nodejs-insta-private-api-mqt 1.3.87 → 1.3.89

package/dist/dist/repositories/account.repository.js

@@ -45,7 +45,7 @@ class AccountRepository extends Repository {
             }
         }
 
-        // Simpler: look for any header that contains ig-set-authorization
+        // 1) Try straight headers for IG-Set-Authorization
         for (const key of Object.keys(headers)) {
             const val = headers[key];
             if (!val) continue;
@@ -60,7 +60,6 @@ class AccountRepository extends Repository {
                     return token;
                 }
             }
-            // Some servers include the header value inside a JSON-like string in other headers
             if (typeof val === 'string' && val.includes('Bearer IGT:2:')) {
                 const token = this._findBearerInString(val);
                 if (token) {
@@ -120,10 +119,9 @@ class AccountRepository extends Repository {
             }
         }
 
-        // 2) Check response.body for common fields
+        // 2) Check response.body for common fields / embedded layout/login_response
         const body = response.body;
         if (body) {
-            // If body has headers string (some responses embed headers JSON as a string)
             if (body.headers && typeof body.headers === 'string') {
                 const token = this._findBearerInString(body.headers);
                 if (token) {
@@ -135,22 +133,20 @@ class AccountRepository extends Repository {
                 }
             }
 
-            // If body contains a layout object or string, stringify and search it
             try {
                 let layoutStr = null;
                 if (body.layout) {
-                    layoutStr =
-                        typeof body.layout === 'string'
-                            ? body.layout
-                            : JSON.stringify(body.layout);
+                    layoutStr = typeof body.layout === 'string'
+                        ? body.layout
+                        : JSON.stringify(body.layout);
                 } else if (body?.layout?.bloks_payload) {
                     layoutStr = JSON.stringify(body.layout.bloks_payload);
                 } else if (body?.bloks_payload) {
                     layoutStr = JSON.stringify(body.bloks_payload);
-                }
-                if (!layoutStr && typeof body === 'string') {
+                } else if (typeof body === 'string') {
                     layoutStr = body;
                 }
+
                 if (layoutStr) {
                     const token = this._findBearerInString(layoutStr);
                     if (token) {
@@ -161,12 +157,11 @@ class AccountRepository extends Repository {
                         return token;
                     }
 
-                    // Some responses embed a login_response JSON string inside layout; try to extract it
+                    // Embedded login_response JSON string
                     const loginResponseMatch = layoutStr.match(
                         /"login_response"\s*:\s*"(\\?{.*?\\?})"/s
                     );
                     if (loginResponseMatch) {
-                        // Unescape JSON string
                         let jsonStr = loginResponseMatch[1];
                         try {
                             jsonStr = jsonStr
@@ -174,23 +169,19 @@ class AccountRepository extends Repository {
                                 .replace(/\\n/g, '');
                             const parsed = JSON.parse(jsonStr);
                             if (parsed && parsed.headers) {
-                                const token = this._findBearerInString(
-                                    parsed.headers
-                                );
-                                if (token) {
-                                    this.client.state.authorization = token;
+                                const t = this._findBearerInString(parsed.headers);
+                                if (t) {
+                                    this.client.state.authorization = t;
                                     try {
                                         this.client.state.updateAuthorization();
                                     } catch (e) {}
-                                    return token;
+                                    return t;
                                 }
                             }
-                        } catch (e) {
-                            // ignore parse errors
-                        }
+                        } catch (e) {}
                     }
 
-                    // Also try to find IG-Set-Password-Encryption headers (not token but useful)
+                    // Encryption key id + pub key in layout
                     const encKeyIdMatch =
                         layoutStr.match(
                             /IG-Set-Password-Encryption-Key-Id[\\"\s:]+(\d+)/i
@@ -202,6 +193,7 @@ class AccountRepository extends Repository {
                         this.client.state.passwordEncryptionKeyId =
                             parseInt(encKeyIdMatch[1]);
                     }
+
                     const encPubKeyMatch =
                         layoutStr.match(
                             /IG-Set-Password-Encryption-Pub-Key[\\"\s:]+([A-Za-z0-9+\/=]+)/i
@@ -214,15 +206,13 @@ class AccountRepository extends Repository {
                             encPubKeyMatch[1];
                     }
 
-                    // Extract user/account identifiers from layout string
+                    // User / pk id
                     const dsIdMatch =
                         layoutStr.match(
                             /ig-set-ig-u-ds-user-id[\\"\s:]+(\d+)/i
                         ) ||
                         layoutStr.match(/ig-u-ds-user-id[\\"\s:]+(\d+)/i) ||
-                        layoutStr.match(
-                            /"strong_id__"\s*:\s*"(\d+)"/i
-                        ) ||
+                        layoutStr.match(/"strong_id__"\s*:\s*"(\d+)"/i) ||
                         layoutStr.match(/"pk_id"\s*:\s*"(\d+)"/i) ||
                         layoutStr.match(/"pk"\s*:\s*(\d+)/i);
                     if (dsIdMatch) {
@@ -254,11 +244,8 @@ class AccountRepository extends Repository {
                         this.client.state.mid = midMatch[1];
                     }
                 }
-            } catch (e) {
-                // ignore
-            }
+            } catch (e) {}
 
-            // 3) If body.logged_in_user exists and we have authorization already, return it
             if (body.logged_in_user && this.client.state.authorization) {
                 return this.client.state.authorization;
             }
@@ -267,15 +254,12 @@ class AccountRepository extends Repository {
         return null;
     }
 
-    // Normalize token string: accept either raw token or "Bearer IGT:2:..." and return trimmed token string
     _normalizeTokenString(val) {
         if (!val || typeof val !== 'string') return null;
 
-        // If header already contains "Bearer IGT:2:..."
         const bearer = this._findBearerInString(val);
         if (bearer) return bearer;
 
-        // If header contains JSON with IG-Set-Authorization field
         try {
             const maybeJson = JSON.parse(val);
             if (maybeJson['IG-Set-Authorization']) {
@@ -283,19 +267,14 @@ class AccountRepository extends Repository {
                     maybeJson['IG-Set-Authorization']
                 );
             }
-        } catch (e) {
-            // not JSON
-        }
+        } catch (e) {}
 
-        // fallback: return trimmed value
         return val.trim();
     }
 
-    // Find bearer token in arbitrary string using multiple patterns
     _findBearerInString(str) {
         if (!str || typeof str !== 'string') return null;
 
-        // Patterns to match the Bearer token in many possible encodings/escapes
         const bearerPatterns = [
             /Bearer IGT:2:[A-Za-z0-9+\/=]+/,
             /Bearer\s+IGT:2:[A-Za-z0-9+\/=]+/,
@@ -309,14 +288,12 @@ class AccountRepository extends Repository {
         for (const pattern of bearerPatterns) {
             const m = str.match(pattern);
             if (m) {
-                // If capturing group present, prefer it
                 if (m[1]) {
                     const token = m[1].includes('Bearer IGT:2:')
                         ? m[1]
                         : `Bearer IGT:2:${m[1]}`;
                     return token.replace(/\?"/g, '').trim();
                 }
-                // Otherwise m[0] contains the full token
                 return m[0].replace(/\?"/g, '').trim();
             }
         }
@@ -324,8 +301,35 @@ class AccountRepository extends Repository {
         return null;
     }
 
+    /**
+     * NEW helper: resolve a valid User-Agent from state / request / deviceString
+     * so it works even if scriptul tău nu setează explicit state.userAgent.
+     */
+    _resolveUserAgent() {
+        const state = this.client.state || {};
+        const req = this.client.request || {};
+
+        const candidates = [
+            state.userAgent,
+            state.appUserAgent,
+            req.userAgent,
+            state.deviceString,
+        ].filter(Boolean);
+
+        let userAgent = candidates.length > 0 ? candidates[0] : null;
+
+        if (!userAgent) {
+            // Fallback – Pixel 9 Pro style UA (nu mai e Xiaomi)
+            userAgent =
+                'Instagram 371.0.0.0.23 Android (35/15; 505dpi; 1440x3120; google; Pixel 9 Pro; pixel9pro; qcom; ro_RO; 703217507)';
+        }
+
+        // Sincronizăm în state ca să fie disponibil peste tot
+        this.client.state.userAgent = userAgent;
+        return userAgent;
+    }
+
     // Ensure we have a valid csrftoken cookie (and mid) before sensitive endpoints.
-    // Instagram typically sets csrftoken via /api/v1/si/fetch_headers/.
     async ensureCsrfToken() {
         const cookieToken = this.client.state.cookieCsrfToken;
         if (
@@ -339,15 +343,12 @@ class AccountRepository extends Repository {
             return cookieToken;
         }
 
-        // Warmup endpoint that returns/set cookies (csrftoken, mid, etc.)
         try {
             await this.client.request.send({
                 method: 'GET',
                 url: `/api/v1/si/fetch_headers/?challenge_type=signup&guid=${this.client.state.uuid}`,
             });
-        } catch (e) {
-            // ignore warmup failures
-        }
+        } catch (e) {}
 
         const token = this.client.state.cookieCsrfToken;
         if (
@@ -365,9 +366,8 @@ class AccountRepository extends Repository {
     }
 
     /**
-     * Internal: perform the Bloks OAuth token fetch step that the official app does
-     * just before password login (com.bloks.www.caa.login.oauth.token.fetch.async).
-     * This is best-effort only and never throws to the caller.
+     * Internal: pre-login Bloks OAuth token fetch, imită exact apelul oficial
+     * com.bloks.www.caa.login.oauth.token.fetch.async
      */
     async _prefetchOauthTokenForLogin(username) {
         if (!username) return null;
@@ -375,7 +375,6 @@ class AccountRepository extends Repository {
         try {
             const nowSec = Math.floor(Date.now() / 1000);
 
-            // Device identifiers – keep them consistent with the main login flow
             const androidDeviceId =
                 this.client.state.androidDeviceId ||
                 this.client.state.deviceId ||
@@ -404,7 +403,6 @@ class AccountRepository extends Repository {
                 `${Date.now()}${Math.floor(Math.random() * 1000)}`
             );
 
-            // AAC object as seen in real traffic: timestamp + UUID + random token
             const aacInitTimestamp =
                 nowSec - Math.floor(Math.random() * 50);
             const aacjid = crypto.randomUUID
@@ -460,9 +458,7 @@ class AccountRepository extends Repository {
 
             const lang = this.client.state.language || 'ro_RO';
             const acceptLanguage = `${lang.replace('_', '-')}, en-US`;
-            const userAgent =
-                this.client.state.userAgent ||
-                'Instagram 371.0.0.0.23 Android (30/11; 320dpi; 720x1449; Xiaomi/Redmi; M2006C3MNG; angelican; mt6765; ro_RO; 703217507)';
+            const userAgent = this._resolveUserAgent();
 
             const timezoneOffset =
                 typeof this.client.state.timezoneOffset === 'number'
@@ -474,7 +470,6 @@ class AccountRepository extends Repository {
                 'content-type':
                     'application/x-www-form-urlencoded; charset=UTF-8',
                 'ig-intended-user-id': '0',
-                // Critical: matches the captured request header
                 priority: 'u=3',
 
                 'x-bloks-is-layout-rtl': 'false',
@@ -556,7 +551,6 @@ class AccountRepository extends Repository {
                 headers: bloksHeaders,
             });
 
-            // Optional debug dump so you can inspect the exact server response.
             try {
                 const fs = require('fs');
                 const path = require('path');
@@ -584,13 +578,466 @@ class AccountRepository extends Repository {
                     JSON.stringify(debugPayload, null, 2),
                     'utf8'
                 );
-            } catch (e) {
-                // Never break login on debug error
-            }
+            } catch (e) {}
+
+            return response.body;
+        } catch (e) {
+            return null;
+        }
+    }
+
+    /**
+     * Step 1: launcher/mobileconfig to fetch mobile config + encryption keys.
+     * Best effort – errors are ignored.
+     */
+    async _launcherMobileConfig(preLogin = true) {
+        const nowSec = Math.floor(Date.now() / 1000);
+        const state = this.client.state || {};
+
+        const androidDeviceId =
+            state.androidDeviceId ||
+            state.deviceId ||
+            `android-${crypto.randomBytes(8).toString('hex')}`;
+
+        const familyDeviceId =
+            state.phoneId ||
+            state.familyDeviceId ||
+            (crypto.randomUUID
+                ? crypto.randomUUID()
+                : require('uuid').v4());
+
+        const qeDeviceId =
+            state.deviceId ||
+            state.qeDeviceId ||
+            (crypto.randomUUID
+                ? crypto.randomUUID()
+                : require('uuid').v4());
+
+        const deviceUUID = state.uuid || qeDeviceId;
+        const userId = state.cookieUserId || '0';
+
+        const bloksVersionId =
+            state.bloksVersionId ||
+            '5e47baf35c5a270b44c8906c8b99063564b30ef69779f3dee0b828bee2e4ef5b';
+
+        const lang = state.language || 'ro_RO';
+        const acceptLanguage = `${lang.replace('_', '-')}, en-US`;
+        const userAgent = this._resolveUserAgent();
+
+        const timezoneOffset =
+            typeof state.timezoneOffset === 'number'
+                ? state.timezoneOffset
+                : 7200;
+
+        const params = {
+            bool_opt_policy: '0',
+            mobileconfig: '',
+            api_version: '9',
+            client_context: '["opt,value_hash"]',
+            unit_type: '2',
+            use_case: 'STANDARD',
+            query_hash:
+                'f00b9d0869db3969378d8d06bfccb24b5ef078012c8e199cba961cd5dfedaa88',
+            ts: String(nowSec),
+            _uid: userId,
+            device_id: deviceUUID,
+            _uuid: deviceUUID,
+            fetch_mode: 'CONFIG_SYNC_ONLY',
+            fetch_type: 'ASYNC_FULL',
+        };
+
+        const headers = {
+            'accept-language': acceptLanguage,
+            'content-type':
+                'application/x-www-form-urlencoded; charset=UTF-8',
+            priority: 'u=3',
+
+            'x-bloks-is-layout-rtl': 'false',
+            'x-bloks-prism-ax-base-colors-enabled': 'false',
+            'x-bloks-prism-button-version': 'CONTROL',
+            'x-bloks-prism-colors-enabled': 'true',
+            'x-bloks-prism-font-enabled': 'false',
+            'x-bloks-prism-indigo-link-version': '0',
+            'x-bloks-version-id': bloksVersionId,
+
+            'x-fb-client-ip': 'True',
+            'x-fb-connection-type': 'WIFI',
+            'x-fb-server-cluster': 'True',
+            'x-fb-network-properties':
+                'VPN;Validated;LocalAddrs=/10.0.0.2,;',
+            'x-fb-http-engine': 'MNS/TCP',
+            'x-fb-rmd': 'state=URL_ELIGIBLE',
+
+            'x-ig-android-id': androidDeviceId,
+            'x-ig-app-id': String(
+                state.fbAnalyticsApplicationId || '567067343352427'
+            ),
+            'x-ig-app-locale': lang,
+            'x-ig-bandwidth-speed-kbps': (
+                Math.random() * 1500 +
+                800
+            ).toFixed(3),
+            'x-ig-bandwidth-totalbytes-b': '0',
+            'x-ig-bandwidth-totaltime-ms': '0',
+            'x-ig-client-endpoint':
+                'LockoutFragment:dogfooding_lockout',
+            'x-ig-capabilities': '3brTv10=',
+            'x-ig-connection-type': 'WIFI',
+            'x-ig-device-id': deviceUUID,
+            'x-ig-device-languages': '{"system_languages":"ro-RO"}',
+            'x-ig-device-locale': lang,
+            'x-ig-family-device-id': familyDeviceId,
+            'x-ig-mapped-locale': lang,
+            'x-ig-nav-chain':
+                'LockoutFragment:dogfooding_lockout:1:cold_start',
+            'x-ig-salt-ids':
+                '220140399,332020310,974466465,974460658',
+            'x-ig-timezone-offset': String(timezoneOffset),
+            'x-ig-www-claim': state.igWWWClaim || '0',
+            'x-mid':
+                state.mid ||
+                state.machineId ||
+                `aZ${crypto.randomBytes(8).toString('hex')}`,
+            'x-pigeon-rawclienttime': `${nowSec}.${Math.floor(
+                Math.random() * 1000
+            )
+                .toString()
+                .padStart(3, '0')}`,
+            'x-pigeon-session-id':
+                state.pigeonSessionId ||
+                `UFS-${crypto.randomBytes(16).toString('hex')}-M`,
+            'x-tigon-is-retry': 'False',
+
+            'accept-encoding': 'gzip, deflate, br',
+            'user-agent': userAgent,
+        };
+
+        if (state.cookieUserId) {
+            headers['ig-intended-user-id'] = String(state.cookieUserId);
+            headers['ig-u-ds-user-id'] = String(state.cookieUserId);
+        }
+        if (state.igURur) {
+            headers['ig-u-rur'] = state.igURur;
+        }
+        if (state.authorization) {
+            headers['authorization'] = state.authorization;
+        }
+
+        try {
+            const response = await this.client.request.send({
+                method: 'POST',
+                url: '/api/v1/launcher/mobileconfig/',
+                form: this.client.request.sign(params),
+                headers,
+            });
+
+            try {
+                const fs = require('fs');
+                const path = require('path');
+                const debugDir = path.join(
+                    process.cwd(),
+                    'authinfo_instagram'
+                );
+                const debugFile = path.join(
+                    debugDir,
+                    'launcher-mobileconfig-debug.json'
+                );
+                try {
+                    fs.mkdirSync(debugDir, { recursive: true });
+                } catch (e) {}
+                const debugPayload = {
+                    at: new Date().toISOString(),
+                    statusCode:
+                        response.statusCode || response.status || null,
+                    headers: response.headers || null,
+                    body: response.body || null,
+                };
+                fs.writeFileSync(
+                    debugFile,
+                    JSON.stringify(debugPayload, null, 2),
+                    'utf8'
+                );
+            } catch (e) {}
+
+            return response.body;
+        } catch (e) {
+            return null;
+        }
+    }
+
+    /**
+     * Step 2: Android Keystore attestation – moves x-ig-attest-params
+     * payload to dedicated endpoint /api/v1/attestation/create_android_keystore/.
+     */
+    async _createAndroidKeystoreAttestation() {
+        const state = this.client.state || {};
+        const nowSec = Math.floor(Date.now() / 1000);
+
+        const androidDeviceId =
+            state.androidDeviceId ||
+            state.deviceId ||
+            `android-${crypto.randomBytes(8).toString('hex')}`;
+
+        const familyDeviceId =
+            state.phoneId ||
+            state.familyDeviceId ||
+            (crypto.randomUUID
+                ? crypto.randomUUID()
+                : require('uuid').v4());
+
+        const qeDeviceId =
+            state.deviceId ||
+            state.qeDeviceId ||
+            (crypto.randomUUID
+                ? crypto.randomUUID()
+                : require('uuid').v4());
+
+        const deviceUUID = state.uuid || qeDeviceId;
+        const userId = state.cookieUserId || '0';
+
+        const attestParams =
+            AccountRepository.generateAttestParams(state);
+
+        const lang = state.language || 'ro_RO';
+        const acceptLanguage = `${lang.replace('_', '-')}, en-US`;
+        const userAgent = this._resolveUserAgent();
+        const timezoneOffset =
+            typeof state.timezoneOffset === 'number'
+                ? state.timezoneOffset
+                : 7200;
+
+        const params = {
+            _uid: userId,
+            _uuid: deviceUUID,
+            device_id: androidDeviceId,
+            family_device_id: familyDeviceId,
+            ts: String(nowSec),
+            ...attestParams,
+        };
+
+        const headers = {
+            'accept-language': acceptLanguage,
+            'content-type':
+                'application/x-www-form-urlencoded; charset=UTF-8',
+            priority: 'u=3',
+
+            'x-ig-android-id': androidDeviceId,
+            'x-ig-device-id': qeDeviceId,
+            'x-ig-family-device-id': familyDeviceId,
+            'x-ig-timezone-offset': String(timezoneOffset),
+            'x-ig-app-id': String(
+                state.fbAnalyticsApplicationId || '567067343352427'
+            ),
+            'x-ig-app-locale': lang,
+            'x-ig-device-locale': lang,
+            'x-ig-mapped-locale': lang,
+            'x-ig-connection-type': 'WIFI',
+            'x-ig-capabilities': '3brTv10=',
+            'x-ig-www-claim': state.igWWWClaim || '0',
+
+            'x-pigeon-rawclienttime': `${nowSec}.${Math.floor(
+                Math.random() * 1000
+            )
+                .toString()
+                .padStart(3, '0')}`,
+            'x-pigeon-session-id':
+                state.pigeonSessionId ||
+                `UFS-${crypto.randomBytes(16).toString('hex')}-A`,
+            'x-mid':
+                state.mid ||
+                state.machineId ||
+                `aZ${crypto.randomBytes(8).toString('hex')}`,
+
+            'x-fb-client-ip': 'True',
+            'x-fb-connection-type': 'WIFI',
+            'x-fb-server-cluster': 'True',
+            'x-fb-http-engine': 'MNS/TCP',
+            'x-fb-network-properties':
+                'VPN;Validated;LocalAddrs=/10.0.0.2,;',
+            'x-fb-rmd': 'state=URL_ELIGIBLE',
+
+            'accept-encoding': 'gzip, deflate, br',
+            'user-agent': userAgent,
+        };
+
+        if (state.cookieUserId) {
+            headers['ig-intended-user-id'] = String(state.cookieUserId);
+        }
+        if (state.authorization) {
+            headers['authorization'] = state.authorization;
+        }
+        if (state.igURur) {
+            headers['ig-u-rur'] = state.igURur;
+        }
+
+        try {
+            const response = await this.client.request.send({
+                method: 'POST',
+                url: '/api/v1/attestation/create_android_keystore/',
+                form: this.client.request.sign(params),
+                headers,
+            });
+
+            try {
+                const fs = require('fs');
+                const path = require('path');
+                const debugDir = path.join(
+                    process.cwd(),
+                    'authinfo_instagram'
+                );
+                const debugFile = path.join(
+                    debugDir,
+                    'attestation-debug.json'
+                );
+                try {
+                    fs.mkdirSync(debugDir, { recursive: true });
+                } catch (e) {}
+                const debugPayload = {
+                    at: new Date().toISOString(),
+                    statusCode:
+                        response.statusCode || response.status || null,
+                    headers: response.headers || null,
+                    body: response.body || null,
+                };
+                fs.writeFileSync(
+                    debugFile,
+                    JSON.stringify(debugPayload, null, 2),
+                    'utf8'
+                );
+            } catch (e) {}
+
+            return response.body;
+        } catch (e) {
+            return null;
+        }
+    }
+
+    /**
+     * Step 3 & 4 & 5 helpers: Terms of service preload, process client data,
+     * and (optional) phone number prefill.
+     * These are best-effort calls; failures are ignored.
+     */
+    async _preloadTermsOfService() {
+        const state = this.client.state || {};
+        const lang = state.language || 'ro_RO';
+        const acceptLanguage = `${lang.replace('_', '-')}, en-US`;
+        const userAgent = this._resolveUserAgent();
+        const bloksVersionId =
+            state.bloksVersionId ||
+            '5e47baf35c5a270b44c8906c8b99063564b30ef69779f3dee0b828bee2e4ef5b';
+
+        const paramsJson = JSON.stringify({});
+        const bkClientContext = JSON.stringify({
+            bloks_version: bloksVersionId,
+            styles_id: 'instagram',
+        });
+
+        const headers = {
+            'accept-language': acceptLanguage,
+            'content-type':
+                'application/x-www-form-urlencoded; charset=UTF-8',
+            priority: 'u=3',
+            'x-bloks-version-id': bloksVersionId,
+            'user-agent': userAgent,
+        };
+
+        try {
+            const response = await this.client.request.send({
+                method: 'POST',
+                url: '/api/v1/bloks/apps/com.bloks.www.caa.login.oxygen_preloads_terms_of_service/',
+                form: {
+                    params: paramsJson,
+                    bk_client_context: bkClientContext,
+                    bloks_versioning_id: bloksVersionId,
+                },
+                headers,
+            });
+            return response.body;
+        } catch (e) {
+            return null;
+        }
+    }
+
+    async _processClientDataAndRedirect(username) {
+        const state = this.client.state || {};
+        const lang = state.language || 'ro_RO';
+        const acceptLanguage = `${lang.replace('_', '-')}, en-US`;
+        const userAgent = this._resolveUserAgent();
+        const bloksVersionId =
+            state.bloksVersionId ||
+            '5e47baf35c5a270b44c8906c8b99063564b30ef69779f3dee0b828bee2e4ef5b';
+
+        const paramsJson = JSON.stringify({
+            username_input: username || '',
+        });
+        const bkClientContext = JSON.stringify({
+            bloks_version: bloksVersionId,
+            styles_id: 'instagram',
+        });
+
+        const headers = {
+            'accept-language': acceptLanguage,
+            'content-type':
+                'application/x-www-form-urlencoded; charset=UTF-8',
+            priority: 'u=3',
+            'x-bloks-version-id': bloksVersionId,
+            'user-agent': userAgent,
+        };
+
+        try {
+            const response = await this.client.request.send({
+                method: 'POST',
+                url: '/api/v1/bloks/async_action/com.bloks.www.bloks.caa.login.process_client_data_and_redirect/',
+                form: {
+                    params: paramsJson,
+                    bk_client_context: bkClientContext,
+                    bloks_versioning_id: bloksVersionId,
+                },
+                headers,
+            });
+            return response.body;
+        } catch (e) {
+            return null;
+        }
+    }
 
+    async _phoneNumberPrefill() {
+        const state = this.client.state || {};
+        const lang = state.language || 'ro_RO';
+        const acceptLanguage = `${lang.replace('_', '-')}, en-US`;
+        const userAgent = this._resolveUserAgent();
+        const bloksVersionId =
+            state.bloksVersionId ||
+            '5e47baf35c5a270b44c8906c8b99063564b30ef69779f3dee0b828bee2e4ef5b';
+
+        const paramsJson = JSON.stringify({});
+        const bkClientContext = JSON.stringify({
+            bloks_version: bloksVersionId,
+            styles_id: 'instagram',
+        });
+
+        const headers = {
+            'accept-language': acceptLanguage,
+            'content-type':
+                'application/x-www-form-urlencoded; charset=UTF-8',
+            priority: 'u=3',
+            'x-bloks-version-id': bloksVersionId,
+            'user-agent': userAgent,
+        };
+
+        try {
+            const response = await this.client.request.send({
+                method: 'POST',
+                url: '/api/v1/bloks/async_action/com.bloks.www.bloks.caa.phone.number.prefill.async.controller/',
+                form: {
+                    params: paramsJson,
+                    bk_client_context: bkClientContext,
+                    bloks_versioning_id: bloksVersionId,
+                },
+                headers,
+            });
             return response.body;
         } catch (e) {
-            // Completely swallow any errors; this step should never break login.
             return null;
         }
     }
@@ -618,19 +1065,32 @@ class AccountRepository extends Repository {
 
         const { encrypted, time } = this.encryptPassword(password);
 
-        // optional CSRF warmup (like app does before login)
         await this.ensureCsrfToken();
 
-        // Pre-login Bloks OAuth token fetch (mirrors captured request).
-        // This helps the flow look closer to the real app, but is best-effort only.
+        // Step 1–5: mobileconfig, keystore attestation, TOS preload, process client data, phone prefill
+        try {
+            await this._launcherMobileConfig(true);
+        } catch (e) {}
+        try {
+            await this._createAndroidKeystoreAttestation();
+        } catch (e) {}
+        try {
+            await this._preloadTermsOfService();
+        } catch (e) {}
+        try {
+            await this._processClientDataAndRedirect(username);
+        } catch (e) {}
+        try {
+            await this._phoneNumberPrefill();
+        } catch (e) {}
+
+        // Step 6: OAuth token fetch
         try {
             await this._prefetchOauthTokenForLogin(username);
-        } catch (e) {
-            // Ignore any errors from the prefetch step.
-        }
+        } catch (e) {}
 
+        // Step 7: real login
         return this.requestWithRetry(async () => {
-            // ====== client_input_params (mirror of real traffic with password) ======
             const nowSec = Math.floor(Date.now() / 1000);
             const aacInitTimestamp =
                 nowSec - Math.floor(Math.random() * 50);
@@ -717,7 +1177,6 @@ class AccountRepository extends Repository {
                 contact_point: username,
             };
 
-            // ====== server_params (mirror after reverse engineering) ======
             const waterfallId = crypto.randomUUID
                 ? crypto.randomUUID()
                 : require('uuid').v4();
@@ -770,10 +1229,6 @@ class AccountRepository extends Repository {
                 server_params: serverParams,
             });
 
-            const attestParams =
-                AccountRepository.generateAttestParams(
-                    this.client.state
-                );
             const bloksVersionId =
                 this.client.state.bloksVersionId ||
                 '5e47baf35c5a270b44c8906c8b99063564b30ef69779f3dee0b828bee2e4ef5b';
@@ -783,12 +1238,9 @@ class AccountRepository extends Repository {
                 styles_id: 'instagram',
             });
 
-            // ====== HEADERS – modelled after real traffic ======
             const lang = this.client.state.language || 'ro_RO';
             const acceptLanguage = `${lang.replace('_', '-')}, en-US`;
-            const userAgent =
-                this.client.state.userAgent ||
-                'Instagram 371.0.0.0.23 Android (30/11; 320dpi; 720x1449; Xiaomi/Redmi; M2006C3MNG; angelican; mt6765; ro_RO; 703217507)';
+            const userAgent = this._resolveUserAgent();
 
             const bloksHeaders = {
                 'accept-language': acceptLanguage,
@@ -831,7 +1283,6 @@ class AccountRepository extends Repository {
                         '567067343352427'
                 ),
                 'x-ig-app-locale': lang,
-                'x-ig-attest-params': JSON.stringify(attestParams),
                 'x-ig-bandwidth-speed-kbps': (
                     Math.random() * 1500 +
                     800
@@ -887,7 +1338,7 @@ class AccountRepository extends Repository {
                 headers: bloksHeaders,
             });
 
-            // === DEBUG LOGIN: save response for offline analysis ===
+            // DEBUG login response
             try {
                 const fs = require('fs');
                 const path = require('path');
@@ -915,14 +1366,10 @@ class AccountRepository extends Repository {
                     JSON.stringify(debugPayload, null, 2),
                     'utf8'
                 );
-            } catch (e) {
-                // don't break login on debug failure
-            }
-            // === END DEBUG LOGIN ===
+            } catch (e) {}
 
             const body = response.body;
 
-            // Immediately attempt to extract and save authorization token from the response
             this._extractAndSaveAuthorization(response);
 
             if (body && body.two_factor_required) {
@@ -956,7 +1403,6 @@ class AccountRepository extends Repository {
                         ? body.layout
                         : JSON.stringify(body.layout);
 
-                // If layout contains two-factor markers, parse and throw
                 if (
                     layoutStr.includes('two_factor_required') ||
                     layoutStr.includes('"two_factor_info"')
@@ -1000,7 +1446,6 @@ class AccountRepository extends Repository {
                     throw err;
                 }
 
-                // Additional attempt to extract token from layout string
                 const tokenFromLayout =
                     this._findBearerInString(layoutStr);
                 if (tokenFromLayout) {
@@ -1011,7 +1456,6 @@ class AccountRepository extends Repository {
                     } catch (e) {}
                 }
 
-                // Extract pk (user id) from layout if present
                 const pkPatterns = [
                     /\\"pk\\":\s*(\d+)/,
                     /"pk":\s*(\d+)/,
@@ -1032,7 +1476,6 @@ class AccountRepository extends Repository {
                     }
                 }
 
-                // Extract IG-Set-WWW-Claim if present
                 const wwwClaimPatterns = [
                     /IG-Set-WWW-Claim[\\"\s:]+([a-f0-9]+)/i,
                     /ig-set-www-claim[\\"\s:]+([a-f0-9]+)/i,
@@ -1048,43 +1491,41 @@ class AccountRepository extends Repository {
                     }
                 }
 
-                // Extract encryption key id and pub key (already attempted earlier)
-                const encKeyIdMatch =
+                const encKeyIdMatch2 =
                     layoutStr.match(
                         /IG-Set-Password-Encryption-Key-Id[\\"\s:]+(\d+)/i
                     ) ||
                     layoutStr.match(
                         /password.encryption.key.id[\\"\s:]+(\d+)/i
                     );
-                if (encKeyIdMatch) {
+                if (encKeyIdMatch2) {
                     this.client.state.passwordEncryptionKeyId =
-                        parseInt(encKeyIdMatch[1]);
+                        parseInt(encKeyIdMatch2[1]);
                 }
 
-                const encPubKeyMatch =
+                const encPubKeyMatch2 =
                     layoutStr.match(
                         /IG-Set-Password-Encryption-Pub-Key[\\"\s:]+([A-Za-z0-9+\/=]+)/i
                     ) ||
                     layoutStr.match(
                         /password.encryption.pub.key[\\"\s:]+([A-Za-z0-9+\/=]+)/i
                     );
-                if (encPubKeyMatch) {
+                if (encPubKeyMatch2) {
                     this.client.state.passwordEncryptionPubKey =
-                        encPubKeyMatch[1];
+                        encPubKeyMatch2[1];
                 }
 
-                const midMatch =
+                const midMatch2 =
                     layoutStr.match(
                         /ig-set-x-mid[\\"\s:]+([A-Za-z0-9+\/=_-]+)/i
                     ) ||
                     layoutStr.match(
                         /\\"x-mid\\"[\\"\s:]+([A-Za-z0-9+\/=_-]+)/i
                     );
-                if (midMatch) {
-                    this.client.state.mid = midMatch[1];
+                if (midMatch2) {
+                    this.client.state.mid = midMatch2[1];
                 }
 
-                // If layout contains a direct logged_in_user JSON, extract and return it
                 const loginResponsePatterns = [
                     /\\"logged_in_user\\":\{[^}]*\\"pk\\":(\d+)[^}]*\\"username\\":\\"([^"\\]+)\\"/,
                     /"logged_in_user":\{[^}]*"pk":(\d+)[^}]*"username":"([^"]+)"/,
@@ -1106,7 +1547,6 @@ class AccountRepository extends Repository {
                     }
                 }
 
-                // If we have extracted a pk and we also have authorization, try to fetch current user
                 if (
                     extractedPk &&
                     this.client.state.authorization
@@ -1130,19 +1570,16 @@ class AccountRepository extends Repository {
                 }
             }
 
-            // If server returned logged_in_user directly in body
             if (body && body.logged_in_user) {
                 const lu = body.logged_in_user;
                 if (lu.pk) {
                     this.client.state.cookieUserId = String(lu.pk);
                     this.client.state._userId = String(lu.pk);
                 }
-                // Ensure authorization is saved if present in response headers
                 this._extractAndSaveAuthorization(response);
                 return lu;
             }
 
-            // If we already have authorization, try to fetch current user to populate state
             if (this.client.state.authorization) {
                 try {
                     const userInfo = await this.currentUser();
@@ -1154,7 +1591,6 @@ class AccountRepository extends Repository {
                     }
                     return user;
                 } catch (e) {
-                    // fallback: return raw body
                     return body;
                 }
             }
@@ -1184,7 +1620,6 @@ class AccountRepository extends Repository {
                     phone_id: this.client.state.phoneId,
                 }),
             });
-            // Save authorization if present in two-factor response
             this._extractAndSaveAuthorization(response);
             return response.body;
         });
@@ -1572,18 +2007,6 @@ class AccountRepository extends Repository {
     }
 
     static generateAttestParams(state) {
-        // Emulate Instagram's keystore attestation as closely as possible:
-        // - version: 2
-        // - type: "keystore"
-        // - errors: [0]
-        // - challenge_nonce: random base64url
-        // - signed_nonce: ECDSA signature over the nonce
-        // - key_hash: sha256(spki(publicKey))
-        // - certificate_chain: 4 PEM certificates concatenated (leaf + 2 intermediates + root)
-        //
-        // NOTE: This is *not* a real hardware-backed attestation chain, but it mirrors
-        // the structure of the official app very closely so the server sees the same
-        // shape: a single attestation object with a 4-certificate chain.
         const challengeNonce = crypto
             .randomBytes(24)
             .toString('base64url');
@@ -1593,7 +2016,6 @@ class AccountRepository extends Repository {
                 namedCurve: 'prime256v1',
             }
         );
-        // Sign the challenge nonce with the private key (simulating TEE signing).
         const signedData = crypto.sign(
             null,
             Buffer.from(challengeNonce),
@@ -1609,7 +2031,6 @@ class AccountRepository extends Repository {
             .update(publicKeyDer)
             .digest('hex');
 
-        // Build a 4-certificate chain (leaf + 2 intermediates + root)
         const leafCertPem =
             AccountRepository._generateSelfSignedCert(
                 privateKey,
@@ -1876,6 +2297,4 @@ class AccountRepository extends Repository {
             return response.body;
         });
     }
-}
-
-module.exports = AccountRepository;
+}module.exports = AccountRepository;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodejs-insta-private-api-mqt",
-  "version": "1.3.87",
+  "version": "1.3.89",
   "description": "Complete Instagram MQTT protocol with full-featured REALTIME and REST API — all in one project.",
 
   "main": "dist/dist/index.js",