@badzz88/baileys 8.4.7 → 8.5.0

package/lib/Utils/command-loader.d.ts

@@ -0,0 +1,31 @@
+export interface CommandContext {
+	sock: any
+	msg: any
+	args: string[]
+	text: string
+	jid: string
+	sender: string
+	isGroup: boolean
+}
+
+export interface Command {
+	name: string
+	aliases?: string[]
+	description?: string
+	execute(ctx: CommandContext): Promise<void> | void
+}
+
+export interface CommandHandlerOptions {
+	commandsDir: string
+	prefix?: string
+	logger?: any
+	onError?: (error: any, msg: any) => void
+}
+
+export interface CommandHandler {
+	commands: Map<string, Command>
+	reload: () => void
+	stop: () => void
+}
+
+export function createCommandHandler(sock: any, options: CommandHandlerOptions): CommandHandler

package/lib/Utils/command-loader.js

@@ -0,0 +1,100 @@
+'use strict'
+Object.defineProperty(exports, '__esModule', { value: true })
+exports.createCommandHandler = void 0
+const fs = require('fs')
+const path = require('path')
+
+/**
+ * Loads command modules from a folder and wires them up to a socket's `messages.upsert`
+ * event, so you don't need to write a prefix/dispatch loop by hand for every project.
+ *
+ * Each file in `commandsDir` should export an object (or a default export) shaped like:
+ *   { name: string, aliases?: string[], description?: string, execute(ctx): Promise<void> | void }
+ *
+ * `ctx` passed to `execute` is: { sock, msg, args, text, jid, sender, isGroup }
+ *
+ * @param {ReturnType<typeof import('../Socket').default>} sock - an active Baileys socket
+ * @param {{ commandsDir: string, prefix?: string, logger?: any, onError?: (error: any, msg: any) => void }} options
+ * @returns {{ commands: Map<string, any>, reload: () => void, stop: () => void }}
+ */
+const createCommandHandler = (sock, options) => {
+	const prefix = options.prefix ?? '!'
+	const logger = options.logger || sock.logger
+	const commands = new Map()
+
+	const load = () => {
+		commands.clear()
+		const dir = options.commandsDir
+		if (!fs.existsSync(dir)) {
+			logger?.warn?.({ dir }, 'commands directory does not exist')
+			return
+		}
+		const files = fs.readdirSync(dir).filter(f => f.endsWith('.js'))
+		for (const file of files) {
+			const fullPath = path.join(dir, file)
+			try {
+				delete require.cache[require.resolve(fullPath)]
+				const mod = require(fullPath)
+				const cmd = mod?.default || mod
+				if (!cmd?.name || typeof cmd.execute !== 'function') {
+					logger?.warn?.({ file }, 'skipping invalid command module (missing name/execute)')
+					continue
+				}
+				commands.set(cmd.name.toLowerCase(), cmd)
+				for (const alias of cmd.aliases || []) {
+					commands.set(alias.toLowerCase(), cmd)
+				}
+			} catch (error) {
+				logger?.error?.({ error, file }, 'failed to load command')
+			}
+		}
+		logger?.debug?.({ count: commands.size }, 'commands loaded')
+	}
+
+	load()
+
+	const handler = async ({ messages, type }) => {
+		if (type !== 'notify') return
+		for (const msg of messages) {
+			try {
+				if (!msg.message || msg.key.fromMe) continue
+				const body =
+					msg.message.conversation ||
+					msg.message.extendedTextMessage?.text ||
+					msg.message.imageMessage?.caption ||
+					msg.message.videoMessage?.caption ||
+					''
+				if (!body.startsWith(prefix)) continue
+				const [cmdName, ...args] = body.slice(prefix.length).trim().split(/\s+/)
+				if (!cmdName) continue
+				const cmd = commands.get(cmdName.toLowerCase())
+				if (!cmd) continue
+				const jid = msg.key.remoteJid
+				const ctx = {
+					sock,
+					msg,
+					args,
+					text: args.join(' '),
+					jid,
+					sender: msg.key.participant || msg.key.remoteJid,
+					isGroup: !!jid && jid.endsWith('@g.us')
+				}
+				await cmd.execute(ctx)
+			} catch (error) {
+				if (options.onError) {
+					options.onError(error, msg)
+				} else {
+					logger?.error?.({ error }, 'command execution failed')
+				}
+			}
+		}
+	}
+	sock.ev.on('messages.upsert', handler)
+
+	return {
+		commands,
+		reload: load,
+		stop: () => sock.ev.off('messages.upsert', handler)
+	}
+}
+exports.createCommandHandler = createCommandHandler

package/lib/Utils/companion-reg-client-utils.js

@@ -1,35 +1,42 @@
-export var CompanionWebClientType;
-(function (CompanionWebClientType) {
-    CompanionWebClientType[CompanionWebClientType["UNKNOWN"] = 0] = "UNKNOWN";
-    CompanionWebClientType[CompanionWebClientType["CHROME"] = 1] = "CHROME";
-    CompanionWebClientType[CompanionWebClientType["EDGE"] = 2] = "EDGE";
-    CompanionWebClientType[CompanionWebClientType["FIREFOX"] = 3] = "FIREFOX";
-    CompanionWebClientType[CompanionWebClientType["IE"] = 4] = "IE";
-    CompanionWebClientType[CompanionWebClientType["OPERA"] = 5] = "OPERA";
-    CompanionWebClientType[CompanionWebClientType["SAFARI"] = 6] = "SAFARI";
-    CompanionWebClientType[CompanionWebClientType["ELECTRON"] = 7] = "ELECTRON";
-    CompanionWebClientType[CompanionWebClientType["UWP"] = 8] = "UWP";
-    CompanionWebClientType[CompanionWebClientType["OTHER_WEB_CLIENT"] = 9] = "OTHER_WEB_CLIENT";
-})(CompanionWebClientType || (CompanionWebClientType = {}));
+'use strict'
+Object.defineProperty(exports, '__esModule', { value: true })
+exports.buildPairingQRData = exports.getCompanionPlatformId = exports.getCompanionWebClientType = exports.CompanionWebClientType = void 0
+var CompanionWebClientType
+;(function (CompanionWebClientType) {
+	CompanionWebClientType[(CompanionWebClientType['UNKNOWN'] = 0)] = 'UNKNOWN'
+	CompanionWebClientType[(CompanionWebClientType['CHROME'] = 1)] = 'CHROME'
+	CompanionWebClientType[(CompanionWebClientType['EDGE'] = 2)] = 'EDGE'
+	CompanionWebClientType[(CompanionWebClientType['FIREFOX'] = 3)] = 'FIREFOX'
+	CompanionWebClientType[(CompanionWebClientType['IE'] = 4)] = 'IE'
+	CompanionWebClientType[(CompanionWebClientType['OPERA'] = 5)] = 'OPERA'
+	CompanionWebClientType[(CompanionWebClientType['SAFARI'] = 6)] = 'SAFARI'
+	CompanionWebClientType[(CompanionWebClientType['ELECTRON'] = 7)] = 'ELECTRON'
+	CompanionWebClientType[(CompanionWebClientType['UWP'] = 8)] = 'UWP'
+	CompanionWebClientType[(CompanionWebClientType['OTHER_WEB_CLIENT'] = 9)] = 'OTHER_WEB_CLIENT'
+})((CompanionWebClientType = exports.CompanionWebClientType || (exports.CompanionWebClientType = {})))
 const BROWSER_TO_COMPANION_WEB_CLIENT = {
-    Chrome: CompanionWebClientType.CHROME,
-    Edge: CompanionWebClientType.EDGE,
-    Firefox: CompanionWebClientType.FIREFOX,
-    IE: CompanionWebClientType.IE,
-    Opera: CompanionWebClientType.OPERA,
-    Safari: CompanionWebClientType.SAFARI
-};
-export const getCompanionWebClientType = ([os, browserName]) => {
-    if (browserName === 'Desktop') {
-        return os === 'Windows' ? CompanionWebClientType.UWP : CompanionWebClientType.ELECTRON;
-    }
-    return BROWSER_TO_COMPANION_WEB_CLIENT[browserName] || CompanionWebClientType.OTHER_WEB_CLIENT;
-};
-export const getCompanionPlatformId = (browser) => {
-    return getCompanionWebClientType(browser).toString();
-};
-export const buildPairingQRData = (ref, noiseKeyB64, identityKeyB64, advB64, browser) => {
-    return ('https://wa.me/settings/linked_devices#' +
-        [ref, noiseKeyB64, identityKeyB64, advB64, getCompanionPlatformId(browser)].join(','));
-};
-//# sourceMappingURL=companion-reg-client-utils.js.map
+	Chrome: CompanionWebClientType.CHROME,
+	Edge: CompanionWebClientType.EDGE,
+	Firefox: CompanionWebClientType.FIREFOX,
+	IE: CompanionWebClientType.IE,
+	Opera: CompanionWebClientType.OPERA,
+	Safari: CompanionWebClientType.SAFARI
+}
+const getCompanionWebClientType = ([os, browserName]) => {
+	if (browserName === 'Desktop') {
+		return os === 'Windows' ? CompanionWebClientType.UWP : CompanionWebClientType.ELECTRON
+	}
+	return BROWSER_TO_COMPANION_WEB_CLIENT[browserName] || CompanionWebClientType.OTHER_WEB_CLIENT
+}
+exports.getCompanionWebClientType = getCompanionWebClientType
+const getCompanionPlatformId = (browser) => {
+	return getCompanionWebClientType(browser).toString()
+}
+exports.getCompanionPlatformId = getCompanionPlatformId
+const buildPairingQRData = (ref, noiseKeyB64, identityKeyB64, advB64, browser) => {
+	return (
+		'https://wa.me/settings/linked_devices#' +
+		[ref, noiseKeyB64, identityKeyB64, advB64, getCompanionPlatformId(browser)].join(',')
+	)
+}
+exports.buildPairingQRData = buildPairingQRData

package/lib/Utils/consumer-application.js

@@ -0,0 +1,107 @@
+'use strict'
+Object.defineProperty(exports, '__esModule', { value: true })
+exports.consumerApplicationToMessage = exports.decodeConsumerApplication = void 0
+const index_js_1 = require('../../WAProto/index.js')
+
+const decodeConsumerApplication = buffer => {
+	if (!Buffer.isBuffer(buffer) && !(buffer instanceof Uint8Array)) {
+		throw new TypeError('decodeConsumerApplication: buffer must be Buffer or Uint8Array')
+	}
+	return index_js_1.proto.ConsumerApplication.decode(buffer)
+}
+exports.decodeConsumerApplication = decodeConsumerApplication
+
+const textOf = mt => (mt && typeof mt.text === 'string' ? mt.text : undefined)
+
+const mapContent = content => {
+	if (!content) return null
+	switch (content.content) {
+		case 'messageText':
+			return { conversation: textOf(content.messageText) ?? '' }
+		case 'extendedTextMessage': {
+			const e = content.extendedTextMessage
+			return {
+				extendedTextMessage: {
+					text: textOf(e.text),
+					matchedText: e.matchedText,
+					canonicalUrl: e.canonicalUrl,
+					description: e.description,
+					title: e.title
+				}
+			}
+		}
+		case 'imageMessage':
+			return {
+				imageMessage: { mediaPayload: content.imageMessage.image, caption: textOf(content.imageMessage.caption) }
+			}
+		case 'videoMessage':
+			return {
+				videoMessage: { mediaPayload: content.videoMessage.video, caption: textOf(content.videoMessage.caption) }
+			}
+		case 'audioMessage':
+			return { audioMessage: { mediaPayload: content.audioMessage.audio, ptt: content.audioMessage.ptt } }
+		case 'documentMessage':
+			return {
+				documentMessage: { mediaPayload: content.documentMessage.document, fileName: content.documentMessage.fileName }
+			}
+		case 'stickerMessage':
+			return { stickerMessage: { mediaPayload: content.stickerMessage.sticker } }
+		case 'contactMessage':
+			return { contactMessage: { mediaPayload: content.contactMessage.contact } }
+		case 'contactsArrayMessage':
+			return {
+				contactsArrayMessage: {
+					displayName: content.contactsArrayMessage.displayName,
+					contacts: content.contactsArrayMessage.contacts || []
+				}
+			}
+		case 'locationMessage': {
+			const loc = content.locationMessage.location || {}
+			return {
+				locationMessage: {
+					degreesLatitude: loc.degreesLatitude,
+					degreesLongitude: loc.degreesLongitude,
+					name: loc.name
+				}
+			}
+		}
+		case 'liveLocationMessage': {
+			const loc = content.liveLocationMessage.location || {}
+			return {
+				liveLocationMessage: {
+					degreesLatitude: loc.degreesLatitude,
+					degreesLongitude: loc.degreesLongitude,
+					caption: textOf(content.liveLocationMessage.caption)
+				}
+			}
+		}
+		case 'reactionMessage':
+			return { reactionMessage: content.reactionMessage }
+		default:
+			return null
+	}
+}
+
+const consumerApplicationToMessage = app => {
+	const payload = app?.payload
+	if (!payload) return null
+	switch (payload.payload) {
+		case 'content':
+			return mapContent(payload.content)
+		case 'applicationData': {
+			const ad = payload.applicationData
+			if (ad?.applicationContent === 'revoke' && ad.revoke?.key) {
+				return {
+					protocolMessage: {
+						key: ad.revoke.key,
+						type: index_js_1.proto.Message.ProtocolMessage.Type.REVOKE
+					}
+				}
+			}
+			return null
+		}
+		default:
+			return null
+	}
+}
+exports.consumerApplicationToMessage = consumerApplicationToMessage

package/lib/Utils/crypto.js

@@ -1,118 +1,155 @@
-import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from 'crypto';
-import * as curve from 'libsignal/src/curve.js';
-import { KEY_BUNDLE_TYPE } from '../Defaults/index.js';
-export { md5, hkdf } from 'whatsapp-rust-bridge';
-// insure browser & node compatibility
-const { subtle } = globalThis.crypto;
-/** prefix version byte to the pub keys, required for some curve crypto functions */
-export const generateSignalPubKey = (pubKey) => pubKey.length === 33 ? pubKey : Buffer.concat([KEY_BUNDLE_TYPE, pubKey]);
-export const Curve = {
-    generateKeyPair: () => {
-        const { pubKey, privKey } = curve.generateKeyPair();
-        return {
-            private: Buffer.from(privKey),
-            // remove version byte
-            public: Buffer.from(pubKey.slice(1))
-        };
-    },
-    sharedKey: (privateKey, publicKey) => {
-        const shared = curve.calculateAgreement(generateSignalPubKey(publicKey), privateKey);
-        return Buffer.from(shared);
-    },
-    sign: (privateKey, buf) => curve.calculateSignature(privateKey, buf),
-    verify: (pubKey, message, signature) => {
-        try {
-            curve.verifySignature(generateSignalPubKey(pubKey), message, signature);
-            return true;
-        }
-        catch (error) {
-            return false;
-        }
-    }
-};
-export const signedKeyPair = (identityKeyPair, keyId) => {
-    const preKey = Curve.generateKeyPair();
-    const pubKey = generateSignalPubKey(preKey.public);
-    const signature = Curve.sign(identityKeyPair.private, pubKey);
-    return { keyPair: preKey, signature, keyId };
-};
-const GCM_TAG_LENGTH = 128 >> 3;
-/**
- * encrypt AES 256 GCM;
- * where the tag tag is suffixed to the ciphertext
- * */
-export function aesEncryptGCM(plaintext, key, iv, additionalData) {
-    const cipher = createCipheriv('aes-256-gcm', key, iv);
-    cipher.setAAD(additionalData);
-    return Buffer.concat([cipher.update(plaintext), cipher.final(), cipher.getAuthTag()]);
+'use strict'
+Object.defineProperty(exports, '__esModule', { value: true })
+exports.signedKeyPair = exports.Curve = exports.generateSignalPubKey = exports.hkdf = exports.md5 = void 0
+exports.aesEncryptGCM = aesEncryptGCM
+exports.aesDecryptGCM = aesDecryptGCM
+exports.aesEncryptCTR = aesEncryptCTR
+exports.aesDecryptCTR = aesDecryptCTR
+exports.aesDecrypt = aesDecrypt
+exports.aesDecryptWithIV = aesDecryptWithIV
+exports.aesEncrypt = aesEncrypt
+exports.aesEncrypWithIV = aesEncrypWithIV
+exports.hmacSign = hmacSign
+exports.sha256 = sha256
+exports.derivePairingCodeKey = derivePairingCodeKey
+const { subtle } = globalThis.crypto
+const Defaults_1 = require('../Defaults')
+const nodeCrypto = require('crypto')
+
+// Pure Node.js `crypto` / hand-written JS only -- no native/WASM module
+// dependency anywhere in this file (including `Curve`, X25519 key exchange +
+// XEdDSA signing). XEdDSA specifically is validated against the official
+// RFC 8032 Ed25519 test vectors, RFC 7748-style X25519 DH vectors, and
+// hundreds of randomized Montgomery<->Edwards interop + self-consistency
+// checks -- see ./curve25519-js.js for details and references.
+
+// ── MD5 ────────────────────────────────────────────────────────────────────────
+const md5 = buffer => nodeCrypto.createHash('md5').update(buffer).digest()
+Object.defineProperty(exports, 'md5', { enumerable: true, get: () => md5 })
+
+// ── HKDF (RFC 5869) ─────────────────────────────────────────────────────────────
+const hkdfExtractJS = (salt, ikm) => nodeCrypto.createHmac('sha256', salt).update(ikm).digest()
+const hkdfExpandJS = (prk, length, info) => {
+	const hashLen = 32
+	const n = Math.ceil(length / hashLen)
+	let t = Buffer.alloc(0)
+	let okm = Buffer.alloc(0)
+	for (let i = 1; i <= n; i++) {
+		t = nodeCrypto
+			.createHmac('sha256', prk)
+			.update(Buffer.concat([t, info, Buffer.from([i])]))
+			.digest()
+		okm = Buffer.concat([okm, t])
+	}
+	return okm.subarray(0, length)
 }
-/**
- * decrypt AES 256 GCM;
- * where the auth tag is suffixed to the ciphertext
- * */
-export function aesDecryptGCM(ciphertext, key, iv, additionalData) {
-    const decipher = createDecipheriv('aes-256-gcm', key, iv);
-    // decrypt additional adata
-    const enc = ciphertext.slice(0, ciphertext.length - GCM_TAG_LENGTH);
-    const tag = ciphertext.slice(ciphertext.length - GCM_TAG_LENGTH);
-    // set additional data
-    decipher.setAAD(additionalData);
-    decipher.setAuthTag(tag);
-    return Buffer.concat([decipher.update(enc), decipher.final()]);
+const hkdf = (ikm, length, options = {}) => {
+	const ikmBuf = Buffer.isBuffer(ikm) ? ikm : Buffer.from(ikm)
+	const saltBuf = options.salt
+		? Buffer.isBuffer(options.salt)
+			? options.salt
+			: Buffer.from(options.salt)
+		: Buffer.alloc(32) // RFC 5869: default salt is HashLen zero bytes
+	const infoBuf = options.info
+		? Buffer.isBuffer(options.info)
+			? options.info
+			: Buffer.from(options.info)
+		: Buffer.alloc(0)
+	const prk = hkdfExtractJS(saltBuf, ikmBuf)
+	return hkdfExpandJS(prk, length, infoBuf)
 }
-export function aesEncryptCTR(plaintext, key, iv) {
-    const cipher = createCipheriv('aes-256-ctr', key, iv);
-    return Buffer.concat([cipher.update(plaintext), cipher.final()]);
+Object.defineProperty(exports, 'hkdf', { enumerable: true, get: () => hkdf })
+
+// ── Signal pub key helper ─────────────────────────────────────────────────────
+const generateSignalPubKey = pubKey =>
+	pubKey.length === 33 ? pubKey : Buffer.concat([Defaults_1.KEY_BUNDLE_TYPE, pubKey])
+exports.generateSignalPubKey = generateSignalPubKey
+
+// ── Curve — X25519 key exchange + XEdDSA signing ──────────────────────────────
+const curve25519JS = require('./curve25519-js')
+exports.Curve = {
+	generateKeyPair: () => curve25519JS.generateKeyPairJS(),
+	sharedKey: (privateKey, publicKey) => curve25519JS.sharedKeyJS(privateKey, publicKey),
+	sign: (privateKey, buf) => curve25519JS.signJS(privateKey, buf),
+	verify: (pubKey, message, signature) => curve25519JS.verifyJS(pubKey, message, signature)
 }
-export function aesDecryptCTR(ciphertext, key, iv) {
-    const decipher = createDecipheriv('aes-256-ctr', key, iv);
-    return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+
+const signedKeyPair = (identityKeyPair, keyId) => {
+	const preKey = exports.Curve.generateKeyPair()
+	const pubKey = generateSignalPubKey(preKey.public)
+	const signature = exports.Curve.sign(identityKeyPair.private, pubKey)
+	return { keyPair: preKey, signature, keyId }
 }
-/** decrypt AES 256 CBC; where the IV is prefixed to the buffer */
-export function aesDecrypt(buffer, key) {
-    return aesDecryptWithIV(buffer.subarray(16), key, buffer.subarray(0, 16));
+exports.signedKeyPair = signedKeyPair
+
+// ── AES-256-GCM ───────────────────────────────────────────────────────────────
+function aesEncryptGCM(plaintext, key, iv, additionalData) {
+	const cipher = nodeCrypto.createCipheriv('aes-256-gcm', key, iv)
+	if (additionalData) cipher.setAAD(additionalData)
+	const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()])
+	return Buffer.concat([encrypted, cipher.getAuthTag()])
 }
-/** decrypt AES 256 CBC */
-export function aesDecryptWithIV(buffer, key, IV) {
-    const aes = createDecipheriv('aes-256-cbc', key, IV);
-    return Buffer.concat([aes.update(buffer), aes.final()]);
+
+function aesDecryptGCM(ciphertext, key, iv, additionalData) {
+	const authTag = ciphertext.subarray(ciphertext.length - 16)
+	const encrypted = ciphertext.subarray(0, ciphertext.length - 16)
+	const decipher = nodeCrypto.createDecipheriv('aes-256-gcm', key, iv)
+	if (additionalData) decipher.setAAD(additionalData)
+	decipher.setAuthTag(authTag)
+	return Buffer.concat([decipher.update(encrypted), decipher.final()])
 }
-// encrypt AES 256 CBC; where a random IV is prefixed to the buffer
-export function aesEncrypt(buffer, key) {
-    const IV = randomBytes(16);
-    const aes = createCipheriv('aes-256-cbc', key, IV);
-    return Buffer.concat([IV, aes.update(buffer), aes.final()]); // prefix IV to the buffer
+
+// ── AES-256-CTR ───────────────────────────────────────────────────────────────
+function aesEncryptCTR(plaintext, key, iv) {
+	const cipher = nodeCrypto.createCipheriv('aes-256-ctr', key, iv)
+	return Buffer.concat([cipher.update(plaintext), cipher.final()])
 }
-// encrypt AES 256 CBC with a given IV
-export function aesEncrypWithIV(buffer, key, IV) {
-    const aes = createCipheriv('aes-256-cbc', key, IV);
-    return Buffer.concat([aes.update(buffer), aes.final()]); // prefix IV to the buffer
+
+function aesDecryptCTR(ciphertext, key, iv) {
+	const decipher = nodeCrypto.createDecipheriv('aes-256-ctr', key, iv)
+	return Buffer.concat([decipher.update(ciphertext), decipher.final()])
 }
-// sign HMAC using SHA 256
-export function hmacSign(buffer, key, variant = 'sha256') {
-    return createHmac(variant, key).update(buffer).digest();
+
+// ── AES-256-CBC (no explicit IV -- zero IV, legacy/unused elsewhere in this lib) ─
+function aesDecrypt(buffer, key) {
+	return aesDecryptWithIV(buffer, key, Buffer.alloc(16))
 }
-export function sha256(buffer) {
-    return createHash('sha256').update(buffer).digest();
+
+function aesEncrypt(buffer, key) {
+	return aesEncrypWithIV(buffer, key, Buffer.alloc(16))
 }
-export async function derivePairingCodeKey(pairingCode, salt) {
-    // Convert inputs to formats Web Crypto API can work with
-    const encoder = new TextEncoder();
-    const pairingCodeBuffer = encoder.encode(pairingCode);
-    const saltBuffer = new Uint8Array(salt instanceof Uint8Array ? salt : new Uint8Array(salt));
-    // Import the pairing code as key material
-    const keyMaterial = await subtle.importKey('raw', pairingCodeBuffer, { name: 'PBKDF2' }, false, [
-        'deriveBits'
-    ]);
-    // Derive bits using PBKDF2 with the same parameters
-    // 2 << 16 = 131,072 iterations
-    const derivedBits = await subtle.deriveBits({
-        name: 'PBKDF2',
-        salt: saltBuffer,
-        iterations: 2 << 16,
-        hash: 'SHA-256'
-    }, keyMaterial, 32 * 8 // 32 bytes * 8 = 256 bits
-    );
-    return Buffer.from(derivedBits);
+
+// ── AES-256-CBC (explicit IV) ─────────────────────────────────────────────────
+function aesDecryptWithIV(buffer, key, IV) {
+	const decipher = nodeCrypto.createDecipheriv('aes-256-cbc', key, IV)
+	return Buffer.concat([decipher.update(buffer), decipher.final()])
+}
+
+function aesEncrypWithIV(buffer, key, IV) {
+	const cipher = nodeCrypto.createCipheriv('aes-256-cbc', key, IV)
+	return Buffer.concat([cipher.update(buffer), cipher.final()])
+}
+
+// ── HMAC-SHA256 ───────────────────────────────────────────────────────────────
+function hmacSign(buffer, key, variant = 'sha256') {
+	return nodeCrypto.createHmac(variant, key).update(buffer).digest()
+}
+
+// ── SHA-256 ───────────────────────────────────────────────────────────────────
+function sha256(buffer) {
+	return nodeCrypto.createHash('sha256').update(buffer).digest()
+}
+
+// ── PBKDF2 pairing code key ───────────────────────────────────────────────────
+async function derivePairingCodeKey(pairingCode, salt) {
+	const encoder = new TextEncoder()
+	const pairingCodeBuffer = encoder.encode(pairingCode)
+	const saltBuffer = new Uint8Array(salt instanceof Uint8Array ? salt : new Uint8Array(salt))
+	const keyMaterial = await subtle.importKey('raw', pairingCodeBuffer, { name: 'PBKDF2' }, false, ['deriveBits'])
+	const derivedBits = await subtle.deriveBits(
+		{ name: 'PBKDF2', salt: saltBuffer, iterations: 2 << 16, hash: 'SHA-256' },
+		keyMaterial,
+		256
+	)
+	return Buffer.from(derivedBits)
 }
-//# sourceMappingURL=crypto.js.map