feat(core): decode WebKit/Chrome .localstorage UTF-16-LE values

[h4x0r]

What

A small UTF-16-LE value-decode convenience for WebKit/Chrome .localstorage files. This is not a new reader — a .localstorage file is a standard SQLite database that sqlite-forensic already opens read-only, dumps (ItemTable), and carves. The one artifact-specific gap: ItemTable.value is a BLOB holding the string as raw UTF-16-LE (little-endian, no BOM, no type-prefix byte), so today it surfaces as opaque hex instead of readable text.

API (in core)

• decode_localstorage_value(blob: &[u8]) -> LocalStorageValue { text: String, lossy: bool } — the lossy flag is a struct field, not a side-channel warning, so a caller cannot render a lossy decode as if it were faithful (secure by design). An odd-length BLOB (a trailing half code unit) or an unpaired surrogate yields U+FFFD and sets lossy; an empty BLOB decodes to the empty string; it never panics.
• is_local_storage_item_table(table_name: &str) -> bool — recognizes the distinctive ItemTable name so callers know when the decode applies. Name-keyed on purpose: the real WebKit/Chromium schema declares the columns with ON CONFLICT clauses (key TEXT UNIQUE ON CONFLICT REPLACE, value BLOB NOT NULL ON CONFLICT FAIL) that a lightweight CREATE TABLE parse does not split cleanly.

DRY

The UTF-16 code-unit pairing is factored into one private decode_utf16_units (which now reports lossiness), reused by the existing TextEncoding::decode_utf16 (behavior-preserving — the DB-encoding path still discards the flag) and by the new Local Storage decode. No second UTF-16 decoder was added.

Validation (oracle-checked, not just self-encoded)

• Independent sqlite3-CLI oracle (gated, skips if absent): a real .localstorage file is built with genuine UTF-16-LE BLOB values — including CJK and emoji (surrogate pairs) — read back through the normal reader, decoded, and asserted to recover the exact original strings.
• Hand-specified UTF-16-LE bytes derived from the Unicode code points + the surrogate-pair formula (not Rust's encoder), so the decoder is checked against the documented construction.
• Adversarial: empty, odd-length, lone-surrogate, and NULL inputs — graceful (lossy / replacement / distinct Value::Null), never a panic.

Gate

cargo fmt --all -- --check clean · cargo clippy --workspace --all-targets -- -D warnings clean · cargo test --workspace 514 passed / 0 failed.

Two commits: RED (failing tests) then GREEN (implementation).

🤖 Generated with Claude Code