whalibmob 5.33.11 → 5.33.16

package/README.md

@@ -122,6 +122,7 @@ wa registration --request-code 919634847671
 The code, and the per-platform setup:
 
 - **[`frida/android/server.js`](https://github.com/Kunboruto20/whalibmob/blob/main/frida/android/server.js)** — Play Integrity + Keystore attestation · [setup](https://github.com/Kunboruto20/whalibmob/blob/main/frida/android/README.md)
+- **[`frida/android/registration/registration.js`](https://github.com/Kunboruto20/whalibmob/blob/main/frida/android/registration/registration.js)** — hooks `mbedtls_gcm_crypt_and_tag` in `libwhatsapp.so` to print the `/code` and `/register` parameters in plaintext, before they are sealed in the `ENC` envelope · [how to use](https://github.com/Kunboruto20/whalibmob/blob/main/frida/android/registration/README.md)
 - **[`frida/ios/server.js`](https://github.com/Kunboruto20/whalibmob/blob/main/frida/ios/server.js)** — DeviceCheck App Attest · [setup](https://github.com/Kunboruto20/whalibmob/blob/main/frida/ios/README.md)
 - **[`frida/ios/registration/registration.js`](https://github.com/Kunboruto20/whalibmob/blob/main/frida/ios/registration/registration.js)** — prints the registration public key
 - **[`frida/ios/exchange/index.js`](https://github.com/Kunboruto20/whalibmob/blob/main/frida/ios/exchange/index.js)** — hooks `mbedtls_gcm_update` to read the payload
@@ -194,6 +195,7 @@ npm install -g whalibmob
     - [Change About Text](#cli-change-about-text)
     - [Change Profile Picture](#cli-change-profile-picture)
     - [Change Privacy Settings](#cli-change-privacy-settings)
+    - [Account Email (recovery address)](#cli-account-email-recovery-address)
   - [Contact Commands](#contact-commands)
     - [Check Who Has WhatsApp](#check-who-has-whatsapp)
     - [Get Profile Picture URL](#get-profile-picture-url)
@@ -346,6 +348,7 @@ npm install -g whalibmob
     - [Change Display Name](#change-display-name)
     - [Change About Text](#change-about-text)
     - [Change Profile Picture](#change-profile-picture)
+    - [Account Email (recovery address)](#account-email-recovery-address)
   - [Privacy](#privacy)
     - [Block / Unblock User](#block--unblock-user)
     - [Get Block List](#get-block-list)
@@ -957,6 +960,43 @@ Available types: `last_seen` · `profile_picture` · `status` · `online` · `re
 
 Available values: `all` · `contacts` · `contact_blacklist` · `none` · `match_last_seen`
 
+#### CLI Account Email (recovery address)
+
+An account can carry an email address, used to get back in if the number is lost
+or the two-step PIN is forgotten.
+
+> [!NOTE]
+> This is **not** a way to receive the registration code. There is no email
+> delivery at the code-request step — register the number first (`--method sms`,
+> `voice`, `wa_old` or `flash`), connect, and only then bind an email. It works
+> on a **primary** account; a companion (QR/pairing) link cannot use it.
+
+Bind the address, ask for a code, read it from your inbox, submit it, confirm:
+
+```sh
+wa> /email set name@example.com
+  email bound: name@example.com
+  next:  /email request    then  /email verify <code>
+
+wa> /email request
+  code sent — check the inbox, then:  /email verify <code>
+
+wa> /email verify 123456
+  code accepted for name@example.com
+  finishing:  /email confirm
+
+wa> /email confirm
+  email confirmed
+
+wa> /email status
+  email      name@example.com
+  verified   yes
+  confirmed  yes
+```
+
+`/email request` takes an optional language and country (e.g. `/email request pt BR`)
+that only pick which language the email is written in — the code is the same.
+
 ---
 
 ### Contact Commands
@@ -4912,6 +4952,42 @@ await client.changeProfilePicture(buf, { raw: true })
 await client.changeProfilePicture(buf, { size: 640, quality: 50 })
 ```
 
+### Account Email (recovery address)
+
+An account can carry an email address, used to recover access when the number is
+lost or the two-step PIN is forgotten.
+
+> [!NOTE]
+> This is **not** a registration-code channel — there is no email delivery at the
+> `/code` step. Register the number first (SMS, voice, `wa_old` or flash) and
+> connect; the email is bound on the live account and verified with a code the
+> server sends to the inbox. Primary (mobile) sessions only — a companion link is
+> refused.
+
+```js
+// 1. bind the address (not verified yet)
+await client.setEmail('name@example.com')
+
+// 2. ask the server to email a six-digit code
+//    lg/lc only choose the language the email is written in
+await client.requestEmailCode({ lg: 'en', lc: 'US' })
+
+// 3. submit the code the user read from their inbox
+const r = await client.verifyEmailCode('123456')
+// r → { verified: true, autoVerifyFailed: false, email: 'name@example.com' }
+
+// 4. confirm ownership
+await client.confirmEmail()
+
+// read the current binding any time
+const status = await client.getEmailStatus()
+// status → { email: 'name@example.com', verified: true, confirmed: true }
+```
+
+Each call throws with the server's reason when it is refused — `535` the code
+expired, `536` the code is wrong, `537` too many wrong tries, `534` locked out,
+`403` not allowed for this account.
+
 ## Privacy
 
 ### Block / Unblock User

package/cli.js

@@ -585,6 +585,13 @@ const HELP = `
                                                        contact_allowlist none known
                                                        match_last_seen on_standard off
 
+  Account email  (recovery address — bound on the connected account)
+    /email status                            show the email bound to the account
+    /email set     <address>                 bind (or change) the recovery email
+    /email request [lg] [lc]                 send a verification code to that email
+    /email verify  <code>                    submit the six-digit code from the email
+    /email confirm                           confirm ownership after verifying
+
   Contacts
     /whatsapp  <phone...>                    check which numbers have WhatsApp
     /picture   <jid> [file]                  profile picture URL; downloads it when a file is given
@@ -666,8 +673,7 @@ const HELP = `
 
   Registration
     /reg check   <phone>                              check if number has WhatsApp
-    /reg code    <phone> [sms|voice|wa_old]           request verification code
-    /reg code    <phone> email <address>              request code via email
+    /reg code    <phone> [sms|voice|wa_old|flash]     request verification code
     /reg push    <phone> [sms|voice]                  request code and receive it over push
     /reg confirm <phone> <code>                       complete registration
 
@@ -1764,6 +1770,53 @@ async function handleLine(line) {
         break;
       }
 
+      case '/email': {
+        requireConn();
+        const action = (p[1] || '').toLowerCase();
+        if (action === 'status' || action === '') {
+          const st = await _client.getEmailStatus();
+          if (!st.email) { out('  no email bound to this account'); break; }
+          out('  email      ' + st.email);
+          out('  verified   ' + (st.verified ? 'yes' : 'no'));
+          out('  confirmed  ' + (st.confirmed ? 'yes' : 'no'));
+          break;
+        }
+        if (action === 'set') {
+          const addr = p[2];
+          if (!addr) { fail('usage: /email set <address>'); break; }
+          const st = await _client.setEmail(addr, { context: 'settings' });
+          out('  email bound: ' + (st.email || addr));
+          out('  next:  /email request    then  /email verify <code>');
+          break;
+        }
+        if (action === 'request') {
+          const lg = p[2] || 'en';
+          const lc = p[3] || 'US';
+          await _client.requestEmailCode({ lg, lc });
+          out('  code sent — check the inbox, then:  /email verify <code>');
+          break;
+        }
+        if (action === 'verify') {
+          const code = p[2];
+          if (!code) { fail('usage: /email verify <code>'); break; }
+          const r = await _client.verifyEmailCode(code);
+          if (r.verified) {
+            out('  code accepted' + (r.email ? ' for ' + r.email : ''));
+            out('  finishing:  /email confirm');
+          } else {
+            out('  not verified' + (r.autoVerifyFailed ? ' (auto-verify failed — run /email confirm)' : ''));
+          }
+          break;
+        }
+        if (action === 'confirm') {
+          await _client.confirmEmail({ context: 'settings' });
+          out('  email confirmed');
+          break;
+        }
+        fail('usage: /email status|set <address>|request [lg] [lc]|verify <code>|confirm');
+        break;
+      }
+
       // ── contacts ───────────────────────────────────────────────────────────
 
       case '/whatsapp': {
@@ -2346,18 +2399,12 @@ async function handleLine(line) {
         else if (sub === 'code') {
           const ph     = normalizePhone(p[2]);
           const method = (p[3] || 'sms').toLowerCase();
-          // email method: /reg code <phone> email <address>
-          const emailAddr = method === 'email' ? (p[4] || '') : '';
           if (!ph) {
-            fail('usage: /reg code <phone> [sms|voice|wa_old|flash|email <address>] [--name "Your Name"]');
+            fail('usage: /reg code <phone> [sms|voice|wa_old|flash] [--name "Your Name"]');
             out('  --name sets the display name the account registers with — what people');
             out('  who have not saved your number see. It can be changed later with /name.');
             break;
           }
-          if (method === 'email' && !emailAddr) {
-            fail('email method requires an address — usage: /reg code <phone> email <address>');
-            break;
-          }
           sessionDirFor(_sessDir, ph, { create: true });
           const sessFile = storeFileFor(_sessDir, ph);
           let store = loadStore(sessFile);
@@ -2376,10 +2423,8 @@ async function handleLine(line) {
               out('  new keys saved — proceed with code below');
             }
           }
-          const methodLabel = method === 'email' ? ('email → ' + emailAddr) : method;
-          out('requesting ' + methodLabel + ' code for +' + ph + '...');
-          const codeOpts = Object.assign(method === 'email' ? { email: emailAddr } : {},
-            { onProgress: out, name: regName });
+          out('requesting ' + method + ' code for +' + ph + '...');
+          const codeOpts = { onProgress: out, name: regName };
           if (regName) out('  registering as "' + (store.name || regName) + '"');
           const r = await requestSmsCode(store, method, codeOpts);
           store.codePending = true;
@@ -2743,10 +2788,9 @@ options:
   --out <file>      where apk-material writes  (default: <session dir>/android-apk-material.json)
   --sms             connect by registering this number over SMS
   --pair            connect by linking to an existing account (8-digit code)
-  --method          sms | voice | wa_old | flash | email  (default: sms)
+  --method          sms | voice | wa_old | flash  (default: sms)
                     flash: WhatsApp rings the number and hangs up; the code is
                     read from the calling number automatically (Android only)
-  --email <address> email address (required when --method email)
   --business        register/connect as WhatsApp Business (same as WA_BUSINESS=1)
   --all             refresh-version: every session in the session directory
   --version <x>     refresh-version: write this version instead of looking one up
@@ -3088,12 +3132,7 @@ async function main() {
     if (flags['request-code'] !== undefined) {
       const ph        = phone || normalizePhone(pos[0] || '');
       const method    = (flags.method || 'sms').toLowerCase();
-      const emailAddr = flags.email || '';
       if (!ph) { fail('phone number required'); process.exit(1); }
-      if (method === 'email' && !emailAddr) {
-        fail('--method email requires --email <address>');
-        process.exit(1);
-      }
       if (!fs.existsSync(_sessDir)) fs.mkdirSync(_sessDir, { recursive: true });
       // Same file the shell's /reg code writes: a number already filed loose in
       // the base directory stays there, a new one gets a directory of its own.
@@ -3120,11 +3159,9 @@ async function main() {
       }
       // If store.codePending === true, keys were already accepted by WhatsApp in a
       // prior /code request — reuse the exact same store without any /exist call.
-      const methodLabel = method === 'email' ? ('email → ' + emailAddr) : method;
-      out('requesting ' + methodLabel + ' code for +' + ph + '...');
+      out('requesting ' + method + ' code for +' + ph + '...');
       try {
-        const codeOpts = Object.assign(method === 'email' ? { email: emailAddr } : {},
-          { onProgress: out, name: regName });
+        const codeOpts = { onProgress: out, name: regName };
         if (regName) out('  registering as "' + (store.name || regName) + '"');
         const r = await requestSmsCode(store, method, codeOpts);
         store.codePending = true;

package/index.d.ts

@@ -608,6 +608,24 @@ export interface TosNoticesResult {
   notices: Array<{ id: string; accepted: boolean }>;
 }
 
+export interface EmailStatus {
+  /** The bound address, or null when none is set. */
+  email: string | null;
+  /** Whether the address has been verified with a code. */
+  verified: boolean;
+  /** Whether ownership has been confirmed. */
+  confirmed: boolean;
+}
+
+export interface EmailVerifyResult {
+  /** Whether the submitted code was accepted. */
+  verified: boolean;
+  /** The server tried to auto-verify and it failed — finish with confirmEmail(). */
+  autoVerifyFailed: boolean;
+  /** The address the result refers to, when the server echoes it. */
+  email: string | null;
+}
+
 export interface PrivacySettings {
   lastSeen: string | null;
   profile: string | null;
@@ -1012,6 +1030,22 @@ export declare class WhalibmobClient extends EventEmitter {
     }
   ): Promise<ContactSyncResult>;
 
+  // ─── Account email — a recovery address bound on the connected account ─────
+  //
+  // Not a registration-code channel: the address is bound on a number that is
+  // already registered and connected, then verified with a code the server
+  // emails. Primary (mobile) sessions only — a companion link is refused.
+  /** The email currently bound to the account, with its verify/confirm state. */
+  getEmailStatus(): Promise<EmailStatus>;
+  /** Bind (or rebind) an email address. Not verified until requestEmailCode(). */
+  setEmail(email: string, opts?: { context?: 'settings' | 'onboarding' }): Promise<EmailStatus>;
+  /** Ask the server to email a verification code. lg/lc only pick the language. */
+  requestEmailCode(opts?: { lg?: string; lc?: string; language?: string; locale?: string }): Promise<boolean>;
+  /** Submit the six-digit code from the email. */
+  verifyEmailCode(code: string): Promise<EmailVerifyResult>;
+  /** Confirm ownership after a successful verifyEmailCode(). */
+  confirmEmail(opts?: { context?: 'settings' | 'onboarding' }): Promise<boolean>;
+
   // ─── Terms-of-Service notices ────────────────────────────────────────────
   //
   // `isTosAccepted` answers `null` for a notice this session has not asked

package/lib/Client.js

@@ -7036,6 +7036,196 @@ class WhalibmobClient extends EventEmitter {
     return out;
   }
 
+  // ─── Email on the account — bind a recovery address and verify it ──────────
+  //
+  // An account can carry an email address, used to get back in when the number
+  // is lost or a two-step PIN is forgotten. It is not a way to receive the
+  // registration code: there is no email delivery at the /code stage — the
+  // address is bound on an account that is already registered and connected,
+  // and verified with a code the server sends to the inbox.
+  //
+  // The whole exchange is <iq xmlns="urn:xmpp:whatsapp:account"> over the live
+  // connection, never the HTTP /code path, and the server only answers it for a
+  // primary (mobile) session. A companion (web) link is refused outright, so
+  // the mode is checked here rather than left to surface as a bare 403.
+  //
+  //   status   <iq type="get"><email/></iq>
+  //   bind     <iq type="set"><email><email_address>a@b.c</email_address></email></iq>
+  //   request  <iq type="set"><verify_email><lg>en</lg><lc>US</lc></verify_email></iq>
+  //   verify   <iq type="set"><verify_email><code>123456</code></verify_email></iq>
+  //   confirm  <iq type="set"><confirm_email/></iq>
+
+  _assertEmailChannel(what) {
+    if (!this._connected) throw new Error(what + ': Not connected');
+    if (this._mode === 'web') {
+      throw new Error(what + ': the account email is a primary-account feature — ' +
+        'a companion (web) link cannot bind or verify it');
+    }
+  }
+
+  // Turn one of the server's numeric email error codes into words, so a 536
+  // reads as "wrong code" rather than a bare number the caller has to look up.
+  _emailError(what, resp) {
+    const errNode = findChild(resp, 'error');
+    const code    = errNode && errNode.attrs && errNode.attrs.code
+      ? String(errNode.attrs.code) : '';
+    const text = {
+      '403': 'not allowed for this account',
+      '534': 'locked out — too many attempts, try again later',
+      '535': 'the code has expired — request a new one',
+      '536': 'the code is incorrect',
+      '537': 'too many wrong codes — request a new one'
+    }[code];
+    return new Error(what + ': server rejected the request' +
+      (code ? ' (' + code + (text ? ' — ' + text : '') + ')' : ''));
+  }
+
+  _parseEmailStatus(resp) {
+    const emailNode = findChild(resp, 'email');
+    if (!emailNode) return { email: null, verified: false, confirmed: false };
+    const addr = findChild(emailNode, 'email_address');
+    const conf = findChild(emailNode, 'confirmed');
+    const addrBuf = addr ? getNodeContent(addr) : null;
+    const confBuf = conf ? getNodeContent(conf) : null;
+    return {
+      email:     addrBuf ? addrBuf.toString('utf8') : null,
+      verified:  !!(emailNode.attrs && emailNode.attrs.verified === 'true'),
+      confirmed: confBuf ? confBuf.toString('utf8') === 'true' : false
+    };
+  }
+
+  /**
+   * Read the email currently bound to the account.
+   * @returns {Promise<{email: string|null, verified: boolean, confirmed: boolean}>}
+   */
+  async getEmailStatus() {
+    this._assertEmailChannel('getEmailStatus');
+    const resp = await this._sendIq(new BinaryNode('iq', {
+      id:    this._genMsgId(),
+      to:    's.whatsapp.net',
+      type:  'get',
+      xmlns: 'urn:xmpp:whatsapp:account'
+    }, [new BinaryNode('email', {}, null)]));
+    if (!resp) throw new Error('getEmailStatus: no reply from server (IQ timed out)');
+    if (resp.attrs && resp.attrs.type === 'error') throw this._emailError('getEmailStatus', resp);
+    return this._parseEmailStatus(resp);
+  }
+
+  /**
+   * Bind (or rebind) an email address to the account. The address is not
+   * verified by this call — request a code with requestEmailCode() next.
+   * @param   {string} email
+   * @param   {object} [opts]  { context?: 'settings' | 'onboarding' }
+   * @returns {Promise<{email: string|null, verified: boolean, confirmed: boolean}>}
+   */
+  async setEmail(email, opts) {
+    this._assertEmailChannel('setEmail');
+    opts = opts || {};
+    const addr = String(email == null ? '' : email).trim();
+    if (!addr || addr.length > 320) {
+      throw new Error('setEmail: email must be between 1 and 320 characters');
+    }
+    const emailChildren = [];
+    if (opts.context) {
+      emailChildren.push(new BinaryNode('context', {}, Buffer.from(String(opts.context), 'utf8')));
+    }
+    emailChildren.push(new BinaryNode('email_address', {}, Buffer.from(addr, 'utf8')));
+    const resp = await this._sendIq(new BinaryNode('iq', {
+      id:    this._genMsgId(),
+      to:    's.whatsapp.net',
+      type:  'set',
+      xmlns: 'urn:xmpp:whatsapp:account'
+    }, [new BinaryNode('email', {}, emailChildren)]));
+    if (!resp) throw new Error('setEmail: no reply from server (IQ timed out)');
+    if (resp.attrs && resp.attrs.type === 'error') throw this._emailError('setEmail', resp);
+    return this._parseEmailStatus(resp);
+  }
+
+  /**
+   * Ask the server to send a verification code to the bound address.
+   * @param   {object} [opts]  { lg?: language (2-3 chars), lc?: country (2-3 chars) }
+   *                           Defaults to en/US. These only pick the language the
+   *                           email is written in; the code itself is the same.
+   * @returns {Promise<boolean>}  true once the server accepts the request.
+   */
+  async requestEmailCode(opts) {
+    this._assertEmailChannel('requestEmailCode');
+    opts = opts || {};
+    const lg = String(opts.lg || opts.language || 'en');
+    const lc = String(opts.lc || opts.locale  || 'US');
+    for (const [name, val] of [['lg', lg], ['lc', lc]]) {
+      if (val.length < 2 || val.length > 3) {
+        throw new Error('requestEmailCode: ' + name + ' must be 2-3 characters');
+      }
+    }
+    const resp = await this._sendIq(new BinaryNode('iq', {
+      id:    this._genMsgId(),
+      to:    's.whatsapp.net',
+      type:  'set',
+      xmlns: 'urn:xmpp:whatsapp:account'
+    }, [new BinaryNode('verify_email', {}, [
+      new BinaryNode('lg', {}, Buffer.from(lg, 'utf8')),
+      new BinaryNode('lc', {}, Buffer.from(lc, 'utf8'))
+    ])]));
+    if (!resp) throw new Error('requestEmailCode: no reply from server (IQ timed out)');
+    if (resp.attrs && resp.attrs.type === 'error') throw this._emailError('requestEmailCode', resp);
+    return true;
+  }
+
+  /**
+   * Submit the six-digit code the server emailed.
+   * @param   {string} code  exactly six digits (separators are stripped)
+   * @returns {Promise<{verified: boolean, autoVerifyFailed: boolean, email: string|null}>}
+   */
+  async verifyEmailCode(code) {
+    this._assertEmailChannel('verifyEmailCode');
+    const digits = String(code == null ? '' : code).replace(/\D/g, '');
+    if (digits.length !== 6) throw new Error('verifyEmailCode: code must be exactly 6 digits');
+    const resp = await this._sendIq(new BinaryNode('iq', {
+      id:    this._genMsgId(),
+      to:    's.whatsapp.net',
+      type:  'set',
+      xmlns: 'urn:xmpp:whatsapp:account'
+    }, [new BinaryNode('verify_email', {}, [
+      new BinaryNode('code', {}, Buffer.from(digits, 'utf8'))
+    ])]));
+    if (!resp) throw new Error('verifyEmailCode: no reply from server (IQ timed out)');
+    if (resp.attrs && resp.attrs.type === 'error') throw this._emailError('verifyEmailCode', resp);
+    const emailNode = findChild(resp, 'email');
+    if (!emailNode) return { verified: false, autoVerifyFailed: false, email: null };
+    const auto = findChild(emailNode, 'auto_verify');
+    const addr = findChild(emailNode, 'email_address');
+    const autoBuf = auto ? getNodeContent(auto) : null;
+    const addrBuf = addr ? getNodeContent(addr) : null;
+    return {
+      verified:         !!(emailNode.attrs && emailNode.attrs.do_verify === 'true'),
+      autoVerifyFailed: autoBuf ? autoBuf.toString('utf8') === 'fail' : false,
+      email:            addrBuf ? addrBuf.toString('utf8') : null
+    };
+  }
+
+  /**
+   * Confirm email ownership — the handshake after a successful verifyEmailCode().
+   * @param   {object} [opts]  { context?: 'settings' | 'onboarding' }
+   * @returns {Promise<boolean>}  true once the server accepts it.
+   */
+  async confirmEmail(opts) {
+    this._assertEmailChannel('confirmEmail');
+    opts = opts || {};
+    const children = opts.context
+      ? [new BinaryNode('context', {}, Buffer.from(String(opts.context), 'utf8'))]
+      : null;
+    const resp = await this._sendIq(new BinaryNode('iq', {
+      id:    this._genMsgId(),
+      to:    's.whatsapp.net',
+      type:  'set',
+      xmlns: 'urn:xmpp:whatsapp:account'
+    }, [new BinaryNode('confirm_email', {}, children)]));
+    if (!resp) throw new Error('confirmEmail: no reply from server (IQ timed out)');
+    if (resp.attrs && resp.attrs.type === 'error') throw this._emailError('confirmEmail', resp);
+    return true;
+  }
+
   // ─── Terms-of-Service notices ─────────────────────────────────────────────
   //
   // WhatsApp gates some surfaces on the account having accepted a given legal

package/lib/Registration.js

@@ -2192,16 +2192,6 @@ async function requestSmsCode(store, method, opts) {
   store.version = waVersion;
   store.device  = _device;
 
-  // The email OTP carries the address alongside the usual parameters. It goes
-  // through the same request path as every other method rather than around it:
-  // it used to have its own branch, which meant a rate-limited email request
-  // reported no wait, a block screen was reported as a raw reason, and none of
-  // the funnel events the other methods emit were sent.
-  const emailAddr = method === 'email' ? (opts.email || '') : '';
-  if (method === 'email' && !emailAddr) {
-    throw new Error('requestSmsCode: email method requires opts.email address');
-  }
-
   // Flash exists on Android and nowhere else. iOS has no public way to read an
   // incoming call's number, so the platform never offers the method and asking
   // for it as iOS is answered with an ordinary SMS at best. Refusing here costs
@@ -2217,8 +2207,7 @@ async function requestSmsCode(store, method, opts) {
   }
 
   // Auto-fallback: if the primary method gets no_routes, try the alternate once.
-  // sms → wa_old, wa_old → sms, voice → sms. Never for email: falling back
-  // would send an SMS to somebody who asked for an email.
+  // sms → wa_old, wa_old → sms, voice → sms.
   const fallbackMethod = method === 'wa_old' ? 'sms' : (method === 'sms' ? 'wa_old' : 'sms');
   let autoFallbackDone = false;
 
@@ -2242,7 +2231,6 @@ async function requestSmsCode(store, method, opts) {
     while (true) {
       // Rebuilt per attempt so client_metrics carries the current attempt count.
       const extra = getRequestVerificationCodeParameters(store, m, _regMeta, _device, attemptNum);
-      if (m === 'email') extra.push('email', emailAddr);
 
       // The screen a later event belongs to is named after the method asked
       // for here, so record it before the request rather than after.
@@ -2334,7 +2322,7 @@ async function requestSmsCode(store, method, opts) {
   let result = await _tryMethod(method);
 
   // Auto-fallback on no_routes
-  if (result && result._noRoutes && !autoFallbackDone && method !== 'email') {
+  if (result && result._noRoutes && !autoFallbackDone) {
     autoFallbackDone = true;
     process.stderr.write(`[REG] ${method} returned no_routes — auto-trying ${fallbackMethod}\n`);
     // Reading the refusal and picking another method off the list.

package/lib/constants.js

@@ -1,5 +1,5 @@
 'use strict';
-
+//
 const WHATSAPP_HOST = 'g.whatsapp.net';
 const WHATSAPP_PORT = 443;
 const REGISTRATION_ENDPOINT = 'https://v.whatsapp.net/v2';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.33.11",
+  "version": "5.33.16",
   "description": "Node.js library for WhatsApp — register a number over SMS, or link as a companion by QR. Signal E2E encryption, media, groups, channels.",
   "author": "Kunboruto20",
   "main": "index.js",