zapo-js 0.1.2 → 0.3.0

package/dist/auth/WaAuthClient.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WaAuthClient = void 0;
-const WaAuthCredentialsFlow_1 = require("./flow/WaAuthCredentialsFlow");
+const credentials_flow_1 = require("./credentials-flow");
 const WaPairingFlow_1 = require("./pairing/WaPairingFlow");
 const WaQrFlow_1 = require("./pairing/WaQrFlow");
 const constants_1 = require("../protocol/constants");
@@ -27,6 +27,7 @@ class WaAuthClient {
         this.callbacks = deps.callbacks ?? {};
         this.authStore = deps.authStore;
         this.signalStore = deps.signalStore;
+        this.preKeyStore = deps.preKeyStore;
         this.credentials = null;
         this.qrFlow = new WaQrFlow_1.WaQrFlow({
             logger: this.logger,
@@ -47,13 +48,14 @@ class WaAuthClient {
                 emitPairingCode: (code) => this.callbacks.onPairingCode?.(code),
                 emitPairingRefresh: (forceManual) => this.callbacks.onPairingRefresh?.(forceManual),
                 emitPaired: (credentials) => this.callbacks.onPaired?.(credentials)
-            }
+            },
+            dangerous: options.dangerous
         });
     }
     getState(connected = false) {
         return {
             connected,
-            registered: hasMeJid(this.credentials),
+            registered: this.credentials?.meJid !== null && this.credentials?.meJid !== undefined,
             hasQr: this.qrFlow.hasQr(),
             hasPairingCode: this.pairingFlow.hasPairingSession()
         };
@@ -64,23 +66,30 @@ class WaAuthClient {
     async loadOrCreateCredentials() {
         return this.runHandled(async () => {
             this.logger.debug('auth client loadOrCreateCredentials start');
-            this.credentials = await (0, WaAuthCredentialsFlow_1.loadOrCreateCredentials)({
+            this.credentials = await (0, credentials_flow_1.loadOrCreateCredentials)({
                 logger: this.logger,
                 authStore: this.authStore,
-                signalStore: this.signalStore
+                signalStore: this.signalStore,
+                preKeyStore: this.preKeyStore,
+                skipSignedPreKeySignatureVerification: this.options.dangerous?.disableSignedPreKeySignatureVerification
             });
             this.logger.info('auth client credentials ready', {
-                registered: hasMeJid(this.credentials)
+                registered: this.credentials?.meJid !== null && this.credentials?.meJid !== undefined
             });
             return this.credentials;
         });
     }
-    buildCommsConfig(socketOptions) {
+    buildCommsConfig(socketOptions, overrides = {}) {
         this.logger.trace('auth client building comms config');
-        return (0, WaAuthCredentialsFlow_1.buildCommsConfig)(this.logger, this.requireCredentials(), socketOptions, {
+        return (0, credentials_flow_1.buildCommsConfig)(this.logger, this.requireCredentials(), socketOptions, {
             deviceBrowser: this.options.deviceBrowser,
             deviceOsDisplayName: this.options.deviceOsDisplayName,
-            requireFullSync: this.options.requireFullSync
+            requireFullSync: this.options.requireFullSync,
+            version: this.options.version,
+            mobileTransport: this.options.mobileTransport,
+            noiseTrustedRootCa: overrides.noiseTrustedRootCa,
+            disableNoiseCertificateChainVerification: overrides.disableNoiseCertificateChainVerification ??
+                this.options.dangerous?.disableNoiseCertificateChainVerification
         });
     }
     async clearTransientState() {
@@ -90,9 +99,8 @@ class WaAuthClient {
     }
     async clearStoredCredentials() {
         this.logger.warn('auth client clearing stored credentials');
-        await this.authStore.clear();
         this.credentials = null;
-        await this.clearTransientState();
+        await Promise.all([this.authStore.clear(), this.clearTransientState()]);
     }
     async persistServerStaticKey(serverStaticKey) {
         this.logger.debug('persisting server static key', {
@@ -145,53 +153,45 @@ class WaAuthClient {
         });
     }
     async persistSuccessAttributes(attributes) {
-        await this.patchCredentials((credentials) => {
-            return {
-                ...credentials,
-                meLid: attributes.meLid ?? credentials.meLid,
-                meDisplayName: attributes.meDisplayName ?? credentials.meDisplayName,
-                companionEncStatic: attributes.companionEncStatic ?? credentials.companionEncStatic,
-                lastSuccessTs: attributes.lastSuccessTs ?? credentials.lastSuccessTs,
-                propsVersion: attributes.propsVersion ?? credentials.propsVersion,
-                abPropsVersion: attributes.abPropsVersion ?? credentials.abPropsVersion,
-                connectionLocation: attributes.connectionLocation ?? credentials.connectionLocation,
-                accountCreationTs: attributes.accountCreationTs ?? credentials.accountCreationTs
-            };
-        }, {
-            shouldPersist: (current, next) => next.meLid !== current.meLid ||
-                next.meDisplayName !== current.meDisplayName ||
-                (current.companionEncStatic === undefined) !==
-                    (next.companionEncStatic === undefined) ||
+        let persistDiff;
+        const computeDiff = (current, next) => ({
+            lidChanged: next.meLid !== current.meLid,
+            displayNameChanged: next.meDisplayName !== current.meDisplayName,
+            companionChanged: (current.companionEncStatic === undefined) !==
+                (next.companionEncStatic === undefined) ||
                 (current.companionEncStatic !== undefined &&
                     next.companionEncStatic !== undefined &&
-                    !(0, bytes_1.uint8Equal)(current.companionEncStatic, next.companionEncStatic)) ||
-                next.lastSuccessTs !== current.lastSuccessTs ||
-                next.propsVersion !== current.propsVersion ||
-                next.abPropsVersion !== current.abPropsVersion ||
-                next.connectionLocation !== current.connectionLocation ||
-                next.accountCreationTs !== current.accountCreationTs,
-            onPersist: (current, next) => {
-                this.logger.debug('persisting success attributes', {
-                    lidChanged: next.meLid !== current.meLid,
-                    displayNameChanged: next.meDisplayName !== current.meDisplayName,
-                    companionChanged: (current.companionEncStatic === undefined) !==
-                        (next.companionEncStatic === undefined) ||
-                        (current.companionEncStatic !== undefined &&
-                            next.companionEncStatic !== undefined &&
-                            !(0, bytes_1.uint8Equal)(current.companionEncStatic, next.companionEncStatic)),
-                    lastSuccessTsChanged: next.lastSuccessTs !== current.lastSuccessTs,
-                    propsVersionChanged: next.propsVersion !== current.propsVersion,
-                    abPropsVersionChanged: next.abPropsVersion !== current.abPropsVersion,
-                    connectionLocationChanged: next.connectionLocation !== current.connectionLocation,
-                    accountCreationTsChanged: next.accountCreationTs !== current.accountCreationTs
-                });
+                    !(0, bytes_1.uint8Equal)(current.companionEncStatic, next.companionEncStatic)),
+            lastSuccessTsChanged: next.lastSuccessTs !== current.lastSuccessTs,
+            propsVersionChanged: next.propsVersion !== current.propsVersion,
+            abPropsVersionChanged: next.abPropsVersion !== current.abPropsVersion,
+            connectionLocationChanged: next.connectionLocation !== current.connectionLocation,
+            accountCreationTsChanged: next.accountCreationTs !== current.accountCreationTs
+        });
+        await this.patchCredentials((credentials) => ({
+            ...credentials,
+            meLid: attributes.meLid ?? credentials.meLid,
+            meDisplayName: attributes.meDisplayName ?? credentials.meDisplayName,
+            companionEncStatic: attributes.companionEncStatic ?? credentials.companionEncStatic,
+            lastSuccessTs: attributes.lastSuccessTs ?? credentials.lastSuccessTs,
+            propsVersion: attributes.propsVersion ?? credentials.propsVersion,
+            abPropsVersion: attributes.abPropsVersion ?? credentials.abPropsVersion,
+            connectionLocation: attributes.connectionLocation ?? credentials.connectionLocation,
+            accountCreationTs: attributes.accountCreationTs ?? credentials.accountCreationTs
+        }), {
+            shouldPersist: (current, next) => {
+                persistDiff = computeDiff(current, next);
+                return Object.values(persistDiff).some(Boolean);
+            },
+            onPersist: () => {
+                this.logger.debug('persisting success attributes', persistDiff);
             }
         });
     }
-    async requestPairingCode(phoneNumber, shouldShowPushNotification = false) {
+    async requestPairingCode(phoneNumber, shouldShowPushNotification = false, customCode) {
         this.requireCredentials();
         this.logger.info('auth client requesting pairing code');
-        return this.runHandled(() => this.pairingFlow.requestPairingCode(phoneNumber, shouldShowPushNotification));
+        return this.runHandled(() => this.pairingFlow.requestPairingCode(phoneNumber, shouldShowPushNotification, customCode));
     }
     async fetchPairingCountryCodeIso() {
         this.requireCredentials();
@@ -233,13 +233,14 @@ class WaAuthClient {
     }
     async updateCredentials(credentials) {
         this.logger.trace('auth client update credentials', {
-            registered: hasMeJid(credentials)
+            registered: credentials?.meJid !== null && credentials?.meJid !== undefined
         });
         this.credentials = credentials;
-        await (0, WaAuthCredentialsFlow_1.persistCredentials)({
+        await (0, credentials_flow_1.persistCredentials)({
             logger: this.logger,
             authStore: this.authStore,
-            signalStore: this.signalStore
+            signalStore: this.signalStore,
+            preKeyStore: this.preKeyStore
         }, credentials);
     }
     requireCredentials() {
@@ -254,6 +255,3 @@ class WaAuthClient {
     }
 }
 exports.WaAuthClient = WaAuthClient;
-function hasMeJid(credentials) {
-    return credentials?.meJid !== null && credentials?.meJid !== undefined;
-}

package/dist/auth/credentials-flow.js

@@ -0,0 +1,195 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadOrCreateCredentials = loadOrCreateCredentials;
+exports.persistCredentials = persistCredentials;
+exports.buildCommsConfig = buildCommsConfig;
+const _crypto_1 = require("../crypto/index.js");
+const keys_1 = require("../crypto/core/keys");
+const X25519_1 = require("../crypto/curves/X25519");
+const jid_1 = require("../protocol/jid");
+const utils_1 = require("../signal/registration/utils");
+const WaMobileTcpSocket_1 = require("../transport/node/WaMobileTcpSocket");
+const WaMobileClientPayload_1 = require("../transport/noise/WaMobileClientPayload");
+const proxy_1 = require("../transport/proxy");
+const primitives_1 = require("../util/primitives");
+async function loadOrCreateCredentials(args) {
+    args.logger.trace('auth credentials loadOrCreate start');
+    const existing = await args.authStore.load();
+    if (!existing) {
+        const credentials = await createFreshAndPersistCredentials(args);
+        args.logger.info('created fresh auth credentials');
+        return credentials;
+    }
+    args.logger.debug('auth credentials loaded from store', {
+        registered: existing.meJid !== null && existing.meJid !== undefined,
+        hasServerStaticKey: existing.serverStaticKey !== null && existing.serverStaticKey !== undefined
+    });
+    const skipSignedPreKeyCheck = args.skipSignedPreKeySignatureVerification === true;
+    if (!existing.meJid &&
+        !skipSignedPreKeyCheck &&
+        !(await hasValidSignedPreKey(args.logger, existing))) {
+        args.logger.warn('signed pre-key is invalid, regenerating credentials');
+        const fresh = await createFreshAndPersistCredentials(args);
+        args.logger.info('regenerated credentials due to invalid signed pre-key');
+        return fresh;
+    }
+    await restoreSignalStore(args.signalStore, args.preKeyStore, existing);
+    args.logger.trace('auth credentials restored into signal store');
+    return existing;
+}
+async function persistCredentials(args, credentials) {
+    args.logger.trace('persisting auth credentials', {
+        registered: credentials.meJid !== null && credentials.meJid !== undefined
+    });
+    await args.authStore.save(credentials);
+}
+function mobileTransportFromCredentials(credentials) {
+    if (!credentials.deviceInfo)
+        return undefined;
+    return {
+        deviceInfo: credentials.deviceInfo,
+        ...(credentials.pushName !== undefined ? { pushName: credentials.pushName } : {}),
+        ...(credentials.yearClass !== undefined ? { yearClass: credentials.yearClass } : {}),
+        ...(credentials.memClass !== undefined ? { memClass: credentials.memClass } : {})
+    };
+}
+function buildCommsConfig(logger, credentials, socketOptions, clientOptions) {
+    const meJid = credentials.meJid;
+    const registered = meJid !== null && meJid !== undefined;
+    const loginIdentity = registered ? (0, jid_1.getLoginIdentity)(meJid) : null;
+    const wsProxy = socketOptions.proxy?.ws;
+    // Resolve the effective mobile transport: explicit option wins, otherwise
+    // synthesize one from persisted credentials.deviceInfo so a registered
+    // mobile session boots in mobile mode without the caller re-passing
+    // deviceInfo on every `new WaClient(...)` call.
+    const effectiveMobileTransport = clientOptions.mobileTransport ?? mobileTransportFromCredentials(credentials);
+    logger.debug('building comms config from credentials', {
+        registered,
+        hasServerStaticKey: credentials.serverStaticKey !== null && credentials.serverStaticKey !== undefined,
+        mobile: Boolean(effectiveMobileTransport),
+        mobileSource: clientOptions.mobileTransport
+            ? 'option'
+            : effectiveMobileTransport
+                ? 'credentials'
+                : 'none'
+    });
+    if (effectiveMobileTransport) {
+        if (wsProxy) {
+            throw new Error('mobileTransport does not support socketOptions.proxy.ws — remove the proxy option or open an issue to add TCP proxy support');
+        }
+        if (!loginIdentity) {
+            throw new Error('mobileTransport requires registered credentials (meJid) — run the mobile bridge flow first');
+        }
+        const loginPayload = (0, WaMobileClientPayload_1.buildMobileLoginPayload)({
+            username: loginIdentity.username,
+            device: loginIdentity.device,
+            passive: effectiveMobileTransport.passive ?? false,
+            deviceInfo: effectiveMobileTransport.deviceInfo,
+            pushName: effectiveMobileTransport.pushName,
+            yearClass: effectiveMobileTransport.yearClass,
+            memClass: effectiveMobileTransport.memClass
+        });
+        return {
+            url: effectiveMobileTransport.tcpUrl ?? 'tcp://g.whatsapp.net:443',
+            rawWebSocketConstructor: WaMobileTcpSocket_1.WaMobileTcpSocketCtor,
+            connectTimeoutMs: socketOptions.connectTimeoutMs,
+            reconnectIntervalMs: socketOptions.reconnectIntervalMs,
+            timeoutIntervalMs: socketOptions.timeoutIntervalMs,
+            maxReconnectAttempts: socketOptions.maxReconnectAttempts,
+            noise: {
+                clientStaticKeyPair: credentials.noiseKeyPair,
+                isRegistered: true,
+                serverStaticKey: credentials.serverStaticKey,
+                routingInfo: credentials.routingInfo,
+                trustedRootCa: clientOptions.noiseTrustedRootCa,
+                verifyCertificateChain: clientOptions.disableNoiseCertificateChainVerification
+                    ? false
+                    : undefined,
+                loginPayload
+            }
+        };
+    }
+    return {
+        url: socketOptions.url,
+        urls: socketOptions.urls,
+        protocols: socketOptions.protocols,
+        dispatcher: (0, proxy_1.toProxyDispatcher)(wsProxy),
+        agent: (0, proxy_1.toProxyAgent)(wsProxy),
+        connectTimeoutMs: socketOptions.connectTimeoutMs,
+        reconnectIntervalMs: socketOptions.reconnectIntervalMs,
+        timeoutIntervalMs: socketOptions.timeoutIntervalMs,
+        maxReconnectAttempts: socketOptions.maxReconnectAttempts,
+        noise: {
+            clientStaticKeyPair: credentials.noiseKeyPair,
+            isRegistered: registered,
+            serverStaticKey: credentials.serverStaticKey,
+            routingInfo: credentials.routingInfo,
+            trustedRootCa: clientOptions.noiseTrustedRootCa,
+            verifyCertificateChain: clientOptions.disableNoiseCertificateChainVerification
+                ? false
+                : undefined,
+            loginPayloadConfig: loginIdentity
+                ? {
+                    username: loginIdentity.username,
+                    device: loginIdentity.device,
+                    deviceBrowser: clientOptions.deviceBrowser,
+                    deviceOsDisplayName: clientOptions.deviceOsDisplayName,
+                    versionBase: clientOptions.version
+                }
+                : undefined,
+            registrationPayloadConfig: !loginIdentity
+                ? {
+                    registrationInfo: credentials.registrationInfo,
+                    signedPreKey: credentials.signedPreKey,
+                    deviceBrowser: clientOptions.deviceBrowser,
+                    deviceOsDisplayName: clientOptions.deviceOsDisplayName,
+                    requireFullSync: clientOptions.requireFullSync,
+                    versionBase: clientOptions.version
+                }
+                : undefined
+        }
+    };
+}
+async function createFreshCredentials(signalStore, preKeyStore, logger) {
+    logger.trace('creating fresh credentials');
+    const [noiseKeyPair, registrationBundle, advSecretKey] = await Promise.all([
+        X25519_1.X25519.generateKeyPair(),
+        (0, utils_1.createAndStoreInitialKeys)(signalStore, preKeyStore),
+        (0, _crypto_1.randomBytesAsync)(32)
+    ]);
+    return {
+        noiseKeyPair,
+        registrationInfo: registrationBundle.registrationInfo,
+        signedPreKey: registrationBundle.signedPreKey,
+        serverHasPreKeys: false,
+        advSecretKey
+    };
+}
+async function createFreshAndPersistCredentials(args) {
+    const credentials = await createFreshCredentials(args.signalStore, args.preKeyStore, args.logger);
+    // Persist credentials first so signal restore never commits state for credentials that failed to save.
+    await args.authStore.save(credentials);
+    await restoreSignalStore(args.signalStore, args.preKeyStore, credentials);
+    return credentials;
+}
+async function hasValidSignedPreKey(logger, credentials) {
+    try {
+        const serializedPubKey = (0, keys_1.toSerializedPubKey)(credentials.signedPreKey.keyPair.pubKey);
+        const valid = await (0, _crypto_1.xeddsaVerify)((0, _crypto_1.toRawPubKey)(credentials.registrationInfo.identityKeyPair.pubKey), serializedPubKey, credentials.signedPreKey.signature);
+        logger.trace('signed pre-key validation completed', { valid });
+        return valid;
+    }
+    catch (error) {
+        logger.warn('signed pre-key validation failed with exception', {
+            message: (0, primitives_1.toError)(error).message
+        });
+        return false;
+    }
+}
+async function restoreSignalStore(signalStore, preKeyStore, credentials) {
+    await Promise.all([
+        signalStore.setRegistrationInfo(credentials.registrationInfo),
+        signalStore.setSignedPreKey(credentials.signedPreKey),
+        preKeyStore.setServerHasPreKeys(credentials.serverHasPreKeys === true)
+    ]);
+}

package/dist/auth/index.js

@@ -14,12 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WaAuthSqliteStore = exports.createCompanionHello = exports.completeCompanionFinish = exports.WaAuthClient = void 0;
+exports.WaAuthClient = void 0;
 __exportStar(require("./types"), exports);
 var WaAuthClient_1 = require("./WaAuthClient");
 Object.defineProperty(exports, "WaAuthClient", { enumerable: true, get: function () { return WaAuthClient_1.WaAuthClient; } });
-var WaPairingCodeCrypto_1 = require("./pairing/WaPairingCodeCrypto");
-Object.defineProperty(exports, "completeCompanionFinish", { enumerable: true, get: function () { return WaPairingCodeCrypto_1.completeCompanionFinish; } });
-Object.defineProperty(exports, "createCompanionHello", { enumerable: true, get: function () { return WaPairingCodeCrypto_1.createCompanionHello; } });
-var auth_store_1 = require("../store/providers/sqlite/auth.store");
-Object.defineProperty(exports, "WaAuthSqliteStore", { enumerable: true, get: function () { return auth_store_1.WaAuthSqliteStore; } });

package/dist/auth/pairing/WaPairingFlow.js

@@ -1,16 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WaPairingFlow = void 0;
-const WaPairingCodeCrypto_1 = require("../pairing/WaPairingCodeCrypto");
+const pairing_code_crypto_1 = require("../pairing/pairing-code-crypto");
 const _crypto_1 = require("../../crypto/index.js");
 const _proto_1 = require("../../proto.js");
+const browser_1 = require("../../protocol/browser");
 const constants_1 = require("../../protocol/constants");
 const jid_1 = require("../../protocol/jid");
 const WaAdvSignature_1 = require("../../signal/crypto/WaAdvSignature");
+const global_1 = require("../../transport/node/builders/global");
 const pairing_1 = require("../../transport/node/builders/pairing");
 const helpers_1 = require("../../transport/node/helpers");
 const bytes_1 = require("../../util/bytes");
-const bytes_2 = require("../../util/bytes");
 class WaPairingFlow {
     constructor(options) {
         this.opts = options;
@@ -23,26 +24,19 @@ class WaPairingFlow {
         this.opts.logger.trace('pairing flow session cleared');
         this.pairingSession = null;
     }
-    async requestPairingCode(phoneNumber, shouldShowPushNotification = false) {
+    async requestPairingCode(phoneNumber, shouldShowPushNotification = false, customCode) {
         this.opts.logger.info('requesting pairing code', {
-            shouldShowPushNotification
+            shouldShowPushNotification,
+            hasCustomCode: customCode !== undefined
         });
+        const normalizedCustomCode = customCode !== undefined ? (0, pairing_code_crypto_1.normalizeCustomPairingCode)(customCode) : undefined;
         const credentials = this.requireCredentials();
         const phoneJid = (0, jid_1.parsePhoneJid)(phoneNumber);
         const [companionHello, refreshedCredentials] = await Promise.all([
-            (0, WaPairingCodeCrypto_1.createCompanionHello)(),
+            (0, pairing_code_crypto_1.createCompanionHello)({ customCode: normalizedCustomCode }),
             this.rotateAdvSecret(credentials)
         ]);
-        const browser = this.opts.device.browser;
-        const browserDisplayName = {
-            chrome: 'Chrome',
-            firefox: 'Firefox',
-            ie: 'IE',
-            opera: 'Opera',
-            safari: 'Safari',
-            edge: 'Edge',
-            chromium: 'Chromium'
-        }[browser.trim().toLowerCase()] ?? browser;
+        const browserDisplayName = (0, browser_1.getWaBrowserDisplayName)(this.opts.device.browser);
         const response = await this.opts.socket.query((0, pairing_1.buildCompanionHelloRequestNode)({
             phoneJid,
             shouldShowPushNotification,
@@ -121,7 +115,10 @@ class WaPairingFlow {
             id: node.attrs.id,
             stage: linkCodeNode.attrs.stage
         });
-        await this.opts.socket.sendNode((0, pairing_1.buildNotificationAckNode)(node));
+        await this.opts.socket.sendNode((0, global_1.buildAckNode)({
+            kind: 'notification',
+            node
+        }));
         const stage = linkCodeNode.attrs.stage;
         if (stage === constants_1.WA_SIGNALING.LINK_CODE_STAGE_REFRESH_CODE) {
             const refNode = (0, helpers_1.findNodeChild)(linkCodeNode, constants_1.WA_NODE_TAGS.LINK_CODE_PAIRING_REF);
@@ -129,7 +126,7 @@ class WaPairingFlow {
                 return true;
             }
             const ref = (0, helpers_1.decodeNodeContentUtf8OrBytes)(refNode.content, 'refresh_code.link_code_pairing_ref');
-            if ((0, bytes_2.uint8Equal)(ref, this.pairingSession.ref)) {
+            if ((0, bytes_1.uint8Equal)(ref, this.pairingSession.ref)) {
                 this.opts.logger.info('received pairing refresh notification', {
                     forceManualRefresh: linkCodeNode.attrs.force_manual_refresh === 'true'
                 });
@@ -149,18 +146,24 @@ class WaPairingFlow {
         if (!hasExpectedChild) {
             return false;
         }
-        await this.opts.socket.sendNode((0, pairing_1.buildNotificationAckNode)(node, constants_1.WA_SIGNALING.COMPANION_REG_REFRESH_NOTIFICATION));
+        // Rotate first so we don't ack success before local credential state is durably updated.
         await this.rotateAdvSecret(this.requireCredentials());
+        await this.opts.socket.sendNode((0, global_1.buildAckNode)({
+            kind: 'notification',
+            node,
+            typeOverride: constants_1.WA_SIGNALING.COMPANION_REG_REFRESH_NOTIFICATION
+        }));
         this.opts.logger.info('handled companion_reg_refresh notification');
         this.opts.qrFlow.refreshCurrentQr();
         return true;
     }
     async handlePairDevice(iqNode, pairDeviceNode) {
         const refs = (0, helpers_1.getNodeChildrenNonEmptyUtf8ByTag)(pairDeviceNode, constants_1.WA_NODE_TAGS.REF, 'pair-device.ref');
+        // Commit adv-secret rotation before sending IQ success to avoid protocol/state divergence.
         await this.rotateAdvSecret(this.requireCredentials());
+        await this.opts.socket.sendNode((0, global_1.buildIqResultNode)(iqNode));
         this.opts.qrFlow.setRefs(refs);
         this.opts.logger.info('pair-device refs updated', { refsCount: refs.length });
-        await this.opts.socket.sendNode((0, pairing_1.buildIqResultNode)(iqNode));
     }
     async handlePairSuccess(iqNode, pairSuccessNode) {
         this.opts.logger.info('processing pair-success node');
@@ -179,13 +182,15 @@ class WaPairingFlow {
         const wrappedHmac = (0, bytes_1.decodeProtoBytes)(wrappedIdentity.hmac, 'ADVSignedDeviceIdentityHMAC.hmac');
         const accountType = wrappedIdentity.accountType ?? _proto_1.proto.ADVEncryptionType.E2EE;
         const isHosted = accountType === _proto_1.proto.ADVEncryptionType.HOSTED;
-        const hmacInput = isHosted
-            ? (0, bytes_2.concatBytes)([WaAdvSignature_1.ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE, wrappedDetails])
-            : wrappedDetails;
-        const expectedHmac = await (0, WaAdvSignature_1.computeAdvIdentityHmac)(credentials.advSecretKey, hmacInput);
-        if (!(0, bytes_2.uint8Equal)(expectedHmac, wrappedHmac)) {
-            this.opts.logger.error('pair-success hmac mismatch');
-            throw new Error('pair-success HMAC validation failed');
+        if (this.opts.dangerous?.disablePairSuccessHmacVerification !== true) {
+            const hmacInput = isHosted
+                ? (0, bytes_1.concatBytes)([WaAdvSignature_1.ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE, wrappedDetails])
+                : wrappedDetails;
+            const expectedHmac = await (0, WaAdvSignature_1.computeAdvIdentityHmac)(credentials.advSecretKey, hmacInput);
+            if (!(0, bytes_1.uint8Equal)(expectedHmac, wrappedHmac)) {
+                this.opts.logger.error('pair-success hmac mismatch');
+                throw new Error('pair-success HMAC validation failed');
+            }
         }
         const { signedIdentity, keyIndex, responseIdentityBytes } = await this.buildPairSuccessResponseIdentity(credentials, wrappedDetails, isHosted);
         const nextCredentials = {
@@ -234,10 +239,12 @@ class WaPairingFlow {
         const accountSignature = (0, bytes_1.decodeProtoBytes)(signedIdentity.accountSignature, 'ADVSignedDeviceIdentity.accountSignature');
         const accountSignatureKey = (0, bytes_1.decodeProtoBytes)(signedIdentity.accountSignatureKey, 'ADVSignedDeviceIdentity.accountSignatureKey');
         const localIdentity = credentials.registrationInfo.identityKeyPair;
-        const validAccountSignature = await (0, WaAdvSignature_1.verifyDeviceIdentityAccountSignature)(details, accountSignature, localIdentity.pubKey, accountSignatureKey, isHosted);
-        if (!validAccountSignature) {
-            this.opts.logger.error('pair-success account signature invalid');
-            throw new Error('pair-success account signature validation failed');
+        if (this.opts.dangerous?.disableAdvSignatureVerification !== true) {
+            const validAccountSignature = await (0, WaAdvSignature_1.verifyDeviceIdentityAccountSignature)(details, accountSignature, localIdentity.pubKey, accountSignatureKey, isHosted);
+            if (!validAccountSignature) {
+                this.opts.logger.error('pair-success account signature invalid');
+                throw new Error('pair-success account signature validation failed');
+            }
         }
         signedIdentity.deviceSignature = await (0, WaAdvSignature_1.generateDeviceSignature)(details, localIdentity, accountSignatureKey, isHosted);
         const advDeviceIdentity = _proto_1.proto.ADVDeviceIdentity.decode(details);
@@ -275,7 +282,7 @@ class WaPairingFlow {
             throw new Error('primary_hello notification is missing fields');
         }
         const ref = (0, helpers_1.decodeNodeContentUtf8OrBytes)(refNode.content, 'primary_hello.link_code_pairing_ref');
-        if (!pairingSession.ref || !(0, bytes_2.uint8Equal)(ref, pairingSession.ref)) {
+        if (!pairingSession.ref || !(0, bytes_1.uint8Equal)(ref, pairingSession.ref)) {
             this.opts.logger.warn('primary_hello ref mismatch ignored');
             return;
         }
@@ -284,7 +291,7 @@ class WaPairingFlow {
             constants_1.WA_DEFAULTS.PAIRING_CODE_MAX_AGE_SECONDS) {
             throw new Error('primary_hello received for an expired pairing code');
         }
-        const finish = await (0, WaPairingCodeCrypto_1.completeCompanionFinish)({
+        const finish = await (0, pairing_code_crypto_1.completeCompanionFinish)({
             pairingCode: pairingSession.pairingCode,
             wrappedPrimaryEphemeralPub: (0, helpers_1.decodeNodeContentUtf8OrBytes)(wrappedPrimaryNode.content, 'primary_hello.link_code_pairing_wrapped_primary_ephemeral_pub'),
             primaryIdentityPub: (0, helpers_1.decodeNodeContentUtf8OrBytes)(primaryIdentityNode.content, 'primary_hello.primary_identity_pub'),