kersiosocket 0.0.0-stage → 0.5.0-dev

package/test/connection.test.js

@@ -0,0 +1,153 @@
+'use strict'
+const test = require('node:test')
+const assert = require('node:assert/strict')
+const { EventEmitter } = require('node:events')
+const { makeSocket, encodeClientPayload } = require('../src')
+const { FrameDecoder, encodeFrame } = require('../src/socket/frame')
+const { WA_HEADER } = require('../src/socket/noise')
+const { ServerHandshake } = require('./helpers')
+
+/** Transport palsu di memori + server Noise di belakangnya. */
+function fakeServer(onEvent) {
+  const factory = () => {
+    const t = new EventEmitter()
+    const dec = new FrameDecoder()
+    const hs = new ServerHandshake()
+    let first = true, done = false
+    t.send = (buf) => {
+      if (first) {
+        assert.deepEqual(buf.subarray(0, 4), WA_HEADER, 'frame pertama harus diawali WA_HEADER')
+        buf = buf.subarray(4)
+        first = false
+      }
+      for (const f of dec.push(buf)) {
+        if (!hs.noise) {
+          const sh = hs.processClientHello(f)
+          setImmediate(() => t.emit('message', encodeFrame(sh)))
+        } else if (!done) {
+          done = true
+          onEvent('server-ready', { hs, payload: hs.processClientFinish(f).payload, t })
+        } else onEvent('client-frame', { data: hs.noise.decrypt(f) })
+      }
+    }
+    t.close = () => setImmediate(() => t.emit('close', 1000, ''))
+    setImmediate(() => t.emit('open'))
+    return t
+  }
+  return factory
+}
+
+test('koneksi penuh: handshake, terima & kirim frame, stats, end()', async () => {
+  let srv
+  const gotFromClient = new Promise((resolve) => {
+    srv = fakeServer((type, d) => {
+      if (type === 'server-ready') {
+        assert.deepEqual(d.payload, Buffer.from('cp'))
+        d.t.emit('message', encodeFrame(d.hs.noise.encrypt(Buffer.from('halo dari server'))))
+      }
+      if (type === 'client-frame') resolve(d.data)
+    })
+  })
+
+  const sock = makeSocket({
+    transportFactory: srv, clientPayload: Buffer.from('cp'), reconnect: { enabled: false }
+  })
+  const states = []
+  sock.ev.on('connection.update', (u) => states.push(u.connection))
+
+  const frame = await new Promise((resolve) => sock.ev.on('frame', resolve))
+  assert.deepEqual(frame, Buffer.from('halo dari server'))
+  assert.equal(sock.state, 'noise-ready')
+
+  sock.sendFrame(Buffer.from('pong'))
+  assert.deepEqual(await gotFromClient, Buffer.from('pong'))
+
+  const s = sock.stats()
+  assert.equal(s.framesIn, 2)
+  assert.ok(s.rssMB > 0)
+
+  sock.end()
+  await new Promise((r) => setTimeout(r, 20))
+  assert.deepEqual(states, ['connecting', 'handshaking', 'noise-ready', 'close'])
+})
+
+test('sendFrame sebelum handshake selesai melempar error', () => {
+  const sock = makeSocket({ autoConnect: false })
+  assert.throws(() => sock.sendFrame(Buffer.from('x')), /belum siap/)
+})
+
+test('listener frame yang melempar error TIDAK memutus koneksi; latensi tercatat', async () => {
+  const srv = fakeServer((type, d) => {
+    if (type === 'server-ready') {
+      d.t.emit('message', encodeFrame(d.hs.noise.encrypt(Buffer.from('satu'))))
+      setTimeout(() => d.t.emit('message', encodeFrame(d.hs.noise.encrypt(Buffer.from('dua')))), 10)
+    }
+  })
+  const sock = makeSocket({ transportFactory: srv, reconnect: { enabled: false } })
+  const handlerErrors = []
+  const frames = []
+  const observerFrames = []
+  sock.ev.on('frame', (f) => observerFrames.push(f.toString()))
+  sock.ev.on('handler.error', (e) => handlerErrors.push(e.message))
+  sock.ev.on('frame', (f) => { frames.push(f.toString()); if (f.toString() === 'satu') throw new Error('bug listener') })
+  await new Promise((r) => setTimeout(r, 60))
+  assert.deepEqual(frames, ['satu', 'dua'])
+  assert.deepEqual(handlerErrors, ['bug listener'])
+  assert.deepEqual(observerFrames, ['satu', 'dua'])
+  assert.equal(sock.state, 'noise-ready')
+  const s = sock.stats()
+  assert.ok(s.handshakeMs >= 0)
+  assert.equal(s.frameLatencyMs.count, 2)
+  assert.ok(s.frameLatencyMs.p95 >= s.frameLatencyMs.p50)
+  sock.end()
+})
+
+test('frame rusak (gagal dekripsi) tetap menutup koneksi sebagai error protokol', async () => {
+  const srv = fakeServer((type, d) => {
+    if (type === 'server-ready') d.t.emit('message', encodeFrame(Buffer.alloc(40, 1)))
+  })
+  const sock = makeSocket({ transportFactory: srv, reconnect: { enabled: false } })
+  const errs = []
+  sock.ev.on('connection.error', (e) => errs.push(e))
+  await new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error('timeout waiting for protocol close')), 1500)
+    sock.ev.on('connection.update', (update) => { if (update.connection === 'close') { clearTimeout(timer); resolve() } })
+  })
+  assert.equal(errs.length, 1)
+  assert.equal(sock.state, 'close')
+})
+
+test('backoff TIDAK direset bila server menutup tepat setelah handshake', async () => {
+  const delays = []
+  const log = { debug() {}, info(m) { const x = /dalam (\d+)ms/.exec(m); if (x) delays.push(+x[1]) }, warn() {}, error() {} }
+  const srv = fakeServer((type, d) => { if (type === 'server-ready') setImmediate(() => d.t.emit('close', 1006, '')) })
+  const sock = makeSocket({
+    transportFactory: srv, logger: log,
+    reconnect: { minDelay: 10, maxDelay: 1000, factor: 2, stableMs: 30000 }
+  })
+  await new Promise((r) => setTimeout(r, 400))
+  sock.end()
+  assert.ok(delays.length >= 3, `harus ada beberapa reconnect, dapat ${delays.length}`)
+  assert.ok(delays[2] > delays[0] * 2, `delay harus naik (exponential): ${delays.join(',')}`)
+})
+
+test('ClientPayload terstruktur di-encode sebelum dikirim dalam ClientFinish', async () => {
+  const options = {
+    mode: 'login', username: '6281234567890', passive: false, pushName: 'Kersio test',
+    userAgent: { platform: 'WEB', appVersion: [2, 3000, 1040000000], localeLanguage: 'id', localeCountry: 'ID' },
+    webInfo: { version: 'test-version-only', webSubPlatform: 'WEB_BROWSER' },
+    connectType: 'WIFI_UNKNOWN', connectReason: 'USER_ACTIVATED'
+  }
+  const expected = encodeClientPayload(options)
+  const received = new Promise((resolve) => {
+    const sock = makeSocket({
+      transportFactory: fakeServer((type, d) => {
+        if (type === 'server-ready') resolve(d.payload)
+      }),
+      clientPayload: options,
+      reconnect: { enabled: false }
+    })
+    sock.ev.on('connection.error', (e) => { throw e })
+  })
+  assert.deepEqual(await received, expected)
+})

package/test/device-props.test.js

@@ -0,0 +1,67 @@
+'use strict'
+const test = require('node:test')
+const assert = require('node:assert/strict')
+const crypto = require('node:crypto')
+const { parseFields } = require('../src/proto/wire')
+const { encodeClientPayload } = require('../src/proto/client-payload')
+const { encodeDeviceProps, buildAppVersionHash, encodeBigEndianUnsigned, createDevicePairingData } = require('../src/proto/device-props')
+
+test('DeviceProps uses the pinned protobuf field layout (independent golden bytes)', () => {
+  const bytes = encodeDeviceProps({
+    os: 'Windows', version: [10, 15, 7], platformType: 'CHROME', requireFullSync: true,
+    historySyncConfig: {
+      storageQuotaMb: 10240,
+      inlineInitialPayloadInE2EeMsg: true,
+      supportCallLogHistory: false,
+      supportCagReactionsAndPolls: true
+    }
+  })
+  assert.equal(bytes.toString('hex'), '0a0757696e646f77731206080a100f1807180120012a09188050200130004001')
+  const fields = parseFields(bytes)
+  assert.deepEqual(fields.map(({ fieldNumber, wireType }) => [fieldNumber, wireType]), [[1,2],[2,2],[3,0],[4,0],[5,2]])
+})
+
+test('registration helpers encode big-endian IDs and the observed app-version MD5', () => {
+  assert.equal(encodeBigEndianUnsigned(0x01020304, 4).toString('hex'), '01020304')
+  assert.equal(encodeBigEndianUnsigned(0x010203, 3).toString('hex'), '010203')
+  assert.throws(() => encodeBigEndianUnsigned(0x1000000, 3), /tidak muat/)
+  const version = [2, 3000, 1043857760]
+  const hash = buildAppVersionHash(version)
+  assert.equal(hash.toString('hex'), 'f6f65c0607a1cdffd8752b051fc95edf')
+  assert.deepEqual(hash, crypto.createHash('md5').update('2.3000.1043857760').digest())
+})
+
+test('createDevicePairingData prepares fields only from caller-supplied key material', () => {
+  const deviceProps = encodeDeviceProps({ os: 'Windows', version: [10, 15, 7], platformType: 'CHROME' })
+  const data = createDevicePairingData({
+    registrationId: 0x01020304,
+    identityPublicKey: Buffer.alloc(32, 1),
+    signedPreKey: { keyId: 0x010203, publicKey: Buffer.alloc(32, 2), signature: Buffer.alloc(64, 3) },
+    appVersion: [2, 3000, 1043857760], deviceProps
+  })
+  assert.equal(data.eRegid.toString('hex'), '01020304')
+  assert.equal(data.eKeytype.toString('hex'), '05')
+  assert.equal(data.eIdent.length, 32)
+  assert.equal(data.eSkeyId.toString('hex'), '010203')
+  assert.equal(data.eSkeyVal.length, 32)
+  assert.equal(data.eSkeySig.length, 64)
+  assert.equal(data.buildHash.toString('hex'), 'f6f65c0607a1cdffd8752b051fc95edf')
+  assert.deepEqual(data.deviceProps, deviceProps)
+  assert.throws(() => createDevicePairingData({ registrationId: 1, identityPublicKey: Buffer.alloc(31), signedPreKey: { keyId: 1, publicKey: Buffer.alloc(32), signature: Buffer.alloc(64) }, appVersion: [1, 2, 3], deviceProps }), /identityPublicKey harus 32 byte/)
+})
+
+test('ClientPayload encodes newer optional fields from pinned schema by their wire numbers', () => {
+  const payload = encodeClientPayload({
+    mode: 'login', username: '6281234567890', passive: true, pull: true, lidDbMigrated: false,
+    userAgent: { platform: 'WEB', appVersion: [2, 3000, 1043857760] },
+    webInfo: { version: 'schema-fixture', webSubPlatform: 'WEB_BROWSER' },
+    shortConnect: true, product: 'WHATSAPP_LID', trafficAnonymization: 'STANDARD', accountType: 'DEFAULT'
+  })
+  const fieldNos = parseFields(payload).map((field) => field.fieldNumber)
+  assert.ok(fieldNos.includes(10))
+  assert.ok(fieldNos.includes(20))
+  assert.ok(fieldNos.includes(33))
+  assert.ok(fieldNos.includes(40))
+  assert.ok(fieldNos.includes(41))
+  assert.ok(fieldNos.includes(42))
+})

package/test/encrypted-store.test.js

@@ -0,0 +1,54 @@
+'use strict'
+const test = require('node:test')
+const assert = require('node:assert/strict')
+const crypto = require('node:crypto')
+const { MemoryStore } = require('../src/session/stores')
+const { EncryptedStore } = require('../src/session/encrypted-store')
+
+test('EncryptedStore encrypts session values and round-trips Buffer fields', async () => {
+  const raw = new MemoryStore()
+  const key = crypto.randomBytes(32)
+  const store = new EncryptedStore(raw, key)
+  const input = { noiseKey: { public: Buffer.alloc(32, 7), private: Buffer.alloc(32, 8) }, registrationId: 12345, name: 'fixture' }
+  await store.set('alpha:creds', input)
+  const envelope = await raw.get('alpha:creds')
+  assert.equal(envelope.format, 'kersiosocket:aes-256-gcm:v1')
+  assert.equal(JSON.stringify(envelope).includes('fixture'), false)
+  const output = await store.get('alpha:creds')
+  assert.deepEqual(output, input)
+  assert.deepEqual(await store.keys('alpha:'), ['alpha:creds'])
+})
+
+test('EncryptedStore rejects wrong keys, tampering, and plaintext without fallback', async () => {
+  const raw = new MemoryStore()
+  const store = new EncryptedStore(raw, Buffer.alloc(32, 1))
+  await store.set('s:creds', { token: 'secret-value' })
+  const wrong = new EncryptedStore(raw, Buffer.alloc(32, 2))
+  await assert.rejects(wrong.get('s:creds'), /autentikasi\/dekripsi gagal/)
+
+  const envelope = await raw.get('s:creds')
+  envelope.data = Buffer.from('changed').toString('base64')
+  await raw.set('s:creds', envelope)
+  await assert.rejects(store.get('s:creds'), /autentikasi\/dekripsi gagal/)
+  await raw.set('legacy:creds', { token: 'plaintext' })
+  await assert.rejects(store.get('legacy:creds'), /tidak ada fallback plaintext/)
+})
+
+test('EncryptedStore binds ciphertext to the storage key', async () => {
+  const raw = new MemoryStore()
+  const store = new EncryptedStore(raw, Buffer.alloc(32, 3))
+  await store.set('first:creds', { a: 1 })
+  const encrypted = await raw.get('first:creds')
+  await raw.set('second:creds', encrypted)
+  await assert.rejects(store.get('second:creds'), /autentikasi\/dekripsi gagal/)
+})
+
+
+test('EncryptedStore rejects use after close and validates storage keys', async () => {
+  const store = new EncryptedStore(new MemoryStore(), Buffer.alloc(32, 9))
+  await assert.rejects(store.set('', { secret: true }), /key harus string/)
+  await assert.rejects(store.get('bad\0key'), /key harus string/)
+  await store.close()
+  await assert.rejects(store.get('s:creds'), /sudah ditutup/)
+  await assert.rejects(store.set('s:creds', {}), /sudah ditutup/)
+})

package/test/frame.test.js

@@ -0,0 +1,37 @@
+'use strict'
+const test = require('node:test')
+const assert = require('node:assert/strict')
+const { FrameDecoder, encodeFrame } = require('../src/socket/frame')
+const { NoiseState, MAX_COUNTER, WA_HEADER } = require('../src/socket/noise')
+
+test('FrameDecoder: frame terbelah di tiap byte dan beberapa frame menyatu', () => {
+  const a = Buffer.from('satu'), b = Buffer.alloc(70000, 7), c = Buffer.alloc(0)
+  const wire = Buffer.concat([encodeFrame(a), encodeFrame(b), encodeFrame(c), encodeFrame(Buffer.from('empat'))])
+  const dec = new FrameDecoder()
+  const got = []
+  for (let i = 0; i < wire.length; i += 1000) got.push(...dec.push(wire.subarray(i, i + 1000)))
+  assert.equal(got.length, 4)
+  assert.deepEqual(got[0], a); assert.deepEqual(got[1], b); assert.equal(got[2].length, 0)
+  assert.deepEqual(got[3], Buffer.from('empat'))
+
+  const dec2 = new FrameDecoder(), got2 = []
+  for (const byte of encodeFrame(Buffer.from('halo'))) got2.push(...dec2.push(Buffer.from([byte])))
+  assert.deepEqual(got2, [Buffer.from('halo')])
+})
+
+test('FrameDecoder: sisa parsial disalin (tidak beralias ke buffer asal)', () => {
+  const dec = new FrameDecoder()
+  const big = Buffer.concat([encodeFrame(Buffer.from('x')), Buffer.from([0, 0])])
+  dec.push(big)
+  big[big.length - 1] = 0xff // ubah buffer asal; sisa di decoder harus tidak ikut berubah
+  assert.deepEqual(dec.push(Buffer.from([1, 0xaa])), [Buffer.from([0xaa])])
+})
+
+test('Noise: counter yang habis ditolak (cegah nonce berulang)', () => {
+  const n = new NoiseState(WA_HEADER)
+  n.finish(true)
+  n.writeCounter = MAX_COUNTER
+  assert.throws(() => n.encrypt(Buffer.from('x')), /counter tulis habis/)
+  n.readCounter = MAX_COUNTER
+  assert.throws(() => n.decrypt(Buffer.alloc(32)), /counter baca habis/)
+})

package/test/helpers.js

@@ -0,0 +1,43 @@
+'use strict'
+/** Sisi SERVER Noise XX untuk keperluan test (loopback). Bukan bagian library publik. */
+const { NoiseState } = require('../src/socket/noise')
+const { generateKeyPair, sharedKey } = require('../src/utils/crypto')
+const {
+  encodeServerHello, decodeClientHello, decodeClientFinish
+} = require('../src/proto/handshake')
+const { WA_HEADER } = require('../src/socket/noise')
+
+class ServerHandshake {
+  constructor({ staticKey = generateKeyPair(), certificate = Buffer.from('sertifikat-palsu'), header = WA_HEADER } = {}) {
+    this.staticKey = staticKey
+    this.certificate = certificate
+    this.header = header
+    this.noise = null
+    this.eph = null
+  }
+
+  processClientHello(data) {
+    const { ephemeral: clientEph } = decodeClientHello(data)
+    const n = (this.noise = new NoiseState(this.header))
+    n.authenticate(clientEph)
+    this.eph = generateKeyPair()
+    n.authenticate(this.eph.public)
+    n.mixIntoKey(sharedKey(this.eph.private, clientEph))
+    const encStatic = n.encrypt(this.staticKey.public)
+    n.mixIntoKey(sharedKey(this.staticKey.private, clientEph))
+    const encCert = n.encrypt(this.certificate)
+    return encodeServerHello({ ephemeral: this.eph.public, static: encStatic, payload: encCert })
+  }
+
+  processClientFinish(data) {
+    const n = this.noise
+    const fin = decodeClientFinish(data)
+    const clientStatic = n.decrypt(fin.static)
+    n.mixIntoKey(sharedKey(this.eph.private, clientStatic))
+    const payload = n.decrypt(fin.payload)
+    n.finish(false)
+    return { clientStatic, payload }
+  }
+}
+
+module.exports = { ServerHandshake }

package/test/node-protocol.test.js

@@ -0,0 +1,90 @@
+'use strict'
+const test = require('node:test')
+const assert = require('node:assert/strict')
+const { EventEmitter } = require('node:events')
+const { NodeProtocol, QueryTimeoutError, RemoteIQError } = require('../src/protocol/node-protocol')
+const { encodeBinaryNode, decodeBinaryNode } = require('../src/wabinary/codec')
+
+const tokens = { single: [], double: [[], [], [], []] }
+function connection() {
+  const conn = new EventEmitter()
+  conn.sent = []
+  conn.sendFrame = (frame) => conn.sent.push(Buffer.from(frame))
+  conn._safeEmit = (event, ...args) => conn.emit(event, ...args)
+  conn.failProtocol = (error) => { conn.failure = error; conn.emit('connection.update', { connection: 'close' }) }
+  return conn
+}
+
+
+test('NodeProtocol menolak token table kosong kecuali mode tes diaktifkan', () => {
+  const conn = connection()
+  assert.throws(() => new NodeProtocol(conn, { tokens }), /token dictionary non-kosong/)
+  const protocol = new NodeProtocol(conn, { tokens, allowEmptyTokenTable: true })
+  protocol.close()
+})
+
+test('NodeProtocol encodes outbound node and resolves matching IQ response', async () => {
+  const conn = connection()
+  const protocol = new NodeProtocol(conn, { tokens, allowEmptyTokenTable: true })
+  const promise = protocol.query({ tag: 'iq', attrs: { type: 'get', to: 's.whatsapp.net' }, content: [{ tag: 'ping', attrs: {} }] })
+  assert.equal(conn.sent.length, 1)
+  const sent = decodeBinaryNode(conn.sent[0], { tokens, requirePrefix: true })
+  assert.equal(sent.tag, 'iq')
+  assert.ok(sent.attrs.id)
+  assert.equal(sent.attrs.type, 'get')
+  conn.emit('frame', encodeBinaryNode({ tag: 'iq', attrs: { id: sent.attrs.id, type: 'result' }, content: [{ tag: 'pong', attrs: {} }] }, { tokens }))
+  const result = await promise
+  assert.equal(result.attrs.type, 'result')
+  assert.equal(result.content[0].tag, 'pong')
+  assert.equal(protocol.stats().pendingQueries, 0)
+  protocol.close()
+})
+
+test('NodeProtocol rejects IQ error, timeout and abort without leaking pending entries', async () => {
+  const conn = connection()
+  const protocol = new NodeProtocol(conn, { tokens, timeoutMs: 30, allowEmptyTokenTable: true })
+  const remote = protocol.query({ tag: 'iq', attrs: { id: 'remote-1', type: 'get' } })
+  conn.emit('frame', encodeBinaryNode({ tag: 'iq', attrs: { id: 'remote-1', type: 'error', code: '400' } }, { tokens }))
+  await assert.rejects(remote, RemoteIQError)
+
+  const timed = protocol.query({ tag: 'iq', attrs: { id: 'timeout-1', type: 'get' } }, { timeoutMs: 10 })
+  await assert.rejects(timed, QueryTimeoutError)
+  assert.equal(protocol.stats().pendingQueries, 0)
+
+  const controller = new AbortController()
+  const aborted = protocol.query({ tag: 'iq', attrs: { id: 'abort-1', type: 'get' } }, { signal: controller.signal, timeoutMs: 1000 })
+  controller.abort(new Error('test cancelled'))
+  await assert.rejects(aborted, /test cancelled/)
+  assert.equal(protocol.stats().pendingQueries, 0)
+  protocol.close()
+})
+
+
+test('NodeProtocol ignores non-response IQ types and auto-generates ID for null', async () => {
+  const conn = connection()
+  const protocol = new NodeProtocol(conn, { tokens, allowEmptyTokenTable: true })
+  const pending = protocol.query({ tag: 'iq', attrs: { id: null, type: 'get' } }, { timeoutMs: 500 })
+  const sent = decodeBinaryNode(conn.sent[0], { tokens, requirePrefix: true })
+  assert.ok(sent.attrs.id)
+  conn.emit('frame', encodeBinaryNode({ tag: 'iq', attrs: { id: sent.attrs.id, type: 'set' } }, { tokens }))
+  assert.equal(protocol.stats().pendingQueries, 1)
+  conn.emit('frame', encodeBinaryNode({ tag: 'iq', attrs: { id: sent.attrs.id, type: 'result' } }, { tokens }))
+  const result = await pending
+  assert.equal(result.attrs.type, 'result')
+  protocol.close()
+})
+
+test('NodeProtocol fails pending IQs closed and can fail closed on malformed WABinary', async () => {
+  const conn = connection()
+  const protocol = new NodeProtocol(conn, { tokens, allowEmptyTokenTable: true })
+  const pending = protocol.query({ tag: 'iq', attrs: { id: 'pending-1', type: 'get' } })
+  conn.emit('connection.update', { connection: 'close' })
+  await assert.rejects(pending, /koneksi ditutup/)
+
+  let protocolError
+  conn.on('protocol.error', (error) => { protocolError = error })
+  conn.emit('frame', Buffer.from([0x00, 0xF8]))
+  assert.ok(protocolError)
+  assert.equal(conn.failure, protocolError)
+  protocol.close()
+})

package/test/noise.test.js

@@ -0,0 +1,66 @@
+'use strict'
+const test = require('node:test')
+const assert = require('node:assert/strict')
+const { ClientHandshake } = require('../src/socket/noise')
+const { generateKeyPair, sharedKey } = require('../src/utils/crypto')
+const { FrameDecoder, encodeFrame } = require('../src/socket/frame')
+const { ServerHandshake } = require('./helpers')
+
+test('X25519: DH simetris', () => {
+  const a = generateKeyPair(), b = generateKeyPair()
+  assert.equal(a.public.length, 32)
+  assert.equal(a.private.length, 32)
+  assert.deepEqual(sharedKey(a.private, b.public), sharedKey(b.private, a.public))
+})
+
+test('frame: encode/decode, terbelah dan menyatu', () => {
+  const p1 = Buffer.from('halo'), p2 = Buffer.alloc(70000, 7)
+  const wire = Buffer.concat([encodeFrame(p1), encodeFrame(p2)])
+  const dec = new FrameDecoder()
+  const got = []
+  for (let i = 0; i < wire.length; i += 1000) got.push(...dec.push(wire.subarray(i, i + 1000)))
+  assert.equal(got.length, 2)
+  assert.deepEqual(got[0], p1)
+  assert.deepEqual(got[1], p2)
+  assert.deepEqual(new FrameDecoder().push(wire).length, 2)
+})
+
+test('Noise XX: handshake klien <-> server dan kanal terenkripsi dua arah', () => {
+  const clientStatic = generateKeyPair()
+  const server = new ServerHandshake()
+  const client = new ClientHandshake({ staticKey: clientStatic })
+
+  const serverHello = server.processClientHello(client.hello())
+  const finish = client.processServerHello(serverHello, Buffer.from('payload-login'))
+  const res = server.processClientFinish(finish)
+
+  assert.deepEqual(res.clientStatic, clientStatic.public)
+  assert.deepEqual(res.payload, Buffer.from('payload-login'))
+  assert.deepEqual(client.serverStatic, server.staticKey.public)
+  assert.deepEqual(client.serverCertificate, Buffer.from('sertifikat-palsu'))
+
+  // kanal transport
+  for (let i = 0; i < 5; i++) {
+    const m = Buffer.from('klien->server ' + i)
+    assert.deepEqual(server.noise.decrypt(client.noise.encrypt(m)), m)
+    const r = Buffer.from('server->klien ' + i)
+    assert.deepEqual(client.noise.decrypt(server.noise.encrypt(r)), r)
+  }
+})
+
+test('Noise: ciphertext yang diubah ditolak', () => {
+  const server = new ServerHandshake()
+  const client = new ClientHandshake({ staticKey: generateKeyPair() })
+  const finish = client.processServerHello(server.processClientHello(client.hello()), Buffer.alloc(0))
+  server.processClientFinish(finish)
+  const ct = client.noise.encrypt(Buffer.from('rahasia'))
+  ct[0] ^= 1
+  assert.throws(() => server.noise.decrypt(ct))
+})
+
+test('Noise: ServerHello dengan hash berbeda (header beda) gagal', () => {
+  const server = new ServerHandshake({ header: Buffer.from([0x57, 0x41, 6, 9]) })
+  const client = new ClientHandshake({ staticKey: generateKeyPair() })
+  const sh = server.processClientHello(client.hello())
+  assert.throws(() => client.processServerHello(sh, Buffer.alloc(0)))
+})

package/test/pairing-adapter.test.js

@@ -0,0 +1,71 @@
+'use strict'
+const test = require('node:test')
+const assert = require('node:assert/strict')
+const { EventEmitter } = require('node:events')
+const { PairingLifecycle } = require('../src/pairing/lifecycle')
+const { attachQrPairingAdapter } = require('../src/pairing/adapter')
+
+function mockSocket(credentials) {
+  const ev = new EventEmitter()
+  ev._safeEmit = (event, ...args) => {
+    for (const listener of ev.rawListeners(event)) {
+      try { Reflect.apply(listener, ev, args) } catch { /* test helper isolates events */ }
+    }
+  }
+  return {
+    ev,
+    sessionId: 'fixture-session',
+    pairing: new PairingLifecycle({ sessionId: 'fixture-session' }),
+    protocol: {},
+    sentNodes: [],
+    sendNode(node) { this.sentNodes.push(node) },
+    credentials
+  }
+}
+
+test('QR adapter acknowledges pair-device and emits references from decoded node', async () => {
+  const creds = {
+    noiseKey: { public: Buffer.alloc(32, 1) },
+    signedIdentityKey: { public: Buffer.alloc(32, 2) },
+    advSecretKey: Buffer.alloc(32, 3)
+  }
+  const sock = mockSocket(creds)
+  const firstQr = new Promise((resolve) => sock.pairing.once('pairing.qr', resolve))
+  sock.pairing.begin('qr')
+  const detach = attachQrPairingAdapter(sock, { credentials: creds, clientType: '1', firstQrMs: 60000, nextQrMs: 20000 })
+  sock.ev.emit('node', {
+    tag: 'iq', attrs: { type: 'set', from: 'server@c.us', id: 'pair-1' },
+    content: [{ tag: 'pair-device', attrs: {}, content: [
+      { tag: 'ref', attrs: {}, content: Buffer.from('ref-fixture-1') },
+      { tag: 'ref', attrs: {}, content: Buffer.from('ref-fixture-2') }
+    ] }]
+  })
+  const qr = await firstQr
+  assert.match(qr.qr, /^https:\/\/wa\.me\/settings\/linked_devices#ref-fixture-1,/)
+  assert.equal(qr.sessionId, 'fixture-session')
+  assert.deepEqual(sock.sentNodes, [{ tag: 'iq', attrs: { to: 's.whatsapp.net', type: 'result', id: 'pair-1' } }])
+  detach()
+  sock.pairing.close()
+})
+
+test('QR adapter does not invent keys and never marks pair-success verified', async () => {
+  const sock = mockSocket(undefined)
+  const errors = []
+  let candidate
+  sock.pairing.on('pairing.error', (event) => errors.push(event.error.message))
+  sock.ev.on('pairing.success.candidate', (event) => { candidate = event })
+  sock.pairing.begin('qr')
+  const detach = attachQrPairingAdapter(sock, { credentials: undefined, clientType: '1' })
+  sock.ev.emit('node', {
+    tag: 'iq', attrs: { type: 'set', from: 's.whatsapp.net', id: 'pair-2' },
+    content: [{ tag: 'pair-device', attrs: {}, content: [{ tag: 'ref', attrs: {}, content: Buffer.from('ref') }] }]
+  })
+  await new Promise((resolve) => setImmediate(resolve))
+  assert.ok(errors.length >= 1)
+  assert.match(errors[0], /kunci|key|credential|bytes/i)
+  sock.ev.emit('node', { tag: 'iq', attrs: { type: 'set', from: 's.whatsapp.net', id: 'pair-3' }, content: [{ tag: 'pair-success', attrs: {}, content: [] }] })
+  assert.ok(candidate)
+  assert.notEqual(sock.pairing.state, 'paired')
+  detach()
+  sock.pairing.close()
+})

package/test/pairing.test.js

@@ -0,0 +1,32 @@
+'use strict'
+const test = require('node:test')
+const assert = require('node:assert/strict')
+const { PairingLifecycle } = require('../src')
+
+test('PairingLifecycle QR: update -> QR -> paired, terisolasi per session', () => {
+  const a = new PairingLifecycle({ sessionId: 'nomor-a' })
+  const b = new PairingLifecycle({ sessionId: 'nomor-b' })
+  const updates = [], qrs = [], success = []
+  a.on('pairing.update', (e) => updates.push(e.state))
+  a.on('pairing.qr', (e) => qrs.push(e.qr))
+  a.on('pairing.success', (e) => success.push(e.sessionId))
+  a.begin('qr').acceptQr('test-only-qr-payload').complete({ registered: true })
+  assert.deepEqual(updates, ['waiting-qr', 'paired'])
+  assert.deepEqual(qrs, ['test-only-qr-payload'])
+  assert.deepEqual(success, ['nomor-a'])
+  assert.equal(b.state, 'idle')
+})
+
+test('PairingLifecycle code: validasi transisi dan invalidasi state setelah close', () => {
+  const flow = new PairingLifecycle({ sessionId: 'nomor-c' })
+  let code = null
+  flow.on('pairing.code', (e) => { code = e.code })
+  flow.begin('code').acceptCode('AB12-CD34')
+  assert.equal(code, 'AB12-CD34')
+  assert.throws(() => flow.acceptQr('qr'), /QR tidak diharapkan/)
+  flow.fail(new Error('contoh gagal'))
+  assert.equal(flow.state, 'failed')
+  flow.reset().close()
+  assert.equal(flow.state, 'closed')
+  assert.throws(() => flow.begin('qr'), /ditutup/)
+})