@ikyyjee/ikyysinggle 1.7.7

package/lib/Utils/sticker.js

@@ -0,0 +1,139 @@
+/**
+ * lib/Utils/sticker.js — image/video -> WhatsApp WebP sticker conversion,
+ * plus writing the sticker-pack EXIF metadata WhatsApp reads for the pack
+ * name/publisher/emoji. Requires the optional "sharp" dependency; video
+ * conversion additionally shells out to a locally-installed `ffmpeg`.
+ *
+ * Note on the ffmpeg call: options.fps/seconds are strictly validated and
+ * coerced to bounded integers, and the process is spawned with an argv
+ * array (execFile), never a shell string — so there's no way for a caller
+ * (or attacker-controlled option) to inject extra shell commands here.
+ */
+import os from 'os';
+import path from 'path';
+import fs from 'fs';
+import crypto from 'crypto';
+import { execFile } from 'child_process';
+
+export const addExifToWebp = async (webpBuffer, { packName = '', packPublisher = '', categories = [] } = {}) => {
+    const json = {
+        'sticker-pack-id': crypto.randomBytes(16).toString('hex'),
+        'sticker-pack-name': packName,
+        'sticker-pack-publisher': packPublisher,
+        emojis: categories.length ? categories : ['😀']
+    };
+    const jsonBuffer = Buffer.from(JSON.stringify(json), 'utf-8');
+    const exifAttr = Buffer.from([
+        0x49, 0x49, 0x2a, 0x00, 0x08, 0x00, 0x00, 0x00, 0x01, 0x00, 0x41, 0x57, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x16,
+        0x00, 0x00, 0x00
+    ]);
+    exifAttr.writeUIntLE(jsonBuffer.length, 14, 4);
+    const exifPayload = Buffer.concat([exifAttr, jsonBuffer]);
+    const pad = (buf) => (buf.length % 2 === 1 ? Buffer.concat([buf, Buffer.from([0x00])]) : buf);
+    const makeChunk = (tag, data) => {
+        const sizeField = Buffer.alloc(4);
+        sizeField.writeUInt32LE(data.length, 0);
+        return Buffer.concat([Buffer.from(tag, 'ascii'), sizeField, pad(data)]);
+    };
+    const exifChunk = makeChunk('EXIF', exifPayload);
+    if (webpBuffer.slice(0, 4).toString('ascii') !== 'RIFF' || webpBuffer.slice(8, 12).toString('ascii') !== 'WEBP') {
+        throw new Error('addExifToWebp expects a valid WebP buffer');
+    }
+    let offset = 12;
+    let vp8xChunk = null;
+    const otherChunks = [];
+    while (offset < webpBuffer.length) {
+        const tag = webpBuffer.slice(offset, offset + 4).toString('ascii');
+        const size = webpBuffer.readUInt32LE(offset + 4);
+        const chunkTotal = 8 + size + (size % 2);
+        if (tag === 'VP8X') {
+            vp8xChunk = webpBuffer.slice(offset, offset + chunkTotal);
+        }
+        else if (tag !== 'EXIF') {
+            otherChunks.push(webpBuffer.slice(offset, offset + chunkTotal));
+        }
+        offset += chunkTotal;
+    }
+    let flags;
+    let canvasWidth;
+    let canvasHeight;
+    if (vp8xChunk) {
+        flags = vp8xChunk.readUInt8(8);
+        canvasWidth = vp8xChunk.readUIntLE(12, 3) + 1;
+        canvasHeight = vp8xChunk.readUIntLE(15, 3) + 1;
+    }
+    else {
+        flags = 0;
+        let sharp;
+        try {
+            sharp = (await import('sharp')).default;
+        }
+        catch (error) {
+            throw new Error('addExifToWebp needs the optional "sharp" dependency to read image dimensions');
+        }
+        const meta = await sharp(webpBuffer).metadata();
+        canvasWidth = meta.width;
+        canvasHeight = meta.height;
+    }
+    flags |= 0x08;
+    const vp8xData = Buffer.alloc(10);
+    vp8xData.writeUInt8(flags, 0);
+    vp8xData.writeUIntLE(canvasWidth - 1, 4, 3);
+    vp8xData.writeUIntLE(canvasHeight - 1, 7, 3);
+    const newVp8xChunk = makeChunk('VP8X', vp8xData);
+    const body = Buffer.concat([newVp8xChunk, ...otherChunks, exifChunk]);
+    const fileSize = Buffer.alloc(4);
+    fileSize.writeUInt32LE(4 + body.length, 0);
+    return Buffer.concat([Buffer.from('RIFF', 'ascii'), fileSize, Buffer.from('WEBP', 'ascii'), body]);
+};
+
+export const imageToWebpSticker = async (imageBuffer, options = {}) => {
+    let sharp;
+    try {
+        sharp = (await import('sharp')).default;
+    }
+    catch (error) {
+        throw new Error('imageToWebpSticker requires the optional "sharp" dependency to be installed');
+    }
+    const webp = await sharp(imageBuffer)
+        .resize(512, 512, { fit: 'contain', background: { r: 0, g: 0, b: 0, alpha: 0 } })
+        .webp({ quality: options.quality ?? 80 })
+        .toBuffer();
+    return addExifToWebp(webp, options);
+};
+
+/** Clamp a user-supplied numeric option to a safe integer range, with a default if invalid. */
+const boundedInt = (value, { min, max, fallback }) => {
+    const n = Number(value);
+    if (!Number.isFinite(n)) {
+        return fallback;
+    }
+    return Math.min(max, Math.max(min, Math.round(n)));
+};
+
+export const videoToWebpSticker = async (videoBuffer, options = {}) => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'xayz-baileys-sticker-'));
+    const inputPath = path.join(tmpDir, 'input.mp4');
+    const outputPath = path.join(tmpDir, 'output.webp');
+    fs.writeFileSync(inputPath, videoBuffer);
+    // Validated/clamped, not interpolated into a shell string — see execFile call below.
+    const fps = boundedInt(options.fps, { min: 1, max: 30, fallback: 10 });
+    const seconds = boundedInt(options.seconds, { min: 1, max: 10, fallback: 5 });
+    const vf = `fps=${fps},scale=512:512:force_original_aspect_ratio=decrease,` +
+        `pad=512:512:(ow-iw)/2:(oh-ih)/2:color=0x00000000,split[a][b];` +
+        `[a]palettegen=reserve_transparent=1[p];[b][p]paletteuse`;
+    const args = ['-y', '-i', inputPath, '-t', String(seconds), '-vf', vf, '-loop', '0', '-preset', 'default', '-an', '-vsync', '0', outputPath];
+    try {
+        await new Promise((resolve, reject) => {
+            // execFile with an argv array — ffmpeg is invoked directly, no shell is
+            // spawned, so nothing in `args` (all of which are numbers/paths we built
+            // ourselves) can be interpreted as a shell command.
+            execFile('ffmpeg', args, (err) => (err ? reject(err) : resolve()));
+        });
+        const webp = fs.readFileSync(outputPath);
+        return await addExifToWebp(webp, options);
+    }
+    finally {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+};

package/lib/Utils/sync-action-utils.js

@@ -0,0 +1,49 @@
+import { proto } from '../../WAProto/index.js';
+import { isLidUser, isPnUser } from '../WABinary/index.js';
+/**
+ * Process contactAction and return events to emit.
+ * Pure function - no side effects.
+ */
+export const processContactAction = (action, id, logger) => {
+    const results = [];
+    if (!id) {
+        logger?.warn({ hasFullName: !!action.fullName, hasLidJid: !!action.lidJid, hasPnJid: !!action.pnJid }, 'contactAction sync: missing id in index');
+        return results;
+    }
+    const lidJid = action.lidJid;
+    const idIsPn = isPnUser(id);
+    // PN is in index[1], not in contactAction.pnJid which is usually null
+    const phoneNumber = idIsPn ? id : action.pnJid || undefined;
+    // Always emit contacts.upsert
+    results.push({
+        event: 'contacts.upsert',
+        data: [
+            {
+                id,
+                name: action.fullName || action.firstName || action.username || undefined,
+                username: action.username || undefined,
+                lid: lidJid || undefined,
+                phoneNumber
+            }
+        ]
+    });
+    // Emit lid-mapping.update if we have valid LID-PN pair
+    if (lidJid && isLidUser(lidJid) && idIsPn) {
+        results.push({
+            event: 'lid-mapping.update',
+            data: { lid: lidJid, pn: id }
+        });
+    }
+    return results;
+};
+export const emitSyncActionResults = (ev, results) => {
+    for (const result of results) {
+        if (result.event === 'contacts.upsert') {
+            ev.emit('contacts.upsert', result.data);
+        }
+        else {
+            ev.emit('lid-mapping.update', result.data);
+        }
+    }
+};
+//# sourceMappingURL=sync-action-utils.js.map

package/lib/Utils/tc-token-utils.js

@@ -0,0 +1,163 @@
+import { getBinaryNodeChild, getBinaryNodeChildren, isHostedLidUser, isHostedPnUser, isJidMetaAI, isLidUser, isPnUser, jidNormalizedUser } from '../WABinary/index.js';
+// Same phone-number pattern as WABinary's isJidBot, applied against the user
+// part so the check is invariant to @c.us ↔ @s.whatsapp.net normalization.
+const BOT_PHONE_REGEX = /^1313555\d{4}$|^131655500\d{2}$/;
+/**
+ * Mirrors WA Web's `Wid.isRegularUser()` (user ∧ ¬PSA ∧ ¬Bot). Used to gate tctoken
+ * storage against malformed notifications — WA Web filters server-side but we
+ * defend here for parity with `WAWebSetTcTokenChatAction.handleIncomingTcToken`.
+ * Works for both pre- and post-normalized JIDs (`@c.us` vs `@s.whatsapp.net`).
+ */
+function isRegularUser(jid) {
+    if (!jid)
+        return false;
+    const user = jid.split('@')[0] ?? '';
+    if (user === '0')
+        return false; // PSA
+    if (BOT_PHONE_REGEX.test(user))
+        return false; // Bot by phone pattern
+    if (isJidMetaAI(jid))
+        return false; // MetaAI (@bot server)
+    return !!(isPnUser(jid) || isLidUser(jid) || isHostedPnUser(jid) || isHostedLidUser(jid) || jid.endsWith('@c.us'));
+}
+const TC_TOKEN_BUCKET_DURATION = 604800; // 7 days
+const TC_TOKEN_NUM_BUCKETS = 4; // ~28-day rolling window
+/** Sentinel key under `tctoken` store holding a JSON array of tracked storage JIDs for cross-session pruning. */
+export const TC_TOKEN_INDEX_KEY = '__index';
+/** Read the persisted tctoken JID index and return its entries (never contains the sentinel key itself). */
+export async function readTcTokenIndex(keys) {
+    const data = await keys.get('tctoken', [TC_TOKEN_INDEX_KEY]);
+    const entry = data[TC_TOKEN_INDEX_KEY];
+    if (!entry?.token?.length)
+        return [];
+    try {
+        const parsed = JSON.parse(Buffer.from(entry.token).toString());
+        if (!Array.isArray(parsed))
+            return [];
+        return parsed.filter((j) => typeof j === 'string' && j.length > 0 && j !== TC_TOKEN_INDEX_KEY);
+    }
+    catch {
+        return [];
+    }
+}
+/** Build a SignalDataSet fragment that writes the merged index (persisted ∪ added) under the sentinel key. */
+export async function buildMergedTcTokenIndexWrite(keys, addedJids) {
+    const persisted = await readTcTokenIndex(keys);
+    const merged = new Set(persisted);
+    for (const jid of addedJids) {
+        if (jid && jid !== TC_TOKEN_INDEX_KEY)
+            merged.add(jid);
+    }
+    return {
+        [TC_TOKEN_INDEX_KEY]: { token: Buffer.from(JSON.stringify([...merged])) }
+    };
+}
+// WA Web has separate sender/receiver AB props for these but they're identical today
+export function isTcTokenExpired(timestamp) {
+    if (timestamp === null || timestamp === undefined)
+        return true;
+    const ts = typeof timestamp === 'string' ? parseInt(timestamp) : timestamp;
+    if (isNaN(ts))
+        return true;
+    const now = Math.floor(Date.now() / 1000);
+    const currentBucket = Math.floor(now / TC_TOKEN_BUCKET_DURATION);
+    const cutoffBucket = currentBucket - (TC_TOKEN_NUM_BUCKETS - 1);
+    const cutoffTimestamp = cutoffBucket * TC_TOKEN_BUCKET_DURATION;
+    return ts < cutoffTimestamp;
+}
+export function shouldSendNewTcToken(senderTimestamp) {
+    if (senderTimestamp === undefined)
+        return true;
+    const now = Math.floor(Date.now() / 1000);
+    const currentBucket = Math.floor(now / TC_TOKEN_BUCKET_DURATION);
+    const senderBucket = Math.floor(senderTimestamp / TC_TOKEN_BUCKET_DURATION);
+    return currentBucket > senderBucket;
+}
+/** Resolve JID to LID for tctoken storage (WA Web stores under LID) */
+export async function resolveTcTokenJid(jid, getLIDForPN) {
+    if (isLidUser(jid))
+        return jid;
+    const lid = await getLIDForPN(jid);
+    return lid ?? jid;
+}
+/** Resolve target JID for issuing privacy token based on AB prop 14303 */
+export async function resolveIssuanceJid(jid, issueToLid, getLIDForPN, getPNForLID) {
+    if (issueToLid) {
+        if (isLidUser(jid))
+            return jid;
+        const lid = await getLIDForPN(jid);
+        return lid ?? jid;
+    }
+    if (!isLidUser(jid))
+        return jid;
+    if (getPNForLID) {
+        const pn = await getPNForLID(jid);
+        return pn ?? jid;
+    }
+    return jid;
+}
+export async function buildTcTokenFromJid({ authState, jid, baseContent = [], getLIDForPN }) {
+    try {
+        const storageJid = await resolveTcTokenJid(jid, getLIDForPN);
+        const tcTokenData = await authState.keys.get('tctoken', [storageJid]);
+        const entry = tcTokenData?.[storageJid];
+        const tcTokenBuffer = entry?.token;
+        if (!tcTokenBuffer?.length || isTcTokenExpired(entry?.timestamp)) {
+            if (tcTokenBuffer) {
+                // Preserve senderTimestamp so shouldSendNewTcToken() keeps its dedupe state
+                // after we drop the unusable peer token. Only wipe the record entirely when
+                // there's nothing worth keeping.
+                const cleared = entry?.senderTimestamp !== undefined
+                    ? { token: Buffer.alloc(0), senderTimestamp: entry.senderTimestamp }
+                    : null;
+                await authState.keys.set({ tctoken: { [storageJid]: cleared } });
+            }
+            return baseContent.length > 0 ? baseContent : undefined;
+        }
+        baseContent.push({
+            tag: 'tctoken',
+            attrs: {},
+            content: tcTokenBuffer
+        });
+        return baseContent;
+    }
+    catch (error) {
+        return baseContent.length > 0 ? baseContent : undefined;
+    }
+}
+export async function storeTcTokensFromIqResult({ result, fallbackJid, keys, getLIDForPN, onNewJidStored }) {
+    const tokensNode = getBinaryNodeChild(result, 'tokens');
+    if (!tokensNode)
+        return;
+    const tokenNodes = getBinaryNodeChildren(tokensNode, 'token');
+    for (const tokenNode of tokenNodes) {
+        if (tokenNode.attrs.type !== 'trusted_contact' || !(tokenNode.content instanceof Uint8Array)) {
+            continue;
+        }
+        // In notifications tokenNode.attrs.jid is your own device JID, not the sender's
+        const rawJid = jidNormalizedUser(fallbackJid || tokenNode.attrs.jid);
+        if (!isRegularUser(rawJid))
+            continue;
+        const storageJid = await resolveTcTokenJid(rawJid, getLIDForPN);
+        const existingTcData = await keys.get('tctoken', [storageJid]);
+        const existingEntry = existingTcData[storageJid];
+        const existingTs = existingEntry?.timestamp ? Number(existingEntry.timestamp) : 0;
+        const incomingTs = tokenNode.attrs.t ? Number(tokenNode.attrs.t) : 0;
+        // timestamp-less tokens would be immediately expired
+        if (!incomingTs)
+            continue;
+        if (existingTs > 0 && existingTs > incomingTs)
+            continue;
+        await keys.set({
+            tctoken: {
+                [storageJid]: {
+                    ...existingEntry,
+                    token: Buffer.from(tokenNode.content),
+                    timestamp: tokenNode.attrs.t
+                }
+            }
+        });
+        onNewJidStored?.(storageJid);
+    }
+}
+//# sourceMappingURL=tc-token-utils.js.map

package/lib/Utils/use-multi-file-auth-state.js

@@ -0,0 +1,121 @@
+import { Mutex } from 'async-mutex';
+import { mkdir, readFile, stat, unlink, writeFile } from 'fs/promises';
+import { join } from 'path';
+import { proto } from '../../WAProto/index.js';
+import { initAuthCreds } from './auth-utils.js';
+import { BufferJSON } from './generics.js';
+// We need to lock files due to the fact that we are using async functions to read and write files
+// https://github.com/WhiskeySockets/Baileys/issues/794
+// https://github.com/nodejs/node/issues/26338
+// Use a Map to store mutexes for each file path
+const fileLocks = new Map();
+// Get or create a mutex for a specific file path
+const getFileLock = (path) => {
+    let mutex = fileLocks.get(path);
+    if (!mutex) {
+        mutex = new Mutex();
+        fileLocks.set(path, mutex);
+    }
+    return mutex;
+};
+/**
+ * stores the full authentication state in a single folder.
+ * Far more efficient than singlefileauthstate
+ *
+ * Again, I wouldn't endorse this for any production level use other than perhaps a bot.
+ * Would recommend writing an auth state for use with a proper SQL or No-SQL DB
+ * */
+export const useMultiFileAuthState = async (folder) => {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const writeData = async (data, file) => {
+        const filePath = join(folder, fixFileName(file));
+        const mutex = getFileLock(filePath);
+        return mutex.acquire().then(async (release) => {
+            try {
+                await writeFile(filePath, JSON.stringify(data, BufferJSON.replacer));
+            }
+            finally {
+                release();
+            }
+        });
+    };
+    const readData = async (file) => {
+        try {
+            const filePath = join(folder, fixFileName(file));
+            const mutex = getFileLock(filePath);
+            return await mutex.acquire().then(async (release) => {
+                try {
+                    const data = await readFile(filePath, { encoding: 'utf-8' });
+                    return JSON.parse(data, BufferJSON.reviver);
+                }
+                finally {
+                    release();
+                }
+            });
+        }
+        catch (error) {
+            return null;
+        }
+    };
+    const removeData = async (file) => {
+        try {
+            const filePath = join(folder, fixFileName(file));
+            const mutex = getFileLock(filePath);
+            return mutex.acquire().then(async (release) => {
+                try {
+                    await unlink(filePath);
+                }
+                catch {
+                }
+                finally {
+                    release();
+                }
+            });
+        }
+        catch { }
+    };
+    const folderInfo = await stat(folder).catch(() => { });
+    if (folderInfo) {
+        if (!folderInfo.isDirectory()) {
+            throw new Error(`found something that is not a directory at ${folder}, either delete it or specify a different location`);
+        }
+    }
+    else {
+        await mkdir(folder, { recursive: true });
+    }
+    const fixFileName = (file) => file?.replace(/\//g, '__')?.replace(/:/g, '-');
+    const creds = (await readData('creds.json')) || initAuthCreds();
+    return {
+        state: {
+            creds,
+            keys: {
+                get: async (type, ids) => {
+                    const data = {};
+                    await Promise.all(ids.map(async (id) => {
+                        let value = await readData(`${type}-${id}.json`);
+                        if (type === 'app-state-sync-key' && value) {
+                            value = proto.Message.AppStateSyncKeyData.fromObject(value);
+                        }
+                        data[id] = value;
+                    }));
+                    return data;
+                },
+                set: async (data) => {
+                    const tasks = [];
+                    for (const category in data) {
+                        for (const id in data[category]) {
+                            const value = data[category][id];
+                            const file = `${category}-${id}.json`;
+                            tasks.push(value ? writeData(value, file) : removeData(file));
+                        }
+                    }
+                    await Promise.all(tasks);
+                }
+            }
+        },
+        saveCreds: async () => {
+            return writeData(creds, 'creds.json');
+        }
+    };
+};
+//# sourceMappingURL=use-multi-file-auth-state.js.map

package/lib/Utils/use-sqlite-auth-state.js

@@ -0,0 +1,168 @@
+/**
+ * lib/Utils/use-sqlite-auth-state.js — alternative auth-state storage using
+ * Node's built-in `node:sqlite` module (Node 22.5+), instead of one JSON
+ * file per key like `useMultiFileAuthState`. Single-file storage scales much
+ * better for a busy bot with lots of app-state-sync keys/prekeys.
+ *
+ * Optional: if `node:sqlite` isn't available (older Node), this throws a
+ * clear error telling you to upgrade or use `useMultiFileAuthState` instead
+ * — nothing else in the library depends on this file or on `node:sqlite`.
+ */
+import { mkdir, readdir, readFile } from 'fs/promises';
+import { dirname, join } from 'path';
+import { proto } from '../../WAProto/index.js';
+import { initAuthCreds } from './auth-utils.js';
+
+export const useSqliteAuthState = async (pathOrFolder, options = {}) => {
+    const { fileName = 'auth.db', migrateFromFolder, logger } = options;
+    const dbPath = /\.(db|sqlite|sqlite3)$/i.test(pathOrFolder) ? pathOrFolder : join(pathOrFolder, fileName);
+    const bufReplacer = (_, value) => {
+        if (Buffer.isBuffer(value) || value instanceof Uint8Array || value?.type === 'Buffer') {
+            return { type: 'Buffer', data: Buffer.from(value?.data || value).toString('base64') };
+        }
+        return value;
+    };
+    const bufReviver = (_, value) => {
+        if (value && typeof value === 'object' && value.type === 'Buffer' && typeof value.data === 'string') {
+            return Buffer.from(value.data, 'base64');
+        }
+        return value;
+    };
+    const encode = (value) => {
+        if (Buffer.isBuffer(value) || value instanceof Uint8Array) {
+            return Buffer.concat([Buffer.from([1]), Buffer.from(value)]);
+        }
+        return Buffer.concat([Buffer.from([0]), Buffer.from(JSON.stringify(value, bufReplacer), 'utf8')]);
+    };
+    const decode = (blob) => {
+        if (!blob || blob.length === 0)
+            return null;
+        if (blob[0] === 1)
+            return Buffer.from(blob.subarray(1));
+        return JSON.parse(Buffer.from(blob.subarray(1)).toString('utf8'), bufReviver);
+    };
+    const fixName = (s) => s?.replace(/\//g, '__')?.replace(/:/g, '-');
+    const keyOf = (category, id) => fixName(`${category}-${id}`);
+    let DatabaseSync;
+    try {
+        ({ DatabaseSync } = await import('node:sqlite'));
+    }
+    catch (err) {
+        throw new Error("useSqliteAuthState needs the built-in 'node:sqlite' module (Node 22.5+). Upgrade Node, or use useMultiFileAuthState instead.");
+    }
+    await mkdir(dirname(dbPath), { recursive: true }).catch(() => { });
+    const db = new DatabaseSync(dbPath);
+    db.exec('PRAGMA journal_mode = TRUNCATE');
+    db.exec('PRAGMA synchronous = NORMAL');
+    db.exec('PRAGMA busy_timeout = 5000');
+    db.exec('CREATE TABLE IF NOT EXISTS auth_state (k TEXT PRIMARY KEY, v BLOB NOT NULL) WITHOUT ROWID');
+    const qGet = db.prepare('SELECT v FROM auth_state WHERE k = ?');
+    const qUpsert = db.prepare('INSERT INTO auth_state(k,v) VALUES(?,?) ON CONFLICT(k) DO UPDATE SET v=excluded.v');
+    const qDelete = db.prepare('DELETE FROM auth_state WHERE k = ?');
+    const runTx = (fn) => {
+        db.exec('BEGIN');
+        try {
+            const r = fn();
+            db.exec('COMMIT');
+            return r;
+        }
+        catch (err) {
+            db.exec('ROLLBACK');
+            throw err;
+        }
+    };
+    const readRaw = (k) => {
+        const row = qGet.get(k);
+        if (!row)
+            return null;
+        try {
+            return decode(row.v);
+        }
+        catch (err) {
+            logger?.warn?.({ k, err: err?.message }, 'sqlite-auth: failed to decode row, treating as missing');
+            return null;
+        }
+    };
+    const runMigration = async (folder) => {
+        let files;
+        try {
+            files = await readdir(folder);
+        }
+        catch {
+            return 0;
+        }
+        const rows = [];
+        for (const file of files) {
+            if (!file.endsWith('.json'))
+                continue;
+            let value;
+            try {
+                value = JSON.parse(await readFile(join(folder, file), 'utf8'), bufReviver);
+            }
+            catch {
+                continue;
+            }
+            if (value === null || value === undefined)
+                continue;
+            rows.push([file.slice(0, -'.json'.length), encode(value)]);
+        }
+        runTx(() => {
+            for (const [k, v] of rows)
+                qUpsert.run(k, v);
+        });
+        return rows.length;
+    };
+    const hasCreds = () => !!qGet.get('creds');
+    if (migrateFromFolder && !hasCreds()) {
+        const n = await runMigration(migrateFromFolder);
+        if (n > 0)
+            logger?.info?.({ count: n, from: migrateFromFolder }, 'sqlite-auth: migrated legacy auth state');
+    }
+    let creds = readRaw('creds');
+    if (!creds) {
+        creds = initAuthCreds();
+        qUpsert.run('creds', encode(creds));
+    }
+    const keys = {
+        get: async (type, ids) => {
+            const data = {};
+            for (const id of ids) {
+                let value = readRaw(keyOf(type, id));
+                if (type === 'app-state-sync-key' && value) {
+                    value = proto.Message.AppStateSyncKeyData.fromObject(value);
+                }
+                if (value !== null && value !== undefined) {
+                    data[id] = value;
+                }
+            }
+            return data;
+        },
+        set: async (data) => {
+            const ops = [];
+            for (const category in data) {
+                for (const id in data[category]) {
+                    ops.push([keyOf(category, id), data[category][id]]);
+                }
+            }
+            runTx(() => {
+                for (const [k, value] of ops) {
+                    if (value === null || value === undefined)
+                        qDelete.run(k);
+                    else
+                        qUpsert.run(k, encode(value));
+                }
+            });
+        },
+        clear: async () => {
+            db.prepare("DELETE FROM auth_state WHERE k <> 'creds'").run();
+        }
+    };
+    return {
+        state: { creds, keys },
+        saveCreds: async () => {
+            qUpsert.run('creds', encode(creds));
+        },
+        db,
+        close: () => db.close()
+    };
+};