@zapo-js/fake-server 1.0.0 → 1.1.0

package/dist/esm/bin.js

@@ -1,12 +1,16 @@
 #!/usr/bin/env node
 /** Standalone CLI for `@zapo-js/fake-server`. */
+import { createInterface } from 'node:readline';
 import { FakeWaServer } from './api/FakeWaServer.js';
+import { parsePairingQrString } from './protocol/auth/pair-device.js';
+import { bytesToHex, toError } from './transport/util.js';
 function parseArgs(argv) {
     let host = '127.0.0.1';
     let port = 0;
     let path = '/ws/chat';
     const peerJids = [];
     const groupSpecs = [];
+    let pairJid = null;
     let log = false;
     let quiet = false;
     let json = false;
@@ -44,6 +48,9 @@ function parseArgs(argv) {
             case '--group':
                 groupSpecs.push(next());
                 break;
+            case '--pair':
+                pairJid = next();
+                break;
             case '--log':
                 log = true;
                 break;
@@ -57,7 +64,7 @@ function parseArgs(argv) {
                 throw new Error(`unknown flag: ${arg}`);
         }
     }
-    return { host, port, path, peerJids, groupSpecs, log, quiet, json, help };
+    return { host, port, path, peerJids, groupSpecs, pairJid, log, quiet, json, help };
 }
 function printHelp() {
     process.stdout.write(`@zapo-js/fake-server – standalone fake WhatsApp Web server
@@ -73,6 +80,12 @@ FLAGS
   --group <spec>      Pre-create a fake group; spec format
                       <group-jid>=<peer-jid>,<peer-jid>,...
                       All peers must already be passed via --peer.
+  --pair <jid>        Drive QR pairing for unregistered clients: the server
+                      sends pair-device refs, then prompts on stdin for the
+                      QR payload the client displays
+                      (ref,noisePubB64,identityPubB64,advSecretB64,platform)
+                      and answers pair-success assigning <jid> as the device
+                      jid. Without this flag the CLI is login-only.
   --log               Print every captured inbound stanza
   --quiet             Suppress the startup info banner
   --json              Print connection info as JSON
@@ -103,7 +116,7 @@ async function main() {
         args = parseArgs(process.argv.slice(2));
     }
     catch (error) {
-        process.stderr.write(`error: ${error instanceof Error ? error.message : String(error)}\n`);
+        process.stderr.write(`error: ${toError(error).message}\n`);
         process.stderr.write('run with --help to see usage.\n');
         process.exit(2);
     }
@@ -125,11 +138,39 @@ async function main() {
         port: args.port,
         path: args.path
     });
+    if (args.pairJid !== null) {
+        const pairJid = args.pairJid;
+        let pairingStarted = false;
+        server.onAuthenticatedPipeline(async (pipeline) => {
+            if (pairingStarted)
+                return;
+            if (pipeline.clientPayload?.kind !== 'registration')
+                return;
+            pairingStarted = true;
+            try {
+                await server.runPairing(pipeline, { deviceJid: pairJid }, async () => {
+                    const qr = await readStdinLine('[fake-server] paste the QR payload displayed by the client and press Enter:\n');
+                    const parsed = parsePairingQrString(qr.trim());
+                    return {
+                        advSecretKey: parsed.advSecretKey,
+                        identityPublicKey: parsed.identityPublicKey
+                    };
+                });
+                process.stdout.write(`[fake-server] pair-success sent for ${pairJid}; the client will now reconnect and log in\n`);
+            }
+            catch (error) {
+                pairingStarted = false;
+                process.stderr.write(`pairing failed: ${toError(error).message}\n`);
+            }
+        });
+    }
     let setupComplete = false;
     const setupPromise = new Promise((resolve, reject) => {
         server.onAuthenticatedPipeline(async (pipeline) => {
             if (setupComplete)
                 return;
+            if (pipeline.clientPayload?.kind !== 'login')
+                return;
             setupComplete = true;
             try {
                 const peers = new Map();
@@ -155,7 +196,7 @@ async function main() {
                 resolve();
             }
             catch (error) {
-                reject(error instanceof Error ? error : new Error(String(error)));
+                reject(toError(error));
             }
         });
     });
@@ -164,12 +205,11 @@ async function main() {
         process.exitCode = 1;
     });
     if (args.log) {
-        server.onPipeline((pipeline) => {
-            pipeline.setEvents({
-                onStanza: (node) => {
-                    process.stdout.write(`[wire] ${node.tag}${node.attrs.id ? ` id=${node.attrs.id}` : ''}${node.attrs.type ? ` type=${node.attrs.type}` : ''}\n`);
-                }
-            });
+        // onCapturedStanza taps the server's own capture stream; overriding
+        // pipeline.setEvents here would replace the server's handlers and
+        // silently break --peer setup and stanza capture.
+        server.onCapturedStanza((node) => {
+            process.stdout.write(`[wire] ${node.tag}${node.attrs.id ? ` id=${node.attrs.id}` : ''}${node.attrs.type ? ` type=${node.attrs.type}` : ''}\n`);
         });
     }
     if (!args.quiet) {
@@ -185,7 +225,8 @@ async function main() {
                     publicKeyHex: bytesToHex(noiseRoot.publicKey)
                 },
                 peers: args.peerJids,
-                groups: parsedGroups
+                groups: parsedGroups,
+                pair: args.pairJid
             }, null, 2) + '\n');
         }
         else {
@@ -201,6 +242,7 @@ async function main() {
                 `│ noise root ca  serial=${noiseRoot.serial} pub=${bytesToHex(noiseRoot.publicKey).slice(0, 32)}…`,
                 `│ peers          ${args.peerJids.length === 0 ? '(none)' : args.peerJids.join(', ')}`,
                 `│ groups         ${parsedGroups.length === 0 ? '(none)' : parsedGroups.map((g) => g.groupJid).join(', ')}`,
+                `│ pair mode      ${args.pairJid ?? '(off – login only)'}`,
                 '├─────────────────────────────────────────────────────────────',
                 '│ Wire your WaClient with:',
                 '│   chatSocketUrls: [server.url]',
@@ -224,7 +266,7 @@ async function main() {
             process.exit(0);
         }
         catch (error) {
-            process.stderr.write(`error during shutdown: ${error instanceof Error ? error.message : String(error)}\n`);
+            process.stderr.write(`error during shutdown: ${toError(error).message}\n`);
             process.exit(1);
         }
     };
@@ -232,15 +274,21 @@ async function main() {
     process.on('SIGTERM', () => void shutdown('SIGTERM'));
     await new Promise(() => undefined);
 }
-function bytesToHex(bytes) {
-    let out = '';
-    for (let index = 0; index < bytes.byteLength; index += 1) {
-        const value = bytes[index];
-        out += value < 16 ? `0${value.toString(16)}` : value.toString(16);
-    }
-    return out;
+function readStdinLine(prompt) {
+    process.stdout.write(prompt);
+    return new Promise((resolve, reject) => {
+        const rl = createInterface({ input: process.stdin });
+        // resolve before close(): rl.close() emits 'close' synchronously,
+        // which would otherwise reject the still-pending promise first.
+        rl.once('line', (line) => {
+            resolve(line);
+            rl.close();
+        });
+        rl.once('close', () => reject(new Error('stdin closed before a QR payload was provided')));
+    });
 }
 main().catch((error) => {
-    process.stderr.write(`fatal: ${error instanceof Error ? (error.stack ?? error.message) : String(error)}\n`);
+    const normalized = toError(error);
+    process.stderr.write(`fatal: ${normalized.stack ?? normalized.message}\n`);
     process.exit(1);
 });

package/dist/esm/index.js

@@ -1,6 +1,6 @@
 export { FakePairingDriver } from './api/FakePairingDriver.js';
 export { FakePeer } from './api/FakePeer.js';
-export { FakeWaServer } from './api/FakeWaServer.js';
+export { FakeServerSession, FakeWaServer } from './api/FakeWaServer.js';
 export { IqExpectation, Scenario } from './api/Scenario.js';
 export { WaFakeConnection } from './infra/WaFakeConnection.js';
 export { buildAppStateSyncFullResult, buildAppStateSyncResult, buildServerSyncNotification, parseAppStateSyncRequest } from './protocol/iq/appstate-sync.js';

package/dist/esm/infra/WaFakeConnectionPipeline.js

@@ -16,6 +16,7 @@ export class WaFakeConnectionPipeline {
         this.events = {};
         this.state = { kind: 'awaiting_prologue' };
         this.chain = Promise.resolve();
+        this.authenticatedPayload = null;
         this.config = config;
         this.frameSocket = new WaFakeFrameSocket(config.connection);
         this.frameSocket.setHandlers({
@@ -34,6 +35,10 @@ export class WaFakeConnectionPipeline {
     isAuthenticated() {
         return this.state.kind === 'authenticated';
     }
+    /** Parsed ClientPayload of the authenticated connection; null before auth. */
+    get clientPayload() {
+        return this.authenticatedPayload;
+    }
     async sendStanza(node) {
         if (this.state.kind !== 'authenticated') {
             throw new Error(`cannot send stanza while pipeline is in state "${this.state.kind}"`);
@@ -153,14 +158,7 @@ export class WaFakeConnectionPipeline {
             }
         }).finish();
         this.frameSocket.sendFrame(serverHello);
-        const keys = handshake.finish();
-        const transport = new WaFakeTransport({
-            recvKey: keys.recvKey,
-            sendKey: keys.sendKey
-        });
-        this.state = { kind: 'authenticated', transport };
-        await this.sendStanza(buildSuccessNode(this.config.successNodeAttributes));
-        this.events.onAuthenticated?.({ clientPayload, clientStaticKey });
+        await this.completeAuthentication(handshake, clientPayload, clientStaticKey);
     }
     async handleClientFinish(frame, handshake, serverEphemeralKeyPair) {
         const parsed = proto.HandshakeMessage.decode(frame);
@@ -172,13 +170,27 @@ export class WaFakeConnectionPipeline {
         handshake.mixIntoKey(await X25519.scalarMult(serverEphemeralKeyPair.privKey, clientStaticKey));
         const clientPayloadBytes = handshake.decrypt(clientFinish.payload);
         const clientPayload = parseClientPayload(clientPayloadBytes);
+        await this.completeAuthentication(handshake, clientPayload, clientStaticKey);
+    }
+    async completeAuthentication(handshake, clientPayload, clientStaticKey) {
         const keys = handshake.finish();
         const transport = new WaFakeTransport({
             recvKey: keys.recvKey,
             sendKey: keys.sendKey
         });
         this.state = { kind: 'authenticated', transport };
+        this.authenticatedPayload = clientPayload;
         await this.sendStanza(buildSuccessNode(this.config.successNodeAttributes));
+        if (clientPayload.kind === 'login') {
+            // Real WA drains offline messages after login and closes the
+            // drain with this bulletin. Baileys-family clients buffer their
+            // events until it arrives, so send it eagerly with count=0.
+            await this.sendStanza({
+                tag: 'ib',
+                attrs: { from: 's.whatsapp.net' },
+                content: [{ tag: 'offline', attrs: { count: '0' } }]
+            });
+        }
         this.events.onAuthenticated?.({ clientPayload, clientStaticKey });
     }
     async handleAuthenticatedFrame(frame, transport) {
@@ -186,7 +198,7 @@ export class WaFakeConnectionPipeline {
         const node = await decodeBinaryNodeStanza(stanzaBytes);
         this.events.onStanza?.(node);
         if (node.tag === 'iq') {
-            const response = await this.config.iqRouter.route(node);
+            const response = await this.config.routeIq(node);
             if (response !== null) {
                 await this.sendStanza(response);
             }

package/dist/esm/protocol/auth/cert-chain.js

@@ -1,6 +1,8 @@
 /** Fake noise certificate chain generator for handshake tests. */
 import { X25519, xeddsaSign } from '../../transport/crypto.js';
 import { proto } from '../../transport/protos.js';
+const WA_CERT_NOT_BEFORE_BACKDATE_SECONDS = 86400;
+const WA_CERT_NOT_AFTER_LIFETIME_SECONDS = 315360000;
 export async function generateFakeNoiseRootCa() {
     const keyPair = await X25519.generateKeyPair();
     return {
@@ -12,17 +14,26 @@ export async function generateFakeNoiseRootCa() {
 export async function buildFakeCertChain(input) {
     const intermediateSerial = input.intermediateSerial ?? 1;
     const leafSerial = input.leafSerial ?? 2;
+    // Strict clients (e.g. whatsmeow) enforce the validity window; leaving
+    // notBefore/notAfter unset decodes as 0 (1970) and reads as expired.
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    const notBefore = input.notBefore ?? nowSeconds - WA_CERT_NOT_BEFORE_BACKDATE_SECONDS;
+    const notAfter = input.notAfter ?? nowSeconds + WA_CERT_NOT_AFTER_LIFETIME_SECONDS;
     const intermediateKeyPair = await X25519.generateKeyPair();
     const intermediateDetails = proto.CertChain.NoiseCertificate.Details.encode({
         serial: intermediateSerial,
         issuerSerial: input.root.serial,
-        key: intermediateKeyPair.pubKey
+        key: intermediateKeyPair.pubKey,
+        notBefore,
+        notAfter
     }).finish();
     const intermediateSignature = await xeddsaSign(input.root.privateKey, intermediateDetails);
     const leafDetails = proto.CertChain.NoiseCertificate.Details.encode({
         serial: leafSerial,
         issuerSerial: intermediateSerial,
-        key: input.leafKey
+        key: input.leafKey,
+        notBefore,
+        notAfter
     }).finish();
     const leafSignature = await xeddsaSign(intermediateKeyPair.privKey, leafDetails);
     const encoded = proto.CertChain.encode({

package/dist/esm/protocol/iq/router.js

@@ -25,12 +25,18 @@ export class WaFakeIqRouter {
         }
         for (const handler of this.highPriorityHandlers) {
             if (matches(iq, handler.matcher)) {
-                return handler.respond(iq);
+                const response = await handler.respond(iq);
+                if (response !== null) {
+                    return response;
+                }
             }
         }
         for (const handler of this.handlers) {
             if (matches(iq, handler.matcher)) {
-                return handler.respond(iq);
+                const response = await handler.respond(iq);
+                if (response !== null) {
+                    return response;
+                }
             }
         }
         this.events.onUnhandled?.(iq);

package/dist/esm/transport/util.js

@@ -4,5 +4,5 @@
  * Re-exports bit-exact byte helpers from zapo-js so Layer 2/3 of the fake
  * server can use them without importing zapo-js directly.
  */
-export { bytesToBase64, bytesToBase64UrlSafe, bytesToHex, decodeBase64Url } from 'zapo-js/util';
+export { bytesToBase64, bytesToBase64UrlSafe, bytesToHex, decodeBase64Url, toError } from 'zapo-js/util';
 export const TEXT_ENCODER = new TextEncoder();

package/dist/index.d.ts

@@ -2,8 +2,8 @@ export { FakePairingDriver } from './api/FakePairingDriver';
 export type { CompanionPairingMaterial, FakePairingDriverDeps, FakePairingDriverOptions } from './api/FakePairingDriver';
 export { FakePeer } from './api/FakePeer';
 export type { CreateFakePeerOptions, ExpectGroupMessageOptions, ExpectMessageOptions, ReceivedMessage, SendMessageOptions } from './api/FakePeer';
-export { FakeWaServer } from './api/FakeWaServer';
-export type { BinaryNode, ExpectIqOptions, ExpectStanzaOptions, FakeWaServerNoiseRootCa, FakeWaServerOptions, FakeWaServerPipelineListener, StanzaMatcher, WaFakeAuthenticatedInfo, WaFakeConnectionPipeline } from './api/FakeWaServer';
+export { FakeServerSession, FakeWaServer } from './api/FakeWaServer';
+export type { BinaryNode, ExpectIqOptions, ExpectStanzaOptions, FakeSessionKeyInfo, FakeWaServerNoiseRootCa, FakeWaServerOptions, FakeWaServerPipelineListener, StanzaMatcher, WaFakeAuthenticatedInfo, WaFakeConnectionPipeline } from './api/FakeWaServer';
 export { IqExpectation, Scenario } from './api/Scenario';
 export type { AuthenticatedPipelineListener, ScenarioServer } from './api/Scenario';
 export { WaFakeConnection } from './infra/WaFakeConnection';

package/dist/index.js

@@ -1,11 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildStreamErrorXmlNotWellFormed = exports.buildStreamErrorReplaced = exports.buildStreamErrorDeviceRemoved = exports.buildStreamErrorCode = exports.buildStreamErrorAck = exports.PreKeyUploadParseError = exports.parsePreKeyUploadIq = exports.parsePairingQrString = exports.buildPairSuccessIq = exports.buildPairDeviceIq = exports.generateFakePrimaryDevice = exports.buildAdvSignedDeviceIdentity = exports.FakeSenderKey = exports.FakePeerDoubleRatchet = exports.generateFakePeerIdentity = exports.buildReceipt = exports.buildIncomingPresence = exports.buildNotification = exports.buildGroupNotification = exports.buildMessage = exports.FakeMediaStore = exports.FakeAppStateCollection = exports.FakeAppStateCrypto = exports.APP_STATE_EMPTY_LT_HASH = exports.encodeHistorySyncPlaintext = exports.buildHistorySyncMessage = exports.buildHistorySyncExternalMessage = exports.buildAppStateSyncKeyShareMessage = exports.buildIncomingErrorStanza = exports.buildChatstate = exports.buildFailure = exports.buildCall = exports.buildIqResult = exports.buildIqError = exports.parseAppStateSyncRequest = exports.buildServerSyncNotification = exports.buildAppStateSyncResult = exports.buildAppStateSyncFullResult = exports.WaFakeConnection = exports.Scenario = exports.IqExpectation = exports.FakeWaServer = exports.FakePeer = exports.FakePairingDriver = void 0;
+exports.buildStreamErrorXmlNotWellFormed = exports.buildStreamErrorReplaced = exports.buildStreamErrorDeviceRemoved = exports.buildStreamErrorCode = exports.buildStreamErrorAck = exports.PreKeyUploadParseError = exports.parsePreKeyUploadIq = exports.parsePairingQrString = exports.buildPairSuccessIq = exports.buildPairDeviceIq = exports.generateFakePrimaryDevice = exports.buildAdvSignedDeviceIdentity = exports.FakeSenderKey = exports.FakePeerDoubleRatchet = exports.generateFakePeerIdentity = exports.buildReceipt = exports.buildIncomingPresence = exports.buildNotification = exports.buildGroupNotification = exports.buildMessage = exports.FakeMediaStore = exports.FakeAppStateCollection = exports.FakeAppStateCrypto = exports.APP_STATE_EMPTY_LT_HASH = exports.encodeHistorySyncPlaintext = exports.buildHistorySyncMessage = exports.buildHistorySyncExternalMessage = exports.buildAppStateSyncKeyShareMessage = exports.buildIncomingErrorStanza = exports.buildChatstate = exports.buildFailure = exports.buildCall = exports.buildIqResult = exports.buildIqError = exports.parseAppStateSyncRequest = exports.buildServerSyncNotification = exports.buildAppStateSyncResult = exports.buildAppStateSyncFullResult = exports.WaFakeConnection = exports.Scenario = exports.IqExpectation = exports.FakeWaServer = exports.FakeServerSession = exports.FakePeer = exports.FakePairingDriver = void 0;
 var FakePairingDriver_1 = require("./api/FakePairingDriver");
 Object.defineProperty(exports, "FakePairingDriver", { enumerable: true, get: function () { return FakePairingDriver_1.FakePairingDriver; } });
 var FakePeer_1 = require("./api/FakePeer");
 Object.defineProperty(exports, "FakePeer", { enumerable: true, get: function () { return FakePeer_1.FakePeer; } });
 var FakeWaServer_1 = require("./api/FakeWaServer");
+Object.defineProperty(exports, "FakeServerSession", { enumerable: true, get: function () { return FakeWaServer_1.FakeServerSession; } });
 Object.defineProperty(exports, "FakeWaServer", { enumerable: true, get: function () { return FakeWaServer_1.FakeWaServer; } });
 var Scenario_1 = require("./api/Scenario");
 Object.defineProperty(exports, "IqExpectation", { enumerable: true, get: function () { return Scenario_1.IqExpectation; } });

package/dist/infra/WaFakeConnectionPipeline.d.ts

@@ -2,7 +2,6 @@
 import { type FakeNoiseRootCa } from '../protocol/auth/cert-chain';
 import { type ParsedClientPayload } from '../protocol/auth/client-payload-validate';
 import { buildSuccessNode } from '../protocol/auth/success-node';
-import { type WaFakeIqRouter } from '../protocol/iq/router';
 import { type BinaryNode } from '../transport/codec';
 import { type SignalKeyPair } from '../transport/crypto';
 import type { WaFakeConnection } from './WaFakeConnection';
@@ -10,7 +9,12 @@ export interface WaFakeConnectionPipelineConfig {
     readonly connection: WaFakeConnection;
     readonly rootCa: FakeNoiseRootCa;
     readonly serverStaticKeyPair: SignalKeyPair;
-    readonly iqRouter: WaFakeIqRouter;
+    /**
+     * Routes an inbound IQ against the session this connection is bound to.
+     * The server resolves the session per connection, so the pipeline stays
+     * unaware of session identity.
+     */
+    readonly routeIq: (iq: BinaryNode) => Promise<BinaryNode | null>;
     readonly successNodeAttributes?: Parameters<typeof buildSuccessNode>[0];
 }
 export interface WaFakeConnectionPipelineEvents {
@@ -33,9 +37,12 @@ export declare class WaFakeConnectionPipeline {
     private events;
     private state;
     private chain;
+    private authenticatedPayload;
     constructor(config: WaFakeConnectionPipelineConfig);
     setEvents(events: WaFakeConnectionPipelineEvents): void;
     isAuthenticated(): boolean;
+    /** Parsed ClientPayload of the authenticated connection; null before auth. */
+    get clientPayload(): ParsedClientPayload | null;
     sendStanza(node: BinaryNode): Promise<void>;
     private onPrologue;
     private scheduleFrame;
@@ -45,6 +52,7 @@ export declare class WaFakeConnectionPipeline {
     /** Server-side IK path used when the client already cached our static key. */
     private handleIkClientHello;
     private handleClientFinish;
+    private completeAuthentication;
     private handleAuthenticatedFrame;
     private fail;
 }

package/dist/infra/WaFakeConnectionPipeline.js

@@ -19,6 +19,7 @@ class WaFakeConnectionPipeline {
         this.events = {};
         this.state = { kind: 'awaiting_prologue' };
         this.chain = Promise.resolve();
+        this.authenticatedPayload = null;
         this.config = config;
         this.frameSocket = new WaFakeFrameSocket_1.WaFakeFrameSocket(config.connection);
         this.frameSocket.setHandlers({
@@ -37,6 +38,10 @@ class WaFakeConnectionPipeline {
     isAuthenticated() {
         return this.state.kind === 'authenticated';
     }
+    /** Parsed ClientPayload of the authenticated connection; null before auth. */
+    get clientPayload() {
+        return this.authenticatedPayload;
+    }
     async sendStanza(node) {
         if (this.state.kind !== 'authenticated') {
             throw new Error(`cannot send stanza while pipeline is in state "${this.state.kind}"`);
@@ -156,14 +161,7 @@ class WaFakeConnectionPipeline {
             }
         }).finish();
         this.frameSocket.sendFrame(serverHello);
-        const keys = handshake.finish();
-        const transport = new WaFakeTransport_1.WaFakeTransport({
-            recvKey: keys.recvKey,
-            sendKey: keys.sendKey
-        });
-        this.state = { kind: 'authenticated', transport };
-        await this.sendStanza((0, success_node_1.buildSuccessNode)(this.config.successNodeAttributes));
-        this.events.onAuthenticated?.({ clientPayload, clientStaticKey });
+        await this.completeAuthentication(handshake, clientPayload, clientStaticKey);
     }
     async handleClientFinish(frame, handshake, serverEphemeralKeyPair) {
         const parsed = protos_1.proto.HandshakeMessage.decode(frame);
@@ -175,13 +173,27 @@ class WaFakeConnectionPipeline {
         handshake.mixIntoKey(await crypto_1.X25519.scalarMult(serverEphemeralKeyPair.privKey, clientStaticKey));
         const clientPayloadBytes = handshake.decrypt(clientFinish.payload);
         const clientPayload = (0, client_payload_validate_1.parseClientPayload)(clientPayloadBytes);
+        await this.completeAuthentication(handshake, clientPayload, clientStaticKey);
+    }
+    async completeAuthentication(handshake, clientPayload, clientStaticKey) {
         const keys = handshake.finish();
         const transport = new WaFakeTransport_1.WaFakeTransport({
             recvKey: keys.recvKey,
             sendKey: keys.sendKey
         });
         this.state = { kind: 'authenticated', transport };
+        this.authenticatedPayload = clientPayload;
         await this.sendStanza((0, success_node_1.buildSuccessNode)(this.config.successNodeAttributes));
+        if (clientPayload.kind === 'login') {
+            // Real WA drains offline messages after login and closes the
+            // drain with this bulletin. Baileys-family clients buffer their
+            // events until it arrives, so send it eagerly with count=0.
+            await this.sendStanza({
+                tag: 'ib',
+                attrs: { from: 's.whatsapp.net' },
+                content: [{ tag: 'offline', attrs: { count: '0' } }]
+            });
+        }
         this.events.onAuthenticated?.({ clientPayload, clientStaticKey });
     }
     async handleAuthenticatedFrame(frame, transport) {
@@ -189,7 +201,7 @@ class WaFakeConnectionPipeline {
         const node = await (0, codec_1.decodeBinaryNodeStanza)(stanzaBytes);
         this.events.onStanza?.(node);
         if (node.tag === 'iq') {
-            const response = await this.config.iqRouter.route(node);
+            const response = await this.config.routeIq(node);
             if (response !== null) {
                 await this.sendStanza(response);
             }

package/dist/protocol/auth/cert-chain.d.ts

@@ -12,6 +12,10 @@ export interface BuildFakeCertChainInput {
     readonly leafKey: Uint8Array;
     readonly intermediateSerial?: number;
     readonly leafSerial?: number;
+    /** Unix seconds. Defaults to 24h before build time. */
+    readonly notBefore?: number;
+    /** Unix seconds. Defaults to 10 years after build time. */
+    readonly notAfter?: number;
 }
 export declare function generateFakeNoiseRootCa(): Promise<FakeNoiseRootCa>;
 export declare function buildFakeCertChain(input: BuildFakeCertChainInput): Promise<FakeCertChainResult>;

package/dist/protocol/auth/cert-chain.js

@@ -5,6 +5,8 @@ exports.generateFakeNoiseRootCa = generateFakeNoiseRootCa;
 exports.buildFakeCertChain = buildFakeCertChain;
 const crypto_1 = require("../../transport/crypto");
 const protos_1 = require("../../transport/protos");
+const WA_CERT_NOT_BEFORE_BACKDATE_SECONDS = 86400;
+const WA_CERT_NOT_AFTER_LIFETIME_SECONDS = 315360000;
 async function generateFakeNoiseRootCa() {
     const keyPair = await crypto_1.X25519.generateKeyPair();
     return {
@@ -16,17 +18,26 @@ async function generateFakeNoiseRootCa() {
 async function buildFakeCertChain(input) {
     const intermediateSerial = input.intermediateSerial ?? 1;
     const leafSerial = input.leafSerial ?? 2;
+    // Strict clients (e.g. whatsmeow) enforce the validity window; leaving
+    // notBefore/notAfter unset decodes as 0 (1970) and reads as expired.
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    const notBefore = input.notBefore ?? nowSeconds - WA_CERT_NOT_BEFORE_BACKDATE_SECONDS;
+    const notAfter = input.notAfter ?? nowSeconds + WA_CERT_NOT_AFTER_LIFETIME_SECONDS;
     const intermediateKeyPair = await crypto_1.X25519.generateKeyPair();
     const intermediateDetails = protos_1.proto.CertChain.NoiseCertificate.Details.encode({
         serial: intermediateSerial,
         issuerSerial: input.root.serial,
-        key: intermediateKeyPair.pubKey
+        key: intermediateKeyPair.pubKey,
+        notBefore,
+        notAfter
     }).finish();
     const intermediateSignature = await (0, crypto_1.xeddsaSign)(input.root.privateKey, intermediateDetails);
     const leafDetails = protos_1.proto.CertChain.NoiseCertificate.Details.encode({
         serial: leafSerial,
         issuerSerial: intermediateSerial,
-        key: input.leafKey
+        key: input.leafKey,
+        notBefore,
+        notAfter
     }).finish();
     const leafSignature = await (0, crypto_1.xeddsaSign)(intermediateKeyPair.privKey, leafDetails);
     const encoded = protos_1.proto.CertChain.encode({

package/dist/protocol/iq/router.d.ts

@@ -7,7 +7,13 @@ export interface WaFakeIqMatcher {
     readonly xmlns?: string;
     readonly childTag?: string;
 }
-export type WaFakeIqResponder = (iq: BinaryNode) => BinaryNode | Promise<BinaryNode>;
+/**
+ * Returns the response stanza, or `null` to fall through: the router keeps
+ * scanning lower-priority handlers as if this one had not matched. Lets a
+ * high-priority handler observe an IQ (capture, log, assert) while the
+ * default handler still answers it.
+ */
+export type WaFakeIqResponder = (iq: BinaryNode) => BinaryNode | null | Promise<BinaryNode | null>;
 export interface WaFakeIqHandler {
     readonly matcher: WaFakeIqMatcher;
     readonly respond: WaFakeIqResponder;

package/dist/protocol/iq/router.js

@@ -30,12 +30,18 @@ class WaFakeIqRouter {
         }
         for (const handler of this.highPriorityHandlers) {
             if (matches(iq, handler.matcher)) {
-                return handler.respond(iq);
+                const response = await handler.respond(iq);
+                if (response !== null) {
+                    return response;
+                }
             }
         }
         for (const handler of this.handlers) {
             if (matches(iq, handler.matcher)) {
-                return handler.respond(iq);
+                const response = await handler.respond(iq);
+                if (response !== null) {
+                    return response;
+                }
             }
         }
         this.events.onUnhandled?.(iq);

package/dist/transport/util.d.ts

@@ -4,5 +4,5 @@
  * Re-exports bit-exact byte helpers from zapo-js so Layer 2/3 of the fake
  * server can use them without importing zapo-js directly.
  */
-export { bytesToBase64, bytesToBase64UrlSafe, bytesToHex, decodeBase64Url } from 'zapo-js/util';
+export { bytesToBase64, bytesToBase64UrlSafe, bytesToHex, decodeBase64Url, toError } from 'zapo-js/util';
 export declare const TEXT_ENCODER: import("util").TextEncoder;

package/dist/transport/util.js

@@ -6,10 +6,11 @@
  * server can use them without importing zapo-js directly.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TEXT_ENCODER = exports.decodeBase64Url = exports.bytesToHex = exports.bytesToBase64UrlSafe = exports.bytesToBase64 = void 0;
+exports.TEXT_ENCODER = exports.toError = exports.decodeBase64Url = exports.bytesToHex = exports.bytesToBase64UrlSafe = exports.bytesToBase64 = void 0;
 var util_1 = require("zapo-js/util");
 Object.defineProperty(exports, "bytesToBase64", { enumerable: true, get: function () { return util_1.bytesToBase64; } });
 Object.defineProperty(exports, "bytesToBase64UrlSafe", { enumerable: true, get: function () { return util_1.bytesToBase64UrlSafe; } });
 Object.defineProperty(exports, "bytesToHex", { enumerable: true, get: function () { return util_1.bytesToHex; } });
 Object.defineProperty(exports, "decodeBase64Url", { enumerable: true, get: function () { return util_1.decodeBase64Url; } });
+Object.defineProperty(exports, "toError", { enumerable: true, get: function () { return util_1.toError; } });
 exports.TEXT_ENCODER = new TextEncoder();

package/package.json

@@ -1,9 +1,14 @@
 {
     "name": "@zapo-js/fake-server",
-    "version": "1.0.0",
+    "version": "1.1.0",
     "description": "Fake WhatsApp Web server used to test zapo-js",
     "license": "MIT",
     "author": "vinikjkkj <contact@vinicius.email> (https://github.com/vinikjkkj)",
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/vinikjkkj/zapo.git",
+        "directory": "packages/fake-server"
+    },
     "main": "dist/index.js",
     "module": "dist/esm/index.js",
     "types": "dist/index.d.ts",