kersiosocket 0.0.0-stage → 0.6.0-dev

package/test/connection.test.js

@@ -0,0 +1,173 @@
+'use strict'
+const test = require('node:test')
+const assert = require('node:assert/strict')
+const { EventEmitter } = require('node:events')
+const { makeSocket, encodeClientPayload } = require('../src')
+const { FrameDecoder, encodeFrame } = require('../src/socket/frame')
+const { WA_HEADER } = require('../src/socket/noise')
+const { ServerHandshake } = require('./helpers')
+
+/** Transport palsu di memori + server Noise di belakangnya. */
+function fakeServer(onEvent) {
+  const factory = () => {
+    const t = new EventEmitter()
+    const dec = new FrameDecoder()
+    const hs = new ServerHandshake()
+    let first = true, done = false
+    t.send = (buf) => {
+      if (first) {
+        assert.deepEqual(buf.subarray(0, 4), WA_HEADER, 'frame pertama harus diawali WA_HEADER')
+        buf = buf.subarray(4)
+        first = false
+      }
+      for (const f of dec.push(buf)) {
+        if (!hs.noise) {
+          const sh = hs.processClientHello(f)
+          setImmediate(() => t.emit('message', encodeFrame(sh)))
+        } else if (!done) {
+          done = true
+          onEvent('server-ready', { hs, payload: hs.processClientFinish(f).payload, t })
+        } else onEvent('client-frame', { data: hs.noise.decrypt(f) })
+      }
+    }
+    t.close = () => setImmediate(() => t.emit('close', 1000, ''))
+    setImmediate(() => t.emit('open'))
+    return t
+  }
+  return factory
+}
+
+test('koneksi penuh: handshake, terima & kirim frame, stats, end()', async () => {
+  let srv
+  const gotFromClient = new Promise((resolve) => {
+    srv = fakeServer((type, d) => {
+      if (type === 'server-ready') {
+        assert.deepEqual(d.payload, Buffer.from('cp'))
+        d.t.emit('message', encodeFrame(d.hs.noise.encrypt(Buffer.from('halo dari server'))))
+      }
+      if (type === 'client-frame') resolve(d.data)
+    })
+  })
+
+  const sock = makeSocket({
+    transportFactory: srv, clientPayload: Buffer.from('cp'), strictServerCertificateVerification: false, reconnect: { enabled: false }
+  })
+  const states = []
+  sock.ev.on('connection.update', (u) => states.push(u.connection))
+
+  const frame = await new Promise((resolve) => sock.ev.on('frame', resolve))
+  assert.deepEqual(frame, Buffer.from('halo dari server'))
+  assert.equal(sock.state, 'noise-ready')
+
+  sock.sendFrame(Buffer.from('pong'))
+  assert.deepEqual(await gotFromClient, Buffer.from('pong'))
+
+  const s = sock.stats()
+  assert.equal(s.framesIn, 2)
+  assert.ok(s.rssMB > 0)
+
+  sock.end()
+  await new Promise((r) => setTimeout(r, 20))
+  assert.deepEqual(states, ['connecting', 'handshaking', 'noise-ready', 'close'])
+})
+
+test('sendFrame sebelum handshake selesai melempar error', () => {
+  const sock = makeSocket({ autoConnect: false })
+  assert.throws(() => sock.sendFrame(Buffer.from('x')), /belum siap/)
+})
+
+test('listener frame yang melempar error TIDAK memutus koneksi; latensi tercatat', async () => {
+  const srv = fakeServer((type, d) => {
+    if (type === 'server-ready') {
+      d.t.emit('message', encodeFrame(d.hs.noise.encrypt(Buffer.from('satu'))))
+      setTimeout(() => d.t.emit('message', encodeFrame(d.hs.noise.encrypt(Buffer.from('dua')))), 10)
+    }
+  })
+  const sock = makeSocket({ transportFactory: srv, strictServerCertificateVerification: false, reconnect: { enabled: false } })
+  const handlerErrors = []
+  const frames = []
+  const observerFrames = []
+  sock.ev.on('frame', (f) => observerFrames.push(f.toString()))
+  sock.ev.on('handler.error', (e) => handlerErrors.push(e.message))
+  sock.ev.on('frame', (f) => { frames.push(f.toString()); if (f.toString() === 'satu') throw new Error('bug listener') })
+  await new Promise((r) => setTimeout(r, 60))
+  assert.deepEqual(frames, ['satu', 'dua'])
+  assert.deepEqual(handlerErrors, ['bug listener'])
+  assert.deepEqual(observerFrames, ['satu', 'dua'])
+  assert.equal(sock.state, 'noise-ready')
+  const s = sock.stats()
+  assert.ok(s.handshakeMs >= 0)
+  assert.equal(s.frameLatencyMs.count, 2)
+  assert.ok(s.frameLatencyMs.p95 >= s.frameLatencyMs.p50)
+  sock.end()
+})
+
+test('frame rusak (gagal dekripsi) tetap menutup koneksi sebagai error protokol', async () => {
+  const srv = fakeServer((type, d) => {
+    if (type === 'server-ready') d.t.emit('message', encodeFrame(Buffer.alloc(40, 1)))
+  })
+  const sock = makeSocket({ transportFactory: srv, strictServerCertificateVerification: false, reconnect: { enabled: false } })
+  const errs = []
+  sock.ev.on('connection.error', (e) => errs.push(e))
+  await new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error('timeout waiting for protocol close')), 1500)
+    sock.ev.on('connection.update', (update) => { if (update.connection === 'close') { clearTimeout(timer); resolve() } })
+  })
+  assert.equal(errs.length, 1)
+  assert.equal(sock.state, 'close')
+})
+
+test('backoff TIDAK direset bila server menutup tepat setelah handshake', async () => {
+  const delays = []
+  const log = { debug() {}, info(m) { const x = /dalam (\d+)ms/.exec(m); if (x) delays.push(+x[1]) }, warn() {}, error() {} }
+  const srv = fakeServer((type, d) => { if (type === 'server-ready') setImmediate(() => d.t.emit('close', 1006, '')) })
+  const sock = makeSocket({
+    transportFactory: srv, logger: log, strictServerCertificateVerification: false,
+    reconnect: { minDelay: 10, maxDelay: 1000, factor: 2, stableMs: 30000 }
+  })
+  await new Promise((r) => setTimeout(r, 400))
+  sock.end()
+  assert.ok(delays.length >= 3, `harus ada beberapa reconnect, dapat ${delays.length}`)
+  assert.ok(delays[2] > delays[0] * 2, `delay harus naik (exponential): ${delays.join(',')}`)
+})
+
+test('ClientPayload terstruktur di-encode sebelum dikirim dalam ClientFinish', async () => {
+  const options = {
+    mode: 'login', username: '6281234567890', passive: false, pushName: 'Kersio test',
+    userAgent: { platform: 'WEB', appVersion: [2, 3000, 1040000000], localeLanguage: 'id', localeCountry: 'ID' },
+    webInfo: { version: 'test-version-only', webSubPlatform: 'WEB_BROWSER' },
+    connectType: 'WIFI_UNKNOWN', connectReason: 'USER_ACTIVATED'
+  }
+  const expected = encodeClientPayload(options)
+  const received = new Promise((resolve) => {
+    const sock = makeSocket({
+      transportFactory: fakeServer((type, d) => {
+        if (type === 'server-ready') resolve(d.payload)
+      }),
+      clientPayload: options,
+      strictServerCertificateVerification: false,
+      reconnect: { enabled: false }
+    })
+    sock.ev.on('connection.error', (e) => { throw e })
+  })
+  assert.deepEqual(await received, expected)
+})
+
+test('native connection fails closed by default without Noise certificate verifier', async () => {
+  const srv = fakeServer(() => {})
+  const sock = makeSocket({ transportFactory: srv, reconnect: { enabled: true, minDelay: 10, maxDelay: 20, factor: 2, stableMs: 1000 } })
+  const errors = []
+  sock.ev.on('connection.error', (error) => errors.push(error))
+  await new Promise((resolve, reject) => {
+    const timer = setTimeout(() => reject(new Error('timeout waiting for strict-certificate close')), 1000)
+    sock.ev.on('connection.update', (update) => {
+      if (update.connection === 'close') { clearTimeout(timer); resolve() }
+    })
+  })
+  await new Promise((resolve) => setTimeout(resolve, 60))
+  assert.equal(errors.length, 1)
+  assert.equal(errors[0].code, 'ERR_NOISE_CERTIFICATE_VERIFIER_MISSING')
+  assert.equal(sock.state, 'close')
+  assert.equal(sock.stats().serverCertificateVerified, false)
+  sock.end()
+})

package/test/device-props.test.js

@@ -0,0 +1,67 @@
+'use strict'
+const test = require('node:test')
+const assert = require('node:assert/strict')
+const crypto = require('node:crypto')
+const { parseFields } = require('../src/proto/wire')
+const { encodeClientPayload } = require('../src/proto/client-payload')
+const { encodeDeviceProps, buildAppVersionHash, encodeBigEndianUnsigned, createDevicePairingData } = require('../src/proto/device-props')
+
+test('DeviceProps uses the pinned protobuf field layout (independent golden bytes)', () => {
+  const bytes = encodeDeviceProps({
+    os: 'Windows', version: [10, 15, 7], platformType: 'CHROME', requireFullSync: true,
+    historySyncConfig: {
+      storageQuotaMb: 10240,
+      inlineInitialPayloadInE2EeMsg: true,
+      supportCallLogHistory: false,
+      supportCagReactionsAndPolls: true
+    }
+  })
+  assert.equal(bytes.toString('hex'), '0a0757696e646f77731206080a100f1807180120012a09188050200130004001')
+  const fields = parseFields(bytes)
+  assert.deepEqual(fields.map(({ fieldNumber, wireType }) => [fieldNumber, wireType]), [[1,2],[2,2],[3,0],[4,0],[5,2]])
+})
+
+test('registration helpers encode big-endian IDs and the observed app-version MD5', () => {
+  assert.equal(encodeBigEndianUnsigned(0x01020304, 4).toString('hex'), '01020304')
+  assert.equal(encodeBigEndianUnsigned(0x010203, 3).toString('hex'), '010203')
+  assert.throws(() => encodeBigEndianUnsigned(0x1000000, 3), /tidak muat/)
+  const version = [2, 3000, 1043857760]
+  const hash = buildAppVersionHash(version)
+  assert.equal(hash.toString('hex'), 'f6f65c0607a1cdffd8752b051fc95edf')
+  assert.deepEqual(hash, crypto.createHash('md5').update('2.3000.1043857760').digest())
+})
+
+test('createDevicePairingData prepares fields only from caller-supplied key material', () => {
+  const deviceProps = encodeDeviceProps({ os: 'Windows', version: [10, 15, 7], platformType: 'CHROME' })
+  const data = createDevicePairingData({
+    registrationId: 0x01020304,
+    identityPublicKey: Buffer.alloc(32, 1),
+    signedPreKey: { keyId: 0x010203, publicKey: Buffer.alloc(32, 2), signature: Buffer.alloc(64, 3) },
+    appVersion: [2, 3000, 1043857760], deviceProps
+  })
+  assert.equal(data.eRegid.toString('hex'), '01020304')
+  assert.equal(data.eKeytype.toString('hex'), '05')
+  assert.equal(data.eIdent.length, 32)
+  assert.equal(data.eSkeyId.toString('hex'), '010203')
+  assert.equal(data.eSkeyVal.length, 32)
+  assert.equal(data.eSkeySig.length, 64)
+  assert.equal(data.buildHash.toString('hex'), 'f6f65c0607a1cdffd8752b051fc95edf')
+  assert.deepEqual(data.deviceProps, deviceProps)
+  assert.throws(() => createDevicePairingData({ registrationId: 1, identityPublicKey: Buffer.alloc(31), signedPreKey: { keyId: 1, publicKey: Buffer.alloc(32), signature: Buffer.alloc(64) }, appVersion: [1, 2, 3], deviceProps }), /identityPublicKey harus 32 byte/)
+})
+
+test('ClientPayload encodes newer optional fields from pinned schema by their wire numbers', () => {
+  const payload = encodeClientPayload({
+    mode: 'login', username: '6281234567890', passive: true, pull: true, lidDbMigrated: false,
+    userAgent: { platform: 'WEB', appVersion: [2, 3000, 1043857760] },
+    webInfo: { version: 'schema-fixture', webSubPlatform: 'WEB_BROWSER' },
+    shortConnect: true, product: 'WHATSAPP_LID', trafficAnonymization: 'STANDARD', accountType: 'DEFAULT'
+  })
+  const fieldNos = parseFields(payload).map((field) => field.fieldNumber)
+  assert.ok(fieldNos.includes(10))
+  assert.ok(fieldNos.includes(20))
+  assert.ok(fieldNos.includes(33))
+  assert.ok(fieldNos.includes(40))
+  assert.ok(fieldNos.includes(41))
+  assert.ok(fieldNos.includes(42))
+})

package/test/encrypted-store.test.js

@@ -0,0 +1,54 @@
+'use strict'
+const test = require('node:test')
+const assert = require('node:assert/strict')
+const crypto = require('node:crypto')
+const { MemoryStore } = require('../src/session/stores')
+const { EncryptedStore } = require('../src/session/encrypted-store')
+
+test('EncryptedStore encrypts session values and round-trips Buffer fields', async () => {
+  const raw = new MemoryStore()
+  const key = crypto.randomBytes(32)
+  const store = new EncryptedStore(raw, key)
+  const input = { noiseKey: { public: Buffer.alloc(32, 7), private: Buffer.alloc(32, 8) }, registrationId: 12345, name: 'fixture' }
+  await store.set('alpha:creds', input)
+  const envelope = await raw.get('alpha:creds')
+  assert.equal(envelope.format, 'kersiosocket:aes-256-gcm:v1')
+  assert.equal(JSON.stringify(envelope).includes('fixture'), false)
+  const output = await store.get('alpha:creds')
+  assert.deepEqual(output, input)
+  assert.deepEqual(await store.keys('alpha:'), ['alpha:creds'])
+})
+
+test('EncryptedStore rejects wrong keys, tampering, and plaintext without fallback', async () => {
+  const raw = new MemoryStore()
+  const store = new EncryptedStore(raw, Buffer.alloc(32, 1))
+  await store.set('s:creds', { token: 'secret-value' })
+  const wrong = new EncryptedStore(raw, Buffer.alloc(32, 2))
+  await assert.rejects(wrong.get('s:creds'), /autentikasi\/dekripsi gagal/)
+
+  const envelope = await raw.get('s:creds')
+  envelope.data = Buffer.from('changed').toString('base64')
+  await raw.set('s:creds', envelope)
+  await assert.rejects(store.get('s:creds'), /autentikasi\/dekripsi gagal/)
+  await raw.set('legacy:creds', { token: 'plaintext' })
+  await assert.rejects(store.get('legacy:creds'), /tidak ada fallback plaintext/)
+})
+
+test('EncryptedStore binds ciphertext to the storage key', async () => {
+  const raw = new MemoryStore()
+  const store = new EncryptedStore(raw, Buffer.alloc(32, 3))
+  await store.set('first:creds', { a: 1 })
+  const encrypted = await raw.get('first:creds')
+  await raw.set('second:creds', encrypted)
+  await assert.rejects(store.get('second:creds'), /autentikasi\/dekripsi gagal/)
+})
+
+
+test('EncryptedStore rejects use after close and validates storage keys', async () => {
+  const store = new EncryptedStore(new MemoryStore(), Buffer.alloc(32, 9))
+  await assert.rejects(store.set('', { secret: true }), /key harus string/)
+  await assert.rejects(store.get('bad\0key'), /key harus string/)
+  await store.close()
+  await assert.rejects(store.get('s:creds'), /sudah ditutup/)
+  await assert.rejects(store.set('s:creds', {}), /sudah ditutup/)
+})

package/test/frame.test.js

@@ -0,0 +1,37 @@
+'use strict'
+const test = require('node:test')
+const assert = require('node:assert/strict')
+const { FrameDecoder, encodeFrame } = require('../src/socket/frame')
+const { NoiseState, MAX_COUNTER, WA_HEADER } = require('../src/socket/noise')
+
+test('FrameDecoder: frame terbelah di tiap byte dan beberapa frame menyatu', () => {
+  const a = Buffer.from('satu'), b = Buffer.alloc(70000, 7), c = Buffer.alloc(0)
+  const wire = Buffer.concat([encodeFrame(a), encodeFrame(b), encodeFrame(c), encodeFrame(Buffer.from('empat'))])
+  const dec = new FrameDecoder()
+  const got = []
+  for (let i = 0; i < wire.length; i += 1000) got.push(...dec.push(wire.subarray(i, i + 1000)))
+  assert.equal(got.length, 4)
+  assert.deepEqual(got[0], a); assert.deepEqual(got[1], b); assert.equal(got[2].length, 0)
+  assert.deepEqual(got[3], Buffer.from('empat'))
+
+  const dec2 = new FrameDecoder(), got2 = []
+  for (const byte of encodeFrame(Buffer.from('halo'))) got2.push(...dec2.push(Buffer.from([byte])))
+  assert.deepEqual(got2, [Buffer.from('halo')])
+})
+
+test('FrameDecoder: sisa parsial disalin (tidak beralias ke buffer asal)', () => {
+  const dec = new FrameDecoder()
+  const big = Buffer.concat([encodeFrame(Buffer.from('x')), Buffer.from([0, 0])])
+  dec.push(big)
+  big[big.length - 1] = 0xff // ubah buffer asal; sisa di decoder harus tidak ikut berubah
+  assert.deepEqual(dec.push(Buffer.from([1, 0xaa])), [Buffer.from([0xaa])])
+})
+
+test('Noise: counter yang habis ditolak (cegah nonce berulang)', () => {
+  const n = new NoiseState(WA_HEADER)
+  n.finish(true)
+  n.writeCounter = MAX_COUNTER
+  assert.throws(() => n.encrypt(Buffer.from('x')), /counter tulis habis/)
+  n.readCounter = MAX_COUNTER
+  assert.throws(() => n.decrypt(Buffer.alloc(32)), /counter baca habis/)
+})

package/test/helpers.js

@@ -0,0 +1,43 @@
+'use strict'
+/** Sisi SERVER Noise XX untuk keperluan test (loopback). Bukan bagian library publik. */
+const { NoiseState } = require('../src/socket/noise')
+const { generateKeyPair, sharedKey } = require('../src/utils/crypto')
+const {
+  encodeServerHello, decodeClientHello, decodeClientFinish
+} = require('../src/proto/handshake')
+const { WA_HEADER } = require('../src/socket/noise')
+
+class ServerHandshake {
+  constructor({ staticKey = generateKeyPair(), certificate = Buffer.from('sertifikat-palsu'), header = WA_HEADER } = {}) {
+    this.staticKey = staticKey
+    this.certificate = certificate
+    this.header = header
+    this.noise = null
+    this.eph = null
+  }
+
+  processClientHello(data) {
+    const { ephemeral: clientEph } = decodeClientHello(data)
+    const n = (this.noise = new NoiseState(this.header))
+    n.authenticate(clientEph)
+    this.eph = generateKeyPair()
+    n.authenticate(this.eph.public)
+    n.mixIntoKey(sharedKey(this.eph.private, clientEph))
+    const encStatic = n.encrypt(this.staticKey.public)
+    n.mixIntoKey(sharedKey(this.staticKey.private, clientEph))
+    const encCert = n.encrypt(this.certificate)
+    return encodeServerHello({ ephemeral: this.eph.public, static: encStatic, payload: encCert })
+  }
+
+  processClientFinish(data) {
+    const n = this.noise
+    const fin = decodeClientFinish(data)
+    const clientStatic = n.decrypt(fin.static)
+    n.mixIntoKey(sharedKey(this.eph.private, clientStatic))
+    const payload = n.decrypt(fin.payload)
+    n.finish(false)
+    return { clientStatic, payload }
+  }
+}
+
+module.exports = { ServerHandshake }

package/test/locking-archive.test.js

@@ -0,0 +1,49 @@
+'use strict'
+const test = require('node:test')
+const assert = require('node:assert/strict')
+const fs = require('node:fs/promises')
+const os = require('node:os')
+const path = require('node:path')
+const { MemoryStore } = require('../src/session/stores')
+const { KeyedMutex, FileLockManager, MessageArchive } = require('../src/session/locking')
+
+test('KeyedMutex membuat operasi dengan key sama berjalan serial', async () => {
+  const mutex = new KeyedMutex()
+  const sequence = []
+  await Promise.all([
+    mutex.run('a', async () => { sequence.push('a1-start'); await new Promise((r) => setTimeout(r, 20)); sequence.push('a1-end') }),
+    mutex.run('a', async () => { sequence.push('a2-start'); sequence.push('a2-end') }),
+    mutex.run('b', async () => { sequence.push('b-start'); sequence.push('b-end') })
+  ])
+  assert.ok(sequence.indexOf('a1-end') < sequence.indexOf('a2-start'))
+})
+
+test('FileLockManager mencegah dua operasi concurrent dan melepaskan lock saat error', async () => {
+  const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'kersio-lock-'))
+  try {
+    const a = new FileLockManager(dir, { staleMs: 5000, heartbeatMs: 500, retryMs: 5 })
+    const b = new FileLockManager(dir, { staleMs: 5000, heartbeatMs: 500, retryMs: 5 })
+    let active = 0, maxActive = 0
+    await Promise.all([
+      a.withLock('session-a', async () => { active++; maxActive = Math.max(maxActive, active); await new Promise((r) => setTimeout(r, 35)); active-- }),
+      b.withLock('session-a', async () => { active++; maxActive = Math.max(maxActive, active); await new Promise((r) => setTimeout(r, 10)); active-- })
+    ])
+    assert.equal(maxActive, 1)
+    await assert.rejects(() => a.withLock('throws', async () => { throw new Error('expected') }), /expected/)
+    assert.equal((await fs.readdir(dir)).filter((x) => x.endsWith('.lock')).length, 0)
+  } finally { await fs.rm(dir, { recursive: true, force: true }) }
+})
+
+test('MessageArchive writes bounded history and exposes getMessage()', async () => {
+  const store = new MemoryStore()
+  const archive = new MessageArchive(store, { sessionId: 'archive-test', maxMessagesPerChat: 2 })
+  const mk = (id, text) => ({ key: { id, remoteJid: '1@s.whatsapp.net' }, message: { conversation: text } })
+  await archive.put(mk('1', 'one'))
+  await archive.put(mk('2', 'two'))
+  await archive.put(mk('3', 'three'))
+  assert.equal(await archive.getMessage({ id: '3', remoteJid: '1@s.whatsapp.net' }).then((v) => v.conversation), 'three')
+  assert.equal(await archive.getRecord({ id: '1', remoteJid: '1@s.whatsapp.net' }), undefined)
+  assert.deepEqual((await archive.recent('1@s.whatsapp.net', 10)).map((m) => m.key.id), ['3', '2'])
+  await archive.delete({ id: '2', remoteJid: '1@s.whatsapp.net' })
+  assert.deepEqual((await archive.recent('1@s.whatsapp.net')).map((m) => m.key.id), ['3'])
+})

package/test/node-protocol.test.js

@@ -0,0 +1,90 @@
+'use strict'
+const test = require('node:test')
+const assert = require('node:assert/strict')
+const { EventEmitter } = require('node:events')
+const { NodeProtocol, QueryTimeoutError, RemoteIQError } = require('../src/protocol/node-protocol')
+const { encodeBinaryNode, decodeBinaryNode } = require('../src/wabinary/codec')
+
+const tokens = { single: [], double: [[], [], [], []] }
+function connection() {
+  const conn = new EventEmitter()
+  conn.sent = []
+  conn.sendFrame = (frame) => conn.sent.push(Buffer.from(frame))
+  conn._safeEmit = (event, ...args) => conn.emit(event, ...args)
+  conn.failProtocol = (error) => { conn.failure = error; conn.emit('connection.update', { connection: 'close' }) }
+  return conn
+}
+
+
+test('NodeProtocol menolak token table kosong kecuali mode tes diaktifkan', () => {
+  const conn = connection()
+  assert.throws(() => new NodeProtocol(conn, { tokens }), /token dictionary non-kosong/)
+  const protocol = new NodeProtocol(conn, { tokens, allowEmptyTokenTable: true })
+  protocol.close()
+})
+
+test('NodeProtocol encodes outbound node and resolves matching IQ response', async () => {
+  const conn = connection()
+  const protocol = new NodeProtocol(conn, { tokens, allowEmptyTokenTable: true })
+  const promise = protocol.query({ tag: 'iq', attrs: { type: 'get', to: 's.whatsapp.net' }, content: [{ tag: 'ping', attrs: {} }] })
+  assert.equal(conn.sent.length, 1)
+  const sent = decodeBinaryNode(conn.sent[0], { tokens, requirePrefix: true })
+  assert.equal(sent.tag, 'iq')
+  assert.ok(sent.attrs.id)
+  assert.equal(sent.attrs.type, 'get')
+  conn.emit('frame', encodeBinaryNode({ tag: 'iq', attrs: { id: sent.attrs.id, type: 'result' }, content: [{ tag: 'pong', attrs: {} }] }, { tokens }))
+  const result = await promise
+  assert.equal(result.attrs.type, 'result')
+  assert.equal(result.content[0].tag, 'pong')
+  assert.equal(protocol.stats().pendingQueries, 0)
+  protocol.close()
+})
+
+test('NodeProtocol rejects IQ error, timeout and abort without leaking pending entries', async () => {
+  const conn = connection()
+  const protocol = new NodeProtocol(conn, { tokens, timeoutMs: 30, allowEmptyTokenTable: true })
+  const remote = protocol.query({ tag: 'iq', attrs: { id: 'remote-1', type: 'get' } })
+  conn.emit('frame', encodeBinaryNode({ tag: 'iq', attrs: { id: 'remote-1', type: 'error', code: '400' } }, { tokens }))
+  await assert.rejects(remote, RemoteIQError)
+
+  const timed = protocol.query({ tag: 'iq', attrs: { id: 'timeout-1', type: 'get' } }, { timeoutMs: 10 })
+  await assert.rejects(timed, QueryTimeoutError)
+  assert.equal(protocol.stats().pendingQueries, 0)
+
+  const controller = new AbortController()
+  const aborted = protocol.query({ tag: 'iq', attrs: { id: 'abort-1', type: 'get' } }, { signal: controller.signal, timeoutMs: 1000 })
+  controller.abort(new Error('test cancelled'))
+  await assert.rejects(aborted, /test cancelled/)
+  assert.equal(protocol.stats().pendingQueries, 0)
+  protocol.close()
+})
+
+
+test('NodeProtocol ignores non-response IQ types and auto-generates ID for null', async () => {
+  const conn = connection()
+  const protocol = new NodeProtocol(conn, { tokens, allowEmptyTokenTable: true })
+  const pending = protocol.query({ tag: 'iq', attrs: { id: null, type: 'get' } }, { timeoutMs: 500 })
+  const sent = decodeBinaryNode(conn.sent[0], { tokens, requirePrefix: true })
+  assert.ok(sent.attrs.id)
+  conn.emit('frame', encodeBinaryNode({ tag: 'iq', attrs: { id: sent.attrs.id, type: 'set' } }, { tokens }))
+  assert.equal(protocol.stats().pendingQueries, 1)
+  conn.emit('frame', encodeBinaryNode({ tag: 'iq', attrs: { id: sent.attrs.id, type: 'result' } }, { tokens }))
+  const result = await pending
+  assert.equal(result.attrs.type, 'result')
+  protocol.close()
+})
+
+test('NodeProtocol fails pending IQs closed and can fail closed on malformed WABinary', async () => {
+  const conn = connection()
+  const protocol = new NodeProtocol(conn, { tokens, allowEmptyTokenTable: true })
+  const pending = protocol.query({ tag: 'iq', attrs: { id: 'pending-1', type: 'get' } })
+  conn.emit('connection.update', { connection: 'close' })
+  await assert.rejects(pending, /koneksi ditutup/)
+
+  let protocolError
+  conn.on('protocol.error', (error) => { protocolError = error })
+  conn.emit('frame', Buffer.from([0x00, 0xF8]))
+  assert.ok(protocolError)
+  assert.equal(conn.failure, protocolError)
+  protocol.close()
+})

package/test/noise.test.js

@@ -0,0 +1,88 @@
+'use strict'
+const test = require('node:test')
+const assert = require('node:assert/strict')
+const { ClientHandshake } = require('../src/socket/noise')
+const { generateKeyPair, sharedKey } = require('../src/utils/crypto')
+const { FrameDecoder, encodeFrame } = require('../src/socket/frame')
+const { ServerHandshake } = require('./helpers')
+
+test('X25519: DH simetris', () => {
+  const a = generateKeyPair(), b = generateKeyPair()
+  assert.equal(a.public.length, 32)
+  assert.equal(a.private.length, 32)
+  assert.deepEqual(sharedKey(a.private, b.public), sharedKey(b.private, a.public))
+})
+
+test('frame: encode/decode, terbelah dan menyatu', () => {
+  const p1 = Buffer.from('halo'), p2 = Buffer.alloc(70000, 7)
+  const wire = Buffer.concat([encodeFrame(p1), encodeFrame(p2)])
+  const dec = new FrameDecoder()
+  const got = []
+  for (let i = 0; i < wire.length; i += 1000) got.push(...dec.push(wire.subarray(i, i + 1000)))
+  assert.equal(got.length, 2)
+  assert.deepEqual(got[0], p1)
+  assert.deepEqual(got[1], p2)
+  assert.deepEqual(new FrameDecoder().push(wire).length, 2)
+})
+
+test('Noise XX: handshake klien <-> server dan kanal terenkripsi dua arah', () => {
+  const clientStatic = generateKeyPair()
+  const server = new ServerHandshake()
+  const client = new ClientHandshake({ staticKey: clientStatic })
+
+  const serverHello = server.processClientHello(client.hello())
+  const finish = client.processServerHello(serverHello, Buffer.from('payload-login'))
+  const res = server.processClientFinish(finish)
+
+  assert.deepEqual(res.clientStatic, clientStatic.public)
+  assert.deepEqual(res.payload, Buffer.from('payload-login'))
+  assert.deepEqual(client.serverStatic, server.staticKey.public)
+  assert.deepEqual(client.serverCertificate, Buffer.from('sertifikat-palsu'))
+
+  // kanal transport
+  for (let i = 0; i < 5; i++) {
+    const m = Buffer.from('klien->server ' + i)
+    assert.deepEqual(server.noise.decrypt(client.noise.encrypt(m)), m)
+    const r = Buffer.from('server->klien ' + i)
+    assert.deepEqual(client.noise.decrypt(server.noise.encrypt(r)), r)
+  }
+})
+
+test('Noise: ciphertext yang diubah ditolak', () => {
+  const server = new ServerHandshake()
+  const client = new ClientHandshake({ staticKey: generateKeyPair() })
+  const finish = client.processServerHello(server.processClientHello(client.hello()), Buffer.alloc(0))
+  server.processClientFinish(finish)
+  const ct = client.noise.encrypt(Buffer.from('rahasia'))
+  ct[0] ^= 1
+  assert.throws(() => server.noise.decrypt(ct))
+})
+
+test('Noise: ServerHello dengan hash berbeda (header beda) gagal', () => {
+  const server = new ServerHandshake({ header: Buffer.from([0x57, 0x41, 6, 9]) })
+  const client = new ClientHandshake({ staticKey: generateKeyPair() })
+  const sh = server.processClientHello(client.hello())
+  assert.throws(() => client.processServerHello(sh, Buffer.alloc(0)))
+})
+
+test('Noise strict mode menolak server certificate bila verifier tidak dikonfigurasi', () => {
+  const server = new ServerHandshake({ certificate: Buffer.from('untrusted') })
+  const client = new ClientHandshake({ staticKey: generateKeyPair(), requireServerCertificateVerification: true })
+  const serverHello = server.processClientHello(client.hello())
+  assert.throws(() => client.processServerHello(serverHello, Buffer.alloc(0)), /verifier sertifikat server belum dikonfigurasi/)
+  assert.equal(client.serverCertificateVerified, false)
+})
+
+test('Noise strict mode hanya menerima certificate bila verifier menyatakan true', () => {
+  const expected = Buffer.from('pinned-test-certificate')
+  const server = new ServerHandshake({ certificate: expected })
+  const client = new ClientHandshake({
+    staticKey: generateKeyPair(),
+    requireServerCertificateVerification: true,
+    verifyServerCertificate: (certificate) => certificate.equals(expected)
+  })
+  const serverHello = server.processClientHello(client.hello())
+  const finish = client.processServerHello(serverHello, Buffer.alloc(0))
+  server.processClientFinish(finish)
+  assert.equal(client.serverCertificateVerified, true)
+})