whalibmob 5.29.5 → 5.29.6

package/README.md

@@ -1866,9 +1866,19 @@ requesting sms code for +919634847671...
   status  sent
 ```
 
-It happens once. Every later registration reads the file. `WA_NO_APK_DOWNLOAD=1`
-turns the fetch off if you would rather it never pulled a hundred megabytes
-unasked, and `wa apk-material` below does the same job by hand.
+It happens once. Every later registration reads the file — from the session
+directory you are using, wherever that is. `WA_NO_APK_DOWNLOAD=1` turns the
+fetch off if you would rather it never pulled a hundred megabytes unasked, and
+`wa apk-material` below does the same job by hand.
+
+> [!NOTE]
+> The download goes through the Aurora OSS token dispenser, a free third-party
+> service that mints an anonymous Play account. It refuses with **HTTP 403**
+> when it is rate limiting and **5xx** when it is having a bad minute, so the
+> request is retried a few times with a growing wait before giving up.
+> `WA_PLAY_RETRY_DELAY_MS` sets that wait (default `2000`, doubling each time).
+> If it still refuses, nothing is wrong with your setup — pass an APK path to
+> `wa apk-material` instead, which is the same thing without the middleman.
 
 The rest of this section is what happens behind that one command, and how to
 drive each part yourself.

package/cli.js

@@ -2833,6 +2833,16 @@ async function main() {
   // first question land in the wrong prompt.
   _sessDir = await askSessionDir(cmd, flags.session);
 
+  // One source of truth for the rest of the run. The library resolves the files
+  // that belong to the installation rather than to a number — the Android token
+  // material above all — through SessionPaths.defaultBaseDir(), which reads
+  // WA_SESSION_DIR. The CLI, though, can arrive at its directory three other
+  // ways: --session, the folder remembered from the setup prompt, or the home
+  // default. Without publishing the answer here, `wa apk-material` wrote into
+  // the resolved directory while registration went looking in ~/.waSession and
+  // reported no material at all.
+  process.env.WA_SESSION_DIR = _sessDir;
+
   await askDebugMode(cmd);
   await askDonation(cmd);
 

package/lib/PlayStore.js

@@ -158,19 +158,68 @@ function _request(url, opts) {
 
 // ─── Auth ─────────────────────────────────────────────────────────────────────
 
+// How often the dispenser is asked before giving up, and how long between tries.
+//
+// The dispenser is a free service shared by everyone who uses it, and the way it
+// sheds load is to refuse — 403 when it is rate limiting, 5xx when it is having
+// a bad minute. Both are usually over in seconds, so one refusal is not an
+// answer worth reporting to the caller. The waits grow so a dispenser that is
+// genuinely busy is not hammered: roughly 2s, then 4s, then 8s.
+const DISPENSER_ATTEMPTS   = 4;
+const DISPENSER_BASE_DELAY = 2000;
+
+// The wait, overridable. Someone behind a dispenser that is having a long day
+// may want to wait longer between tries, and the test suite wants not to wait
+// at all. 0 is valid and means retry immediately.
+function _dispenserDelay() {
+  const n = Number(process.env.WA_PLAY_RETRY_DELAY_MS);
+  return Number.isFinite(n) && n >= 0 ? n : DISPENSER_BASE_DELAY;
+}
+
+// Worth asking again, or not. A refusal that says "too many, come back" is; a
+// 400 saying the request itself is malformed never will be, and retrying it
+// only makes the caller wait three times as long for the same error.
+function _dispenserRetryable(status) {
+  return status === 403 || status === 408 || status === 429 || status >= 500;
+}
+
+const _sleep = (ms) => new Promise(r => setTimeout(r, ms));
+
 async function fetchAnonymousAuth() {
   const body = JSON.stringify(DEVICE_PROFILE);
-  const res  = await _request(AURORA_DISPENSER_URL, {
-    method:  'POST',
-    headers: {
-      'Content-Type':   'application/json',
-      'User-Agent':     AURORA_USER_AGENT,
-      'Content-Length': Buffer.byteLength(body)
-    },
-    body
-  });
+  const headers = {
+    'Content-Type':   'application/json',
+    'User-Agent':     AURORA_USER_AGENT,
+    'Content-Length': Buffer.byteLength(body)
+  };
+
+  let res = null;
+  let lastErr = null;
+  for (let attempt = 1; attempt <= DISPENSER_ATTEMPTS; attempt++) {
+    try {
+      res = await _request(AURORA_DISPENSER_URL, { method: 'POST', headers, body });
+      lastErr = null;
+      if (res.status === 200) break;
+      if (!_dispenserRetryable(res.status) || attempt === DISPENSER_ATTEMPTS) break;
+      _whaDbg('[DBG] PLAY dispenser HTTP ' + res.status + ' — attempt ' +
+        attempt + '/' + DISPENSER_ATTEMPTS + ', retrying');
+    } catch (e) {
+      // A dropped connection or a timeout is the same kind of transient as a
+      // 5xx, so it is retried on the same schedule rather than thrown at once.
+      lastErr = e;
+      res = null;
+      if (attempt === DISPENSER_ATTEMPTS) break;
+      _whaDbg('[DBG] PLAY dispenser ' + (e && e.message) + ' — attempt ' +
+        attempt + '/' + DISPENSER_ATTEMPTS + ', retrying');
+    }
+    await _sleep(_dispenserDelay() * Math.pow(2, attempt - 1));
+  }
+
+  if (lastErr) throw lastErr;
+
   if (res.status !== 200) {
     throw new Error('the Aurora token dispenser answered HTTP ' + res.status +
+      ' after ' + DISPENSER_ATTEMPTS + ' attempts' +
       ' — it is a free third-party service and this is what it does when it is ' +
       'down or rate limiting. Nothing is wrong with your setup; either try again ' +
       'later or pass an APK path instead.');
@@ -384,3 +433,9 @@ module.exports = {
   AURORA_DISPENSER_URL,
   PERSONAL_PACKAGE
 };
+
+// Dispenser retry internals, exposed for tests. Not part of the public API.
+module.exports._retry = {
+  dispenserRetryable: _dispenserRetryable,
+  DISPENSER_ATTEMPTS
+};

package/lib/Registration.js

@@ -957,7 +957,27 @@ function androidMaterialPath(device) {
   const name = (device && device.business)
     ? 'android-apk-material-business.json'
     : 'android-apk-material.json';
-  return path.join(os.homedir(), '.waSession', name);
+
+  // The session directory, wherever it actually is — not a hardcoded
+  // ~/.waSession. `wa apk-material` writes the file into the directory the CLI
+  // resolved (--session, WA_SESSION_DIR, or the one remembered from the setup
+  // prompt), while this read it from the home default and reported "no
+  // material" for anything else. Anyone who moved their sessions had to set
+  // WA_ANDROID_APK_MATERIAL by hand to make registration find a file that was
+  // already there. SessionPaths.defaultBaseDir() is the same resolver the
+  // writer goes through, and SHARED_FILES there already names both of these as
+  // belonging to the base directory.
+  const { defaultBaseDir } = require('./SessionPaths');
+  const primary = path.join(defaultBaseDir(), name);
+
+  // Material extracted before the directory could be moved still sits in
+  // ~/.waSession. If the configured directory has none but the old default
+  // does, read that rather than claiming there is no material at all.
+  if (!fs.existsSync(primary)) {
+    const legacy = path.join(os.homedir(), '.waSession', name);
+    if (legacy !== primary && fs.existsSync(legacy)) return legacy;
+  }
+  return primary;
 }
 
 const _androidMaterial = {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.29.5",
+  "version": "5.29.6",
   "description": "Node.js library for WhatsApp — register a number over SMS, or link as a companion by QR. Signal E2E encryption, media, groups, channels.",
   "author": "Kunboruto20",
   "main": "index.js",