kersiosocket 0.0.0-stage → 0.6.0-dev

package/src/protocol/node-protocol.js

@@ -0,0 +1,155 @@
+'use strict'
+
+const crypto = require('node:crypto')
+const { encodeBinaryNode, decodeBinaryNode, loadTokenTable, makeTokenTables } = require('../wabinary/codec')
+
+class QueryTimeoutError extends Error {
+  constructor(id, timeoutMs) {
+    super(`WABinary IQ ${id} timeout setelah ${timeoutMs} ms`)
+    this.name = 'QueryTimeoutError'
+    this.code = 'ERR_QUERY_TIMEOUT'
+    this.id = id
+    this.timeoutMs = timeoutMs
+  }
+}
+
+class RemoteIQError extends Error {
+  constructor(node) {
+    const code = node?.attrs?.code ? ` (code ${node.attrs.code})` : ''
+    super(`server mengembalikan IQ error${code}`)
+    this.name = 'RemoteIQError'
+    this.code = 'ERR_REMOTE_IQ'
+    this.node = node
+  }
+}
+
+/**
+ * Node-level protocol layer above Noise transport. It does not implement Signal,
+ * registration credentials, or authenticated pairing-success verification.
+ */
+class NodeProtocol {
+  constructor(connection, options = {}) {
+    this.connection = connection
+    const hasExplicitTokenTable = options.tokens !== undefined && options.tokens !== null
+    this.tokens = hasExplicitTokenTable ? options.tokens : loadTokenTable(options.tokenTablePath)
+    makeTokenTables(this.tokens) // validate dictionary structure at construction time
+    const populated = (this.tokens.single || []).some(Boolean) || (this.tokens.double || []).some((page) => page.some(Boolean))
+    if (!populated && options.allowEmptyTokenTable !== true) {
+      throw new Error('NodeProtocol membutuhkan token dictionary non-kosong; jalankan npm run refresh:tokens terlebih dahulu (allowEmptyTokenTable hanya untuk tes lokal)')
+    }
+    if (this.tokens._metadata && this.tokens._metadata.dictVersion !== 3) {
+      throw new Error(`NodeProtocol mendukung DictVersion 3, menerima ${this.tokens._metadata.dictVersion}`)
+    }
+    this.timeoutMs = options.timeoutMs ?? 30000
+    this.maxPending = options.maxPending ?? 1024
+    this.closeOnDecodeError = options.closeOnDecodeError !== false
+    if (!Number.isSafeInteger(this.timeoutMs) || this.timeoutMs < 1) throw new TypeError('timeoutMs harus integer positif')
+    if (!Number.isSafeInteger(this.maxPending) || this.maxPending < 1) throw new TypeError('maxPending harus integer positif')
+    this.pending = new Map()
+    this.closed = false
+    this.onFrame = (frame) => this._handleFrame(frame)
+    this.onConnectionUpdate = ({ connection: state }) => {
+      if (state === 'close') this._rejectAll(new Error('koneksi ditutup sebelum IQ selesai'))
+    }
+    connection.on('frame', this.onFrame)
+    connection.on('connection.update', this.onConnectionUpdate)
+  }
+
+  sendNode(node) {
+    if (this.closed) throw new Error('NodeProtocol sudah ditutup')
+    const bytes = encodeBinaryNode(node, { tokens: this.tokens })
+    this.connection.sendFrame(bytes)
+    return bytes.length
+  }
+
+  query(node, options = {}) {
+    if (this.closed) return Promise.reject(new Error('NodeProtocol sudah ditutup'))
+    if (!node || node.tag !== 'iq') return Promise.reject(new TypeError('query() hanya menerima node IQ'))
+    if (this.pending.size >= this.maxPending) return Promise.reject(new Error('batas IQ pending tercapai'))
+    const timeoutMs = options.timeoutMs ?? this.timeoutMs
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1) return Promise.reject(new TypeError('timeoutMs harus integer positif'))
+    const attrs = { ...(node.attrs || {}) }
+    const id = attrs.id === undefined || attrs.id === null ? this._newId() : String(attrs.id)
+    if (this.pending.has(id)) return Promise.reject(new Error(`IQ id duplikat: ${id}`))
+    attrs.id = id
+    const outgoing = { ...node, attrs }
+    if (options.signal?.aborted) return Promise.reject(options.signal.reason || new Error('IQ dibatalkan'))
+
+    return new Promise((resolve, reject) => {
+      const entry = { resolve, reject, timer: null, signal: options.signal, abort: null }
+      entry.timer = setTimeout(() => {
+        this._dropPending(id)
+        reject(new QueryTimeoutError(id, timeoutMs))
+      }, timeoutMs)
+      if (entry.signal) {
+        entry.abort = () => {
+          this._dropPending(id)
+          reject(entry.signal.reason || new Error('IQ dibatalkan'))
+        }
+        entry.signal.addEventListener('abort', entry.abort, { once: true })
+      }
+      this.pending.set(id, entry)
+      try { this.sendNode(outgoing) } catch (error) {
+        this._dropPending(id)
+        reject(error)
+      }
+    })
+  }
+
+  close(reason = new Error('NodeProtocol ditutup')) {
+    if (this.closed) return
+    this.closed = true
+    this.connection.off('frame', this.onFrame)
+    this.connection.off('connection.update', this.onConnectionUpdate)
+    this._rejectAll(reason)
+  }
+
+  stats() {
+    return { pendingQueries: this.pending.size, maxPending: this.maxPending, closed: this.closed }
+  }
+
+  _newId() {
+    return `${Date.now().toString(36)}-${crypto.randomBytes(6).toString('hex')}`
+  }
+
+  _handleFrame(frame) {
+    if (this.closed) return
+    let node
+    try {
+      node = decodeBinaryNode(frame, { tokens: this.tokens, requirePrefix: true })
+    } catch (error) {
+      this.connection._safeEmit('protocol.error', error)
+      if (this.closeOnDecodeError) this.connection.failProtocol(error)
+      return
+    }
+    this.connection._safeEmit('node', node)
+    this.connection._safeEmit(`node:${node.tag}`, node)
+    if (node.tag === 'iq') {
+      this.connection._safeEmit('iq', node)
+      const id = node.attrs?.id
+      const entry = id === undefined ? undefined : this.pending.get(String(id))
+      if (entry && (node.attrs?.type === 'result' || node.attrs?.type === 'error')) {
+        this._dropPending(String(id))
+        if (node.attrs.type === 'error') entry.reject(new RemoteIQError(node))
+        else entry.resolve(node)
+      }
+    }
+  }
+
+  _dropPending(id) {
+    const entry = this.pending.get(id)
+    if (!entry) return
+    clearTimeout(entry.timer)
+    if (entry.signal && entry.abort) entry.signal.removeEventListener('abort', entry.abort)
+    this.pending.delete(id)
+  }
+
+  _rejectAll(error) {
+    for (const [id, entry] of this.pending) {
+      this._dropPending(id)
+      entry.reject(error)
+    }
+  }
+}
+
+module.exports = { NodeProtocol, QueryTimeoutError, RemoteIQError }

package/src/session/codec.js

@@ -0,0 +1,25 @@
+'use strict'
+/**
+ * Serialisasi nilai session ke JSON dengan dukungan Buffer/Uint8Array (base64) dan bigint.
+ * Dipakai oleh store berbasis teks (file, SQLite, Redis, Mongo).
+ */
+function encode(value) {
+  return JSON.stringify(value, function (key, v) {
+    const raw = this[key] // JSON.stringify sudah memanggil Buffer.toJSON sebelum replacer
+    if (raw instanceof Uint8Array) return { $b: Buffer.from(raw.buffer, raw.byteOffset, raw.byteLength).toString('base64') }
+    if (typeof raw === 'bigint') return { $n: raw.toString() }
+    return v
+  })
+}
+
+function decode(text) {
+  return JSON.parse(text, (key, v) => {
+    if (v && typeof v === 'object') {
+      if (typeof v.$b === 'string' && Object.keys(v).length === 1) return Buffer.from(v.$b, 'base64')
+      if (typeof v.$n === 'string' && Object.keys(v).length === 1) return BigInt(v.$n)
+    }
+    return v
+  })
+}
+
+module.exports = { encode, decode }

package/src/session/encrypted-store.js

@@ -0,0 +1,107 @@
+'use strict'
+
+const crypto = require('node:crypto')
+const { encode, decode } = require('./codec')
+
+const FORMAT = 'kersiosocket:aes-256-gcm:v1'
+const IV_BYTES = 12
+const TAG_BYTES = 16
+
+/**
+ * Authenticated-encryption wrapper for any compatible session store.
+ * Supply a 32-byte master key from a secret manager or environment variable.
+ * The wrapper never generates or persists its own master key.
+ */
+class EncryptedStore {
+  constructor(store, masterKey) {
+    if (!store || typeof store.get !== 'function' || typeof store.set !== 'function' || typeof store.delete !== 'function') {
+      throw new TypeError('EncryptedStore memerlukan store dengan get/set/delete')
+    }
+    if (!Buffer.isBuffer(masterKey) && !(masterKey instanceof Uint8Array)) {
+      throw new TypeError('masterKey harus Buffer/Uint8Array 32 byte; jangan simpan key di source code')
+    }
+    const key = Buffer.from(masterKey.buffer, masterKey.byteOffset, masterKey.byteLength)
+    if (key.length !== 32) throw new RangeError('masterKey harus tepat 32 byte untuk AES-256-GCM')
+    this.store = store
+    this.key = Buffer.from(key)
+    this.closed = false
+  }
+
+  async get(key) {
+    this._assertOpen()
+    assertStorageKey(key)
+    const envelope = await this.store.get(key)
+    if (envelope === undefined) return undefined
+    if (!envelope || envelope.format !== FORMAT || typeof envelope.iv !== 'string' || typeof envelope.tag !== 'string' || typeof envelope.data !== 'string') {
+      throw new Error(`EncryptedStore: data '${key}' tidak memiliki format terenkripsi yang dikenali; tidak ada fallback plaintext`)
+    }
+    const iv = decodeBase64Strict(envelope.iv, 'iv')
+    const tag = decodeBase64Strict(envelope.tag, 'tag')
+    const data = decodeBase64Strict(envelope.data, 'data')
+    if (iv.length !== IV_BYTES || tag.length !== TAG_BYTES) throw new Error(`EncryptedStore: envelope '${key}' malformed`)
+    try {
+      const decipher = crypto.createDecipheriv('aes-256-gcm', this.key, iv)
+      decipher.setAAD(this._aad(key))
+      decipher.setAuthTag(tag)
+      const plain = Buffer.concat([decipher.update(data), decipher.final()])
+      return decode(plain.toString('utf8'))
+    } catch {
+      throw new Error(`EncryptedStore: autentikasi/dekripsi gagal untuk '${key}' (key salah atau data diubah)`)
+    }
+  }
+
+  async set(key, value) {
+    this._assertOpen()
+    assertStorageKey(key)
+    const iv = crypto.randomBytes(IV_BYTES)
+    const cipher = crypto.createCipheriv('aes-256-gcm', this.key, iv)
+    cipher.setAAD(this._aad(key))
+    const plain = Buffer.from(encode(value), 'utf8')
+    const data = Buffer.concat([cipher.update(plain), cipher.final()])
+    await this.store.set(key, {
+      format: FORMAT,
+      iv: iv.toString('base64'),
+      tag: cipher.getAuthTag().toString('base64'),
+      data: data.toString('base64')
+    })
+  }
+
+  async delete(key) {
+    this._assertOpen()
+    assertStorageKey(key)
+    await this.store.delete(key)
+  }
+
+  async keys(prefix = '') {
+    this._assertOpen()
+    if (typeof prefix !== 'string') throw new TypeError('prefix harus string')
+    if (typeof this.store.keys !== 'function') throw new Error('store dasar tidak mendukung keys()')
+    return this.store.keys(prefix)
+  }
+
+  async close() {
+    if (this.closed) return
+    this.closed = true
+    this.key.fill(0)
+    if (typeof this.store.close === 'function') await this.store.close()
+  }
+
+  _assertOpen() {
+    if (this.closed) throw new Error('EncryptedStore sudah ditutup')
+  }
+
+  _aad(key) { return Buffer.from(`${FORMAT}\0${key}`, 'utf8') }
+}
+
+function assertStorageKey(key) {
+  if (typeof key !== 'string' || key.length === 0 || key.includes('\0')) throw new TypeError('key harus string non-kosong tanpa NUL')
+}
+
+function decodeBase64Strict(value, name) {
+  if (value.length % 4 !== 0 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {
+    throw new Error(`EncryptedStore: ${name} bukan base64 valid`)
+  }
+  return Buffer.from(value, 'base64')
+}
+
+module.exports = { EncryptedStore, ENCRYPTED_STORE_FORMAT: FORMAT }

package/src/session/locking.js

@@ -0,0 +1,233 @@
+'use strict'
+
+const fs = require('node:fs/promises')
+const path = require('node:path')
+const crypto = require('node:crypto')
+
+class LockTimeoutError extends Error {
+  constructor(key, timeoutMs) {
+    super(`timeout menunggu lock '${key}' setelah ${timeoutMs} ms`)
+    this.name = 'LockTimeoutError'
+    this.code = 'ERR_LOCK_TIMEOUT'
+    this.key = key
+    this.timeoutMs = timeoutMs
+  }
+}
+
+/** In-process keyed mutex. Use FileLockManager when more than one process shares a store. */
+class KeyedMutex {
+  constructor() { this.queues = new Map() }
+
+  async run(key, task) {
+    if (typeof key !== 'string' || !key) throw new TypeError('key lock wajib string non-kosong')
+    if (typeof task !== 'function') throw new TypeError('task lock wajib function')
+    const previous = this.queues.get(key) || Promise.resolve()
+    const current = previous.catch(() => {}).then(task)
+    this.queues.set(key, current)
+    try { return await current } finally {
+      if (this.queues.get(key) === current) this.queues.delete(key)
+    }
+  }
+}
+
+/**
+ * Cross-process lease lock based on atomic mkdir().
+ * It protects cooperating processes sharing the same local filesystem; it is not a
+ * distributed lock for network filesystems with broken/weak rename semantics.
+ */
+class FileLockManager {
+  constructor(dir, { staleMs = 60000, heartbeatMs = 10000, retryMs = 40 } = {}) {
+    if (typeof dir !== 'string' || !dir.trim()) throw new TypeError('direktori lock wajib diisi')
+    if (!Number.isSafeInteger(staleMs) || staleMs < 3000) throw new RangeError('staleMs minimal 3000')
+    if (!Number.isSafeInteger(heartbeatMs) || heartbeatMs < 500 || heartbeatMs >= staleMs) throw new RangeError('heartbeatMs harus >=500 dan < staleMs')
+    if (!Number.isSafeInteger(retryMs) || retryMs < 5) throw new RangeError('retryMs minimal 5')
+    this.dir = path.resolve(dir)
+    this.staleMs = staleMs
+    this.heartbeatMs = heartbeatMs
+    this.retryMs = retryMs
+    this.ready = fs.mkdir(this.dir, { recursive: true })
+  }
+
+  run(key, task, options) { return this.withLock(key, task, options) }
+
+  async withLock(key, task, { timeoutMs = 15000, signal } = {}) {
+    if (typeof key !== 'string' || !key) throw new TypeError('key lock wajib string non-kosong')
+    if (typeof task !== 'function') throw new TypeError('task lock wajib function')
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1) throw new RangeError('timeoutMs harus integer positif')
+    await this.ready
+    const token = crypto.randomUUID()
+    const lockDir = path.join(this.dir, `${crypto.createHash('sha256').update(key).digest('hex')}.lock`)
+    const deadline = Date.now() + timeoutMs
+    let acquired = false
+    while (!acquired) {
+      if (signal?.aborted) throw signal.reason || new Error('lock dibatalkan')
+      try {
+        await fs.mkdir(lockDir)
+        acquired = true
+        try {
+          await fs.writeFile(path.join(lockDir, 'owner.json'), JSON.stringify({ token, keyHash: path.basename(lockDir), pid: process.pid, createdAt: Date.now() }), { flag: 'wx', mode: 0o600 })
+          const now = new Date()
+          await fs.utimes(lockDir, now, now)
+        } catch (error) {
+          await fs.rm(lockDir, { recursive: true, force: true }).catch(() => {})
+          throw error
+        }
+      } catch (error) {
+        if (error.code !== 'EEXIST') throw error
+        await this._reclaimIfStale(lockDir)
+        if (Date.now() >= deadline) throw new LockTimeoutError(key, timeoutMs)
+        await sleep(this.retryMs + Math.floor(Math.random() * Math.max(1, this.retryMs)), signal)
+      }
+    }
+
+    const heartbeat = setInterval(async () => {
+      try {
+        const owner = JSON.parse(await fs.readFile(path.join(lockDir, 'owner.json'), 'utf8'))
+        if (owner.token !== token) return
+        const now = new Date()
+        await fs.utimes(lockDir, now, now)
+      } catch { /* lease may have been reclaimed; fn should remain responsible for errors */ }
+    }, this.heartbeatMs)
+    heartbeat.unref?.()
+    try { return await task() } finally {
+      clearInterval(heartbeat)
+      try {
+        const owner = JSON.parse(await fs.readFile(path.join(lockDir, 'owner.json'), 'utf8'))
+        if (owner.token === token) await fs.rm(lockDir, { recursive: true, force: true })
+      } catch { /* never delete a lock not proven to be ours */ }
+    }
+  }
+
+  async _reclaimIfStale(lockDir) {
+    // Serialize stale reclamation so one waiter cannot rename a newly acquired lock
+    // after another waiter has already removed the stale directory.
+    const reclaimDir = `${lockDir}.reclaim`
+    try { await fs.mkdir(reclaimDir) } catch (error) {
+      if (error.code === 'EEXIST') return
+      throw error
+    }
+    try {
+      let stat
+      try { stat = await fs.stat(lockDir) } catch (error) { if (error.code === 'ENOENT') return; throw error }
+      if (Date.now() - stat.mtimeMs <= this.staleMs) return
+      const tombstone = `${lockDir}.stale-${process.pid}-${crypto.randomBytes(4).toString('hex')}`
+      try {
+        await fs.rename(lockDir, tombstone)
+        await fs.rm(tombstone, { recursive: true, force: true })
+      } catch (error) {
+        if (!['ENOENT', 'EEXIST', 'ENOTEMPTY'].includes(error.code)) throw error
+      }
+    } finally {
+      await fs.rm(reclaimDir, { recursive: true, force: true }).catch(() => {})
+    }
+  }
+}
+
+/**
+ * Small persistent message archive. It stores full backend message objects (including
+ * buffers supported by the configured store codec) and offers Baileys-style getMessage.
+ */
+class LockedStore {
+  constructor(store, lockManager) {
+    if (!store || typeof store.get !== 'function' || typeof store.set !== 'function' || typeof store.delete !== 'function') throw new TypeError('LockedStore memerlukan store get/set/delete')
+    if (!lockManager || typeof lockManager.run !== 'function') throw new TypeError('lockManager harus menyediakan run(key, task)')
+    this.store = store
+    this.lockManager = lockManager
+  }
+  get(key) { return this.lockManager.run(`store:${key}`, () => this.store.get(key)) }
+  set(key, value) { return this.lockManager.run(`store:${key}`, () => this.store.set(key, value)) }
+  delete(key) { return this.lockManager.run(`store:${key}`, () => this.store.delete(key)) }
+  keys(prefix = '') { return this.lockManager.run('store:__keys__', () => {
+    if (typeof this.store.keys !== 'function') throw new Error('store dasar tidak mendukung keys()')
+    return this.store.keys(prefix)
+  }) }
+  close() { return typeof this.store.close === 'function' ? this.store.close() : undefined }
+}
+
+class MessageArchive {
+  constructor(store, { sessionId = 'default', maxMessagesPerChat = 1000, mutex = new KeyedMutex() } = {}) {
+    if (!store || typeof store.get !== 'function' || typeof store.set !== 'function' || typeof store.delete !== 'function') {
+      throw new TypeError('MessageArchive memerlukan store dengan get/set/delete')
+    }
+    if (!Number.isSafeInteger(maxMessagesPerChat) || maxMessagesPerChat < 1) throw new RangeError('maxMessagesPerChat harus integer positif')
+    this.store = store
+    this.sessionId = validateScope(sessionId)
+    this.maxMessagesPerChat = maxMessagesPerChat
+    this.mutex = mutex
+  }
+
+  async put(message) {
+    const key = message?.key
+    const jid = key?.remoteJid
+    const id = key?.id
+    if (typeof jid !== 'string' || !jid || typeof id !== 'string' || !id) return false
+    const indexKey = this._indexKey(jid)
+    const recordKey = this._recordKey(jid, id)
+    return this.mutex.run(indexKey, async () => {
+      await this.store.set(recordKey, message)
+      const current = await this.store.get(indexKey)
+      const ids = Array.isArray(current) ? current.filter((entry) => entry && entry.id !== id) : []
+      ids.push({ id, key: recordKey, timestamp: Date.now() })
+      const removed = ids.splice(0, Math.max(0, ids.length - this.maxMessagesPerChat))
+      await this.store.set(indexKey, ids)
+      for (const old of removed) await this.store.delete(old.key)
+      return true
+    })
+  }
+
+  async getRecord(key) {
+    if (!key || typeof key.remoteJid !== 'string' || typeof key.id !== 'string') return undefined
+    return this.store.get(this._recordKey(key.remoteJid, key.id))
+  }
+
+  async getMessage(key) {
+    const record = await this.getRecord(key)
+    return record?.message
+  }
+
+  async recent(jid, limit = 50) {
+    if (typeof jid !== 'string' || !jid) throw new TypeError('jid wajib diisi')
+    if (!Number.isSafeInteger(limit) || limit < 1) throw new RangeError('limit harus integer positif')
+    const ids = await this.store.get(this._indexKey(jid))
+    if (!Array.isArray(ids)) return []
+    const selected = ids.slice(-limit).reverse()
+    const out = []
+    for (const entry of selected) {
+      const message = await this.store.get(entry.key)
+      if (message !== undefined) out.push(message)
+    }
+    return out
+  }
+
+  async delete(key) {
+    if (!key || typeof key.remoteJid !== 'string' || typeof key.id !== 'string') return false
+    const indexKey = this._indexKey(key.remoteJid)
+    return this.mutex.run(indexKey, async () => {
+      const recordKey = this._recordKey(key.remoteJid, key.id)
+      await this.store.delete(recordKey)
+      const ids = await this.store.get(indexKey)
+      if (Array.isArray(ids)) await this.store.set(indexKey, ids.filter((entry) => entry.key !== recordKey))
+      return true
+    })
+  }
+
+  _indexKey(jid) { return `archive:${this.sessionId}:${encodeURIComponent(jid)}:index` }
+  _recordKey(jid, id) { return `archive:${this.sessionId}:${encodeURIComponent(jid)}:message:${encodeURIComponent(id)}` }
+}
+
+function validateScope(value) {
+  if (typeof value !== 'string' || !value.trim() || value.includes('\0')) throw new TypeError('sessionId harus string non-kosong')
+  return value
+}
+
+function sleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) return reject(signal.reason || new Error('operasi dibatalkan'))
+    const timer = setTimeout(done, ms)
+    const onAbort = () => { clearTimeout(timer); signal.removeEventListener('abort', onAbort); reject(signal.reason || new Error('operasi dibatalkan')) }
+    function done() { signal?.removeEventListener('abort', onAbort); resolve() }
+    signal?.addEventListener('abort', onAbort, { once: true })
+  })
+}
+
+module.exports = { KeyedMutex, FileLockManager, LockedStore, MessageArchive, LockTimeoutError }

package/src/session/manager.js

@@ -0,0 +1,61 @@
+'use strict'
+const { makeSocket } = require('../socket/make')
+
+/**
+ * Banyak sesi (banyak nomor) dalam satu proses, semuanya memakai satu store.
+ *
+ *   const sessions = createSessionManager({ store: new FileStore('./sessions'), logger })
+ *   const a = sessions.open('nomor-a')   // dibuat sekali, dipakai ulang
+ *   const b = sessions.open('nomor-b')
+ *   await sessions.list()                // semua sesi yang tersimpan di store
+ *   sessions.stats()                     // ringkasan per sesi + total RAM proses
+ */
+function createSessionManager({ store, ...defaults } = {}) {
+  if (!store) throw new Error('createSessionManager: store wajib diisi')
+  const live = new Map()
+
+  return {
+    open(id, overrides = {}) {
+      if (!id || /[:/\\]/.test(id)) throw new Error('id sesi tidak valid (tanpa : / \\)')
+      let sock = live.get(id)
+      if (!sock) {
+        sock = makeSocket({ ...defaults, ...overrides, store, sessionId: id })
+        live.set(id, sock)
+      }
+      return sock
+    },
+
+    get: (id) => live.get(id),
+
+    /** Hentikan koneksi sebuah sesi. Dengan { purge: true } kredensialnya juga dihapus dari store. */
+    async close(id, { purge = false } = {}) {
+      const sock = live.get(id)
+      if (sock) { await sock.ready; sock.end(); live.delete(id) }
+      if (purge) await store.delete(`${id}:creds`)
+    },
+
+    async closeAll() {
+      await Promise.all([...live.keys()].map((id) => this.close(id)))
+      if (store.close) await store.close()
+    },
+
+    async list() {
+      if (!store.keys) throw new Error('store ini tidak mendukung keys()')
+      const ids = new Set()
+      for (const k of await store.keys()) {
+        const i = k.indexOf(':')
+        if (i > 0 && k.slice(i + 1) === 'creds') ids.add(k.slice(0, i))
+      }
+      return [...ids]
+    },
+
+    stats() {
+      const m = process.memoryUsage()
+      const sessions = {}
+      for (const [id, s] of live) sessions[id] = s.stats()
+      return { sessions, active: live.size, rssMB: +(m.rss / 1048576).toFixed(1), heapUsedMB: +(m.heapUsed / 1048576).toFixed(1) }
+    }
+  }
+}
+
+module.exports = { createSessionManager }