kersiosocket 0.0.0-stage → 0.6.0-dev

package/src/pairing/qr.js

@@ -0,0 +1,38 @@
+'use strict'
+
+const LINKED_DEVICES_PREFIX = 'https://wa.me/settings/linked_devices#'
+
+function bytes(value, name, length) {
+  if (!(Buffer.isBuffer(value) || value instanceof Uint8Array)) throw new TypeError(`${name} harus bytes`)
+  const out = Buffer.from(value.buffer, value.byteOffset, value.byteLength)
+  if (length !== undefined && out.length !== length) throw new RangeError(`${name} harus ${length} byte`)
+  return out
+}
+
+/**
+ * Build the observed linked-device QR payload. This only formats the QR payload;
+ * it does not implement registration, signature verification, or the live socket handler.
+ * The field layout is based on public whatsmeow/Baileys observations and must be
+ * checked against the WhatsApp Web version being targeted.
+ */
+function buildPairingQrPayload({ ref, noisePublicKey, identityPublicKey, advSecretKey, clientType }) {
+  const refBytes = typeof ref === 'string' ? Buffer.from(ref, 'utf8') : bytes(ref, 'ref')
+  if (refBytes.length === 0) throw new TypeError('ref pairing kosong')
+  const noise = bytes(noisePublicKey, 'noisePublicKey', 32)
+  const identity = bytes(identityPublicKey, 'identityPublicKey', 32)
+  const adv = bytes(advSecretKey, 'advSecretKey', 32)
+  if (typeof clientType !== 'string' || !/^[0-9a-z]$/.test(clientType)) throw new TypeError('clientType harus kode satu karakter yang telah diverifikasi')
+  return `${LINKED_DEVICES_PREFIX}${refBytes.toString('utf8')},${noise.toString('base64')},${identity.toString('base64')},${adv.toString('base64')},${clientType}`
+}
+
+/** Extract only ref payloads from a decoded iq/pair-device node; no side effects. */
+function extractPairingRefs(node) {
+  if (!node || node.tag !== 'iq' || !Array.isArray(node.content)) return []
+  const pairDevice = node.content.find((child) => child && child.tag === 'pair-device')
+  if (!pairDevice || !Array.isArray(pairDevice.content)) return []
+  return pairDevice.content
+    .filter((child) => child && child.tag === 'ref' && (Buffer.isBuffer(child.content) || child.content instanceof Uint8Array))
+    .map((child) => Buffer.from(child.content))
+}
+
+module.exports = { LINKED_DEVICES_PREFIX, buildPairingQrPayload, extractPairingRefs }

package/src/pairing/verified-commit.js

@@ -0,0 +1,46 @@
+'use strict'
+
+/**
+ * Fail-closed commit guard for a protocol-specific pair-success verifier.
+ * This function is intentionally not itself the WhatsApp ADV/signature verifier: callers
+ * must supply an independently validated implementation and test vectors.
+ */
+async function commitVerifiedPairSuccess({
+  node,
+  verifyPairSuccess,
+  store,
+  sessionId,
+  sendNode,
+  lifecycle
+} = {}) {
+  if (typeof verifyPairSuccess !== 'function') throw new TypeError('verifyPairSuccess wajib diisi; pairing tidak boleh dipercaya tanpa verifier')
+  if (!store || typeof store.set !== 'function') throw new TypeError('store wajib menyediakan set() untuk menyimpan credentials')
+  if (typeof sendNode !== 'function') throw new TypeError('sendNode wajib diisi untuk mengirim balasan pairing')
+  if (!lifecycle || typeof lifecycle.complete !== 'function') throw new TypeError('lifecycle pairing tidak valid')
+
+  const effectiveSessionId = sessionId || lifecycle.sessionId || 'default'
+  const result = await verifyPairSuccess(node)
+  if (!result || result.verified !== true || !result.checks ||
+      result.checks.deviceIdentity !== true ||
+      result.checks.accountSignature !== true ||
+      result.checks.advHmac !== true) {
+    const error = new Error('pair-success ditolak: pemeriksaan identity/signature/ADV-HMAC tidak lengkap atau gagal')
+    error.code = 'ERR_PAIR_SUCCESS_UNVERIFIED'
+    throw error
+  }
+  if (!result.credentials || typeof result.credentials !== 'object' || Array.isArray(result.credentials)) {
+    throw new TypeError('verifier tidak mengembalikan credentials terverifikasi')
+  }
+  if (!result.replyNode || typeof result.replyNode !== 'object' || typeof result.replyNode.tag !== 'string') {
+    throw new TypeError('verifier tidak mengembalikan node balasan pair-device-sign yang valid')
+  }
+
+  // Persist before replying/finalizing. A crash after persistence is recoverable from
+  // auth state; a failed verification can never be saved or mark lifecycle as paired.
+  await store.set(`auth:${effectiveSessionId}:credentials`, result.credentials)
+  await sendNode(result.replyNode)
+  lifecycle.complete({ verified: true, sessionId: effectiveSessionId, completedAt: Date.now() })
+  return { verified: true, sessionId: effectiveSessionId, credentials: result.credentials }
+}
+
+module.exports = { commitVerifiedPairSuccess }

package/src/proto/client-payload.js

@@ -0,0 +1,185 @@
+'use strict'
+/**
+ * KersioSocket's hand-maintained ClientPayload encoder.
+ * Field numbers are based on publicly documented/reverse-engineered protobuf
+ * schema observations and must be checked against the target WhatsApp Web build.
+ * This module does not perform pairing cryptography or manufacture key signatures.
+ */
+const { fieldVarint, fieldBool, fieldBytes, fieldString, fieldMessage, fieldFixed32, pack } = require('./wire')
+
+const PLATFORM = Object.freeze({
+  ANDROID: 0, IOS: 1, WINDOWS_PHONE: 2, BLACKBERRY: 3, BLACKBERRYX: 4,
+  S40: 5, S60: 6, PYTHON_CLIENT: 7, TIZEN: 8, ENTERPRISE: 9,
+  SMB_ANDROID: 10, KAIOS: 11, SMB_IOS: 12, WINDOWS: 13, WEB: 14,
+  PORTAL: 15, GREEN_ANDROID: 16, GREEN_IPHONE: 17, BLUE_ANDROID: 18,
+  BLUE_IPHONE: 19, FBLITE_ANDROID: 20, MLITE_ANDROID: 21, IGLITE_ANDROID: 22,
+  PAGE: 23, MACOS: 24, OCULUS_MSG: 25, OCULUS_CALL: 26, MILAN: 27, CAPI: 28,
+  WEAROS: 29, ARDEVICE: 30, VRDEVICE: 31, BLUE_WEB: 32, IPAD: 33, TEST: 34,
+  SMART_GLASSES: 35, BLUE_VR: 36, AR_WRIST: 37
+})
+const RELEASE_CHANNEL = Object.freeze({ RELEASE: 0, BETA: 1, ALPHA: 2, DEBUG: 3 })
+const WEB_SUB_PLATFORM = Object.freeze({ WEB_BROWSER: 0, APP_STORE: 1, WIN_STORE: 2, DARWIN: 3, WIN32: 4, WIN_HYBRID: 5 })
+const CONNECT_REASON = Object.freeze({ PUSH: 0, USER_ACTIVATED: 1, SCHEDULED: 2, ERROR_RECONNECT: 3, NETWORK_SWITCH: 4, PING_RECONNECT: 5 })
+const CONNECT_TYPE = Object.freeze({ CELLULAR_UNKNOWN: 0, WIFI_UNKNOWN: 1, CELLULAR_EDGE: 100, CELLULAR_IDEN: 101, CELLULAR_UMTS: 102, CELLULAR_EVDO: 103, CELLULAR_GPRS: 104, CELLULAR_HSDPA: 105, CELLULAR_HSUPA: 106, CELLULAR_HSPA: 107, CELLULAR_CDMA: 108, CELLULAR_1XRTT: 109, CELLULAR_EHRPD: 110, CELLULAR_LTE: 111, CELLULAR_HSPAP: 112 })
+const PRODUCT = Object.freeze({ WHATSAPP: 0, MESSENGER: 1, INTEROP: 2, INTEROP_MSGR: 3, WHATSAPP_LID: 4 })
+const DEVICE_TYPE = Object.freeze({ PHONE: 0, TABLET: 1, DESKTOP: 2, WEARABLE: 3, VR: 4 })
+const IOS_APP_EXTENSION = Object.freeze({ SHARE_EXTENSION: 0, SERVICE_EXTENSION: 1, INTENTS_EXTENSION: 2 })
+const TRAFFIC_ANONYMIZATION = Object.freeze({ OFF: 0, STANDARD: 1 })
+const ACCOUNT_TYPE = Object.freeze({ DEFAULT: 0, GUEST: 1 })
+
+function enumValue(table, value, name) {
+  if (typeof value === 'string') {
+    if (!Object.hasOwn(table, value)) throw new TypeError(`${name} enum tidak dikenal: ${value}`)
+    return table[value]
+  }
+  if (!Number.isInteger(value) || !Object.values(table).includes(value)) throw new TypeError(`${name} harus nama enum atau nilai enum yang dikenal`)
+  return value
+}
+
+function nonEmptyString(value, name) {
+  if (typeof value !== 'string' || value.length === 0) throw new TypeError(`${name} wajib berupa string non-kosong`)
+  return value
+}
+
+function normalizeVersion(version, name) {
+  if (Array.isArray(version)) {
+    if (version.length < 3 || version.length > 5) throw new TypeError(`${name} harus memiliki 3 sampai 5 angka versi`)
+    return version.map((part, i) => {
+      if (!Number.isInteger(part) || part < 0 || part > 0xffffffff) throw new TypeError(`${name}[${i}] harus uint32`)
+      return part
+    })
+  }
+  if (version && typeof version === 'object') {
+    const ordered = ['primary', 'secondary', 'tertiary', 'quaternary', 'quinary']
+    const out = ordered.filter((key) => version[key] !== undefined).map((key) => version[key])
+    if (out.length < 3 || out.some((part) => !Number.isInteger(part) || part < 0 || part > 0xffffffff)) {
+      throw new TypeError(`${name} perlu primary/secondary/tertiary berupa uint32`)
+    }
+    return out
+  }
+  throw new TypeError(`${name} harus array angka atau objek versi`)
+}
+
+function encodeAppVersion(version) {
+  const parts = normalizeVersion(version, 'userAgent.appVersion')
+  return pack(parts.map((part, i) => fieldVarint(i + 1, part)))
+}
+
+function encodeUserAgent(input) {
+  if (!input || typeof input !== 'object') throw new TypeError('userAgent wajib diisi')
+  if (input.platform === undefined) throw new TypeError('userAgent.platform wajib diisi')
+  if (input.appVersion === undefined) throw new TypeError('userAgent.appVersion wajib diisi')
+  const parts = [
+    fieldVarint(1, enumValue(PLATFORM, input.platform, 'platform')),
+    fieldMessage(2, encodeAppVersion(input.appVersion)),
+    fieldString(3, input.mcc), fieldString(4, input.mnc),
+    fieldString(5, input.osVersion), fieldString(6, input.manufacturer),
+    fieldString(7, input.device), fieldString(8, input.osBuildNumber),
+    fieldString(9, input.phoneId),
+    input.releaseChannel === undefined ? null : fieldVarint(10, enumValue(RELEASE_CHANNEL, input.releaseChannel, 'releaseChannel')),
+    fieldString(11, input.localeLanguageIso6391 || input.localeLanguage),
+    fieldString(12, input.localeCountryIso31661Alpha2 || input.localeCountry),
+    fieldString(13, input.deviceBoard), fieldString(14, input.deviceExpId),
+    input.deviceType === undefined ? null : fieldVarint(15, enumValue(DEVICE_TYPE, input.deviceType, 'deviceType')),
+    fieldString(16, input.deviceModelType)
+  ]
+  return pack(parts)
+}
+
+function encodeWebInfo(input) {
+  if (!input || typeof input !== 'object') throw new TypeError('webInfo wajib diisi')
+  const version = nonEmptyString(input.version, 'webInfo.version')
+  const parts = [fieldString(1, input.refToken), fieldString(2, version)]
+  if (input.webSubPlatform !== undefined) {
+    parts.push(fieldVarint(4, enumValue(WEB_SUB_PLATFORM, input.webSubPlatform, 'webSubPlatform')))
+  }
+  if (input.webdPayload !== undefined) {
+    if (!(Buffer.isBuffer(input.webdPayload) || input.webdPayload instanceof Uint8Array)) {
+      throw new TypeError('webInfo.webdPayload harus bytes protobuf yang sudah di-encode')
+    }
+    parts.push(fieldMessage(3, input.webdPayload))
+  }
+  return pack(parts)
+}
+
+function requireBytes(input, key, length, label) {
+  const value = input[key]
+  if (!(Buffer.isBuffer(value) || value instanceof Uint8Array)) throw new TypeError(`devicePairingData.${key} wajib berupa bytes`)
+  const buf = Buffer.from(value.buffer, value.byteOffset, value.byteLength)
+  if (length !== undefined && buf.length !== length) throw new RangeError(`devicePairingData.${key} harus ${length} byte`)
+  if (label === 'regid' && ![2, 3, 4].includes(buf.length)) throw new RangeError('devicePairingData.eRegid harus 2, 3, atau 4 byte')
+  if (label === 'deviceProps' && buf.length === 0) throw new RangeError('devicePairingData.deviceProps tidak boleh kosong')
+  return buf
+}
+
+function encodeDevicePairingData(input) {
+  if (!input || typeof input !== 'object') throw new TypeError('devicePairingData wajib berupa objek')
+  return pack([
+    fieldBytes(1, requireBytes(input, 'eRegid', 4)),
+    fieldBytes(2, requireBytes(input, 'eKeytype', 1)),
+    fieldBytes(3, requireBytes(input, 'eIdent', 32)),
+    fieldBytes(4, requireBytes(input, 'eSkeyId', 3)),
+    fieldBytes(5, requireBytes(input, 'eSkeyVal', 32)),
+    fieldBytes(6, requireBytes(input, 'eSkeySig', 64)),
+    fieldBytes(7, requireBytes(input, 'buildHash', 16)),
+    fieldBytes(8, requireBytes(input, 'deviceProps', undefined, 'deviceProps'))
+  ])
+}
+
+/**
+ * Encode an explicit ClientPayload object to bytes for Noise ClientFinish.
+ * `mode: 'registration'` requires a complete, externally prepared pairing bundle;
+ * `mode: 'login'` requires an existing WhatsApp numeric username.
+ *
+ * Version values are intentionally supplied by the caller, not hard-coded, because
+ * WhatsApp Web changes them. A successful encode does not prove server compatibility.
+ */
+function encodeClientPayload(input) {
+  if (!input || typeof input !== 'object' || Buffer.isBuffer(input)) throw new TypeError('clientPayload harus berupa objek terstruktur')
+  const mode = input.mode || (input.devicePairingData ? 'registration' : 'login')
+  if (mode !== 'registration' && mode !== 'login') throw new TypeError("mode harus 'registration' atau 'login'")
+  if (mode === 'registration' && input.username !== undefined) throw new TypeError('registration tidak boleh memakai username login')
+  if (input.agent !== undefined) throw new TypeError('ClientPayload.agent tidak tersedia di schema yang dipatok; field 17 tidak didefinisikan di referensi ini')
+  if (mode === 'registration' && input.devicePairingData === undefined) throw new TypeError('registration memerlukan devicePairingData lengkap')
+  if (mode === 'login' && input.devicePairingData !== undefined) throw new TypeError('login tidak boleh membawa devicePairingData registrasi')
+  if (mode === 'login') {
+    const username = input.username
+    if (typeof username !== 'string' || !/^\d{5,20}$/.test(username)) throw new TypeError('username login harus string digit nomor akun, tanpa tanda +')
+  }
+
+  const userAgent = encodeUserAgent(input.userAgent)
+  const webInfo = encodeWebInfo(input.webInfo)
+  const payload = [
+    input.username === undefined ? null : fieldVarint(1, BigInt(input.username)),
+    fieldBool(3, input.passive),
+    fieldMessage(5, userAgent), fieldMessage(6, webInfo),
+    fieldString(7, input.pushName),
+    fieldFixed32(9, input.sessionId),
+    fieldBool(10, input.shortConnect),
+    input.connectType === undefined ? null : fieldVarint(12, enumValue(CONNECT_TYPE, input.connectType, 'connectType')),
+    input.connectReason === undefined ? null : fieldVarint(13, enumValue(CONNECT_REASON, input.connectReason, 'connectReason')),
+    fieldVarint(16, input.connectAttemptCount), fieldVarint(18, input.device),
+    input.devicePairingData === undefined ? null : fieldMessage(19, encodeDevicePairingData(input.devicePairingData)),
+    input.product === undefined ? null : fieldVarint(20, enumValue(PRODUCT, input.product, 'product')),
+    fieldBytes(21, input.fbCat), fieldBytes(22, input.fbUserAgent),
+    fieldBool(23, input.oc), fieldVarint(24, input.lc),
+    input.iosAppExtension === undefined ? null : fieldVarint(30, enumValue(IOS_APP_EXTENSION, input.iosAppExtension, 'iosAppExtension')),
+    input.fbAppId === undefined ? null : fieldVarint(31, input.fbAppId), fieldBytes(32, input.fbDeviceId),
+    fieldBool(33, input.pull), fieldBytes(34, input.paddingBytes),
+    fieldVarint(36, input.yearClass), fieldVarint(37, input.memClass),
+    input.trafficAnonymization === undefined ? null : fieldVarint(40, enumValue(TRAFFIC_ANONYMIZATION, input.trafficAnonymization, 'trafficAnonymization')),
+    fieldBool(41, input.lidDbMigrated),
+    input.accountType === undefined ? null : fieldVarint(42, enumValue(ACCOUNT_TYPE, input.accountType, 'accountType')),
+    fieldFixed32(43, input.connectionSequenceInfo), fieldBool(44, input.paaLink),
+    fieldVarint(45, input.preacksCount), fieldVarint(46, input.processingQueueSize)
+  ]
+  const encoded = pack(payload)
+  if (encoded.length === 0) throw new Error('ClientPayload hasil encode kosong')
+  return encoded
+}
+
+module.exports = {
+  encodeClientPayload, encodeUserAgent, encodeWebInfo, encodeDevicePairingData,
+  PLATFORM, RELEASE_CHANNEL, WEB_SUB_PLATFORM, CONNECT_REASON, CONNECT_TYPE, PRODUCT, DEVICE_TYPE,
+  IOS_APP_EXTENSION, TRAFFIC_ANONYMIZATION, ACCOUNT_TYPE
+}

package/src/proto/device-props.js

@@ -0,0 +1,143 @@
+'use strict'
+/**
+ * Explicit encoder for the pinned WAProto DeviceProps schema snapshot.
+ * This builds protobuf bytes only; it does not create/verify Signal keys or signatures.
+ */
+const crypto = require('node:crypto')
+const { fieldVarint, fieldBool, fieldString, fieldMessage, fieldBytes, pack } = require('./wire')
+
+const PLATFORM_TYPE = Object.freeze({
+  UNKNOWN: 0, CHROME: 1, FIREFOX: 2, IE: 3, OPERA: 4, SAFARI: 5, EDGE: 6,
+  DESKTOP: 7, IPAD: 8, ANDROID_TABLET: 9, OHANA: 10, ALOHA: 11, CATALINA: 12,
+  TCL_TV: 13, IOS_PHONE: 14, IOS_CATALYST: 15, ANDROID_PHONE: 16,
+  ANDROID_AMBIGUOUS: 17, WEAR_OS: 18, AR_WRIST: 19, AR_DEVICE: 20, UWP: 21,
+  VR: 22, CLOUD_API: 23, SMARTGLASSES: 24
+})
+const HISTORY_FIELDS = Object.freeze([
+  ['fullSyncDaysLimit', 1, 'uint'], ['fullSyncSizeMbLimit', 2, 'uint'], ['storageQuotaMb', 3, 'uint'],
+  ['inlineInitialPayloadInE2EeMsg', 4, 'bool'], ['recentSyncDaysLimit', 5, 'uint'],
+  ['supportCallLogHistory', 6, 'bool'], ['supportBotUserAgentChatHistory', 7, 'bool'],
+  ['supportCagReactionsAndPolls', 8, 'bool'], ['supportBizHostedMsg', 9, 'bool'],
+  ['supportRecentSyncChunkMessageCountTuning', 10, 'bool'], ['supportHostedGroupMsg', 11, 'bool'],
+  ['supportFbidBotChatHistory', 12, 'bool'], ['supportAddOnHistorySyncMigration', 13, 'bool'],
+  ['supportMessageAssociation', 14, 'bool'], ['supportGroupHistory', 15, 'bool'],
+  ['onDemandReady', 16, 'bool'], ['supportGuestChat', 17, 'bool'],
+  ['completeOnDemandReady', 18, 'bool'], ['thumbnailSyncDaysLimit', 19, 'uint']
+])
+const VERSION_FIELDS = ['primary', 'secondary', 'tertiary', 'quaternary', 'quinary']
+
+function versionParts(version, label = 'version') {
+  let parts
+  if (Array.isArray(version)) parts = version
+  else if (version && typeof version === 'object') parts = VERSION_FIELDS.filter((k) => version[k] !== undefined).map((k) => version[k])
+  else throw new TypeError(`${label} harus array atau objek versi`)
+  if (parts.length < 3 || parts.length > 5 || parts.some((n) => !Number.isInteger(n) || n < 0 || n > 0xffffffff)) {
+    throw new TypeError(`${label} harus berisi 3–5 uint32`)
+  }
+  return parts
+}
+
+function encodeVersion(version, label) {
+  return pack(versionParts(version, label).map((n, i) => fieldVarint(i + 1, n)))
+}
+
+function enumField(table, value, field, label) {
+  if (value === undefined || value === null) return null
+  let n = value
+  if (typeof n === 'string') {
+    if (!Object.hasOwn(table, n)) throw new TypeError(`${label} enum tidak dikenal: ${n}`)
+    n = table[n]
+  }
+  if (!Number.isInteger(n) || !Object.values(table).includes(n)) throw new TypeError(`${label} harus nilai enum yang dikenal`)
+  return fieldVarint(field, n)
+}
+
+function encodeHistorySyncConfig(input) {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) throw new TypeError('historySyncConfig harus objek')
+  const known = new Set(HISTORY_FIELDS.map(([key]) => key))
+  for (const key of Object.keys(input)) if (!known.has(key)) throw new TypeError(`historySyncConfig field tidak dikenal: ${key}`)
+  const fields = []
+  for (const [key, no, type] of HISTORY_FIELDS) {
+    if (input[key] === undefined || input[key] === null) continue
+    if (type === 'bool') fields.push(fieldBool(no, input[key]))
+    else {
+      if (!Number.isInteger(input[key]) || input[key] < 0 || input[key] > 0xffffffff) throw new TypeError(`historySyncConfig.${key} harus uint32`)
+      fields.push(fieldVarint(no, input[key]))
+    }
+  }
+  return pack(fields)
+}
+
+function encodeDeviceProps(input) {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) throw new TypeError('deviceProps harus objek')
+  const allowed = new Set(['os', 'version', 'platformType', 'requireFullSync', 'historySyncConfig'])
+  for (const key of Object.keys(input)) if (!allowed.has(key)) throw new TypeError(`DeviceProps field tidak dikenal: ${key}`)
+  const fields = [
+    input.os === undefined ? null : fieldString(1, input.os),
+    input.version === undefined ? null : fieldMessage(2, encodeVersion(input.version, 'DeviceProps.version')),
+    enumField(PLATFORM_TYPE, input.platformType, 3, 'DeviceProps.platformType'),
+    fieldBool(4, input.requireFullSync),
+    input.historySyncConfig === undefined ? null : fieldMessage(5, encodeHistorySyncConfig(input.historySyncConfig))
+  ]
+  const encoded = pack(fields)
+  if (encoded.length === 0) throw new TypeError('DeviceProps tidak boleh kosong')
+  return encoded
+}
+
+/** Encode a registration ID / signed-prekey ID in unsigned big-endian form. */
+function encodeBigEndianUnsigned(value, width) {
+  if (!Number.isSafeInteger(value) || value < 0) throw new TypeError('nilai big-endian harus integer non-negatif yang aman')
+  if (!Number.isInteger(width) || width < 1 || width > 6) throw new RangeError('width harus 1..6 byte')
+  if (BigInt(value) >= (1n << BigInt(width * 8))) throw new RangeError(`nilai tidak muat dalam ${width} byte`)
+  const out = Buffer.alloc(width)
+  let n = BigInt(value)
+  for (let i = width - 1; i >= 0; i--) { out[i] = Number(n & 0xffn); n >>= 8n }
+  return out
+}
+
+/** Matches the observed registration buildHash: MD5 of dotted client version. */
+function buildAppVersionHash(version) {
+  const parts = versionParts(version, 'appVersion')
+  return crypto.createHash('md5').update(parts.join('.'), 'utf8').digest()
+}
+
+/**
+ * Build the DevicePairingRegistrationData fields from caller-created key material.
+ * No keys/signatures are generated here; signedPreKey.signature must already be valid.
+ */
+function createDevicePairingData({ registrationId, identityPublicKey, signedPreKey, appVersion, deviceProps, eKeytype = Buffer.from([5]) }) {
+  if (!signedPreKey || typeof signedPreKey !== 'object') throw new TypeError('signedPreKey harus berisi keyId, publicKey, signature')
+  if (!Buffer.isBuffer(identityPublicKey) && !(identityPublicKey instanceof Uint8Array)) throw new TypeError('identityPublicKey harus bytes')
+  if (!Buffer.isBuffer(signedPreKey.publicKey) && !(signedPreKey.publicKey instanceof Uint8Array)) throw new TypeError('signedPreKey.publicKey harus bytes')
+  if (!Buffer.isBuffer(signedPreKey.signature) && !(signedPreKey.signature instanceof Uint8Array)) throw new TypeError('signedPreKey.signature harus bytes')
+  if (!Buffer.isBuffer(eKeytype) && !(eKeytype instanceof Uint8Array)) throw new TypeError('eKeytype harus bytes')
+  const identity = Buffer.from(identityPublicKey)
+  const preKey = Buffer.from(signedPreKey.publicKey)
+  const signature = Buffer.from(signedPreKey.signature)
+  const keyType = Buffer.from(eKeytype)
+  if (identity.length !== 32) throw new RangeError('identityPublicKey harus 32 byte')
+  if (preKey.length !== 32) throw new RangeError('signedPreKey.publicKey harus 32 byte')
+  if (signature.length !== 64) throw new RangeError('signedPreKey.signature harus 64 byte')
+  if (keyType.length !== 1) throw new RangeError('eKeytype harus 1 byte pada schema ini')
+  const props = Buffer.isBuffer(deviceProps) || deviceProps instanceof Uint8Array ? Buffer.from(deviceProps) : encodeDeviceProps(deviceProps)
+  if (!props.length) throw new RangeError('deviceProps tidak boleh kosong')
+  return {
+    eRegid: encodeBigEndianUnsigned(registrationId, 4),
+    eKeytype: keyType,
+    eIdent: identity,
+    eSkeyId: encodeBigEndianUnsigned(signedPreKey.keyId, 3),
+    eSkeyVal: preKey,
+    eSkeySig: signature,
+    buildHash: buildAppVersionHash(appVersion),
+    deviceProps: props
+  }
+}
+
+module.exports = {
+  PLATFORM_TYPE,
+  encodeDeviceProps,
+  encodeHistorySyncConfig,
+  encodeBigEndianUnsigned,
+  buildAppVersionHash,
+  createDevicePairingData
+}

package/src/proto/handshake.js

@@ -0,0 +1,79 @@
+'use strict'
+/**
+ * Encoder/decoder protobuf MINIMAL khusus pesan handshake.
+ * Hanya mendukung field length-delimited (wire type 2) + skip varint.
+ * Nanti (v0.2) diganti proto lengkap; ini sengaja kecil supaya cepat dimuat.
+ *
+ * HandshakeMessage { clientHello = 2; serverHello = 3; clientFinish = 4 }
+ * ClientHello  { ephemeral = 1; static = 2; payload = 3 }
+ * ServerHello  { ephemeral = 1; static = 2; payload = 3 }
+ * ClientFinish { static = 1; payload = 2 }
+ */
+
+function varint(n) {
+  const out = []
+  while (n > 0x7f) { out.push((n & 0x7f) | 0x80); n >>>= 7 }
+  out.push(n)
+  return Buffer.from(out)
+}
+
+function field(num, buf) {
+  return Buffer.concat([varint((num << 3) | 2), varint(buf.length), buf])
+}
+
+function decodeFields(buf) {
+  const fields = new Map()
+  let i = 0
+  const readVarint = () => {
+    let result = 0, shift = 0, b
+    do {
+      if (i >= buf.length) throw new Error('protobuf: varint terpotong')
+      b = buf[i++]
+      result |= (b & 0x7f) << shift
+      shift += 7
+    } while (b & 0x80)
+    return result >>> 0
+  }
+  while (i < buf.length) {
+    const tag = readVarint()
+    const num = tag >>> 3, wire = tag & 7
+    if (wire === 0) readVarint()
+    else if (wire === 2) {
+      const len = readVarint()
+      if (i + len > buf.length) throw new Error('protobuf: field melebihi buffer')
+      fields.set(num, buf.subarray(i, i + len))
+      i += len
+    } else throw new Error(`protobuf: wire type ${wire} belum didukung`)
+  }
+  return fields
+}
+
+const encodeClientHello = (ephemeral) => field(2, field(1, ephemeral))
+const encodeServerHello = ({ ephemeral, static: s, payload }) =>
+  field(3, Buffer.concat([field(1, ephemeral), field(2, s), field(3, payload)]))
+const encodeClientFinish = ({ static: s, payload }) =>
+  field(4, Buffer.concat([field(1, s), field(2, payload)]))
+
+function need(map, num, name) {
+  const v = map.get(num)
+  if (!v) throw new Error(`handshake: field ${name} tidak ada`)
+  return v
+}
+
+function decodeClientHello(buf) {
+  const inner = decodeFields(need(decodeFields(buf), 2, 'clientHello'))
+  return { ephemeral: need(inner, 1, 'ephemeral') }
+}
+function decodeServerHello(buf) {
+  const inner = decodeFields(need(decodeFields(buf), 3, 'serverHello'))
+  return { ephemeral: need(inner, 1, 'ephemeral'), static: need(inner, 2, 'static'), payload: need(inner, 3, 'payload') }
+}
+function decodeClientFinish(buf) {
+  const inner = decodeFields(need(decodeFields(buf), 4, 'clientFinish'))
+  return { static: need(inner, 1, 'static'), payload: need(inner, 2, 'payload') }
+}
+
+module.exports = {
+  encodeClientHello, encodeServerHello, encodeClientFinish,
+  decodeClientHello, decodeServerHello, decodeClientFinish
+}

package/src/proto/wire.js

@@ -0,0 +1,137 @@
+'use strict'
+/**
+ * Tiny protobuf wire-format codec used by KersioSocket.
+ *
+ * This intentionally implements the protobuf wire primitives, not a generated
+ * copy of another project's WAProto code. Field meanings live in our own schema
+ * modules. Supported wire types: varint (0), fixed64 (1), bytes/message (2),
+ * and fixed32 (5). No implicit string conversion for binary fields.
+ */
+
+const MAX_FIELD_NUMBER = 0x1fffffff
+
+function asBigInt(value, name = 'value') {
+  if (typeof value === 'bigint') {
+    if (value < 0n || value > 0xffffffffffffffffn) throw new RangeError(`${name} di luar rentang uint64`)
+    return value
+  }
+  if (!Number.isSafeInteger(value) || value < 0) throw new TypeError(`${name} harus integer aman non-negatif`)
+  return BigInt(value)
+}
+
+function encodeVarint(value) {
+  let n = asBigInt(value)
+  const out = []
+  while (n > 0x7fn) {
+    out.push(Number((n & 0x7fn) | 0x80n))
+    n >>= 7n
+  }
+  out.push(Number(n))
+  return Buffer.from(out)
+}
+
+function tag(fieldNumber, wireType) {
+  if (!Number.isInteger(fieldNumber) || fieldNumber < 1 || fieldNumber > MAX_FIELD_NUMBER) {
+    throw new RangeError('nomor field protobuf tidak valid')
+  }
+  if (![0, 1, 2, 5].includes(wireType)) throw new RangeError('wire type protobuf tidak didukung')
+  return encodeVarint(BigInt(fieldNumber * 8 + wireType))
+}
+
+function fieldVarint(fieldNumber, value) {
+  if (value === undefined || value === null) return null
+  return Buffer.concat([tag(fieldNumber, 0), encodeVarint(value)])
+}
+
+function fieldBool(fieldNumber, value) {
+  if (value === undefined || value === null) return null
+  if (typeof value !== 'boolean') throw new TypeError(`field ${fieldNumber} harus boolean`)
+  return fieldVarint(fieldNumber, value ? 1 : 0)
+}
+
+function fieldBytes(fieldNumber, value) {
+  if (value === undefined || value === null) return null
+  if (!(Buffer.isBuffer(value) || value instanceof Uint8Array)) {
+    throw new TypeError(`field ${fieldNumber} harus Buffer/Uint8Array`)
+  }
+  const bytes = Buffer.from(value.buffer, value.byteOffset, value.byteLength)
+  return Buffer.concat([tag(fieldNumber, 2), encodeVarint(bytes.length), bytes])
+}
+
+function fieldString(fieldNumber, value) {
+  if (value === undefined || value === null) return null
+  if (typeof value !== 'string') throw new TypeError(`field ${fieldNumber} harus string`)
+  return fieldBytes(fieldNumber, Buffer.from(value, 'utf8'))
+}
+
+function fieldMessage(fieldNumber, value) {
+  return fieldBytes(fieldNumber, value)
+}
+
+function fieldFixed32(fieldNumber, value) {
+  if (value === undefined || value === null) return null
+  if (!Number.isInteger(value) || value < -0x80000000 || value > 0x7fffffff) {
+    throw new RangeError(`field ${fieldNumber} harus signed int32`)
+  }
+  const data = Buffer.allocUnsafe(4)
+  data.writeInt32LE(value)
+  return Buffer.concat([tag(fieldNumber, 5), data])
+}
+
+function pack(parts) {
+  const present = parts.filter((part) => part !== null && part !== undefined)
+  return present.length ? Buffer.concat(present) : Buffer.alloc(0)
+}
+
+function readVarint(buffer, state) {
+  let value = 0n
+  let shift = 0n
+  for (let count = 0; count < 10; count++) {
+    if (state.offset >= buffer.length) throw new Error('protobuf: varint terpotong')
+    const byte = buffer[state.offset++]
+    value |= BigInt(byte & 0x7f) << shift
+    if ((byte & 0x80) === 0) return value
+    shift += 7n
+  }
+  throw new Error('protobuf: varint melebihi 10 byte')
+}
+
+/** Decode wire entries without applying any application-specific schema. */
+function parseFields(input) {
+  const buffer = Buffer.from(input)
+  const state = { offset: 0 }
+  const fields = []
+  while (state.offset < buffer.length) {
+    const rawTag = readVarint(buffer, state)
+    const fieldNumber = Number(rawTag >> 3n)
+    const wireType = Number(rawTag & 7n)
+    if (fieldNumber < 1 || fieldNumber > MAX_FIELD_NUMBER) throw new Error('protobuf: nomor field tidak valid')
+    let value
+    if (wireType === 0) {
+      value = readVarint(buffer, state)
+    } else if (wireType === 1) {
+      if (state.offset + 8 > buffer.length) throw new Error('protobuf: fixed64 terpotong')
+      value = Buffer.from(buffer.subarray(state.offset, state.offset + 8))
+      state.offset += 8
+    } else if (wireType === 2) {
+      const length = readVarint(buffer, state)
+      if (length > BigInt(buffer.length - state.offset)) throw new Error('protobuf: panjang field melebihi buffer')
+      const end = state.offset + Number(length)
+      value = Buffer.from(buffer.subarray(state.offset, end))
+      state.offset = end
+    } else if (wireType === 5) {
+      if (state.offset + 4 > buffer.length) throw new Error('protobuf: fixed32 terpotong')
+      value = Buffer.from(buffer.subarray(state.offset, state.offset + 4))
+      state.offset += 4
+    } else {
+      throw new Error(`protobuf: wire type ${wireType} tidak didukung`)
+    }
+    fields.push({ fieldNumber, wireType, value })
+  }
+  return fields
+}
+
+module.exports = {
+  encodeVarint, fieldVarint, fieldBool, fieldBytes, fieldString,
+  fieldMessage, fieldFixed32, pack, parseFields
+}