@badzz88/baileys 8.5.4 → 8.5.5

package/lib/Utils/chat-utils.js

@@ -13,7 +13,6 @@ exports.processSyncAction =
 	exports.newLTHashState =
 		void 0
 const boom_1 = require('@hapi/boom')
-const whatsapp_rust_bridge_1 = require('whatsapp-rust-bridge')
 const index_js_1 = require('../../WAProto/index.js')
 const LabelAssociation_1 = require('../Types/LabelAssociation')
 const WABinary_1 = require('../WABinary')
@@ -23,13 +22,16 @@ const lt_hash_1 = require('./lt-hash')
 const messages_media_1 = require('./messages-media')
 const sync_action_utils_1 = require('./sync-action-utils')
 const mutationKeys = keydata => {
-	const keys = (0, whatsapp_rust_bridge_1.expandAppStateKeys)(keydata)
+	// app-state mutation keys are just HKDF-expanded sub-keys of a single 32-byte
+	// key, no elliptic-curve math involved -- this is the standard derivation
+	// used across the Baileys ecosystem.
+	const expanded = (0, crypto_1.hkdf)(keydata, 160, { info: 'WhatsApp Mutation Keys' })
 	return {
-		indexKey: keys.indexKey,
-		valueEncryptionKey: keys.valueEncryptionKey,
-		valueMacKey: keys.valueMacKey,
-		snapshotMacKey: keys.snapshotMacKey,
-		patchMacKey: keys.patchMacKey
+		indexKey: expanded.subarray(0, 32),
+		valueEncryptionKey: expanded.subarray(32, 64),
+		valueMacKey: expanded.subarray(64, 96),
+		snapshotMacKey: expanded.subarray(96, 128),
+		patchMacKey: expanded.subarray(128, 160)
 	}
 }
 const generateMac = (operation, data, keyId, key) => {
@@ -64,11 +66,11 @@ const makeLtHashGenerator = ({ indexValueMap, hash }) => {
 				if (!prevOp) {
 					throw new boom_1.Boom('tried remove, but no previous op', { data: { indexMac, valueMac } })
 				}
-				
+				// remove from index value mac, since this mutation is erased
 				delete indexValueMap[indexMacBase64]
 			} else {
 				addBuffs.push(valueMac)
-				
+				// add this index into the history map
 				indexValueMap[indexMacBase64] = { valueMac }
 			}
 			if (prevOp) {
@@ -135,7 +137,7 @@ const encodeSyncdPatch = async (
 	const encValue = (0, crypto_1.aesEncrypt)(encoded, keyValue.valueEncryptionKey)
 	const valueMac = generateMac(operation, encValue, encKeyId, keyValue.valueMacKey)
 	const indexMac = (0, crypto_1.hmacSign)(indexBuffer, keyValue.indexKey)
-	
+	// update LT hash
 	const generator = makeLtHashGenerator(state)
 	generator.mix({ indexMac, valueMac, operation })
 	Object.assign(state, generator.finish())
@@ -168,12 +170,12 @@ exports.encodeSyncdPatch = encodeSyncdPatch
 const decodeSyncdMutations = async (msgMutations, initialState, getAppStateSyncKey, onMutation, validateMacs) => {
 	const ltGenerator = makeLtHashGenerator(initialState)
 	const derivedKeyCache = new Map()
-	
-	
-	
+	// indexKey used to HMAC sign record.index.blob
+	// valueEncryptionKey used to AES-256-CBC encrypt record.value.blob[0:-32]
+	// the remaining record.value.blob[0:-32] is the mac, it the HMAC sign of key.keyId + decoded proto data + length of bytes in keyId
 	for (const msgMutation of msgMutations) {
-		
-		
+		// if it's a syncdmutation, get the operation property
+		// otherwise, if it's only a record -- it'll be a SET mutation
 		const operation =
 			'operation' in msgMutation ? msgMutation.operation : index_js_1.proto.SyncdMutation.SyncdOperation.SET
 		const record = 'record' in msgMutation && !!msgMutation.record ? msgMutation.record : msgMutation
@@ -397,7 +399,7 @@ const decodePatches = async (
 				throw new boom_1.Boom(`failed to verify LTHash at ${newState.version} of ${name}`)
 			}
 		}
-		
+		// clear memory used up by the mutations
 		syncd.mutations = []
 	}
 	return { state: newState, mutationMap }
@@ -495,7 +497,7 @@ const chatModificationToAppPatch = (mod, jid) => {
 					messageRange: getMessageRange(mod.lastMessages)
 				}
 			},
-			index: ['clearChat', jid, '1' , '0'],
+			index: ['clearChat', jid, '1' /*the option here is 0 when keep starred messages is enabled*/, '0'],
 			type: 'regular_high',
 			apiVersion: 6,
 			operation: OP.SET
@@ -841,45 +843,6 @@ const chatModificationToAppPatch = (mod, jid) => {
 			apiVersion: 1,
 			operation: OP.SET
 		}
-	} else if ('externalWebBeta' in mod) {
-		patch = {
-			syncAction: {
-				externalWebBetaAction: { isOptIn: !!mod.externalWebBeta }
-			},
-			index: ['setting_external_web_beta'],
-			type: 'regular',
-			apiVersion: 1,
-			operation: OP.SET
-		}
-	} else if ('maibaAIFeatures' in mod) {
-		const statusEnum = index_js_1.proto.SyncActionValue.MaibaAIFeaturesControlAction.MaibaAIFeatureStatus
-		const replyModeEnum = index_js_1.proto.SyncActionValue.MaibaAIFeaturesControlAction.MaibaAIReplyMode
-		const statusMap = {
-			enabled: statusEnum.ENABLED,
-			enabled_has_learning: statusEnum.ENABLED_HAS_LEARNING,
-			disabled: statusEnum.DISABLED
-		}
-		const replyModeMap = {
-			muted: replyModeEnum.MUTED,
-			ai_agent: replyModeEnum.AI_AGENT,
-			suggestions: replyModeEnum.SUGGESTIONS
-		}
-		const aiFeatures = mod.maibaAIFeatures
-		const status =
-			typeof aiFeatures.status === 'string' ? (statusMap[aiFeatures.status] ?? statusEnum.ENABLED) : aiFeatures.status
-		const replyMode =
-			typeof aiFeatures.replyMode === 'string'
-				? (replyModeMap[aiFeatures.replyMode] ?? replyModeEnum.SUGGESTIONS)
-				: aiFeatures.replyMode
-		patch = {
-			syncAction: {
-				maibaAiFeaturesControlAction: { aiFeatureStatus: status, aiReplyMode: replyMode }
-			},
-			index: ['setting_maiba_ai'],
-			type: 'regular',
-			apiVersion: 1,
-			operation: OP.SET
-		}
 	} else {
 		throw new boom_1.Boom('not supported')
 	}
@@ -904,25 +867,25 @@ const processSyncAction = (syncAction, ev, me, initialSyncOpts, logger) => {
 			}
 		])
 	} else if (action?.archiveChatAction || type === 'archive' || type === 'unarchive') {
-		
-		
-		
-		
-		
-		
-		
-		
-		
-		
+		// okay so we've to do some annoying computation here
+		// when we're initially syncing the app state
+		// there are a few cases we need to handle
+		// 1. if the account unarchiveChats setting is true
+		//   a. if the chat is archived, and no further messages have been received -- simple, keep archived
+		//   b. if the chat was archived, and the user received messages from the other person afterwards
+		//		then the chat should be marked unarchved --
+		//		we compare the timestamp of latest message from the other person to determine this
+		// 2. if the account unarchiveChats setting is false -- then it doesn't matter,
+		//	it'll always take an app state action to mark in unarchived -- which we'll get anyway
 		const archiveAction = action?.archiveChatAction
 		const isArchived = archiveAction ? archiveAction.archived : type === 'archive'
-		
-		
-		
-		
-		
+		// // basically we don't need to fire an "archive" update if the chat is being marked unarchvied
+		// // this only applies for the initial sync
+		// if(isInitialSync && !isArchived) {
+		// 	isArchived = false
+		// }
 		const msgRange = !accountSettings?.unarchiveChats ? undefined : archiveAction?.messageRange
-		
+		// logger?.debug({ chat: id, syncAction }, 'message range archive')
 		ev.emit('chats.update', [
 			{
 				id,
@@ -932,9 +895,9 @@ const processSyncAction = (syncAction, ev, me, initialSyncOpts, logger) => {
 		])
 	} else if (action?.markChatAsReadAction) {
 		const markReadAction = action.markChatAsReadAction
-		
-		
-		
+		// basically we don't need to fire an "read" update if the chat is being marked as read
+		// because the chat is read by default
+		// this only applies for the initial sync
 		const isNullUpdate = isInitialSync && markReadAction.read
 		ev.emit('chats.update', [
 			{
@@ -1223,33 +1186,6 @@ const processSyncAction = (syncAction, ev, me, initialSyncOpts, logger) => {
 		ev.emit('settings.update', { setting: 'businessBroadcastInsights', value: action.businessBroadcastInsightsAction })
 	} else if (action?.bizAiSettingsNudgeAction) {
 		ev.emit('settings.update', { setting: 'bizAiSettingsNudge', value: action.bizAiSettingsNudgeAction })
-	} else if (action?.clearChatAction) {
-		ev.emit('chats.update', [
-			{
-				id,
-				lastMessageRecvTimestamp: 0,
-				conditional: getChatUpdateConditional(id, action.clearChatAction?.messageRange)
-			}
-		])
-	} else if (action?.deviceCapabilities) {
-		ev.emit('settings.update', { setting: 'deviceCapabilities', value: action.deviceCapabilities })
-	} else if (action?.ugcBot) {
-		ev.emit('settings.update', { setting: 'ugcBot', value: action.ugcBot })
-	} else if (action?.coexV2VersionAction) {
-		ev.emit('settings.update', { setting: 'coexV2Version', value: action.coexV2VersionAction })
-	} else if (action?.wasaRootSecretAction) {
-		ev.emit('settings.update', { setting: 'wasaRootSecret', value: action.wasaRootSecretAction })
-	} else if (action?.bubbleLockMessageAction) {
-		ev.emit('messages.update', [
-			{
-				key: { remoteJid: id, id: msgId, fromMe: fromMe === '1' },
-				update: { bubbleLocked: action.bubbleLockMessageAction?.locked }
-			}
-		])
-	} else if (action?.labelSublistAction) {
-		ev.emit('chats.update', [
-			{ id, labelSublistId: action.labelSublistAction?.subListId, conditional: getChatUpdateConditional(id, undefined) }
-		])
 	} else {
 		logger?.debug({ syncAction, id }, 'unprocessable update')
 	}

package/lib/Utils/command-loader.d.ts

@@ -0,0 +1,31 @@
+export interface CommandContext {
+	sock: any
+	msg: any
+	args: string[]
+	text: string
+	jid: string
+	sender: string
+	isGroup: boolean
+}
+
+export interface Command {
+	name: string
+	aliases?: string[]
+	description?: string
+	execute(ctx: CommandContext): Promise<void> | void
+}
+
+export interface CommandHandlerOptions {
+	commandsDir: string
+	prefix?: string
+	logger?: any
+	onError?: (error: any, msg: any) => void
+}
+
+export interface CommandHandler {
+	commands: Map<string, Command>
+	reload: () => void
+	stop: () => void
+}
+
+export function createCommandHandler(sock: any, options: CommandHandlerOptions): CommandHandler

package/lib/Utils/command-loader.js

@@ -0,0 +1,100 @@
+'use strict'
+Object.defineProperty(exports, '__esModule', { value: true })
+exports.createCommandHandler = void 0
+const fs = require('fs')
+const path = require('path')
+
+/**
+ * Loads command modules from a folder and wires them up to a socket's `messages.upsert`
+ * event, so you don't need to write a prefix/dispatch loop by hand for every project.
+ *
+ * Each file in `commandsDir` should export an object (or a default export) shaped like:
+ *   { name: string, aliases?: string[], description?: string, execute(ctx): Promise<void> | void }
+ *
+ * `ctx` passed to `execute` is: { sock, msg, args, text, jid, sender, isGroup }
+ *
+ * @param {ReturnType<typeof import('../Socket').default>} sock - an active Baileys socket
+ * @param {{ commandsDir: string, prefix?: string, logger?: any, onError?: (error: any, msg: any) => void }} options
+ * @returns {{ commands: Map<string, any>, reload: () => void, stop: () => void }}
+ */
+const createCommandHandler = (sock, options) => {
+	const prefix = options.prefix ?? '!'
+	const logger = options.logger || sock.logger
+	const commands = new Map()
+
+	const load = () => {
+		commands.clear()
+		const dir = options.commandsDir
+		if (!fs.existsSync(dir)) {
+			logger?.warn?.({ dir }, 'commands directory does not exist')
+			return
+		}
+		const files = fs.readdirSync(dir).filter(f => f.endsWith('.js'))
+		for (const file of files) {
+			const fullPath = path.join(dir, file)
+			try {
+				delete require.cache[require.resolve(fullPath)]
+				const mod = require(fullPath)
+				const cmd = mod?.default || mod
+				if (!cmd?.name || typeof cmd.execute !== 'function') {
+					logger?.warn?.({ file }, 'skipping invalid command module (missing name/execute)')
+					continue
+				}
+				commands.set(cmd.name.toLowerCase(), cmd)
+				for (const alias of cmd.aliases || []) {
+					commands.set(alias.toLowerCase(), cmd)
+				}
+			} catch (error) {
+				logger?.error?.({ error, file }, 'failed to load command')
+			}
+		}
+		logger?.debug?.({ count: commands.size }, 'commands loaded')
+	}
+
+	load()
+
+	const handler = async ({ messages, type }) => {
+		if (type !== 'notify') return
+		for (const msg of messages) {
+			try {
+				if (!msg.message || msg.key.fromMe) continue
+				const body =
+					msg.message.conversation ||
+					msg.message.extendedTextMessage?.text ||
+					msg.message.imageMessage?.caption ||
+					msg.message.videoMessage?.caption ||
+					''
+				if (!body.startsWith(prefix)) continue
+				const [cmdName, ...args] = body.slice(prefix.length).trim().split(/\s+/)
+				if (!cmdName) continue
+				const cmd = commands.get(cmdName.toLowerCase())
+				if (!cmd) continue
+				const jid = msg.key.remoteJid
+				const ctx = {
+					sock,
+					msg,
+					args,
+					text: args.join(' '),
+					jid,
+					sender: msg.key.participant || msg.key.remoteJid,
+					isGroup: !!jid && jid.endsWith('@g.us')
+				}
+				await cmd.execute(ctx)
+			} catch (error) {
+				if (options.onError) {
+					options.onError(error, msg)
+				} else {
+					logger?.error?.({ error }, 'command execution failed')
+				}
+			}
+		}
+	}
+	sock.ev.on('messages.upsert', handler)
+
+	return {
+		commands,
+		reload: load,
+		stop: () => sock.ev.off('messages.upsert', handler)
+	}
+}
+exports.createCommandHandler = createCommandHandler

package/lib/Utils/companion-reg-client-utils.js

@@ -0,0 +1,42 @@
+'use strict'
+Object.defineProperty(exports, '__esModule', { value: true })
+exports.buildPairingQRData = exports.getCompanionPlatformId = exports.getCompanionWebClientType = exports.CompanionWebClientType = void 0
+var CompanionWebClientType
+;(function (CompanionWebClientType) {
+	CompanionWebClientType[(CompanionWebClientType['UNKNOWN'] = 0)] = 'UNKNOWN'
+	CompanionWebClientType[(CompanionWebClientType['CHROME'] = 1)] = 'CHROME'
+	CompanionWebClientType[(CompanionWebClientType['EDGE'] = 2)] = 'EDGE'
+	CompanionWebClientType[(CompanionWebClientType['FIREFOX'] = 3)] = 'FIREFOX'
+	CompanionWebClientType[(CompanionWebClientType['IE'] = 4)] = 'IE'
+	CompanionWebClientType[(CompanionWebClientType['OPERA'] = 5)] = 'OPERA'
+	CompanionWebClientType[(CompanionWebClientType['SAFARI'] = 6)] = 'SAFARI'
+	CompanionWebClientType[(CompanionWebClientType['ELECTRON'] = 7)] = 'ELECTRON'
+	CompanionWebClientType[(CompanionWebClientType['UWP'] = 8)] = 'UWP'
+	CompanionWebClientType[(CompanionWebClientType['OTHER_WEB_CLIENT'] = 9)] = 'OTHER_WEB_CLIENT'
+})((CompanionWebClientType = exports.CompanionWebClientType || (exports.CompanionWebClientType = {})))
+const BROWSER_TO_COMPANION_WEB_CLIENT = {
+	Chrome: CompanionWebClientType.CHROME,
+	Edge: CompanionWebClientType.EDGE,
+	Firefox: CompanionWebClientType.FIREFOX,
+	IE: CompanionWebClientType.IE,
+	Opera: CompanionWebClientType.OPERA,
+	Safari: CompanionWebClientType.SAFARI
+}
+const getCompanionWebClientType = ([os, browserName]) => {
+	if (browserName === 'Desktop') {
+		return os === 'Windows' ? CompanionWebClientType.UWP : CompanionWebClientType.ELECTRON
+	}
+	return BROWSER_TO_COMPANION_WEB_CLIENT[browserName] || CompanionWebClientType.OTHER_WEB_CLIENT
+}
+exports.getCompanionWebClientType = getCompanionWebClientType
+const getCompanionPlatformId = (browser) => {
+	return getCompanionWebClientType(browser).toString()
+}
+exports.getCompanionPlatformId = getCompanionPlatformId
+const buildPairingQRData = (ref, noiseKeyB64, identityKeyB64, advB64, browser) => {
+	return (
+		'https://wa.me/settings/linked_devices#' +
+		[ref, noiseKeyB64, identityKeyB64, advB64, getCompanionPlatformId(browser)].join(',')
+	)
+}
+exports.buildPairingQRData = buildPairingQRData

package/lib/Utils/crypto.js

@@ -1,12 +1,6 @@
 'use strict'
 Object.defineProperty(exports, '__esModule', { value: true })
-exports.signedKeyPair =
-	exports.Curve =
-	exports.generateSignalPubKey =
-	exports.getEnabledFeatures =
-	exports.hkdf =
-	exports.md5 =
-		void 0
+exports.signedKeyPair = exports.Curve = exports.generateSignalPubKey = exports.hkdf = exports.md5 = void 0
 exports.aesEncryptGCM = aesEncryptGCM
 exports.aesDecryptGCM = aesDecryptGCM
 exports.aesEncryptCTR = aesEncryptCTR
@@ -20,36 +14,64 @@ exports.sha256 = sha256
 exports.derivePairingCodeKey = derivePairingCodeKey
 const { subtle } = globalThis.crypto
 const Defaults_1 = require('../Defaults')
-const rb = require('whatsapp-rust-bridge')
-
-
-Object.defineProperty(exports, 'md5', { enumerable: true, get: () => rb.md5 })
-Object.defineProperty(exports, 'hkdf', { enumerable: true, get: () => rb.hkdf })
-Object.defineProperty(exports, 'getEnabledFeatures', { enumerable: true, get: () => rb.getEnabledFeatures })
-
+const nodeCrypto = require('crypto')
+
+// Pure Node.js `crypto` / hand-written JS only -- no native/WASM module
+// dependency anywhere in this file (including `Curve`, X25519 key exchange +
+// XEdDSA signing). XEdDSA specifically is validated against the official
+// RFC 8032 Ed25519 test vectors, RFC 7748-style X25519 DH vectors, and
+// hundreds of randomized Montgomery<->Edwards interop + self-consistency
+// checks -- see ./curve25519-js.js for details and references.
+
+// ── MD5 ────────────────────────────────────────────────────────────────────────
+const md5 = buffer => nodeCrypto.createHash('md5').update(buffer).digest()
+Object.defineProperty(exports, 'md5', { enumerable: true, get: () => md5 })
+
+// ── HKDF (RFC 5869) ─────────────────────────────────────────────────────────────
+const hkdfExtractJS = (salt, ikm) => nodeCrypto.createHmac('sha256', salt).update(ikm).digest()
+const hkdfExpandJS = (prk, length, info) => {
+	const hashLen = 32
+	const n = Math.ceil(length / hashLen)
+	let t = Buffer.alloc(0)
+	let okm = Buffer.alloc(0)
+	for (let i = 1; i <= n; i++) {
+		t = nodeCrypto
+			.createHmac('sha256', prk)
+			.update(Buffer.concat([t, info, Buffer.from([i])]))
+			.digest()
+		okm = Buffer.concat([okm, t])
+	}
+	return okm.subarray(0, length)
+}
+const hkdf = (ikm, length, options = {}) => {
+	const ikmBuf = Buffer.isBuffer(ikm) ? ikm : Buffer.from(ikm)
+	const saltBuf = options.salt
+		? Buffer.isBuffer(options.salt)
+			? options.salt
+			: Buffer.from(options.salt)
+		: Buffer.alloc(32) // RFC 5869: default salt is HashLen zero bytes
+	const infoBuf = options.info
+		? Buffer.isBuffer(options.info)
+			? options.info
+			: Buffer.from(options.info)
+		: Buffer.alloc(0)
+	const prk = hkdfExtractJS(saltBuf, ikmBuf)
+	return hkdfExpandJS(prk, length, infoBuf)
+}
+Object.defineProperty(exports, 'hkdf', { enumerable: true, get: () => hkdf })
 
+// ── Signal pub key helper ─────────────────────────────────────────────────────
 const generateSignalPubKey = pubKey =>
 	pubKey.length === 33 ? pubKey : Buffer.concat([Defaults_1.KEY_BUNDLE_TYPE, pubKey])
 exports.generateSignalPubKey = generateSignalPubKey
 
-
+// ── Curve — X25519 key exchange + XEdDSA signing ──────────────────────────────
+const curve25519JS = require('./curve25519-js')
 exports.Curve = {
-	generateKeyPair: () => {
-		const pair = rb.generateKeyPair()
-		return {
-			private: Buffer.from(pair.privKey),
-			public: Buffer.from(pair.pubKey).subarray(1) 
-		}
-	},
-	sharedKey: (privateKey, publicKey) => Buffer.from(rb.calculateAgreement(generateSignalPubKey(publicKey), privateKey)),
-	sign: (privateKey, buf) => rb.calculateSignature(privateKey, buf),
-	verify: (pubKey, message, signature) => {
-		try {
-			return rb.verifySignature(generateSignalPubKey(pubKey), message, signature)
-		} catch {
-			return false
-		}
-	}
+	generateKeyPair: () => curve25519JS.generateKeyPairJS(),
+	sharedKey: (privateKey, publicKey) => curve25519JS.sharedKeyJS(privateKey, publicKey),
+	sign: (privateKey, buf) => curve25519JS.signJS(privateKey, buf),
+	verify: (pubKey, message, signature) => curve25519JS.verifyJS(pubKey, message, signature)
 }
 
 const signedKeyPair = (identityKeyPair, keyId) => {
@@ -60,57 +82,65 @@ const signedKeyPair = (identityKeyPair, keyId) => {
 }
 exports.signedKeyPair = signedKeyPair
 
-
+// ── AES-256-GCM ───────────────────────────────────────────────────────────────
 function aesEncryptGCM(plaintext, key, iv, additionalData) {
-	return Buffer.from(rb.aesEncryptGCM(plaintext, key, iv, additionalData))
+	const cipher = nodeCrypto.createCipheriv('aes-256-gcm', key, iv)
+	if (additionalData) cipher.setAAD(additionalData)
+	const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()])
+	return Buffer.concat([encrypted, cipher.getAuthTag()])
 }
 
 function aesDecryptGCM(ciphertext, key, iv, additionalData) {
-	return Buffer.from(rb.aesDecryptGCM(ciphertext, key, iv, additionalData))
+	const authTag = ciphertext.subarray(ciphertext.length - 16)
+	const encrypted = ciphertext.subarray(0, ciphertext.length - 16)
+	const decipher = nodeCrypto.createDecipheriv('aes-256-gcm', key, iv)
+	if (additionalData) decipher.setAAD(additionalData)
+	decipher.setAuthTag(authTag)
+	return Buffer.concat([decipher.update(encrypted), decipher.final()])
 }
 
-
+// ── AES-256-CTR ───────────────────────────────────────────────────────────────
 function aesEncryptCTR(plaintext, key, iv) {
-	return Buffer.from(rb.aesEncryptCTR(plaintext, key, iv))
+	const cipher = nodeCrypto.createCipheriv('aes-256-ctr', key, iv)
+	return Buffer.concat([cipher.update(plaintext), cipher.final()])
 }
 
 function aesDecryptCTR(ciphertext, key, iv) {
-	return Buffer.from(rb.aesDecryptCTR(ciphertext, key, iv))
+	const decipher = nodeCrypto.createDecipheriv('aes-256-ctr', key, iv)
+	return Buffer.concat([decipher.update(ciphertext), decipher.final()])
 }
 
-
+// ── AES-256-CBC (no explicit IV -- zero IV, legacy/unused elsewhere in this lib) ─
 function aesDecrypt(buffer, key) {
-	return Buffer.from(rb.aesDecrypt(buffer, key))
+	return aesDecryptWithIV(buffer, key, Buffer.alloc(16))
 }
 
-function aesDecryptWithIV(buffer, key, IV) {
-	return Buffer.from(rb.aesDecryptWithIV(buffer, key, IV))
+function aesEncrypt(buffer, key) {
+	return aesEncrypWithIV(buffer, key, Buffer.alloc(16))
 }
 
-function aesEncrypt(buffer, key) {
-	return Buffer.from(rb.aesEncrypt(buffer, key))
+// ── AES-256-CBC (explicit IV) ─────────────────────────────────────────────────
+function aesDecryptWithIV(buffer, key, IV) {
+	const decipher = nodeCrypto.createDecipheriv('aes-256-cbc', key, IV)
+	return Buffer.concat([decipher.update(buffer), decipher.final()])
 }
 
 function aesEncrypWithIV(buffer, key, IV) {
-	return Buffer.from(rb.aesEncrypWithIV(buffer, key, IV))
+	const cipher = nodeCrypto.createCipheriv('aes-256-cbc', key, IV)
+	return Buffer.concat([cipher.update(buffer), cipher.final()])
 }
 
-
+// ── HMAC-SHA256 ───────────────────────────────────────────────────────────────
 function hmacSign(buffer, key, variant = 'sha256') {
-	if (variant !== 'sha256') {
-		
-		const { createHmac } = require('crypto')
-		return createHmac(variant, key).update(buffer).digest()
-	}
-	return Buffer.from(rb.hmacSign(buffer, key))
+	return nodeCrypto.createHmac(variant, key).update(buffer).digest()
 }
 
-
+// ── SHA-256 ───────────────────────────────────────────────────────────────────
 function sha256(buffer) {
-	return Buffer.from(rb.sha256(buffer))
+	return nodeCrypto.createHash('sha256').update(buffer).digest()
 }
 
-
+// ── PBKDF2 pairing code key ───────────────────────────────────────────────────
 async function derivePairingCodeKey(pairingCode, salt) {
 	const encoder = new TextEncoder()
 	const pairingCodeBuffer = encoder.encode(pairingCode)