whalibmob 5.14.18 → 5.14.19

package/README.md

@@ -2149,7 +2149,8 @@ History arrives in chunks over the first minute or so after linking, largest fir
 | File | Holds |
 |---|---|
 | `<phone>.web.json` | link state — keys, `advSecretKey`, the device slot you were given |
-| `<phone>.web.signal.json` | Signal sessions and pre-keys for the linked device |
+| `<phone>.web.signal.json` | Signal sessions, signed pre-key, identities, LID map, pre-key counters |
+| `<phone>.web.pre-key-<id>.json` | one one-time pre-key — 812 of them |
 | `<phone>.web.sk.json` | group SenderKeys |
 | `<phone>.web.tctoken.json` | privacy tokens |
 | `<phone>.web.appState.json` | app-state version and hash per collection |
@@ -2538,7 +2539,11 @@ whalibmob_auth/
 ├── android-apk-material-business.json
 ├── 919634847671/
 │   ├── 919634847671.json                ← the store: keys, device, version
-│   ├── 919634847671.signal.json         ← Signal sessions
+│   ├── 919634847671.signal.json         ← Signal sessions, signed pre-key, identities
+│   ├── 919634847671.pre-key-1.json      ← one-time pre-keys, one file each
+│   ├── 919634847671.pre-key-2.json
+│   ├── …                                  812 of them
+│   ├── 919634847671.pre-key-812.json
 │   ├── 919634847671.sk.json             ← sender keys
 │   ├── 919634847671.tctoken.json
 │   ├── 919634847671.device-cache.json
@@ -2566,6 +2571,66 @@ of a pile by prefix.
 > is moved unless you ask — `wa migrate-sessions` does that, one number or all
 > of them, and re-running it is safe.
 
+### One-time Pre-keys
+
+A pre-key is a one-shot Diffie-Hellman key the account leaves with the server so
+somebody who wants to message it can open a Signal session without it being
+online. Each one is handed out once and then gone. Run out and nobody can start
+a conversation with the number at all — the messages are not delayed, they are
+never sent, and nothing anywhere reports it.
+
+whalibmob keeps a pool of **812**, generated the moment a session is created and
+written one key per file, in whatever authentication folder you gave it:
+
+```
+~/.waSession/919634847671/
+├── 919634847671.pre-key-1.json
+├── 919634847671.pre-key-2.json
+└── … 919634847671.pre-key-812.json
+```
+
+A companion link for the same number keeps its own pool beside it as
+`919634847671.web.pre-key-<id>.json`. The two are never shared: they are
+separate devices with separate identity keys, and a key offered under the wrong
+one cannot be answered.
+
+The file is the same shape the reference client writes — the raw 32-byte public
+key and the private key, both BufferJSON:
+
+```json
+{"private":{"type":"Buffer","data":"…"},"public":{"type":"Buffer","data":"…"}}
+```
+
+**Keeping the server stocked.** Three things drive it, and all of them ask the
+server what it is actually holding rather than guessing from the local pool —
+the two drift apart, because the server spends a key on every bundle it hands
+out and none of that reaches this side.
+
+| When | What it does |
+|---|---|
+| on login | asks the server for its count; **0** there means a full 812 goes up, anything low means a top-up of 5 |
+| when the server says it is running low | same check, same batch |
+| every 30 minutes | same check — for the session that stays up long enough to be drained without a word |
+
+A batch is the next ids the server has not been sent, never the whole pool
+again, and only counts as sent once the server has acknowledged it — a rejected
+upload is retried four times with backoff and then left for the next check, with
+the same keys still queued. Ids are never reused, even after the key under one
+has been spent.
+
+After the login upload the account also asks for the server's **key bundle
+digest** and compares the identity key and signed pre-key it is being served
+against the ones this session holds. A mismatch there is the failure that used
+to need the number registering again to clear.
+
+None of this needs calling: `init()` and `connectWeb()` both do it, identically.
+
+> [!NOTE]
+> **Sessions written before 5.14.19 keep every key they had.** Pre-keys used to
+> live inside `<phone>.signal.json`; on the first start they are moved out into
+> files of their own and the aggregate copy is dropped. The keys themselves do
+> not change, so the bundles the server has already handed out stay answerable.
+
 ### Where the folder comes from
 
 | order | source |
@@ -2720,6 +2785,14 @@ Creates a fresh credential store for the given phone number — the key pairs, r
 
 It returns everything `createNewStore` does, plus a few fields kept for application code that expects them: `nextPreKeyId`, `firstUnuploadedPreKeyId`, `accountSyncCounter`, `accountSettings`, `processedHistoryMessages` and `advSecretKey`. Those extras live on the object only — `saveStore` does not write them, so they are not there again after a reload. Nothing in the library reads them; treat them as a convenience, not as state.
 
+> [!NOTE]
+> The two pre-key counters the library actually runs on are the ones in the
+> `SignalStore` — `nextPreKeyId()` and `firstUnuploadedPreKeyId()`, persisted in
+> `<phone>.signal.json`. They live there rather than in the store because a
+> number's mobile half and its companion half have a `SignalStore` each and must
+> never share a pre-key id space. The fields above are the same names on a
+> different object and do not drive anything.
+
 ```js
 const { initAuthCreds, saveStore } = require('whalibmob')
 const path = require('path')

package/lib/Client.js

@@ -11,7 +11,7 @@ const { NoiseSocket }     = require('./noise');
 const { MessageSender, generateMessageId, makeJid, buildOrGetAdvIdentity } = require('./messages/MessageSender');
 const { checkIfRegistered, checkNumberStatus, requestSmsCode, verifyCode, assertRegistrationKeys, fetchIosVersion, fetchWaVersion } = require('./Registration');
 const { defaultBaseDir, sessionDirFor, isLegacyLayout,
-        SESSION_SUFFIXES } = require('./SessionPaths');
+        preKeyFilesFor, SESSION_SUFFIXES } = require('./SessionPaths');
 const { getDeviceConfig } = require('./DeviceConfig');
 const { prepareProfilePicture, probeImageSize, canDecodeImage } = require('./MediaThumbnail');
 const { createNewStore, saveStore, loadStore, toSixParts, fromSixParts } = require('./Store');
@@ -47,7 +47,8 @@ const { NodeCache }       = require('@cacheable/node-cache');
 
 // Group metadata cache lifetime — matches DeviceManager's device cache.
 const GROUP_META_CACHE_TTL = '5m';
-const { SignalProtocol }  = require('./signal/SignalProtocol');
+const { SignalProtocol, INITIAL_PREKEY_COUNT, MIN_PREKEY_COUNT } =
+  require('./signal/SignalProtocol');
 const { DeviceManager, jidStrToObj } = require('./DeviceManager');
 const {
   processHistorySyncNotification,
@@ -172,10 +173,10 @@ const PING_INTERVAL_MS    = 25000;
 const KEEPALIVE_INTERVAL  = 20000;
 const RECONNECT_BACKOFF   = [1000, 2000, 4000, 8000, 15000, 30000];
 
-// When the server is down to this many one-time keys or fewer, send it more.
-// The number is small on purpose: the server tells us when it is running low,
-// and this is the floor for the case where that notice never arrives.
-const PRE_KEY_SERVER_MIN  = 5;
+// How many attempts an upload gets before it is left for the next check, and
+// how long it waits between them.
+const PRE_KEY_UPLOAD_TRIES   = 4;
+const PRE_KEY_UPLOAD_BACKOFF = (attempt) => Math.min(1000 * Math.pow(2, attempt), 10000);
 
 // How often to ask the server how many it has left. The drain is invisible from
 // here — every bundle handed out is a key gone, and none of that reaches this
@@ -1229,6 +1230,22 @@ class WhalibmobClient extends EventEmitter {
       fs.renameSync(from, to);
       moved.push(suffix);
     }
+
+    // The pre-key files carry the number in their names too, one per key.
+    // preKeyFilesFor anchors on the digits, so that is what the new name
+    // replaces — the `.web` half and the id after it are kept as they are.
+    const currentDigits = current.replace(/\D/g, '');
+    for (const name of preKeyFilesFor(fromDir, current)) {
+      const renamed = canonical + name.slice(currentDigits.length);
+      const to      = path.join(fromDir, renamed);
+      if (fs.existsSync(to)) {
+        throw new Error('Cannot rename session: ' + renamed +
+          ' already exists. Move it aside first.');
+      }
+      fs.renameSync(path.join(fromDir, name), to);
+      moved.push(renamed);
+    }
+
     if (!moved.length) throw new Error('No session files found for ' + current);
 
     if (toDir !== fromDir) {
@@ -1306,7 +1323,10 @@ class WhalibmobClient extends EventEmitter {
     // bundle it is serving, which is the thing that goes quietly wrong and
     // takes the account's reachability with it.
     this._ensureServerPreKeys('login')
-      .then(() => this._verifyServerKeyBundle('login'));
+      .then(() => this._verifyServerKeyBundle('login'))
+      // Both swallow their own failures; this is only here so that a rejection
+      // from somewhere neither expected cannot take the process down with it.
+      .catch(err => _whaDbg('[DBG] PREKEY login check failed: ' + (err && err.message)));
 
     // Same telemetry ping the web client sends on every completed login.
     this._sendUnifiedSession();
@@ -3041,7 +3061,7 @@ class WhalibmobClient extends EventEmitter {
     // rotating index wraps back onto ids that are still in flight.
     let pkId = existing ? existing.pkId : null;
     if (pkId === null && this._signal) {
-      const allKeys = this._signal.getPreKeysForUpload(800);
+      const allKeys = this._signal.getPreKeysForUpload(INITIAL_PREKEY_COUNT);
       const free = allKeys.find(k => !this._retryAdvertisedPreKeys.has(k.keyId));
       // If every key is already spoken for, fall back to rotating rather than
       // sending no bundle at all — a stale id beats no retry.
@@ -3069,7 +3089,7 @@ class WhalibmobClient extends EventEmitter {
       try {
         const spk        = this._signal.getSignedPreKeyForUpload();
         const identKey   = this._signal.getIdentityKey();
-        const allPreKeys = this._signal.getPreKeysForUpload(800);
+        const allPreKeys = this._signal.getPreKeysForUpload(INITIAL_PREKEY_COUNT);
         const pk         = allPreKeys.find(k => k.keyId === pkId) || allPreKeys[0];
 
         if (spk && identKey && pk) {
@@ -3527,39 +3547,81 @@ class WhalibmobClient extends EventEmitter {
 
   // ─── Pre-key upload ───────────────────────────────────────────────────────
 
-  _uploadPreKeys() {
-    if (!this._signal || !this._socket || !this._connected) return;
+  // Send the server a batch of one-time keys, plus the identity and signed
+  // pre-key that go with them.
+  //
+  // The batch is the next `count` ids the server has not been sent — not the
+  // whole local pool, which is what this used to send. Eight hundred keys went
+  // up on every login and every top-up, the same eight hundred each time, and
+  // the ids the server had already been given were sent again while the ones
+  // generated since were not.
+  //
+  // Awaited, and retried, because it is the one message whose loss is silent:
+  // an upload that never lands leaves the server with nothing to hand out and
+  // the account unreachable, with no error anywhere to say so.
+  //
+  // @returns {Promise<boolean>} whether the server acknowledged it
+  async _uploadPreKeys(count) {
+    if (!this._signal || !this._socket || !this._connected) return false;
+    count = count > 0 ? count : MIN_PREKEY_COUNT;
 
-    const preKeys  = this._signal.getPreKeysForUpload(800);
+    const { preKeys, update } = this._signal.getNextPreKeys(count);
     const spk      = this._signal.getSignedPreKeyForUpload();
     const identKey = this._signal.getIdentityKey();
-    if (!preKeys.length || !spk) return;
-
-    const preKeyNodes = preKeys.map(pk => new BinaryNode('key', {}, [
-      new BinaryNode('id',    {}, intToBytes(pk.keyId, 3)),
-      new BinaryNode('value', {}, stripKeyPrefix(pk.pubKey))
-    ]));
+    if (!preKeys.length || !spk) return false;
 
-    const skNode = new BinaryNode('skey', {}, [
-      new BinaryNode('id',        {}, intToBytes(spk.keyId, 3)),
-      new BinaryNode('value',     {}, stripKeyPrefix(spk.keyPair.pubKey)),
-      new BinaryNode('signature', {}, spk.signature)
-    ]);
-
-    const pkId = this._genMsgId();
-    _whaDbg('[DBG] SEND uploadPreKeys IQ id=' + pkId);
-    this._socket.sendNode(new BinaryNode('iq', {
-      id:    pkId,
-      to:    's.whatsapp.net',
-      type:  'set',
-      xmlns: 'encrypt'
-    }, [
+    const children = [
       new BinaryNode('registration', {}, intToBytes(this._store.registrationId, 4)),
       new BinaryNode('type',         {}, Buffer.from([5])),
       new BinaryNode('identity',     {}, stripKeyPrefix(identKey)),
-      new BinaryNode('list',         {}, preKeyNodes),
-      skNode
-    ]));
+      new BinaryNode('list',         {}, preKeys.map(pk => new BinaryNode('key', {}, [
+        new BinaryNode('id',    {}, intToBytes(pk.keyId, 3)),
+        new BinaryNode('value', {}, stripKeyPrefix(pk.pubKey))
+      ]))),
+      new BinaryNode('skey', {}, [
+        new BinaryNode('id',        {}, intToBytes(spk.keyId, 3)),
+        new BinaryNode('value',     {}, stripKeyPrefix(spk.keyPair.pubKey)),
+        new BinaryNode('signature', {}, spk.signature)
+      ])
+    ];
+
+    for (let attempt = 0; attempt < PRE_KEY_UPLOAD_TRIES; attempt++) {
+      if (!this._socket || !this._connected) break;
+
+      const pkId = this._genMsgId();
+      _whaDbg('[DBG] SEND uploadPreKeys IQ id=' + pkId + ' count=' + preKeys.length +
+        ' ids=' + preKeys[0].keyId + '..' + preKeys[preKeys.length - 1].keyId +
+        (attempt ? ' (retry ' + attempt + ')' : ''));
+
+      let resp = null;
+      try {
+        resp = await this._sendIq(new BinaryNode('iq', {
+          id:    pkId,
+          to:    's.whatsapp.net',
+          type:  'set',
+          xmlns: 'encrypt'
+        }, children));
+      } catch (err) {
+        _whaDbg('[DBG] PREKEY upload send failed: ' + (err && err.message));
+      }
+
+      if (resp && !(resp.attrs && resp.attrs.type === 'error')) {
+        // Only now. The keys themselves were spent the moment they were
+        // generated — an id is never handed out twice — but a batch the server
+        // did not take is a batch that still has to go, so the range stays
+        // unuploaded until it is acknowledged.
+        this._signal.commitPreKeyUpload(update);
+        _whaDbg('[DBG] PREKEY uploaded ' + preKeys.length + ' key(s)');
+        return true;
+      }
+
+      if (attempt < PRE_KEY_UPLOAD_TRIES - 1) {
+        await new Promise(r => setTimeout(r, PRE_KEY_UPLOAD_BACKOFF(attempt)));
+      }
+    }
+
+    _whaDbg('[DBG] PREKEY upload gave up after ' + PRE_KEY_UPLOAD_TRIES + ' attempt(s)');
+    return false;
   }
 
   // How many one-time keys the server is still holding for us.
@@ -3671,8 +3733,7 @@ class WhalibmobClient extends EventEmitter {
 
       if (digest.missing) {
         _whaDbg('[DBG] KEYBUNDLE server returned no digest (' + reason + ') — re-uploading');
-        this._replenishLocalPreKeys();
-        this._uploadPreKeys();
+        await this._uploadPreKeys(INITIAL_PREKEY_COUNT);
         return;
       }
 
@@ -3705,8 +3766,10 @@ class WhalibmobClient extends EventEmitter {
 
       _whaDbg('[DBG] KEYBUNDLE server disagrees on ' + mismatches.join(' and ') +
         ' (' + reason + ') — re-uploading');
-      this._replenishLocalPreKeys();
-      this._uploadPreKeys();
+      // What is wrong here is the identity or the signed pre-key, and both ride
+      // along with any batch, however small. The one-time pool was settled a
+      // moment ago by _ensureServerPreKeys.
+      await this._uploadPreKeys(MIN_PREKEY_COUNT);
     } catch (err) {
       _whaDbg('[DBG] KEYBUNDLE check failed (' + reason + '): ' + (err && err.message));
     }
@@ -3726,33 +3789,48 @@ class WhalibmobClient extends EventEmitter {
     if (!this._signal) return;
     try {
       const serverCount = await this._queryServerPreKeyCount();
+
+      // How big a batch this warrants. A server holding none of ours has either
+      // never had them or has handed every one out, and either way the account
+      // is unreachable until a full pool is back up there; anything else is a
+      // top-up. A session that has never uploaded counts as the first case even
+      // when the server says it has some, because whatever it is holding did
+      // not come from here.
+      const neverUploaded = this._signal.firstUnuploadedPreKeyId() <= 1;
+      const count = (serverCount === 0 || neverUploaded)
+        ? INITIAL_PREKEY_COUNT : MIN_PREKEY_COUNT;
+
       if (serverCount === null) {
-        // No usable answer. Fall back to the old behaviour — an upload we may
-        // not have needed costs nothing next to an account nobody can reach.
+        // No usable answer. Upload anyway — one we may not have needed costs
+        // nothing next to an account nobody can reach.
         _whaDbg('[DBG] PREKEY server count unavailable (' + reason + ') — uploading anyway');
-        this._replenishLocalPreKeys();
-        this._uploadPreKeys();
+        await this._uploadPreKeys(count);
         return;
       }
 
-      _whaDbg('[DBG] PREKEY server holds ' + serverCount + ' (' + reason + ')');
-      if (serverCount > PRE_KEY_SERVER_MIN) return;
+      // The newest key we generated. If it is not in the pool the store has
+      // lost keys the server may still be serving, and the bundle needs
+      // rebuilding whatever the count says.
+      const currentId      = this._signal.currentPreKeyId();
+      const missingCurrent = currentId > 0 && !this._signal.hasPreKey(currentId);
+      const lowServer      = serverCount <= count;
+
+      _whaDbg('[DBG] PREKEY server holds ' + serverCount + ' (' + reason +
+        '), current id ' + currentId + (missingCurrent ? ' MISSING' : ' present'));
 
-      _whaDbg('[DBG] PREKEY server low (' + serverCount + ' <= ' + PRE_KEY_SERVER_MIN +
-        ') — uploading');
-      this._replenishLocalPreKeys();
-      this._uploadPreKeys();
+      if (!lowServer && !missingCurrent) return;
+
+      const why = [];
+      if (lowServer)      why.push('server count low (' + serverCount + ')');
+      if (missingCurrent) why.push('current pre-key ' + currentId + ' missing from storage');
+      _whaDbg('[DBG] PREKEY uploading ' + count + ' due to: ' + why.join(', '));
+
+      await this._uploadPreKeys(count);
     } catch (err) {
       _whaDbg('[DBG] PREKEY check failed (' + reason + '): ' + (err && err.message));
     }
   }
 
-  // Make sure there is something to upload before uploading.
-  _replenishLocalPreKeys() {
-    if (!this._signal) return;
-    if (this._signal.preKeyCount() < 20) this._signal.replenishPreKeys();
-  }
-
   _checkAndReplenishPreKeys() {
     if (!this._signal) return;
     // The server said it is running low, so ask it how low and act on that

package/lib/SessionPaths.js

@@ -67,6 +67,28 @@ const SESSION_SUFFIXES = [
   '.web.appStateKeys.json'
 ];
 
+// The one-time pre-keys are the exception to the list above. There are 812 of
+// them and they are a file each — <phone>.pre-key-<id>.json for the number
+// itself, <phone>.web.pre-key-<id>.json for its companion half — so they cannot
+// be enumerated by suffix and have to be found by name instead.
+const PRE_KEY_FILE_RE = (phone) =>
+  new RegExp('^' + String(phone).replace(/\D/g, '') + '(\\.web)?\\.pre-key-\\d+\\.json$');
+
+/**
+ * Every pre-key file a number owns in a directory, by name.
+ *
+ * Anything that moves a session has to move these too: a number whose pre-keys
+ * are left behind still has its Signal sessions and looks perfectly healthy
+ * until somebody tries to open a new one with it, and then the pkmsg arrives
+ * naming a key that is not there any more.
+ */
+function preKeyFilesFor(dir, phone) {
+  const re = PRE_KEY_FILE_RE(phone);
+  let entries;
+  try { entries = fs.readdirSync(dir); } catch (_) { return []; }
+  return entries.filter(name => re.test(name));
+}
+
 // Files that belong to the installation rather than to any number, and stay at
 // the top of the base directory.
 const SHARED_FILES = [
@@ -202,6 +224,13 @@ function migrateSession(baseDir, phone) {
     moved.push(phone + suffix);
   }
 
+  for (const name of preKeyFilesFor(baseDir, phone)) {
+    const dest = path.join(to, name);
+    if (_exists(dest)) { skipped.push(name); continue; }
+    fs.renameSync(path.join(baseDir, name), dest);
+    moved.push(name);
+  }
+
   return { phone, from: baseDir, to, moved, skipped };
 }
 
@@ -213,6 +242,7 @@ module.exports = {
   webStoreFileFor,
   listSessions,
   migrateSession,
+  preKeyFilesFor,
   SESSION_SUFFIXES,
   SHARED_FILES
 };

package/lib/signal/SignalProtocol.js

@@ -8,9 +8,22 @@ const { GroupCipher, GroupSessionBuilder, SenderKeyRecord, SenderKeyName, Sender
 
 const { SessionCipher, SessionBuilder, ProtocolAddress, keyhelper } = libsignal;
 
-const PRE_KEY_COUNT   = 800;
-const PRE_KEY_MIN     = 50;
-const PRE_KEY_START   = 1;
+// The pre-key pool, sized the way the reference client sizes it.
+//
+//   INITIAL_PREKEY_COUNT  what a fresh account puts on the server, and what it
+//                         puts back when the server turns out to be holding
+//                         none of ours
+//   MIN_PREKEY_COUNT      the routine top-up, sent when the server says it is
+//                         running low
+//
+// The pool is generated up front rather than on demand, so the authentication
+// folder holds all 812 keys from the moment the session exists.
+const INITIAL_PREKEY_COUNT = 812;
+const MIN_PREKEY_COUNT     = 5;
+
+// Below this many keys left, a session that is starting up refills to the full
+// pool rather than waiting for the server to ask.
+const PRE_KEY_LOW_WATER    = 50;
 
 // ─── Per-JID async mutex ────────────
 // Prevents race conditions when two messages are encrypted simultaneously
@@ -128,17 +141,22 @@ class SignalProtocol {
   }
 
   _ensurePreKeys() {
-    if (this.store.preKeyCount() >= PRE_KEY_MIN) return;
+    if (this.store.preKeyCount() >= PRE_KEY_LOW_WATER) return;
     this.replenishPreKeys();
   }
 
+  /** Top the local pool back up to INITIAL_PREKEY_COUNT. */
   replenishPreKeys() {
-    const have    = this.store.preKeyCount();
-    const need    = PRE_KEY_COUNT - have;
+    const need = INITIAL_PREKEY_COUNT - this.store.preKeyCount();
     if (need <= 0) return [];
+    return this.generatePreKeys(need);
+  }
+
+  /** Generate `count` fresh pre-keys, continuing the id sequence. */
+  generatePreKeys(count) {
     const startId = this.store.nextPreKeyId();
     const newKeys = [];
-    for (let i = 0; i < need; i++) {
+    for (let i = 0; i < count; i++) {
       const kp = keyhelper.generatePreKey(startId + i);
       this.store.storePreKey(kp.keyId, kp.keyPair);
       newKeys.push({ keyId: kp.keyId, pubKey: kp.keyPair.pubKey });
@@ -150,10 +168,78 @@ class SignalProtocol {
     return this.store.preKeyCount();
   }
 
+  /** The id of the newest pre-key generated, 0 when none ever was. */
+  currentPreKeyId() {
+    return this.store.nextPreKeyId() - 1;
+  }
+
+  hasPreKey(keyId) {
+    return this.store.hasPreKey(keyId);
+  }
+
+  firstUnuploadedPreKeyId() {
+    return this.store.firstUnuploadedPreKeyId();
+  }
+
+  /**
+   * The next batch to send the server, generating whatever is missing to make
+   * `count` of them — the same arithmetic the reference client does.
+   *
+   * `firstUnuploadedPreKeyId` is the lowest id the server has not been sent, so
+   * the batch is the `count` ids from there up. Whatever of those has already
+   * been generated is reused; the rest is made now, continuing from
+   * `nextPreKeyId`. That is what stops an account from re-sending its whole
+   * pool on every top-up — which is what this used to do, eight hundred keys at
+   * a time, several times a session.
+   *
+   * The returned `update` is not applied here. Ids are spent the moment they
+   * are generated (storePreKey advances nextPreKeyId), but a batch only counts
+   * as uploaded once the server has acknowledged it — see commitPreKeyUpload().
+   *
+   * @returns {{preKeys: Array<{keyId, pubKey}>, update: {firstUnuploadedPreKeyId: number}}}
+   */
+  getNextPreKeys(count) {
+    count = count > 0 ? Math.floor(count) : MIN_PREKEY_COUNT;
+
+    const first     = this.store.firstUnuploadedPreKeyId();
+    const available = this.store.nextPreKeyId() - first;
+    const remaining = count - available;
+    if (remaining > 0) this.generatePreKeys(remaining);
+
+    const last = first + count - 1;
+    const preKeys = [];
+    for (let id = first; id <= last; id++) {
+      const raw = this.store._preKeys[String(id)];
+      // An id in the range whose key has already been consumed. The reference
+      // client would put an undefined key on the wire here; skip it instead.
+      if (!raw) continue;
+      preKeys.push({ keyId: id, pubKey: Buffer.from(raw.pubKey, 'base64') });
+    }
+
+    return { preKeys, update: { firstUnuploadedPreKeyId: last + 1 } };
+  }
+
+  /** Record that the batch getNextPreKeys() returned reached the server. */
+  commitPreKeyUpload(update) {
+    if (!update) return;
+    this.store.setFirstUnuploadedPreKeyId(update.firstUnuploadedPreKeyId);
+  }
+
+  /**
+   * Every pre-key still in the pool, oldest id first.
+   *
+   * Used where a single key has to be picked out by id — the bundle attached to
+   * a retry receipt — rather than for uploads, which go through
+   * getNextPreKeys().
+   */
   getPreKeysForUpload(max) {
-    max = max || PRE_KEY_COUNT;
+    max = max || INITIAL_PREKEY_COUNT;
+    const ids = Object.keys(this.store._preKeys)
+      .map(Number)
+      .filter(n => Number.isFinite(n))
+      .sort((a, b) => a - b);
+
     const preKeys = [];
-    const ids = Object.keys(this.store._preKeys).map(Number);
     for (const id of ids.slice(0, max)) {
       const raw = this.store._preKeys[String(id)];
       preKeys.push({
@@ -362,4 +448,7 @@ function jidToAddress(jid) {
   return new ProtocolAddress(user, deviceId);
 }
 
-module.exports = { SignalProtocol, jidToAddress, pad, unpad };
+module.exports = {
+  SignalProtocol, jidToAddress, pad, unpad,
+  INITIAL_PREKEY_COUNT, MIN_PREKEY_COUNT
+};

package/lib/signal/SignalStore.js

@@ -38,6 +38,91 @@ const { SessionRecord } = require('./libsignal');
 
 const DEBOUNCE_MS = 300;
 
+// ─── Pre-key files ────────────────────────────────────────────────────────────
+//
+// One-time pre-keys do not live in the snapshot above. They get a file each,
+// named the way Baileys names them:
+//
+//   <base>/40756469325/40756469325.pre-key-1.json
+//   ...
+//   <base>/40756469325/40756469325.pre-key-812.json
+//
+// Everything else about a pre-key is small, but there are 812 of them
+// and every one that is consumed rewrites the whole store — so keeping them in
+// the aggregate file meant a ~95 KB write on each incoming pkmsg, and made the
+// pool something you could only inspect by parsing the file. A file each is
+// what the reference client does, it is what anyone comparing the two
+// authentication folders expects to see, and a write now touches one key.
+//
+// The stem in front of `.pre-key-` is the one the .signal.json file already
+// carries, so a number's mobile half (40756469325.pre-key-N.json) and its
+// companion half (40756469325.web.pre-key-N.json) keep separate pools, as they
+// must — and a session still sitting in the old flat layout, where every
+// number shares one directory, does not collide with its neighbours either.
+//
+// A pre-key on disk is byte-for-byte what Baileys writes: BufferJSON, the raw
+// 32-byte public key with no type prefix.
+//
+//   {"private":{"type":"Buffer","data":"…"},"public":{"type":"Buffer","data":"…"}}
+//
+// In memory whalibmob carries the 33-byte 0x05-prefixed public key libsignal
+// hands out, so the prefix comes off on the way to disk and goes back on on the
+// way in.
+//
+// Unlike the snapshot these are written straight, without the temp-file dance.
+// The blast radius of a torn write is one key: it fails to parse at load, is
+// skipped, and the pool is topped back up. The snapshot cannot be treated that
+// way because losing it loses every session the account has.
+
+const PRE_KEY_INFIX      = '.pre-key-';
+const SIGNAL_KEY_PREFIX  = 0x05;
+
+// How many pre-key files may be in flight at once. Eight hundred parallel
+// writes is a reliable way to meet EMFILE.
+const PRE_KEY_WRITE_CONCURRENCY = 32;
+
+function _escapeRe(s) {
+  return String(s).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+// A BufferJSON field, in any of the shapes it is written in.
+function _bufFrom(field) {
+  if (!field) return null;
+  if (Buffer.isBuffer(field)) return field;
+  if (typeof field === 'string') return Buffer.from(field, 'base64');
+  if (field.type === 'Buffer') {
+    return Array.isArray(field.data)
+      ? Buffer.from(field.data)
+      : Buffer.from(String(field.data), 'base64');
+  }
+  return null;
+}
+
+function _encodePreKeyFile(entry) {
+  const pub = Buffer.from(entry.pubKey, 'base64');
+  const raw = (pub.length === 33 && pub[0] === SIGNAL_KEY_PREFIX) ? pub.slice(1) : pub;
+  return JSON.stringify({
+    private: { type: 'Buffer', data: entry.privKey },
+    public:  { type: 'Buffer', data: raw.toString('base64') }
+  });
+}
+
+function _decodePreKeyFile(text) {
+  const obj  = JSON.parse(text);
+  const priv = _bufFrom(obj && obj.private);
+  let   pub  = _bufFrom(obj && obj.public);
+  if (!priv || !pub || priv.length !== 32) return null;
+  if (pub.length === 32) pub = Buffer.concat([Buffer.from([SIGNAL_KEY_PREFIX]), pub]);
+  if (pub.length !== 33) return null;
+  return { pubKey: pub.toString('base64'), privKey: priv.toString('base64') };
+}
+
+// A stored counter, or 1 when the file predates it or holds nonsense.
+function _counter(value) {
+  const n = Number(value);
+  return Number.isFinite(n) && n >= 1 ? Math.floor(n) : 1;
+}
+
 class SignalStore {
   constructor() {
     this._identityKeyPair  = null;
@@ -68,6 +153,30 @@ class SignalStore {
     this._writing          = false;
     this._writeAgain       = false;
 
+    // Where the pre-key files go, and which ids are waiting to be written or
+    // unlinked. Empty until attachFile() — a store with nowhere to write keeps
+    // its pre-keys in memory and queues nothing.
+    this._pkDir            = null;
+    this._pkPrefix         = null;
+    this._pkPending        = new Set();
+    this._pkTimer          = null;
+    this._pkWriting        = false;
+
+    // The two counters Baileys keeps in creds. They live here instead because a
+    // number's mobile and companion halves have a .signal.json each and must
+    // never share a pre-key id space.
+    //
+    //   _nextPreKeyId             the id the next generated key takes
+    //   _firstUnuploadedPreKeyId  the lowest id the server has not been sent
+    //
+    // Both only ever go up. An id that has been handed to the server is spent
+    // even after the key itself is consumed and deleted, so deriving the next
+    // id from what is still on disk — which is what this used to do — walks
+    // backwards over ids the server is still serving and hands two different
+    // keys out under one id.
+    this._nextPreKeyId            = 1;
+    this._firstUnuploadedPreKeyId = 1;
+
     // Flush synchronously on exit so no state is ever lost.
     //
     // Kept as references so they can be taken off again: a store that has been
@@ -98,6 +207,12 @@ class SignalStore {
     const stale = this._filePath ? [this._tmpPath(true), this._tmpPath(false)] : [];
     this._filePath   = null;
     this._writeAgain = false;
+    // Same for the pre-key files: _flushSync() above has written whatever was
+    // outstanding, so let the directory go before the caller moves it.
+    if (this._pkTimer) { clearTimeout(this._pkTimer); this._pkTimer = null; }
+    this._pkDir    = null;
+    this._pkPrefix = null;
+    this._pkPending.clear();
     for (const f of stale) { try { fs.unlinkSync(f); } catch (_) {} }
   }
 
@@ -108,19 +223,90 @@ class SignalStore {
 
   attachFile(filePath) {
     this._filePath = filePath;
+    // The pre-key files sit beside the snapshot and share its stem, so
+    // 40756469325.signal.json gives 40756469325.pre-key-<id>.json and
+    // 40756469325.web.signal.json gives 40756469325.web.pre-key-<id>.json.
+    const base = path.basename(filePath);
+    this._pkDir    = path.dirname(filePath);
+    this._pkPrefix = base.endsWith('.signal.json')
+      ? base.slice(0, -'.signal.json'.length)
+      : base.replace(/\.json$/, '');
     this._load();
   }
 
+  /** Where a pre-key of this id belongs on disk. */
+  _preKeyFile(id) {
+    return path.join(this._pkDir, this._pkPrefix + PRE_KEY_INFIX + id + '.json');
+  }
+
+  // Read every pre-key file this session owns. Returns how many were read.
+  //
+  // A file that will not parse is skipped rather than fatal: it costs one key
+  // out of 812, and the pool is topped back up on the next check.
+  _loadPreKeyFiles() {
+    if (!this._pkDir) return 0;
+    let entries;
+    try { entries = fs.readdirSync(this._pkDir); } catch (_) { return 0; }
+
+    const re = new RegExp('^' + _escapeRe(this._pkPrefix + PRE_KEY_INFIX) + '(\\d+)\\.json$');
+    let count = 0;
+    for (const name of entries) {
+      const m = re.exec(name);
+      if (!m) continue;
+      try {
+        const entry = _decodePreKeyFile(
+          fs.readFileSync(path.join(this._pkDir, name), 'utf8'));
+        if (entry) { this._preKeys[m[1]] = entry; count++; }
+      } catch (_) {}
+    }
+    return count;
+  }
+
   _load() {
-    if (!this._filePath || !fs.existsSync(this._filePath)) return;
-    try {
-      const raw = JSON.parse(fs.readFileSync(this._filePath, 'utf8'));
+    this._preKeys = {};
+
+    let raw = null;
+    if (this._filePath && fs.existsSync(this._filePath)) {
+      try { raw = JSON.parse(fs.readFileSync(this._filePath, 'utf8')); } catch (_) {}
+    }
+    if (raw) {
       this._sessions      = raw.sessions      || {};
-      this._preKeys       = raw.preKeys       || {};
       this._signedPreKeys = raw.signedPreKeys || {};
       this._identities    = raw.identities    || {};
       this._lidMappings   = raw.lidMappings   || {};  // phone → lid, persisted
-    } catch (_) {}
+      this._nextPreKeyId            = _counter(raw.nextPreKeyId);
+      this._firstUnuploadedPreKeyId = _counter(raw.firstUnuploadedPreKeyId);
+    }
+
+    // Files first — they are where a pre-key lives now.
+    this._loadPreKeyFiles();
+
+    // Anything still only in the old aggregate block moves out to a file of its
+    // own. A session written before this change has its whole pool in there and
+    // the server is serving those exact keys, so dropping them would leave
+    // every bundle already handed out unanswerable.
+    let migrated = 0;
+    const legacy = (raw && raw.preKeys) || {};
+    for (const id of Object.keys(legacy)) {
+      if (this._preKeys[id]) continue;
+      const entry = legacy[id];
+      if (!entry || !entry.pubKey || !entry.privKey) continue;
+      this._preKeys[id] = entry;
+      this._pkPending.add(id);
+      migrated++;
+    }
+    if (migrated) {
+      this._flushPreKeysSync();
+      this._save();   // rewrites the snapshot without the old block
+    }
+
+    // An id on disk is an id that has been used, whatever the counter says.
+    const ids   = Object.keys(this._preKeys).map(Number).filter(n => Number.isFinite(n) && n > 0);
+    const maxId = ids.length ? Math.max(...ids) : 0;
+    if (this._nextPreKeyId <= maxId) this._nextPreKeyId = maxId + 1;
+    if (this._firstUnuploadedPreKeyId > this._nextPreKeyId) {
+      this._firstUnuploadedPreKeyId = this._nextPreKeyId;
+    }
   }
 
   // Persist a phone ↔ LID mapping.  Called any time we learn a new mapping from
@@ -138,16 +324,96 @@ class SignalStore {
   }
 
   // Everything that is persisted, as it goes on disk.
+  //
+  // One-time pre-keys are not in here — they are a file each, see _preKeyFile().
+  // Their two counters are, because they have to survive a pool that has been
+  // drained to nothing and say what id comes next anyway.
   _snapshot() {
     return JSON.stringify({
       sessions:      this._sessions,
-      preKeys:       this._preKeys,
       signedPreKeys: this._signedPreKeys,
       identities:    this._identities,
-      lidMappings:   this._lidMappings
+      lidMappings:   this._lidMappings,
+      nextPreKeyId:            this._nextPreKeyId,
+      firstUnuploadedPreKeyId: this._firstUnuploadedPreKeyId
     });
   }
 
+  // ─── Pre-key writing ──────────────────────────────────────────────────────
+
+  // Mark one pre-key id as needing its file written (or removed, when the key
+  // is no longer in memory) and arm the debounce.
+  _savePreKey(id) {
+    if (!this._pkDir) return;
+    this._pkPending.add(String(id));
+    if (this._pkTimer) clearTimeout(this._pkTimer);
+    this._pkTimer = setTimeout(() => {
+      this._pkTimer = null;
+      this._flushPreKeysAsync();
+    }, DEBOUNCE_MS);
+  }
+
+  _flushPreKeysAsync() {
+    if (!this._pkDir || this._pkWriting || !this._pkPending.size) return;
+    try { fs.mkdirSync(this._pkDir, { recursive: true }); } catch (_) { return; }
+
+    this._pkWriting = true;
+    const ids = [...this._pkPending];
+    this._pkPending.clear();
+
+    let next = 0, active = 0, done = false;
+    const pump = () => {
+      while (active < PRE_KEY_WRITE_CONCURRENCY && next < ids.length) {
+        active++;
+        this._writePreKeyAsync(ids[next++], () => { active--; pump(); });
+      }
+      if (!active && next >= ids.length && !done) {
+        done = true;
+        this._pkWriting = false;
+        // Something came due while this batch was running — and cleared the
+        // debounce that would have picked it up, since _savePreKey only arms a
+        // timer. Arm one now.
+        if (this._pkPending.size) this._savePreKey([...this._pkPending][0]);
+      }
+    };
+    pump();
+  }
+
+  _writePreKeyAsync(id, cb) {
+    if (!this._pkDir) return cb();
+    const file  = this._preKeyFile(id);
+    const entry = this._preKeys[id];
+    if (!entry) return fs.unlink(file, () => cb());
+
+    let data;
+    try { data = _encodePreKeyFile(entry); } catch (_) { return cb(); }
+    fs.writeFile(file, data, 'utf8', () => {
+      // Consumed while the write was in flight. A key that has been used is one
+      // the account must not offer again, so take it back off the disk rather
+      // than leave the write that overtook the unlink standing.
+      if (!this._preKeys[id]) return fs.unlink(file, () => cb());
+      cb();
+    });
+  }
+
+  _flushPreKeysSync() {
+    if (!this._pkDir || !this._pkPending.size) return;
+    if (this._pkTimer) { clearTimeout(this._pkTimer); this._pkTimer = null; }
+
+    const ids = [...this._pkPending];
+    this._pkPending.clear();
+    try { fs.mkdirSync(this._pkDir, { recursive: true }); } catch (_) { return; }
+
+    for (const id of ids) {
+      const file  = this._preKeyFile(id);
+      const entry = this._preKeys[id];
+      try {
+        if (entry) fs.writeFileSync(file, _encodePreKeyFile(entry), 'utf8');
+        else       fs.unlinkSync(file);
+      } catch (_) {}
+    }
+  }
+
   // Where a write assembles the file before it becomes the file. The sync and
   // async writers get separate names so the one can never find the other's
   // half-written temp file under it.
@@ -166,6 +432,9 @@ class SignalStore {
 
   // Immediate synchronous flush (process exit, and detach())
   _flushSync() {
+    // Pre-keys have their own dirty set — a pool that changed while the
+    // snapshot did not still has files owed to it.
+    this._flushPreKeysSync();
     if (!this._dirty || !this._filePath) return;
     if (this._saveTimer) { clearTimeout(this._saveTimer); this._saveTimer = null; }
     const rev  = this._rev;
@@ -378,16 +647,20 @@ class SignalStore {
   }
 
   async storePreKey(keyId, keyPair) {
-    this._preKeys[String(keyId)] = {
+    const id = String(keyId);
+    this._preKeys[id] = {
       pubKey:  Buffer.from(keyPair.pubKey).toString('base64'),
       privKey: Buffer.from(keyPair.privKey).toString('base64')
     };
-    this._save();
+    this._savePreKey(id);
+    // Storing an id spends it, whether it was generated here or restored from
+    // somewhere else.
+    this.setNextPreKeyId(Number(keyId) + 1);
   }
 
   async removePreKey(keyId) {
     delete this._preKeys[String(keyId)];
-    this._save();
+    this._savePreKey(keyId);
   }
 
   // ─── Signed PreKeys ───────────────────────────────────────────────────────
@@ -420,9 +693,36 @@ class SignalStore {
     return Object.keys(this._preKeys).length;
   }
 
+  /** Whether this id is still in the pool — i.e. nobody has spent it yet. */
+  hasPreKey(keyId) {
+    return Object.prototype.hasOwnProperty.call(this._preKeys, String(keyId));
+  }
+
+  /** The id the next generated pre-key takes. Never goes backwards. */
   nextPreKeyId() {
-    const ids = Object.keys(this._preKeys).map(Number);
-    return ids.length ? Math.max(...ids) + 1 : 1;
+    return this._nextPreKeyId;
+  }
+
+  setNextPreKeyId(id) {
+    const n = Number(id);
+    if (!Number.isFinite(n) || n <= this._nextPreKeyId) return;
+    this._nextPreKeyId = Math.floor(n);
+    if (this._firstUnuploadedPreKeyId > this._nextPreKeyId) {
+      this._firstUnuploadedPreKeyId = this._nextPreKeyId;
+    }
+    this._save();
+  }
+
+  /** The lowest id the server has not been sent. Never goes backwards. */
+  firstUnuploadedPreKeyId() {
+    return this._firstUnuploadedPreKeyId;
+  }
+
+  setFirstUnuploadedPreKeyId(id) {
+    const n = Number(id);
+    if (!Number.isFinite(n) || n <= this._firstUnuploadedPreKeyId) return;
+    this._firstUnuploadedPreKeyId = Math.min(Math.floor(n), this._nextPreKeyId);
+    this._save();
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.14.18",
+  "version": "5.14.19",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API and web ",
   "author": "Kunboruto20",
   "main": "index.js",