_key;
-        }
-        catch (err) {
-            throw new Error(`Failed to read os_crypt.encrypted_key from Local State: ${err.message}`);
-        }
-        if (!encryptedKeyB64) {
-            throw new Error("No os_crypt.encrypted_key found in Local State.\n" +
-                "This profile may predate Chrome's encrypted-key scheme.");
-        }
-        const encryptedKey = Buffer.from(encryptedKeyB64, "base64");
-        if (!encryptedKey.subarray(0, DPAPI_PREFIX.length).equals(DPAPI_PREFIX)) {
-            throw new Error('Unexpected encrypted_key format (missing "DPAPI" prefix).');
-        }
-        const key = dpapiDecrypt(encryptedKey.subarray(DPAPI_PREFIX.length));
-        _cachedKeys.set(dir, key);
-        // Also pre-cache the ABE key for v20 blobs
-        try {
-            this.getAppBoundKey?.(dir, browser);
-        }
-        catch {
-            // Ignore
-        }
-        return key;
-    },
-    getAppBoundKey(chromeDir, browser = _lastResolvedBrowser ?? getActiveBrowser()) {
-        const requestedDir = chromeDir || _lastResolvedDir || this.getDefaultChromeDir(browser);
-        const dir = resolveLocalStateDir(requestedDir);
-        _lastResolvedDir = dir;
-        _lastResolvedBrowser = browser;
-        const cached = _cachedABEKeys.get(dir);
-        if (cached !== undefined) {
-            return cached;
-        }
-        const localStatePath = join(dir, "Local State");
-        if (!existsSync(localStatePath))
-            return undefined;
-        let appBoundKeyB64;
-        try {
-            const raw = readFileSync(localStatePath, "utf-8");
-            appBoundKeyB64 = JSON.parse(raw)?.os_crypt?.app_bound_encrypted_key;
-        }
-        catch {
-            return undefined;
-        }
-        if (!appBoundKeyB64)
-            return undefined;
-        const appBoundKey = Buffer.from(appBoundKeyB64, "base64");
-        if (!appBoundKey.subarray(0, APPB_PREFIX.length).equals(APPB_PREFIX)) {
-            return undefined;
-        }
-        // App-Bound Encryption: Pass raw encrypted bytes directly to COM elevation service
-        const abeKey = abeDecrypt(appBoundKey.subarray(APPB_PREFIX.length), browser.id);
-        if (!abeKey)
-            return undefined;
-        const key = abeKey.length > 32 ? abeKey.subarray(abeKey.length - 32) : abeKey;
-        _cachedABEKeys.set(dir, key);
-        return key;
-    },
-    decrypt(blob, key) {
-        const prefix = blob.subarray(0, 3).toString("utf-8");
-        // v20 = App-Bound Encryption (Chrome 127+)
-        if (prefix === "v20") {
-            // Try to get the ABE key for this profile
-            const abeKey = this.getAppBoundKey?.(_lastResolvedDir, _lastResolvedBrowser);
-            if (!abeKey) {
-                return "<v20 app-bound encryption - requires chrome_abe_decrypt.exe>";
-            }
-            return decryptValueBufferGcmV20(blob, abeKey);
-        }
-        // v10/v11 = standard DPAPI + AES-256-GCM
-        return decryptValueBufferGcm(blob, key);
-    },
-    clearCache() {
-        _cachedKeys.clear();
-        _cachedABEKeys.clear();
-        _lastResolvedDir = undefined;
-        _lastResolvedBrowser = undefined;
-    },
-};

package/dist/src/core/sql.d.ts

@@ -1,2 +0,0 @@
-/** Builds a SQL LIKE pattern with wildcard characters escaped for literal matching. */
-export declare function sqlLikePattern(term: string): string;

package/dist/src/core/sql.js

@@ -1,4 +0,0 @@
-/** Builds a SQL LIKE pattern with wildcard characters escaped for literal matching. */
-export function sqlLikePattern(term) {
-    return `%${term.replace(/([%_\\])/g, "\\$1")}%`;
-}

package/dist/src/index.d.ts

@@ -1,28 +0,0 @@
-/**
- * chrome-tools — Public API
- *
- * This module re-exports all feature modules for use as a Node.js library.
- *
- * @example
- * import { getPasswords, getBookmarks, discoverProfiles } from 'chrome-tools';
- *
- * const passwords = getPasswords({ profile: 'Default' });
- * const bookmarks = getBookmarks({ search: 'github' });
- * const profiles  = discoverProfiles();
- */
-export { getDefaultChromeDir, discoverProfiles, getProfileMetadata, getProfileStates, resolveProfilePath, resolveTargetProfiles, detectInstalledBrowsers, type DiscoveredProfile, type ProfileMetadata, type ProfileState, type ResolveProfilesOptions, type InstalledBrowser, } from "./core/chrome.js";
-export { BROWSERS, listBrowsers, resolveBrowser, requireBrowser, getActiveBrowser, setActiveBrowser, type BrowserId, type BrowserDescriptor, } from "./core/browsers.js";
-export { selectPlatform, getPlatformChromeDir, deriveEncryptionKey, decryptValue, decryptValueBuffer, clearKeyCache, type ChromePlatform, } from "./core/platform/index.js";
-export { getKeychainPassword, getChromeKeychainPassword, clearKeychainCache, setKeychainPasswordProvider, getKeychainPasswordProvider, type KeychainPasswordProvider, } from "./core/keychain.js";
-export { chromeTimeToDate, } from "./core/crypto.js";
-export { queryDatabase, tableExists, } from "./core/db.js";
-export { getPasswords } from "./modules/passwords.js";
-export { getBookmarks } from "./modules/bookmarks.js";
-export { getHistory, getSearchTerms } from "./modules/history.js";
-export { getCookies, type CookieEntry, type CookieOptions } from "./modules/cookies.js";
-export { getLocalStorage, type LocalStorageEntry, type LocalStorageOptions } from "./modules/local-storage.js";
-export { getAutofillEntries, getCreditCards, getAddresses } from "./modules/autofill.js";
-export { getDownloads } from "./modules/downloads.js";
-export { getExtensions } from "./modules/extensions.js";
-export { getSearchEngines } from "./modules/search-engines.js";
-export { getTopSites } from "./modules/top-sites.js";