whalibmob 5.26.0 → 5.28.0

package/index.d.ts

@@ -123,6 +123,14 @@ export interface WhalibmobClientOptions {
   autoFixNumber?: boolean;
   /** Send read receipts for incoming messages. Default `true`. */
   autoRead?: boolean;
+  /**
+   * Refuse every incoming call. Default `true`.
+   *
+   * Turning it off does not answer calls — nothing here can — it leaves the
+   * refusal to you, which is the only way to let some calls ring and reject the
+   * rest with `rejectCall()`.
+   */
+  autoRejectCalls?: boolean;
   /** Refresh the announced build from the platform's store before every handshake. Default `true`. */
   refreshVersion?: boolean;
   /** `true` enables debug logging; an object is handed to `pino` as-is. */
@@ -227,8 +235,24 @@ export interface PollSendResult extends SendResult {
   messageSecret: Buffer;
 }
 
+/** What a message was a reply to, and who it mentioned. */
+export interface DecodedContextInfo {
+  /** Id of the quoted message. */
+  stanzaId?: string;
+  /** Who wrote the quoted message. */
+  participant?: Jid;
+  remoteJid?: Jid;
+  mentionedJid?: Jid[];
+  /** The quoted message, decoded the same way as any other. */
+  quotedMessage?: DecodedMessage;
+  /** The quoted message's raw protobuf bytes, for re-encoding it verbatim. */
+  quotedMessageRaw?: Buffer;
+}
+
 export interface DecodedBase {
   type: string;
+  /** Present when the message quoted another or carried mentions. */
+  contextInfo?: DecodedContextInfo;
   /**
    * The message arrived inside a view-once envelope. The content is decoded
    * normally — media included — this only records how it was sent.
@@ -632,7 +656,7 @@ export interface WhalibmobEvents {
   message: (msg: IncomingMessage) => void;
   receipt: (r: { type: string; id: string; from: Jid }) => void;
   presence: (p: { from: Jid; available: boolean }) => void;
-  call: (c: { from: Jid }) => void;
+  call: (c: { from: Jid; id: string | null; status: 'offer' | 'ringing' | 'terminate' | 'unknown'; node: any }) => void;
   notification: (node: any) => void;
   decrypt_error: (e: { id: string; from: Jid; participant?: Jid; err: Error }) => void;
   session_refresh: (e: { node: any }) => void;
@@ -831,6 +855,12 @@ export declare class WhalibmobClient extends EventEmitter {
    */
   requestAppStateKeys(keyIds: string[]): Promise<string | null>;
 
+  /**
+   * Refuse one incoming call. Only reachable when the client was built with
+   * `autoRejectCalls: false`; the id and caller come off the `call` event.
+   */
+  rejectCall(callId: string, from: Jid): boolean;
+
   // ─── Account restriction ─────────────────────────────────────────────────
   fetchReachoutTimelock(): Promise<ReachoutTimelockState>;
   /** The last known state, recomputed; does not ask the server again. */
@@ -1314,6 +1344,38 @@ export declare const PushClient: LibModule;
 export declare const Fcm: LibModule;
 export declare const FcmMcs: LibModule;
 
+/**
+ * X25519 through Node's own OpenSSL — a drop-in for `curve25519-js`, roughly
+ * 19x faster on `sharedKey` and byte-identical to it.
+ *
+ * `sign` and `verify` are XEdDSA and stay on the JavaScript implementation:
+ * Node's Ed25519 is a different scheme and would produce different bytes.
+ */
+export declare const Curve: LibModule & {
+  generateKeyPair(seed: Buffer | Uint8Array): { private: Buffer; public: Buffer };
+  sharedKey(priv: Buffer | Uint8Array, pub: Buffer | Uint8Array): Buffer;
+  sign(priv: Buffer | Uint8Array, message: Buffer | Uint8Array): Buffer;
+  verify(pub: Buffer | Uint8Array, message: Buffer | Uint8Array, signature: Buffer | Uint8Array): boolean;
+  /** Whether Node's X25519 is in use; `false` means the JavaScript fallback is. */
+  NATIVE: boolean;
+};
+
+/**
+ * HKDF-SHA256 through Node's own OpenSSL — roughly 2.2x faster than the
+ * JavaScript implementation and byte-identical to it. Returns a `Buffer`,
+ * not the `ArrayBuffer` Node's own `hkdfSync` hands back.
+ */
+export declare const Hkdf: LibModule & {
+  hkdfSha256(
+    ikm: Buffer | Uint8Array,
+    salt: Buffer | Uint8Array | string,
+    info: Buffer | Uint8Array | string,
+    length: number
+  ): Buffer;
+  /** Whether Node's HKDF is in use; `false` means the JavaScript fallback is. */
+  NATIVE: boolean;
+};
+
 /** Linking to an account that already exists. */
 export declare const PairingCode: LibModule;
 export declare const CompanionPairing: LibModule;

package/index.js

@@ -129,6 +129,8 @@ const WebVersion       = require('./lib/WebVersion');
 const WebProto         = require('./lib/webproto');
 
 const BinaryNode           = require('./lib/BinaryNode');
+const Curve                = require('./lib/curve');
+const Hkdf                 = require('./lib/hkdf');
 const Noise                = require('./lib/noise');
 const WebSocketStream      = require('./lib/WebSocketStream');
 const Socks                = require('./lib/socks');
@@ -348,6 +350,11 @@ module.exports = {
   FcmMcs,
 
   // Linking to an account that already exists
+  // X25519, through Node's own OpenSSL. Drop-in for curve25519-js.
+  Curve,
+  // HKDF-SHA256, through Node's own OpenSSL.
+  Hkdf,
+
   PairingCode,
   CompanionPairing,
   QrPairing,

package/lib/Client.js

@@ -496,6 +496,12 @@ class WhalibmobClient extends EventEmitter {
     // Blue-tick every message as it arrives. Set to false to make read receipts
     // explicit, sent only by a markRead() call.
     this.autoRead = opts.autoRead !== false;
+
+    // Every incoming call is refused unless this is turned off. Off does not
+    // mean calls are answered — nothing here can answer one — it means the
+    // refusal is left to the caller, which is the only way to let some calls
+    // ring and reject the rest. See rejectCall().
+    this._autoRejectCalls = opts.autoRejectCalls !== false;
     // Flipped by setOnline(). Delivery receipts sent while this is false carry
     // type="inactive", which the sender's app records but does not render.
     this._sendActiveReceipts = false;
@@ -4162,20 +4168,46 @@ class WhalibmobClient extends EventEmitter {
       }
     }
 
-    this.emit('call', { from: attrs.from || '', node });
-    // Reject call automatically
-    if (this._socket && this._connected) {
-      const offer = findChild(node, 'offer');
-      const callId = offer && offer.attrs && offer.attrs.call_id;
-      if (callId) {
-        this._socket.sendNode(new BinaryNode('call', {
-          to: attrs.from || '',
-          id: this._genMsgId()
-        }, [new BinaryNode('reject', { call_id: callId, call_creator: attrs.from || '' }, null)]));
-      }
+    // What the stanza actually says, rather than the raw node alone: which call
+    // it is, and what stage it is at. A caller deciding whether to reject needs
+    // both, and digging them out of the node is not its job.
+    const offer  = findChild(node, 'offer');
+    const relay  = findChild(node, 'relaylatency');
+    const term   = findChild(node, 'terminate');
+    const callId = (offer && offer.attrs && offer.attrs.call_id) ||
+                   (term  && term.attrs  && term.attrs.call_id)  || null;
+    const status = offer ? 'offer' : (term ? 'terminate' : (relay ? 'ringing' : 'unknown'));
+
+    this.emit('call', { from: attrs.from || '', id: callId, status, node });
+
+    // Reject every incoming call, unless the caller asked to decide for itself.
+    // Turning this off does not answer calls — nothing here can — it only stops
+    // the automatic refusal, so a caller can reject some and let the rest ring.
+    if (this._autoRejectCalls && callId && status === 'offer') {
+      this.rejectCall(callId, attrs.from || '');
     }
   }
 
+  /**
+   * Refuse one incoming call.
+   *
+   * Only needed when the client was built with `autoRejectCalls: false`; with
+   * the default every call is refused before this could be reached. The call id
+   * and the caller both come off the `call` event.
+   *
+   * @param {string} callId  the `id` from the call event
+   * @param {string} from    the `from` from the call event
+   * @returns {boolean} whether the refusal could be sent
+   */
+  rejectCall(callId, from) {
+    if (!callId || !this._socket || !this._connected) return false;
+    this._socket.sendNode(new BinaryNode('call', {
+      to: from || '',
+      id: this._genMsgId()
+    }, [new BinaryNode('reject', { call_id: callId, call_creator: from || '' }, null)]));
+    return true;
+  }
+
   // ─── Auth failure (server forces logout during active session) ──────────────
 
   // <failure> ends the connection, but not every reason means the session died.
@@ -5461,9 +5493,9 @@ class WhalibmobClient extends EventEmitter {
     // Web-mode history lands in its own files. A number can be registered over
     // SMS and separately linked as a companion, and only the companion ever
     // receives history — merging the two would be merging different accounts'
-    // views of the same number.
-    const phone = (this._store && this._store.phoneNumber) +
-                  (this._mode === 'web' ? '.web' : '');
+    // views of the same number. Same prefix the readers use.
+    const phone = this._sessionFilePrefix();
+    if (!phone) return;
     const sessionDir = this._sessionDir;
 
     _whaDbg('[DBG] HIST_SYNC start syncType=' + notification.syncType +
@@ -5680,15 +5712,25 @@ class WhalibmobClient extends EventEmitter {
   }
 
   /**
-   * getHistoryStore — load the persisted history store for this phone.
-   * Returns the parsed {phone}.history.json content or null if not yet synced.
+   * The name every file of this session is built from.
    *
-   * @returns {object|null}
+   * A number can be registered over SMS and separately linked as a companion,
+   * and the two are different accounts' views of it, so the companion's files
+   * carry a `.web` in the middle: 40712345678.web.history.json. Everything that
+   * reads or writes one has to agree on that — a writer that adds the `.web`
+   * and a reader that does not will not error, it will simply never find the
+   * file it just wrote.
    */
-  getHistoryStore() {
+  _sessionFilePrefix() {
     if (!this._store || !this._store.phoneNumber) return null;
+    return this._store.phoneNumber + (this._mode === 'web' ? '.web' : '');
+  }
+
+  _readSessionJson(suffix) {
+    const prefix = this._sessionFilePrefix();
+    if (!prefix) return null;
     const fs   = require('fs');
-    const file = require('path').join(this._sessionDir, this._store.phoneNumber + '.history.json');
+    const file = require('path').join(this._sessionDir, prefix + suffix);
     try {
       if (!fs.existsSync(file)) return null;
       return JSON.parse(fs.readFileSync(file, 'utf8'));
@@ -5696,19 +5738,25 @@ class WhalibmobClient extends EventEmitter {
   }
 
   /**
-   * getMessagesStore — load the persisted messages for this phone.
-   * Returns the parsed {phone}.messages.json content or null if not yet synced.
+   * getHistoryStore — load the persisted history store for this session.
+   * Returns the parsed {phone}.history.json content — {phone}.web.history.json
+   * on a companion — or null if not yet synced.
+   *
+   * @returns {object|null}
+   */
+  getHistoryStore() {
+    return this._readSessionJson('.history.json');
+  }
+
+  /**
+   * getMessagesStore — load the persisted messages for this session.
+   * Returns the parsed {phone}.messages.json content — {phone}.web.messages.json
+   * on a companion — or null if not yet synced.
    *
    * @returns {object|null}
    */
   getMessagesStore() {
-    if (!this._store || !this._store.phoneNumber) return null;
-    const fs   = require('fs');
-    const file = require('path').join(this._sessionDir, this._store.phoneNumber + '.messages.json');
-    try {
-      if (!fs.existsSync(file)) return null;
-      return JSON.parse(fs.readFileSync(file, 'utf8'));
-    } catch (_) { return null; }
+    return this._readSessionJson('.messages.json');
   }
 
   // ─── Public API ───────────────────────────────────────────────────────────

package/lib/CompanionPairing.js

@@ -18,7 +18,7 @@
 // from that account.
 
 const crypto  = require('crypto');
-const curveJs = require('curve25519-js');
+const curveJs = require('./curve');
 
 const WA_ADV_ACCOUNT_SIG_PREFIX        = Buffer.from([6, 0]);
 const WA_ADV_DEVICE_SIG_PREFIX         = Buffer.from([6, 1]);

package/lib/HistorySyncHandler.js

@@ -26,13 +26,13 @@
  */
 
 const crypto = require('crypto');
+const { hkdfSha256 } = require('./hkdf');
 const https  = require('https');
 const http   = require('http');
 const zlib   = require('zlib');
 const fs     = require('fs');
 const path   = require('path');
 
-const { hkdf }   = require('@noble/hashes/hkdf');
 const { sha256 } = require('@noble/hashes/sha256');
 
 // ─── Constants ────────────────────────────────────────────────────────────────
@@ -442,7 +442,7 @@ function decodeHistorySync(buf) {
 function deriveHistoryKeys(mediaKeyBuf) {
   const ikm  = Buffer.isBuffer(mediaKeyBuf) ? mediaKeyBuf : Buffer.from(mediaKeyBuf);
   const info = Buffer.from(HISTORY_HKDF_INFO, 'utf8');
-  const expanded = Buffer.from(hkdf(sha256, ikm, Buffer.alloc(0), info, EXPANDED_SIZE));
+  const expanded = hkdfSha256(ikm, Buffer.alloc(0), info, EXPANDED_SIZE);
   return {
     iv:        expanded.slice(0, IV_LEN),
     cipherKey: expanded.slice(IV_LEN, IV_LEN + KEY_LEN),

package/lib/MediaService.js

@@ -1,11 +1,11 @@
 'use strict';
 
 const crypto  = require('crypto');
+const { hkdfSha256 } = require('./hkdf');
 const https   = require('https');
 const http    = require('http');
 const fs      = require('fs');
 const path    = require('path');
-const { hkdf } = require('@noble/hashes/hkdf');
 const { sha256 } = require('@noble/hashes/sha256');
 const { getDeviceConfig } = require('./DeviceConfig');
 
@@ -69,7 +69,7 @@ const MAC_LEN       = 10;
 function deriveMediaKeyData(mediaKey, keyName) {
   const ikm  = Buffer.isBuffer(mediaKey) ? mediaKey : Buffer.from(mediaKey);
   const info = Buffer.from(keyName, 'utf8');
-  return Buffer.from(hkdf(sha256, ikm, Buffer.alloc(0), info, EXPANDED_SIZE));
+  return hkdfSha256(ikm, Buffer.alloc(0), info, EXPANDED_SIZE);
 }
 
 function encryptMedia(plaintext, mediaKey, keyName) {

package/lib/PairingCode.js

@@ -25,7 +25,8 @@
 // in normally.
 
 const crypto = require('crypto');
-const curveJs = require('curve25519-js');
+const { hkdfSha256 } = require('./hkdf');
+const curveJs = require('./curve');
 
 // Crockford base32 minus the ambiguous characters — no I, O, U, and no 0.
 // Five random bytes become exactly eight characters.
@@ -85,15 +86,12 @@ function aesEncryptGCM(plaintext, key, iv, aad) {
 }
 
 function hkdf(input, length, info, salt) {
-  const { hkdf: nobleHkdf } = require('@noble/hashes/hkdf');
-  const { sha256 } = require('@noble/hashes/sha256');
-  return Buffer.from(nobleHkdf(
-    sha256,
+  return hkdfSha256(
     input,
     salt || Buffer.alloc(32),
     info ? Buffer.from(info, 'utf8') : Buffer.alloc(0),
     length
-  ));
+  );
 }
 
 function stripKeyPrefix(pub) {

package/lib/Registration.js

@@ -6,7 +6,7 @@ const tls    = require('tls');
 const fs     = require('fs');
 const os     = require('os');
 const path   = require('path');
-const curveJs = require('curve25519-js');
+const curveJs = require('./curve');
 const { v4: uuidv4 } = require('uuid');
 const { getDeviceConfig } = require('./DeviceConfig');
 const AndroidApk  = require('./AndroidApk');

package/lib/Store.js

@@ -5,7 +5,7 @@ const { warn: _whaWarn, dbg: _whaDbg } = require('./logger');
 const fs = require('fs');
 const path = require('path');
 const crypto = require('crypto');
-const curveJs = require('curve25519-js');
+const curveJs = require('./curve');
 const { v4: uuidv4 } = require('uuid');
 const { IOS_DEVICE, IOS_VERSION_FALLBACK, ANDROID_VERSION_FALLBACK,
         platformForOs, isBusinessPlatform } = require('./constants');

package/lib/appstate/AppStateSync.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const crypto     = require('crypto');
-const { hkdf }   = require('@noble/hashes/hkdf');
+const { hkdfSha256 } = require('../hkdf');
 const { sha256 } = require('@noble/hashes/sha256');
 const { makeGenerator, newState } = require('./LTHash');
 const S = require('./SyncdProto');
@@ -19,8 +19,8 @@ const KEY_EXPANSION_LEN  = 160;
 
 function mutationKeys(keyData) {
   const ikm = Buffer.isBuffer(keyData) ? keyData : Buffer.from(keyData);
-  const e   = Buffer.from(hkdf(sha256, ikm, Buffer.alloc(0),
-    Buffer.from(KEY_EXPANSION_INFO, 'utf8'), KEY_EXPANSION_LEN));
+  const e   = hkdfSha256(ikm, Buffer.alloc(0),
+    Buffer.from(KEY_EXPANSION_INFO, 'utf8'), KEY_EXPANSION_LEN);
   return {
     indexKey:           e.subarray(0, 32),
     valueEncryptionKey: e.subarray(32, 64),

package/lib/appstate/LTHash.js

@@ -1,7 +1,6 @@
 'use strict';
+const { hkdfSha256 } = require('../hkdf');
 
-const { hkdf }   = require('@noble/hashes/hkdf');
-const { sha256 } = require('@noble/hashes/sha256');
 
 // A summation hash that survives being edited out of order.
 //
@@ -30,9 +29,7 @@ class LTHash {
   // 128 bytes of key material for one value.
   _expand(value) {
     const ikm = Buffer.isBuffer(value) ? value : Buffer.from(value);
-    return Buffer.from(
-      hkdf(sha256, ikm, Buffer.alloc(0), Buffer.from(this.salt, 'utf8'), HASH_BYTES)
-    );
+    return hkdfSha256(ikm, Buffer.alloc(0), Buffer.from(this.salt, 'utf8'), HASH_BYTES);
   }
 
   // Word-by-word, 16 bits at a time, little-endian, wrapping at 2^16.

package/lib/curve.js

@@ -0,0 +1,148 @@
+'use strict';
+
+// X25519, through Node's own OpenSSL rather than a JavaScript field arithmetic
+// implementation.
+//
+// Every session setup and every ratchet step does a Diffie-Hellman, and every
+// registration derives 812 pre-keys, so this is the busiest arithmetic in the
+// library. Measured on the same machine, over 3000 iterations each:
+//
+//   sharedKey        curve25519-js  0.765 ms/op    Node  0.040 ms/op   19x
+//   generateKeyPair  curve25519-js  0.779 ms/op    Node  0.085 ms/op    9x
+//
+// The results are byte-identical, which is the only reason this swap is
+// allowed to exist — verified over 200 random key pairs in test/curve.test.js
+// rather than assumed from the fact that both claim to implement RFC 7748.
+//
+// Two things are deliberately NOT native:
+//
+//   sign / verify are XEdDSA — signing with a Montgomery key, which is what
+//   Signal specifies and what WhatsApp's device identities are signed with.
+//   Node has Ed25519, which is a different scheme over a different encoding of
+//   the same curve; swapping one for the other would produce different bytes
+//   and every signature this library has ever written would stop verifying.
+//   Those two stay on curve25519-js, and that is why it is still a dependency.
+//
+//   The private half of generateKeyPair is clamped here rather than left as the
+//   seed. curve25519-js clamps it before returning, callers store what they are
+//   given, and a session written with one and read with the other would not
+//   agree. Node clamps internally at use time and hands back the raw seed, so
+//   the clamp has to be done explicitly to keep the returned pair identical.
+//
+// The API is curve25519-js's, unchanged, so this is a drop-in for it.
+
+const crypto  = require('crypto');
+const curveJs = require('curve25519-js');
+
+// The DER wrappers Node wants around a bare 32-byte X25519 key. Both are fixed
+// prefixes — the algorithm identifier and the length header — so a raw key
+// becomes an importable one by concatenation.
+const PRIVATE_KEY_DER_PREFIX = Buffer.from([
+  48, 46, 2, 1, 0, 48, 5, 6, 3, 43, 101, 110, 4, 34, 4, 32
+]);
+const PUBLIC_KEY_DER_PREFIX = Buffer.from([
+  48, 42, 48, 5, 6, 3, 43, 101, 110, 3, 33, 0
+]);
+
+// Whether this Node was built with X25519. Everything below falls back to the
+// JavaScript implementation when it was not, so an unusual build keeps working
+// rather than failing at the first handshake.
+const NATIVE = (() => {
+  try {
+    if (typeof crypto.diffieHellman !== 'function') return false;
+    const seed = Buffer.alloc(32, 1);
+    _importPrivate(seed);
+    return true;
+  } catch (_) { return false; }
+})();
+
+function _importPrivate(raw32) {
+  return crypto.createPrivateKey({
+    key:    Buffer.concat([PRIVATE_KEY_DER_PREFIX, raw32]),
+    format: 'der',
+    type:   'pkcs8'
+  });
+}
+
+function _importPublic(raw32) {
+  return crypto.createPublicKey({
+    key:    Buffer.concat([PUBLIC_KEY_DER_PREFIX, raw32]),
+    format: 'der',
+    type:   'spki'
+  });
+}
+
+// The clamp RFC 7748 specifies for X25519 private scalars, applied to a copy so
+// a caller's seed is never modified underneath it.
+function clamp(seed) {
+  const k = Buffer.from(seed);
+  k[0]  &= 248;
+  k[31] &= 127;
+  k[31] |= 64;
+  return k;
+}
+
+/**
+ * A key pair from 32 bytes of seed.
+ *
+ * Returns the same shape and the same bytes as curve25519-js: the private half
+ * clamped, the public half derived from it.
+ *
+ * @param {Buffer|Uint8Array} seed  32 bytes
+ * @returns {{private: Buffer, public: Buffer}}
+ */
+function generateKeyPair(seed) {
+  if (!seed || seed.length !== 32) {
+    throw new Error('generateKeyPair: seed must be 32 bytes, got ' +
+      (seed ? seed.length : 'nothing'));
+  }
+  if (!NATIVE) {
+    const kp = curveJs.generateKeyPair(seed);
+    return { private: Buffer.from(kp.private), public: Buffer.from(kp.public) };
+  }
+  const priv = clamp(seed);
+  const pub  = crypto.createPublicKey(_importPrivate(priv))
+    .export({ format: 'der', type: 'spki' })
+    .subarray(PUBLIC_KEY_DER_PREFIX.length);
+  return { private: priv, public: Buffer.from(pub) };
+}
+
+/**
+ * The X25519 shared secret between our private key and their public key.
+ *
+ * @param {Buffer|Uint8Array} priv  32 bytes
+ * @param {Buffer|Uint8Array} pub   32 bytes
+ * @returns {Buffer} 32 bytes
+ */
+function sharedKey(priv, pub) {
+  if (!priv || priv.length !== 32) throw new Error('sharedKey: private key must be 32 bytes');
+  if (!pub  || pub.length  !== 32) throw new Error('sharedKey: public key must be 32 bytes');
+  if (!NATIVE) return Buffer.from(curveJs.sharedKey(priv, pub));
+  return crypto.diffieHellman({
+    privateKey: _importPrivate(Buffer.from(priv)),
+    publicKey:  _importPublic(Buffer.from(pub))
+  });
+}
+
+/**
+ * XEdDSA signature. Not native — see the note at the top of this file.
+ *
+ * @returns {Buffer} 64 bytes
+ */
+function sign(priv, message) {
+  return Buffer.from(curveJs.sign(priv, message));
+}
+
+/** XEdDSA verification. Not native — see the note at the top of this file. */
+function verify(pub, message, signature) {
+  return curveJs.verify(pub, message, signature);
+}
+
+module.exports = {
+  generateKeyPair,
+  sharedKey,
+  sign,
+  verify,
+  /** Whether Node's X25519 is being used. `false` means the JS fallback is. */
+  NATIVE
+};

package/lib/hkdf.js

@@ -0,0 +1,65 @@
+'use strict';
+
+// HKDF-SHA256, through Node's own OpenSSL.
+//
+// Every media key, every app-state key, every Noise handshake and every sender
+// key goes through this, so it runs on nearly every operation the library
+// performs. Measured over 20000 iterations at the 112-byte length the media
+// path uses:
+//
+//   @noble/hashes  20.99 us/op      Node  9.38 us/op      2.2x
+//
+// Byte-identical over 300 random combinations of key material, salt and info
+// at random lengths — checked in test/hkdf.test.js rather than assumed from
+// both implementing RFC 5869.
+//
+// Two details this wrapper exists to get right:
+//
+//   Node's hkdfSync returns an ArrayBuffer, not a Buffer. Handing one to code
+//   that expects a Buffer gives an object with no `.equals`, no `.subarray`
+//   returning a Buffer, and a `.length` that is `undefined` — mistakes that
+//   surface far from here. A Buffer is what comes back from this.
+//
+//   The argument order is @noble's, so this is a drop-in for it, with the hash
+//   argument dropped since it is always SHA-256 here.
+
+const crypto = require('crypto');
+
+// Whether this Node has hkdfSync. It arrived in Node 15; the fallback keeps an
+// older one working rather than failing at the first key derivation.
+const NATIVE = typeof crypto.hkdfSync === 'function';
+
+let _nobleHkdf = null, _nobleSha = null;
+function _noble() {
+  if (!_nobleHkdf) {
+    _nobleHkdf = require('@noble/hashes/hkdf').hkdf;
+    _nobleSha  = require('@noble/hashes/sha256').sha256;
+  }
+  return { hkdf: _nobleHkdf, sha256: _nobleSha };
+}
+
+/**
+ * Expand key material into `length` bytes.
+ *
+ * @param {Buffer|Uint8Array} ikm     the input key material
+ * @param {Buffer|Uint8Array|string} salt  may be empty
+ * @param {Buffer|Uint8Array|string} info  may be empty
+ * @param {number} length             how many bytes to produce
+ * @returns {Buffer}
+ */
+function hkdfSha256(ikm, salt, info, length) {
+  if (!NATIVE) {
+    const n = _noble();
+    return Buffer.from(n.hkdf(n.sha256, ikm, salt, info, length));
+  }
+  // Buffer.from(ArrayBuffer) is a view over the same memory rather than a copy,
+  // which is fine here because the ArrayBuffer is freshly allocated by
+  // hkdfSync and nothing else holds a reference to it.
+  return Buffer.from(crypto.hkdfSync('sha256', ikm, salt, info, length));
+}
+
+module.exports = {
+  hkdfSha256,
+  /** Whether Node's HKDF is in use; `false` means the JavaScript fallback is. */
+  NATIVE
+};

package/lib/messages/MediaRetry.js

@@ -28,8 +28,7 @@
 // the additional data.
 
 const crypto     = require('crypto');
-const { hkdf }   = require('@noble/hashes/hkdf');
-const { sha256 } = require('@noble/hashes/sha256');
+const { hkdfSha256 } = require('../hkdf');
 
 const RETRY_KEY_INFO = 'WhatsApp Media Retry Notification';
 const IV_SIZE        = 12;
@@ -89,7 +88,7 @@ function readFields(buf) {
 function mediaRetryKey(mediaKey) {
   const ikm = Buffer.isBuffer(mediaKey) ? mediaKey : Buffer.from(mediaKey);
   return Buffer.from(
-    hkdf(sha256, ikm, Buffer.alloc(0), Buffer.from(RETRY_KEY_INFO, 'utf8'), 32));
+    hkdfSha256(ikm, Buffer.alloc(0), Buffer.from(RETRY_KEY_INFO, 'utf8'), 32));
 }
 
 /**

package/lib/messages/MessageSender.js

@@ -117,7 +117,7 @@ function _encodeADVSignedIdentity(details, sigKey, acctSig, devSig) {
 
 let _curve25519js = null;
 function _getCurve() {
-  if (!_curve25519js) _curve25519js = require('curve25519-js');
+  if (!_curve25519js) _curve25519js = require('../curve');
   return _curve25519js;
 }
 

package/lib/messages/ReportingToken.js

@@ -21,7 +21,7 @@
 // not observable on send.
 
 const crypto     = require('crypto');
-const { hkdf }   = require('@noble/hashes/hkdf');
+const { hkdfSha256 } = require('../hkdf');
 const { sha256 } = require('@noble/hashes/sha256');
 
 // Protobuf field numbers on Message that the token is computed over.
@@ -224,7 +224,7 @@ function generateMsgSecretKey(modificationType, origMsgId, origMsgSender, modifi
     Buffer.from(String(modificationSender), 'utf8'),
     Buffer.from(modificationType, 'utf8')
   ]);
-  return Buffer.from(hkdf(sha256, origMsgSecret, Buffer.alloc(32), useCaseSecret, 32));
+  return hkdfSha256(origMsgSecret, Buffer.alloc(32), useCaseSecret, 32);
 }
 
 // ─── reading what we need out of the encoded message ─────────────────────────

package/lib/noise.js

@@ -1,11 +1,11 @@
 'use strict';
 
 const net          = require('net');
+const { hkdfSha256 } = require('./hkdf');
 const crypto       = require('crypto');
 const EventEmitter = require('events');
-const curveJs      = require('curve25519-js');
+const curveJs      = require('./curve');
 const { sha256 }   = require('@noble/hashes/sha256');
-const { hkdf }     = require('@noble/hashes/hkdf');
 const { MOBILE_PROLOGUE, WEB_PROLOGUE, WHATSAPP_HOST, WHATSAPP_PORT,
         platformForOs } = require('./constants');
 const { encodeHandshakeClientHello, encodeHandshakeClientFinish,
@@ -224,7 +224,7 @@ function aesgcmDecrypt(key, counter, ciphertext, aad) {
 }
 
 function deriveHkdf(salt, ikm, length) {
-  return Buffer.from(hkdf(sha256, ikm, salt, new Uint8Array(0), length));
+  return hkdfSha256(ikm, salt, new Uint8Array(0), length);
 }
 
 class NoiseState {

package/lib/proto/MessageProto.js

@@ -612,6 +612,80 @@ function _unwrap(envelope, innerField) {
   } catch (_) { return null; }
 }
 
+// ─── ContextInfo, on the way in ──────────────────────────────────────────────
+//
+// Every message that can be a reply carries one, always at field 17 of its own
+// content field — and field 7 for a group invite, which numbers its own fields.
+// It is what says the message quotes another, and what the quoted message was:
+//
+//   ContextInfo { stanzaId=1, participant=2, quotedMessage=3, remoteJid=4,
+//                 mentionedJid=15 }
+//
+// Without it a reply is indistinguishable from a message sent on its own, so
+// anything that acts on what was quoted — re-sending a view-once, turning a
+// photo into a sticker — has nothing to act on.
+const CONTEXT_BEARING_FIELDS = [
+  [6, 17],   // extendedTextMessage
+  [3, 17],   // imageMessage
+  [4, 17],   // contactMessage
+  [5, 17],   // locationMessage
+  [7, 17],   // documentMessage
+  [8, 17],   // audioMessage
+  [9, 17],   // videoMessage
+  [26, 17],  // stickerMessage
+  [49, 17],  // pollCreationMessage
+  [28, 7]    // groupInviteMessage — its contextInfo is field 7
+];
+
+function decodeContextInfo(buf, depth) {
+  if (!buf || !Buffer.isBuffer(buf)) return null;
+  try {
+    const c   = _decodeFields(buf);
+    const out = {};
+
+    const stanzaId = _str(c[1]);
+    if (stanzaId) out.stanzaId = stanzaId;
+    const participant = _str(c[2]);
+    if (participant) out.participant = participant;
+    const remoteJid = _str(c[4]);
+    if (remoteJid) out.remoteJid = remoteJid;
+
+    // Mentions are a repeated string, so one mention decodes to a bare value
+    // rather than to a list of one.
+    if (c[15] != null) {
+      const raw = Array.isArray(c[15]) ? c[15] : [c[15]];
+      const jids = raw.map(_str).filter(Boolean);
+      if (jids.length) out.mentionedJid = jids;
+    }
+
+    // The quoted message is a Message of its own, decoded the same way as any
+    // other. The depth bound is shared with the envelope unwrapping so a chain
+    // of replies quoting replies cannot recurse without end.
+    if (Buffer.isBuffer(c[3]) && c[3].length && (depth || 0) < MAX_WRAPPER_DEPTH) {
+      out.quotedMessageRaw = c[3];
+      const quoted = decodeMessageContainer(c[3], (depth || 0) + 1);
+      if (quoted && quoted.type !== 'unknown') out.quotedMessage = quoted;
+    }
+
+    return Object.keys(out).length ? out : null;
+  } catch (_) { return null; }
+}
+
+// Whichever content field the message turned out to be, its contextInfo.
+function _contextInfoOf(f, depth) {
+  for (const [contentField, ctxField] of CONTEXT_BEARING_FIELDS) {
+    const content = f[contentField];
+    if (!Buffer.isBuffer(content)) continue;
+    try {
+      const inner = _decodeFields(content)[ctxField];
+      if (!Buffer.isBuffer(inner) || !inner.length) continue;
+      const ctx = decodeContextInfo(inner, depth);
+      if (ctx) return ctx;
+    } catch (_) { /* try the next one */ }
+  }
+  return null;
+}
+
 function decodeMessageContainer(buf, depth) {
   if (!buf || buf.length === 0) return { type: 'unknown' };
   try {
@@ -953,6 +1027,13 @@ function decodeMessageContainer(buf, depth) {
         msgResult = Object.assign({}, msgResult, { encKey: messageSecret });
       }
       if (skdmInfo && !msgResult.skdm) msgResult = Object.assign({}, msgResult, { skdm: skdmInfo });
+      // What this message was a reply to, if anything. Read at the level that
+      // actually carried the content, so an envelope does not overwrite the
+      // context the message inside it already found.
+      if (!msgResult.contextInfo) {
+        const ctx = _contextInfoOf(f, level);
+        if (ctx) msgResult = Object.assign({}, msgResult, { contextInfo: ctx });
+      }
       return msgResult;
     }
 
@@ -1025,5 +1106,6 @@ module.exports = {
   PROTOCOL_MSG_EPHEMERAL,
   GROUP_INVITE_TYPE_DEFAULT,
   GROUP_INVITE_TYPE_PARENT,
-  decodeMessageContainer
+  decodeMessageContainer,
+  decodeContextInfo
 };

package/lib/signal/SenderKey.js

@@ -1,14 +1,14 @@
 'use strict';
 
 const { dbg: _whaDbg } = require('../logger');
+const { hkdfSha256 } = require('../hkdf');
 
 const crypto = require('crypto');
 const fs     = require('fs');
 const path   = require('path');
-const { hkdf }   = require('@noble/hashes/hkdf');
 const { sha256 } = require('@noble/hashes/sha256');
 const { hmac }   = require('@noble/hashes/hmac');
-const curveJs    = require('curve25519-js');
+const curveJs    = require('../curve');
 
 // ─── Helpers ─────────────────────────────────────────────────────────────────
 
@@ -63,7 +63,7 @@ function advanceChain(chainKey) {
 function deriveMessageKeys(messageKey) {
   const salt    = Buffer.alloc(32);
   const info    = Buffer.from('WhisperGroup');
-  const derived = Buffer.from(hkdf(sha256, messageKey, salt, info, 48));
+  const derived = hkdfSha256(messageKey, salt, info, 48);
   return {
     iv:        derived.slice(0, 16),
     cipherKey: derived.slice(16, 48)

package/lib/signal/libsignal/curve.js

@@ -3,7 +3,7 @@ const { dbg: _whaDbg, warn: _whaWarn, err: _whaErr, info: _whaInfo } = require('
 
 'use strict';
 
-const curveJs = require('curve25519-js');
+const curveJs = require('../../curve');
 const nodeCrypto = require('crypto');
 // from: https://github.com/digitalbazaar/x25519-key-agreement-key-2019/blob/master/lib/crypto.js
 const PUBLIC_KEY_DER_PREFIX = Buffer.from([

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.26.0",
+  "version": "5.28.0",
   "description": "Node.js library for WhatsApp — register a number over SMS, or link as a companion by QR. Signal E2E encryption, media, groups, channels.",
   "author": "Kunboruto20",
   "main": "index.js",