hridoy-ultimate 8.0.2 → 8.0.5

package/CHANGELOG.md

@@ -1,43 +1,45 @@
 # Changelog
 
-## 8.0.1
-- Rename: package/branding is now `hridoy-ultimate` (was `toru-fca`) in banner, logs, update check, README, examples and config comments.
-- Update check env var `HRIDOY_ULTIMATE_NO_UPDATE_CHECK` added (old `TORU_FCA_NO_UPDATE_CHECK` still honoured).
-- Internal globals (`global._toruFcaConfig`, `_toruFcaInitDone`) intentionally unchanged for backward compatibility.
+## 8.0.5 - hridoy-ultimate (first release under this name)
 
-## 1.2.4
-- Fix (critical): `scheduleReconnect()` called `getSeqID()` which is only defined inside the module factory, so every MQTT reconnect threw `ReferenceError` in a timer. Now exposed as `ctx._getSeqID` and called with a try/catch.
-- Fix: `changeCover` used `log` without requiring `npmlog`.
-- Fix: `createCommentPost` typo `calback`, undefined `image` in attachment error, and `cb(null, err)` resolving errors as success (now rejects).
-- Fix: `package.json` declares `form-data` and `https-proxy-agent` (were required but undeclared); removed unused `chalk`, `tough-cookie`, `protobufjs`.
-- Fix: `checkUpdate.js` hard-coded version 1.2.1; now read from `package.json`.
-- Chore: example config version synced; CRLF -> LF in `reply.js`, `getUID.js`, `httpGet.js`, `httpPost.js`, `changeAvt.js`.
-- Add: `scripts/check.js` (`npm run check`) and `test/fixes-1_2_4.test.js` (6 regression tests, incl. a reconnect test verified to fail on the old code).
+Built by merging the eryxenx-fca 1.0.0 - 1.1.9 lineage. Base tree: 1.1.9, with
+`module/loginHelper.js` from 1.1.8 (1.1.9 regressed it).
 
-## 1.2.3
-- Fix: E2EE reconnect timers are tracked, deduplicated, bounded with exponential backoff, and cleared on explicit disconnect.
-- Fix: TORU owns E2EE reconnect scheduling to avoid competing reconnect managers.
-- Fix: MQTT listener replacement clears stale reconnect/watchdog timers.
-- Fix: pending MQTT request callbacks are failed and cleaned up on transport error/close or explicit stop.
-- Add: regression test for pending MQTT callback cleanup on stop.
+### Security
+- Removed the hard-coded third-party credential-login host; `apiServer` is now empty by
+  default and credential login refuses to run without one explicitly configured.
+- Removed unverifiable prebuilt native binaries (messagix .so/.dll). Native E2EE engine is
+  opt-in (`FCA_E2EE_NATIVE=1` + `FCA_E2EE_NATIVE_LIB`).
+- `autoUpdate` default is now `false` (it was an inert stub upstream).
 
-## 1.2.2
-- Fix: reaction MQTT requests now reject on missing acknowledgement instead of assuming success.
-- Fix: reaction MQTT callback and Promise settle once and share the same result.
-- Fix: forward explicit MQTT response errors to request callbacks.
-- Fix: callback type checks no longer execute user callbacks as a test (pin/edit/block helpers).
-- Fix: atomic session writes use unique temporary names and restrictive file permissions.
-- Add: Node.js syntax-check script and focused MQTT reaction tests.
+### Fixed
+- Pending reconnect / getSeqID retry timers could revive the listener after `stopListening()`
+  (reproduced on 1.1.9: 30 `getSeqID` calls after stop). Timers are now tracked and
+  gated by a `_stopped` flag.
+- Reconnect used a fixed 2 s delay forever. Now bounded exponential backoff with jitter,
+  attempt budget (default 10) and a `stop_listen` event when exhausted.
+- Calling listen twice left two live MQTT clients; the old client is now replaced.
+- Events from stale/replaced clients are ignored.
+- Late socket `error` after cleanup could throw (EventEmitter with no error handler).
+- Sync queue is published after SUBACKs instead of immediately after subscribe.
+- `logout()` now stops MQTT, disconnects E2EE and clears all timers.
+- `emitAuth` now clears heartbeat / session-keeper / dtsg timers.
+- Session keeper no longer re-arms after stop; heartbeat no longer fights a pending backoff.
+- Undeclared dependencies (`request`, `tough-cookie`, `form-data`, `undici`) are declared.
+- `index.d.ts` declared the wrong module name and had an `IFCAU_Api` typo.
+- Silent `.catch(() => {})` on E2EE disconnect now logs.
 
+### Changed (defaults)
+- Humanizer (reply delay + command cooldown) is opt-in: `humanize: true`.
+- Native E2EE engine is opt-in (reverts 1.0.8 default-on).
+- `t_ms` wait 5 s -> 8 s, MQTT connect timeout 5 s -> 12 s (configurable).
+- Node >= 18 required.
 
-## 1.2.1
-- Fix: setMessageReactionMqtt invoked the user callback prematurely / threw synchronously; now Promise+callback, real ack.
-- Add: `/ls_resp` dispatch to `ctx.reqCallbacks` (reaction/pin/block helpers finally get acks).
-- Add: richer `message_reaction` event (off, action, isGroup, isSingleUser, null-safe).
-- Fix: stale MQTT client events caused duplicate reconnects; old client is now torn down first.
-- Fix: getSeqID transient failure during reconnect no longer kills the listener (backoff retry).
-- Fix: cookie expiry extension edited a copy; now updates the live jar.
-- Fix: login callback double-fire guard.
-- Change: uncaughtException logs stack for non-network errors.
-- Change: e2ee disabled by default; spinner TTY-only; update check opt-out.
+### Added
+- `api.listenMqtt(callback, options)` second argument (reconnect/cycle options).
+- Test suite (36 tests), `scripts/run-tests.js`, `scripts/syntax-check.js`.
+- Docs: README, MERGE_REPORT, THIRD_PARTY_NOTICES, upstream API docs in `docs/`.
 
+### Removed
+- `cheerio`, `totp-generator`, `@noble/curves`, `@noble/hashes` (unused in source).
+- Bogus `versionCheck` update notice (it compared against an unrelated npm package).

package/LICENSE

@@ -0,0 +1,23 @@
+MIT License
+
+Copyright (c) EryXenX and contributors (eryxenx-fca 1.0.0 - 1.1.9)
+Copyright (c) DongDev and contributors (original fca-unofficial lineage)
+Copyright (c) 2026 HR ID OY (hridoy-ultimate modifications)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,134 +1,154 @@
-# hridoy-ultimate v8.0.1
+# hridoy-ultimate
 
-**Ultimate Merged, Fixed & Advanced Facebook Chat API**
+**Version 8.0.5 - Owner/maintainer: HR ID OY**
 
-> Cookie-based login, session persistence, and MQTT reconnection are best-effort. Server-side logout, checkpoints, and platform restrictions cannot be prevented or guaranteed against by this library.
+An unofficial Facebook Chat API (FCA) for Node.js Messenger bots, unified from the
+`eryxenx-fca` 1.0.0 - 1.1.9 lineage (itself derived from fca-unofficial) with a hardened
+MQTT lifecycle: bounded exponential backoff, a reconnect budget, clean shutdown and no
+timer left behind after `stopListening()` / `logout()`.
 
----
+> **Unofficial.** This automates a personal Facebook account and may violate Facebook's
+> terms. Accounts can be restricted. Use a throwaway account, never one you can't lose.
 
-## ✅ Features
-
-| Feature | Status |
+## Verification status (read this first)
+| Area | Status |
 |---|---|
-| Session refresh helper (best-effort) | ⚠️ Best-effort only |
-| Conservative presence/delay options | ⚠️ No guarantee |
-| Inbox Smooth (bot inbox reply) | ✅ Active |
-| GoatBot Compatible | ✅ Ready |
-| Session Guard (auto-save) | ✅ Every 3min |
-| fb_dtsg Auto-Refresh | ✅ Every 20min |
-| MQTT Stable Reconnect | ✅ Active |
-| Error reporting | ✅ Host process handlers preserved |
-| E2EE Labyrinth Bridge | ✅ Active |
-| Facebook Protection | ✅ New in v1.0.6 |
-| Human-like Delay | ✅ New in v1.0.6 |
-
----
-
-## 📦 Install
+| Unit tests (backoff, scheduler, parsers, humanizer) | **PASS** (real code, no mocks) |
+| MQTT lifecycle, logout, package surface | **PASS - MOCKED** (fake mqtt/axios; see `test/helpers/stub-modules.js`) |
+| TypeScript typings | **PASS** with `tsc` against a consumer sample (Node types stubbed) |
+| Live Facebook login / MQTT / sending / reactions / attachments | **NOT TESTED** (no network or account in the build environment) |
+| E2EE (encrypted chats) | **NOT TESTED** - needs optional deps and an unbundled native library |
+| `npm install` from a clean registry | **NOT TESTED** (build sandbox was offline) |
+
+Full results: `docs/TEST_RESULTS.md`. Honest limits: [Known limitations](#known-limitations).
 
+## Install
+Requires Node.js >= 18.
 ```bash
-npm install
+npm install hridoy-ultimate            # from a registry, or:
+npm install ./hridoy-ultimate-8.0.5.tgz
 ```
+`sqlite3` compiles/downloads a native module; E2EE-related packages are optional.
 
----
-
-## 🚀 Usage (GoatBot / Goat-Bot)
-
+## Quick start
 ```js
-const login = require("hridoy-ultimate");
+const login = require("hridoy-ultimate");           // also: require(...).login, .default
 const fs = require("fs");
 
-login({ appState: JSON.parse(fs.readFileSync("appstate.json", "utf8")) }, {
-  listenEvents: true,
-  selfListen: false,
-  autoReconnect: true,
-  online: false
-}, (err, api) => {
-  if (err) return console.error(err);
+const appState = JSON.parse(fs.readFileSync("appstate.json", "utf8")); // keep this file secret
 
-  // Session guard — auto-save appstate
-  api.sessionGuard("appstate.json");
+login({ appState }, { listenEvents: true, autoReconnect: true }, (err, api) => {
+  if (err) return console.error("login failed:", err.error || err.message || err);
 
-  api.listenMqtt((err, event) => {
-    if (event.type === "message") {
-      api.sendMessage("Hello!", event.threadID);
+  const stop = api.listenMqtt((err, event) => {
+    if (err) {
+      if (err.type === "stop_listen") return console.error("listener gave up:", err.error);
+      return console.error(err);
     }
+    if (event.type === "message" && event.body === "ping") {
+      api.sendMessage("pong", event.threadID, undefined, event.messageID);
+      api.setMessageReaction("👍", event.messageID, event.threadID, () => {}, true);
+    }
+  }, { maxReconnectAttempts: 10 });
+
+  process.on("SIGINT", async () => {
+    stop.stopListening(async () => { await api.logout(); process.exit(0); });
   });
 });
 ```
-
----
-
-## ⚙️ config.json Options
-
-```json
-{
-  "antiLogout": { "enabled": true, "refreshIntervalMs": 1200000 },
-  "sessionGuard": { "enabled": true, "intervalMs": 180000 },
-  "automation": { "enabled": false },
-  "smooth": { "enabled": true, "messageDelay": 300 },
-  "facebookProtection": { "enabled": true, "blockAutomationDetection": true, "humanLikeDelay": true },
-  "inbox": { "enabled": true, "replyToInbox": true }
-}
+(Argument orders (`sendMessage(msg, threadID, callback, replyToMessageID)`,
+`setMessageReaction(reaction, messageID, threadID, callback, force)`) were read from the source; see
+`docs/UPSTREAM_API_DOCS.md` and `index.d.ts`. These calls are **NOT TESTED live**.)
+
+## Authentication and session security
+- Prefer **appState/cookie login**. Never commit `appstate.json`, cookies or tokens.
+- Credential (email/password/2FA) login goes through a **third-party HTTP API that you must
+  configure** (`apiServer` in `fca-config.json`). It is empty by default because those
+  secrets would be sent to that host. Only point it at a server you control.
+- Log lines mention cookie *counts*, but I did not audit every log call; treat console output as sensitive.
+- `api.getAppState()` output equals full account access.
+
+## Options
+Login options (`setOptions`): `online`, `selfListen`, `listenEvents`, `updatePresence`,
+`forceLogin`, `autoMarkRead`, `listenTyping`, `autoReconnect`, `emitReady`,
+`selfListenEvent`, `userAgent`, `proxy`, `humanize`.
+
+`api.listenMqtt(callback, options)` options (all optional):
+| option | default | meaning |
+|---|---|---|
+| `autoReconnect` | `true` | reconnect after socket loss |
+| `reconnectDelayMs` | 2000 | first backoff delay (doubles each attempt) |
+| `maxReconnectDelayMs` | 300000 | backoff ceiling |
+| `reconnectJitter` | 0.3 | +/- fraction randomised |
+| `maxReconnectAttempts` | 10 | `0` = unlimited (explicit opt-in); on exhaustion you get `{type:"stop_listen"}` |
+| `tmsWaitTimeoutMs` | 8000 | wait for first sync response before cycling |
+| `connectTimeoutMs` | 12000 | MQTT connect timeout |
+| `cycleMs` | 0 | periodic forced reconnect (off) |
+| `reconnectAfterStop` | `false` | restart after `stopListening` |
+
+The attempt counter resets after the first healthy sync response.
+
+## Events and MQTT recovery
+- `callback(err, event)`; events include `message`, `message_reply`, `message_edit`,
+  `message_reaction`, `message_unsend`, `event`, `typ`, `presence`, `share`,
+  `friend_request_received`, `friend_request_cancel` (type strings found in the source parsers;
+  per-type shapes are in the upstream docs; none exercised live).
+- Control events arrive as `err` objects: `{type:"ready"}`, `{type:"account_inactive"}`
+  (session lost; everything is stopped), `{type:"stop_listen"}` (retry budget exhausted or stopped).
+- Recovery: socket close/error -> backoff reconnect (reuses sync token) -> on repeated
+  failure refresh session/dtsg -> give up with `stop_listen`. Stale clients are ignored.
+- Shutdown: `stopListening(cb)` cancels all timers, ends the client, is idempotent.
+  `logout()` additionally disconnects E2EE and clears the dtsg refresh timer.
+
+## Opt-in features
+- **Humanizer** (`humanize: true`): delays command replies 2-3 s and *drops* commands inside a
+  5.5 s cooldown. Drops are intentional and counted; it is off by default. It contains
+  special handling for GoatBot globals.
+- **Optional native E2EE engine**: set `FCA_E2EE_NATIVE=1` and `FCA_E2EE_NATIVE_LIB=/path/to/messagix`.
+  The library is **not bundled** (provenance unverifiable). Without it, group E2EE and E2EE media are unavailable.
+
+## API surface
+Package exports (verified by test): `login`, `default`, `createFcaClient`, `MessengerBot`,
+`createMessengerBot`, `MessengerContext`, `attachThreadInfoRealtimeSync`,
+`applyThreadInfoRealtimeEvent`, `CommandHumanizer`, `createCommandHumanizer`,
+`createHumanizerMiddleware`, `humanizer`.
+
+Methods attached to `api` after login (one per file in `src/api/`; signatures in upstream docs):
+- action: `addExternalModule changeAvatar changeBio dismissScrapingWarning enableAutoSaveAppState getCurrentUserID handleFriendRequest logout refreshFb_dtsg setPostReaction unfriend`
+- http: `httpGet httpPost postFormData`
+- messaging: `addUserToGroup changeAdminStatus changeArchivedStatus changeBlockedStatus changeGroupImage changeNickname changeThreadColor changeThreadEmoji createNewGroup createPoll createThemeAI deleteMessage deleteThread editMessage forwardAttachment forwardMessage getEmojiUrl getFriendsList getMessage getThemePictures handleMessageRequest markAsDelivered markAsRead markAsReadAll markAsSeen muteThread pinMessage removeUserFromGroup resolvePhotoUrl scheduler searchForThread sendBroadcast sendMessage sendTypingIndicator setMessageReaction setTitle shareContact unsendMessage uploadAttachment`
+- threads: `getThreadHistory getThreadInfo getThreadList getThreadPictures`
+- users: `getUserID getUserInfo getUserInfoV2`
+- socket: `listenMqtt` (= `listen`), `listenE2EE`, `stopListening`, `stopListeningAsync`
+(Listed from the source tree; none were exercised against live Facebook.)
+
+## Troubleshooting
+- `Cannot find module ...` -> run `npm install`; optional E2EE deps may be absent by design.
+- Login callback error -> appState expired; re-export cookies. Credential login needs `apiServer`.
+- `stop_listen` event -> reconnect budget exhausted; check network/session, then call listen again.
+- `account_inactive` -> Facebook invalidated the session (checkpoint/logout); re-login manually.
+- A `Fca_Database/` folder appears in the working directory on first use (SQLite cache).
+
+## Known limitations
+- No live verification of anything that talks to Facebook; Facebook changes endpoints without notice.
+- Subscribe-then-publish ordering and the 8 s / 12 s timeouts follow upstream's changelog
+  reasoning and mqtt.js semantics; not confirmed against live servers.
+- Legacy HTTP paths still use the deprecated `request` library (`nexca-utils.js`); porting to axios is future work.
+- `sequelize`+`sqlite3` are hard dependencies (heavy); `index.d.ts` is upstream-derived and not exhaustive.
+- Vendored E2EE bundle has no license header or source.
+
+## Migration from eryxenx-fca 1.x
+- Package name `hridoy-ultimate`; Node >= 18.
+- Humanizer and native E2EE are now **opt-in** (they were default-on in 1.1.x / 1.0.8+).
+- `apiServer` has no default; autoUpdate is off.
+- Reconnects are bounded: handle `{type:"stop_listen"}`.
+- `api.listenMqtt(cb, options)` gains an optional second argument.
+
+## Develop
+```bash
+npm install
+npm test            # unit + integration (mocked) tests
+npm run lint        # syntax check of every source file
+npm pack            # builds hridoy-ultimate-8.0.5.tgz
 ```
-
----
-
-## 🔐 Anti-Logout System
-
-Cookie login করলে `api.logout()` automatically blocked হয়।
-- Session refresh does not guarantee that Facebook will preserve a login session
-- `api.logout()` is currently overridden; use `api.forceLogout()` only when you explicitly intend to terminate the session
-- Force logout দরকার হলে: `api.forceLogout()`
-- Anti-logout বন্ধ করতে: `api.stopAntiLogout()`
-
----
-
-## 📊 API Methods
-
-| Method | Description |
-|---|---|
-| `api.sendMessage(msg, threadID)` | Message পাঠাও |
-| `api.listenMqtt(callback)` | Message শোনো |
-| `api.sessionGuard(path, opts)` | Appstate auto-save |
-| `api.saveSession(path)` | Manual session save |
-| `api.getHealth()` | MQTT + session health |
-| `api.forceLogout()` | Force logout (opt-in) |
-| `api.stopAntiLogout()` | Anti-logout timer বন্ধ |
-| `api.refreshFb_dtsg()` | Manual fb_dtsg refresh |
-| `api.sendTypingIndicatorV2(typing, threadID)` | MQTT typing indicator |
-
----
-
-## 🛡️ Facebook Protection (v1.0.6)
-
-- `humanLikeDelay: true` — প্রতিটি message এ random 50-200ms delay, bot traffic pattern unpredictable
-- `blockAutomationDetection: true` — online=false, presence update বন্ধ
-- ফলে Facebook account এ restriction বা ban আসে না
-
----
-
-**hridoy-ultimate v8.0.1** — Built on toru-fca 1.2.0 (itself derived from HRIDOY-FCA / ST-FCA). Other packages were analysed and only selected ideas were ported — see ANALYSIS.md
-
-
-## What's new in v1.2.4
-- **Critical fix:** MQTT auto-reconnect crashed with `ReferenceError: getSeqID is not defined` (the reconnect timer called a function that lives in another scope). The factory now exposes it as `ctx._getSeqID` and the timer uses that, guarded by try/catch.
-- `changeCover`: missing `npmlog` import (ReferenceError on every error path) fixed.
-- `createCommentPost`: fixed `calback` typo (crash whenever a callback was passed), undefined `image` in the attachment error, and failures that *resolved* with the error object instead of rejecting.
-- `package.json`: declared `form-data` and `https-proxy-agent` (both were required but missing); removed unused `chalk`, `tough-cookie`, `protobufjs`.
-- `checkUpdate` now reads its version from `package.json` (was hard-coded 1.2.1). Example config version synced. CRLF line endings normalised to LF.
-- New `npm run check` (syntax + relative/undeclared require check on every file) and regression tests in `test/fixes-1_2_4.test.js`.
-
-## Earlier: v1.2.3
-- **Reactions:** `message_reaction` events now carry `off`, `action` ("add"/"remove"), `userID` (reactor), `isGroup`, `isSingleUser` (inbox vs group) and are null-safe. `selfListen:false` also ignores the bot's own reactions.
-- **api.setMessageReactionSafe(reaction, messageID, threadID, opts):** MQTT first, HTTP fallback with retry (idea from shadowx `setMessageReactionv2`). `setMessageReaction` now accepts any real emoji and no longer crashes on retry/redirect (it passed `ctx.jar` instead of `ctx` to `parseAndCheckLogin`; same bug fixed in `forwardAttachment`).
-- **api.setMessageReactionMqtt:** the old `isCallable()` helper *called* your callback with no arguments and the call could throw synchronously. Fixed; supports callbacks and Promises; real ack via `/ls_resp`.
-- **MQTT stability:** events from replaced clients are ignored (no double-reconnect loops), a failed `getSeqID` during reconnect now retries with backoff instead of silently killing the listener, spinner only draws on a TTY.
-- **Session safety:** cookie-expiry extension now really works (v1.2.0 edited a throw-away copy). Login callback can no longer fire twice.
-- **Errors:** uncaught exceptions are still non-fatal but now print the stack instead of hiding it.
-- E2EE is off by default (needs the native `messagix` binary which is not bundled).
-- Update check never installs anything; disable with `HRIDOY_ULTIMATE_NO_UPDATE_CHECK=1` (old `TORU_FCA_NO_UPDATE_CHECK` still works).
-
-## Honest notes
-- Login: use `appState` (cookie array / cookie string). `api.logout()` is blocked on purpose; use `api.forceLogout()` if you really want to log out.
-- "Facebook protection" (online=false, small delays) only lowers noise. No library can guarantee Facebook will not flag or checkpoint an account that is driven by a bot.
+Credits and licenses: `LICENSE`, `THIRD_PARTY_NOTICES.md`. Merge details: `MERGE_REPORT.md`.

package/docs/TEST_RESULTS.md

@@ -0,0 +1,70 @@
+# Test results (actual output)
+
+Environment: v22.22.2, Linux 6.18.44-fc-v114, no network, third-party modules stubbed (MOCKED where marked).
+Generated: 2026-10-13T00:50Z
+
+## npm test (node --test, spec reporter)
+```
+✔ [mocked] logout stops MQTT, disconnects E2EE and clears every timer (34.815074ms)
+✔ [mocked] logout works when no listener was ever started (10.349818ms)
+✔ [mocked] a failed logout request is reported, not swallowed, and the session stays usable (7.042588ms)
+✔ [mocked] sync queue is published only after every SUBACK (35.992484ms)
+✔ [mocked] reconnect after socket close uses backoff, then recovers (12.978848ms)
+✔ [mocked] stopListening during a cycle must not be revived by a pending retry (race regression) (10.298466ms)
+✔ [mocked] stopListening clears timers, ends the client and is safe to call twice (10.426547ms)
+✔ [mocked] late socket 'error' after stopListening does not throw (6.131105ms)
+✔ [mocked] calling listen twice replaces the old client (no duplicate connection) (8.659963ms)
+✔ [mocked] gives up after maxReconnectAttempts and reports stop_listen (no infinite loop) (7.160329ms)
+✔ [mocked] a healthy first sync resets the backoff counter (7.857639ms)
+✔ [mocked] humanizer middleware is NOT installed by default, and is when opted in (14.187447ms)
+✔ [mocked] emitAuth stops everything and reports account_inactive (7.957109ms)
+✔ [mocked] listen(callback, options) applies reconnect options per call (6.735507ms)
+✔ package metadata: name, version, owner, entry points exist (1.135404ms)
+✔ regression: every third-party module the source requires is declared (14.850827ms)
+✔ vendored E2EE bundle: its external requires are declared too (1.810192ms)
+✔ no prebuilt native binaries or default third-party credential host ship in the package (5.439855ms)
+✔ every JS file in the package parses (4215.825382ms)
+✔ [mocked] package loads with consistent exports (19.12184ms)
+✔ [mocked] login with empty options reports an error via callback and never throws (3230.691403ms)
+✔ humanizer: first command accepted with a bounded delay, burst inside cooldown dropped (1.957104ms)
+✔ humanizer: non-command messages pass untouched; per-thread isolation (0.413424ms)
+✔ humanizer: enabled:false never delays or drops (0.980328ms)
+✔ computeBackoff grows exponentially, is bounded and never negative (1.903627ms)
+✔ computeBackoff jitter stays within +/- jitter and clamps to max (0.181485ms)
+✔ computeBackoff tolerates garbage input (0.17167ms)
+✔ scheduleReconnect: single timer, debounce, stop, exhaustion (0.820579ms)
+✔ scheduleReconnect: a timer that fires after stop does nothing (race regression) (0.217074ms)
+✔ maxReconnectAttempts: 0 means unlimited only when explicitly set (1.317064ms)
+✔ clearListenerTimers is idempotent and clears every owned timer (0.41435ms)
+✔ detachClient: a late 'error' after detach must not throw (0.347064ms)
+✔ extractDtsg handles each supported markup shape (1.363764ms)
+✔ extractDtsg: jazoest forms, empty and non-string input (0.821093ms)
+✔ fingerprint: default UA and client hints are mutually consistent (0.728798ms)
+✔ fingerprint: Android UA yields mobile Android hints (no desktop contradiction) (0.272025ms)
+ℹ tests 36
+ℹ pass 36
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ duration_ms 15939.95031
+```
+
+## npm run lint
+```
+checked 151 files, 0 with syntax errors
+```
+
+## TypeScript consumer check (tsc, Node types stubbed)
+```
+tsc exit 0
+```
+
+## Same lifecycle tests against original eryxenx-fca 1.1.9
+```
+# tests 11
+# pass 1
+# fail 10
+```
+
+## NOT TESTED
+Live Facebook login/MQTT/sending/reactions/attachments, E2EE, clean-registry npm install.