whalibmob 5.33.20 → 5.33.22

package/README.md

@@ -19,7 +19,7 @@ code, and bring the account into being. Both transports, one API.
 
 ### Start here
 
-[![Register a number](https://img.shields.io/badge/Register_a_number-SMS_or_voice-25D366?style=for-the-badge)](#register-a-new-number)
+[![Register a number](https://img.shields.io/badge/Register_a_number-SMS,_voice_or_email-25D366?style=for-the-badge)](#register-a-new-number)
 [![Link an account](https://img.shields.io/badge/Link_an_account-QR_or_pairing_code-128C7E?style=for-the-badge)](#linking-to-an-existing-account-pairing-code-or-qr)
 [![Use the CLI](https://img.shields.io/badge/Use_the_CLI-no_code_needed-075E54?style=for-the-badge)](#cli--getting-started)
 
@@ -439,6 +439,9 @@ wa registration --request-code 919634847671 --method wa_old
 
 # via flash call — WhatsApp rings the number and hangs up (Android only)
 WA_OS=android wa registration --request-code 919634847671 --method flash
+
+# via email — WhatsApp sends a 6-digit code to the email address linked to the number
+wa registration --request-code 919634847671 --method email_otp
 ```
 
 **Flash call** sends no code anywhere. WhatsApp rings the number from a
@@ -471,6 +474,28 @@ Three things to know before choosing it:
 Set `WA_FLASH_CODE_LEN` if a number's server expects a different length than the
 six digits the app defaults to.
 
+**Email OTP** sends a 6-digit verification code to the email address that the
+phone number's WhatsApp account has associated. This method only works when the
+number already has an email linked to its WhatsApp account — if there is no email
+on file, the server returns an error and you should fall back to `sms` or `voice`.
+
+```sh
+# request via email
+wa registration --request-code 919634847671 --method email_otp
+
+# then confirm with the 6-digit code WhatsApp emailed
+wa registration --register 919634847671 --code 123456
+```
+
+Two things to know before choosing it:
+
+- **Email must be linked.** If the number has never had an email associated in
+  WhatsApp Settings → Account → Email address, the server rejects the request.
+  Use `sms` or `voice` instead.
+- **Falls back to SMS.** When `email_otp` fails (no email on file or email
+  delivery issue), whalibmob automatically retries with `sms` so the attempt is
+  not wasted.
+
 **Set the account's display name while registering** with `--name`. This is the
 name people who have *not* saved your number see next to it — in group
 participant lists, in notifications, and beside your messages. Quote it if it

package/cli.js

@@ -673,7 +673,7 @@ const HELP = `
 
   Registration
     /reg check   <phone>                              check if number has WhatsApp
-    /reg code    <phone> [sms|voice|wa_old|flash]     request verification code
+    /reg code    <phone> [sms|voice|wa_old|flash|email_otp]  request verification code
     /reg push    <phone> [sms|voice]                  request code and receive it over push
     /reg confirm <phone> <code>                       complete registration
 
@@ -2400,7 +2400,7 @@ async function handleLine(line) {
           const ph     = normalizePhone(p[2]);
           const method = (p[3] || 'sms').toLowerCase();
           if (!ph) {
-            fail('usage: /reg code <phone> [sms|voice|wa_old|flash] [--name "Your Name"]');
+            fail('usage: /reg code <phone> [sms|voice|wa_old|flash|email_otp] [--name "Your Name"]');
             out('  --name sets the display name the account registers with — what people');
             out('  who have not saved your number see. It can be changed later with /name.');
             break;
@@ -2788,7 +2788,7 @@ options:
   --out <file>      where apk-material writes  (default: <session dir>/android-apk-material.json)
   --sms             connect by registering this number over SMS
   --pair            connect by linking to an existing account (8-digit code)
-  --method          sms | voice | wa_old | flash  (default: sms)
+  --method          sms | voice | wa_old | flash | email_otp  (default: sms)
                     flash: WhatsApp rings the number and hangs up; the code is
                     read from the calling number automatically (Android only)
   --business        register/connect as WhatsApp Business (same as WA_BUSINESS=1)

package/lib/Attestation.js

@@ -55,6 +55,27 @@ const GS_SERVER_KEY = Buffer.from(
 // Base stat codes for the 13 path checks; +1000 when stat() fails.
 const GS_BASE_CODES = [10, 11, 0, 100, 101, 102, 103, 104, 1, 105, 106, 107, 108];
 
+// ─── _ge: environment security flags ─────────────────────────────────────────
+// sb=false (no security bypass), sv=false (not security-verified by TEE).
+// Always false on a headless client — matching a device that passed basic
+// checks but has no hardware-backed verification.
+function generateGeToken() {
+  return encodeURIComponent('{"sb":false,"sv":false}');
+}
+
+// ─── _ga: app analytics envelope ─────────────────────────────────────────────
+// bi = SHA-512 of the session nonce (deterministic per session, unique per
+// device); ap/ai/ae are numeric constants observed across Android builds;
+// mp/mu are multi-profile/multi-user booleans (false on a single-user install).
+function generateGaToken(nonceB64) {
+  const nonceBuf = Buffer.from(
+    (nonceB64 || '').replace(/-/g, '+').replace(/_/g, '/'), 'base64'
+  );
+  const bi = crypto.createHash('sha512').update(nonceBuf).digest('base64');
+  const json = '{"bi":"' + bi + '","ap":247444,"ai":145847,"mp":false,"ae":128383,"mu":false}';
+  return encodeURIComponent(json);
+}
+
 function generateGsToken() {
   const nowMs = Date.now();
   const sec   = Math.floor(nowMs / 1000);
@@ -246,14 +267,16 @@ async function attestationFields(device, nonceB64, opts) {
   if (device && device.os === 'android') {
     const a  = await androidIntegrity(nonceB64 || '', device);
     const gs = generateGsToken();
+    const ge = generateGeToken();
+    const ga = generateGaToken(nonceB64 || '');
     _ok('_gs field generated (WASafe envelope, ' + gs.length + ' encoded chars)');
     return [
       'gpia',       orNull(a.gpia),
       '_gg',        orNull(a.gg),
       '_gi',        orNull(a.gi),
       '_gp',        orNull(a.gp),
-      '_ge',        orNull(a.ge),
-      '_ga',        orNull(a.ga),
+      '_ge',        ge,
+      '_ga',        ga,
       '_gs',        gs,
       'push_token', pushToken
     ];

package/lib/Registration.js

@@ -1389,7 +1389,7 @@ function getRequestVerificationCodeParameters(store, method, meta, device, attem
       'reason',                     '',
       'mcc',                        meta.mcc,
       'mnc',                        meta.mnc,
-      'feo2_query_status',          'client_capabilities_cached',
+      'feo2_query_status',          'success_get_client_capabilities',
       'db',                         '1',
       'sim_type',                   '1',
       'recaptcha',                  '%7B%22stage%22%3A%22ABPROP_DISABLED%22%7D',
@@ -2216,8 +2216,11 @@ async function requestSmsCode(store, method, opts) {
   }
 
   // Auto-fallback: if the primary method gets no_routes, try the alternate once.
-  // sms → wa_old, wa_old → sms, voice → sms.
-  const fallbackMethod = method === 'wa_old' ? 'sms' : (method === 'sms' ? 'wa_old' : 'sms');
+  // sms → wa_old, wa_old → sms, voice → sms, email_otp → sms.
+  const fallbackMethod = method === 'wa_old' ? 'sms'
+    : (method === 'sms'       ? 'wa_old'
+    : (method === 'email_otp' ? 'sms'
+    : 'sms'));
   let autoFallbackDone = false;
 
   // Derive real MCC/MNC from the phone number being registered.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.33.20",
+  "version": "5.33.22",
   "description": "Node.js library for WhatsApp — register a number over SMS, or link as a companion by QR. Signal E2E encryption, media, groups, channels.",
   "author": "Kunboruto20",
   "main": "index.js",