whalibmob 5.29.5 → 5.30.0

package/README.md

@@ -1845,6 +1845,9 @@ Both are optional and both keep working when omitted — you get an error naming
 > [!NOTE]
 > Registration reports the screens it passes through to WhatsApp's `/client_log`, the way the phone clients do — a client that registers in total silence does something no real installation does. It is fire-and-forget and every failure is swallowed, so it can never take a registration down. Set `WA_FUNNEL_LOG=0` to send none of it.
 
+> [!NOTE]
+> Those events carry timestamps, and registration waits between them the way a person would: a few seconds to type the number in, a moment on the confirmation sheet, longer before asking again after a refusal. Without the waits the whole funnel leaves inside one millisecond, which no handset does. It adds a handful of seconds to a registration. Set `WA_REG_PACING=0` to remove them.
+
 ### Registering as Android
 
 **There is nothing to do first.** Name the platform and register:
@@ -1866,9 +1869,19 @@ requesting sms code for +919634847671...
   status  sent
 ```
 
-It happens once. Every later registration reads the file. `WA_NO_APK_DOWNLOAD=1`
-turns the fetch off if you would rather it never pulled a hundred megabytes
-unasked, and `wa apk-material` below does the same job by hand.
+It happens once. Every later registration reads the file — from the session
+directory you are using, wherever that is. `WA_NO_APK_DOWNLOAD=1` turns the
+fetch off if you would rather it never pulled a hundred megabytes unasked, and
+`wa apk-material` below does the same job by hand.
+
+> [!NOTE]
+> The download goes through the Aurora OSS token dispenser, a free third-party
+> service that mints an anonymous Play account. It refuses with **HTTP 403**
+> when it is rate limiting and **5xx** when it is having a bad minute, so the
+> request is retried a few times with a growing wait before giving up.
+> `WA_PLAY_RETRY_DELAY_MS` sets that wait (default `2000`, doubling each time).
+> If it still refuses, nothing is wrong with your setup — pass an APK path to
+> `wa apk-material` instead, which is the same thing without the middleman.
 
 The rest of this section is what happens behind that one command, and how to
 drive each part yourself.

package/cli.js

@@ -2833,6 +2833,16 @@ async function main() {
   // first question land in the wrong prompt.
   _sessDir = await askSessionDir(cmd, flags.session);
 
+  // One source of truth for the rest of the run. The library resolves the files
+  // that belong to the installation rather than to a number — the Android token
+  // material above all — through SessionPaths.defaultBaseDir(), which reads
+  // WA_SESSION_DIR. The CLI, though, can arrive at its directory three other
+  // ways: --session, the folder remembered from the setup prompt, or the home
+  // default. Without publishing the answer here, `wa apk-material` wrote into
+  // the resolved directory while registration went looking in ~/.waSession and
+  // reported no material at all.
+  process.env.WA_SESSION_DIR = _sessDir;
+
   await askDebugMode(cmd);
   await askDonation(cmd);
 

package/lib/PlayStore.js

@@ -158,19 +158,68 @@ function _request(url, opts) {
 
 // ─── Auth ─────────────────────────────────────────────────────────────────────
 
+// How often the dispenser is asked before giving up, and how long between tries.
+//
+// The dispenser is a free service shared by everyone who uses it, and the way it
+// sheds load is to refuse — 403 when it is rate limiting, 5xx when it is having
+// a bad minute. Both are usually over in seconds, so one refusal is not an
+// answer worth reporting to the caller. The waits grow so a dispenser that is
+// genuinely busy is not hammered: roughly 2s, then 4s, then 8s.
+const DISPENSER_ATTEMPTS   = 4;
+const DISPENSER_BASE_DELAY = 2000;
+
+// The wait, overridable. Someone behind a dispenser that is having a long day
+// may want to wait longer between tries, and the test suite wants not to wait
+// at all. 0 is valid and means retry immediately.
+function _dispenserDelay() {
+  const n = Number(process.env.WA_PLAY_RETRY_DELAY_MS);
+  return Number.isFinite(n) && n >= 0 ? n : DISPENSER_BASE_DELAY;
+}
+
+// Worth asking again, or not. A refusal that says "too many, come back" is; a
+// 400 saying the request itself is malformed never will be, and retrying it
+// only makes the caller wait three times as long for the same error.
+function _dispenserRetryable(status) {
+  return status === 403 || status === 408 || status === 429 || status >= 500;
+}
+
+const _sleep = (ms) => new Promise(r => setTimeout(r, ms));
+
 async function fetchAnonymousAuth() {
   const body = JSON.stringify(DEVICE_PROFILE);
-  const res  = await _request(AURORA_DISPENSER_URL, {
-    method:  'POST',
-    headers: {
-      'Content-Type':   'application/json',
-      'User-Agent':     AURORA_USER_AGENT,
-      'Content-Length': Buffer.byteLength(body)
-    },
-    body
-  });
+  const headers = {
+    'Content-Type':   'application/json',
+    'User-Agent':     AURORA_USER_AGENT,
+    'Content-Length': Buffer.byteLength(body)
+  };
+
+  let res = null;
+  let lastErr = null;
+  for (let attempt = 1; attempt <= DISPENSER_ATTEMPTS; attempt++) {
+    try {
+      res = await _request(AURORA_DISPENSER_URL, { method: 'POST', headers, body });
+      lastErr = null;
+      if (res.status === 200) break;
+      if (!_dispenserRetryable(res.status) || attempt === DISPENSER_ATTEMPTS) break;
+      _whaDbg('[DBG] PLAY dispenser HTTP ' + res.status + ' — attempt ' +
+        attempt + '/' + DISPENSER_ATTEMPTS + ', retrying');
+    } catch (e) {
+      // A dropped connection or a timeout is the same kind of transient as a
+      // 5xx, so it is retried on the same schedule rather than thrown at once.
+      lastErr = e;
+      res = null;
+      if (attempt === DISPENSER_ATTEMPTS) break;
+      _whaDbg('[DBG] PLAY dispenser ' + (e && e.message) + ' — attempt ' +
+        attempt + '/' + DISPENSER_ATTEMPTS + ', retrying');
+    }
+    await _sleep(_dispenserDelay() * Math.pow(2, attempt - 1));
+  }
+
+  if (lastErr) throw lastErr;
+
   if (res.status !== 200) {
     throw new Error('the Aurora token dispenser answered HTTP ' + res.status +
+      ' after ' + DISPENSER_ATTEMPTS + ' attempts' +
       ' — it is a free third-party service and this is what it does when it is ' +
       'down or rate limiting. Nothing is wrong with your setup; either try again ' +
       'later or pass an APK path instead.');
@@ -384,3 +433,9 @@ module.exports = {
   AURORA_DISPENSER_URL,
   PERSONAL_PACKAGE
 };
+
+// Dispenser retry internals, exposed for tests. Not part of the public API.
+module.exports._retry = {
+  dispenserRetryable: _dispenserRetryable,
+  DISPENSER_ATTEMPTS
+};

package/lib/Registration.js

@@ -957,7 +957,27 @@ function androidMaterialPath(device) {
   const name = (device && device.business)
     ? 'android-apk-material-business.json'
     : 'android-apk-material.json';
-  return path.join(os.homedir(), '.waSession', name);
+
+  // The session directory, wherever it actually is — not a hardcoded
+  // ~/.waSession. `wa apk-material` writes the file into the directory the CLI
+  // resolved (--session, WA_SESSION_DIR, or the one remembered from the setup
+  // prompt), while this read it from the home default and reported "no
+  // material" for anything else. Anyone who moved their sessions had to set
+  // WA_ANDROID_APK_MATERIAL by hand to make registration find a file that was
+  // already there. SessionPaths.defaultBaseDir() is the same resolver the
+  // writer goes through, and SHARED_FILES there already names both of these as
+  // belonging to the base directory.
+  const { defaultBaseDir } = require('./SessionPaths');
+  const primary = path.join(defaultBaseDir(), name);
+
+  // Material extracted before the directory could be moved still sits in
+  // ~/.waSession. If the configured directory has none but the old default
+  // does, read that rather than claiming there is no material at all.
+  if (!fs.existsSync(primary)) {
+    const legacy = path.join(os.homedir(), '.waSession', name);
+    if (legacy !== primary && fs.existsSync(legacy)) return legacy;
+  }
+  return primary;
 }
 
 const _androidMaterial = {};
@@ -1319,10 +1339,17 @@ function getAppPid(store) {
   return store._appPid;
 }
 
-function buildClientMetrics(attempt) {
+// is_sim_absent used to be the constant false while the same request could send
+// sim_mcc/sim_mnc as 000/000 — which is precisely what a handset reports when
+// there is no SIM in it. One request then said both "a SIM is present" and "no
+// operator", which no real handset ever says. Reading it off the operator the
+// request actually declares keeps the two halves telling one story.
+function buildClientMetrics(attempt, meta) {
+  const mcc = meta && meta.mcc != null ? String(meta.mcc).trim() : '';
+  const simAbsent = !/^\d+$/.test(mcc) || /^0+$/.test(mcc);
   const json = '{"attempts":' + (attempt || 1)
     + ',"app_campaign_download_source":"google-play|unknown"'
-    + ',"is_sim_absent":false}';
+    + ',"is_sim_absent":' + (simAbsent ? 'true' : 'false') + '}';
   return encodeURIComponent(json);
 }
 
@@ -1363,7 +1390,7 @@ function getRequestVerificationCodeParameters(store, method, meta, device, attem
       'prefer_sms_over_flash',      wantsFlash ? 'false' : 'true',
       'simnum',                     '0',
       'airplane_mode_type',         '0',
-      'client_metrics',             buildClientMetrics(attempt),
+      'client_metrics',             buildClientMetrics(attempt, meta),
       'mistyped',                   '7',
       'advertising_id',             store.advertisingId || '',
       'hasinrc',                    '1',
@@ -1621,6 +1648,45 @@ async function sendEncrypted(path, plaintext, store, waVersion) {
   return result;
 }
 
+// ---------- Pacing ----------
+//
+// The funnel events say a person walked through the screens. The timestamps on
+// them said otherwise: session_start, the number lookup and the code request
+// left within a few milliseconds of each other, because nothing in between was
+// waiting on a person. Nobody opens WhatsApp and has a phone number typed,
+// checked and submitted inside one millisecond, and that gap is visible to the
+// server on every event it receives.
+//
+// So the waits a person actually causes are put back. Each one is a range
+// rather than a number — a fixed delay is its own signature — and each is
+// named after the thing being waited for:
+//
+//   enter_number    typing the number in before the lookup fires
+//   confirm_number  the "is this your number?" sheet, and tapping through it
+//   retry_code      after a refused request, before asking again
+//   switch_method   picking a different delivery method out of the list
+//
+// Set WA_REG_PACING=0 to drop all of it, for anything that wants the request
+// shapes without the waiting.
+const PACING_RANGES_MS = {
+  enter_number:   [1800, 5200],
+  confirm_number: [1200, 3600],
+  retry_code:     [2800, 7500],
+  switch_method:  [2000, 5000]
+};
+
+function pacingEnabled() {
+  return process.env.WA_REG_PACING !== '0';
+}
+
+function humanPause(kind) {
+  const range = PACING_RANGES_MS[kind];
+  if (!range || !pacingEnabled()) return Promise.resolve();
+  const ms = range[0] + Math.floor(Math.random() * (range[1] - range[0] + 1));
+  _whaDbg('[DBG] REG pacing ' + kind + ' ' + ms + 'ms');
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
 // ---------- Funnel telemetry ----------
 //
 // The native client reports every screen it moves through — the number entry,
@@ -2022,10 +2088,13 @@ async function checkNumberStatus(phoneNumber) {
 async function assertRegistrationKeys(store, waVersion) {
   // The session-start event the native client fires before it knows the number.
   await sendPrePnFunnelLog(store, waVersion, 'session_start', 'registration_session_start');
+  // The number gets typed between those two events.
+  await humanPause('enter_number');
   await sendFunnelLog(store, waVersion, 'enter_number', 'exist_check', 'exist_attempt');
 
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
+      if (attempt > 0) await humanPause('retry_code');
       logDeviceIdentity('before /exist', store, waVersion);
       const result = await sendRequest('/exist', store, waVersion, false, null);
       // reason === 'incorrect' → keys not found → fresh
@@ -2120,6 +2189,8 @@ async function requestSmsCode(store, method, opts) {
     //   7. Unknown error first time → retry once
     let lastReason = null;
     let attemptNum = 1;
+    // The confirmation sheet the app puts up before it will ask for a code.
+    await humanPause('confirm_number');
     while (true) {
       // Rebuilt per attempt so client_metrics carries the current attempt count.
       const extra = getRequestVerificationCodeParameters(store, m, _regMeta, _device, attemptNum);
@@ -2184,6 +2255,9 @@ async function requestSmsCode(store, method, opts) {
       if (attemptNum > MAX_CODE_REQUEST_ATTEMPTS) {
         throw new Error(`Registration error (${m}): giving up after ${MAX_CODE_REQUEST_ATTEMPTS} attempts — raw: ${JSON.stringify(result)}`);
       }
+
+      // Nobody re-taps the button the instant the error lands.
+      await humanPause('retry_code');
     }
   }
 
@@ -2194,6 +2268,8 @@ async function requestSmsCode(store, method, opts) {
   if (result && result._noRoutes && !autoFallbackDone && method !== 'email') {
     autoFallbackDone = true;
     process.stderr.write(`[REG] ${method} returned no_routes — auto-trying ${fallbackMethod}\n`);
+    // Reading the refusal and picking another method off the list.
+    await humanPause('switch_method');
     result = await _tryMethod(fallbackMethod);
   }
 
@@ -2353,3 +2429,6 @@ module.exports._verify = {
   flashCodeFromCallerId, flashCodeLength, codeForSubmission,
   getRequestVerificationCodeParameters
 };
+
+// Pacing internals, exposed for tests. Not part of the public API.
+module.exports._pacing = { pacingEnabled, humanPause, buildClientMetrics, PACING_RANGES_MS };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.29.5",
+  "version": "5.30.0",
   "description": "Node.js library for WhatsApp — register a number over SMS, or link as a companion by QR. Signal E2E encryption, media, groups, channels.",
   "author": "Kunboruto20",
   "main": "index.js",