whalibmob 5.14.7 → 5.14.9

package/lib/Client.js

@@ -442,9 +442,11 @@ class WhalibmobClient extends EventEmitter {
   async init(phoneNumber) {
     phoneNumber = String(phoneNumber).replace(/\D/g, '');
     this._phoneNumber = phoneNumber;
-    // A fresh attempt clears whatever made the last one fatal. Only the public
-    // entry points reset it — the reconnect loop must not clear its own guard.
-    this._fatal = false;
+    // A fresh attempt clears whatever made the last one fatal, and whatever
+    // deliberate disconnect came before it. Only the public entry points reset
+    // these — the reconnect loop must not clear its own guards.
+    this._fatal   = false;
+    this._closing = false;
 
     this._sessionDir = sessionDirFor(this._baseDir, phoneNumber);
 
@@ -621,7 +623,9 @@ class WhalibmobClient extends EventEmitter {
     phoneNumber = String(phoneNumber).replace(/\D/g, '');
     this._phoneNumber = phoneNumber;
     this._mode = 'web';
-    this._fatal = false;
+    // Same as init(): a fresh attempt lifts both guards from the last one.
+    this._fatal   = false;
+    this._closing = false;
 
     const { createNewWebStore, loadWebStore, saveWebStore, webSessionPath } =
       require('./WebStore');
@@ -1066,13 +1070,34 @@ class WhalibmobClient extends EventEmitter {
     return idx > 0 ? `${lidUser}:${idx}@lid` : `${lidUser}@lid`;
   }
 
-  disconnect() {
+  /**
+   * Close the connection, and keep it closed.
+   *
+   * Connect again through init() / initWeb() — those are where the caller says
+   * it wants a connection, and where the guard below is lifted.
+   *
+   * @param {object}  [opts]
+   * @param {boolean} [opts.reconnect=false]  drop the current socket but leave
+   *        the reconnect loop armed. For a failure the server has told us is
+   *        temporary, where coming back is the right answer.
+   */
+  disconnect(opts) {
     // Closing the socket makes it emit 'close', which lands in _onClose and
     // schedules a reconnect. That is right for a dropped connection and wrong
     // for a deliberate teardown — and it is what turned a single <failure> into
     // an endless retry loop, since clearing _reconnecting was not enough to
     // stop the handler that sets it again.
-    this._closing      = true;
+    //
+    // For that to work the guard has to still be set when the 'close' arrives,
+    // and it arrives on a later tick — a socket is destroyed now and reports it
+    // afterwards. Clearing it at the end of this method, which is what it used
+    // to do, meant _scheduleReconnect() never once saw it set: every deliberate
+    // disconnect dialled straight back in a second later, and /reconnect ended
+    // up with the old session live alongside the new one.
+    //
+    // Only ever set here, never cleared, so a teardown that means it cannot be
+    // undone by a later one that does not.
+    if (!(opts && opts.reconnect)) this._closing = true;
     this._reconnecting = false;
     this._reconnectTry = 0;
     this._stopTimers();
@@ -1082,7 +1107,6 @@ class WhalibmobClient extends EventEmitter {
     }
     this._connected = false;
     this.emit('close');
-    this._closing = false;
   }
 
   /**
@@ -1246,8 +1270,11 @@ class WhalibmobClient extends EventEmitter {
 
     this._requestMediaConnection();
     // Ask what the server still has rather than uploading blind. It answers
-    // with a number this side has no other way of learning.
-    this._ensureServerPreKeys('login');
+    // with a number this side has no other way of learning, and then with the
+    // bundle it is serving, which is the thing that goes quietly wrong and
+    // takes the account's reachability with it.
+    this._ensureServerPreKeys('login')
+      .then(() => this._verifyServerKeyBundle('login'));
 
     // Same telemetry ping the web client sends on every completed login.
     this._sendUnifiedSession();
@@ -3277,7 +3304,11 @@ class WhalibmobClient extends EventEmitter {
     this.emit('auth_failure', { reason, location: loc, loggedOut: spent, node });
     this._fatal = spent;
     this._reconnecting = false;
-    this.disconnect();
+    // A reason that did not kill the session is one to come back from, so this
+    // teardown leaves the reconnect loop armed — a 503 is the server having a
+    // bad minute, not a reason to abandon a working registration. A reason that
+    // did kill it is fatal, and _scheduleReconnect() stands down on that itself.
+    this.disconnect({ reconnect: !spent });
   }
 
   // ─── Media connection ─────────────────────────────────────────────────────
@@ -3411,6 +3442,103 @@ class WhalibmobClient extends EventEmitter {
     return Array.isArray(list.content) ? list.content.length : 0;
   }
 
+  // What the server believes this account's key bundle is.
+  //
+  // The digest is the only way to see it. Everything else here is a guess about
+  // what was uploaded once and assumed to have stuck — and when the server's
+  // idea of the bundle and ours part company, nobody can open a session with
+  // this account and there is no error anywhere to say so. It is the state that
+  // registering the number again clears, which is why registering again is what
+  // has been fixing it.
+  async _queryKeyDigest() {
+    if (!this._socket || !this._connected) return null;
+
+    const resp = await this._sendIq(new BinaryNode('iq', {
+      id:    this._genMsgId(),
+      to:    's.whatsapp.net',
+      type:  'get',
+      xmlns: 'encrypt'
+    }, [new BinaryNode('digest', {}, null)]));
+
+    if (!resp) return null;
+    if (resp.attrs && resp.attrs.type === 'error') return null;
+
+    const digest = findChild(resp, 'digest');
+    if (!digest) return { missing: true };
+
+    const bytesOf = (parent, tag) => {
+      const n = parent && findChild(parent, tag);
+      if (!n) return null;
+      if (Buffer.isBuffer(n.content)) return n.content;
+      return n.content ? Buffer.from(n.content) : null;
+    };
+
+    const skey = findChild(digest, 'skey');
+    const list = findChild(digest, 'list');
+    return {
+      missing:    false,
+      identity:   bytesOf(digest, 'identity'),
+      skeyId:     bytesOf(skey, 'id'),
+      skeyValue:  bytesOf(skey, 'value'),
+      preKeyCount: list && Array.isArray(list.content) ? list.content.length : 0
+    };
+  }
+
+  // Compare that bundle against the one we hold, and re-upload when they differ.
+  //
+  // Only values the server states outright are compared — the identity key and
+  // the signed pre-key it is serving — so nothing here depends on guessing how
+  // it hashes them. A mismatch means the bundle other people are handed is not
+  // the one this session can answer for, and no amount of waiting fixes that.
+  async _verifyServerKeyBundle(reason) {
+    if (!this._signal) return;
+    try {
+      const digest = await this._queryKeyDigest();
+      if (!digest) return;                       // no answer; nothing to conclude
+
+      if (digest.missing) {
+        _whaDbg('[DBG] KEYBUNDLE server returned no digest (' + reason + ') — re-uploading');
+        this._replenishLocalPreKeys();
+        this._uploadPreKeys();
+        return;
+      }
+
+      const bare      = (b) => (b && b.length === 33 && b[0] === 0x05) ? b.slice(1) : b;
+      const ourIdent  = bare(this._signal.getIdentityKey());
+      const ourSpk    = this._signal.getSignedPreKeyForUpload();
+      const ourSpkPub = ourSpk && bare(ourSpk.keyPair.pubKey);
+
+      const mismatches = [];
+      if (digest.identity && ourIdent &&
+          Buffer.compare(digest.identity, ourIdent) !== 0) {
+        mismatches.push('identity key');
+      }
+      if (digest.skeyValue && ourSpkPub &&
+          Buffer.compare(digest.skeyValue, ourSpkPub) !== 0) {
+        mismatches.push('signed pre-key');
+      }
+      if (digest.skeyId && ourSpk) {
+        let served = 0;
+        for (const b of digest.skeyId) served = (served << 8) | b;
+        if (served !== ourSpk.keyId) mismatches.push('signed pre-key id (' + served +
+          ' vs ' + ourSpk.keyId + ')');
+      }
+
+      if (!mismatches.length) {
+        _whaDbg('[DBG] KEYBUNDLE matches the server (' + reason + '), ' +
+          digest.preKeyCount + ' one-time key(s) there');
+        return;
+      }
+
+      _whaDbg('[DBG] KEYBUNDLE server disagrees on ' + mismatches.join(' and ') +
+        ' (' + reason + ') — re-uploading');
+      this._replenishLocalPreKeys();
+      this._uploadPreKeys();
+    } catch (err) {
+      _whaDbg('[DBG] KEYBUNDLE check failed (' + reason + '): ' + (err && err.message));
+    }
+  }
+
   // Top the server back up when it is running out. Never throws: a session that
   // cannot ask is left exactly as it was rather than losing its connection over
   // a bookkeeping query.

package/lib/Registration.js

@@ -418,6 +418,149 @@ const COUNTRY_META = {
   '971': { mcc: '424', mnc: '02',  lg: 'ar', lc: 'AE' }, // UAE
   '972': { mcc: '425', mnc: '01',  lg: 'he', lc: 'IL' }, // Israel
   '880': { mcc: '470', mnc: '01',  lg: 'bn', lc: 'BD' }, // Bangladesh
+  // Filled in from the ITU mobile-network tables so a number from anywhere
+  // reports the carrier its country actually has. Without an entry a session
+  // falls back to 000/000, which is what a handset with no SIM card reports.
+  // One operational national operator per country; the point is a plausible
+  // home network, not a particular one.
+  '53':    { mcc: '368', mnc: '01', lg: 'es', lc: 'CU' }, // Cuba (CUBACEL)
+  '211':   { mcc: '659', mnc: '02', lg: 'en', lc: 'SS' }, // South Sudan (MTN)
+  '220':   { mcc: '607', mnc: '01', lg: 'en', lc: 'GM' }, // Gambia (Gamcel)
+  '221':   { mcc: '608', mnc: '01', lg: 'fr', lc: 'SN' }, // Senegal (Orange)
+  '222':   { mcc: '609', mnc: '01', lg: 'ar', lc: 'MR' }, // Mauritania (Mattel)
+  '223':   { mcc: '610', mnc: '01', lg: 'fr', lc: 'ML' }, // Mali (Malitel)
+  '224':   { mcc: '611', mnc: '01', lg: 'fr', lc: 'GN' }, // Guinea (Orange)
+  '225':   { mcc: '612', mnc: '02', lg: 'fr', lc: 'CI' }, // Ivory Coast (Moov)
+  '226':   { mcc: '613', mnc: '01', lg: 'fr', lc: 'BF' }, // Burkina Faso (Telmob)
+  '227':   { mcc: '614', mnc: '01', lg: 'fr', lc: 'NE' }, // Niger (SahelCom)
+  '228':   { mcc: '615', mnc: '01', lg: 'fr', lc: 'TG' }, // Togo (Togo Cell)
+  '229':   { mcc: '616', mnc: '01', lg: 'fr', lc: 'BJ' }, // Benin (Benin Telecoms Mob)
+  '230':   { mcc: '617', mnc: '01', lg: 'en', lc: 'MU' }, // Mauritius (my.t)
+  '231':   { mcc: '618', mnc: '01', lg: 'en', lc: 'LR' }, // Liberia (Lonestar Cell MTN)
+  '232':   { mcc: '619', mnc: '01', lg: 'en', lc: 'SL' }, // Sierra Leone (Orange)
+  '233':   { mcc: '620', mnc: '01', lg: 'en', lc: 'GH' }, // Ghana (MTN)
+  '235':   { mcc: '622', mnc: '01', lg: 'ar', lc: 'TD' }, // Chad (Airtel)
+  '236':   { mcc: '623', mnc: '01', lg: 'fr', lc: 'CF' }, // Central African Republic (Moov)
+  '237':   { mcc: '624', mnc: '01', lg: 'en', lc: 'CM' }, // Cameroon (MTN Cameroon)
+  '238':   { mcc: '625', mnc: '01', lg: 'pt', lc: 'CV' }, // Cape Verde (CVMOVEL)
+  '239':   { mcc: '626', mnc: '01', lg: 'pt', lc: 'ST' }, // São Tomé and Príncipe (CSTmovel)
+  '240':   { mcc: '627', mnc: '01', lg: 'fr', lc: 'GQ' }, // Equatorial Guinea (Orange GQ)
+  '241':   { mcc: '628', mnc: '01', lg: 'fr', lc: 'GA' }, // Gabon (Libertis)
+  '242':   { mcc: '629', mnc: '01', lg: 'fr', lc: 'CG' }, // Republic of the Congo (Airtel)
+  '243':   { mcc: '630', mnc: '01', lg: 'fr', lc: 'CD' }, // DR Congo (Vodacom)
+  '244':   { mcc: '631', mnc: '02', lg: 'pt', lc: 'AO' }, // Angola (UNITEL)
+  '245':   { mcc: '632', mnc: '01', lg: 'pt', lc: 'GW' }, // Guinea-Bissau (Guinetel)
+  '248':   { mcc: '633', mnc: '01', lg: 'en', lc: 'SC' }, // Seychelles (Cable & Wireless)
+  '249':   { mcc: '634', mnc: '01', lg: 'ar', lc: 'SD' }, // Sudan (Zain SD)
+  '250':   { mcc: '635', mnc: '10', lg: 'en', lc: 'RW' }, // Rwanda (MTN)
+  '251':   { mcc: '636', mnc: '01', lg: 'am', lc: 'ET' }, // Ethiopia (MTN)
+  '252':   { mcc: '637', mnc: '01', lg: 'ar', lc: 'SO' }, // Somalia (Telesom)
+  '253':   { mcc: '638', mnc: '01', lg: 'ar', lc: 'DJ' }, // Djibouti (Evatis)
+  '257':   { mcc: '642', mnc: '01', lg: 'fr', lc: 'BI' }, // Burundi (econet Leo)
+  '258':   { mcc: '643', mnc: '01', lg: 'pt', lc: 'MZ' }, // Mozambique (mCel)
+  '260':   { mcc: '645', mnc: '01', lg: 'en', lc: 'ZM' }, // Zambia (Airtel)
+  '261':   { mcc: '646', mnc: '01', lg: 'fr', lc: 'MG' }, // Madagascar (Airtel)
+  '263':   { mcc: '648', mnc: '01', lg: 'en', lc: 'ZW' }, // Zimbabwe (Net*One)
+  '264':   { mcc: '649', mnc: '01', lg: 'af', lc: 'NA' }, // Namibia (MTC)
+  '265':   { mcc: '650', mnc: '01', lg: 'en', lc: 'MW' }, // Malawi (TNM)
+  '266':   { mcc: '651', mnc: '01', lg: 'en', lc: 'LS' }, // Lesotho (Vodacom)
+  '267':   { mcc: '652', mnc: '01', lg: 'en', lc: 'BW' }, // Botswana (Mascom)
+  '268':   { mcc: '653', mnc: '02', lg: 'en', lc: 'SZ' }, // Eswatini (Eswatini Mobile Li)
+  '269':   { mcc: '654', mnc: '01', lg: 'ar', lc: 'KM' }, // Comoros (HURI)
+  '290':   { mcc: '658', mnc: '01', lg: 'en', lc: 'SH' }, // Saint Helena, Ascension and Tristan da Cunha (Sure)
+  '291':   { mcc: '657', mnc: '01', lg: 'ar', lc: 'ER' }, // Eritrea (Eritel)
+  '297':   { mcc: '363', mnc: '01', lg: 'nl', lc: 'AW' }, // Aruba (SETAR)
+  '298':   { mcc: '288', mnc: '01', lg: 'da', lc: 'FO' }, // Faroe Islands (Føroya Tele)
+  '299':   { mcc: '290', mnc: '01', lg: 'kl', lc: 'GL' }, // Greenland (tusass)
+  '350':   { mcc: '266', mnc: '01', lg: 'en', lc: 'GI' }, // Gibraltar (GibTel)
+  '352':   { mcc: '270', mnc: '01', lg: 'de', lc: 'LU' }, // Luxembourg (POST)
+  '354':   { mcc: '274', mnc: '01', lg: 'is', lc: 'IS' }, // Iceland (Síminn)
+  '355':   { mcc: '276', mnc: '01', lg: 'sq', lc: 'AL' }, // Albania (ONE)
+  '356':   { mcc: '278', mnc: '01', lg: 'en', lc: 'MT' }, // Malta (Epic)
+  '357':   { mcc: '280', mnc: '01', lg: 'el', lc: 'CY' }, // Cyprus (Cytamobile-Vodafon)
+  '359':   { mcc: '284', mnc: '01', lg: 'bg', lc: 'BG' }, // Bulgaria (A1 BG)
+  '370':   { mcc: '246', mnc: '01', lg: 'lt', lc: 'LT' }, // Lithuania (Telia)
+  '371':   { mcc: '247', mnc: '01', lg: 'lv', lc: 'LV' }, // Latvia (LMT)
+  '372':   { mcc: '248', mnc: '01', lg: 'et', lc: 'EE' }, // Estonia (Telia)
+  '373':   { mcc: '259', mnc: '01', lg: 'ro', lc: 'MD' }, // Moldova (Orange)
+  '374':   { mcc: '283', mnc: '01', lg: 'hy', lc: 'AM' }, // Armenia (Beeline)
+  '375':   { mcc: '257', mnc: '01', lg: 'be', lc: 'BY' }, // Belarus (A1)
+  '376':   { mcc: '213', mnc: '03', lg: 'ca', lc: 'AD' }, // Andorra (Som, Mobiland)
+  '377':   { mcc: '212', mnc: '10', lg: 'fr', lc: 'MC' }, // Monaco (Office des Telepho)
+  '378':   { mcc: '292', mnc: '01', lg: 'it', lc: 'SM' }, // San Marino (PRIMA)
+  '381':   { mcc: '220', mnc: '01', lg: 'sr', lc: 'RS' }, // Serbia (Yettel)
+  '382':   { mcc: '297', mnc: '01', lg: 'en', lc: 'ME' }, // Montenegro (One)
+  '383':   { mcc: '221', mnc: '01', lg: 'sq', lc: 'XK' }, // Kosovo (Vala)
+  '385':   { mcc: '219', mnc: '01', lg: 'hr', lc: 'HR' }, // Croatia (HT HR)
+  '386':   { mcc: '293', mnc: '10', lg: 'sl', lc: 'SI' }, // Slovenia (SŽ - Infrastruktur)
+  '387':   { mcc: '218', mnc: '03', lg: 'bs', lc: 'BA' }, // Bosnia and Herzegovina (HT-ERONET)
+  '389':   { mcc: '294', mnc: '01', lg: 'mk', lc: 'MK' }, // North Macedonia (Telekom.mk)
+  '421':   { mcc: '231', mnc: '01', lg: 'sk', lc: 'SK' }, // Slovakia (Orange)
+  '423':   { mcc: '295', mnc: '01', lg: 'de', lc: 'LI' }, // Liechtenstein (Swisscom)
+  '500':   { mcc: '750', mnc: '001', lg: 'en', lc: 'FK' }, // Falkland Islands (Sure)
+  '501':   { mcc: '702', mnc: '67', lg: 'en', lc: 'BZ' }, // Belize (DigiCell)
+  '502':   { mcc: '704', mnc: '01', lg: 'es', lc: 'GT' }, // Guatemala (Claro)
+  '503':   { mcc: '706', mnc: '01', lg: 'es', lc: 'SV' }, // El Salvador (Claro)
+  '504':   { mcc: '708', mnc: '001', lg: 'es', lc: 'HN' }, // Honduras (Claro)
+  '505':   { mcc: '710', mnc: '21', lg: 'es', lc: 'NI' }, // Nicaragua (Claro)
+  '506':   { mcc: '712', mnc: '01', lg: 'es', lc: 'CR' }, // Costa Rica (Kölbi ICE)
+  '507':   { mcc: '714', mnc: '01', lg: 'es', lc: 'PA' }, // Panama (Cable & Wireless)
+  '508':   { mcc: '308', mnc: '01', lg: 'fr', lc: 'PM' }, // Saint Pierre and Miquelon (Ameris)
+  '509':   { mcc: '372', mnc: '02', lg: 'fr', lc: 'HT' }, // Haiti (Digicel)
+  '591':   { mcc: '736', mnc: '01', lg: 'ay', lc: 'BO' }, // Bolivia (Viva)
+  '592':   { mcc: '738', mnc: '00', lg: 'en', lc: 'GY' }, // Guyana (E-Networks)
+  '593':   { mcc: '740', mnc: '00', lg: 'es', lc: 'EC' }, // Ecuador (Movistar)
+  '594':   { mcc: '340', mnc: '01', lg: 'fr', lc: 'GF' }, // French Guiana (Orange)
+  '595':   { mcc: '744', mnc: '01', lg: 'gn', lc: 'PY' }, // Paraguay (VOX)
+  '597':   { mcc: '746', mnc: '02', lg: 'nl', lc: 'SR' }, // Suriname (Telesur)
+  '598':   { mcc: '748', mnc: '01', lg: 'es', lc: 'UY' }, // Uruguay (Antel)
+  '670':   { mcc: '514', mnc: '01', lg: 'pt', lc: 'TL' }, // Timor-Leste (Telkomcel)
+  '672':   { mcc: '505', mnc: '10', lg: 'en', lc: 'NF' }, // Norfolk Island (Norfolk Telecom)
+  '673':   { mcc: '528', mnc: '02', lg: 'ms', lc: 'BN' }, // Brunei (PCSB)
+  '674':   { mcc: '536', mnc: '02', lg: 'en', lc: 'NR' }, // Nauru (Digicel)
+  '675':   { mcc: '537', mnc: '01', lg: 'en', lc: 'PG' }, // Papua New Guinea (bmobile)
+  '676':   { mcc: '539', mnc: '01', lg: 'en', lc: 'TO' }, // Tonga (U-Call)
+  '677':   { mcc: '540', mnc: '01', lg: 'en', lc: 'SB' }, // Solomon Islands (BREEZE)
+  '678':   { mcc: '541', mnc: '00', lg: 'bi', lc: 'VU' }, // Vanuatu (AIL)
+  '679':   { mcc: '542', mnc: '01', lg: 'en', lc: 'FJ' }, // Fiji (Vodafone)
+  '680':   { mcc: '552', mnc: '01', lg: 'en', lc: 'PW' }, // Palau (PNCC)
+  '681':   { mcc: '543', mnc: '01', lg: 'fr', lc: 'WF' }, // Wallis and Futuna (Manuia)
+  '682':   { mcc: '548', mnc: '01', lg: 'en', lc: 'CK' }, // Cook Islands (Vodafone)
+  '683':   { mcc: '555', mnc: '01', lg: 'en', lc: 'NU' }, // Niue (Telecom Niue)
+  '685':   { mcc: '549', mnc: '01', lg: 'en', lc: 'WS' }, // Samoa (Digicel)
+  '686':   { mcc: '545', mnc: '01', lg: 'en', lc: 'KI' }, // Kiribati (Kiribati - ATH)
+  '687':   { mcc: '546', mnc: '01', lg: 'fr', lc: 'NC' }, // New Caledonia (Mobilis)
+  '688':   { mcc: '553', mnc: '01', lg: 'en', lc: 'TV' }, // Tuvalu (TTC)
+  '689':   { mcc: '547', mnc: '05', lg: 'fr', lc: 'PF' }, // French Polynesia (Ora)
+  '690':   { mcc: '554', mnc: '01', lg: 'en', lc: 'TK' }, // Tokelau (Teletok)
+  '691':   { mcc: '550', mnc: '01', lg: 'en', lc: 'FM' }, // Micronesia (FSMTC)
+  '692':   { mcc: '551', mnc: '01', lg: 'en', lc: 'MH' }, // Marshall Islands (Marshall Islands N)
+  '850':   { mcc: '467', mnc: '05', lg: 'ko', lc: 'KP' }, // North Korea (Koryolink)
+  '852':   { mcc: '454', mnc: '00', lg: 'en', lc: 'HK' }, // Hong Kong (1O1O / One2Free / )
+  '853':   { mcc: '455', mnc: '00', lg: 'pt', lc: 'MO' }, // Macau (SmarTone)
+  '855':   { mcc: '456', mnc: '01', lg: 'km', lc: 'KH' }, // Cambodia (Cellcard)
+  '856':   { mcc: '457', mnc: '01', lg: 'lo', lc: 'LA' }, // Laos (LaoTel)
+  '886':   { mcc: '466', mnc: '01', lg: 'zh', lc: 'TW' }, // Taiwan (FarEasTone)
+  '960':   { mcc: '472', mnc: '01', lg: 'dv', lc: 'MV' }, // Maldives (Dhiraagu)
+  '961':   { mcc: '415', mnc: '01', lg: 'ar', lc: 'LB' }, // Lebanon (Alfa)
+  '962':   { mcc: '416', mnc: '01', lg: 'ar', lc: 'JO' }, // Jordan (zain JO)
+  '963':   { mcc: '417', mnc: '01', lg: 'ar', lc: 'SY' }, // Syria (Syriatel)
+  '964':   { mcc: '418', mnc: '00', lg: 'ar', lc: 'IQ' }, // Iraq (Asia Cell)
+  '965':   { mcc: '419', mnc: '02', lg: 'ar', lc: 'KW' }, // Kuwait (zain KW)
+  '967':   { mcc: '421', mnc: '01', lg: 'ar', lc: 'YE' }, // Yemen (SabaFon)
+  '968':   { mcc: '422', mnc: '02', lg: 'ar', lc: 'OM' }, // Oman (Omantel)
+  '970':   { mcc: '425', mnc: '05', lg: 'ar', lc: 'PS' }, // Palestine (Jawwal)
+  '973':   { mcc: '426', mnc: '01', lg: 'ar', lc: 'BH' }, // Bahrain (Batelco)
+  '974':   { mcc: '427', mnc: '01', lg: 'ar', lc: 'QA' }, // Qatar (Ooredoo)
+  '975':   { mcc: '402', mnc: '11', lg: 'dz', lc: 'BT' }, // Bhutan (B-Mobile)
+  '976':   { mcc: '428', mnc: '88', lg: 'mn', lc: 'MN' }, // Mongolia (Unitel)
+  '977':   { mcc: '429', mnc: '01', lg: 'ne', lc: 'NP' }, // Nepal (Namaste / NT Mobil)
+  '992':   { mcc: '436', mnc: '01', lg: 'ru', lc: 'TJ' }, // Tajikistan (Tcell)
+  '993':   { mcc: '438', mnc: '02', lg: 'ru', lc: 'TM' }, // Turkmenistan (TM-Cell)
+  '994':   { mcc: '400', mnc: '01', lg: 'az', lc: 'AZ' }, // Azerbaijan (Azercell)
+  '995':   { mcc: '282', mnc: '01', lg: 'ka', lc: 'GE' }, // Georgia (Geocell)
+  '996':   { mcc: '437', mnc: '01', lg: 'ky', lc: 'KG' }, // Kyrgyzstan (Beeline)
+  '998':   { mcc: '434', mnc: '03', lg: 'ru', lc: 'UZ' }, // Uzbekistan (UzMobile)
 };
 
 function getCountryMeta(cc) {
@@ -431,17 +574,20 @@ function getCountryMeta(cc) {
 //              (Java long conversion removes them automatically)
 
 const THREE_DIGIT_CCS = new Set([
-  '355','213','376','244','672','374','297','994','387','1246','880','226',
-  '599','1242','975','267','257','229','590','673','591','238','682','237',
-  '236','242','225','269','506','53','357','253','1767','291','240','251',
-  '372','500','298','241','995','594','233','299','220','224','245','592',
-  '504','353','246','964','354','962','996','855','686','850','965','7',
-  '856','423','231','266','370','352','218','261','692','692','389','223',
-  '692','222','960','265','692','976','853','258','264','977','674','505',
-  '687','227','968','507','675','689','680','595','974','692','250','677',
-  '248','963','503','268','235','228','676','1868','688','255','993','690',
-  '670','598','678','685','967','692','262','964','993','1784','1242','371',
-  '1473','692','1268','692','1869','692'
+  '211','212','213','216','218','220','221','222','223','224','225','226',
+  '227','228','229','230','231','232','233','234','235','236','237','238',
+  '239','240','241','242','243','244','245','246','247','248','249','250',
+  '251','252','253','254','255','256','257','258','260','261','262','263',
+  '264','265','266','267','268','269','290','291','297','298','299','350',
+  '351','352','353','354','355','356','357','358','359','370','371','372',
+  '373','374','375','376','377','378','380','381','382','383','385','386',
+  '387','389','420','421','423','500','501','502','503','504','505','506',
+  '507','508','509','590','591','592','593','594','595','596','597','598',
+  '599','670','672','673','674','675','676','677','678','679','680','681',
+  '682','683','685','686','687','688','689','690','691','692','850','852',
+  '853','855','856','880','886','960','961','962','963','964','965','966',
+  '967','968','970','971','972','973','974','975','976','977','992','993',
+  '994','995','996','998'
 ]);
 
 const TWO_DIGIT_CCS = new Set([
@@ -451,11 +597,10 @@ const TWO_DIGIT_CCS = new Set([
   '95','98'
 ]);
 
-// Every country we carry metadata for has to be splittable here, or parsePhone
-// takes the wrong prefix and the registration token ends up computed over the
-// wrong national number — which the server answers by refusing the code. The
-// two lists above were maintained by hand and had already drifted, so the
-// country table itself gets the last word.
+// The country table only covers the places we carry carrier metadata for, which
+// is far fewer than the places that can register. Anything it names still has to
+// be splittable, so it is folded in — a no-op while the lists above are complete,
+// and a backstop if a code is ever added to the table and not to them.
 for (const cc of Object.keys(COUNTRY_META)) {
   if      (cc.length === 3) THREE_DIGIT_CCS.add(cc);
   else if (cc.length === 2) TWO_DIGIT_CCS.add(cc);

package/lib/image/Bmp.js

@@ -13,15 +13,27 @@ function isBmp(buf) {
 // One channel out of a packed pixel. A mask says where the channel sits and how
 // wide it is, and the width varies — 5-6-5 and 5-5-5 are both ordinary — so the
 // value is scaled by its own maximum rather than shifted by a fixed amount.
+//
+// Both scans below stop at 32 on their own, because a shift count in JS is
+// taken mod 32: `bits >>> 32` is `bits >>> 0`, so a mask of all ones sends an
+// unbounded scan back to bit 0 and it never comes out. Nothing upstream could
+// catch that — decodeImage's try/catch cannot interrupt a loop that does not
+// end, and a thumbnail is built on the way to sending an ordinary image, so
+// one crafted BMP would take the whole process down with it.
 function maskChannel(v, mask) {
   if (!mask) return 0;
   let shift = 0;
-  while (!((mask >>> shift) & 1)) shift++;
+  while (shift < 32 && !((mask >>> shift) & 1)) shift++;
+  if (shift === 32) return 0;                    // no bit set — nothing to read
   const bits = (mask >>> shift) >>> 0;
   let width = 0;
-  while ((bits >>> width) & 1) width++;
-  const max = (1 << width) - 1;
-  return Math.round(((v >>> shift) & max) * 255 / max);
+  while (width < 32 && ((bits >>> width) & 1)) width++;
+  // The obvious `(1 << width) - 1` is wrong at both ends of that range: `1 <<
+  // 32` is 1, and `1 << 31` is negative, so a 31- or 32-bit channel would be
+  // scaled by zero or by a negative maximum. Build the maximum unsigned, and
+  // read the value back unsigned too — `& 0xffffffff` alone yields an int32.
+  const max = width >= 32 ? 0xffffffff : ((1 << width) >>> 0) - 1;
+  return Math.round((((v >>> shift) & max) >>> 0) * 255 / max);
 }
 
 function decodeBmp(buf) {

package/lib/signal/SignalStore.js

@@ -14,6 +14,27 @@ const { SessionRecord } = require('./libsignal');
 //   • on process exit, flush synchronously (so state is never lost)
 //
 // Result: zero blocking disk I/O during the encryption hot-path.
+//
+// Two rules keep that from costing the account everything it knows:
+//
+//   • Every write goes to a temp file and is renamed into place. Writing over
+//     the live path is not one step — it is an open, a truncate and as many
+//     writes as the file needs — and anything that reads or writes in the
+//     middle of that sees a mixture of two snapshots. That mixture is not
+//     valid JSON, and _load() below answers unreadable state with an empty
+//     store, so a single interleaved write silently costs the account every
+//     session, pre-key, identity and LID mapping it had. rename(2) is atomic:
+//     the file is one whole snapshot or the other, never a blend.
+//
+//   • A write never lands if newer state reached the disk while it was in
+//     flight. The async write started by the debounce is not cancellable, and
+//     a synchronous flush — detach(), or the exit handlers — can easily
+//     overtake it; letting the older snapshot finish last would undo every
+//     session written since. _writtenRev records what the file holds, and a
+//     write that has been overtaken drops its temp file instead of renaming.
+//
+// In-memory state is always the newest thing there is, so any write we abandon
+// costs nothing: the next one writes what is current.
 
 const DEBOUNCE_MS = 300;
 
@@ -37,6 +58,15 @@ class SignalStore {
     this._dirty            = false;
     this._rev              = 0;
     this._saveTimer        = null;
+    // The revision the file on disk actually holds.  An async write compares
+    // against it before renaming: if a synchronous flush got there first, the
+    // write it is holding is stale and must not land.
+    this._writtenRev       = 0;
+    // One async write at a time.  Two of them running together on one path
+    // interleave, and _writeAgain remembers that another one came due while
+    // the first was still going so it can be re-run from a fresh snapshot.
+    this._writing          = false;
+    this._writeAgain       = false;
 
     // Flush synchronously on exit so no state is ever lost.
     //
@@ -61,7 +91,14 @@ class SignalStore {
       process.removeListener('SIGTERM', this._onSigTerm);
       process.removeListener('SIGINT',  this._onSigInt);
     } catch (_) {}
-    this._filePath = null;
+    // Clearing the path is also what tells a write that is still in flight to
+    // stand down — it checks the path it started with before renaming. The
+    // caller detaches in order to move these files, so leave nothing of ours
+    // behind in the directory it is about to rename.
+    const stale = this._filePath ? [this._tmpPath(true), this._tmpPath(false)] : [];
+    this._filePath   = null;
+    this._writeAgain = false;
+    for (const f of stale) { try { fs.unlinkSync(f); } catch (_) {} }
   }
 
   init(identityKeyPair, registrationId) {
@@ -100,23 +137,67 @@ class SignalStore {
     return this._lidMappings;
   }
 
-  // Immediate synchronous flush (used on process exit only)
+  // Everything that is persisted, as it goes on disk.
+  _snapshot() {
+    return JSON.stringify({
+      sessions:      this._sessions,
+      preKeys:       this._preKeys,
+      signedPreKeys: this._signedPreKeys,
+      identities:    this._identities,
+      lidMappings:   this._lidMappings
+    });
+  }
+
+  // Where a write assembles the file before it becomes the file. The sync and
+  // async writers get separate names so the one can never find the other's
+  // half-written temp file under it.
+  _tmpPath(sync) {
+    return this._filePath + (sync ? '.stmp' : '.atmp');
+  }
+
+  // A rename replaces the file, so the one that lands carries the temp file's
+  // permissions and not the old file's. This holds Signal private keys, and an
+  // operator who tightened its mode would find it loosened again by the next
+  // write — so carry whatever the file already had across. null when there is
+  // no file yet, which leaves the default the old writes produced.
+  _modeOf(file) {
+    try { return fs.statSync(file).mode & 0o777; } catch (_) { return null; }
+  }
+
+  // Immediate synchronous flush (process exit, and detach())
   _flushSync() {
     if (!this._dirty || !this._filePath) return;
     if (this._saveTimer) { clearTimeout(this._saveTimer); this._saveTimer = null; }
+    const rev  = this._rev;
+    const file = this._filePath;
+    const tmp  = this._tmpPath(true);
     try {
-      const data = JSON.stringify({
-        sessions:      this._sessions,
-        preKeys:       this._preKeys,
-        signedPreKeys: this._signedPreKeys,
-        identities:    this._identities,
-        lidMappings:   this._lidMappings
-      });
-      const dir = path.dirname(this._filePath);
+      const dir  = path.dirname(file);
       if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-      fs.writeFileSync(this._filePath, data, 'utf8');
-      this._dirty = false;
-    } catch (_) {}
+      const mode = this._modeOf(file);
+      fs.writeFileSync(tmp, this._snapshot(), mode !== null
+        ? { encoding: 'utf8', mode } : 'utf8');
+      if (mode !== null) fs.chmodSync(tmp, mode);
+      fs.renameSync(tmp, file);
+      // Take the async writer's temp file away from it.
+      //
+      // Its "have I been overtaken?" check runs on this thread, but the rename
+      // it authorises is carried out on a pool thread afterwards — and at exit
+      // the pool is usually busy, so that rename can still be queued now and
+      // execute during teardown, putting this snapshot back to an older one.
+      // Its callback never runs there, so nothing would notice or repair it.
+      // Removing the source makes that queued rename fail ENOENT instead.
+      // detach() does the same thing, which is why detach() was never exposed
+      // to this; the exit path simply was not doing it.
+      try { fs.unlinkSync(this._tmpPath(false)); } catch (_) {}
+      // Nothing ran between the snapshot and the rename — this is synchronous —
+      // so the file now holds exactly this revision and there is nothing left
+      // to write.
+      this._writtenRev = rev;
+      this._dirty      = false;
+    } catch (_) {
+      try { fs.unlinkSync(tmp); } catch (_) {}
+    }
   }
 
   // Schedule an async (non-blocking) write after DEBOUNCE_MS inactivity.
@@ -128,25 +209,67 @@ class SignalStore {
     if (this._saveTimer) clearTimeout(this._saveTimer);
     this._saveTimer = setTimeout(() => {
       this._saveTimer = null;
-      // The revision this write is a snapshot of.
-      const rev  = this._rev;
-      const data = JSON.stringify({
-        sessions:      this._sessions,
-        preKeys:       this._preKeys,
-        signedPreKeys: this._signedPreKeys,
-        identities:    this._identities,
-        lidMappings:   this._lidMappings
-      });
-      const dir = path.dirname(this._filePath);
+      this._writeAsync();
+    }, DEBOUNCE_MS);
+  }
+
+  // The debounced write itself: temp file, then rename into place, and only if
+  // nothing newer reached the disk in the meantime.
+  _writeAsync() {
+    if (!this._filePath || !this._dirty) return;
+    // Fold a write that comes due mid-write into the one already running
+    // rather than starting a second one over the same temp file.
+    if (this._writing) { this._writeAgain = true; return; }
+
+    // The revision this write is a snapshot of, and the path it is for. Both
+    // are read once, here: by the time the callbacks run either may have moved
+    // on, and that is exactly what they have to notice.
+    const rev  = this._rev;
+    const file = this._filePath;
+    const tmp  = this._tmpPath(false);
+
+    let data, mode;
+    try {
+      const dir = path.dirname(file);
       if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-      // Only clear the flag when nothing changed while the write was running.
-      // A mutation that arrived after the snapshot is not in `data`, and its
-      // own debounce timer may never fire — clearing here would make the
-      // exit-time _flushSync() skip it and lose it.
-      fs.writeFile(this._filePath, data, 'utf8', () => {
+      mode = this._modeOf(file);
+      data = this._snapshot();
+    } catch (_) { return; }
+
+    this._writing    = true;
+    this._writeAgain = false;
+
+    const finish = () => {
+      this._writing = false;
+      // A write came due while this one was running and was folded into it.
+      // Every other mutation armed its own debounce timer, which is still
+      // pending and will write what is current.
+      if (this._writeAgain && this._dirty && this._filePath) this._writeAsync();
+    };
+    const abandon = () => { fs.unlink(tmp, () => {}); finish(); };
+
+    // Create the temp file already tight rather than widening the window in
+    // which a store full of private keys sits at the umask default.
+    fs.writeFile(tmp, data, mode !== null ? { encoding: 'utf8', mode } : 'utf8', (err) => {
+      if (err) return abandon();
+      // detach() let the file go, or a synchronous flush wrote newer state
+      // while this one was running. Renaming now would put an older snapshot
+      // back and take every session written since with it.
+      if (file !== this._filePath || rev <= this._writtenRev) return abandon();
+      if (mode !== null) { try { fs.chmodSync(tmp, mode); } catch (_) {} }
+      fs.rename(tmp, file, (renameErr) => {
+        if (renameErr) return abandon();
+        // Never walk it backwards: a synchronous flush can land — and record a
+        // higher revision — between the check above and this callback.
+        if (rev > this._writtenRev) this._writtenRev = rev;
+        // Only clear the flag when nothing changed while the write was
+        // running. A mutation that arrived after the snapshot is not in
+        // `data`, and clearing here would make the exit-time _flushSync()
+        // skip it and lose it.
         if (this._rev === rev) this._dirty = false;
+        finish();
       });
-    }, DEBOUNCE_MS);
+    });
   }
 
   // ─── Identity / registration ─────────────────────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.14.7",
+  "version": "5.14.9",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API and web ",
   "author": "Kunboruto20",
   "main": "index.js",