whalibmob 5.33.6 → 5.33.8

package/README.md

@@ -39,7 +39,7 @@ code, and bring the account into being. Both transports, one API.
 
 ### 💬 Need help? Talk to me on Telegram
 
-[![whalibmob channel](https://img.shields.io/badge/whalibmob_channel-News_%26_updates-229ED9?style=for-the-badge&logo=telegram&logoColor=white)](https://t.me/+sHN4MDCyB7U5OWY0)
+[![whalibmob channel](https://img.shields.io/badge/whalibmob_channel-News_%26_updates-229ED9?style=for-the-badge&logo=telegram&logoColor=white)](https://t.me/whalibmob)
 
 [![Contact me on Telegram](https://img.shields.io/badge/Contact_me-%40brtyu545-229ED9?style=for-the-badge&logo=telegram&logoColor=white)](https://t.me/brtyu545)
 

package/cli.js

@@ -496,10 +496,13 @@ function normalizePhone(s) {
 // describe a call that is never coming.
 function printCodeNextSteps(store, phone, confirmCmd) {
   if (store && store.codeMethod === 'flash') {
+    const cc      = store.flashCliCc ? ' (from +' + store.flashCliCc + ')' : '';
+    const timeout = Number(store.flashTimeout) > 0 ? Number(store.flashTimeout) : null;
     out('  a call will ring +' + phone + ' and hang up by itself — do not answer it');
-    out('  the code is the LAST 6 DIGITS of the number that called');
-    out('  pasting the whole number works too — only its last 6 digits are sent');
-    out('  run: ' + confirmCmd + ' <last-6-digits>');
+    out('  it comes from a foreign number' + cc + ' — paste that WHOLE number here');
+    out('  whalibmob reads the code out of it for you (no need to pick out digits)');
+    if (timeout) out('  ⚠ be quick — the flash code expires about ' + timeout + 's after the call');
+    out('  run: ' + confirmCmd + ' <number-that-called>');
     return;
   }
   out('  important: enter the code within 10 minutes');
@@ -2742,7 +2745,7 @@ options:
   --pair            connect by linking to an existing account (8-digit code)
   --method          sms | voice | wa_old | flash | email  (default: sms)
                     flash: WhatsApp rings the number and hangs up; the code is
-                    the last 6 digits of the calling number (Android only)
+                    read from the calling number automatically (Android only)
   --email <address> email address (required when --method email)
   --business        register/connect as WhatsApp Business (same as WA_BUSINESS=1)
   --all             refresh-version: every session in the session directory

package/lib/Client.js

@@ -1904,8 +1904,8 @@ class WhalibmobClient extends EventEmitter {
       // the bit means naming that moment back. A <clean> without it does not
       // acknowledge anything in particular, so the server keeps announcing the
       // same change on every connection from now on — which is what it did:
-      // the timestamp was on the wire and never read off it. whatsmeow's
-      // MarkNotDirty takes it as an argument for exactly this reason.
+      // the timestamp was on the wire and never read off it. The reference
+      // client's mark-not-dirty takes it as an argument for exactly this reason.
       dirtyTypes.push({
         type:      String(attrs.type),
         timestamp: attrs.timestamp ? String(attrs.timestamp) : null
@@ -1940,8 +1940,8 @@ class WhalibmobClient extends EventEmitter {
    * The timestamp is half of that acknowledgement: it says *which* change is
    * being cleared. Every `<clean>` this sent went out without one, because the
    * attribute was never read off the `<dirty>` that carried it — so nothing was
-   * acknowledged in particular and the server kept announcing. whatsmeow's
-   * MarkNotDirty takes it as an argument for the same reason.
+   * acknowledged in particular and the server kept announcing. The reference
+   * client's mark-not-dirty takes it as an argument for the same reason.
    *
    * @param {string} type            the dirty type, e.g. 'groups'
    * @param {number|string} [fromTs] the timestamp the announcement carried
@@ -2135,8 +2135,8 @@ class WhalibmobClient extends EventEmitter {
    * chat message to yourself.
    *
    * Asking twice for the same key inside a day achieves nothing, so each id is
-   * remembered and held down for that long. This is what whatsmeow does with
-   * `requestAppStateKeys`, and for the same reason.
+   * remembered and held down for that long. This is what the reference client
+   * does when it requests app-state keys, and for the same reason.
    *
    * @param {string[]} keyIds  base64 (or hex) key ids, as the decoder reports
    * @returns {Promise<string|null>} the id of the message that carried it
@@ -2910,9 +2910,9 @@ class WhalibmobClient extends EventEmitter {
   // ever holds one. A primary (an SMS session) has no salt on file and sends no
   // cstoken, which is what the real primary does until it has minted its own.
   //
-  // This mirrors whatsmeow's generateCsToken line for line: a regular user, not
-  // the PSA account and not a bot; the recipient resolved to a LID; the HMAC
-  // taken over that LID's bare `user@lid` string.
+  // This mirrors the reference client's cstoken generation line for line: a
+  // regular user, not the PSA account and not a bot; the recipient resolved to
+  // a LID; the HMAC taken over that LID's bare `user@lid` string.
 
   /** The stored NCT salt as bytes, or null when this session has none. */
   _nctSalt() {
@@ -2927,7 +2927,8 @@ class WhalibmobClient extends EventEmitter {
    *
    * A JID already on the LID server is used as-is; a phone JID is resolved
    * through the same PN→LID map every send uses. Device and agent parts are
-   * dropped — the token is taken over the non-AD address, as whatsmeow does.
+   * dropped — the token is taken over the non-AD address, as the reference
+   * client does.
    */
   _bareLidFor(jid) {
     if (!jid) return null;
@@ -4077,7 +4078,7 @@ class WhalibmobClient extends EventEmitter {
    * someone linking a laptop and a tablet in the same sitting produced two
    * children, two hashes, and the whole thing was thrown away — cache dropped,
    * full usync round-trip on the next send. Steps are now kept separately and
-   * applied one at a time, the way whatsmeow's handleDeviceNotification does.
+   * applied one at a time.
    *
    * Children are `add`, `remove`, or `update`. `update` does not name what it
    * changed, so it survives as a step that tells the applier to drop the cache
@@ -4357,7 +4358,7 @@ class WhalibmobClient extends EventEmitter {
 
   // The acknowledgement a server push gets, whatever tag it came in on.
   //
-  // Mirrors the one whatsmeow sends: the stanza's own tag as the class, its id,
+  // Mirrors the one the reference client sends: the stanza's own tag as the class, its id,
   // and back to whoever sent it, carrying `participant` and `recipient` through
   // when the stanza named them. `type` rides along for everything but a message,
   // where it means something else entirely.
@@ -6335,7 +6336,7 @@ class WhalibmobClient extends EventEmitter {
    * directPath, its own mediaKey, its own digests — carried beside the text
    * rather than inside it, and encrypted under a key name of its own. So
    * `downloadMedia` cannot fetch it: that reads the message's own media, and a
-   * text message has none. This is whatsmeow's DownloadThumbnail.
+   * text message has none. This is the reference client's thumbnail download.
    *
    * The small inline preview is a different thing and needs no download: it is
    * already on the decoded message as `jpegThumbnail`.
@@ -7391,7 +7392,7 @@ class WhalibmobClient extends EventEmitter {
    *
    * Both JIDs are taken without their device: a vote belongs to an account.
    *
-   * This is whatsmeow's DecryptPollVote. Nothing here could read a vote before:
+   * This is the reference client's poll-vote decryption. Nothing here could read a vote before:
    * `sendPoll` handed back the key and left the rest to the caller.
    *
    * @param {object} vote            the `message` event payload, or its `decoded`

package/lib/DeviceManager.js

@@ -1211,14 +1211,12 @@ class DeviceManager {
    * notification as a whole. A contact linking two devices in one sitting sends
    * two children with two different hashes, and reading them as one change with
    * one hash — which is what this did — meant the notification could never
-   * verify and the cache was dropped every time. Stepping through them the way
-   * whatsmeow's handleDeviceNotification does keeps the cache across exactly
-   * the case that used to defeat it.
+   * verify and the cache was dropped every time. Stepping through them one at a
+   * time keeps the cache across exactly the case that used to defeat it.
    *
    * A step that fails to verify drops the cache but not the running list, so a
-   * later step whose hash does match puts a proven list back — the same
-   * recovery whatsmeow gets from mutating its local copy after deleting the
-   * cached one.
+   * later step whose hash does match puts a proven list back — the recovery
+   * that comes from mutating the local copy after deleting the cached one.
    *
    * @param   {object} opts
    * @param   {string} opts.priKey     the cache entry: digits, or 'lid:<user>'
@@ -1259,7 +1257,7 @@ class DeviceManager {
 
       // `update` does not say what changed. The list on file cannot be trusted
       // and cannot be repaired, so it goes — and the remaining steps still get
-      // their turn, as they do in whatsmeow.
+      // their turn.
       if (step.tag === 'update') {
         this._dcDel([priKey]);
         out.primaryOk = false;

package/lib/MediaService.js

@@ -266,8 +266,8 @@ function _digestMismatch(actual, expected, what) {
  * The MAC is the guarantee — its key comes from the mediaKey, which only the
  * sender and the recipients hold — and it was always checked. The two digests
  * were not: fileEncSha256 only when the caller asked for it, and fileSha256
- * never at all, though it was written on every upload. whatsmeow checks both on
- * every download (ErrInvalidMediaSHA256), and now so does this.
+ * never at all, though it was written on every upload. Both are meant to be
+ * checked on every download, and now so does this.
  *
  * They tell failures apart, too. A truncated or substituted download is caught
  * before any work is spent decrypting it, and a plaintext that decrypts but is

package/lib/PushClient.js

@@ -1,5 +1,5 @@
 'use strict';
-
+//push here
 // ─── Push clients ─────────────────────────────────────────────────────────────
 //
 // Every real WhatsApp install can be woken by the server, and which line it is

package/lib/Registration.js

@@ -1,5 +1,5 @@
 'use strict';
-
+//registration tool
 const crypto = require('crypto');
 const https  = require('https');
 const tls    = require('tls');
@@ -1838,13 +1838,50 @@ function flashCodeLength() {
   return raw > 0 ? raw : FLASH_CODE_LENGTH;
 }
 
-function flashCodeFromCallerId(input, len) {
+// The server's own rule for pulling the code out of the number that rang.
+//
+// The /code reply for a flash call carries cli_filter — a regex such as
+// "(.*)373(.*)" — alongside cli_prefix and the code length. The code is the
+// part the filter isolates after the prefix: for a caller id "393739799312"
+// the filter's trailing group is "9799312", and the code is its last `length`
+// digits. Applying this is the whole fix for a flash "mismatch" on a correctly
+// read number — the national part of an Italian +39 373 XXXXXXX caller id has
+// more digits after the prefix than the six-digit code, so the old assumption
+// that the code was simply the last six digits took the wrong slice.
+//
+// Returns null when there is no filter, it does not compile, or it does not
+// match, so the caller can fall back to the plain last-`length` behaviour.
+function applyFlashFilter(digits, filter) {
+  if (!filter) return null;
+  let re;
+  try { re = new RegExp(String(filter)); } catch (_) { return null; }
+  const m = re.exec(digits);
+  if (!m) return null;
+  // The code follows the prefix, so it is the last capture group that has any
+  // digits in it; earlier groups hold the country code and prefix.
+  for (let i = m.length - 1; i >= 1; i--) {
+    const g = m[i] && m[i].replace(/\D/g, '');
+    if (g) return g;
+  }
+  return null;
+}
+
+// `opts` may be a bare length (the historical signature) or
+// { length, filter }. The filter, when it matches, decides which digits are the
+// code; the length then trims them. Without a filter this is the old behaviour:
+// the last `length` digits of whatever was typed.
+function flashCodeFromCallerId(input, opts) {
   const digits = normalizeCodeResult(input);
-  const want   = len > 0 ? len : flashCodeLength();
+  const o      = (opts && typeof opts === 'object') ? opts : { length: opts };
+  const want   = Number(o.length) > 0 ? Number(o.length) : flashCodeLength();
+
+  const filtered = applyFlashFilter(digits, o.filter);
+  const base     = (filtered && filtered.length) ? filtered : digits;
+
   // Shorter than the code means the caller already typed just the tail (or the
   // handset showed a short number); there is nothing to trim and guessing would
   // only corrupt it.
-  return digits.length > want ? digits.slice(-want) : digits;
+  return base.length > want ? base.slice(-want) : base;
 }
 
 // The digits /register is given, for whichever method the pending code came by.
@@ -1859,9 +1896,20 @@ function codeForSubmission(store, code, opts) {
   const pending = String(
     (opts && opts.method) || (store && store.codeMethod) || ''
   ).toLowerCase();
-  return pending === 'flash'
-    ? flashCodeFromCallerId(code)
-    : normalizeCodeResult(code);
+  if (pending !== 'flash') return normalizeCodeResult(code);
+
+  // Length: an explicit WA_FLASH_CODE_LEN / opts.flashCodeLen wins, else the
+  // length the server named in its /code reply (captured as store.flashCodeLength),
+  // else the six-digit default inside flashCodeFromCallerId.
+  const envLen = parseInt(process.env.WA_FLASH_CODE_LEN, 10);
+  const length = envLen > 0 ? envLen
+               : (opts && Number(opts.flashCodeLen) > 0 ? Number(opts.flashCodeLen)
+               : (store && Number(store.flashCodeLength) > 0 ? Number(store.flashCodeLength) : 0));
+  // Filter: the server's cli_filter from the /code reply, isolating the code
+  // after the prefix. opts.flashFilter lets a caller state it outright.
+  const filter = (opts && opts.flashFilter) || (store && store.flashCliFilter) || null;
+
+  return flashCodeFromCallerId(code, { length, filter });
 }
 
 // Take the digits the server filed the account under. Brazilian mobiles are the
@@ -2214,6 +2262,27 @@ async function requestSmsCode(store, method, opts) {
         // The confirmation step is usually a separate command, so this is
         // written to the session rather than kept in memory.
         store.codeMethod = m;
+
+        // A flash /code reply states exactly how to read the code out of the
+        // number that will ring: cli_filter is a regex isolating the code after
+        // cli_prefix, and `length` is how many digits it is. Confirmation is
+        // usually a separate command, so these are written to the session for
+        // codeForSubmission to use rather than kept in memory. flash_timeout is
+        // the window the call is valid for, carried so the CLI can warn.
+        if (m === 'flash') {
+          const srvLen = Number(result.length);
+          store.flashCliFilter  = result.cli_filter || null;
+          store.flashCliPrefix  = result.cli_prefix || null;
+          store.flashCliCc      = result.cli_cc     || null;
+          store.flashCodeLength = srvLen > 0 ? srvLen : null;
+          store.flashTimeout    = Number(result.flash_timeout) > 0 ? Number(result.flash_timeout) : null;
+          _whaDbg('[DBG] REG ← /code flash cli: cc=' + (result.cli_cc || '?')
+            + ' prefix=' + (result.cli_prefix || '?')
+            + ' filter=' + (result.cli_filter || '?')
+            + ' length=' + (srvLen > 0 ? srvLen : '?')
+            + ' timeout=' + (result.flash_timeout || '?') + 's');
+        }
+
         await sendFunnelLog(store, waVersion, verifyScreen, 'request_code', 'request_code_success');
         return result;
       }
@@ -2426,7 +2495,7 @@ module.exports._token = { computeToken, androidMaterialPath, registrationHeaders
 module.exports._verify = {
   hasChallenge, is2FARequired, decodeOrNull, isSuccessful,
   normalizeCodeResult, currentVerifyScreen, adoptCanonicalNumber, funnelEnabled, waitHint,
-  flashCodeFromCallerId, flashCodeLength, codeForSubmission,
+  flashCodeFromCallerId, flashCodeLength, applyFlashFilter, codeForSubmission,
   getRequestVerificationCodeParameters
 };
 

package/lib/WAM/BinaryInfo.js

@@ -2,9 +2,9 @@
 
 // What an outgoing WAM buffer is assembled from.
 //
-// Identical to Baileys' BinaryInfo: a protocol version, a sequence number that
-// the server uses to order buffers, the events queued for the next flush, and
-// the scratch list the encoder fills with byte chunks.
+// A protocol version, a sequence number that the server uses to order buffers,
+// the events queued for the next flush, and the scratch list the encoder fills
+// with byte chunks.
 
 class BinaryInfo {
     constructor(options = {}) {

package/lib/WAM/constants.js

@@ -2,10 +2,10 @@
 
 // The WAM event and global tables, exactly as the reference client defines them.
 //
-// Ported verbatim from Baileys' WAM/constants.js — every event id, every field
-// id and every type, unchanged. This is a generated table scraped from
-// WhatsApp Web itself, not something to hand-edit: an id that drifts from what
-// the server expects makes the whole buffer unparseable on the other side.
+// Every event id, every field id and every type is taken unchanged from
+// WhatsApp Web itself — a generated table scraped from the client, not
+// something to hand-edit: an id that drifts from what the server expects makes
+// the whole buffer unparseable on the other side.
 //
 // WEB_EVENTS   one entry per event: { name, id, props: { field: [id, type] },
 //              wamChannel, weight }

package/lib/WAM/encode.js

@@ -1,6 +1,6 @@
 'use strict';
 
-// The WAM binary encoder, ported line for line from Baileys' WAM/encode.js.
+// The WAM binary encoder.
 //
 // A buffer is a 'WAM' magic header, then a run of length-prefixed values whose
 // flags say whether each one is a global attribute, an event, or a field of the

package/lib/playstore-device.js

@@ -1,5 +1,5 @@
 // Aurora-style device profile posted to the anonymous token dispenser.
-// Copied verbatim from Cobalt's sdk-gphone64-x86_64.json — the dispenser
+// Describes an emulator-class device (sdk-gphone64-x86_64) — the dispenser
 // mints an account shaped for this device, and the Play catalogue decides
 // what it is allowed to download from it.
 

package/lib/proto/MessageProto.js

@@ -360,8 +360,7 @@ function encodeMessage(type, payload) {
 // message is buried inside a DeviceSentMessage the copy inside it is a level
 // too deep for anything that does not know to go looking. A poll echoed to our
 // own devices reached them without a message secret, so none of them could ever
-// decrypt a vote on it. whatsmeow (`MessageContextInfo: message.MessageContextInfo`
-// in marshalMessage) and Baileys both duplicate it for the same reason.
+// decrypt a vote on it. The reference clients duplicate it for the same reason.
 //
 // phash is left unset, as it is by every other implementation: it describes the
 // participant list, the server checks that against the hash on the stanza, and
@@ -770,7 +769,8 @@ function decodeMessageContainer(buf, depth) {
         // own JID and names nothing: the conversation it belongs to is only ever
         // written here, in the envelope. It was being opened and thrown away, so
         // a message sent from the phone arrived with no way to tell which chat
-        // it was in. whatsmeow keeps the same two fields as Info.DeviceSentMeta.
+        // it was in. The reference client keeps the same two fields on its
+        // device-sent metadata.
         if (w.field === 31) {
           try {
             const env  = _decodeFields(f[31]);

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "whalibmob",
-  "version": "5.33.6",
+  "version": "5.33.8",
   "description": "Node.js library for WhatsApp — register a number over SMS, or link as a companion by QR. Signal E2E encryption, media, groups, channels.",
   "author": "Kunboruto20",
   "main": "index.js",
   "types": "index.d.ts",
   "bin": {
-    "wa": "cli.js"
+    "wa": "./cli.js"
   },
   "files": [
     "index.js",