whalibmob 5.33.28 → 5.33.29

package/lib/Registration.js

@@ -1593,6 +1593,16 @@ function toBase64Url(buf) {
   return buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_');
 }
 
+// The native client encodes the Signal-key and expid wire parameters with
+// Base64.encodeToString(bytes, 11) = URL_SAFE | NO_WRAP | NO_PADDING: authkey
+// (43 chars), e_ident/e_skey_val (43), e_skey_sig (86), e_regid (6), e_keytype,
+// e_skey_id (4), expid (22) — never a trailing '='. The padded form still
+// decodes server-side, but the bare '=' is a wire tell no real device emits.
+// The ENC envelope and the vname certificate keep their own encoder above.
+function toBase64UrlNoPad(buf) {
+  return toBase64Url(buf).replace(/=+$/, '');
+}
+
 // ---------- vname: the Business verified-name certificate ----------
 //
 // A Business registration carries one extra form field, `vname`, and a consumer
@@ -1712,18 +1722,18 @@ async function buildPayload(store, waVersion, useToken, extraPairs, path) {
     'rc',                String(RELEASE_CHANNEL),
     'lg',                meta.lg,
     'lc',                meta.lc,
-    'authkey',           toBase64Url(stripKeyPrefix(store.noiseKeyPair.public)),
+    'authkey',           toBase64UrlNoPad(stripKeyPrefix(store.noiseKeyPair.public)),
     // Business only; buildForm drops a null, so a consumer registration sends
     // the same body it always has.
     'vname',             buildVerifiedNameCertificate(store, device),
-    'e_regid',           toBase64Url(intToBytes(store.registrationId, 4)),
-    'e_keytype',         toBase64Url(Buffer.from([SIGNAL_KEY_TYPE])),
-    'e_ident',           toBase64Url(stripKeyPrefix(store.identityKeyPair.public)),
-    'e_skey_id',         toBase64Url(intToBytes(store.signedPreKey.id, 3)),
-    'e_skey_val',        toBase64Url(stripKeyPrefix(store.signedPreKey.public)),
-    'e_skey_sig',        toBase64Url(store.signedPreKey.signature),
+    'e_regid',           toBase64UrlNoPad(intToBytes(store.registrationId, 4)),
+    'e_keytype',         toBase64UrlNoPad(Buffer.from([SIGNAL_KEY_TYPE])),
+    'e_ident',           toBase64UrlNoPad(stripKeyPrefix(store.identityKeyPair.public)),
+    'e_skey_id',         toBase64UrlNoPad(intToBytes(store.signedPreKey.id, 3)),
+    'e_skey_val',        toBase64UrlNoPad(stripKeyPrefix(store.signedPreKey.public)),
+    'e_skey_sig',        toBase64UrlNoPad(store.signedPreKey.signature),
     'fdid',              fdid,
-    'expid',             toBase64Url(store.deviceId),
+    'expid',             toBase64UrlNoPad(store.deviceId),
     'id',                toUrlHex(store.identityId),
     'access_session_id', getAccessSessionId(store),
     'token',             token,
@@ -1920,7 +1930,7 @@ async function sendFunnelLog(store, waVersion, currentScreen, actionTaken, event
       'in',              national,
       'lg',              'en',
       'lc',              'US',
-      'expid',           toBase64Url(store.deviceId),
+      'expid',           toBase64UrlNoPad(store.deviceId),
       'fdid',            fdid,
       'id',              toUrlHex(store.identityId),
       'current_screen',  currentScreen,
@@ -1952,7 +1962,7 @@ async function sendPrePnFunnelLog(store, waVersion, actionTaken, eventName) {
     const body = buildForm([
       'lg',              'en',
       'lc',              'US',
-      'expid',           toBase64Url(store.deviceId),
+      'expid',           toBase64UrlNoPad(store.deviceId),
       'fdid',            fdid,
       'id',              toUrlHex(store.identityId),
       'current_screen',  'enter_number',

package/lib/Store.js

@@ -82,7 +82,11 @@ function createNewStore(phoneNumber, opts) {
 
   const registrationId = (crypto.randomBytes(2).readUInt16BE(0) & 0x3fff) + 1;
   const fdid           = uuidv4();
-  const deviceId       = crypto.randomBytes(16);
+  // expid goes on the wire as a UUID and WhatsApp reads its version/variant
+  // nibbles (the native client builds it with UUID.nameUUIDFromBytes/randomUUID).
+  // 16 fully random bytes land on a valid UUID shape only ~1 time in 16, so the
+  // server sees a malformed UUID; take the 16 bytes of a real v4 UUID instead.
+  const deviceId       = Buffer.from(uuidv4().replace(/-/g, ''), 'hex');
   const identityId     = crypto.randomBytes(16);
   // Device fingerprint fields the native client sends on /code (see
   // Registration.js): advertising id (UUID) and the 20-byte backup token.
@@ -358,7 +362,8 @@ function fromSixParts(sixParts) {
     },
     registrationId: (crypto.randomBytes(2).readUInt16BE(0) & 0x3fff) + 1,
     fdid:           uuidv4(),
-    deviceId:       crypto.randomBytes(16),
+    // expid must be a valid UUID on the wire — see createNewStore above.
+    deviceId:       Buffer.from(uuidv4().replace(/-/g, ''), 'hex'),
     identityId,
     advertisingId:  uuidv4(),
     backupToken:    crypto.randomBytes(20),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.33.28",
+  "version": "5.33.29",
   "description": "Node.js library for WhatsApp — register a number over SMS, or link as a companion by QR. Signal E2E encryption, media, groups, channels.",
   "author": "Kunboruto20",
   "main": "index.js",