@lazyneoaz/metachat 4.0.4 → 4.0.5

package/dist/index.mjs

@@ -13515,7 +13515,7 @@ var require_agent = __commonJS({
     var agent_base_1 = require_src2();
     var parse_proxy_response_1 = __importDefault(require_parse_proxy_response());
     var debug2 = debug_1.default("https-proxy-agent:agent");
-    var HttpsProxyAgent5 = class extends agent_base_1.Agent {
+    var HttpsProxyAgent4 = class extends agent_base_1.Agent {
       constructor(_opts) {
         let opts;
         if (typeof _opts === "string") {
@@ -13609,7 +13609,7 @@ var require_agent = __commonJS({
         });
       }
     };
-    exports.default = HttpsProxyAgent5;
+    exports.default = HttpsProxyAgent4;
     function resume(socket) {
       socket.resume();
     }
@@ -21852,94 +21852,6 @@ var require_form_data2 = __commonJS({
   }
 });
 
-// src/utils/headers.ts
-function sanitizeHeaderValue2(value) {
-  if (value === null || value === void 0) return "";
-  let str = String(value);
-  if (str.trim().startsWith("[") && str.trim().endsWith("]")) {
-    try {
-      const parsed = JSON.parse(str);
-      if (Array.isArray(parsed)) {
-        return "";
-      }
-    } catch {
-    }
-  }
-  str = str.replace(/[\x00-\x08\x0B-\x0C\x0E-\x1F\x7F\r\n\[\]]/g, "").trim();
-  return str;
-}
-function sanitizeHeaderName(name) {
-  if (!name || typeof name !== "string") return "";
-  return name.replace(/[^\x21-\x7E]/g, "").trim();
-}
-function getHeaders(url2, options, ctx, customHeader) {
-  const u = new URL(url2);
-  const ua = options?.userAgent || "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36";
-  const referer = options?.referer || "https://www.facebook.com/";
-  const origin2 = referer.replace(/\/+$/, "");
-  const contentType = options?.contentType || "application/x-www-form-urlencoded";
-  const acceptLang = options?.acceptLanguage || "en-US,en;q=0.9,vi;q=0.8";
-  const headers = {
-    Host: sanitizeHeaderValue2(u.host),
-    Origin: sanitizeHeaderValue2(origin2),
-    Referer: sanitizeHeaderValue2(referer),
-    "User-Agent": sanitizeHeaderValue2(ua),
-    Accept: "text/html,application/xhtml+xml,application/xml;q=0.9,application/json;q=0.8,*/*;q=0.7",
-    "Accept-Language": sanitizeHeaderValue2(acceptLang),
-    "Accept-Encoding": "gzip, deflate, br",
-    "Content-Type": sanitizeHeaderValue2(contentType),
-    Connection: "keep-alive",
-    DNT: "1",
-    "Upgrade-Insecure-Requests": "1",
-    "sec-ch-ua": '"Chromium";v="139", "Not;A=Brand";v="24", "Google Chrome";v="139"',
-    "sec-ch-ua-mobile": "?0",
-    "sec-ch-ua-platform": '"Windows"',
-    "sec-ch-ua-arch": '"x86"',
-    "sec-ch-ua-bitness": '"64"',
-    "sec-ch-ua-full-version-list": '"Chromium";v="139.0.0.0", "Not;A=Brand";v="24.0.0.0", "Google Chrome";v="139.0.0.0"',
-    "sec-ch-ua-platform-version": '"15.0.0"',
-    "Sec-Fetch-Site": "same-origin",
-    "Sec-Fetch-Mode": "cors",
-    "Sec-Fetch-Dest": "empty",
-    "X-Requested-With": "XMLHttpRequest",
-    Pragma: "no-cache",
-    "Cache-Control": "no-cache"
-  };
-  if (ctx?.region) {
-    const regionValue = sanitizeHeaderValue2(ctx.region);
-    if (regionValue) headers["X-MSGR-Region"] = regionValue;
-  }
-  if (customHeader && typeof customHeader === "object") {
-    for (const [key, value] of Object.entries(customHeader)) {
-      if (value === null || value === void 0 || typeof value === "function") continue;
-      if (typeof value === "object") continue;
-      const sanitizedKey = sanitizeHeaderName(key);
-      const sanitizedValue = sanitizeHeaderValue2(value);
-      if (sanitizedKey && sanitizedValue !== "") {
-        const existingKey = Object.keys(headers).find(
-          (headerKey) => headerKey.toLowerCase() === sanitizedKey.toLowerCase()
-        );
-        headers[existingKey || sanitizedKey] = sanitizedValue;
-      }
-    }
-  }
-  const sanitizedHeaders = {};
-  for (const [key, value] of Object.entries(headers)) {
-    const sanitizedKey = sanitizeHeaderName(key);
-    const sanitizedValue = sanitizeHeaderValue2(value);
-    if (sanitizedKey && sanitizedValue !== "") {
-      sanitizedHeaders[sanitizedKey] = sanitizedValue;
-    }
-  }
-  return sanitizedHeaders;
-}
-var meta;
-var init_headers = __esm({
-  "src/utils/headers.ts"() {
-    meta = (prop2) => new RegExp(`<meta property="${prop2}" content="([^"]*)"`);
-  }
-});
-
 // node_modules/color-name/index.js
 var require_color_name = __commonJS({
   "node_modules/color-name/index.js"(exports, module) {
@@ -24818,14 +24730,12 @@ function getGUID() {
   });
 }
 function getFrom(str, startToken, endToken) {
-  const start = str.indexOf(startToken) + startToken.length;
-  if (start < startToken.length) return "";
-  const lastHalf = str.substring(start);
-  const end2 = lastHalf.indexOf(endToken);
-  if (end2 === -1) {
-    throw Error("Could not find endTime `" + endToken + "` in the given string.");
-  }
-  return lastHalf.substring(0, end2);
+  const startIndex = str.indexOf(startToken);
+  if (startIndex < 0) return "";
+  const start = startIndex + startToken.length;
+  const end2 = str.indexOf(endToken, start);
+  if (end2 < 0) return str.slice(start);
+  return str.slice(start, end2);
 }
 function makeParsable(html3) {
   const withoutForLoop = html3.replace(/for\s*\(\s*;\s*;\s*\)\s*;\s*/, "");
@@ -24954,6 +24864,480 @@ var init_constants = __esm({
   }
 });
 
+// src/utils/user-agents.ts
+function buildProfile(major, plat) {
+  const full = `${major}.0.0.0`;
+  const brands = [
+    `"Not;A=Brand";v="24"`,
+    `"Chromium";v="${major}"`,
+    `"Google Chrome";v="${major}"`
+  ];
+  const fullVersionList = [
+    `"Not;A=Brand";v="24.0.0.0"`,
+    `"Chromium";v="${full}"`,
+    `"Google Chrome";v="${full}"`
+  ];
+  const screen = getRandom(SCREENS);
+  const language = getRandom(LANGUAGES);
+  const isMac = /Macintosh/.test(plat.platform);
+  const devicePixelRatio = isMac ? 2 : getRandom([1, 1.25, 1.5]) === 1 ? 1 : 1.25;
+  return {
+    userAgent: `Mozilla/5.0 (${plat.platform}) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${full} Safari/537.36`,
+    secChUa: brands.join(", "),
+    secChUaFullVersionList: fullVersionList.join(", "),
+    secChUaPlatform: plat.chPlatform,
+    secChUaPlatformVersion: plat.chPlatformVersion,
+    secChUaArch: plat.chArch,
+    secChUaBitness: plat.chBitness,
+    secChUaModel: '""',
+    secChUaWow64: plat.chWow64,
+    secChUaFormFactors: plat.formFactors,
+    secChUaMobile: "?0",
+    acceptLanguage: language === "en-GB" ? "en-GB,en;q=0.9" : "en-US,en;q=0.9",
+    language,
+    timezone: getRandom(TIMEOZONES),
+    screen: {
+      ...screen,
+      colorDepth: 24,
+      pixelDepth: 24
+    },
+    devicePixelRatio,
+    hardwareConcurrency: getRandom([4, 8, 12, 16]),
+    deviceMemory: getRandom([8, 8, 16]),
+    label: plat.label
+  };
+}
+function randomUserAgent() {
+  return buildProfile(getRandom(CHROME_MAJORS), getRandom(DESKTOP_PLATFORMS));
+}
+function normalizeBrowserProfile(input) {
+  if (!input) return defaultBrowserProfile;
+  const base = defaultBrowserProfile;
+  const ua = input.userAgent || base.userAgent;
+  const major = (ua.match(/Chrome\/(\d+)/) || [])[1] || CHROME_MAJORS[0];
+  const inferred = buildProfile(
+    major,
+    /Macintosh/.test(ua) ? DESKTOP_PLATFORMS.find((p) => /Macintosh/.test(p.platform)) : DESKTOP_PLATFORMS[0]
+  );
+  return { ...inferred, ...input, userAgent: ua };
+}
+var CHROME_MAJORS, DESKTOP_PLATFORMS, SCREENS, TIMEOZONES, LANGUAGES, defaultBrowserProfile, defaultUserAgent, windowsUserAgent;
+var init_user_agents = __esm({
+  "src/utils/user-agents.ts"() {
+    init_constants();
+    CHROME_MAJORS = ["141", "140", "139"];
+    DESKTOP_PLATFORMS = [
+      {
+        platform: "Windows NT 10.0; Win64; x64",
+        chPlatform: '"Windows"',
+        chPlatformVersion: '"15.0.0"',
+        chArch: '"x86"',
+        chBitness: '"64"',
+        chWow64: "?0",
+        formFactors: '"Desktop"',
+        label: "Chrome/Windows-11"
+      },
+      {
+        platform: "Windows NT 10.0; Win64; x64",
+        chPlatform: '"Windows"',
+        chPlatformVersion: '"10.0.0"',
+        chArch: '"x86"',
+        chBitness: '"64"',
+        chWow64: "?0",
+        formFactors: '"Desktop"',
+        label: "Chrome/Windows-10"
+      },
+      {
+        platform: "Macintosh; Intel Mac OS X 10_15_7",
+        chPlatform: '"macOS"',
+        chPlatformVersion: '"14.6.1"',
+        chArch: '"x86"',
+        chBitness: '"64"',
+        chWow64: "?0",
+        formFactors: '"Desktop"',
+        label: "Chrome/macOS-14"
+      },
+      {
+        platform: "Macintosh; Intel Mac OS X 10_15_7",
+        chPlatform: '"macOS"',
+        chPlatformVersion: '"15.1.0"',
+        chArch: '"arm"',
+        chBitness: '"64"',
+        chWow64: "?0",
+        formFactors: '"Desktop"',
+        label: "Chrome/macOS-15-arm"
+      }
+    ];
+    SCREENS = [
+      { width: 1920, height: 1080, availWidth: 1920, availHeight: 1053 },
+      { width: 2560, height: 1440, availWidth: 2560, availHeight: 1400 },
+      { width: 1536, height: 864, availWidth: 1536, availHeight: 824 },
+      { width: 1440, height: 900, availWidth: 1440, availHeight: 860 },
+      { width: 1366, height: 768, availWidth: 1366, availHeight: 728 }
+    ];
+    TIMEOZONES = [
+      "America/New_York",
+      "America/Chicago",
+      "America/Los_Angeles",
+      "Europe/London",
+      "Europe/Berlin",
+      "Asia/Singapore"
+    ];
+    LANGUAGES = ["en-US", "en-GB"];
+    defaultBrowserProfile = buildProfile(
+      CHROME_MAJORS[0],
+      DESKTOP_PLATFORMS[0]
+    );
+    defaultUserAgent = defaultBrowserProfile.userAgent;
+    windowsUserAgent = defaultUserAgent;
+  }
+});
+
+// src/utils/headers.ts
+function sanitizeHeaderValue2(value) {
+  if (value === null || value === void 0) return "";
+  const str = String(value);
+  return str.replace(/[\x00-\x08\x0B-\x0C\x0E-\x1F\x7F\r\n]/g, "").trim();
+}
+function sanitizeHeaderName(name) {
+  if (!name || typeof name !== "string") return "";
+  return name.replace(/[^\x21-\x7E]/g, "").trim();
+}
+function originOf(referer) {
+  try {
+    return new URL(referer).origin;
+  } catch {
+    return "https://www.facebook.com";
+  }
+}
+function isMessengerHost(host) {
+  return /(^|\.)messenger\.com$/i.test(host);
+}
+function isBusinessHost(host) {
+  return /(^|\.)business\.facebook\.com$/i.test(host);
+}
+function isFacebookHost(host) {
+  return /(^|\.)facebook\.com$/i.test(host);
+}
+function isGraphQlPath(pathname) {
+  return /\/api\/graphql/i.test(pathname) || /graphqlbatch/i.test(pathname);
+}
+function resolveProfile(options) {
+  const base = options?.browser || options?.browserProfile || defaultBrowserProfile;
+  const merged = {
+    ...base,
+    userAgent: options?.userAgent || base.userAgent,
+    secChUa: options?.secChUa || base.secChUa,
+    secChUaFullVersionList: options?.secChUaFullVersionList || base.secChUaFullVersionList,
+    secChUaPlatform: options?.secChUaPlatform || base.secChUaPlatform,
+    secChUaPlatformVersion: options?.secChUaPlatformVersion || base.secChUaPlatformVersion,
+    secChUaArch: options?.secChUaArch || base.secChUaArch,
+    secChUaBitness: options?.secChUaBitness || base.secChUaBitness,
+    secChUaWow64: options?.secChUaWow64 || base.secChUaWow64,
+    secChUaFormFactors: options?.secChUaFormFactors || base.secChUaFormFactors,
+    secChUaMobile: options?.secChUaMobile || base.secChUaMobile,
+    acceptLanguage: options?.acceptLanguage || base.acceptLanguage
+  };
+  if (options?.userAgent && !options?.browser && !options?.browserProfile) {
+    return normalizeBrowserProfile(merged);
+  }
+  return merged;
+}
+function shouldSendOrigin(method, isXhr) {
+  const m = (method || "GET").toUpperCase();
+  if (m === "GET" || m === "HEAD" || m === "OPTIONS") return false;
+  return true;
+}
+function getHeaders(url2, options, ctx, customHeader) {
+  const u = new URL(url2);
+  const profile = resolveProfile(options);
+  const method = String(options?.method || customHeader?.method || "GET").toUpperCase();
+  const defaultReferer = isMessengerHost(u.hostname) ? "https://www.messenger.com/" : isBusinessHost(u.hostname) ? "https://business.facebook.com/" : "https://www.facebook.com/";
+  const referer = options?.referer || defaultReferer;
+  const origin2 = options?.origin || originOf(referer);
+  const contentType = options?.contentType || (customHeader?.["Content-Type"] || customHeader?.["content-type"]) || "application/x-www-form-urlencoded";
+  const isGraphQl = isGraphQlPath(u.pathname);
+  const isXhr = isGraphQl || contentType.includes("json") || !!options?.xhr;
+  const isDocument2 = !isXhr && (method === "GET" || method === "HEAD");
+  const secFetchSite = (() => {
+    if (isDocument2) return "none";
+    let refererHost = referer;
+    try {
+      refererHost = new URL(referer).hostname;
+    } catch {
+    }
+    if (isMessengerHost(u.hostname) && !isMessengerHost(refererHost)) return "same-site";
+    if (isFacebookHost(u.hostname) && !isFacebookHost(refererHost)) return "cross-site";
+    return "same-origin";
+  })();
+  const accept = isGraphQl ? "*/*" : isXhr ? "*/*" : "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7";
+  const headers = {
+    Referer: sanitizeHeaderValue2(referer),
+    "User-Agent": sanitizeHeaderValue2(profile.userAgent),
+    Accept: accept,
+    "Accept-Language": sanitizeHeaderValue2(profile.acceptLanguage),
+    "Accept-Encoding": "gzip, deflate, br",
+    Connection: "keep-alive",
+    "Upgrade-Insecure-Requests": "1",
+    "sec-ch-ua": sanitizeHeaderValue2(profile.secChUa),
+    "sec-ch-ua-mobile": sanitizeHeaderValue2(profile.secChUaMobile),
+    "sec-ch-ua-platform": sanitizeHeaderValue2(profile.secChUaPlatform),
+    "sec-ch-ua-platform-version": sanitizeHeaderValue2(profile.secChUaPlatformVersion),
+    "sec-ch-ua-arch": sanitizeHeaderValue2(profile.secChUaArch),
+    "sec-ch-ua-bitness": sanitizeHeaderValue2(profile.secChUaBitness),
+    "sec-ch-ua-model": sanitizeHeaderValue2(profile.secChUaModel),
+    "sec-ch-ua-wow64": sanitizeHeaderValue2(profile.secChUaWow64),
+    "sec-ch-ua-form-factors": sanitizeHeaderValue2(profile.secChUaFormFactors),
+    "sec-ch-ua-full-version-list": sanitizeHeaderValue2(profile.secChUaFullVersionList),
+    "Sec-Fetch-Site": secFetchSite,
+    "Sec-Fetch-Mode": isXhr ? "cors" : "navigate",
+    "Sec-Fetch-Dest": isXhr ? "empty" : "document"
+  };
+  if (method !== "GET" && method !== "HEAD") {
+    headers["Content-Type"] = sanitizeHeaderValue2(contentType);
+  }
+  if (shouldSendOrigin(method)) {
+    headers["Origin"] = sanitizeHeaderValue2(origin2);
+  }
+  if (isDocument2) {
+    headers["Sec-Fetch-User"] = "?1";
+    headers["priority"] = "u=0, i";
+  }
+  if (isXhr) {
+    headers["X-Requested-With"] = "XMLHttpRequest";
+    headers["Pragma"] = "no-cache";
+    headers["Cache-Control"] = "no-cache";
+    headers["priority"] = "u=1, i";
+  }
+  if (isGraphQl) {
+    headers["x-asbd-id"] = "129477";
+    const lsd = ctx?.lsd || ctx?.fb_lsd;
+    if (lsd) headers["x-fb-lsd"] = sanitizeHeaderValue2(lsd);
+    const friendlyName = customHeader?.["x-fb-friendly-name"] || customHeader?.["X-Fb-Friendly-Name"];
+    if (friendlyName) headers["x-fb-friendly-name"] = sanitizeHeaderValue2(friendlyName);
+  }
+  if (ctx?.region) {
+    const regionValue = sanitizeHeaderValue2(ctx.region);
+    if (regionValue) headers["X-MSGR-Region"] = regionValue;
+  }
+  if (customHeader && typeof customHeader === "object") {
+    for (const [key, value] of Object.entries(customHeader)) {
+      if (value === null || value === void 0 || typeof value === "function") continue;
+      if (typeof value === "object") continue;
+      const sanitizedKey = sanitizeHeaderName(key);
+      let sanitizedValue = sanitizeHeaderValue2(value);
+      if (!sanitizedKey || sanitizedValue === "") continue;
+      if (sanitizedKey.toLowerCase() === "referer") {
+        headers["Referer"] = sanitizedValue;
+        if (!customHeader.origin && !customHeader.Origin && shouldSendOrigin(method)) {
+          headers["Origin"] = originOf(sanitizedValue);
+        }
+        continue;
+      }
+      const existingKey = Object.keys(headers).find(
+        (headerKey) => headerKey.toLowerCase() === sanitizedKey.toLowerCase()
+      );
+      headers[existingKey || sanitizedKey] = sanitizedValue;
+    }
+  }
+  const sanitizedHeaders = {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (value === void 0 || value === null) continue;
+    const sanitizedKey = sanitizeHeaderName(key);
+    const sanitizedValue = sanitizeHeaderValue2(value);
+    if (sanitizedKey && sanitizedValue !== "") {
+      sanitizedHeaders[sanitizedKey] = sanitizedValue;
+    }
+  }
+  return sanitizedHeaders;
+}
+function getWebSocketHeaders(url2, options, ctx) {
+  const profile = resolveProfile(options);
+  const u = new URL(url2);
+  const origin2 = isMessengerHost(u.hostname) ? "https://www.messenger.com" : isBusinessHost(u.hostname) ? "https://business.facebook.com" : "https://www.facebook.com";
+  const referer = options?.referer || (origin2 === "https://www.messenger.com" ? "https://www.messenger.com/" : `${origin2}/`);
+  return {
+    Origin: origin2,
+    Referer: referer,
+    "User-Agent": profile.userAgent,
+    "Accept-Language": profile.acceptLanguage,
+    "Accept-Encoding": "gzip, deflate, br, zstd",
+    "Cache-Control": "no-cache",
+    Pragma: "no-cache",
+    "sec-ch-ua": profile.secChUa,
+    "sec-ch-ua-mobile": profile.secChUaMobile,
+    "sec-ch-ua-platform": profile.secChUaPlatform,
+    "sec-ch-ua-platform-version": profile.secChUaPlatformVersion,
+    "sec-ch-ua-arch": profile.secChUaArch,
+    "sec-ch-ua-bitness": profile.secChUaBitness,
+    "sec-ch-ua-model": profile.secChUaModel,
+    "sec-ch-ua-wow64": profile.secChUaWow64,
+    "sec-ch-ua-full-version-list": profile.secChUaFullVersionList
+  };
+}
+function getFingerprintParams(options) {
+  const profile = resolveProfile(options);
+  return {
+    dpr: String(profile.devicePixelRatio)
+  };
+}
+var meta;
+var init_headers = __esm({
+  "src/utils/headers.ts"() {
+    init_user_agents();
+    meta = (prop2) => new RegExp(`<meta property="${prop2}" content="([^"]*)"`);
+  }
+});
+
+// src/utils/pacing.ts
+function pacingState(ctx) {
+  if (!ctx.__pacing) {
+    ctx.__pacing = { lastRequestAt: 0, chain: Promise.resolve(), inflight: 0 };
+  }
+  return ctx.__pacing;
+}
+function humanDelay(baseMs = TYPICAL_GAP_MS, spreadMs = 220) {
+  const u = Math.random() * Math.random();
+  const jitter = Math.floor(u * spreadMs * 2) - spreadMs;
+  return Math.max(MIN_GAP_MS, Math.min(MAX_GAP_MS, baseMs + jitter));
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, Math.max(0, Math.floor(ms))));
+}
+async function paceRequest(ctx, weight = "normal") {
+  const state = pacingState(ctx);
+  const base = weight === "light" ? TYPICAL_GAP_MS * 0.5 : weight === "heavy" ? TYPICAL_GAP_MS * 2.2 : TYPICAL_GAP_MS;
+  const turn = state.chain.then(async () => {
+    const now = Date.now();
+    const elapsed = now - state.lastRequestAt;
+    if (elapsed < MIN_GAP_MS) {
+      await sleep(humanDelay(Math.max(base, MIN_GAP_MS - elapsed)));
+    } else if (elapsed < base) {
+      await sleep(humanDelay(base - elapsed, 160));
+    } else {
+      await sleep(humanDelay(MIN_GAP_MS, 60));
+    }
+    state.lastRequestAt = Date.now();
+  });
+  state.chain = turn.catch(() => {
+  });
+  return turn;
+}
+function retryDelay(attempt, baseMs = 1200, capMs = 45e3) {
+  const exp = Math.min(capMs, baseMs * Math.pow(1.7, Math.max(0, attempt)));
+  const jitter = 0.5 + Math.random() * 0.75;
+  return Math.min(capMs, Math.floor(exp * jitter));
+}
+function noteAction(ctx, weight = "heavy") {
+  const state = pacingState(ctx);
+  state.lastRequestAt = Date.now() + (weight === "heavy" ? 350 : 120);
+}
+var MIN_GAP_MS, TYPICAL_GAP_MS, MAX_GAP_MS;
+var init_pacing = __esm({
+  "src/utils/pacing.ts"() {
+    MIN_GAP_MS = 120;
+    TYPICAL_GAP_MS = 420;
+    MAX_GAP_MS = 2500;
+  }
+});
+
+// src/utils/safety.ts
+function safetyState(ctx) {
+  if (!ctx.__safety) {
+    ctx.__safety = { window: [], openedAt: 0, authFailures: 0, cappedCount: 0, trips: [] };
+  }
+  const state = ctx.__safety;
+  if (!Array.isArray(state.window)) state.window = [];
+  if (!Array.isArray(state.trips)) state.trips = [];
+  return state;
+}
+function cooldownFor(state) {
+  const factor = Math.pow(1.8, Math.max(0, state.trips.length - 1));
+  return Math.min(MAX_COOLDOWN_MS, Math.floor(BASE_COOLDOWN_MS * factor));
+}
+function isBreakerOpen(ctx) {
+  const state = safetyState(ctx);
+  if (!state.openedAt) return false;
+  if (Date.now() - state.openedAt >= cooldownFor(state)) {
+    state.openedAt = 0;
+    state.authFailures = 0;
+    return false;
+  }
+  return true;
+}
+function tripBreaker(ctx, reason = "manual") {
+  const state = safetyState(ctx);
+  if (state.openedAt && state.reason === reason) return;
+  state.openedAt = Date.now();
+  state.reason = reason;
+  state.authFailures = 0;
+  state.trips.push(Date.now());
+  if (ctx.__onSafetyTrip) {
+    try {
+      ctx.__onSafetyTrip({ reason, cooldownMs: cooldownFor(state) });
+    } catch {
+    }
+  }
+}
+function resetBreaker(ctx) {
+  const state = safetyState(ctx);
+  state.openedAt = 0;
+  state.reason = void 0;
+  state.authFailures = 0;
+}
+function noteAuthFailure(ctx) {
+  const state = safetyState(ctx);
+  state.authFailures += 1;
+  if (state.authFailures >= AUTH_FAILURE_THRESHOLD) {
+    tripBreaker(ctx, "auth-failure");
+  }
+}
+function noteRateLimit(ctx) {
+  tripBreaker(ctx, "rate-limit");
+}
+function noteCheckpoint(ctx) {
+  tripBreaker(ctx, "checkpoint");
+}
+function reserveRequest(ctx) {
+  const state = safetyState(ctx);
+  if (isBreakerOpen(ctx)) {
+    return cooldownFor(state) - (Date.now() - state.openedAt);
+  }
+  const now = Date.now();
+  state.window = state.window.filter((t) => now - t < WINDOW_MS);
+  if (state.window.length >= MAX_REQUESTS_IN_WINDOW) {
+    state.cappedCount += 1;
+    const oldest = state.window[0];
+    return Math.max(0, WINDOW_MS - (now - oldest));
+  }
+  state.window.push(now);
+  return 0;
+}
+function safetySnapshot(ctx) {
+  const state = safetyState(ctx);
+  const now = Date.now();
+  state.window = state.window.filter((t) => now - t < WINDOW_MS);
+  const open = isBreakerOpen(ctx);
+  return {
+    closed: !open,
+    reason: open ? state.reason : void 0,
+    cooldownRemainingMs: open ? cooldownFor(state) - (now - state.openedAt) : 0,
+    requestsInWindow: state.window.length,
+    authFailures: state.authFailures,
+    cappedCount: state.cappedCount
+  };
+}
+var MAX_REQUESTS_IN_WINDOW, WINDOW_MS, BASE_COOLDOWN_MS, MAX_COOLDOWN_MS, AUTH_FAILURE_THRESHOLD;
+var init_safety = __esm({
+  "src/utils/safety.ts"() {
+    MAX_REQUESTS_IN_WINDOW = 28;
+    WINDOW_MS = 2e4;
+    BASE_COOLDOWN_MS = 3 * 60 * 1e3;
+    MAX_COOLDOWN_MS = 30 * 60 * 1e3;
+    AUTH_FAILURE_THRESHOLD = 3;
+  }
+});
+
 // src/utils/axios.ts
 var axios_exports = {};
 __export(axios_exports, {
@@ -25019,18 +25403,37 @@ function adaptResponse(res) {
     }
   };
 }
+function looksLikeCheckpoint(res) {
+  const location = res?.headers?.location || res?.headers?.Location || "";
+  if (typeof location === "string" && /\/checkpoint\/|two_factor|\/consent|\/recover|account_disabled/i.test(location)) {
+    return true;
+  }
+  const body = typeof res?.body === "string" ? res.body : "";
+  return /"error":1357004|account has been (?:disabled|suspended)|confirm your identity|security check/i.test(body.slice(0, 400));
+}
 async function requestWithRetry(requestFunction, retries = 3, baseDelay = 1e3, ctx) {
   const emit2 = (event, payload) => {
     try {
-      if (ctx?._emitter && typeof ctx._emitter.emit === "function") ;
+      if (ctx?._emitter && typeof ctx._emitter.emit === "function") {
+        ctx._emitter.emit(event, payload);
+      }
     } catch {
     }
   };
   let lastError;
   for (let i2 = 0; i2 < retries; i2++) {
     try {
+      const safetyWait = reserveRequest(ctx);
+      if (safetyWait > 0) await delay(safetyWait);
+      await paceRequest(ctx, "normal");
       const res = await requestFunction();
-      return adaptResponse(res);
+      const adapted = adaptResponse(res);
+      if (looksLikeCheckpoint(adapted)) {
+        noteCheckpoint(ctx);
+      } else {
+        resetBreaker(ctx);
+      }
+      return adapted;
     } catch (rawError) {
       const e = rawError || {};
       lastError = e;
@@ -25046,6 +25449,7 @@ async function requestWithRetry(requestFunction, retries = 3, baseDelay = 1e3, c
       const method = String(e?.config?.method || "").toUpperCase();
       if (status === 429) {
         emit2("rateLimit", { status, url: url2, method });
+        noteRateLimit(ctx);
       }
       if (status >= 400 && status < 500 && status !== 429) {
         if (e.response) return adaptResponse(e.response);
@@ -25060,8 +25464,7 @@ async function requestWithRetry(requestFunction, retries = 3, baseDelay = 1e3, c
       if (!status && (netCode === "UND_ERR_CONNECT_TIMEOUT" || netCode === "ETIMEDOUT" || netCode === "ECONNRESET" || netCode === "ECONNREFUSED" || netCode === "ENOTFOUND" || /timeout|connect timeout|network error|fetch failed/i.test(msg))) {
         emit2("networkError", { code: netCode, message: msg, url: url2, method });
       }
-      const backoffDelay = Math.min(baseDelay * Math.pow(2, i2) + Math.floor(Math.random() * 200), 3e4);
-      await delay(backoffDelay);
+      await delay(retryDelay(i2, baseDelay, 3e4));
     }
   }
   throw lastError || new Error("Request failed after retries");
@@ -25084,16 +25487,16 @@ function cleanGet(url2) {
 }
 async function get(url2, reqJar, qs2, options, ctx, customHeader) {
   const config = {
-    headers: getHeaders(url2, options, ctx, customHeader),
+    headers: getHeaders(url2, { ...options, method: "GET" }, ctx, customHeader),
     timeout: 6e4,
     params: qs2,
     ...getRequestProxy(options),
     validateStatus: (status) => status >= 200 && status < 600
   };
-  return requestWithRetry(async () => await getClient(reqJar).get(url2, config));
+  return requestWithRetry(async () => await getClient(reqJar).get(url2, config), 3, 1e3, ctx);
 }
 async function post(url2, reqJar, form, options, ctx, customHeader) {
-  const headers = getHeaders(url2, options, ctx, customHeader);
+  const headers = getHeaders(url2, { ...options, method: "POST" }, ctx, customHeader);
   let data2 = form;
   const contentType = headers["Content-Type"] || "application/x-www-form-urlencoded";
   if (contentType.includes("json")) {
@@ -25118,7 +25521,7 @@ async function post(url2, reqJar, form, options, ctx, customHeader) {
     ...getRequestProxy(options),
     validateStatus: (status) => status >= 200 && status < 600
   };
-  return requestWithRetry(async () => await getClient(reqJar).post(url2, data2, config));
+  return requestWithRetry(async () => await getClient(reqJar).post(url2, data2, config), 3, 1e3, ctx);
 }
 async function postMultipart(url2, reqJar, formData, qs2, options, ctx, customHeader) {
   const multipartHeader = {
@@ -25126,7 +25529,7 @@ async function postMultipart(url2, reqJar, formData, qs2, options, ctx, customHe
     ...customHeader || {}
   };
   const config = {
-    headers: getHeaders(url2, options, ctx, multipartHeader),
+    headers: getHeaders(url2, { ...options, method: "POST" }, ctx, multipartHeader),
     timeout: 12e4,
     params: qs2,
     maxContentLength: Infinity,
@@ -25134,7 +25537,7 @@ async function postMultipart(url2, reqJar, formData, qs2, options, ctx, customHe
     ...getRequestProxy(options),
     validateStatus: (status) => status >= 200 && status < 600
   };
-  return requestWithRetry(async () => await getClient(reqJar).post(url2, formData, config));
+  return requestWithRetry(async () => await getClient(reqJar).post(url2, formData, config), 3, 1e3, ctx);
 }
 async function postFormData(url2, reqJar, form, qs2, options, ctx, customHeader) {
   const formData = new import_form_data2.default();
@@ -25148,13 +25551,13 @@ async function postFormData(url2, reqJar, form, qs2, options, ctx, customHeader)
     ...customHeader || {}
   };
   const config = {
-    headers: getHeaders(url2, options, ctx, multipartHeader),
+    headers: getHeaders(url2, { ...options, method: "POST" }, ctx, multipartHeader),
     timeout: 6e4,
     params: qs2,
     ...getRequestProxy(options),
     validateStatus: (status) => status >= 200 && status < 600
   };
-  return requestWithRetry(async () => await getClient(reqJar).post(url2, formData, config));
+  return requestWithRetry(async () => await getClient(reqJar).post(url2, formData, config), 3, 1e3, ctx);
 }
 function getJar() {
   return new import_tough_cookie.CookieJar();
@@ -25168,6 +25571,8 @@ var init_axios3 = __esm({
     import_form_data2 = __toESM(require_form_data2());
     init_headers();
     init_constants();
+    init_pacing();
+    init_safety();
     jar = new import_tough_cookie.CookieJar();
     client = wrapper(axios_default.create({ jar }));
     clients = /* @__PURE__ */ new WeakMap();
@@ -69521,7 +69926,7 @@ var require_dist3 = __commonJS({
       }
       return options;
     };
-    var HttpsProxyAgent5 = class extends agent_base_1.Agent {
+    var HttpsProxyAgent4 = class extends agent_base_1.Agent {
       constructor(proxy, opts) {
         super(opts);
         this.options = { path: void 0 };
@@ -69600,8 +70005,8 @@ var require_dist3 = __commonJS({
         return fakeSocket;
       }
     };
-    HttpsProxyAgent5.protocols = ["http", "https"];
-    exports.HttpsProxyAgent = HttpsProxyAgent5;
+    HttpsProxyAgent4.protocols = ["http", "https"];
+    exports.HttpsProxyAgent = HttpsProxyAgent4;
     function resume(socket) {
       socket.resume();
     }
@@ -75102,34 +75507,57 @@ var require_lodash = __commonJS({
 var utils_exports2 = {};
 __export(utils_exports2, {
   AUTHOR: () => AUTHOR,
+  AUTH_ERROR_CODES: () => AUTH_ERROR_CODES,
+  AUTH_FAILURE_THRESHOLD: () => AUTH_FAILURE_THRESHOLD,
   AuthenticationError: () => AuthenticationError,
+  BASE_COOLDOWN_MS: () => BASE_COOLDOWN_MS,
   BRAND: () => BRAND,
+  CHROME_MAJORS: () => CHROME_MAJORS,
   ConfigurationError: () => ConfigurationError,
+  DESKTOP_PLATFORMS: () => DESKTOP_PLATFORMS,
   FCAError: () => FCAError,
+  LS_DOC_TOKEN_ERRORS: () => LS_DOC_TOKEN_ERRORS,
+  MAX_REQUESTS_IN_WINDOW: () => MAX_REQUESTS_IN_WINDOW,
   NUM_TO_DAY: () => NUM_TO_DAY,
   NUM_TO_MONTH: () => NUM_TO_MONTH,
   NetworkError: () => NetworkError,
   NotFoundError: () => NotFoundError,
   PermissionError: () => PermissionError,
   RateLimitError: () => RateLimitError,
+  SESSION_COOKIE_NAMES: () => SESSION_COOKIE_NAMES,
   TimeoutError: () => TimeoutError,
   ValidationError: () => ValidationError,
+  WINDOW_MS: () => WINDOW_MS,
   _formatAttachment: () => _formatAttachment,
+  applySetCookie: () => applySetCookie,
   arrToForm: () => arrToForm,
   arrayToObject: () => arrayToObject2,
+  awaitProactiveSlot: () => awaitProactiveSlot,
   banner: () => banner,
   binaryToDecimal: () => binaryToDecimal,
   brandTag: () => brandTag,
+  buildProfile: () => buildProfile,
   buildWsTaskContent: () => buildWsTaskContent,
+  canActProactively: () => canActProactively,
   cleanGet: () => cleanGet,
   cleanJsonResponse: () => cleanJsonResponse,
+  collectSessionCookies: () => collectSessionCookies,
   debug: () => debug,
   decodeClientPayload: () => decodeClientPayload,
+  defaultBrowserProfile: () => defaultBrowserProfile,
   defaultUserAgent: () => defaultUserAgent,
   delay: () => delay2,
   ensureCometTokens: () => ensureCometTokens,
   error: () => error,
   extractAttachmentIds: () => extractAttachmentIds,
+  extractCookies: () => extractCookies,
+  extractCookiesFromBody: () => extractCookiesFromBody,
+  extractCookiesFromJar: () => extractCookiesFromJar,
+  extractCookiesFromSetCookie: () => extractCookiesFromSetCookie,
+  extractDtsg: () => extractDtsg,
+  extractLsd: () => extractLsd,
+  extractSpin: () => extractSpin,
+  formatAppStateCookie: () => formatAppStateCookie,
   formatAttachment: () => formatAttachment,
   formatCookie: () => formatCookie2,
   formatDate: () => formatDate,
@@ -75156,6 +75584,7 @@ __export(utils_exports2, {
   getAccessFromBusiness: () => getAccessFromBusiness,
   getAdminTextMessageType: () => getAdminTextMessageType,
   getAppState: () => getAppState,
+  getFingerprintParams: () => getFingerprintParams,
   getFrom: () => getFrom,
   getGUID: () => getGUID,
   getHeaders: () => getHeaders,
@@ -75163,14 +75592,28 @@ __export(utils_exports2, {
   getRandom: () => getRandom,
   getSignatureID: () => getSignatureID,
   getType: () => getType,
+  getWebSocketHeaders: () => getWebSocketHeaders,
+  hasAuthenticatedSession: () => hasAuthenticatedSession,
+  humanDelay: () => humanDelay,
   info: () => info,
+  invalidateCometTokens: () => invalidateCometTokens,
+  isAuthFailure: () => isAuthFailure,
+  isBreakerOpen: () => isBreakerOpen,
   isReadableStream: () => isReadableStream2,
+  isStaleTokenError: () => isStaleTokenError,
   json: () => json2,
   log: () => log,
   logOptions: () => logOptions,
   makeDefaults: () => makeDefaults,
   makeParsable: () => makeParsable,
   meta: () => meta,
+  missingSessionCookies: () => missingSessionCookies,
+  normalizeBrowserProfile: () => normalizeBrowserProfile,
+  noteAction: () => noteAction,
+  noteAuthFailure: () => noteAuthFailure,
+  noteCheckpoint: () => noteCheckpoint,
+  noteRateLimit: () => noteRateLimit,
+  paceRequest: () => paceRequest,
   padZeros: () => padZeros,
   parseAndCheckLogin: () => parseAndCheckLogin,
   post: () => post,
@@ -75181,16 +75624,31 @@ __export(utils_exports2, {
   promisify: () => promisify,
   publishLsRequestWithAck: () => publishLsRequestWithAck,
   randomUserAgent: () => randomUserAgent,
+  refreshSessionCookies: () => refreshSessionCookies,
+  repairSession: () => repairSession,
+  reserveRequest: () => reserveRequest,
+  resetBreaker: () => resetBreaker,
+  resolveProfile: () => resolveProfile,
+  retryDelay: () => retryDelay,
+  safetySnapshot: () => safetySnapshot,
   saveCookies: () => saveCookies,
+  scheduleSessionKeepAlive: () => scheduleSessionKeepAlive,
   setProxy: () => setProxy2,
+  sleep: () => sleep,
+  startLiveness: () => startLiveness,
   success: () => success,
+  tripBreaker: () => tripBreaker,
   uploadGroupImage: () => uploadGroupImage,
   uploadMercuryAttachment: () => uploadMercuryAttachment,
+  warmUpSession: () => warmUpSession,
   warn: () => warn,
   windowsUserAgent: () => windowsUserAgent,
+  withCometTokens: () => withCometTokens,
+  withSessionRetry: () => withSessionRetry,
   ws: () => ws
 });
 init_axios3();
+init_headers();
 init_constants();
 
 // node_modules/cheerio/dist/esm/options.js
@@ -89399,8 +89857,34 @@ init_headers();
 
 // src/utils/clients.ts
 init_constants();
+function formatAppStateCookie(cookie) {
+  const name = cookie.name || cookie.key;
+  const value = String(cookie.value);
+  const parts = [`${name}=${value}`];
+  const path2 = cookie.path || "/";
+  parts.push(`Path=${path2}`);
+  const domain = cookie.domain || ".facebook.com";
+  parts.push(`Domain=${domain}`);
+  if (cookie.secure) parts.push("Secure");
+  if (cookie.httpOnly) parts.push("HttpOnly");
+  const sameSite = normalizeSameSite(cookie.sameSite);
+  if (sameSite) parts.push(`SameSite=${sameSite}`);
+  if (cookie.expirationDate && !cookie.session) {
+    parts.push(`Expires=${new Date(cookie.expirationDate * 1e3).toUTCString()}`);
+  }
+  return parts.join("; ");
+}
+function normalizeSameSite(value) {
+  if (!value) return null;
+  const v = String(value).toLowerCase();
+  if (v === "no_restriction" || v === "none") return "None";
+  if (v === "lax") return "Lax";
+  if (v === "strict") return "Strict";
+  return null;
+}
 function formatCookie(arr, url2) {
-  return arr[0] + "=" + arr[1] + "; Path=" + arr[3] + "; Domain=" + url2 + ".com";
+  const host = url2.replace(/^\./, "");
+  return arr[0] + "=" + arr[1] + "; Path=" + arr[3] + "; Domain=." + host + "; Secure; SameSite=None";
 }
 function parseAndCheckLogin(ctx, http5, retryCount = 0, noRetry = false) {
   const delay3 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
@@ -89409,7 +89893,7 @@ function parseAndCheckLogin(ctx, http5, retryCount = 0, noRetry = false) {
       throw new Error("parseAndCheckLogin received an invalid response.");
     }
     if (data2.statusCode >= 500 && data2.statusCode < 600) {
-      if (noRetry || retryCount >= 5) {
+      if (noRetry || retryCount >= 3) {
         const err = new Error(
           "Request retry failed. Check the `res` and `statusCode` property on this error."
         );
@@ -89419,7 +89903,7 @@ function parseAndCheckLogin(ctx, http5, retryCount = 0, noRetry = false) {
         throw err;
       }
       retryCount++;
-      const retryTime = Math.floor(Math.random() * 5e3);
+      const retryTime = Math.min(3e4, Math.floor(800 * Math.pow(1.7, retryCount) * (0.5 + Math.random())));
       const request = data2.request || {};
       const uri = request.uri || {};
       const url2 = request.url || (uri.protocol && uri.hostname ? uri.protocol + "//" + uri.hostname + (uri.port ? ":" + uri.port : "") + (uri.pathname || "") : "");
@@ -89469,17 +89953,17 @@ function parseAndCheckLogin(ctx, http5, retryCount = 0, noRetry = false) {
     } else {
       throw new Error("Unknown response body type: " + typeof data2.body);
     }
-    if (res.redirect && data2.request.method === "GET") {
+    if (res.redirect && data2.request.method === "GET" && retryCount < 5) {
       const redirectRes = await http5.get(res.redirect, ctx.jar);
-      return await parseAndCheckLogin(ctx, http5)(redirectRes);
+      return await parseAndCheckLogin(ctx, http5, retryCount + 1)(redirectRes);
     }
     if (res.jsmods && res.jsmods.require && Array.isArray(res.jsmods.require[0]) && res.jsmods.require[0][0] === "Cookie") {
       const requireCookie = res.jsmods.require[0][3];
       if (Array.isArray(requireCookie) && requireCookie.length >= 4) {
         const cookieValue = String(requireCookie[0]).replace("_js_", "");
         const normalizedCookie = [cookieValue, requireCookie[1], requireCookie[2], requireCookie[3]];
-        ctx.jar.setCookie(formatCookie(normalizedCookie, "facebook"), "https://www.facebook.com");
-        ctx.jar.setCookie(formatCookie(normalizedCookie, "messenger"), "https://www.messenger.com");
+        ctx.jar.setCookieSync(formatCookie(normalizedCookie, "facebook"), "https://www.facebook.com");
+        ctx.jar.setCookieSync(formatCookie(normalizedCookie, "messenger"), "https://www.messenger.com");
       }
     }
     if (res.jsmods && Array.isArray(res.jsmods.require)) {
@@ -89504,13 +89988,27 @@ function parseAndCheckLogin(ctx, http5, retryCount = 0, noRetry = false) {
 }
 function saveCookies(jar2) {
   return function(res) {
-    const cookies = res?.headers?.["set-cookie"] || [];
+    const headers = res?.headers || {};
+    const raw = headers["set-cookie"] || headers["Set-Cookie"] || [];
+    const cookies = Array.isArray(raw) ? raw : [raw];
     cookies.forEach(function(c) {
-      if (c.indexOf(".facebook.com") > -1) {
-        jar2.setCookie(c, "https://www.facebook.com");
+      if (!c || typeof c !== "string") return;
+      if (/domain=\.?facebook\.com/i.test(c) || /domain=\.?messenger\.com/i.test(c)) {
+        try {
+          jar2.setCookieSync(c, "https://www.facebook.com");
+        } catch {
+        }
+        try {
+          const mirrored = c.replace(/domain=\.?facebook\.com/i, "domain=.messenger.com").replace(/domain=\.?messenger\.com/i, "domain=.facebook.com");
+          jar2.setCookieSync(mirrored, "https://www.messenger.com");
+        } catch {
+        }
+      } else {
+        try {
+          jar2.setCookieSync(`${c}; domain=.facebook.com; path=/`, "https://www.facebook.com");
+        } catch {
+        }
       }
-      const c2 = c.replace(/domain=\.facebook\.com/, "domain=.messenger.com");
-      jar2.setCookie(c2, "https://www.messenger.com");
     });
     return res;
   };
@@ -90040,43 +90538,8 @@ function formatProxyPresence(presence, userID) {
   };
 }
 
-// src/utils/user-agents.ts
-init_constants();
-var BROWSER_DATA = {
-  windows: {
-    platform: "Windows NT 10.0; Win64; x64",
-    chromeVersions: ["126.0.0.0", "125.0.0.0", "124.0.0.0"],
-    platformVersion: '"15.0.0"'
-  },
-  mac: {
-    platform: "Macintosh; Intel Mac OS X 10_15_7",
-    chromeVersions: ["126.0.0.0", "125.0.0.0", "124.0.0.0"],
-    platformVersion: '"15.7.9"'
-  }
-};
-var defaultUserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36";
-var windowsUserAgent = defaultUserAgent;
-function randomUserAgent() {
-  const os = getRandom(Object.keys(BROWSER_DATA));
-  const data2 = BROWSER_DATA[os];
-  const version = getRandom(data2.chromeVersions);
-  const majorVersion = version.split(".")[0];
-  const userAgent = `Mozilla/5.0 (${data2.platform}) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${version} Safari/537.36`;
-  const brands = [
-    `"Not/A)Brand";v="8"`,
-    `"Chromium";v="${majorVersion}"`,
-    `"Google Chrome";v="${majorVersion}"`
-  ];
-  const secChUa = brands.join(", ");
-  const secChUaFullVersionList = brands.map((b) => b.replace(/"$/, `.0.0.0"`)).join(", ");
-  return {
-    userAgent,
-    secChUa,
-    secChUaFullVersionList,
-    secChUaPlatform: `"${os === "windows" ? "Windows" : "macOS"}"`,
-    secChUaPlatformVersion: data2.platformVersion
-  };
-}
+// src/utils/index.ts
+init_user_agents();
 
 // src/utils/errors.ts
 var FCAError = class extends Error {
@@ -90240,6 +90703,7 @@ function buildWsTaskContent(ctx, tasks, versionId) {
 // src/utils/attachments.ts
 var import_form_data3 = __toESM(require_form_data2());
 init_constants();
+init_user_agents();
 function cleanJsonResponse(value) {
   if (typeof value !== "string") return value;
   const normalized = value.replace(/^for\s*\(;;\);\s*/i, "");
@@ -90381,7 +90845,7 @@ function normalizeFilename(filename, mime) {
   return ext ? `${base}.${ext}` : base;
 }
 async function uploadMercuryAttachment(ctx, defaultFuncs, attachment) {
-  const normalized = await normalizeAttachmentInput(attachment);
+  const normalized = await normalizeAttachmentInput(attachment, ctx);
   const url2 = "https://www.facebook.com/ajax/mercury/upload.php";
   await ensureUploadTokens(ctx, defaultFuncs);
   const formData = new import_form_data3.default();
@@ -90393,7 +90857,7 @@ async function uploadMercuryAttachment(ctx, defaultFuncs, attachment) {
   const data2 = cleanJsonResponse(res && res.body !== void 0 ? res.body : res);
   return finalizeUpload(data2);
 }
-async function normalizeAttachmentInput(attachment) {
+async function normalizeAttachmentInput(attachment, ctx) {
   if (Buffer.isBuffer(attachment)) {
     const mime = sniffMime(attachment);
     return {
@@ -90405,7 +90869,11 @@ async function normalizeAttachmentInput(attachment) {
   const url2 = typeof attachment === "string" ? attachment : attachment && (attachment.url || attachment.href);
   if (typeof url2 === "string" && /^https?:\/\//i.test(url2)) {
     const resp = await fetch(url2, {
-      headers: { "User-Agent": "Mozilla/5.0", Accept: "*/*" }
+      headers: {
+        "User-Agent": ctx?.globalOptions && ctx.globalOptions.userAgent || defaultBrowserProfile.userAgent,
+        Accept: "image/avif,image/webp,image/apng,image/svg+xml,image/*,video/*,audio/*,*/*;q=0.8",
+        "Accept-Language": ctx?.globalOptions && ctx.globalOptions.browser?.acceptLanguage || "en-US,en;q=0.9"
+      }
     });
     if (!resp.ok) {
       throw new Error(`Failed to download attachment url (HTTP ${resp.status})`);
@@ -90495,7 +90963,21 @@ async function uploadGroupImage(ctx, defaultFuncs, image) {
 }
 
 // src/utils/lsd.ts
-var TOKEN_TTL_MS = 30 * 60 * 1e3;
+var TOKEN_TTL_MS = 10 * 60 * 1e3;
+var STALE_TOKEN_ERRORS = /* @__PURE__ */ new Set([
+  1357004,
+  // "Sorry, something went wrong / close and re-open your browser window"
+  1357031,
+  // document token invalid
+  1357051
+  // token mismatch
+]);
+var MAX_BACKOFF_MS = 60 * 1e3;
+function tokenState(ctx) {
+  const state = ctx.__cometTokens || (ctx.__cometTokens = {});
+  if (typeof state.failures !== "number") state.failures = 0;
+  return state;
+}
 function getFrom3(html3, startToken, endToken) {
   const startIndex = html3.indexOf(startToken);
   if (startIndex < 0) return "";
@@ -90510,34 +90992,544 @@ function extractLsd(html3) {
 function extractDtsg(html3) {
   return getFrom3(html3, '["DTSGInitialData",[],{"token":"', '"}') || getFrom3(html3, 'name="fb_dtsg" value="', '"') || (html3.match(/"DTSGInitialData",\[\],\{"token":"([^"]+)"/) || [])[1] || "";
 }
+function extractSpin(html3) {
+  const out = {};
+  const spinB = (html3.match(/"__spin_b":"([^"]+)"/) || [])[1];
+  const spinR = (html3.match(/"__spin_r":(\d+)/) || [])[1];
+  const spinT = (html3.match(/"__spin_t":(\d+)/) || [])[1];
+  const rev = (html3.match(/"__rev":(\d+)/) || [])[1] || getFrom3(html3, 'revision":', ",");
+  if (spinB) out.__spin_b = spinB;
+  if (spinR) out.__spin_r = spinR;
+  if (spinT) out.__spin_t = spinT;
+  if (rev) out.__rev = rev;
+  return out;
+}
+function recomputeJazoest(fbDtsg) {
+  let sum = 0;
+  for (let i2 = 0; i2 < fbDtsg.length; i2++) sum += fbDtsg.charCodeAt(i2);
+  return "2" + String(sum);
+}
+function tokenPairFresh(state) {
+  return Boolean(
+    state.lsd && state.fb_dtsg && state.fetchedAt && Date.now() - state.fetchedAt < TOKEN_TTL_MS
+  );
+}
+function htmlOf(res) {
+  if (typeof res === "string") return res;
+  if (res && typeof res.body === "string") return res.body;
+  if (res && res.body != null) return String(res.body);
+  return "";
+}
 async function ensureCometTokens(ctx, defaultFuncs, force = false) {
-  const state = ctx.__cometTokens || (ctx.__cometTokens = {});
-  const fresh = state.fetchedAt && Date.now() - state.fetchedAt < TOKEN_TTL_MS;
-  if (!force && fresh && state.lsd && state.fb_dtsg) {
+  const state = tokenState(ctx);
+  if (!force && tokenPairFresh(state)) {
     ctx.lsd = state.lsd;
     ctx.fb_dtsg = state.fb_dtsg;
     return;
   }
+  if (!force && state.failures > 0) {
+    const backoff = Math.min(1e3 * Math.pow(2, state.failures), MAX_BACKOFF_MS);
+    if (state.attemptedAt && Date.now() - state.attemptedAt < backoff) {
+      if (state.lsd && state.fb_dtsg) {
+        ctx.lsd = state.lsd;
+        ctx.fb_dtsg = state.fb_dtsg;
+      }
+      return;
+    }
+  }
+  state.attemptedAt = Date.now();
   try {
     const res = await defaultFuncs.get("https://www.facebook.com/", ctx.jar);
-    const html3 = typeof res === "string" ? res : res && res.body;
-    if (typeof html3 !== "string") return;
+    const html3 = htmlOf(res);
+    if (!html3) {
+      state.failures++;
+      return;
+    }
     const lsd = extractLsd(html3);
     const dtsg = extractDtsg(html3);
-    if (lsd) state.lsd = lsd;
-    if (dtsg) state.fb_dtsg = dtsg;
+    if (!lsd || !dtsg) {
+      state.failures++;
+      return;
+    }
+    state.lsd = lsd;
+    state.fb_dtsg = dtsg;
     state.fetchedAt = Date.now();
-    if (state.lsd) ctx.lsd = state.lsd;
-    if (state.fb_dtsg) {
-      ctx.fb_dtsg = state.fb_dtsg;
-      if (typeof ctx.jazoest !== "string" || !ctx.jazoest) {
-        let sum = 0;
-        for (let i2 = 0; i2 < ctx.fb_dtsg.length; i2++) sum += ctx.fb_dtsg.charCodeAt(i2);
-        ctx.jazoest = "2" + String(sum);
+    state.failures = 0;
+    const spin = extractSpin(html3);
+    if (Object.keys(spin).length) ctx.__spin = { ...ctx.__spin || {}, ...spin };
+    if (spin.__rev) ctx.revision = spin.__rev;
+    ctx.lsd = lsd;
+    ctx.fb_dtsg = dtsg;
+    ctx.jazoest = recomputeJazoest(dtsg);
+  } catch {
+    state.failures++;
+  }
+}
+function invalidateCometTokens(ctx) {
+  const state = tokenState(ctx);
+  state.lsd = void 0;
+  state.fb_dtsg = void 0;
+  state.fetchedAt = void 0;
+  state.failures = 0;
+  state.attemptedAt = 0;
+  delete ctx.lsd;
+  delete ctx.fb_dtsg;
+}
+function isStaleTokenError(value) {
+  if (value == null) return false;
+  if (typeof value === "number") return STALE_TOKEN_ERRORS.has(value);
+  if (typeof value === "object") {
+    const code = Number(value.error ?? value.code ?? value.errorCode);
+    if (STALE_TOKEN_ERRORS.has(code)) return true;
+    const text3 = String(value.errorDescription || value.errorSummary || value.message || "");
+    return /clos(?:e|ing) (?:and|then) re-?open|invalid document|invalid token|stale token|re-?open your browser/i.test(
+      text3
+    );
+  }
+  return false;
+}
+var LS_DOC_TOKEN_ERRORS = STALE_TOKEN_ERRORS;
+async function withCometTokens(ctx, defaultFuncs, run, options = {}) {
+  const retries = Math.max(1, options.retries ?? 2);
+  let last2;
+  for (let attempt = 0; attempt < retries; attempt++) {
+    await ensureCometTokens(ctx, defaultFuncs, attempt > 0);
+    last2 = await run();
+    if (!isStaleTokenError(last2)) return last2;
+    invalidateCometTokens(ctx);
+  }
+  return last2;
+}
+
+// src/utils/session.ts
+init_safety();
+var SESSION_COOKIE_NAMES = /* @__PURE__ */ new Set([
+  "c_user",
+  "xs",
+  "fr",
+  "datr",
+  "sb",
+  "presence",
+  "wd",
+  "dpr",
+  "locale"
+]);
+var AUTH_ERROR_CODES = /* @__PURE__ */ new Set([
+  1357001,
+  // "Facebook blocked the login"
+  1357002,
+  // not logged in
+  1357031,
+  // document token invalid (treated as auth-adjacent here)
+  1357046,
+  1357036
+]);
+function isCookieJar(jar2) {
+  return Boolean(jar2) && typeof jar2.getCookiesSync === "function";
+}
+function extractCookiesFromJar(jar2) {
+  const out = {};
+  if (!isCookieJar(jar2)) return out;
+  const origins = [
+    "https://www.facebook.com",
+    "https://facebook.com",
+    "https://mbasic.facebook.com",
+    "https://web.facebook.com",
+    "https://www.messenger.com",
+    "https://messenger.com"
+  ];
+  for (const origin2 of origins) {
+    try {
+      const cookies = jar2.getCookiesSync(origin2) || [];
+      for (const cookie of cookies) {
+        const key = cookie && (cookie.key || cookie.name);
+        const value = cookie && cookie.value;
+        if (!key || value == null) continue;
+        if (!(key in out) || /facebook\.com$/.test(cookie.domain || "")) {
+          out[key] = String(value);
+        }
+      }
+    } catch {
+    }
+  }
+  return out;
+}
+function extractCookiesFromSetCookie(header) {
+  const out = {};
+  if (!header) return out;
+  const list = Array.isArray(header) ? header : [String(header)];
+  for (const raw of list) {
+    const parts = String(raw).split(/,(?=\s*[^=;,\s]+\s*=)/);
+    for (const part of parts) {
+      const firstSegment = part.split(";")[0].trim();
+      const eq2 = firstSegment.indexOf("=");
+      if (eq2 <= 0) continue;
+      const name = firstSegment.slice(0, eq2).trim();
+      const value = firstSegment.slice(eq2 + 1).trim();
+      if (name) out[name] = value;
+    }
+  }
+  return out;
+}
+function extractCookiesFromBody(body) {
+  const out = {};
+  if (body == null) return out;
+  const text3 = typeof body === "string" ? body : JSON.stringify(body);
+  if (!text3) return out;
+  const re = /(?:document\.cookie\s*=\s*|setCookie\(\s*)["'\\]*([A-Za-z0-9_]+)=([^"';\s\\]+)/g;
+  let match;
+  while ((match = re.exec(text3)) !== null) {
+    out[match[1]] = match[2];
+  }
+  return out;
+}
+function extractCookies(sources) {
+  const merged = {};
+  const seen = [];
+  const fromJar = extractCookiesFromJar(sources.jar);
+  if (Object.keys(fromJar).length) {
+    Object.assign(merged, fromJar);
+    seen.push("jar");
+  }
+  const fromHeader = extractCookiesFromSetCookie(sources.setCookie);
+  if (Object.keys(fromHeader).length) {
+    Object.assign(merged, fromHeader);
+    seen.push("set-cookie");
+  }
+  const fromBody = extractCookiesFromBody(sources.body);
+  if (Object.keys(fromBody).length) {
+    Object.assign(merged, fromBody);
+    seen.push("body");
+  }
+  return { cookies: merged, count: Object.keys(merged).length, sources: seen };
+}
+function applySetCookie(jar2, header) {
+  if (!isCookieJar(jar2) || !header) return 0;
+  const list = Array.isArray(header) ? header : [String(header)];
+  let applied = 0;
+  for (const raw of list) {
+    if (!raw || typeof raw !== "string") continue;
+    try {
+      jar2.setCookieSync(raw, "https://www.facebook.com");
+      applied++;
+    } catch {
+      try {
+        const normalized = raw.replace(/domain=\.?facebook\.com/i, "Domain=.facebook.com").replace(/;\s*$/, "");
+        jar2.setCookieSync(normalized, "https://www.facebook.com");
+        applied++;
+      } catch {
+      }
+    }
+    if (/domain=\.?facebook\.com/i.test(raw)) {
+      try {
+        jar2.setCookieSync(raw.replace(/domain=\.?facebook\.com/i, "domain=.messenger.com"), "https://www.messenger.com");
+      } catch {
       }
     }
+  }
+  return applied;
+}
+function hasAuthenticatedSession(jar2) {
+  const cookies = extractCookiesFromJar(jar2);
+  return Boolean(cookies.c_user && (cookies.xs || cookies.fr));
+}
+function collectSessionCookies(ctx, host) {
+  const origins = /* @__PURE__ */ new Set([
+    "https://www.facebook.com",
+    "https://facebook.com",
+    "https://web.facebook.com",
+    "https://mbasic.facebook.com",
+    "https://www.messenger.com",
+    "https://messenger.com",
+    "https://edge-chat.messenger.com",
+    "https://gateway.facebook.com"
+  ]);
+  if (host) {
+    try {
+      origins.add(new URL(host).origin);
+    } catch {
+    }
+  }
+  const seen = {};
+  const parts = [];
+  for (const origin2 of origins) {
+    let list = [];
+    try {
+      list = ctx?.jar?.getCookiesSync(origin2) || [];
+    } catch {
+      list = [];
+    }
+    for (const cookie of list) {
+      const name = cookie?.key || cookie?.name;
+      if (!name || seen[name]) continue;
+      seen[name] = true;
+      try {
+        parts.push(cookie.cookieString ? cookie.cookieString() : `${name}=${cookie.value}`);
+      } catch {
+        parts.push(`${name}=${cookie.value}`);
+      }
+    }
+  }
+  return parts.join("; ");
+}
+function missingSessionCookies(jar2) {
+  const cookies = extractCookiesFromJar(jar2);
+  const missing = [];
+  if (!cookies.c_user) missing.push("c_user");
+  if (!cookies.xs) missing.push("xs");
+  if (!cookies.fr) missing.push("fr");
+  if (!cookies.datr) missing.push("datr");
+  return missing;
+}
+function defaultFuncsGet(defaultFuncs, url2, jar2) {
+  return defaultFuncs.get(url2, jar2);
+}
+async function refreshSessionCookies(ctx, defaultFuncs, options = {}) {
+  const surfaces = options.surfaces || [
+    "https://www.facebook.com/",
+    "https://www.messenger.com/"
+  ];
+  let applied = 0;
+  const errors = [];
+  for (const url2 of surfaces) {
+    try {
+      const res = await defaultFuncsGet(defaultFuncs, url2, ctx.jar);
+      const headers = res && res.headers || {};
+      const setCookie = headers["set-cookie"] || headers["Set-Cookie"];
+      applied += applySetCookie(ctx.jar, setCookie);
+      const embedded = extractCookiesFromBody(res && (res.body ?? res));
+      for (const [name, value] of Object.entries(embedded)) {
+        try {
+          ctx.jar.setCookieSync(`${name}=${value}; domain=.facebook.com; path=/; Secure; SameSite=None`, "https://www.facebook.com");
+          applied++;
+        } catch {
+        }
+      }
+      if (typeof res?.body === "string" && res.body.includes("DTSGInitialData")) {
+        invalidateCometTokens(ctx);
+      }
+    } catch (error2) {
+      errors.push(`${url2}: ${error2 && (error2.message || error2.error || error2)}`);
+    }
+  }
+  const extracted = extractCookies({ jar: ctx.jar });
+  const authenticated = hasAuthenticatedSession(ctx.jar);
+  if (applied > 0) ctx.__lastCookieRefreshAt = Date.now();
+  return { ...extracted, applied, authenticated, errors };
+}
+function isAuthFailure(value) {
+  if (value == null) return false;
+  if (typeof value === "number") return AUTH_ERROR_CODES.has(value);
+  if (typeof value === "object") {
+    const code = Number(value.error ?? value.code ?? value.errorCode ?? value.statusCode);
+    if (AUTH_ERROR_CODES.has(code)) return true;
+    const text3 = String(value.error || value.message || value.errorDescription || "");
+    return /not logged in|blocked the login|session (?:has )?expired|requires_reauth|please log in again/i.test(text3);
+  }
+  return false;
+}
+async function withSessionRetry(ctx, defaultFuncs, operation, options = {}) {
+  const attempts = Math.max(1, options.attempts ?? 2);
+  let lastError;
+  for (let i2 = 0; i2 < attempts; i2++) {
+    try {
+      const result = await operation();
+      if (isAuthFailure(result)) {
+        lastError = result;
+        noteAuthFailure(ctx);
+        if (i2 === attempts - 1) throw result;
+        if (options.onRecover) options.onRecover({ attempt: i2 + 1, error: result });
+        await repairSession(ctx, defaultFuncs);
+        continue;
+      }
+      resetBreaker(ctx);
+      return result;
+    } catch (error2) {
+      lastError = error2;
+      if (!isAuthFailure(error2) || i2 === attempts - 1) throw error2;
+      noteAuthFailure(ctx);
+      if (options.onRecover) options.onRecover({ attempt: i2 + 1, error: error2 });
+      await repairSession(ctx, defaultFuncs);
+    }
+  }
+  throw lastError || new Error("Operation failed after session retries.");
+}
+async function repairSession(ctx, defaultFuncs) {
+  invalidateCometTokens(ctx);
+  let ok = false;
+  try {
+    const refresh = await refreshSessionCookies(ctx, defaultFuncs);
+    ok = refresh.authenticated;
   } catch {
+    ok = false;
   }
+  if (typeof ctx.__resetMqttBackoff === "function") {
+    try {
+      ctx.__resetMqttBackoff();
+    } catch {
+    }
+  }
+  return ok;
+}
+function scheduleSessionKeepAlive(ctx, defaultFuncs, intervalMs = 15 * 60 * 1e3) {
+  if (ctx.__cookieKeepAliveTimer) {
+    clearInterval(ctx.__cookieKeepAliveTimer);
+    ctx.__cookieKeepAliveTimer = null;
+  }
+  const jitter = () => intervalMs * (0.85 + Math.random() * 0.3);
+  let stopped = false;
+  const tick = async () => {
+    if (stopped || ctx.loggedIn === false) return;
+    try {
+      await refreshSessionCookies(ctx, defaultFuncs);
+    } catch {
+    } finally {
+      if (!stopped) ctx.__cookieKeepAliveTimer = setTimeout(tick, jitter());
+    }
+  };
+  ctx.__cookieKeepAliveTimer = setTimeout(tick, jitter());
+  return () => {
+    stopped = true;
+    if (ctx.__cookieKeepAliveTimer) {
+      clearTimeout(ctx.__cookieKeepAliveTimer);
+      ctx.__cookieKeepAliveTimer = null;
+    }
+  };
+}
+
+// src/utils/index.ts
+init_pacing();
+
+// src/utils/warmup.ts
+init_pacing();
+var SURFACES = [
+  "https://www.facebook.com/",
+  "https://www.facebook.com/messages/t/",
+  "https://www.messenger.com/"
+];
+async function warmUpSession(ctx, getter, options = {}) {
+  const visited = [];
+  const errors = [];
+  let cookiesApplied = 0;
+  let tokensSeeded = false;
+  if (!hasAuthenticatedSession(ctx.jar)) {
+    return { visited, cookiesApplied, authenticated: false, tokensSeeded, errors: ["no authenticated session cookies"] };
+  }
+  const surfaces = options.includeMessenger === false ? SURFACES.slice(0, 2) : SURFACES;
+  for (const url2 of surfaces) {
+    try {
+      const res = await getter(url2, ctx.jar, null, ctx.globalOptions, ctx, { noRef: true });
+      visited.push(url2);
+      const headers = res && res.headers || {};
+      cookiesApplied += applySetCookie(ctx.jar, headers["set-cookie"] || headers["Set-Cookie"]);
+      const html3 = typeof res === "string" ? res : res && res.body;
+      if (typeof html3 === "string" && html3.includes("DTSGInitialData")) {
+        const lsd = extractLsd(html3);
+        const dtsg = extractDtsg(html3);
+        if (lsd && dtsg) {
+          ctx.__cometTokens = { lsd, fb_dtsg: dtsg, fetchedAt: Date.now(), failures: 0 };
+          ctx.lsd = lsd;
+          ctx.fb_dtsg = dtsg;
+          ctx.jazoest = "2" + Array.from(dtsg).reduce((a, b) => a + b.charCodeAt(0), 0);
+          const spin = extractSpin(html3);
+          if (Object.keys(spin).length) ctx.__spin = { ...ctx.__spin || {}, ...spin };
+          if (spin.__rev) ctx.revision = spin.__rev;
+          tokensSeeded = true;
+        }
+      } else if (url2.includes("/messages")) {
+        invalidateCometTokens(ctx);
+      }
+      await sleep(humanDelay(650, 420));
+    } catch (error2) {
+      errors.push(`${url2}: ${error2 && (error2.message || error2.error || error2)}`);
+    }
+  }
+  const extracted = extractCookies({ jar: ctx.jar });
+  return {
+    visited,
+    cookiesApplied,
+    authenticated: hasAuthenticatedSession(ctx.jar),
+    tokensSeeded,
+    errors: [...errors, ...extracted.count ? [] : ["no cookies extracted"]]
+  };
+}
+
+// src/utils/index.ts
+init_safety();
+
+// src/utils/liveness.ts
+init_pacing();
+init_safety();
+var ACTIVE_MIN_MS = 6 * 60 * 1e3;
+var ACTIVE_MAX_MS = 14 * 60 * 1e3;
+var IDLE_MIN_MS = 2 * 60 * 1e3;
+var IDLE_MAX_MS = 7 * 60 * 1e3;
+function randBetween(min, max) {
+  return Math.floor(min + Math.random() * (max - min));
+}
+function startLiveness(ctx, options = {}) {
+  if (ctx.__livenessStop) {
+    try {
+      ctx.__livenessStop();
+    } catch {
+    }
+  }
+  ctx.__requestsPaced = ctx.__requestsPaced || 0;
+  let stopped = false;
+  let active = true;
+  let nextAt = Date.now() + randBetween(ACTIVE_MIN_MS, ACTIVE_MAX_MS);
+  let timer = null;
+  ctx.__foreground = true;
+  const schedule = () => {
+    if (stopped) return;
+    const wait = Math.max(1e3, nextAt - Date.now());
+    timer = setTimeout(tick, wait);
+    if (timer && typeof timer.unref === "function") timer.unref();
+  };
+  const tick = () => {
+    if (stopped) return;
+    active = !active;
+    ctx.__foreground = active ? !!ctx.globalOptions?.online : false;
+    try {
+      if (active) options.foregroundPing?.();
+      else options.backgroundPing?.();
+    } catch {
+    }
+    nextAt = Date.now() + (active ? randBetween(ACTIVE_MIN_MS, ACTIVE_MAX_MS) : randBetween(IDLE_MIN_MS, IDLE_MAX_MS));
+    schedule();
+  };
+  schedule();
+  const stop = () => {
+    stopped = true;
+    if (timer) {
+      clearTimeout(timer);
+      timer = null;
+    }
+    ctx.__livenessStop = null;
+  };
+  ctx.__livenessStop = stop;
+  return {
+    stop,
+    state: () => ({
+      active,
+      nextTransitionMs: Math.max(0, nextAt - Date.now()),
+      requests: ctx.__requestsPaced || 0,
+      breakerOpen: isBreakerOpen(ctx)
+    })
+  };
+}
+function canActProactively(ctx) {
+  if (isBreakerOpen(ctx)) return false;
+  if (ctx.__foreground === false) return false;
+  return true;
+}
+async function awaitProactiveSlot(ctx, maxWaitMs = 15 * 60 * 1e3) {
+  const deadline = Date.now() + maxWaitMs;
+  while (Date.now() < deadline) {
+    if (canActProactively(ctx)) return true;
+    await sleep(humanDelay(4e3, 3e3));
+  }
+  return false;
 }
 
 // src/utils/index.ts
@@ -90569,19 +91561,32 @@ async function json2(url2, jar2, qs2, options, ctx, customHeader) {
   }
 }
 function makeDefaults(html3, userID, ctx) {
-  let reqCounter = 1;
   const revision = getFrom(html3, 'revision":', ",");
   function mergeWithDefaults(obj) {
+    const reqId = (() => {
+      ctx.__reqCounter = (typeof ctx.__reqCounter === "number" ? ctx.__reqCounter : 0) + 1;
+      return ctx.__reqCounter.toString(36);
+    })();
+    const spin = ctx.__spin || {};
     const newObj = {
       av: userID,
       __user: userID,
-      __req: (reqCounter++).toString(36),
-      __rev: revision,
+      __req: reqId,
+      __rev: ctx.revision || revision,
       __a: 1,
       ...ctx && {
         fb_dtsg: ctx.fb_dtsg,
         jazoest: ctx.jazoest
-      }
+      },
+      // The Comet document token and its spin siblings gate GraphQL; include
+      // them whenever they are known so no module has to remember.
+      ...ctx && ctx.lsd ? { lsd: ctx.lsd } : {},
+      ...spin.__spin_b ? { __spin_b: spin.__spin_b } : {},
+      ...spin.__spin_r ? { __spin_r: spin.__spin_r } : {},
+      ...spin.__spin_t ? { __spin_t: spin.__spin_t } : {},
+      // Device pixel ratio must match the Client Hints profile the headers
+      // advertise, otherwise the form and the headers disagree.
+      ...getFingerprintParams(ctx?.globalOptions)
     };
     if (!obj) return newObj;
     for (const prop2 in obj) {
@@ -90592,13 +91597,18 @@ function makeDefaults(html3, userID, ctx) {
     return newObj;
   }
   return {
-    get: (url2, jar2, qs2, ctxx, customHeader = {}) => get(url2, jar2, mergeWithDefaults(qs2), ctx.globalOptions, ctxx || ctx, customHeader),
+    // GET carries only caller-supplied query parameters. The shared form
+    // defaults (av/__user/fb_dtsg/jazoest/lsd/…) are a POST body and must never
+    // be appended to a document URL: Facebook treats a document GET that
+    // carries form state as an AJAX call and answers with a 1357004 JSON error
+    // instead of the page, which is exactly the "stale token" symptom.
+    get: (url2, jar2, qs2, ctxx, customHeader = {}) => get(url2, jar2, qs2, ctx.globalOptions, ctxx || ctx, customHeader),
     post: (url2, jar2, form, ctxx, customHeader = {}) => post(url2, jar2, mergeWithDefaults(form), ctx.globalOptions, ctxx || ctx, customHeader),
     postFormData: (url2, jar2, form, qs2, ctxx, customHeader) => postFormData(
       url2,
       jar2,
       mergeWithDefaults(form),
-      mergeWithDefaults(qs2),
+      qs2,
       ctx.globalOptions,
       ctxx || ctx,
       customHeader
@@ -90622,7 +91632,19 @@ async function setOptions(globalOptions, options = {}) {
     listenEvents: (value) => globalOptions.listenEvents = Boolean(value),
     updatePresence: (value) => globalOptions.updatePresence = Boolean(value),
     forceLogin: (value) => globalOptions.forceLogin = Boolean(value),
-    userAgent: (value) => globalOptions.userAgent = value,
+    userAgent: (value) => {
+      globalOptions.userAgent = value;
+      globalOptions.browser = normalizeBrowserProfile({
+        ...globalOptions.browser || defaultBrowserProfile,
+        userAgent: value
+      });
+    },
+    browser: (value) => {
+      if (!value || typeof value !== "object") return;
+      const profile = normalizeBrowserProfile(value);
+      globalOptions.browser = profile;
+      globalOptions.userAgent = profile.userAgent;
+    },
     autoMarkDelivery: (value) => globalOptions.autoMarkDelivery = Boolean(value),
     autoMarkRead: (value) => globalOptions.autoMarkRead = Boolean(value),
     listenTyping: (value) => globalOptions.listenTyping = Boolean(value),
@@ -90640,8 +91662,9 @@ async function setOptions(globalOptions, options = {}) {
     randomUserAgent(value) {
       globalOptions.randomUserAgent = Boolean(value);
       if (value) {
-        const ua = randomUserAgent();
-        globalOptions.userAgent = ua.userAgent;
+        const profile = randomUserAgent();
+        globalOptions.browser = profile;
+        globalOptions.userAgent = profile.userAgent;
       }
     },
     bypassRegion(value) {
@@ -90659,7 +91682,20 @@ async function setOptions(globalOptions, options = {}) {
 // src/core/models/buildAPI.ts
 async function buildAPI(html3, jar2, netData, globalOptions, fbLinkFunc, errorRetrievingMsg) {
   const userID = (() => {
-    const cookies = jar2.getCookiesSync(fbLinkFunc());
+    const origins = [
+      "https://www.facebook.com",
+      "https://facebook.com",
+      "https://web.facebook.com",
+      "https://mbasic.facebook.com",
+      "https://www.messenger.com"
+    ];
+    let cookies = [];
+    for (const origin2 of origins) {
+      try {
+        cookies = cookies.concat(jar2.getCookiesSync(origin2) || []);
+      } catch {
+      }
+    }
     const primaryProfile = cookies.find(
       (val2) => val2.cookieString().startsWith("c_user=")
     );
@@ -90667,6 +91703,13 @@ async function buildAPI(html3, jar2, netData, globalOptions, fbLinkFunc, errorRe
       (val2) => val2.cookieString().startsWith("i_user=")
     );
     if (!primaryProfile && !secondaryProfile) {
+      const hasXs = cookies.some((val2) => val2.cookieString().startsWith("xs="));
+      const hasDatr = cookies.some((val2) => val2.cookieString().startsWith("datr="));
+      if (hasXs || hasDatr) {
+        throw new Error(
+          "Facebook session expired or invalid (cookies present but no c_user). Export a fresh appState from a logged-in browser and try again."
+        );
+      }
       throw new Error(errorRetrievingMsg);
     }
     return secondaryProfile?.cookieString().split("=")[1] || primaryProfile.cookieString().split("=")[1];
@@ -90691,7 +91734,7 @@ async function buildAPI(html3, jar2, netData, globalOptions, fbLinkFunc, errorRe
     return null;
   };
   const dtsgData = findConfig("DTSGInitialData");
-  const dtsg = dtsgData ? dtsgData.token : getFrom(html3, '"token":"', '"');
+  const dtsg = dtsgData ? dtsgData.token : extractDtsg(html3) || getFrom(html3, '"token":"', '"');
   if (typeof dtsg !== "string" || dtsg.length === 0) {
     throw new Error("Unable to retrieve Facebook form security token (fb_dtsg).");
   }
@@ -90702,6 +91745,10 @@ async function buildAPI(html3, jar2, netData, globalOptions, fbLinkFunc, errorRe
       0
     )}`
   };
+  const lsdConfig = findConfig("LSD");
+  const lsd = lsdConfig && lsdConfig.token || extractLsd(html3) || void 0;
+  const spin = extractSpin(html3);
+  const revision = spin.__rev || getFrom(html3, 'revision":', ",").trim();
   const clientIDData = findConfig("MqttWebDeviceID");
   const clientID = clientIDData ? clientIDData.clientID : void 0;
   const mqttConfigData = findConfig("MqttWebConfig");
@@ -90740,8 +91787,14 @@ async function buildAPI(html3, jar2, netData, globalOptions, fbLinkFunc, errorRe
     callback_Task: {},
     region,
     firstListen: true,
-    ...dtsgResult
+    ...dtsgResult,
+    ...lsd ? { lsd } : {},
+    ...Object.keys(spin).length ? { __spin: spin } : {},
+    ...revision ? { revision } : {}
   };
+  if (lsd && dtsg) {
+    ctx.__cometTokens = { lsd, fb_dtsg: dtsg, fetchedAt: Date.now(), failures: 0 };
+  }
   const defaultFuncs = makeDefaults(html3, userID, ctx);
   return [ctx, defaultFuncs, {}];
 }
@@ -91015,29 +92068,78 @@ var getBotInitialData_default = (defaultFuncs, api, ctx) => {
       };
     }
     log("Fetching account info...");
-    api.httpGet(`https://www.facebook.com/profile.php?id=${ctx.userID}`, null, {
-      customUserAgent: windowsUserAgent
-    }, (err, data2) => {
-      if (err) return callback(err);
-      try {
-        const profileMatch = data2.match(/"CurrentUserInitialData",\[\],\{(.*?)\},(.*?)\]/);
-        if (profileMatch && profileMatch[1]) {
-          const accountJson = JSON.parse(`{${profileMatch[1]}}`);
-          accountJson.name = accountJson.NAME;
-          accountJson.uid = accountJson.USER_ID;
-          delete accountJson.NAME;
-          delete accountJson.USER_ID;
+    const locale = (ctx.globalOptions?.browser?.language || "en-US").replace("-", "_");
+    const url2 = `https://www.facebook.com/profile.php?id=${ctx.userID}&sk=about&locale=${locale}`;
+    api.httpGet(
+      url2,
+      null,
+      {},
+      (err, data2) => {
+        if (err) return callback(err);
+        try {
+          const accountJson = extractCurrentUser(data2);
+          if (accountJson) {
+            return callback(null, {
+              ...accountJson,
+              name: accountJson.NAME ?? accountJson.name,
+              uid: accountJson.USER_ID ?? accountJson.userID ?? ctx.userID
+            });
+          }
           return callback(null, {
-            ...accountJson
+            error: "Something went wrong. Maybe its possible that it has a limitation due to spam requests. You can try again later."
           });
-        } else return callback(null, { error: "Something went wrong. Maybe its possible that it has a limitation due to spam requests. You can try again later." });
-      } catch (e) {
-        return callback(e);
-      }
-    }, true);
+        } catch (e) {
+          return callback(e);
+        }
+      },
+      true
+    );
     return returnPromise;
   };
 };
+function extractCurrentUser(html3) {
+  if (typeof html3 !== "string") return null;
+  const marker = '"CurrentUserInitialData",[],';
+  const markerIndex = html3.indexOf(marker);
+  const anchor = markerIndex >= 0 ? markerIndex + marker.length : html3.indexOf('"CurrentUserInitialData"');
+  if (anchor < 0) return null;
+  const start = html3.indexOf("{", anchor);
+  if (start < 0) return null;
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+  for (let i2 = start; i2 < html3.length; i2++) {
+    const ch = html3[i2];
+    if (inString) {
+      if (escaped) {
+        escaped = false;
+      } else if (ch === "\\") {
+        escaped = true;
+      } else if (ch === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+    } else if (ch === "{") {
+      depth++;
+    } else if (ch === "}") {
+      depth--;
+      if (depth === 0) {
+        try {
+          const parsed = JSON.parse(html3.slice(start, i2 + 1));
+          parsed.name = parsed.NAME;
+          parsed.uid = parsed.USER_ID;
+          return parsed;
+        } catch {
+          return null;
+        }
+      }
+    }
+  }
+  return null;
+}
 
 // src/deltas/apis/login/logout.ts
 function logout_default(defaultFuncs, api, ctx) {
@@ -91047,6 +92149,13 @@ function logout_default(defaultFuncs, api, ctx) {
       if (ctx.globalOptions) {
         ctx.globalOptions.autoReconnect = false;
       }
+      if (typeof ctx.__stopCookieKeepAlive === "function") {
+        try {
+          ctx.__stopCookieKeepAlive();
+        } catch {
+        }
+        ctx.__stopCookieKeepAlive = null;
+      }
       if (ctx.presenceInterval) {
         clearInterval(ctx.presenceInterval);
         ctx.presenceInterval = null;
@@ -93156,6 +94265,10 @@ function collectTracks(payload) {
 }
 
 // src/deltas/apis/music/searchMusic.ts
+function nextRequestId(ctx) {
+  ctx.__reqCounter = (typeof ctx.__reqCounter === "number" ? ctx.__reqCounter : 0) + 1;
+  return ctx.__reqCounter.toString(36);
+}
 function normalizeError(error2) {
   if (!error2 || typeof error2 !== "object") {
     const message2 = String(error2);
@@ -93177,32 +94290,53 @@ function normalizeError(error2) {
 }
 function searchMusic_default(defaultFuncs, _api, ctx) {
   async function runSearch(text3, count, selectedOptions, callback) {
-    await ensureCometTokens(ctx, defaultFuncs);
     const params = { first: count };
     if (text3) params.search_text = text3;
     if (selectedOptions.cursor) params.after = String(selectedOptions.cursor);
-    const form = {
-      av: ctx.userID,
-      __user: ctx.userID,
-      __a: "1",
-      __req: Math.floor(Math.random() * 1296).toString(36),
-      fb_api_caller_class: "RelayModern",
-      fb_api_req_friendly_name: SEARCH_FRIENDLY_NAME,
-      doc_id: SEARCH_DOC_ID,
-      variables: JSON.stringify({
-        params,
-        product: selectedOptions.product || PRODUCT
-      }),
-      server_timestamps: "true"
-    };
-    if (ctx.fb_dtsg) form.fb_dtsg = ctx.fb_dtsg;
-    if (ctx.jazoest) form.jazoest = ctx.jazoest;
-    if (ctx.lsd) form.lsd = ctx.lsd;
-    const customHeader = {};
-    if (ctx.lsd) customHeader["X-Fb-Lsd"] = ctx.lsd;
-    customHeader["X-Fb-Friendly-Name"] = SEARCH_FRIENDLY_NAME;
-    const parsed = await defaultFuncs.post(GRAPHQL_URL, ctx.jar, form, {}, ctx, customHeader).then(parseAndCheckLogin(ctx, defaultFuncs));
+    const attempt = async (forceRefresh) => {
+      await ensureCometTokens(ctx, defaultFuncs, forceRefresh);
+      const form = {
+        av: ctx.userID,
+        __user: ctx.userID,
+        __a: "1",
+        __req: nextRequestId(ctx),
+        fb_api_caller_class: "RelayModern",
+        fb_api_req_friendly_name: SEARCH_FRIENDLY_NAME,
+        doc_id: SEARCH_DOC_ID,
+        variables: JSON.stringify({
+          params,
+          product: selectedOptions.product || PRODUCT
+        }),
+        server_timestamps: "true"
+      };
+      if (ctx.fb_dtsg) form.fb_dtsg = ctx.fb_dtsg;
+      if (ctx.jazoest) form.jazoest = ctx.jazoest;
+      if (ctx.lsd) form.lsd = ctx.lsd;
+      const spin = ctx.__spin || {};
+      if (spin.__spin_b) form.__spin_b = spin.__spin_b;
+      if (spin.__spin_r) form.__spin_r = spin.__spin_r;
+      if (spin.__spin_t) form.__spin_t = spin.__spin_t;
+      if (ctx.revision) form.__rev = ctx.revision;
+      const customHeader = {};
+      if (ctx.lsd) customHeader["X-Fb-Lsd"] = ctx.lsd;
+      customHeader["X-Fb-Friendly-Name"] = SEARCH_FRIENDLY_NAME;
+      const raw = await defaultFuncs.post(GRAPHQL_URL, ctx.jar, form, ctx, customHeader).then(parseAndCheckLogin(ctx, defaultFuncs));
+      return raw;
+    };
+    let parsed = await attempt(false);
+    if (isStaleTokenError(parsed)) {
+      invalidateCometTokens(ctx);
+      parsed = await attempt(true);
+    }
     if (!parsed) throw { error: "searchMusic returned empty object.", code: "BAD_RESPONSE" };
+    if (isStaleTokenError(parsed)) {
+      throw {
+        error: parsed.error,
+        errorSummary: parsed.errorSummary,
+        errorDescription: parsed.errorDescription,
+        code: "STALE_TOKEN"
+      };
+    }
     if (parsed.error) {
       throw {
         error: parsed.error,
@@ -93224,6 +94358,20 @@ function searchMusic_default(defaultFuncs, _api, ctx) {
     const page = collectTracks(parsed);
     const tracks = page.tracks.slice(0, count);
     if (tracks.length === 0) {
+      invalidateCometTokens(ctx);
+      const retried = await attempt(true);
+      if (!isStaleTokenError(retried) && !retried.error && !(retried.errors || []).length) {
+        const retryPage = collectTracks(retried);
+        const retryTracks = retryPage.tracks.slice(0, count);
+        if (retryTracks.length) {
+          const result2 = retryTracks.slice();
+          result2.tracks = retryTracks;
+          result2.endCursor = retryPage.endCursor;
+          result2.hasNextPage = retryPage.hasNextPage;
+          result2.query = text3;
+          return result2;
+        }
+      }
       throw {
         error: `No music results found for "${text3}". The Facebook music catalog may be unavailable for this account or region.`,
         code: "NO_RESULTS",
@@ -93507,8 +94655,9 @@ function connectLightspeed(ctx, globalCallback) {
     const chatOn = ctx.globalOptions.online;
     const foreground = false;
     const sessionID = Math.floor(Math.random() * Number.MAX_SAFE_INTEGER) + 1;
-    const cookies = ctx.jar.getCookiesSync("https://www.facebook.com").join("; ");
+    const cookies = collectSessionCookies(ctx, "https://gateway.facebook.com");
     const cid = ctx.clientID;
+    const appId = ctx.mqttAppID || ctx.appID || "2220391788200892";
     const username = {
       u: ctx.userID,
       s: sessionID,
@@ -93516,7 +94665,7 @@ function connectLightspeed(ctx, globalCallback) {
       fg: foreground,
       d: cid,
       ct: "websocket",
-      aid: "2220391788200892",
+      aid: appId,
       mqtt_sid: "",
       cp: 3,
       ecp: 10,
@@ -93526,10 +94675,12 @@ function connectLightspeed(ctx, globalCallback) {
       no_auto_fg: true,
       gas: null,
       pack: [],
-      a: ctx.globalOptions.userAgent
+      a: ctx.globalOptions.userAgent || defaultBrowserProfile.userAgent,
+      vi: "3",
+      lc: "en_US"
     };
     const queryParams = new URLSearchParams({
-      "x-dgw-appid": "2220391788200892",
+      "x-dgw-appid": appId,
       "x-dgw-appversion": "0",
       "x-dgw-authtype": "1:0",
       "x-dgw-version": "5",
@@ -93540,6 +94691,7 @@ function connectLightspeed(ctx, globalCallback) {
       "x-dgw-deviceid": ctx.clientID
     });
     const host = `wss://gateway.facebook.com/ws/lightspeed?${queryParams.toString()}`;
+    const wsHeaders = getWebSocketHeaders(host, ctx.globalOptions);
     const options = {
       clientId: "mqttwsclient",
       protocolId: "MQIsdp",
@@ -93547,15 +94699,12 @@ function connectLightspeed(ctx, globalCallback) {
       username: JSON.stringify(username),
       clean: true,
       wsOptions: {
-        headers: {
-          "Cookie": cookies,
-          "Origin": "https://www.facebook.com",
-          "User-Agent": username.a,
-          "Referer": "https://www.facebook.com/",
-          "Host": new URL(host).hostname
-        }
+        headers: { ...wsHeaders, Cookie: cookies },
+        origin: wsHeaders.Origin,
+        protocolVersion: 13,
+        binaryType: "arraybuffer"
       },
-      keepalive: 10,
+      keepalive: 10 + Math.floor(Math.random() * 10),
       reconnectPeriod: 0
     };
     if (ctx.globalOptions.proxy) {
@@ -93607,9 +94756,9 @@ function connectLightspeed(ctx, globalCallback) {
   }
   function reconnect(retryCount) {
     if (isStopped || reconnectTimer || ctx.loggedIn === false || ctx.globalOptions.autoReconnect === false) return;
-    const delay3 = Math.min(3e3 * Math.pow(2, retryCount), 6e4);
-    log(`[Lightspeed] Reconnecting in ${delay3 / 1e3} seconds...`);
-    reconnectTimer = setTimeout(() => startConnection(retryCount), delay3);
+    const delay3 = retryDelay(retryCount, 4e3, 12e4);
+    log(`[Lightspeed] Reconnecting in ${(delay3 / 1e3).toFixed(1)} seconds...`);
+    reconnectTimer = setTimeout(() => startConnection(retryCount + 1), delay3);
   }
   startConnection();
   return {
@@ -98633,11 +99782,15 @@ function themeQuery_default(defaultFuncs, _api, ctx) {
       doc_id: "24474714052117636"
     };
     const referer = threadID ? `https://www.facebook.com/messages/t/${threadID}` : "https://www.facebook.com/messages";
-    const resData = await defaultFuncs.post("https://www.facebook.com/api/graphql/", ctx.jar, form, null, {
-      "x-fb-friendly-name": "MWPThreadThemeQuery_AllThemesQuery",
-      "x-fb-lsd": ctx.lsd,
-      referer
-    }).then(parseAndCheckLogin(ctx, defaultFuncs));
+    const resData = await withCometTokens(
+      ctx,
+      defaultFuncs,
+      () => defaultFuncs.post("https://www.facebook.com/api/graphql/", ctx.jar, form, null, {
+        "x-fb-friendly-name": "MWPThreadThemeQuery_AllThemesQuery",
+        "x-fb-lsd": ctx.lsd,
+        referer
+      }).then(parseAndCheckLogin(ctx, defaultFuncs))
+    );
     if (resData?.errors) {
       throw new Error(JSON.stringify(resData.errors));
     }
@@ -98678,6 +99831,7 @@ function getHealthStatus_default(_defaultFuncs, _api, ctx) {
   return function getHealthStatus() {
     const mqtt3 = ctx.mqttClient;
     const connected = !!mqtt3 && (typeof mqtt3.connected === "boolean" ? mqtt3.connected : mqtt3.readyState === 1 || !!(mqtt3.stream && !mqtt3.stream.destroyed));
+    const safety = typeof ctx.__safetySnapshot === "function" ? ctx.__safetySnapshot() : null;
     return {
       userID: ctx.userID || null,
       loggedIn: !!ctx.userID,
@@ -98688,8 +99842,13 @@ function getHealthStatus_default(_defaultFuncs, _api, ctx) {
         lastMessageAt: ctx.__mqttLastMessageAt || null
       },
       antiSuspension: {
-        enabled: false,
-        circuitBreakerOpen: false
+        enabled: true,
+        // The breaker is open when Facebook has signalled it is unhappy and
+        // the session is deliberately pausing rather than risking a lockdown.
+        circuitBreakerOpen: safety ? !safety.closed : false,
+        reason: safety ? safety.reason : void 0,
+        cooldownRemainingMs: safety ? safety.cooldownRemainingMs : 0,
+        requestsInWindow: safety ? safety.requestsInWindow : 0
       },
       uptimeMs: typeof ctx.__startedAt === "number" ? Date.now() - ctx.__startedAt : null,
       timestamp: Date.now()
@@ -98750,7 +99909,6 @@ function getFriendsList_default(defaultFuncs, api, ctx) {
 
 // src/deltas/apis/mqtt/realtime.ts
 var import_undici = __toESM(require_undici());
-var import_https_proxy_agent3 = __toESM(require_dist3());
 function formatNotification(data2) {
   if (!data2.data || !data2.data.viewer) return null;
   const notifEdge = data2.data.viewer.notifications_page?.edges?.[1]?.node?.notif;
@@ -98765,6 +99923,31 @@ function formatNotification(data2) {
     seenState: notifEdge.seen_state
   };
 }
+function collectRealtimeCookies(ctx) {
+  const origins = [
+    "https://www.facebook.com",
+    "https://facebook.com",
+    "https://www.messenger.com",
+    "https://gateway.facebook.com"
+  ];
+  const seen = {};
+  const parts = [];
+  for (const origin2 of origins) {
+    let list = [];
+    try {
+      list = ctx.jar.getCookiesSync(origin2) || [];
+    } catch {
+      list = [];
+    }
+    for (const cookie of list) {
+      const name = cookie?.key;
+      if (!name || seen[name]) continue;
+      seen[name] = true;
+      parts.push(cookie.cookieString());
+    }
+  }
+  return parts.join("; ");
+}
 function realtime_default(defaultFuncs, api, ctx) {
   return function listenRealtime() {
     const emitter = new EventEmitter2();
@@ -98772,6 +99955,7 @@ function realtime_default(defaultFuncs, api, ctx) {
     let reconnectTimeout;
     let keepAliveInterval;
     let stopped = false;
+    let retries = 0;
     const subscriptions = [
       '{"x-dgw-app-XRSS-method":"Falco","x-dgw-app-xrs-body":"true","x-dgw-app-XRS-Accept-Ack":"RSAck","x-dgw-app-XRSS-http_referer":"https://www.facebook.com/friends"}',
       '{"x-dgw-app-XRSS-method":"FBGQLS:USER_ACTIVITY_UPDATE_SUBSCRIBE","x-dgw-app-XRSS-doc_id":"9525970914181809","x-dgw-app-XRSS-routing_hint":"UserActivitySubscription","x-dgw-app-xrs-body":"true","x-dgw-app-XRS-Accept-Ack":"RSAck","x-dgw-app-XRSS-http_referer":"https://www.facebook.com/friends"}',
@@ -98823,8 +100007,9 @@ function realtime_default(defaultFuncs, api, ctx) {
     async function connect() {
       if (stopped) return;
       try {
+        const appId = ctx.mqttAppID || ctx.appID || "2220391788200892";
         const queryParams = new URLSearchParams({
-          "x-dgw-appid": "2220391788200892",
+          "x-dgw-appid": String(appId),
           "x-dgw-appversion": "0",
           "x-dgw-authtype": "1:0",
           "x-dgw-version": "5",
@@ -98834,23 +100019,22 @@ function realtime_default(defaultFuncs, api, ctx) {
           "x-dgw-app-stream-group": "group1"
         });
         const url2 = `wss://gateway.facebook.com/ws/realtime?${queryParams.toString()}`;
-        const cookies = ctx.jar.getCookiesSync("https://www.facebook.com").join("; ");
+        const cookies = collectRealtimeCookies(ctx);
+        const wsHeaders = getWebSocketHeaders(url2, ctx.globalOptions, ctx);
         const baseHeaders = {
-          "Cookie": cookies,
-          "Origin": "https://www.facebook.com",
-          "User-Agent": ctx.globalOptions.userAgent,
-          "Referer": "https://www.facebook.com",
-          "Host": new URL(url2).hostname,
-          "Accept-Encoding": "gzip, deflate, br",
-          "Accept-Language": "en-US,en;q=0.9"
+          ...wsHeaders,
+          "Referer": "https://www.facebook.com/friends",
+          "Cookie": cookies
         };
         const wsOptions = { headers: baseHeaders };
         if (ctx.globalOptions.proxy) {
-          wsOptions.agent = new import_https_proxy_agent3.HttpsProxyAgent(ctx.globalOptions.proxy);
+          const { ProxyAgent } = await Promise.resolve().then(() => __toESM(require_undici()));
+          wsOptions.dispatcher = new ProxyAgent(ctx.globalOptions.proxy);
         }
         ws2 = new import_undici.WebSocket(url2, wsOptions);
         ws2.onopen = () => {
           log("Connected via undici.WebSocket");
+          retries = 0;
           subscriptions.forEach((payload, index3) => {
             const prefix = Buffer.from([14, index3, 0, payload.length]);
             const suffix = Buffer.from([0, 0]);
@@ -98882,7 +100066,7 @@ function realtime_default(defaultFuncs, api, ctx) {
           clearInterval(keepAliveInterval);
           keepAliveInterval = void 0;
           clearTimeout(reconnectTimeout);
-          reconnectTimeout = setTimeout(connect, 1e3);
+          reconnectTimeout = setTimeout(connect, retryDelay(++retries, 2e3, 6e4));
         };
       } catch (err) {
         if (stopped) return;
@@ -98890,7 +100074,7 @@ function realtime_default(defaultFuncs, api, ctx) {
         emitter.emit("error", err);
         clearInterval(keepAliveInterval);
         clearTimeout(reconnectTimeout);
-        reconnectTimeout = setTimeout(connect, 1e3);
+        reconnectTimeout = setTimeout(connect, retryDelay(++retries, 2e3, 6e4));
       }
     }
     connect();
@@ -98909,7 +100093,7 @@ function realtime_default(defaultFuncs, api, ctx) {
 // src/deltas/apis/mqtt/listenMqtt.ts
 var import_mqtt2 = __toESM(require_mqtt2());
 var import_websocket_stream2 = __toESM(require_websocket_stream());
-var import_https_proxy_agent4 = __toESM(require_dist3());
+var import_https_proxy_agent3 = __toESM(require_dist3());
 
 // src/deltas/apis/mqtt/deltas/value.ts
 function parseDelta(defaultFuncs, api, ctx, globalCallback, v) {
@@ -99133,9 +100317,15 @@ var MQTT_CONFIG = {
   },
   PROTOCOL_VERSION: 3,
   QOS_LEVEL: 1,
-  INITIAL_RETRY_DELAY: 2e3,
-  MAX_RETRY_DELAY: 6e4,
-  RETRY_MULTIPLIER: 1.6
+  // A dropped socket deserves a quick retry; only a refused handshake
+  // (explicit throttle) gets the long backoff. Both ramps are jittered.
+  INITIAL_RETRY_DELAY: 4e3,
+  MAX_RETRY_DELAY: 3e5,
+  RETRY_MULTIPLIER: 2,
+  // A refused handshake (connack returnCode != 0) means we are being
+  // throttled, not that the network blipped: wait much longer before trying.
+  THROTTLE_DELAY: 9e4,
+  MAX_THROTTLE_DELAY: 9e5
 };
 var SYNC_CONFIG = {
   API_VERSION: 11,
@@ -99144,14 +100334,15 @@ var SYNC_CONFIG = {
   ENCODING: "JSON"
 };
 function buildMqttUsername(ctx, sessionID) {
+  const profile = resolveProfile(ctx.globalOptions);
   return {
     u: ctx.userID,
     s: String(sessionID),
-    chat_on: ctx.globalOptions.online,
+    chat_on: !!ctx.globalOptions.online,
     fg: false,
     d: ctx.clientID,
     ct: "websocket",
-    aid: ctx.mqttAppID || "218474845183941",
+    aid: ctx.mqttAppID || ctx.appID || "2220391788200892",
     mqtt_sid: "",
     cp: 3,
     ecp: 10,
@@ -99161,13 +100352,14 @@ function buildMqttUsername(ctx, sessionID) {
     no_auto_fg: true,
     gas: null,
     pack: [],
-    a: ctx.globalOptions.userAgent,
+    a: profile.userAgent,
     vi: "3",
-    lc: "en_US"
+    lc: (profile.language || "en-US").replace("-", "_")
   };
 }
 function buildMqttOptions(ctx, host, username) {
-  const cookies = ctx.jar.getCookiesSync("https://www.facebook.com").join("; ");
+  const cookies = collectSessionCookies(ctx, host);
+  const wsHeaders = getWebSocketHeaders(host, ctx.globalOptions);
   const options = {
     clientId: "mqttwsclient",
     protocolId: "MQIsdp",
@@ -99175,14 +100367,8 @@ function buildMqttOptions(ctx, host, username) {
     username: JSON.stringify(username),
     clean: true,
     wsOptions: {
-      headers: {
-        "Cookie": cookies,
-        "Origin": "https://www.messenger.com",
-        "User-Agent": username.a,
-        "Referer": "https://www.messenger.com/",
-        "Host": new URL(host).hostname
-      },
-      origin: "https://www.messenger.com",
+      headers: { ...wsHeaders, Cookie: cookies },
+      origin: wsHeaders.Origin,
       protocolVersion: 13,
       binaryType: "arraybuffer"
     },
@@ -99192,7 +100378,7 @@ function buildMqttOptions(ctx, host, username) {
     reconnectPeriod: 0
   };
   if (ctx.globalOptions.proxy) {
-    options.wsOptions.agent = new import_https_proxy_agent4.HttpsProxyAgent(ctx.globalOptions.proxy);
+    options.wsOptions.agent = new import_https_proxy_agent3.HttpsProxyAgent(ctx.globalOptions.proxy);
   }
   return options;
 }
@@ -99214,6 +100400,7 @@ var listenMqtt_default = (defaultFuncs, api, ctx) => {
     stopped: false,
     attempts: 0,
     delay: MQTT_CONFIG.INITIAL_RETRY_DELAY,
+    throttleDelay: MQTT_CONFIG.THROTTLE_DELAY,
     generation: 0
   };
   const log2 = (...args) => log(...args);
@@ -99247,13 +100434,36 @@ var listenMqtt_default = (defaultFuncs, api, ctx) => {
     } catch (_3) {
     }
   }
-  function scheduleReconnect(reason) {
+  function scheduleReconnect(reason, throttled = false) {
     if (lifecycle.stopped) return;
     if (ctx.loggedIn === false) return;
     if (ctx.globalOptions && ctx.globalOptions.autoReconnect === false) return;
+    if (isBreakerOpen(ctx)) {
+      const wait = Math.min(
+        safetySnapshot(ctx).cooldownRemainingMs || MQTT_CONFIG.THROTTLE_DELAY,
+        MQTT_CONFIG.MAX_THROTTLE_DELAY
+      );
+      clearReconnectTimer();
+      lifecycle.reconnectTimer = setTimeout(() => {
+        lifecycle.reconnectTimer = null;
+        if (lifecycle.stopped || ctx.loggedIn === false) return;
+        start();
+      }, wait);
+      log2(`MQTT ${reason}; safety breaker open, waiting ${(wait / 1e3).toFixed(1)}s`);
+      return;
+    }
     clearReconnectTimer();
-    const delay3 = Math.min(lifecycle.delay + getJitter(500), MQTT_CONFIG.MAX_RETRY_DELAY);
-    lifecycle.delay = Math.min(lifecycle.delay * MQTT_CONFIG.RETRY_MULTIPLIER, MQTT_CONFIG.MAX_RETRY_DELAY);
+    let delay3;
+    if (throttled) {
+      delay3 = Math.min(lifecycle.throttleDelay + getJitter(8e3), MQTT_CONFIG.MAX_THROTTLE_DELAY);
+      lifecycle.throttleDelay = Math.min(
+        lifecycle.throttleDelay * MQTT_CONFIG.RETRY_MULTIPLIER,
+        MQTT_CONFIG.MAX_THROTTLE_DELAY
+      );
+    } else {
+      delay3 = Math.min(lifecycle.delay + getJitter(1500), MQTT_CONFIG.MAX_RETRY_DELAY);
+      lifecycle.delay = Math.min(lifecycle.delay * MQTT_CONFIG.RETRY_MULTIPLIER, MQTT_CONFIG.MAX_RETRY_DELAY);
+    }
     lifecycle.attempts++;
     log2(`MQTT ${reason}; reconnecting in ${(delay3 / 1e3).toFixed(1)}s (attempt ${lifecycle.attempts})`);
     lifecycle.reconnectTimer = setTimeout(() => {
@@ -99265,7 +100475,9 @@ var listenMqtt_default = (defaultFuncs, api, ctx) => {
   function resetBackoff() {
     lifecycle.attempts = 0;
     lifecycle.delay = MQTT_CONFIG.INITIAL_RETRY_DELAY;
+    lifecycle.throttleDelay = MQTT_CONFIG.THROTTLE_DELAY;
   }
+  ctx.__resetMqttBackoff = resetBackoff;
   async function fetchSeqId() {
     if (ctx.lastSeqId) return ctx.lastSeqId;
     const form = {
@@ -99332,9 +100544,18 @@ var listenMqtt_default = (defaultFuncs, api, ctx) => {
       ctx.mqttClient = client2;
       let connected = false;
       let closing = false;
+      let throttled = false;
+      let authFailure = false;
       client2.on("error", (err) => {
         ctx.lastMqttError = err;
-        error("listenMqtt", new NetworkError(`MQTT connection error: ${err?.message || err}`, { originalError: err, host }));
+        const msg = String(err && err.message || err || "");
+        if (/connection refused|not authorized|server unavailable|bad username|identifier rejected|unacceptable protocol/i.test(msg)) {
+          throttled = true;
+        }
+        if (isAuthFailure && isAuthFailure(err)) {
+          authFailure = true;
+        }
+        error("listenMqtt", new NetworkError(`MQTT connection error: ${msg}`, { originalError: err, host }));
       });
       client2.on("offline", () => {
         if (generation !== lifecycle.generation) return;
@@ -99348,7 +100569,17 @@ var listenMqtt_default = (defaultFuncs, api, ctx) => {
         ctx.mqttConnected = false;
         if (closing) return;
         closing = true;
-        scheduleReconnect("connection closed");
+        if (authFailure) {
+          noteAuthFailure(ctx);
+          Promise.resolve().then(() => repairSession(ctx, defaultFuncs)).catch(() => {
+          }).then(() => {
+            if (generation !== lifecycle.generation) return;
+            resetBackoff();
+            scheduleReconnect("session repaired after auth error");
+          });
+          return;
+        }
+        scheduleReconnect(throttled ? "connection refused (throttled)" : "connection closed", throttled);
       });
       client2.on("connect", () => {
         if (generation !== lifecycle.generation) return;
@@ -99452,6 +100683,13 @@ var listenMqtt_default = (defaultFuncs, api, ctx) => {
     log2("Reconnecting MQTT...");
     clearTimers();
     destroyClient();
+    try {
+      const last2 = ctx.lastMqttError;
+      if (last2 && isAuthFailure && isAuthFailure(last2)) {
+        await repairSession(ctx, defaultFuncs);
+      }
+    } catch (_3) {
+    }
     try {
       await ensureSeqId();
     } catch (err) {
@@ -99511,7 +100749,9 @@ var listenMqtt_default = (defaultFuncs, api, ctx) => {
         }
       }
       ctx.firstListen = false;
+      let fetchedSeqId = false;
       try {
+        fetchedSeqId = !ctx.lastSeqId;
         await ensureSeqId();
       } catch (err) {
         ctx.lastMqttError = err;
@@ -99519,6 +100759,7 @@ var listenMqtt_default = (defaultFuncs, api, ctx) => {
         scheduleReconnect("sequence id fetch failed");
         return;
       }
+      if (fetchedSeqId) await sleep(humanDelay(700, 400));
       await start();
     })().catch((err) => {
       error("listenMqtt startup error:", err);
@@ -99650,7 +100891,7 @@ async function loginHelper(credentials, globalOptions, callback, setOptionsFunc,
           if (!name || c.value === void 0 || c.value === null) {
             throw new Error(`Invalid appState cookie at index ${index3}.`);
           }
-          return `${name}=${String(c.value)}`;
+          return formatAppStateCookie(c);
         });
       } else if (typeof appState === "string") {
         cookieStrings = appState.split(";").map((s) => s.trim()).filter(Boolean);
@@ -99663,9 +100904,16 @@ async function loginHelper(credentials, globalOptions, callback, setOptionsFunc,
         if (cookieString.indexOf("=") <= 0) {
           throw new Error(`Invalid appState cookie at index ${index3}.`);
         }
-        const domain = ".facebook.com";
-        const str = `${cookieString}; domain=${domain}; path=/;`;
-        jar2.setCookie(str, "https://facebook.com");
+        const normalized = cookieString.replace(/;\s*domain=facebook\.com/i, "; domain=.facebook.com").replace(/;\s*domain=messenger\.com/i, "; domain=.messenger.com");
+        const str = /(^|;)\s*domain=/i.test(normalized) ? normalized : `${normalized}; domain=.facebook.com; path=/; Secure; SameSite=None`;
+        try {
+          jar2.setCookieSync(str, "https://facebook.com");
+        } catch {
+          try {
+            jar2.setCookieSync(`${normalized}; domain=.facebook.com; path=/; Secure; SameSite=None`, "https://www.facebook.com");
+          } catch {
+          }
+        }
       });
     } else if (credentials.email && credentials.password) {
       const url2 = "https://api.facebook.com/method/auth.login";
@@ -99682,15 +100930,25 @@ async function loginHelper(credentials, globalOptions, callback, setOptionsFunc,
       const query = qs.stringify(params);
       const xurl = `${url2}?${query}`;
       try {
-        const resp2 = await axios_default.get(xurl);
+        const legacyHeaders = getHeaders(
+          url2,
+          globalOptions,
+          null,
+          { "Content-Type": "application/x-www-form-urlencoded" }
+        );
+        const resp2 = await axios_default.get(xurl, {
+          headers: legacyHeaders,
+          timeout: 6e4,
+          validateStatus: (status) => status >= 200 && status < 600
+        });
         if (resp2.status !== 200) {
           throw new Error("Wrong password / email");
         }
         const cstrs = resp2.data["session_cookies"].map((c) => `${c.name}=${c.value}`);
         cstrs.forEach((cstr) => {
           const domain = ".facebook.com";
-          const str = `${cstr}; domain=${domain}; path=/;`;
-          jar2.setCookie(str, "https://facebook.com");
+          const str = `${cstr}; domain=${domain}; path=/; Secure; SameSite=None`;
+          jar2.setCookieSync(str, "https://facebook.com");
         });
       } catch (e) {
         throw new Error("Wrong password / email");
@@ -99803,6 +101061,46 @@ async function loginHelper(credentials, globalOptions, callback, setOptionsFunc,
     api.ctx = ctx;
     api.defaultFuncs = defaultFuncs;
     api.globalOptions = globalOptions;
+    api.extractCookies = () => extractCookies({ jar: jar2 });
+    api.refreshSession = () => refreshSessionCookies(ctx, defaultFuncs);
+    api.hasAuthenticatedSession = () => hasAuthenticatedSession(jar2);
+    api.repairSession = () => repairSession(ctx, defaultFuncs);
+    api.warmUpSession = () => warmUpSession(ctx, defaultFuncs.get);
+    ctx.__startedAt = Date.now();
+    ctx.__safetySnapshot = () => safetySnapshot(ctx);
+    api.getSafetyStatus = () => safetySnapshot(ctx);
+    api.pauseSession = (reason) => {
+      tripBreaker(ctx, reason || "manual");
+      return safetySnapshot(ctx);
+    };
+    api.resumeSession = () => {
+      resetBreaker(ctx);
+      return safetySnapshot(ctx);
+    };
+    ctx.__onSafetyTrip = (info2) => {
+      warn(
+        "Account safety",
+        `pausing requests for ${Math.round((info2.cooldownMs || 0) / 1e3)}s (${info2.reason})`
+      );
+    };
+    if (globalOptions.warmUp !== false) {
+      try {
+        await warmUpSession(ctx, defaultFuncs.get);
+      } catch (warmUpError) {
+        warn("Session warm-up skipped:", warmUpError?.message || warmUpError);
+      }
+    }
+    ctx.__stopCookieKeepAlive = scheduleSessionKeepAlive(ctx, defaultFuncs, 15 * 60 * 1e3);
+    if (globalOptions.liveness !== false) {
+      const liveness = startLiveness(ctx, {
+        foregroundPing: () => log("Session active"),
+        backgroundPing: () => log("Session idle")
+      });
+      ctx.__livenessHandle = liveness;
+      api.getLivenessState = () => liveness.state();
+      api.canActProactively = () => canActProactively(ctx);
+      api.awaitProactiveSlot = (maxWaitMs) => awaitProactiveSlot(ctx, maxWaitMs);
+    }
     return callback(null, api);
   } catch (error2) {
     error("loginHelper", error2.error || error2);
@@ -99822,6 +101120,10 @@ async function login(credentials, options, callback) {
   if ("logging" in options) {
     logOptions(options.logging);
   }
+  const browser = options.randomUserAgent ? randomUserAgent() : normalizeBrowserProfile({
+    ...options.browser || defaultBrowserProfile,
+    ...options.userAgent ? { userAgent: options.userAgent } : {}
+  });
   const defaultOptions2 = {
     selfListen: false,
     listenEvents: false,
@@ -99833,7 +101135,8 @@ async function login(credentials, options, callback) {
     autoReconnect: true,
     online: false,
     emitReady: false,
-    userAgent: options.userAgent || "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36",
+    userAgent: browser.userAgent,
+    browser,
     advancedProtection: false,
     autoRotateSession: false,
     randomUserAgent: false
@@ -99876,6 +101179,10 @@ async function login(credentials, options, callback) {
 var public_exports = {};
 
 // index.ts
+init_headers();
+init_user_agents();
+init_pacing();
+init_safety();
 var metaChat = Object.assign(login, {
   login,
   publicTypes: public_exports,
@@ -99966,4 +101273,4 @@ lodash/lodash.js:
    *)
 */
 
-export { index_default as default, login, public_exports as publicTypes };
+export { applySetCookie, awaitProactiveSlot, canActProactively, collectSessionCookies, index_default as default, defaultBrowserProfile, ensureCometTokens, extractCookies, extractCookiesFromBody, extractCookiesFromJar, extractCookiesFromSetCookie, extractCurrentUser, getFingerprintParams, getHeaders, getWebSocketHeaders, hasAuthenticatedSession, humanDelay, invalidateCometTokens, isAuthFailure, isBreakerOpen, isStaleTokenError, login, missingSessionCookies, normalizeBrowserProfile, noteAction, noteAuthFailure, noteCheckpoint, noteRateLimit, paceRequest, public_exports as publicTypes, randomUserAgent, refreshSessionCookies, repairSession, reserveRequest, resetBreaker, resolveProfile, retryDelay, safetySnapshot, sleep, startLiveness, tripBreaker, warmUpSession, withCometTokens, withSessionRetry };