whalibmob 5.29.6 → 5.30.0

package/README.md

@@ -1845,6 +1845,9 @@ Both are optional and both keep working when omitted — you get an error naming
 > [!NOTE]
 > Registration reports the screens it passes through to WhatsApp's `/client_log`, the way the phone clients do — a client that registers in total silence does something no real installation does. It is fire-and-forget and every failure is swallowed, so it can never take a registration down. Set `WA_FUNNEL_LOG=0` to send none of it.
 
+> [!NOTE]
+> Those events carry timestamps, and registration waits between them the way a person would: a few seconds to type the number in, a moment on the confirmation sheet, longer before asking again after a refusal. Without the waits the whole funnel leaves inside one millisecond, which no handset does. It adds a handful of seconds to a registration. Set `WA_REG_PACING=0` to remove them.
+
 ### Registering as Android
 
 **There is nothing to do first.** Name the platform and register:

package/lib/Registration.js

@@ -1339,10 +1339,17 @@ function getAppPid(store) {
   return store._appPid;
 }
 
-function buildClientMetrics(attempt) {
+// is_sim_absent used to be the constant false while the same request could send
+// sim_mcc/sim_mnc as 000/000 — which is precisely what a handset reports when
+// there is no SIM in it. One request then said both "a SIM is present" and "no
+// operator", which no real handset ever says. Reading it off the operator the
+// request actually declares keeps the two halves telling one story.
+function buildClientMetrics(attempt, meta) {
+  const mcc = meta && meta.mcc != null ? String(meta.mcc).trim() : '';
+  const simAbsent = !/^\d+$/.test(mcc) || /^0+$/.test(mcc);
   const json = '{"attempts":' + (attempt || 1)
     + ',"app_campaign_download_source":"google-play|unknown"'
-    + ',"is_sim_absent":false}';
+    + ',"is_sim_absent":' + (simAbsent ? 'true' : 'false') + '}';
   return encodeURIComponent(json);
 }
 
@@ -1383,7 +1390,7 @@ function getRequestVerificationCodeParameters(store, method, meta, device, attem
       'prefer_sms_over_flash',      wantsFlash ? 'false' : 'true',
       'simnum',                     '0',
       'airplane_mode_type',         '0',
-      'client_metrics',             buildClientMetrics(attempt),
+      'client_metrics',             buildClientMetrics(attempt, meta),
       'mistyped',                   '7',
       'advertising_id',             store.advertisingId || '',
       'hasinrc',                    '1',
@@ -1641,6 +1648,45 @@ async function sendEncrypted(path, plaintext, store, waVersion) {
   return result;
 }
 
+// ---------- Pacing ----------
+//
+// The funnel events say a person walked through the screens. The timestamps on
+// them said otherwise: session_start, the number lookup and the code request
+// left within a few milliseconds of each other, because nothing in between was
+// waiting on a person. Nobody opens WhatsApp and has a phone number typed,
+// checked and submitted inside one millisecond, and that gap is visible to the
+// server on every event it receives.
+//
+// So the waits a person actually causes are put back. Each one is a range
+// rather than a number — a fixed delay is its own signature — and each is
+// named after the thing being waited for:
+//
+//   enter_number    typing the number in before the lookup fires
+//   confirm_number  the "is this your number?" sheet, and tapping through it
+//   retry_code      after a refused request, before asking again
+//   switch_method   picking a different delivery method out of the list
+//
+// Set WA_REG_PACING=0 to drop all of it, for anything that wants the request
+// shapes without the waiting.
+const PACING_RANGES_MS = {
+  enter_number:   [1800, 5200],
+  confirm_number: [1200, 3600],
+  retry_code:     [2800, 7500],
+  switch_method:  [2000, 5000]
+};
+
+function pacingEnabled() {
+  return process.env.WA_REG_PACING !== '0';
+}
+
+function humanPause(kind) {
+  const range = PACING_RANGES_MS[kind];
+  if (!range || !pacingEnabled()) return Promise.resolve();
+  const ms = range[0] + Math.floor(Math.random() * (range[1] - range[0] + 1));
+  _whaDbg('[DBG] REG pacing ' + kind + ' ' + ms + 'ms');
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
 // ---------- Funnel telemetry ----------
 //
 // The native client reports every screen it moves through — the number entry,
@@ -2042,10 +2088,13 @@ async function checkNumberStatus(phoneNumber) {
 async function assertRegistrationKeys(store, waVersion) {
   // The session-start event the native client fires before it knows the number.
   await sendPrePnFunnelLog(store, waVersion, 'session_start', 'registration_session_start');
+  // The number gets typed between those two events.
+  await humanPause('enter_number');
   await sendFunnelLog(store, waVersion, 'enter_number', 'exist_check', 'exist_attempt');
 
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
+      if (attempt > 0) await humanPause('retry_code');
       logDeviceIdentity('before /exist', store, waVersion);
       const result = await sendRequest('/exist', store, waVersion, false, null);
       // reason === 'incorrect' → keys not found → fresh
@@ -2140,6 +2189,8 @@ async function requestSmsCode(store, method, opts) {
     //   7. Unknown error first time → retry once
     let lastReason = null;
     let attemptNum = 1;
+    // The confirmation sheet the app puts up before it will ask for a code.
+    await humanPause('confirm_number');
     while (true) {
       // Rebuilt per attempt so client_metrics carries the current attempt count.
       const extra = getRequestVerificationCodeParameters(store, m, _regMeta, _device, attemptNum);
@@ -2204,6 +2255,9 @@ async function requestSmsCode(store, method, opts) {
       if (attemptNum > MAX_CODE_REQUEST_ATTEMPTS) {
         throw new Error(`Registration error (${m}): giving up after ${MAX_CODE_REQUEST_ATTEMPTS} attempts — raw: ${JSON.stringify(result)}`);
       }
+
+      // Nobody re-taps the button the instant the error lands.
+      await humanPause('retry_code');
     }
   }
 
@@ -2214,6 +2268,8 @@ async function requestSmsCode(store, method, opts) {
   if (result && result._noRoutes && !autoFallbackDone && method !== 'email') {
     autoFallbackDone = true;
     process.stderr.write(`[REG] ${method} returned no_routes — auto-trying ${fallbackMethod}\n`);
+    // Reading the refusal and picking another method off the list.
+    await humanPause('switch_method');
     result = await _tryMethod(fallbackMethod);
   }
 
@@ -2373,3 +2429,6 @@ module.exports._verify = {
   flashCodeFromCallerId, flashCodeLength, codeForSubmission,
   getRequestVerificationCodeParameters
 };
+
+// Pacing internals, exposed for tests. Not part of the public API.
+module.exports._pacing = { pacingEnabled, humanPause, buildClientMetrics, PACING_RANGES_MS };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.29.6",
+  "version": "5.30.0",
   "description": "Node.js library for WhatsApp — register a number over SMS, or link as a companion by QR. Signal E2E encryption, media, groups, channels.",
   "author": "Kunboruto20",
   "main": "index.js",