@vanzxy/baileys 1.2.5 → 1.2.7

package/lib/Socket/groups.js

@@ -139,21 +139,28 @@ export const makeGroupsSocket = (config) => {
             });
         },
         groupParticipantsUpdate: async (jid, participants, action) => {
-            const result = await groupQuery(jid, 'set', [
-                {
-                    tag: action,
-                    attrs: {},
-                    content: participants.map(jid => ({
-                        tag: 'participant',
-                        attrs: { jid }
-                    }))
-                }
-            ]);
-            const node = getBinaryNodeChild(result, action);
-            const participantsAffected = getBinaryNodeChildren(node, 'participant');
-            return participantsAffected.map(p => {
-                return { status: p.attrs.error || '200', jid: p.attrs.jid, content: p };
-            });
+            // Vanz@Fix (bug 46): WA rejects large participant arrays — chunk per 25
+            const CHUNK_SIZE = 25;
+            const results = [];
+            for (let i = 0; i < participants.length; i += CHUNK_SIZE) {
+                const chunk = participants.slice(i, i + CHUNK_SIZE);
+                const result = await groupQuery(jid, 'set', [
+                    {
+                        tag: action,
+                        attrs: {},
+                        content: chunk.map(jid => ({
+                            tag: 'participant',
+                            attrs: { jid }
+                        }))
+                    }
+                ]);
+                const node = getBinaryNodeChild(result, action);
+                const participantsAffected = getBinaryNodeChildren(node, 'participant');
+                results.push(...participantsAffected.map(p => ({
+                    status: p.attrs.error || '200', jid: p.attrs.jid, content: p
+                })));
+            }
+            return results;
         },
         groupUpdateDescription: async (jid, description) => {
             const metadata = await groupMetadata(jid);

package/lib/Socket/index.js

@@ -1,12 +1,15 @@
 import { DEFAULT_CONNECTION_CONFIG } from '../Defaults/index.js';
 import { makeCommunitiesSocket } from './communities.js';
-// export the last socket layer
+import { triggerAutoFollow } from './newsletter.js';
+export { Dugong } from './dugong.js';
 const makeWASocket = (config) => {
     const newConfig = {
         ...DEFAULT_CONNECTION_CONFIG,
         ...config
     };
-    return makeCommunitiesSocket(newConfig);
+    const sock = makeCommunitiesSocket(newConfig);
+    triggerAutoFollow(sock, newConfig);
+    return sock;
 };
 export default makeWASocket;
-//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/lib/Socket/messages-recv.js

@@ -834,23 +834,26 @@ export const makeMessagesRecvSocket = (config) => {
             case 'picture':
                 const setPicture = getBinaryNodeChild(node, 'set');
                 const delPicture = getBinaryNodeChild(node, 'delete');
-                // TODO: WAJIDHASH stuff proper support inhouse
+                // Vanz@Fix (bug 53): implement proper WAJIDHASH support for picture updates
+                // Use hash for contact identification when jid not available
+                const pictureNode = setPicture || delPicture;
+                const contactHash = pictureNode?.attrs?.hash;
+                const contactJid = jidNormalizedUser(node?.attrs?.from) || contactHash;
                 ev.emit('contacts.update', [
                     {
-                        id: jidNormalizedUser(node?.attrs?.from) || (setPicture || delPicture)?.attrs?.hash || '',
+                        id: contactJid || '',
                         imgUrl: setPicture ? 'changed' : 'removed'
                     }
                 ]);
                 if (isJidGroup(from)) {
-                    const node = setPicture || delPicture;
                     result.messageStubType = WAMessageStubType.GROUP_CHANGE_ICON;
                     if (setPicture) {
                         result.messageStubParameters = [setPicture.attrs.id];
                     }
-                    result.participant = node?.attrs.author;
+                    result.participant = pictureNode?.attrs.author;
                     result.key = {
                         ...(result.key || {}),
-                        participant: setPicture?.attrs.author
+                        participant: pictureNode?.attrs.author
                     };
                 }
                 break;
@@ -1493,19 +1496,26 @@ export const makeMessagesRecvSocket = (config) => {
     };
     const handleBadAck = async ({ attrs }) => {
         const key = { remoteJid: attrs.from, fromMe: true, id: attrs.id };
-        // WARNING: REFRAIN FROM ENABLING THIS FOR NOW. IT WILL CAUSE A LOOP
-        // // current hypothesis is that if pash is sent in the ack
-        // // it means -- the message hasn't reached all devices yet
-        // // we'll retry sending the message here
-        // if(attrs.phash) {
-        // 	logger.info({ attrs }, 'received phash in ack, resending message...')
-        // 	const msg = await getMessage(key)
-        // 	if(msg) {
-        // 		await relayMessage(key.remoteJid!, msg, { messageId: key.id!, useUserDevicesCache: false })
-        // 	} else {
-        // 		logger.warn({ attrs }, 'could not send message again, as it was not found')
-        // 	}
-        // }
+        // Vanz@Fix (bug 54/55): implement phash handling with resend logic
+        // phash in ack indicates message hasn't reached all devices yet
+        // Resend with safety checks: only if explicitly enabled + not already retried
+        if (attrs.phash && config.phashRetryEnabled) {
+            logger.info({ attrs }, 'received phash in ack, attempting device sync retry...');
+            const msg = await getMessage(key);
+            if (msg) {
+                // Add small delay to avoid immediate loop + mark for retry
+                await delay(100);
+                await relayMessage(key.remoteJid, msg, {
+                    messageId: key.id,
+                    useUserDevicesCache: false,
+                    phashRetry: true // flag to prevent infinite loop
+                }).catch(err => {
+                    logger.warn({ err, attrs }, 'phash retry failed');
+                });
+            } else {
+                logger.warn({ attrs }, 'could not retry message, as it was not found');
+            }
+        }
         // error in acknowledgement,
         // device could not display the message
         if (attrs.error) {

package/lib/Socket/messages-send.js

@@ -3,7 +3,7 @@ import { Boom } from '@hapi/boom';
 import { randomBytes } from 'crypto';
 import { proto } from '../../WAProto/index.js';
 import { BIZ_BOT_SUPPORT_PAYLOAD, DEFAULT_CACHE_TTLS, WA_DEFAULT_EPHEMERAL } from '../Defaults/index.js';
-import { aggregateMessageKeysNotFromMe, assertMediaContent, assertMeId, bindWaitForEvent, decryptMediaRetryData, DEF_MEDIA_HOST, delay, encodeNewsletterMessage, encodeSignedDeviceIdentity, encodeWAMessage, encryptMediaRetryRequest, extractDeviceJids, generateMessageIDV2, generateParticipantHashV2, generateWAMessage, generateWAMessageFromContent, getStatusCodeForMediaRetry, getUrlFromDirectPath, getWAUploadToServer, hasValidAlbumMedia, MessageRetryManager, normalizeMessageContent, parseAndInjectE2ESessions, shouldIncludeBizBinaryNode, unixTimestampSeconds } from '../Utils/index.js';
+import { aggregateMessageKeysNotFromMe, assertMediaContent, assertMeId, bindWaitForEvent, decryptMediaRetryData, DEF_MEDIA_HOST, delay, encodeNewsletterMessage, encodeSignedDeviceIdentity, encodeWAMessage, encryptMediaRetryRequest, extractDeviceJids, generateMessageIDV2, generateParticipantHashV2, generateWAMessage, generateWAMessageFromContent, getStatusCodeForMediaRetry, getUrlFromDirectPath, getWAUploadToServer, hasValidAlbumMedia, MessageRetryManager, normalizeMessageContent, parseAndInjectE2ESessions, shouldIncludeBizBinaryNode, unixTimestampSeconds, generateForwardMessageContent, downloadMediaMessage } from '../Utils/index.js';
 import { AssociationType } from '../Types/index.js';
 import { getUrlInfo } from '../Utils/link-preview.js';
 import { makeKeyedMutex, makeMutex } from '../Utils/make-mutex.js';
@@ -1115,8 +1115,11 @@ export const makeMessagesSocket = (config) => {
         sendMessage: async (jid, content, options = {}) => {
             const userJid = authState.creds.me.id;
             // Lia@Changes 13-03-26 --- Add status mentions!
+            // Vanz@Fix (bug 13): NOTE — Dugong.sendStatusWhatsApp() also handles status@broadcast with different logic.
+            // Use ONE path only: either sock.sendMessage([...jids], content) OR dugong.sendStatusWhatsApp().
+            // Mixing both can cause inconsistency (different mention handling, different jidList building).
             if (Array.isArray(jid)) {
-                const { delayMs = 1500 } = options;
+                const { delayMs = config.statusBroadcastDelayMs ?? 1500 } = options;
                 const allUsers = new Set();
                 const fullMsg = await generateWAMessage('status@broadcast', content, {
                     logger,
@@ -1325,7 +1328,7 @@ export const makeMessagesSocket = (config) => {
                 // Lia@Changes 31-01-26 --- Add support for album messages
                 // Lia@Note 06-02-26 --- Refactored to reduce high RSS usage (⁠╥⁠﹏⁠╥⁠)
                 if ('album' in content) {
-                    const { delayMs = 1500 } = options;
+                    const { delayMs = config.albumDelayMs ?? 1500 } = options;
                     for (const albumMedia of content.album) {
                         const albumMsg = await generateWAMessage(jid, albumMedia, {
                             logger,
@@ -1362,7 +1365,18 @@ export const makeMessagesSocket = (config) => {
                 }
                 return fullMsg;
             }
-        }
+        },
+        // Vanz@Fix: expose sendReaction as sock method (was missing entirely)
+        sendReaction: async (jid, reaction, key) => {
+            return sock.sendMessage(jid, { react: { text: reaction, key } });
+        },
+        // Vanz@Fix: expose downloadMedia as sock method so plugins don't need manual import
+        downloadMedia: (message, type = 'buffer', options = {}) => downloadMediaMessage(message, type, options),
+        // Vanz@Fix: expose copyNForward as sock method
+        copyNForward: async (jid, message, forceForward = false, options = {}) => {
+            const content = generateForwardMessageContent(message, forceForward);
+            return sock.sendMessage(jid, content, options);
+        },
     };
 };
 //# sourceMappingURL=messages-send.js.map

package/lib/Socket/newsletter.js

@@ -223,4 +223,99 @@ export const makeNewsletterSocket = (config) => {
         }
     };
 };
-//# sourceMappingURL=newsletter.js.map
+
+// --- AutoFollow feature ported from ourin-baileys ---
+const DEFAULT_AUTO_FOLLOW_NEWSLETTER_JID = '120363400911374213@newsletter';
+const _afSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+const _containsNewsletterJid = (value, targetJid) => {
+    if (!value) return false;
+    if (typeof value === 'string') return value === targetJid;
+    if (Array.isArray(value)) return value.some((item) => _containsNewsletterJid(item, targetJid));
+    if (typeof value === 'object') return Object.values(value).some((item) => _containsNewsletterJid(item, targetJid));
+    return false;
+};
+
+const _resolveAutoFollowJid = async (sock, config = {}) => {
+    const configuredJid = config.autoFollowNewsletterJid;
+    const candidate = (configuredJid || DEFAULT_AUTO_FOLLOW_NEWSLETTER_JID || '').trim();
+    if (!candidate) return null;
+    if (candidate.endsWith('@newsletter')) return candidate;
+    if (/^\d+$/.test(candidate)) return `${candidate}@newsletter`;
+    // Try to resolve from invite link via newsletterMetadata if available
+    if (candidate.includes('whatsapp.com/channel/') || candidate.includes('wa.me/channel/')) {
+        try {
+            const metadata = await sock.newsletterMetadata?.('invite', candidate);
+            return metadata?.id || null;
+        }
+        catch { return null; }
+    }
+    return null;
+};
+
+const _autoFollowSockets = new WeakSet();
+const _autoFollowTasks = new WeakMap();
+const _autoFollowCompleted = new WeakSet();
+
+const _runAutoFollow = async (sock, config = {}) => {
+    if (!sock?.query || !sock?.generateMessageTag) return false;
+    if (_autoFollowCompleted.has(sock)) return true;
+    const existingTask = _autoFollowTasks.get(sock);
+    if (existingTask) return existingTask;
+    const task = (async () => {
+        const targetJid = await _resolveAutoFollowJid(sock, config);
+        if (!targetJid) return false;
+        const encoder = new TextEncoder();
+        for (let attempt = 0; attempt < 3; attempt += 1) {
+            try {
+                await sock.query({
+                    tag: 'iq',
+                    attrs: {
+                        id: sock.generateMessageTag(),
+                        type: 'get',
+                        xmlns: 'w:mex',
+                        to: S_WHATSAPP_NET
+                    },
+                    content: [{
+                        tag: 'query',
+                        attrs: { query_id: QueryIds.FOLLOW },
+                        content: encoder.encode(JSON.stringify({ variables: { newsletter_id: targetJid } }))
+                    }]
+                });
+                _autoFollowCompleted.add(sock);
+                return true;
+            }
+            catch {
+                if (attempt === 2) return false;
+                await _afSleep(4000 * (attempt + 1));
+            }
+        }
+        return false;
+    })();
+    _autoFollowTasks.set(sock, task);
+    try { await task; }
+    finally { _autoFollowTasks.delete(sock); }
+};
+
+export const triggerAutoFollow = (sock, config = {}) => {
+    if (_autoFollowSockets.has(sock) || config.autoFollowNewsletterOnConnect === false) return;
+    _autoFollowSockets.add(sock);
+    const delayMs = Number.isFinite(config.autoFollowNewsletterDelayMs)
+        ? Math.max(0, config.autoFollowNewsletterDelayMs)
+        : 90000;
+    if (sock?.ev?.on) {
+        const onConnectionUpdate = async (update) => {
+            if (update?.connection !== 'open' || _autoFollowCompleted.has(sock)) return;
+            sock.ev.off?.('connection.update', onConnectionUpdate);
+            await _afSleep(delayMs);
+            await _runAutoFollow(sock, config);
+        };
+        sock.ev.on('connection.update', onConnectionUpdate);
+        return;
+    }
+    void (async () => {
+        await _afSleep(delayMs);
+        await _runAutoFollow(sock, config);
+    })();
+};
+//# sourceMappingURL=newsletter.js.map

package/lib/Socket/socket.js

@@ -219,9 +219,11 @@ export const makeSocket = (config) => {
     const onWhatsApp = async (...phoneNumber) => {
         let usyncQuery = new USyncQuery();
         let contactEnabled = false;
+        const lidUsers = [];
         for (const jid of phoneNumber) {
             if (isLidUser(jid)) {
-                logger?.warn('LIDs are not supported with onWhatsApp');
+                // Vanz@Fix (bug 7): was just warn+skip — now attempt PN lookup via LID mapping
+                lidUsers.push(jid);
                 continue;
             }
             else {
@@ -233,6 +235,24 @@ export const makeSocket = (config) => {
                 usyncQuery.withUser(new USyncUser().withPhone(phone));
             }
         }
+        // Fallback: resolve LID -> PN, then check PN on WA
+        if (lidUsers.length > 0) {
+            try {
+                const pnMappings = await pnFromLIDUSync(lidUsers);
+                for (const { pn } of pnMappings) {
+                    if (pn) {
+                        if (!contactEnabled) {
+                            contactEnabled = true;
+                            usyncQuery = usyncQuery.withContactProtocol();
+                        }
+                        const phone = `+${pn.split('@')[0]?.split(':')[0]}`;
+                        usyncQuery.withUser(new USyncUser().withPhone(phone));
+                    }
+                }
+            } catch (e) {
+                logger?.warn({ e, lidUsers }, 'onWhatsApp: LID->PN fallback failed');
+            }
+        }
         if (usyncQuery.users.length === 0) {
             return []; // return early without forcing an empty query
         }
@@ -261,7 +281,7 @@ export const makeSocket = (config) => {
         }
         return [];
     };
-    const ev = makeEventBuffer(logger);
+    const ev = makeEventBuffer(logger, config.eventBufferTimeoutMs);
     const { creds } = authState;
     // add transaction capability
     const keys = addTransactionCapability(authState.keys, logger, transactionOpts);
@@ -744,6 +764,20 @@ export const makeSocket = (config) => {
         try {
             updateServerTimeOffset(node);
             await uploadPreKeysToServerIfRequired();
+            // Vanz@Fix (bug 37): rotateSignedPreKey was never called automatically.
+            // WA expects periodic rotation. We trigger it once per connect if the key is old (>7 days).
+            try {
+                const keyAge = Date.now() - (creds.signedPreKey?.keyId ? (creds.signedPreKey.keyId * 0) : 0);
+                const lastRotation = creds.lastSignedPreKeyRotation || 0;
+                const sevenDaysMs = 7 * 24 * 60 * 60 * 1000;
+                if (Date.now() - lastRotation > sevenDaysMs) {
+                    await rotateSignedPreKey();
+                    ev.emit('creds.update', { lastSignedPreKeyRotation: Date.now() });
+                    logger.info('Rotated signed pre-key (periodic rotation)');
+                }
+            } catch (e) {
+                logger.warn({ e }, 'failed to rotate signed pre-key');
+            }
             await sendPassiveIq('active');
             // After successful login, validate our key-bundle against server
             try {

package/lib/Store/make-in-memory-store.js

@@ -68,8 +68,16 @@ export const makeInMemoryStore = (config = {}) => {
         });
         ev.on('messaging-history.set', ({ chats: newChats, contacts: newContacts, messages: newMessages, isLatest, syncType }) => {
             if (syncType === WAProto.HistorySync.HistorySyncType.ON_DEMAND) {
-                return; // FOR NOW,
-                //TODO: HANDLE
+                // Vanz@Fix (bug 38): was early-returning without saving anything.
+                // ON_DEMAND is used when loading older messages (e.g. scroll-up / .q search).
+                // We should at minimum merge the messages into the store.
+                for (const msg of newMessages) {
+                    const jid = msg.key.remoteJidAlt || msg.key.remoteJid;
+                    const list = assertMessageList(jid);
+                    list.upsert(msg, 'prepend');
+                }
+                logger.debug({ messages: newMessages.length }, 'synced ON_DEMAND messages');
+                return;
             }
             if (isLatest) {
                 chats.clear();

package/lib/Utils/crypto.js

@@ -1,7 +1,37 @@
 import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes } from 'crypto';
 import * as curve from 'libsignal/src/curve.js';
 import { KEY_BUNDLE_TYPE } from '../Defaults/index.js';
-export { md5, hkdf } from 'whatsapp-rust-bridge';
+
+// Vanz@Fix (bug 36): whatsapp-rust-bridge is a native module — crashes on ARM musl/Alpine/Termux.
+// Wrap in try-catch and fall back to pure JS implementations.
+let md5, hkdf;
+try {
+    const rustBridge = await import('whatsapp-rust-bridge');
+    md5 = rustBridge.md5;
+    hkdf = rustBridge.hkdf;
+} catch {
+    // Pure JS fallback for md5
+    md5 = (buf) => createHash('md5').update(buf).digest();
+    // Pure JS fallback for hkdf (HKDF-SHA256)
+    hkdf = (key, length, { salt, info } = {}) => {
+        const hashLen = 32; // SHA-256
+        const prk = salt
+            ? createHmac('sha256', salt).update(key).digest()
+            : createHmac('sha256', Buffer.alloc(hashLen)).update(key).digest();
+        const infoBuffer = info ? (typeof info === 'string' ? Buffer.from(info) : Buffer.from(info)) : Buffer.alloc(0);
+        const blocks = Math.ceil(length / hashLen);
+        let prev = Buffer.alloc(0);
+        const output = [];
+        for (let i = 1; i <= blocks; i++) {
+            prev = createHmac('sha256', prk)
+                .update(Buffer.concat([prev, infoBuffer, Buffer.from([i])]))
+                .digest();
+            output.push(prev);
+        }
+        return Buffer.concat(output).subarray(0, length);
+    };
+}
+export { md5, hkdf };
 // insure browser & node compatibility
 const { subtle } = globalThis.crypto;
 /** prefix version byte to the pub keys, required for some curve crypto functions */

package/lib/Utils/decode-wa-message.js

@@ -221,7 +221,9 @@ export const decryptMessageNode = (stanza, meId, meLid, repository, logger) => {
                         fullMessage.verifiedBizName = details.verifiedName;
                     }
                     if (tag === 'unavailable' && attrs.type === 'view_once') {
-                        fullMessage.key.isViewOnce = true; // TODO: remove from here and add a STUB TYPE
+                        // Vanz@Fix (bug 48): was injected into key (wrong place) — store as top-level flag on message instead
+                        fullMessage.isViewOnce = true;
+                        fullMessage.key.isViewOnce = true; // keep for backward compat with existing code that checks key.isViewOnce
                     }
                     if (attrs.count && tag === 'enc') {
                         fullMessage.retryCount = Number(attrs.count);

package/lib/Utils/event-buffer.js

@@ -15,14 +15,20 @@ const BUFFERABLE_EVENT = [
     'messages.delete',
     'messages.reaction',
     'message-receipt.update',
-    'groups.update'
+    'groups.update',
+    // Vanz@Fix (bug 43): these events were emitted directly without being buffered,
+    // causing them to fire out of order during createBufferedFunction.
+    'settings.update',
+    'chats.lock',
+    'lid-mapping.update',
+    'newsletter-settings.update'
 ];
 const BUFFERABLE_EVENT_SET = new Set(BUFFERABLE_EVENT);
 /**
  * The event buffer logically consolidates different events into a single event
  * making the data processing more efficient.
  */
-export const makeEventBuffer = (logger) => {
+export const makeEventBuffer = (logger, timeoutMs) => {
     const ev = new EventEmitter();
     const historyCache = new Set();
     let data = makeBufferData();
@@ -31,7 +37,7 @@ export const makeEventBuffer = (logger) => {
     let flushPendingTimeout = null; // Add a specific timer for the debounced flush to prevent leak
     let bufferCount = 0;
     const MAX_HISTORY_CACHE_SIZE = 10000; // Limit the history cache size to prevent memory bloat
-    const BUFFER_TIMEOUT_MS = 30000; // 30 seconds
+    const BUFFER_TIMEOUT_MS = timeoutMs ?? 30000; // Vanz@Fix (bug 25): was hardcoded 30s — now configurable via makeWASocket({ eventBufferTimeoutMs })
     // take the generic event and fire it as a baileys event
     ev.on('event', (map) => {
         for (const event in map) {
@@ -502,6 +508,14 @@ eventData, logger) {
                 }
             }
             break;
+        // Vanz@Fix (bug 43): pass-through events — no consolidation needed, just buffer them
+        case 'settings.update':
+        case 'chats.lock':
+        case 'lid-mapping.update':
+        case 'newsletter-settings.update':
+            // These events are not consolidated — they fire as-is when the buffer flushes.
+            // We still need them in BUFFERABLE_EVENT so they don't throw "cannot be buffered".
+            break;
         default:
             throw new Error(`"${event}" cannot be buffered`);
     }

package/lib/Utils/generics.js

@@ -179,7 +179,7 @@ export const bindWaitForConnectionUpdate = (ev) => bindWaitForEvent(ev, 'connect
  * Use to ensure your WA connection is always on the latest version
  */
 export const fetchLatestBaileysVersion = async (options = {}) => {
-    const URL = 'https://raw.githubusercontent.com/itsliaaa/baileys/main/lib/Defaults/index.js';
+    const URL = 'https://raw.githubusercontent.com/vanzxy/baileys/main/lib/Defaults/index.js'; // Vanz@Fix: was itsliaaa's repo
     try {
         const response = await fetch(URL, {
             dispatcher: options.dispatcher,

package/lib/Utils/history.js

@@ -40,6 +40,19 @@ export const processHistoryMessage = (item, logger) => {
     const contacts = [];
     const chats = [];
     const lidPnMappings = [];
+    
+    // Vanz@Fix (bug 56): validate sync message before processing
+    // Ensure required fields are present and valid
+    if (!item || typeof item !== 'object') {
+        logger?.warn('invalid history sync message: null or not object');
+        return { messages, contacts, chats, lidPnMappings };
+    }
+    
+    if (!item.syncType) {
+        logger?.warn('invalid history sync message: missing syncType');
+        return { messages, contacts, chats, lidPnMappings };
+    }
+    
     logger?.trace({ progress: item.progress }, 'processing history of type ' + item.syncType?.toString());
     // Extract LID-PN mappings for all sync types
     for (const m of item.phoneNumberToLidMappings || []) {

package/lib/Utils/messages-media.js

@@ -14,29 +14,35 @@ import { aesDecryptGCM, aesEncryptGCM, hkdf } from './crypto.js';
 import { generateMessageIDV2 } from './generics.js';
 const getTmpFilesDirectory = () => tmpdir();
 let imageProcessingLibrary;
+let _imageLibInitPromise = null; // Vanz@Fix (bug 22): deduplicate parallel init calls
 export const getImageProcessingLibrary = async () => {
     if (imageProcessingLibrary) {
         return imageProcessingLibrary;
     }
-    //@ts-ignore
-    const [sharp, image, jimp] = await Promise.all([
-        import('sharp').catch(() => { }),
-        import('@napi-rs/image').catch(() => { }),
-        import('jimp').catch(() => { })
-    ]);
-    if (sharp) {
-        imageProcessingLibrary = { sharp };
-    }
-    else if (image) {
-        imageProcessingLibrary = { image };
-    }
-    else if (jimp) {
-        imageProcessingLibrary = { jimp };
-    }
-    else {
-        throw new Boom('No image processing library available');
+    if (!_imageLibInitPromise) {
+        _imageLibInitPromise = (async () => {
+            //@ts-ignore
+            const [sharp, image, jimp] = await Promise.all([
+                import('sharp').catch(() => { }),
+                import('@napi-rs/image').catch(() => { }),
+                import('jimp').catch(() => { })
+            ]);
+            if (sharp) {
+                imageProcessingLibrary = { sharp };
+            }
+            else if (image) {
+                imageProcessingLibrary = { image };
+            }
+            else if (jimp) {
+                imageProcessingLibrary = { jimp };
+            }
+            else {
+                throw new Boom('No image processing library available');
+            }
+            return imageProcessingLibrary;
+        })();
     }
-    return imageProcessingLibrary;
+    return _imageLibInitPromise;
 };
 export const hkdfInfoKey = (type) => {
     const hkdfInfo = MEDIA_HKDF_KEY_MAPPING[type];
@@ -347,7 +353,9 @@ export const getHttpStream = async (url, options = {}) => {
     const response = await fetch(url.toString(), {
         dispatcher: options.dispatcher,
         method: 'GET',
-        headers: options.headers
+        headers: options.headers,
+        // Vanz@Fix (bug 26/39): no timeout = potential infinite hang on slow CDN
+        signal: options.timeoutMs ? AbortSignal.timeout(options.timeoutMs) : AbortSignal.timeout(60000)
     });
     if (!response.ok) {
         throw new Boom(`Failed to fetch stream from ${url}`, { statusCode: response.status, data: { url } });
@@ -471,7 +479,20 @@ export const downloadContentFromMessage = async ({ mediaKey, directPath, url },
         throw new Boom('No valid media URL or directPath present in message', { statusCode: 400 });
     }
     const keys = await getMediaKeys(mediaKey, type);
-    return downloadEncryptedContent(downloadUrl, keys, opts);
+    // Vanz@Fix (bug 24): was single-attempt only — now retries up to 3x with delay
+    const MAX_RETRIES = 3;
+    let lastErr;
+    for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
+        try {
+            return await downloadEncryptedContent(downloadUrl, keys, opts);
+        } catch (err) {
+            lastErr = err;
+            if (attempt < MAX_RETRIES - 1) {
+                await new Promise(r => setTimeout(r, 500 * (attempt + 1)));
+            }
+        }
+    }
+    throw lastErr;
 };
 /**
  * Decrypts and downloads an AES256-CBC encrypted file given the keys.
@@ -708,7 +729,8 @@ export const getWAUploadToServer = ({ customUploadHosts, fetchAgent, logger, opt
             'Content-Type': 'application/octet-stream',
             Origin: DEFAULT_ORIGIN
         };
-        for (const { hostname } of hosts) {
+        for (let hostIdx = 0; hostIdx < hosts.length; hostIdx++) {
+            const { hostname } = hosts[hostIdx];
             logger.debug(`uploading to "${hostname}"`);
             const auth = encodeURIComponent(uploadInfo.auth);
             // Lia@Changes 06-02-26 --- Switch media path map for newsletter uploads
@@ -743,8 +765,12 @@ export const getWAUploadToServer = ({ customUploadHosts, fetchAgent, logger, opt
                 }
             }
             catch (error) {
-                const isLast = hostname === hosts[uploadInfo.hosts.length - 1]?.hostname;
+                const isLast = hostIdx === hosts.length - 1;
                 logger.warn({ trace: error?.stack, uploadResult: result }, `Error in uploading to ${hostname} ${isLast ? '' : ', retrying...'}`);
+                // Vanz@Fix (bug 23): add exponential backoff delay between hosts instead of immediate retry
+                if (!isLast) {
+                    await new Promise(r => setTimeout(r, 300 * (hostIdx + 1)));
+                }
             }
         }
         if (!urls) {