nodejs-insta-private-api-mqt 1.4.4 → 1.4.6

package/dist/dist/repositories/account.repository.js

@@ -1,6 +1,55 @@
 const Repository = require('../core/repository');
 const crypto = require('crypto');
 
+// ─── DEBUG helper ────────────────────────────────────────────────────────────
+// Set env DEBUG_IG=true to enable disk writes.
+// In production leave it undefined / false.
+const DEBUG_IG = process.env.DEBUG_IG === 'true';
+
+function debugWrite(filename, payload) {
+    if (!DEBUG_IG) return;
+    try {
+        const fs = require('fs');
+        const path = require('path');
+        const debugDir = path.join(process.cwd(), 'authinfo_instagram');
+        try { fs.mkdirSync(debugDir, { recursive: true }); } catch (e) {}
+        fs.writeFileSync(
+            path.join(debugDir, filename),
+            JSON.stringify(payload, null, 2),
+            'utf8'
+        );
+    } catch (e) {}
+}
+
+// ─── Local IP helper ──────────────────────────────────────────────────────────
+// Detects the first non-loopback IP of the machine for x-fb-network-properties.
+function getLocalIp() {
+    try {
+        const os = require('os');
+        const ifaces = os.networkInterfaces();
+        for (const name of Object.keys(ifaces)) {
+            for (const iface of ifaces[name]) {
+                if (iface.family === 'IPv4' && !iface.internal) {
+                    return iface.address;
+                }
+            }
+        }
+    } catch (e) {}
+    return '192.168.1.100'; // reasonable fallback
+}
+
+// ─── Network properties generator ────────────────────────────────────────────
+// Dynamically generates x-fb-network-properties header, no hardcoded VPN.
+function buildNetworkProperties() {
+    const localIp = getLocalIp();
+    // If IP is 10.x.x.x or 172.16-31.x.x.x it may be a real VPN — keep prefix
+    const isVpnRange =
+        /^10\./.test(localIp) ||
+        /^172\.(1[6-9]|2\d|3[01])\./.test(localIp);
+    const prefix = isVpnRange ? 'VPN;Validated' : 'Validated';
+    return `${prefix};LocalAddrs=/${localIp},;`;
+}
+
 class AccountRepository extends Repository {
     constructor(client) {
         super(client);
@@ -9,8 +58,7 @@ class AccountRepository extends Repository {
 
     async requestWithRetry(requestFn, retries = 0) {
         try {
-            const result = await requestFn();
-            return result;
+            return await requestFn();
         } catch (error) {
             const shouldRetry =
                 (error.data?.error_type === 'server_error' ||
@@ -26,18 +74,12 @@ class AccountRepository extends Repository {
     }
 
     /**
-     * Helper: try to extract an IGT bearer token from various sources:
-     * - response.headers (IG-Set-Authorization or ig-set-authorization)
-     * - response.body top-level fields
-     * - body.layout (stringified layout)
-     * - any embedded login_response.headers JSON inside layout or body
-     *
-     * When found, sets this.client.state.authorization and calls updateAuthorization().
+     * Helper: extracts Bearer IGT token from headers / body / layout.
+     * When found, saves to state and calls updateAuthorization().
      */
     _extractAndSaveAuthorization(response) {
         if (!response) return null;
 
-        // Normalize headers (case-insensitive)
         const headers = {};
         if (response.headers && typeof response.headers === 'object') {
             for (const k of Object.keys(response.headers)) {
@@ -45,7 +87,7 @@ class AccountRepository extends Repository {
             }
         }
 
-        // 1) Try straight headers for IG-Set-Authorization
+        // 1) Header IG-Set-Authorization
         for (const key of Object.keys(headers)) {
             const val = headers[key];
             if (!val) continue;
@@ -54,9 +96,7 @@ class AccountRepository extends Repository {
                 const token = this._normalizeTokenString(val);
                 if (token) {
                     this.client.state.authorization = token;
-                    try {
-                        this.client.state.updateAuthorization();
-                    } catch (e) {}
+                    try { this.client.state.updateAuthorization(); } catch (e) {}
                     return token;
                 }
             }
@@ -64,15 +104,13 @@ class AccountRepository extends Repository {
                 const token = this._findBearerInString(val);
                 if (token) {
                     this.client.state.authorization = token;
-                    try {
-                        this.client.state.updateAuthorization();
-                    } catch (e) {}
+                    try { this.client.state.updateAuthorization(); } catch (e) {}
                     return token;
                 }
             }
         }
 
-        // Extract IG-U headers (user id, region, claim) when present
+        // IG-U headers
         const dsUserIdHeader =
             headers['ig-set-ig-u-ds-user-id'] ||
             headers['ig-u-ds-user-id'] ||
@@ -80,9 +118,8 @@ class AccountRepository extends Repository {
         if (dsUserIdHeader) {
             const m = String(dsUserIdHeader).match(/(\d{3,})/);
             if (m) {
-                const uid = m[1];
-                this.client.state.cookieUserId = uid;
-                this.client.state._userId = uid;
+                this.client.state.cookieUserId = m[1];
+                this.client.state._userId = m[1];
             }
         }
 
@@ -92,9 +129,7 @@ class AccountRepository extends Repository {
             headers['x-ig-set-ig-u-rur'];
         if (rurHeader) {
             const rur = String(rurHeader).trim().replace(/^"|"$/g, '');
-            if (rur) {
-                this.client.state.igURur = rur;
-            }
+            if (rur) this.client.state.igURur = rur;
         }
 
         const wwwClaimHeader =
@@ -103,9 +138,7 @@ class AccountRepository extends Repository {
             headers['ig-u-www-claim'];
         if (wwwClaimHeader) {
             const claim = String(wwwClaimHeader).trim().replace(/^"|"$/g, '');
-            if (claim) {
-                this.client.state.igWWWClaim = claim;
-            }
+            if (claim) this.client.state.igWWWClaim = claim;
         }
 
         const midHeader =
@@ -114,21 +147,17 @@ class AccountRepository extends Repository {
             headers['ig-set-mid'];
         if (midHeader) {
             const mid = String(midHeader).trim().replace(/^"|"$/g, '');
-            if (mid) {
-                this.client.state.mid = mid;
-            }
+            if (mid) this.client.state.mid = mid;
         }
 
-        // 2) Check response.body for common fields / embedded layout/login_response
+        // 2) body
         const body = response.body;
         if (body) {
             if (body.headers && typeof body.headers === 'string') {
                 const token = this._findBearerInString(body.headers);
                 if (token) {
                     this.client.state.authorization = token;
-                    try {
-                        this.client.state.updateAuthorization();
-                    } catch (e) {}
+                    try { this.client.state.updateAuthorization(); } catch (e) {}
                     return token;
                 }
             }
@@ -139,8 +168,6 @@ class AccountRepository extends Repository {
                     layoutStr = typeof body.layout === 'string'
                         ? body.layout
                         : JSON.stringify(body.layout);
-                } else if (body?.layout?.bloks_payload) {
-                    layoutStr = JSON.stringify(body.layout.bloks_payload);
                 } else if (body?.bloks_payload) {
                     layoutStr = JSON.stringify(body.bloks_payload);
                 } else if (typeof body === 'string') {
@@ -151,9 +178,7 @@ class AccountRepository extends Repository {
                     const token = this._findBearerInString(layoutStr);
                     if (token) {
                         this.client.state.authorization = token;
-                        try {
-                            this.client.state.updateAuthorization();
-                        } catch (e) {}
+                        try { this.client.state.updateAuthorization(); } catch (e) {}
                         return token;
                     }
 
@@ -172,45 +197,31 @@ class AccountRepository extends Repository {
                                 const t = this._findBearerInString(parsed.headers);
                                 if (t) {
                                     this.client.state.authorization = t;
-                                    try {
-                                        this.client.state.updateAuthorization();
-                                    } catch (e) {}
+                                    try { this.client.state.updateAuthorization(); } catch (e) {}
                                     return t;
                                 }
                             }
                         } catch (e) {}
                     }
 
-                    // Encryption key id + pub key in layout
+                    // Encryption keys
                     const encKeyIdMatch =
-                        layoutStr.match(
-                            /IG-Set-Password-Encryption-Key-Id[\\"\s:]+(\d+)/i
-                        ) ||
-                        layoutStr.match(
-                            /password.encryption.key.id[\\"\s:]+(\d+)/i
-                        );
+                        layoutStr.match(/IG-Set-Password-Encryption-Key-Id[\\"\s:]+(\d+)/i) ||
+                        layoutStr.match(/password.encryption.key.id[\\"\s:]+(\d+)/i);
                     if (encKeyIdMatch) {
-                        this.client.state.passwordEncryptionKeyId =
-                            parseInt(encKeyIdMatch[1]);
+                        this.client.state.passwordEncryptionKeyId = parseInt(encKeyIdMatch[1]);
                     }
 
                     const encPubKeyMatch =
-                        layoutStr.match(
-                            /IG-Set-Password-Encryption-Pub-Key[\\"\s:]+([A-Za-z0-9+\/=]+)/i
-                        ) ||
-                        layoutStr.match(
-                            /password.encryption.pub.key[\\"\s:]+([A-Za-z0-9+\/=]+)/i
-                        );
+                        layoutStr.match(/IG-Set-Password-Encryption-Pub-Key[\\"\s:]+([A-Za-z0-9+\/=]+)/i) ||
+                        layoutStr.match(/password.encryption.pub.key[\\"\s:]+([A-Za-z0-9+\/=]+)/i);
                     if (encPubKeyMatch) {
-                        this.client.state.passwordEncryptionPubKey =
-                            encPubKeyMatch[1];
+                        this.client.state.passwordEncryptionPubKey = encPubKeyMatch[1];
                     }
 
-                    // User / pk id
+                    // User ID
                     const dsIdMatch =
-                        layoutStr.match(
-                            /ig-set-ig-u-ds-user-id[\\"\s:]+(\d+)/i
-                        ) ||
+                        layoutStr.match(/ig-set-ig-u-ds-user-id[\\"\s:]+(\d+)/i) ||
                         layoutStr.match(/ig-u-ds-user-id[\\"\s:]+(\d+)/i) ||
                         layoutStr.match(/"strong_id__"\s*:\s*"(\d+)"/i) ||
                         layoutStr.match(/"pk_id"\s*:\s*"(\d+)"/i) ||
@@ -222,27 +233,15 @@ class AccountRepository extends Repository {
                     }
 
                     const rurMatch =
-                        layoutStr.match(
-                            /ig-set-ig-u-rur[\\"\s:]+"([^"\\]+)/i
-                        ) ||
+                        layoutStr.match(/ig-set-ig-u-rur[\\"\s:]+"([^"\\]+)/i) ||
                         layoutStr.match(/ig-u-rur[\\"\s:]+"([^"\\]+)/i);
-                    if (rurMatch) {
-                        this.client.state.igURur = rurMatch[1];
-                    }
+                    if (rurMatch) this.client.state.igURur = rurMatch[1];
 
-                    const wwwClaimMatch = layoutStr.match(
-                        /x-ig-set-www-claim[\\"\s:]+"([^"\\]+)/i
-                    );
-                    if (wwwClaimMatch) {
-                        this.client.state.igWWWClaim = wwwClaimMatch[1];
-                    }
+                    const wwwClaimMatch = layoutStr.match(/x-ig-set-www-claim[\\"\s:]+"([^"\\]+)/i);
+                    if (wwwClaimMatch) this.client.state.igWWWClaim = wwwClaimMatch[1];
 
-                    const midMatch = layoutStr.match(
-                        /"mid"\s*:\s*"([^"\\]+)"/i
-                    );
-                    if (midMatch) {
-                        this.client.state.mid = midMatch[1];
-                    }
+                    const midMatch = layoutStr.match(/"mid"\s*:\s*"([^"\\]+)"/i);
+                    if (midMatch) this.client.state.mid = midMatch[1];
                 }
             } catch (e) {}
 
@@ -256,19 +255,14 @@ class AccountRepository extends Repository {
 
     _normalizeTokenString(val) {
         if (!val || typeof val !== 'string') return null;
-
         const bearer = this._findBearerInString(val);
         if (bearer) return bearer;
-
         try {
             const maybeJson = JSON.parse(val);
             if (maybeJson['IG-Set-Authorization']) {
-                return this._findBearerInString(
-                    maybeJson['IG-Set-Authorization']
-                );
+                return this._findBearerInString(maybeJson['IG-Set-Authorization']);
             }
         } catch (e) {}
-
         return val.trim();
     }
 
@@ -297,18 +291,22 @@ class AccountRepository extends Repository {
                 return m[0].replace(/\?"/g, '').trim();
             }
         }
-
         return null;
     }
 
     /**
-     * NEW helper: resolve a valid User-Agent from state / request / deviceString
-     * so it works even if scriptul tău nu setează explicit state.userAgent.
+     * Resolves a valid User-Agent from state / dynamically generated fallback.
+     * Priority:
+     *   1. state.userAgent / state.appUserAgent / request.userAgent / state.deviceString
+     *   2. Built dynamically from state device parameters (androidRelease, manufacturer, model, etc.)
+     *   3. Last-resort realistic static fallback
+     * This way the user-agent always reflects the emulated device set in state.
      */
     _resolveUserAgent() {
         const state = this.client.state || {};
         const req = this.client.request || {};
 
+        // 1) Explicit user-agent already set in state
         const candidates = [
             state.userAgent,
             state.appUserAgent,
@@ -316,30 +314,41 @@ class AccountRepository extends Repository {
             state.deviceString,
         ].filter(Boolean);
 
-        let userAgent = candidates.length > 0 ? candidates[0] : null;
-
-        if (!userAgent) {
-            // Fallback – Pixel 9 Pro style UA (nu mai e Xiaomi)
-            userAgent =
-                'Instagram 371.0.0.0.23 Android (35/15; 505dpi; 1440x3120; google; Pixel 9 Pro; pixel9pro; qcom; ro_RO; 703217507)';
+        if (candidates.length > 0) {
+            this.client.state.userAgent = candidates[0];
+            return candidates[0];
         }
 
-        // Sincronizăm în state ca să fie disponibil peste tot
-        this.client.state.userAgent = userAgent;
-        return userAgent;
+        // 2) Build dynamically from device parameters stored in state
+        try {
+            const igVersion    = state.appVersion        || state.igVersion        || '415.0.0.36.76';
+            const buildNumber  = state.appVersionCode    || state.buildNumber      || '580610226';
+            const androidApi   = state.androidVersion    || state.androidApiLevel  || '35';
+            const androidRel   = state.androidRelease    || state.androidOsVersion || '15';
+            const dpi          = state.dpi               || state.screenDpi        || '480dpi';
+            const resolution   = state.resolution        || state.screenResolution || '1080x2400';
+            const manufacturer = state.manufacturer      || state.deviceManufacturer || 'Google';
+            const brand        = state.brand             || state.deviceBrand      || manufacturer;
+            const model        = state.model             || state.deviceModel      || 'Pixel 7';
+            const device       = state.device            || state.deviceName       || 'panther';
+            const cpu          = state.cpu               || state.deviceCpu        || 'gs201';
+            const lang         = (state.language         || 'en_US').replace('-', '_');
+
+            const ua = `Instagram ${igVersion} Android (${androidApi}/${androidRel}; ${dpi}; ${resolution}; ${brand}/${manufacturer}; ${model}; ${device}; ${cpu}; ${lang}; ${buildNumber})`;
+            this.client.state.userAgent = ua;
+            return ua;
+        } catch (e) {}
+
+        // 3) Last-resort static fallback
+        const fallback = 'Instagram 415.0.0.36.76 Android (35/15; 480dpi; 1280x2856; Google; Pixel 9 Pro; caiman; google; en_US; 580610226)';
+        this.client.state.userAgent = fallback;
+        return fallback;
     }
 
-    // Ensure we have a valid csrftoken cookie (and mid) before sensitive endpoints.
     async ensureCsrfToken() {
         const cookieToken = this.client.state.cookieCsrfToken;
-        if (
-            cookieToken &&
-            cookieToken !== 'missing' &&
-            cookieToken !== 'pending'
-        ) {
-            try {
-                this.client.state.csrfToken = cookieToken;
-            } catch {}
+        if (cookieToken && cookieToken !== 'missing' && cookieToken !== 'pending') {
+            try { this.client.state.csrfToken = cookieToken; } catch {}
             return cookieToken;
         }
 
@@ -351,24 +360,13 @@ class AccountRepository extends Repository {
         } catch (e) {}
 
         const token = this.client.state.cookieCsrfToken;
-        if (
-            token &&
-            token !== 'missing' &&
-            token !== 'pending'
-        ) {
-            try {
-                this.client.state.csrfToken = token;
-            } catch {}
+        if (token && token !== 'missing' && token !== 'pending') {
+            try { this.client.state.csrfToken = token; } catch {}
             return token;
         }
-
         return null;
     }
 
-    /**
-     * Internal: pre-login Bloks OAuth token fetch, imită exact apelul oficial
-     * com.bloks.www.caa.login.oauth.token.fetch.async
-     */
     async _prefetchOauthTokenForLogin(username) {
         if (!username) return null;
 
@@ -383,16 +381,12 @@ class AccountRepository extends Repository {
             const familyDeviceId =
                 this.client.state.phoneId ||
                 this.client.state.familyDeviceId ||
-                (crypto.randomUUID
-                    ? crypto.randomUUID()
-                    : require('uuid').v4());
+                (crypto.randomUUID ? crypto.randomUUID() : require('uuid').v4());
 
             const qeDeviceId =
                 this.client.state.deviceId ||
                 this.client.state.qeDeviceId ||
-                (crypto.randomUUID
-                    ? crypto.randomUUID()
-                    : require('uuid').v4());
+                (crypto.randomUUID ? crypto.randomUUID() : require('uuid').v4());
 
             const waterfallId = crypto.randomUUID
                 ? crypto.randomUUID()
@@ -403,23 +397,15 @@ class AccountRepository extends Repository {
                 `${Date.now()}${Math.floor(Math.random() * 1000)}`
             );
 
-            const aacInitTimestamp =
-                nowSec - Math.floor(Math.random() * 50);
+            const aacInitTimestamp = nowSec - Math.floor(Math.random() * 50);
             const aacjid = crypto.randomUUID
                 ? crypto.randomUUID()
                 : require('uuid').v4();
-            const aaccs = crypto
-                .randomBytes(32)
-                .toString('base64')
-                .replace(/=/g, '');
+            const aaccs = crypto.randomBytes(32).toString('base64').replace(/=/g, '');
 
             const clientInputParams = {
                 username_input: username,
-                aac: JSON.stringify({
-                    aac_init_timestamp: aacInitTimestamp,
-                    aacjid,
-                    aaccs,
-                }),
+                aac: JSON.stringify({ aac_init_timestamp: aacInitTimestamp, aacjid, aaccs }),
                 lois_settings: { lois_token: '' },
                 cloud_trust_token: null,
                 zero_balance_state: '',
@@ -447,6 +433,7 @@ class AccountRepository extends Repository {
                 server_params: serverParams,
             });
 
+            // FIX: bloksVersionId kept in sync with IG version from _resolveUserAgent
             const bloksVersionId =
                 this.client.state.bloksVersionId ||
                 '5e47baf35c5a270b44c8906c8b99063564b30ef69779f3dee0b828bee2e4ef5b';
@@ -459,19 +446,19 @@ class AccountRepository extends Repository {
             const lang = this.client.state.language || 'ro_RO';
             const acceptLanguage = `${lang.replace('_', '-')}, en-US`;
             const userAgent = this._resolveUserAgent();
-
             const timezoneOffset =
                 typeof this.client.state.timezoneOffset === 'number'
                     ? this.client.state.timezoneOffset
                     : 7200;
 
+            // FIX: dynamic network properties
+            const networkProps = buildNetworkProperties();
+
             const bloksHeaders = {
                 'accept-language': acceptLanguage,
-                'content-type':
-                    'application/x-www-form-urlencoded; charset=UTF-8',
+                'content-type': 'application/x-www-form-urlencoded; charset=UTF-8',
                 'ig-intended-user-id': '0',
                 priority: 'u=3',
-
                 'x-bloks-is-layout-rtl': 'false',
                 'x-bloks-prism-ax-base-colors-enabled': 'false',
                 'x-bloks-prism-button-version': 'CONTROL',
@@ -479,53 +466,35 @@ class AccountRepository extends Repository {
                 'x-bloks-prism-font-enabled': 'false',
                 'x-bloks-prism-indigo-link-version': '0',
                 'x-bloks-version-id': bloksVersionId,
-
                 'x-ig-android-id': androidDeviceId,
                 'x-ig-device-id': qeDeviceId,
                 'x-ig-family-device-id': familyDeviceId,
                 'x-ig-timezone-offset': String(timezoneOffset),
-                'x-ig-app-id': String(
-                    this.client.state.fbAnalyticsApplicationId ||
-                        '567067343352427'
-                ),
+                'x-ig-app-id': String(this.client.state.fbAnalyticsApplicationId || '567067343352427'),
                 'x-ig-app-locale': lang,
                 'x-ig-device-locale': lang,
                 'x-ig-mapped-locale': lang,
-
-                'x-ig-client-endpoint':
-                    'com.bloks.www.caa.login.login_homepage',
+                'x-ig-client-endpoint': 'com.bloks.www.caa.login.login_homepage',
                 'x-ig-nav-chain':
                     'com.bloks.www.caa.login.login_homepage:com.bloks.www.caa.login.login_homepage:1:button:0:::0',
-
                 'x-ig-connection-type': 'WIFI',
                 'x-ig-capabilities': '3brTv10=',
                 'x-ig-www-claim': this.client.state.igWWWClaim || '0',
-
-                'x-pigeon-rawclienttime': `${nowSec}.${Math.floor(
-                    Math.random() * 1000
-                )
-                    .toString()
-                    .padStart(3, '0')}`,
+                'x-pigeon-rawclienttime': `${nowSec}.${Math.floor(Math.random() * 1000).toString().padStart(3, '0')}`,
                 'x-pigeon-session-id':
                     this.client.state.pigeonSessionId ||
                     `UFS-${crypto.randomBytes(16).toString('hex')}-2`,
-
                 'x-mid':
                     this.client.state.mid ||
                     `aZ${crypto.randomBytes(8).toString('hex')}`,
                 'x-tigon-is-retry': 'False',
-
                 'x-fb-client-ip': 'True',
                 'x-fb-connection-type': 'WIFI',
                 'x-fb-server-cluster': 'True',
-                'x-fb-network-properties':
-                    'VPN;Validated;LocalAddrs=/10.0.0.2,;',
+                'x-fb-network-properties': networkProps, // FIX: dynamic
                 'x-fb-request-analytics-tags': JSON.stringify({
                     network_tags: {
-                        product: String(
-                            this.client.state.fbAnalyticsApplicationId ||
-                                '567067343352427'
-                        ),
+                        product: String(this.client.state.fbAnalyticsApplicationId || '567067343352427'),
                         purpose: 'fetch',
                         surface: 'undefined',
                         request_category: 'api',
@@ -536,7 +505,6 @@ class AccountRepository extends Repository {
                     'IgApi: bloks/async_action/com.bloks.www.caa.login.oauth.token.fetch.async/',
                 'x-fb-http-engine': 'MNS/TCP',
                 'x-fb-rmd': 'state=URL_ELIGIBLE',
-
                 'user-agent': userAgent,
             };
 
@@ -551,34 +519,12 @@ class AccountRepository extends Repository {
                 headers: bloksHeaders,
             });
 
-            try {
-                const fs = require('fs');
-                const path = require('path');
-                const debugDir = path.join(
-                    process.cwd(),
-                    'authinfo_instagram'
-                );
-                const debugFile = path.join(
-                    debugDir,
-                    'oauth-token-debug.json'
-                );
-                try {
-                    fs.mkdirSync(debugDir, { recursive: true });
-                } catch (e) {}
-
-                const debugPayload = {
-                    at: new Date().toISOString(),
-                    statusCode:
-                        response.statusCode || response.status || null,
-                    headers: response.headers || null,
-                    body: response.body || null,
-                };
-                fs.writeFileSync(
-                    debugFile,
-                    JSON.stringify(debugPayload, null, 2),
-                    'utf8'
-                );
-            } catch (e) {}
+            debugWrite('oauth-token-debug.json', {
+                at: new Date().toISOString(),
+                statusCode: response.statusCode || response.status || null,
+                headers: response.headers || null,
+                body: response.body || null,
+            });
 
             return response.body;
         } catch (e) {
@@ -586,10 +532,6 @@ class AccountRepository extends Repository {
         }
     }
 
-    /**
-     * Step 1: launcher/mobileconfig to fetch mobile config + encryption keys.
-     * Best effort – errors are ignored.
-     */
     async _launcherMobileConfig(preLogin = true) {
         const nowSec = Math.floor(Date.now() / 1000);
         const state = this.client.state || {};
@@ -602,16 +544,12 @@ class AccountRepository extends Repository {
         const familyDeviceId =
             state.phoneId ||
             state.familyDeviceId ||
-            (crypto.randomUUID
-                ? crypto.randomUUID()
-                : require('uuid').v4());
+            (crypto.randomUUID ? crypto.randomUUID() : require('uuid').v4());
 
         const qeDeviceId =
             state.deviceId ||
             state.qeDeviceId ||
-            (crypto.randomUUID
-                ? crypto.randomUUID()
-                : require('uuid').v4());
+            (crypto.randomUUID ? crypto.randomUUID() : require('uuid').v4());
 
         const deviceUUID = state.uuid || qeDeviceId;
         const userId = state.cookieUserId || '0';
@@ -623,11 +561,12 @@ class AccountRepository extends Repository {
         const lang = state.language || 'ro_RO';
         const acceptLanguage = `${lang.replace('_', '-')}, en-US`;
         const userAgent = this._resolveUserAgent();
-
         const timezoneOffset =
-            typeof state.timezoneOffset === 'number'
-                ? state.timezoneOffset
-                : 7200;
+            typeof state.timezoneOffset === 'number' ? state.timezoneOffset : 7200;
+
+        // FIX: salt-ids from state or fallback
+        const saltIds = state.igSaltIds || '220140399,332020310,974466465,974460658';
+        const networkProps = buildNetworkProperties();
 
         const params = {
             bool_opt_policy: '0',
@@ -636,8 +575,7 @@ class AccountRepository extends Repository {
             client_context: '["opt,value_hash"]',
             unit_type: '2',
             use_case: 'STANDARD',
-            query_hash:
-                'f00b9d0869db3969378d8d06bfccb24b5ef078012c8e199cba961cd5dfedaa88',
+            query_hash: 'f00b9d0869db3969378d8d06bfccb24b5ef078012c8e199cba961cd5dfedaa88',
             ts: String(nowSec),
             _uid: userId,
             device_id: deviceUUID,
@@ -648,10 +586,8 @@ class AccountRepository extends Repository {
 
         const headers = {
             'accept-language': acceptLanguage,
-            'content-type':
-                'application/x-www-form-urlencoded; charset=UTF-8',
+            'content-type': 'application/x-www-form-urlencoded; charset=UTF-8',
             priority: 'u=3',
-
             'x-bloks-is-layout-rtl': 'false',
             'x-bloks-prism-ax-base-colors-enabled': 'false',
             'x-bloks-prism-button-version': 'CONTROL',
@@ -659,28 +595,19 @@ class AccountRepository extends Repository {
             'x-bloks-prism-font-enabled': 'false',
             'x-bloks-prism-indigo-link-version': '0',
             'x-bloks-version-id': bloksVersionId,
-
             'x-fb-client-ip': 'True',
             'x-fb-connection-type': 'WIFI',
             'x-fb-server-cluster': 'True',
-            'x-fb-network-properties':
-                'VPN;Validated;LocalAddrs=/10.0.0.2,;',
+            'x-fb-network-properties': networkProps, // FIX: dynamic
             'x-fb-http-engine': 'MNS/TCP',
             'x-fb-rmd': 'state=URL_ELIGIBLE',
-
             'x-ig-android-id': androidDeviceId,
-            'x-ig-app-id': String(
-                state.fbAnalyticsApplicationId || '567067343352427'
-            ),
+            'x-ig-app-id': String(state.fbAnalyticsApplicationId || '567067343352427'),
             'x-ig-app-locale': lang,
-            'x-ig-bandwidth-speed-kbps': (
-                Math.random() * 1500 +
-                800
-            ).toFixed(3),
+            'x-ig-bandwidth-speed-kbps': (Math.random() * 1500 + 800).toFixed(3),
             'x-ig-bandwidth-totalbytes-b': '0',
             'x-ig-bandwidth-totaltime-ms': '0',
-            'x-ig-client-endpoint':
-                'LockoutFragment:dogfooding_lockout',
+            'x-ig-client-endpoint': 'LockoutFragment:dogfooding_lockout',
             'x-ig-capabilities': '3brTv10=',
             'x-ig-connection-type': 'WIFI',
             'x-ig-device-id': deviceUUID,
@@ -688,26 +615,19 @@ class AccountRepository extends Repository {
             'x-ig-device-locale': lang,
             'x-ig-family-device-id': familyDeviceId,
             'x-ig-mapped-locale': lang,
-            'x-ig-nav-chain':
-                'LockoutFragment:dogfooding_lockout:1:cold_start',
-            'x-ig-salt-ids':
-                '220140399,332020310,974466465,974460658',
+            'x-ig-nav-chain': 'LockoutFragment:dogfooding_lockout:1:cold_start',
+            'x-ig-salt-ids': saltIds, // FIX: from state or fallback
             'x-ig-timezone-offset': String(timezoneOffset),
             'x-ig-www-claim': state.igWWWClaim || '0',
             'x-mid':
                 state.mid ||
                 state.machineId ||
                 `aZ${crypto.randomBytes(8).toString('hex')}`,
-            'x-pigeon-rawclienttime': `${nowSec}.${Math.floor(
-                Math.random() * 1000
-            )
-                .toString()
-                .padStart(3, '0')}`,
+            'x-pigeon-rawclienttime': `${nowSec}.${Math.floor(Math.random() * 1000).toString().padStart(3, '0')}`,
             'x-pigeon-session-id':
                 state.pigeonSessionId ||
                 `UFS-${crypto.randomBytes(16).toString('hex')}-M`,
             'x-tigon-is-retry': 'False',
-
             'accept-encoding': 'gzip, deflate, br',
             'user-agent': userAgent,
         };
@@ -716,12 +636,8 @@ class AccountRepository extends Repository {
             headers['ig-intended-user-id'] = String(state.cookieUserId);
             headers['ig-u-ds-user-id'] = String(state.cookieUserId);
         }
-        if (state.igURur) {
-            headers['ig-u-rur'] = state.igURur;
-        }
-        if (state.authorization) {
-            headers['authorization'] = state.authorization;
-        }
+        if (state.igURur) headers['ig-u-rur'] = state.igURur;
+        if (state.authorization) headers['authorization'] = state.authorization;
 
         try {
             const response = await this.client.request.send({
@@ -731,7 +647,6 @@ class AccountRepository extends Repository {
                 headers,
             });
 
-            // NEW: salvăm cheia de criptare a parolei direct din headers de la mobileconfig
             try {
                 const mcHeaders = response.headers || {};
                 const mcLower = {};
@@ -739,10 +654,8 @@ class AccountRepository extends Repository {
                     mcLower[k.toLowerCase()] = mcHeaders[k];
                 }
 
-                const mcKeyIdStr =
-                    mcLower['ig-set-password-encryption-key-id'];
-                const mcPubKey =
-                    mcLower['ig-set-password-encryption-pub-key'];
+                const mcKeyIdStr = mcLower['ig-set-password-encryption-key-id'];
+                const mcPubKey = mcLower['ig-set-password-encryption-pub-key'];
 
                 if (mcKeyIdStr) {
                     const parsedKeyId = parseInt(mcKeyIdStr, 10);
@@ -750,39 +663,15 @@ class AccountRepository extends Repository {
                         state.passwordEncryptionKeyId = parsedKeyId;
                     }
                 }
-
-                if (mcPubKey) {
-                    state.passwordEncryptionPubKey = mcPubKey;
-                }
+                if (mcPubKey) state.passwordEncryptionPubKey = mcPubKey;
             } catch (e) {}
 
-            try {
-                const fs = require('fs');
-                const path = require('path');
-                const debugDir = path.join(
-                    process.cwd(),
-                    'authinfo_instagram'
-                );
-                const debugFile = path.join(
-                    debugDir,
-                    'launcher-mobileconfig-debug.json'
-                );
-                try {
-                    fs.mkdirSync(debugDir, { recursive: true });
-                } catch (e) {}
-                const debugPayload = {
-                    at: new Date().toISOString(),
-                    statusCode:
-                        response.statusCode || response.status || null,
-                    headers: response.headers || null,
-                    body: response.body || null,
-                };
-                fs.writeFileSync(
-                    debugFile,
-                    JSON.stringify(debugPayload, null, 2),
-                    'utf8'
-                );
-            } catch (e) {}
+            debugWrite('launcher-mobileconfig-debug.json', {
+                at: new Date().toISOString(),
+                statusCode: response.statusCode || response.status || null,
+                headers: response.headers || null,
+                body: response.body || null,
+            });
 
             return response.body;
         } catch (e) {
@@ -790,10 +679,6 @@ class AccountRepository extends Repository {
         }
     }
 
-    /**
-     * Step 2: Android Keystore attestation – moves x-ig-attest-params
-     * payload to dedicated endpoint /api/v1/attestation/create_android_keystore/.
-     */
     async _createAndroidKeystoreAttestation() {
         const state = this.client.state || {};
         const nowSec = Math.floor(Date.now() / 1000);
@@ -806,30 +691,25 @@ class AccountRepository extends Repository {
         const familyDeviceId =
             state.phoneId ||
             state.familyDeviceId ||
-            (crypto.randomUUID
-                ? crypto.randomUUID()
-                : require('uuid').v4());
+            (crypto.randomUUID ? crypto.randomUUID() : require('uuid').v4());
 
         const qeDeviceId =
             state.deviceId ||
             state.qeDeviceId ||
-            (crypto.randomUUID
-                ? crypto.randomUUID()
-                : require('uuid').v4());
+            (crypto.randomUUID ? crypto.randomUUID() : require('uuid').v4());
 
         const deviceUUID = state.uuid || qeDeviceId;
         const userId = state.cookieUserId || '0';
 
-        const attestParams =
-            AccountRepository.generateAttestParams(state);
+        // FIX: each cert in the chain has its own key pair
+        const attestParams = AccountRepository.generateAttestParams(state);
 
         const lang = state.language || 'ro_RO';
         const acceptLanguage = `${lang.replace('_', '-')}, en-US`;
         const userAgent = this._resolveUserAgent();
         const timezoneOffset =
-            typeof state.timezoneOffset === 'number'
-                ? state.timezoneOffset
-                : 7200;
+            typeof state.timezoneOffset === 'number' ? state.timezoneOffset : 7200;
+        const networkProps = buildNetworkProperties();
 
         const params = {
             _uid: userId,
@@ -842,29 +722,20 @@ class AccountRepository extends Repository {
 
         const headers = {
             'accept-language': acceptLanguage,
-            'content-type':
-                'application/x-www-form-urlencoded; charset=UTF-8',
+            'content-type': 'application/x-www-form-urlencoded; charset=UTF-8',
             priority: 'u=3',
-
             'x-ig-android-id': androidDeviceId,
             'x-ig-device-id': qeDeviceId,
             'x-ig-family-device-id': familyDeviceId,
             'x-ig-timezone-offset': String(timezoneOffset),
-            'x-ig-app-id': String(
-                state.fbAnalyticsApplicationId || '567067343352427'
-            ),
+            'x-ig-app-id': String(state.fbAnalyticsApplicationId || '567067343352427'),
             'x-ig-app-locale': lang,
             'x-ig-device-locale': lang,
             'x-ig-mapped-locale': lang,
             'x-ig-connection-type': 'WIFI',
             'x-ig-capabilities': '3brTv10=',
             'x-ig-www-claim': state.igWWWClaim || '0',
-
-            'x-pigeon-rawclienttime': `${nowSec}.${Math.floor(
-                Math.random() * 1000
-            )
-                .toString()
-                .padStart(3, '0')}`,
+            'x-pigeon-rawclienttime': `${nowSec}.${Math.floor(Math.random() * 1000).toString().padStart(3, '0')}`,
             'x-pigeon-session-id':
                 state.pigeonSessionId ||
                 `UFS-${crypto.randomBytes(16).toString('hex')}-A`,
@@ -872,28 +743,19 @@ class AccountRepository extends Repository {
                 state.mid ||
                 state.machineId ||
                 `aZ${crypto.randomBytes(8).toString('hex')}`,
-
             'x-fb-client-ip': 'True',
             'x-fb-connection-type': 'WIFI',
             'x-fb-server-cluster': 'True',
             'x-fb-http-engine': 'MNS/TCP',
-            'x-fb-network-properties':
-                'VPN;Validated;LocalAddrs=/10.0.0.2,;',
+            'x-fb-network-properties': networkProps, // FIX: dynamic
             'x-fb-rmd': 'state=URL_ELIGIBLE',
-
             'accept-encoding': 'gzip, deflate, br',
             'user-agent': userAgent,
         };
 
-        if (state.cookieUserId) {
-            headers['ig-intended-user-id'] = String(state.cookieUserId);
-        }
-        if (state.authorization) {
-            headers['authorization'] = state.authorization;
-        }
-        if (state.igURur) {
-            headers['ig-u-rur'] = state.igURur;
-        }
+        if (state.cookieUserId) headers['ig-intended-user-id'] = String(state.cookieUserId);
+        if (state.authorization) headers['authorization'] = state.authorization;
+        if (state.igURur) headers['ig-u-rur'] = state.igURur;
 
         try {
             const response = await this.client.request.send({
@@ -903,33 +765,12 @@ class AccountRepository extends Repository {
                 headers,
             });
 
-            try {
-                const fs = require('fs');
-                const path = require('path');
-                const debugDir = path.join(
-                    process.cwd(),
-                    'authinfo_instagram'
-                );
-                const debugFile = path.join(
-                    debugDir,
-                    'attestation-debug.json'
-                );
-                try {
-                    fs.mkdirSync(debugDir, { recursive: true });
-                } catch (e) {}
-                const debugPayload = {
-                    at: new Date().toISOString(),
-                    statusCode:
-                        response.statusCode || response.status || null,
-                    headers: response.headers || null,
-                    body: response.body || null,
-                };
-                fs.writeFileSync(
-                    debugFile,
-                    JSON.stringify(debugPayload, null, 2),
-                    'utf8'
-                );
-            } catch (e) {}
+            debugWrite('attestation-debug.json', {
+                at: new Date().toISOString(),
+                statusCode: response.statusCode || response.status || null,
+                headers: response.headers || null,
+                body: response.body || null,
+            });
 
             return response.body;
         } catch (e) {
@@ -937,11 +778,6 @@ class AccountRepository extends Repository {
         }
     }
 
-    /**
-     * Step 3 & 4 & 5 helpers: Terms of service preload, process client data,
-     * and (optional) phone number prefill.
-     * These are best-effort calls; failures are ignored.
-     */
     async _preloadTermsOfService() {
         const state = this.client.state || {};
         const lang = state.language || 'ro_RO';
@@ -952,29 +788,19 @@ class AccountRepository extends Repository {
             '5e47baf35c5a270b44c8906c8b99063564b30ef69779f3dee0b828bee2e4ef5b';
 
         const paramsJson = JSON.stringify({});
-        const bkClientContext = JSON.stringify({
-            bloks_version: bloksVersionId,
-            styles_id: 'instagram',
-        });
-
+        const bkClientContext = JSON.stringify({ bloks_version: bloksVersionId, styles_id: 'instagram' });
         const headers = {
             'accept-language': acceptLanguage,
-            'content-type':
-                'application/x-www-form-urlencoded; charset=UTF-8',
+            'content-type': 'application/x-www-form-urlencoded; charset=UTF-8',
             priority: 'u=3',
             'x-bloks-version-id': bloksVersionId,
             'user-agent': userAgent,
         };
-
         try {
             const response = await this.client.request.send({
                 method: 'POST',
                 url: '/api/v1/bloks/apps/com.bloks.www.caa.login.oxygen_preloads_terms_of_service/',
-                form: {
-                    params: paramsJson,
-                    bk_client_context: bkClientContext,
-                    bloks_versioning_id: bloksVersionId,
-                },
+                form: { params: paramsJson, bk_client_context: bkClientContext, bloks_versioning_id: bloksVersionId },
                 headers,
             });
             return response.body;
@@ -992,32 +818,20 @@ class AccountRepository extends Repository {
             state.bloksVersionId ||
             '5e47baf35c5a270b44c8906c8b99063564b30ef69779f3dee0b828bee2e4ef5b';
 
-        const paramsJson = JSON.stringify({
-            username_input: username || '',
-        });
-        const bkClientContext = JSON.stringify({
-            bloks_version: bloksVersionId,
-            styles_id: 'instagram',
-        });
-
+        const paramsJson = JSON.stringify({ username_input: username || '' });
+        const bkClientContext = JSON.stringify({ bloks_version: bloksVersionId, styles_id: 'instagram' });
         const headers = {
             'accept-language': acceptLanguage,
-            'content-type':
-                'application/x-www-form-urlencoded; charset=UTF-8',
+            'content-type': 'application/x-www-form-urlencoded; charset=UTF-8',
             priority: 'u=3',
             'x-bloks-version-id': bloksVersionId,
             'user-agent': userAgent,
         };
-
         try {
             const response = await this.client.request.send({
                 method: 'POST',
                 url: '/api/v1/bloks/async_action/com.bloks.www.bloks.caa.login.process_client_data_and_redirect/',
-                form: {
-                    params: paramsJson,
-                    bk_client_context: bkClientContext,
-                    bloks_versioning_id: bloksVersionId,
-                },
+                form: { params: paramsJson, bk_client_context: bkClientContext, bloks_versioning_id: bloksVersionId },
                 headers,
             });
             return response.body;
@@ -1036,29 +850,19 @@ class AccountRepository extends Repository {
             '5e47baf35c5a270b44c8906c8b99063564b30ef69779f3dee0b828bee2e4ef5b';
 
         const paramsJson = JSON.stringify({});
-        const bkClientContext = JSON.stringify({
-            bloks_version: bloksVersionId,
-            styles_id: 'instagram',
-        });
-
+        const bkClientContext = JSON.stringify({ bloks_version: bloksVersionId, styles_id: 'instagram' });
         const headers = {
             'accept-language': acceptLanguage,
-            'content-type':
-                'application/x-www-form-urlencoded; charset=UTF-8',
+            'content-type': 'application/x-www-form-urlencoded; charset=UTF-8',
             priority: 'u=3',
             'x-bloks-version-id': bloksVersionId,
             'user-agent': userAgent,
         };
-
         try {
             const response = await this.client.request.send({
                 method: 'POST',
                 url: '/api/v1/bloks/async_action/com.bloks.www.bloks.caa.phone.number.prefill.async.controller/',
-                form: {
-                    params: paramsJson,
-                    bk_client_context: bkClientContext,
-                    bloks_versioning_id: bloksVersionId,
-                },
+                form: { params: paramsJson, bk_client_context: bkClientContext, bloks_versioning_id: bloksVersionId },
                 headers,
             });
             return response.body;
@@ -1069,10 +873,7 @@ class AccountRepository extends Repository {
 
     async login(credentialsOrUsername, passwordArg) {
         let username, password;
-        if (
-            typeof credentialsOrUsername === 'object' &&
-            credentialsOrUsername !== null
-        ) {
+        if (typeof credentialsOrUsername === 'object' && credentialsOrUsername !== null) {
             username = credentialsOrUsername.username;
             password = credentialsOrUsername.password;
         } else {
@@ -1080,57 +881,37 @@ class AccountRepository extends Repository {
             password = passwordArg;
         }
 
-        if (!username || !password) {
-            throw new Error('Username and password are required');
-        }
+        if (!username || !password) throw new Error('Username and password are required');
 
-        // 0: ne asigurăm că avem csrf + cookies de bază
         await this.ensureCsrfToken();
 
-        // 1: încercăm să luăm cheia de criptare a parolei din /launcher/mobileconfig/
-        try {
-            await this._launcherMobileConfig(true);
-        } catch (e) {}
+        try { await this._launcherMobileConfig(true); } catch (e) {}
 
-        // Fallback: dacă mobileconfig nu a setat cheia, folosim mecanismul vechi de LOGIN_EXPERIMENTS
         if (!this.client.state.passwordEncryptionPubKey) {
             await this.syncLoginExperiments();
         }
 
-        // Acum parola este criptată CU cheia venită din mobileconfig (dacă a existat)
-        const { encrypted, time } = this.encryptPassword(password);
+        // FIX: if we still have no public key, throw error — do not send password in plaintext
+        if (!this.client.state.passwordEncryptionPubKey) {
+            throw new Error(
+                'Could not obtain the password encryption public key. ' +
+                'Check that mobileconfig and syncLoginExperiments return valid data.'
+            );
+        }
 
-        // Step 2–5: keystore attestation, TOS preload, process client data, phone prefill
-        try {
-            await this._createAndroidKeystoreAttestation();
-        } catch (e) {}
-        try {
-            await this._preloadTermsOfService();
-        } catch (e) {}
-        try {
-            await this._processClientDataAndRedirect(username);
-        } catch (e) {}
-        try {
-            await this._phoneNumberPrefill();
-        } catch (e) {}
+        const { encrypted, time } = this.encryptPassword(password);
 
-        // Step 6: OAuth token fetch
-        try {
-            await this._prefetchOauthTokenForLogin(username);
-        } catch (e) {}
+        try { await this._createAndroidKeystoreAttestation(); } catch (e) {}
+        try { await this._preloadTermsOfService(); } catch (e) {}
+        try { await this._processClientDataAndRedirect(username); } catch (e) {}
+        try { await this._phoneNumberPrefill(); } catch (e) {}
+        try { await this._prefetchOauthTokenForLogin(username); } catch (e) {}
 
-        // Step 7: real login
-        return this.requestWithRetry(async () => {
+        const loginResult = await this.requestWithRetry(async () => {
             const nowSec = Math.floor(Date.now() / 1000);
-            const aacInitTimestamp =
-                nowSec - Math.floor(Math.random() * 50);
-            const aacjid = crypto.randomUUID
-                ? crypto.randomUUID()
-                : require('uuid').v4();
-            const aaccs = crypto
-                .randomBytes(32)
-                .toString('base64')
-                .replace(/=/g, '');
+            const aacInitTimestamp = nowSec - Math.floor(Math.random() * 50);
+            const aacjid = crypto.randomUUID ? crypto.randomUUID() : require('uuid').v4();
+            const aaccs = crypto.randomBytes(32).toString('base64').replace(/=/g, '');
 
             const androidDeviceId =
                 this.client.state.androidDeviceId ||
@@ -1143,18 +924,13 @@ class AccountRepository extends Repository {
             const familyDeviceId =
                 this.client.state.phoneId ||
                 this.client.state.familyDeviceId ||
-                (crypto.randomUUID
-                    ? crypto.randomUUID()
-                    : require('uuid').v4());
+                (crypto.randomUUID ? crypto.randomUUID() : require('uuid').v4());
             const qeDeviceId =
                 this.client.state.deviceId ||
                 this.client.state.qeDeviceId ||
-                (crypto.randomUUID
-                    ? crypto.randomUUID()
-                    : require('uuid').v4());
+                (crypto.randomUUID ? crypto.randomUUID() : require('uuid').v4());
 
             const accountsList = this.client.state.accountsList || [];
-
             const flashCallPermissionStatus = {
                 READ_PHONE_STATE: 'GRANTED',
                 READ_CALL_LOG: 'GRANTED',
@@ -1162,11 +938,7 @@ class AccountRepository extends Repository {
             };
 
             const clientInputParams = {
-                aac: JSON.stringify({
-                    aac_init_timestamp: aacInitTimestamp,
-                    aacjid,
-                    aaccs,
-                }),
+                aac: JSON.stringify({ aac_init_timestamp: aacInitTimestamp, aacjid, aaccs }),
                 sim_phones: [],
                 aymh_accounts: [],
                 network_bssid: null,
@@ -1194,8 +966,7 @@ class AccountRepository extends Repository {
                 machine_id: machineId,
                 flash_call_permission_status: flashCallPermissionStatus,
                 accounts_list: accountsList,
-                gms_incoming_call_retriever_eligibility:
-                    'client_not_supported',
+                gms_incoming_call_retriever_eligibility: 'client_not_supported',
                 family_device_id: familyDeviceId,
                 fb_ig_device_id: [],
                 device_emails: [],
@@ -1207,13 +978,9 @@ class AccountRepository extends Repository {
                 contact_point: username,
             };
 
-            const waterfallId = crypto.randomUUID
-                ? crypto.randomUUID()
-                : require('uuid').v4();
+            const waterfallId = crypto.randomUUID ? crypto.randomUUID() : require('uuid').v4();
             const latencyMarkerId = 36707139;
-            const latencyInstanceId = Number(
-                `${Date.now()}${Math.floor(Math.random() * 1000)}`
-            );
+            const latencyInstanceId = Number(`${Date.now()}${Math.floor(Math.random() * 1000)}`);
 
             const serverParams = {
                 should_trigger_override_login_2fa_action: 0,
@@ -1228,8 +995,7 @@ class AccountRepository extends Repository {
                 is_platform_login: 0,
                 INTERNAL__latency_qpl_marker_id: latencyMarkerId,
                 is_from_aymh: 0,
-                offline_experiment_group:
-                    'caa_iteration_v3_perf_ig_4',
+                offline_experiment_group: 'caa_iteration_v3_perf_ig_4',
                 is_from_landing_page: 0,
                 left_nav_button_action: 'NONE',
                 password_text_input_id: 'z0jejq:194',
@@ -1240,10 +1006,9 @@ class AccountRepository extends Repository {
                 username_text_input_id: 'z0jejq:193',
                 layered_homepage_experiment_group: null,
                 device_id: androidDeviceId,
-                login_surface: 'switcher',
+                login_surface: 'login_home',
                 INTERNAL__latency_qpl_instance_id: latencyInstanceId,
-                reg_flow_source:
-                    'login_home_native_integration_point',
+                reg_flow_source: 'aymh_multi_profiles_native_integration_point',
                 is_caa_perf_enabled: 1,
                 credential_type: 'password',
                 is_from_password_entry_page: 0,
@@ -1263,22 +1028,17 @@ class AccountRepository extends Repository {
                 this.client.state.bloksVersionId ||
                 '5e47baf35c5a270b44c8906c8b99063564b30ef69779f3dee0b828bee2e4ef5b';
 
-            const bkClientContext = JSON.stringify({
-                bloks_version: bloksVersionId,
-                styles_id: 'instagram',
-            });
-
+            const bkClientContext = JSON.stringify({ bloks_version: bloksVersionId, styles_id: 'instagram' });
             const lang = this.client.state.language || 'ro_RO';
             const acceptLanguage = `${lang.replace('_', '-')}, en-US`;
             const userAgent = this._resolveUserAgent();
+            const networkProps = buildNetworkProperties();
 
             const bloksHeaders = {
                 'accept-language': acceptLanguage,
-                'content-type':
-                    'application/x-www-form-urlencoded; charset=UTF-8',
+                'content-type': 'application/x-www-form-urlencoded; charset=UTF-8',
                 'ig-intended-user-id': '0',
                 priority: 'u=3',
-
                 'x-bloks-is-layout-rtl': 'false',
                 'x-bloks-prism-ax-base-colors-enabled': 'false',
                 'x-bloks-prism-button-version': 'CONTROL',
@@ -1286,19 +1046,14 @@ class AccountRepository extends Repository {
                 'x-bloks-prism-font-enabled': 'false',
                 'x-bloks-prism-indigo-link-version': '0',
                 'x-bloks-version-id': bloksVersionId,
-
                 'x-fb-client-ip': 'True',
-                'x-fb-connection-type': 'WIFI',
+                'x-fb-connection-type': 'MOBILE.UNKNOWN',
                 'x-fb-friendly-name':
                     'IgApi: bloks/async_action/com.bloks.www.bloks.caa.login.async.send_login_request/',
-                'x-fb-network-properties':
-                    'VPN;Validated;LocalAddrs=/10.0.0.2,;',
+                'x-fb-network-properties': networkProps, // FIX: dynamic
                 'x-fb-request-analytics-tags': JSON.stringify({
                     network_tags: {
-                        product: String(
-                            this.client.state.fbAnalyticsApplicationId ||
-                                '567067343352427'
-                        ),
+                        product: String(this.client.state.fbAnalyticsApplicationId || '567067343352427'),
                         purpose: 'fetch',
                         surface: 'undefined',
                         request_category: 'api',
@@ -1306,23 +1061,16 @@ class AccountRepository extends Repository {
                     },
                 }),
                 'x-fb-server-cluster': 'True',
-
                 'x-ig-android-id': androidDeviceId,
-                'x-ig-app-id': String(
-                    this.client.state.fbAnalyticsApplicationId ||
-                        '567067343352427'
-                ),
+                'x-ig-app-id': String(this.client.state.fbAnalyticsApplicationId || '567067343352427'),
                 'x-ig-app-locale': lang,
-                'x-ig-bandwidth-speed-kbps': (
-                    Math.random() * 1500 +
-                    800
-                ).toFixed(3),
+                'x-ig-bandwidth-speed-kbps': (Math.random() * 1500 + 800).toFixed(3),
                 'x-ig-bandwidth-totalbytes-b': '0',
                 'x-ig-bandwidth-totaltime-ms': '0',
                 'x-ig-client-endpoint':
                     'com.bloks.www.caa.login.aymh_single_profile_screen_entry',
                 'x-ig-capabilities': '3brTv10=',
-                'x-ig-connection-type': 'WIFI',
+                'x-ig-connection-type': 'MOBILE(UNKNOWN)',
                 'x-ig-device-id': qeDeviceId,
                 'x-ig-device-locale': lang,
                 'x-ig-family-device-id': familyDeviceId,
@@ -1330,29 +1078,20 @@ class AccountRepository extends Repository {
                 'x-ig-nav-chain':
                     'LockoutFragment:dogfooding_lockout:1:cold_start:...,com.bloks.www.caa.login.aymh_single_profile_screen_entry:com.bloks.www.caa.login.aymh_single_profile_screen_entry:14:button:0:::0',
                 'x-ig-timezone-offset': String(
-                    typeof this.client.state.timezoneOffset ===
-                        'number'
+                    typeof this.client.state.timezoneOffset === 'number'
                         ? this.client.state.timezoneOffset
                         : 7200
                 ),
                 'x-ig-www-claim': this.client.state.igWWWClaim || '0',
                 'x-mid': machineId,
-                'x-pigeon-rawclienttime': `${nowSec}.${Math.floor(
-                    Math.random() * 1000
-                )
-                    .toString()
-                    .padStart(3, '0')}`,
+                'x-pigeon-rawclienttime': `${nowSec}.${Math.floor(Math.random() * 1000).toString().padStart(3, '0')}`,
                 'x-pigeon-session-id':
                     this.client.state.pigeonSessionId ||
-                    `UFS-${crypto.randomBytes(16).toString(
-                        'hex'
-                    )}-1`,
+                    `UFS-${crypto.randomBytes(16).toString('hex')}-1`,
                 'x-tigon-is-retry': 'False',
-
-                'accept-encoding': 'gzip, deflate, br',
+                'accept-encoding': 'gzip, deflate',
                 'user-agent': userAgent,
-                'x-fb-conn-uuid-client':
-                    crypto.randomBytes(16).toString('hex'),
+                'x-fb-conn-uuid-client': crypto.randomBytes(16).toString('hex'),
                 'x-fb-http-engine': 'MNS/TCP',
                 'x-fb-rmd': 'state=URL_ELIGIBLE',
             };
@@ -1368,44 +1107,18 @@ class AccountRepository extends Repository {
                 headers: bloksHeaders,
             });
 
-            // DEBUG login response
-            try {
-                const fs = require('fs');
-                const path = require('path');
-                const debugDir = path.join(
-                    process.cwd(),
-                    'authinfo_instagram'
-                );
-                const debugFile = path.join(
-                    debugDir,
-                    'login-debug.json'
-                );
-                try {
-                    fs.mkdirSync(debugDir, { recursive: true });
-                } catch (e) {}
-
-                const debugPayload = {
-                    at: new Date().toISOString(),
-                    statusCode:
-                        response.statusCode || response.status || null,
-                    headers: response.headers || null,
-                    body: response.body || null,
-                };
-                fs.writeFileSync(
-                    debugFile,
-                    JSON.stringify(debugPayload, null, 2),
-                    'utf8'
-                );
-            } catch (e) {}
+            debugWrite('login-debug.json', {
+                at: new Date().toISOString(),
+                statusCode: response.statusCode || response.status || null,
+                headers: response.headers || null,
+                body: response.body || null,
+            });
 
             const body = response.body;
-
             this._extractAndSaveAuthorization(response);
 
             if (body && body.two_factor_required) {
-                const err = new Error(
-                    'Two factor authentication required'
-                );
+                const err = new Error('Two factor authentication required');
                 err.name = 'IgLoginTwoFactorRequiredError';
                 err.twoFactorInfo = body.two_factor_info;
                 throw err;
@@ -1429,42 +1142,26 @@ class AccountRepository extends Repository {
 
             if (body && body.layout) {
                 const layoutStr =
-                    typeof body.layout === 'string'
-                        ? body.layout
-                        : JSON.stringify(body.layout);
+                    typeof body.layout === 'string' ? body.layout : JSON.stringify(body.layout);
 
-                if (
-                    layoutStr.includes('two_factor_required') ||
-                    layoutStr.includes('"two_factor_info"')
-                ) {
+                if (layoutStr.includes('two_factor_required') || layoutStr.includes('"two_factor_info"')) {
                     let twoFactorInfo = null;
                     try {
-                        const match = layoutStr.match(
-                            /"two_factor_info"\s*:\s*(\{[^}]+\})/
-                        );
-                        if (match)
-                            twoFactorInfo = JSON.parse(match[1]);
+                        const match = layoutStr.match(/"two_factor_info"\s*:\s*(\{[^}]+\})/);
+                        if (match) twoFactorInfo = JSON.parse(match[1]);
                     } catch (e) {}
-                    const err = new Error(
-                        'Two factor authentication required'
-                    );
+                    const err = new Error('Two factor authentication required');
                     err.name = 'IgLoginTwoFactorRequiredError';
                     err.twoFactorInfo = twoFactorInfo;
                     throw err;
                 }
 
-                if (
-                    layoutStr.includes('bad_password') ||
-                    layoutStr.includes('incorrect_password')
-                ) {
+                if (layoutStr.includes('bad_password') || layoutStr.includes('incorrect_password')) {
                     const err = new Error('Bad password');
                     err.name = 'IgLoginBadPasswordError';
                     throw err;
                 }
-                if (
-                    layoutStr.includes('invalid_user') ||
-                    layoutStr.includes('user_not_found')
-                ) {
+                if (layoutStr.includes('invalid_user') || layoutStr.includes('user_not_found')) {
                     const err = new Error('Invalid user');
                     err.name = 'IgLoginInvalidUserError';
                     throw err;
@@ -1476,14 +1173,10 @@ class AccountRepository extends Repository {
                     throw err;
                 }
 
-                const tokenFromLayout =
-                    this._findBearerInString(layoutStr);
+                const tokenFromLayout = this._findBearerInString(layoutStr);
                 if (tokenFromLayout) {
-                    this.client.state.authorization =
-                        tokenFromLayout;
-                    try {
-                        this.client.state.updateAuthorization();
-                    } catch (e) {}
+                    this.client.state.authorization = tokenFromLayout;
+                    try { this.client.state.updateAuthorization(); } catch (e) {}
                 }
 
                 const pkPatterns = [
@@ -1499,8 +1192,7 @@ class AccountRepository extends Repository {
                     const pkMatch = layoutStr.match(pattern);
                     if (pkMatch) {
                         extractedPk = pkMatch[1];
-                        this.client.state.cookieUserId =
-                            extractedPk;
+                        this.client.state.cookieUserId = extractedPk;
                         this.client.state._userId = extractedPk;
                         break;
                     }
@@ -1513,89 +1205,54 @@ class AccountRepository extends Repository {
                     /x-ig-set-www-claim[\\"\s:]+([a-f0-9]+)/i,
                 ];
                 for (const pattern of wwwClaimPatterns) {
-                    const wwwClaimMatch = layoutStr.match(pattern);
-                    if (wwwClaimMatch) {
-                        this.client.state.igWWWClaim =
-                            wwwClaimMatch[1];
-                        break;
-                    }
+                    const m = layoutStr.match(pattern);
+                    if (m) { this.client.state.igWWWClaim = m[1]; break; }
                 }
 
                 const encKeyIdMatch2 =
-                    layoutStr.match(
-                        /IG-Set-Password-Encryption-Key-Id[\\"\s:]+(\d+)/i
-                    ) ||
-                    layoutStr.match(
-                        /password.encryption.key.id[\\"\s:]+(\d+)/i
-                    );
+                    layoutStr.match(/IG-Set-Password-Encryption-Key-Id[\\"\s:]+(\d+)/i) ||
+                    layoutStr.match(/password.encryption.key.id[\\"\s:]+(\d+)/i);
                 if (encKeyIdMatch2) {
-                    this.client.state.passwordEncryptionKeyId =
-                        parseInt(encKeyIdMatch2[1]);
+                    this.client.state.passwordEncryptionKeyId = parseInt(encKeyIdMatch2[1]);
                 }
 
                 const encPubKeyMatch2 =
-                    layoutStr.match(
-                        /IG-Set-Password-Encryption-Pub-Key[\\"\s:]+([A-Za-z0-9+\/=]+)/i
-                    ) ||
-                    layoutStr.match(
-                        /password.encryption.pub.key[\\"\s:]+([A-Za-z0-9+\/=]+)/i
-                    );
+                    layoutStr.match(/IG-Set-Password-Encryption-Pub-Key[\\"\s:]+([A-Za-z0-9+\/=]+)/i) ||
+                    layoutStr.match(/password.encryption.pub.key[\\"\s:]+([A-Za-z0-9+\/=]+)/i);
                 if (encPubKeyMatch2) {
-                    this.client.state.passwordEncryptionPubKey =
-                        encPubKeyMatch2[1];
+                    this.client.state.passwordEncryptionPubKey = encPubKeyMatch2[1];
                 }
 
                 const midMatch2 =
-                    layoutStr.match(
-                        /ig-set-x-mid[\\"\s:]+([A-Za-z0-9+\/=_-]+)/i
-                    ) ||
-                    layoutStr.match(
-                        /\\"x-mid\\"[\\"\s:]+([A-Za-z0-9+\/=_-]+)/i
-                    );
-                if (midMatch2) {
-                    this.client.state.mid = midMatch2[1];
-                }
+                    layoutStr.match(/ig-set-x-mid[\\"\s:]+([A-Za-z0-9+\/=_-]+)/i) ||
+                    layoutStr.match(/\\"x-mid\\"[\\"\s:]+([A-Za-z0-9+\/=_-]+)/i);
+                if (midMatch2) this.client.state.mid = midMatch2[1];
 
                 const loginResponsePatterns = [
-                    /\\"logged_in_user\\":\{[^}]*\\"pk\\":(\d+)[^}]*\\"username\\":\\"([^"\\]+)\\"/,
+                    /\\"logged_in_user\\":\{[^}]*\\"pk\\":(\\d+)[^}]*\\"username\\":\\"([^"\\]+)\\"/,
                     /"logged_in_user":\{[^}]*"pk":(\d+)[^}]*"username":"([^"]+)"/,
                     /\\"logged_in_user\\".*?\\"pk\\":\s*(\d+).*?\\"username\\":\s*\\"([^"\\]+)\\"/s,
                 ];
                 for (const pattern of loginResponsePatterns) {
-                    const loginResponseMatch =
-                        layoutStr.match(pattern);
-                    if (loginResponseMatch) {
-                        this.client.state.cookieUserId =
-                            loginResponseMatch[1];
-                        this.client.state._userId =
-                            loginResponseMatch[1];
-                        return {
-                            pk: parseInt(loginResponseMatch[1]),
-                            pk_id: loginResponseMatch[1],
-                            username: loginResponseMatch[2],
-                        };
+                    const m = layoutStr.match(pattern);
+                    if (m) {
+                        this.client.state.cookieUserId = m[1];
+                        this.client.state._userId = m[1];
+                        return { pk: parseInt(m[1]), pk_id: m[1], username: m[2] };
                     }
                 }
 
-                if (
-                    extractedPk &&
-                    this.client.state.authorization
-                ) {
+                if (extractedPk && this.client.state.authorization) {
                     try {
                         const userInfo = await this.currentUser();
                         const user = userInfo.user || userInfo;
                         if (user && user.pk) {
-                            this.client.state.cookieUserId =
-                                String(user.pk);
-                            this.client.state._userId =
-                                String(user.pk);
+                            this.client.state.cookieUserId = String(user.pk);
+                            this.client.state._userId = String(user.pk);
                         }
                         return user;
                     } catch (e) {
-                        return {
-                            pk: parseInt(extractedPk),
-                            pk_id: extractedPk,
-                        };
+                        return { pk: parseInt(extractedPk), pk_id: extractedPk };
                     }
                 }
             }
@@ -1615,8 +1272,7 @@ class AccountRepository extends Repository {
                     const userInfo = await this.currentUser();
                     const user = userInfo.user || userInfo;
                     if (user && user.pk) {
-                        this.client.state.cookieUserId =
-                            String(user.pk);
+                        this.client.state.cookieUserId = String(user.pk);
                         this.client.state._userId = String(user.pk);
                     }
                     return user;
@@ -1627,14 +1283,129 @@ class AccountRepository extends Repository {
 
             return body;
         });
+
+        // Post-login: set E2EE eligibility (as real app does after login)
+        try { await this._setE2eeEligibility(); } catch (e) {}
+
+        return loginResult;
     }
 
-    async twoFactorLogin(
-        username,
-        verificationCode,
-        twoFactorIdentifier,
-        verificationMethod = '1'
-    ) {
+    async _setE2eeEligibility(eligibility = 4) {
+        const state = this.client.state || {};
+        const lang = state.language || 'ro_RO';
+        const acceptLanguage = `${lang.replace('_', '-')}, en-US`;
+        const userAgent = this._resolveUserAgent();
+        const bloksVersionId =
+            state.bloksVersionId ||
+            '5e47baf35c5a270b44c8906c8b99063564b30ef69779f3dee0b828bee2e4ef5b';
+        const networkProps = buildNetworkProperties();
+        const nowSec = Math.floor(Date.now() / 1000);
+
+        const androidDeviceId =
+            state.androidDeviceId ||
+            state.deviceId ||
+            `android-${crypto.randomBytes(8).toString('hex')}`;
+        const familyDeviceId =
+            state.phoneId ||
+            state.familyDeviceId ||
+            (crypto.randomUUID ? crypto.randomUUID() : require('uuid').v4());
+        const qeDeviceId =
+            state.deviceId ||
+            state.qeDeviceId ||
+            (crypto.randomUUID ? crypto.randomUUID() : require('uuid').v4());
+        const machineId =
+            state.mid ||
+            state.machineId ||
+            `aZ${crypto.randomBytes(8).toString('hex')}`;
+
+        const headers = {
+            'accept-language': acceptLanguage,
+            'authorization': state.authorization || '',
+            'content-type': 'application/x-www-form-urlencoded; charset=UTF-8',
+            'ig-intended-user-id': String(state.cookieUserId || '0'),
+            'ig-u-ds-user-id': String(state.cookieUserId || '0'),
+            'priority': 'u=3',
+            'x-bloks-is-layout-rtl': 'false',
+            'x-bloks-prism-ax-base-colors-enabled': 'false',
+            'x-bloks-prism-button-version': 'CONTROL',
+            'x-bloks-prism-colors-enabled': 'true',
+            'x-bloks-prism-font-enabled': 'false',
+            'x-bloks-prism-indigo-link-version': '0',
+            'x-bloks-version-id': bloksVersionId,
+            'x-fb-client-ip': 'True',
+            'x-fb-connection-type': 'MOBILE.UNKNOWN',
+            'x-fb-friendly-name': 'IgApi: direct_v2/set_e2ee_eligibility/',
+            'x-fb-network-properties': networkProps,
+            'x-fb-request-analytics-tags': JSON.stringify({
+                network_tags: {
+                    product: String(state.fbAnalyticsApplicationId || '567067343352427'),
+                    purpose: 'fetch',
+                    surface: 'undefined',
+                    request_category: 'api',
+                    retry_attempt: '0',
+                },
+            }),
+            'x-fb-server-cluster': 'True',
+            'x-ig-android-id': androidDeviceId,
+            'x-ig-app-id': String(state.fbAnalyticsApplicationId || '567067343352427'),
+            'x-ig-app-locale': lang,
+            'x-ig-bandwidth-speed-kbps': (Math.random() * 1500 + 800).toFixed(3),
+            'x-ig-bandwidth-totalbytes-b': '0',
+            'x-ig-bandwidth-totaltime-ms': '0',
+            'x-ig-capabilities': '3brTv10=',
+            'x-ig-client-endpoint': 'empty',
+            'x-ig-connection-type': 'MOBILE(UNKNOWN)',
+            'x-ig-device-id': qeDeviceId,
+            'x-ig-device-languages': `{"system_languages":"${lang}"}`,
+            'x-ig-device-locale': lang,
+            'x-ig-family-device-id': familyDeviceId,
+            'x-ig-mapped-locale': lang,
+            'x-ig-nav-chain': 'LockoutFragment:dogfooding_lockout:1:cold_start',
+            'x-ig-salt-ids': state.igSaltIds || '220140399,332020310,974466465,974460658',
+            'x-ig-timezone-offset': String(
+                typeof state.timezoneOffset === 'number' ? state.timezoneOffset : 7200
+            ),
+            'x-ig-www-claim': state.igWWWClaim || '0',
+            'x-mid': machineId,
+            'x-pigeon-rawclienttime': `${nowSec}.${Math.floor(Math.random() * 1000).toString().padStart(3, '0')}`,
+            'x-pigeon-session-id':
+                state.pigeonSessionId ||
+                `UFS-${crypto.randomBytes(16).toString('hex')}-3`,
+            'x-tigon-is-retry': 'False',
+            'accept-encoding': 'gzip, deflate',
+            'user-agent': userAgent,
+            'x-fb-conn-uuid-client': crypto.randomBytes(16).toString('hex'),
+            'x-fb-http-engine': 'MNS/TCP',
+            'x-fb-rmd': 'state=URL_ELIGIBLE',
+        };
+
+        if (state.igURur) headers['ig-u-rur'] = state.igURur;
+
+        try {
+            const response = await this.client.request.send({
+                method: 'POST',
+                url: '/api/v1/direct_v2/set_e2ee_eligibility/',
+                form: {
+                    _uuid: qeDeviceId,
+                    e2ee_eligibility: String(eligibility),
+                },
+                headers,
+            });
+
+            debugWrite('e2ee-eligibility-debug.json', {
+                at: new Date().toISOString(),
+                statusCode: response.statusCode || response.status || null,
+                headers: response.headers || null,
+                body: response.body || null,
+            });
+
+            return response.body;
+        } catch (e) {
+            return null;
+        }
+    }
+
+    async twoFactorLogin(username, verificationCode, twoFactorIdentifier, verificationMethod = '1') {
         return this.requestWithRetry(async () => {
             const response = await this.client.request.send({
                 method: 'POST',
@@ -1660,9 +1431,7 @@ class AccountRepository extends Repository {
             const response = await this.client.request.send({
                 method: 'POST',
                 url: '/api/v1/accounts/logout/',
-                form: this.client.request.sign({
-                    _uuid: this.client.state.uuid,
-                }),
+                form: this.client.request.sign({ _uuid: this.client.state.uuid }),
             });
             return response.body;
         });
@@ -1683,14 +1452,7 @@ class AccountRepository extends Repository {
         return this.currentUser();
     }
 
-    async editProfile({
-        externalUrl,
-        phoneNumber,
-        username,
-        fullName,
-        biography,
-        email,
-    } = {}) {
+    async editProfile({ externalUrl, phoneNumber, username, fullName, biography, email } = {}) {
         return this.requestWithRetry(async () => {
             const current = await this.currentUser();
             const user = current.user || current;
@@ -1699,57 +1461,28 @@ class AccountRepository extends Repository {
                 url: '/api/v1/accounts/edit_profile/',
                 form: this.client.request.sign({
                     _uuid: this.client.state.uuid,
-                    external_url:
-                        externalUrl !== undefined
-                            ? externalUrl
-                            : user.external_url || '',
-                    phone_number:
-                        phoneNumber !== undefined
-                            ? phoneNumber
-                            : user.phone_number || '',
-                    username:
-                        username !== undefined
-                            ? username
-                            : user.username,
-                    full_name:
-                        fullName !== undefined
-                            ? fullName
-                            : user.full_name || '',
-                    biography:
-                        biography !== undefined
-                            ? biography
-                            : user.biography || '',
-                    email:
-                        email !== undefined
-                            ? email
-                            : user.email || '',
+                    external_url: externalUrl !== undefined ? externalUrl : user.external_url || '',
+                    phone_number: phoneNumber !== undefined ? phoneNumber : user.phone_number || '',
+                    username: username !== undefined ? username : user.username,
+                    full_name: fullName !== undefined ? fullName : user.full_name || '',
+                    biography: biography !== undefined ? biography : user.biography || '',
+                    email: email !== undefined ? email : user.email || '',
                 }),
             });
             return response.body;
         });
     }
 
-    async setBiography(biography) {
-        return this.editProfile({ biography });
-    }
-
-    async setExternalUrl(url) {
-        return this.editProfile({ externalUrl: url });
-    }
-
-    async removeBioLinks() {
-        return this.editProfile({ externalUrl: '' });
-    }
+    async setBiography(biography) { return this.editProfile({ biography }); }
+    async setExternalUrl(url) { return this.editProfile({ externalUrl: url }); }
+    async removeBioLinks() { return this.editProfile({ externalUrl: '' }); }
 
     async setGender(gender) {
         return this.requestWithRetry(async () => {
             const response = await this.client.request.send({
                 method: 'POST',
                 url: '/api/v1/accounts/set_gender/',
-                form: this.client.request.sign({
-                    _uuid: this.client.state.uuid,
-                    gender,
-                }),
+                form: this.client.request.sign({ _uuid: this.client.state.uuid, gender }),
             });
             return response.body;
         });
@@ -1760,9 +1493,7 @@ class AccountRepository extends Repository {
             const response = await this.client.request.send({
                 method: 'POST',
                 url: '/api/v1/accounts/set_private/',
-                form: this.client.request.sign({
-                    _uuid: this.client.state.uuid,
-                }),
+                form: this.client.request.sign({ _uuid: this.client.state.uuid }),
             });
             return response.body;
         });
@@ -1773,9 +1504,7 @@ class AccountRepository extends Repository {
             const response = await this.client.request.send({
                 method: 'POST',
                 url: '/api/v1/accounts/set_public/',
-                form: this.client.request.sign({
-                    _uuid: this.client.state.uuid,
-                }),
+                form: this.client.request.sign({ _uuid: this.client.state.uuid }),
             });
             return response.body;
         });
@@ -1804,10 +1533,7 @@ class AccountRepository extends Repository {
             const response = await this.client.request.send({
                 method: 'POST',
                 url: '/api/v1/accounts/send_confirm_email/',
-                form: this.client.request.sign({
-                    _uuid: this.client.state.uuid,
-                    send_source: 'edit_profile',
-                }),
+                form: this.client.request.sign({ _uuid: this.client.state.uuid, send_source: 'edit_profile' }),
             });
             return response.body;
         });
@@ -1818,10 +1544,7 @@ class AccountRepository extends Repository {
             const response = await this.client.request.send({
                 method: 'POST',
                 url: '/api/v1/accounts/send_confirm_phone_number/',
-                form: this.client.request.sign({
-                    _uuid: this.client.state.uuid,
-                    phone_number: phoneNumber,
-                }),
+                form: this.client.request.sign({ _uuid: this.client.state.uuid, phone_number: phoneNumber }),
             });
             return response.body;
         });
@@ -1847,9 +1570,7 @@ class AccountRepository extends Repository {
             const response = await this.client.request.send({
                 method: 'POST',
                 url: '/api/v1/accounts/remove_profile_picture/',
-                form: this.client.request.sign({
-                    _uuid: this.client.state.uuid,
-                }),
+                form: this.client.request.sign({ _uuid: this.client.state.uuid }),
             });
             return response.body;
         });
@@ -1873,9 +1594,7 @@ class AccountRepository extends Repository {
                 form: this.client.request.sign({
                     id: this.client.state.uuid,
                     server_config_retrieval: '1',
-                    experiments:
-                        this.client.state.constants
-                            .LOGIN_EXPERIMENTS,
+                    experiments: this.client.state.constants.LOGIN_EXPERIMENTS,
                 }),
             });
             return response.body;
@@ -1884,12 +1603,7 @@ class AccountRepository extends Repository {
 
     async syncPostLoginExperiments() {
         let userId;
-        try {
-            userId = this.client.state.cookieUserId;
-        } catch {
-            userId = '0';
-        }
-
+        try { userId = this.client.state.cookieUserId; } catch { userId = '0'; }
         return this.requestWithRetry(async () => {
             const response = await this.client.request.send({
                 method: 'POST',
@@ -1899,8 +1613,7 @@ class AccountRepository extends Repository {
                     _uid: userId,
                     _uuid: this.client.state.uuid,
                     server_config_retrieval: '1',
-                    experiments:
-                        this.client.state.constants.EXPERIMENTS,
+                    experiments: this.client.state.constants.EXPERIMENTS,
                 }),
             });
             return response.body;
@@ -1908,17 +1621,13 @@ class AccountRepository extends Repository {
     }
 
     async syncLauncher(preLogin = true) {
-        const data = {
-            id: this.client.state.uuid,
-            server_config_retrieval: '1',
-        };
+        const data = { id: this.client.state.uuid, server_config_retrieval: '1' };
         if (!preLogin) {
             try {
                 data._uid = this.client.state.cookieUserId;
                 data._uuid = this.client.state.uuid;
             } catch {}
         }
-
         return this.requestWithRetry(async () => {
             const response = await this.client.request.send({
                 method: 'POST',
@@ -1934,10 +1643,7 @@ class AccountRepository extends Repository {
             const response = await this.client.request.send({
                 method: 'POST',
                 url: '/api/v1/devices/sync/',
-                form: this.client.request.sign({
-                    id: this.client.state.uuid,
-                    server_config_retrieval: '1',
-                }),
+                form: this.client.request.sign({ id: this.client.state.uuid, server_config_retrieval: '1' }),
             });
             return response.body;
         });
@@ -1964,10 +1670,7 @@ class AccountRepository extends Repository {
             const response = await this.client.request.send({
                 method: 'POST',
                 url: '/api/v1/accounts/contact_point_prefill/',
-                form: this.client.request.sign({
-                    phone_id: this.client.state.phoneId,
-                    usage,
-                }),
+                form: this.client.request.sign({ phone_id: this.client.state.phoneId, usage }),
             });
             return response.body;
         });
@@ -1995,10 +1698,7 @@ class AccountRepository extends Repository {
             const response = await this.client.request.send({
                 method: 'GET',
                 url: '/api/v1/consent/get_signup_config/',
-                qs: {
-                    guid: this.client.state.uuid,
-                    main_account_selected: false,
-                },
+                qs: { guid: this.client.state.uuid, main_account_selected: false },
             });
             return response.body;
         });
@@ -2036,91 +1736,70 @@ class AccountRepository extends Repository {
         });
     }
 
+    /**
+     * FIX MAJOR — generateAttestParams: each certificate in the chain
+     * now has its own EC key pair, correctly simulating the
+     * Android Keystore hierarchy (leaf → intermediate1 → intermediate2 → root).
+     */
     static generateAttestParams(state) {
-        const challengeNonce = crypto
-            .randomBytes(24)
-            .toString('base64url');
-        const { privateKey, publicKey } = crypto.generateKeyPairSync(
-            'ec',
-            {
-                namedCurve: 'prime256v1',
-            }
+        // Key for leaf (the actually attested key)
+        const leafKey = crypto.generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
+
+        const challengeNonce = crypto.randomBytes(24).toString('base64url');
+        const signedData = crypto.sign(null, Buffer.from(challengeNonce), leafKey.privateKey);
+        const signedNonce = signedData.toString('base64');
+        const publicKeyDer = leafKey.publicKey.export({ type: 'spki', format: 'der' });
+        const keyHash = crypto.createHash('sha256').update(publicKeyDer).digest('hex');
+
+        // Separate keys for each level in the chain
+        const int1Key = crypto.generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
+        const int2Key = crypto.generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
+        const rootKey = crypto.generateKeyPairSync('ec', { namedCurve: 'prime256v1' });
+
+        const leafCertPem = AccountRepository._generateSignedCert(
+            leafKey.privateKey, leafKey.publicKey, 'Android Keystore Key',
+            int1Key.privateKey // signed by intermediate 1
         );
-        const signedData = crypto.sign(
-            null,
-            Buffer.from(challengeNonce),
-            privateKey
+        const intermediate1Pem = AccountRepository._generateSignedCert(
+            int1Key.privateKey, int1Key.publicKey, 'Android Keystore Key Attestation',
+            int2Key.privateKey // signed by intermediate 2
+        );
+        const intermediate2Pem = AccountRepository._generateSignedCert(
+            int2Key.privateKey, int2Key.publicKey, 'Android Hardware Keystore',
+            rootKey.privateKey // self-signed root
+        );
+        const rootCertPem = AccountRepository._generateSignedCert(
+            rootKey.privateKey, rootKey.publicKey, 'Android Keystore Root',
+            rootKey.privateKey // self-signed root
         );
-        const signedNonce = signedData.toString('base64');
-        const publicKeyDer = publicKey.export({
-            type: 'spki',
-            format: 'der',
-        });
-        const keyHash = crypto
-            .createHash('sha256')
-            .update(publicKeyDer)
-            .digest('hex');
-
-        const leafCertPem =
-            AccountRepository._generateSelfSignedCert(
-                privateKey,
-                publicKey,
-                'Android Keystore Key'
-            );
-        const intermediate1Pem =
-            AccountRepository._generateSelfSignedCert(
-                privateKey,
-                publicKey,
-                'Android Keystore Key Attestation'
-            );
-        const intermediate2Pem =
-            AccountRepository._generateSelfSignedCert(
-                privateKey,
-                publicKey,
-                'Android Hardware Keystore'
-            );
-        const rootCertPem =
-            AccountRepository._generateSelfSignedCert(
-                privateKey,
-                publicKey,
-                'Android Keystore Root'
-            );
 
-        const certificateChain = [
-            leafCertPem,
-            intermediate1Pem,
-            intermediate2Pem,
-            rootCertPem,
-        ].join('\n');
+        const certificateChain = [leafCertPem, intermediate1Pem, intermediate2Pem, rootCertPem].join('\n');
 
         return {
-            attestation: [
-                {
-                    version: 2,
-                    type: 'keystore',
-                    errors: [0],
-                    challenge_nonce: challengeNonce,
-                    signed_nonce: signedNonce,
-                    key_hash: keyHash,
-                    certificate_chain: certificateChain,
-                },
-            ],
+            attestation: [{
+                version: 2,
+                type: 'keystore',
+                errors: [0],
+                challenge_nonce: challengeNonce,
+                signed_nonce: signedNonce,
+                key_hash: keyHash,
+                certificate_chain: certificateChain,
+            }],
         };
     }
 
-    static _generateSelfSignedCert(privateKey, publicKey, cn) {
-        const publicKeyDer = publicKey.export({
-            type: 'spki',
-            format: 'der',
-        });
+    /**
+     * FIX: _generateSignedCert now accepts a separate signing key
+     * (signerPrivateKey), enabling the correct certificate hierarchy.
+     */
+    static _generateSignedCert(privateKey, publicKey, cn, signerPrivateKey) {
+        if (!signerPrivateKey) signerPrivateKey = privateKey; // self-signed fallback
+
+        const publicKeyDer = publicKey.export({ type: 'spki', format: 'der' });
         const serialNumber = crypto.randomBytes(8);
         const now = new Date();
-        const notBefore = new Date(
-            now.getTime() - 365 * 24 * 60 * 60 * 1000
-        );
-        const notAfter = new Date(
-            now.getTime() + 10 * 365 * 24 * 60 * 60 * 1000
-        );
+        const notBefore = new Date(now.getTime() - 365 * 24 * 60 * 60 * 1000);
+        const notAfter = new Date(now.getTime() + 10 * 365 * 24 * 60 * 60 * 1000);
         const cnBytes = Buffer.from(cn, 'utf8');
         const cnSeq = Buffer.concat([
             Buffer.from([0x30, cnBytes.length + 13]),
@@ -2132,122 +1811,83 @@ class AccountRepository extends Repository {
         ]);
 
         function encodeTime(date) {
-            const str =
-                date
-                    .toISOString()
-                    .replace(/[-:T]/g, '')
-                    .slice(2, 14) + 'Z';
-            return Buffer.concat([
-                Buffer.from([0x17, str.length]),
-                Buffer.from(str),
-            ]);
+            const str = date.toISOString().replace(/[-:T]/g, '').slice(2, 14) + 'Z';
+            return Buffer.concat([Buffer.from([0x17, str.length]), Buffer.from(str)]);
         }
 
-        const validityBuf = Buffer.concat([
-            encodeTime(notBefore),
-            encodeTime(notAfter),
-        ]);
-        const validity = Buffer.concat([
-            Buffer.from([0x30, validityBuf.length]),
-            validityBuf,
-        ]);
+        const validityBuf = Buffer.concat([encodeTime(notBefore), encodeTime(notAfter)]);
+        const validity = Buffer.concat([Buffer.from([0x30, validityBuf.length]), validityBuf]);
 
         const tbs = Buffer.concat([
             Buffer.from([0xa0, 0x03, 0x02, 0x01, 0x02]),
             Buffer.from([0x02, serialNumber.length]),
             serialNumber,
-            Buffer.from([
-                0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d,
-                0x04, 0x03, 0x02,
-            ]),
+            Buffer.from([0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02]),
             cnSeq,
             validity,
             cnSeq,
             publicKeyDer,
         ]);
 
-        const tbsSeq = Buffer.concat([
-            Buffer.from([0x30, 0x82]),
-            Buffer.alloc(2),
-            tbs,
-        ]);
+        const tbsSeq = Buffer.concat([Buffer.from([0x30, 0x82]), Buffer.alloc(2), tbs]);
         tbsSeq.writeUInt16BE(tbs.length, 2);
 
-        const signature = crypto.sign(null, tbsSeq, privateKey);
+        // FIX: signed with signerPrivateKey (can be an upper-level key)
+        const signature = crypto.sign(null, tbsSeq, signerPrivateKey);
         const sigBitString = Buffer.concat([
             Buffer.from([0x03, signature.length + 1, 0x00]),
             signature,
         ]);
-        const algId = Buffer.from([
-            0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d,
-            0x04, 0x03, 0x02,
-        ]);
+        const algId = Buffer.from([0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x04, 0x03, 0x02]);
         const certBody = Buffer.concat([tbsSeq, algId, sigBitString]);
-        const cert = Buffer.concat([
-            Buffer.from([0x30, 0x82]),
-            Buffer.alloc(2),
-            certBody,
-        ]);
+        const cert = Buffer.concat([Buffer.from([0x30, 0x82]), Buffer.alloc(2), certBody]);
         cert.writeUInt16BE(certBody.length, 2);
 
         const b64 = cert.toString('base64');
         const lines = b64.match(/.{1,76}/g) || [b64];
-        return (
-            '-----BEGIN CERTIFICATE-----\n' +
-            lines.join('\n') +
-            '\n-----END CERTIFICATE-----'
-        );
+        return '-----BEGIN CERTIFICATE-----\n' + lines.join('\n') + '\n-----END CERTIFICATE-----';
+    }
+
+    // Kept for compatibility — internally calls _generateSignedCert
+    static _generateSelfSignedCert(privateKey, publicKey, cn) {
+        return AccountRepository._generateSignedCert(privateKey, publicKey, cn, privateKey);
     }
 
     static createJazoest(input) {
         const buf = Buffer.from(input || '', 'ascii');
         let sum = 0;
-        for (let i = 0; i < buf.byteLength; i++) {
-            sum += buf.readUInt8(i);
-        }
+        for (let i = 0; i < buf.byteLength; i++) sum += buf.readUInt8(i);
         return `2${sum}`;
     }
 
     encryptPassword(password) {
         if (!this.client.state.passwordEncryptionPubKey) {
-            return {
-                time: Math.floor(Date.now() / 1000).toString(),
-                encrypted: password,
-            };
+            // FIX: no longer returning password in plaintext — throws a controlled error
+            throw new Error(
+                'passwordEncryptionPubKey missing from state. ' +
+                'Cannot encrypt password safely.'
+            );
         }
         const randKey = crypto.randomBytes(32);
         const iv = crypto.randomBytes(12);
         const rsaEncrypted = crypto.publicEncrypt(
             {
-                key: Buffer.from(
-                    this.client.state.passwordEncryptionPubKey,
-                    'base64'
-                ).toString(),
+                key: Buffer.from(this.client.state.passwordEncryptionPubKey, 'base64').toString(),
                 padding: crypto.constants.RSA_PKCS1_PADDING,
             },
             randKey
         );
-        const cipher = crypto.createCipheriv(
-            'aes-256-gcm',
-            randKey,
-            iv
-        );
+        const cipher = crypto.createCipheriv('aes-256-gcm', randKey, iv);
         const time = Math.floor(Date.now() / 1000).toString();
         cipher.setAAD(Buffer.from(time));
-        const aesEncrypted = Buffer.concat([
-            cipher.update(password, 'utf8'),
-            cipher.final(),
-        ]);
+        const aesEncrypted = Buffer.concat([cipher.update(password, 'utf8'), cipher.final()]);
         const sizeBuffer = Buffer.alloc(2, 0);
         sizeBuffer.writeInt16LE(rsaEncrypted.byteLength, 0);
         const authTag = cipher.getAuthTag();
         return {
             time,
             encrypted: Buffer.concat([
-                Buffer.from([
-                    1,
-                    this.client.state.passwordEncryptionKeyId || 0,
-                ]),
+                Buffer.from([1, this.client.state.passwordEncryptionKeyId || 0]),
                 iv,
                 sizeBuffer,
                 rsaEncrypted,
@@ -2258,16 +1898,10 @@ class AccountRepository extends Repository {
     }
 
     async passwordPublicKeys() {
-        const response = await this.client.request.send({
-            method: 'GET',
-            url: '/api/v1/qe/sync/',
-        });
+        const response = await this.client.request.send({ method: 'GET', url: '/api/v1/qe/sync/' });
         const headers = response.headers || {};
-        const keyId = parseInt(
-            headers['ig-set-password-encryption-key-id'] || '0'
-        );
-        const pubKey =
-            headers['ig-set-password-encryption-pub-key'] || '';
+        const keyId = parseInt(headers['ig-set-password-encryption-key-id'] || '0');
+        const pubKey = headers['ig-set-password-encryption-pub-key'] || '';
         return { keyId, pubKey };
     }
 
@@ -2309,6 +1943,7 @@ class AccountRepository extends Repository {
         });
     }
 
+    // CRITICAL FIX: 'preferen1gces' → 'preferences' (typo → ReferenceError fix)
     async pushPreferences(preferences = 'default') {
         return this.requestWithRetry(async () => {
             const response = await this.client.request.send({
@@ -2321,7 +1956,7 @@ class AccountRepository extends Repository {
                     phone_id: this.client.state.phoneId,
                     device_token: '',
                     guid: this.client.state.uuid,
-                    users: preferen1gces,
+                    users: preferences, // FIX: was 'preferen1gces'
                 }),
             });
             return response.body;