hridoy-ultimate 8.0.5 → 9.0.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 9.0.0 - hridoy-ultimate (merge of 83 analysed builds)
+
+Base: hridoy-ultimate 8.0.5 (`fca.zip`), plus fixes taken from the `@eryxenx/fca` 1.0.0-1.1.9,
+`fca-eryxenx` 1.x-39.x lines (see `MERGE_REPORT.md` for the per-fix source versions).
+
+### Added
+- **Typing indicator, default ON** (`src/utils/typingIndicator.js`): shows typing when a
+  command-like message arrives, clears it when the reply is sent or after 8 s; zero added
+  latency; MQTT and E2EE threads. Options `typingIndicator: false | {...}`,
+  `api.getTypingIndicator()`, `api.setTypingIndicator()`, `api.withTyping()`.
+- `messagix.so` / `messagix.dll` bundled in `src/api/socket/e2ee/native/build/` (SHA-256 pinned
+  in a test and in `THIRD_PARTY_NOTICES.md`). Enabling needs only `FCA_E2EE_NATIVE=1`; the
+  engine stays opt-in because it kicks the vendored engine's socket (same E2EE device).
+- `MERGE_REPORT.md`, `THIRD_PARTY_NOTICES.md` (both were listed in `files` but missing).
+- 10 typing tests, fingerprint test, pinned-binary package test.
+
+### Fixed
+- `setMessageReaction` no longer falls back to the bogus thread id `"0"`; it rejects with a
+  clear error when the thread cannot be resolved.
+- Chrome fingerprint pool refreshed to 149.0.7827.102 / 151.0.7922.75 (was Chrome 131-135).
+  The User-Agent is now the reduced `Chrome/<major>.0.0.0` form real Chrome sends; the full
+  build stays in `Sec-CH-UA-Full-Version-List` (client hints derived from the same fingerprint).
+- `index.d.ts`: `sendTypingIndicator` had the wrong signature; 23 previously undeclared API methods
+  and the `humanize` / `typingIndicator` options are now declared.
+- Logout / stopListening clear typing timers.
+
 ## 8.0.5 - hridoy-ultimate (first release under this name)
 
 Built by merging the eryxenx-fca 1.0.0 - 1.1.9 lineage. Base tree: 1.1.9, with

package/MERGE_REPORT.md

@@ -0,0 +1,54 @@
+# Merge report - hridoy-ultimate 9.0.0
+
+## Inputs
+- 83 published packages, analysed statically (extract, per-version diff, `node --check`, reading
+  the core paths): `@eryxenx/fca` 1.0.0-1.1.9 (18), `fca-eryxenx` 1.0.0-29.0.0 (20),
+  3.0.2 + 30.0.0-39.1.8 (20), 4.0.x + 39.1.9-39.9.0 (20), 6.0.0-9.0.3 (5).
+- `fca.zip` = hridoy-ultimate 8.0.5, used as the base tree (already a hardened merge of
+  `@eryxenx/fca` 1.1.9 with `loginHelper.js` from 1.1.8, with a 36-test suite).
+- `messagix.so` / `messagix.dll` supplied by the maintainer.
+
+Nothing was run against Facebook. Not every one of the ~14,000 extracted files was read line by
+line; the 12,144 `.js/.cjs/.mjs` files contain only 352 distinct contents.
+
+## What the best builds contributed, and where it stands in 9.0.0
+Verified by reading the 8.0.5 code before touching it.
+
+| Improvement | Best source | Status |
+|---|---|---|
+| Stable MQTT (backoff, SUBACK, 8 s / 12 s timeouts, stale-client guard) | `fca-eryxenx` 20-23 | already in base (own implementation, tested) |
+| Native client reuse + `koffi.disposable` string free (leak fixes) | 39.2.0 / 39.2.1 | already in base |
+| 15 s `withTimeout` on native calls | 39.1.8 | already in base |
+| `getThreadInfo` E2EE branch | 39.1.6 | already in base |
+| E2EE group routing in react / unsend / edit | 39.2.2 | already in base (`isE2EEGroup`) |
+| Session keeper (cookie + `fb_dtsg` refresh) | 39.2.7 | already in base |
+| `Accept` header navigation vs XHR | 39.2.5 | already in base |
+| Attachment id fallback in `sendMessage` | 7.0.0 | already in base |
+| Native E2EE engine opt-in (not auto-connected) | 39.2.8 | already in base |
+| Logout stops MQTT / E2EE / timers | none (all builds lacked it) | already in base |
+| Typing indicator | none (only the opt-in humanizer had one) | **new in 9.0.0** |
+| Bundled `messagix` binaries | maintainer upload | **restored in 9.0.0, opt-in** |
+| Reduced UA + refreshed Chrome pool | fingerprint.js from 1.1.7, rebuilt | **new in 9.0.0** |
+| `setMessageReaction` thread `"0"` fallback | present in every build | **fixed in 9.0.0** |
+| `index.d.ts` coverage | 23 of 66 methods missing in 1.1.9 | **fixed in 9.0.0** |
+
+## Rejected on purpose
+- `autoLogin: true` default and the `minhdong.site` credential host (every `fca-eryxenx` build and
+  `@eryxenx/fca` 1.0.0-1.0.5). Credentials and the 2FA secret would go to a third party.
+- Default-on humanizer (silently drops commands inside its cooldown), default-on native engine
+  (kicks the vendored E2EE socket), bogus `versionCheck` (1.1.9), inert auto-update.
+- 39.3.0-39.9.0: branch cut from the 39.1.2-39.1.4 tree, loses the 39.2.x fixes, adds
+  `[E2EE-DEBUG]` logging of full reaction payloads. 39.1.0-39.1.4 / 39.3.0+ also ship a duplicate
+  17.5 MB native copy.
+- `fca-eryxenx` 9.0.0 (syntax error in `core/channel.js:178`), 3.0.2-6.0.0 (`editMessage` requires a
+  non-existent `../utils`), 4.0.4's dead "stability patch", the stray `index.js.nexca`, nested
+  `e2ee/e2ee/` copies.
+
+## Known issues kept (documented, not hidden)
+- `module/login.js` still installs process-wide `unhandledRejection` / `uncaughtException`
+  handlers that log and continue; they keep bots alive but can hide a fatal state.
+- `src/api/messaging/sendMessage.js` is loaded and then overridden by `src/api/socket/sendMessage.js`
+  (`loginHelper.js`); kept for backward compatibility.
+- Legacy HTTP paths still use the deprecated `request` library (`src/utils/nexca-utils.js`).
+- Native binaries: x86-64 only, stripped, license wording conflicts (see `THIRD_PARTY_NOTICES.md`).
+- Live Facebook behaviour (login, MQTT, send, react, E2EE, typing) is NOT verified here.

package/README.md

@@ -1,9 +1,10 @@
 # hridoy-ultimate
 
-**Version 8.0.5 - Owner/maintainer: HR ID OY**
+**Version 9.0.0 - Owner/maintainer: HR ID OY**
 
 An unofficial Facebook Chat API (FCA) for Node.js Messenger bots, unified from the
-`eryxenx-fca` 1.0.0 - 1.1.9 lineage (itself derived from fca-unofficial) with a hardened
+`@eryxenx/fca` 1.0.0 - 1.1.9 and `fca-eryxenx` 1.x - 39.x lineages (83 published builds
+analysed, see `MERGE_REPORT.md`; itself derived from fca-unofficial) with a hardened
 MQTT lifecycle: bounded exponential backoff, a reconnect budget, clean shutdown and no
 timer left behind after `stopListening()` / `logout()`.
 
@@ -13,11 +14,11 @@ timer left behind after `stopListening()` / `logout()`.
 ## Verification status (read this first)
 | Area | Status |
 |---|---|
-| Unit tests (backoff, scheduler, parsers, humanizer) | **PASS** (real code, no mocks) |
-| MQTT lifecycle, logout, package surface | **PASS - MOCKED** (fake mqtt/axios; see `test/helpers/stub-modules.js`) |
+| Unit tests (backoff, scheduler, parsers, humanizer, typing indicator, fingerprint) | **PASS** (real code, no mocks) |
+| MQTT lifecycle, logout, typing wiring, package surface (incl. pinned binary hashes) | **PASS - MOCKED** (fake mqtt/axios; see `test/helpers/stub-modules.js`) |
 | TypeScript typings | **PASS** with `tsc` against a consumer sample (Node types stubbed) |
 | Live Facebook login / MQTT / sending / reactions / attachments | **NOT TESTED** (no network or account in the build environment) |
-| E2EE (encrypted chats) | **NOT TESTED** - needs optional deps and an unbundled native library |
+| E2EE (encrypted chats) and the bundled native binaries | **NOT TESTED** - needs optional deps and a live account |
 | `npm install` from a clean registry | **NOT TESTED** (build sandbox was offline) |
 
 Full results: `docs/TEST_RESULTS.md`. Honest limits: [Known limitations](#known-limitations).
@@ -26,7 +27,7 @@ Full results: `docs/TEST_RESULTS.md`. Honest limits: [Known limitations](#known-
 Requires Node.js >= 18.
 ```bash
 npm install hridoy-ultimate            # from a registry, or:
-npm install ./hridoy-ultimate-8.0.5.tgz
+npm install ./hridoy-ultimate-9.0.0.tgz
 ```
 `sqlite3` compiles/downloads a native module; E2EE-related packages are optional.
 
@@ -71,7 +72,7 @@ login({ appState }, { listenEvents: true, autoReconnect: true }, (err, api) => {
 ## Options
 Login options (`setOptions`): `online`, `selfListen`, `listenEvents`, `updatePresence`,
 `forceLogin`, `autoMarkRead`, `listenTyping`, `autoReconnect`, `emitReady`,
-`selfListenEvent`, `userAgent`, `proxy`, `humanize`.
+`selfListenEvent`, `userAgent`, `proxy`, `humanize`, `typingIndicator`.
 
 `api.listenMqtt(callback, options)` options (all optional):
 | option | default | meaning |
@@ -100,12 +101,35 @@ The attempt counter resets after the first healthy sync response.
 - Shutdown: `stopListening(cb)` cancels all timers, ends the client, is idempotent.
   `logout()` additionally disconnects E2EE and clears the dtsg refresh timer.
 
+## Typing indicator (default ON)
+Shows "typing..." in a thread the moment a command-like message arrives (GoatBot prefix,
+`/`, `!`, `.`) and clears it when your reply is sent, or after a safety timeout (8 s). It
+adds **no latency**: the event is delivered first, the typing signal is fire-and-forget. Works
+for normal and E2EE threads.
+
+```js
+login(cookie, { typingIndicator: false });                    // off
+login(cookie, { typingIndicator: { onlyCommands: false } });  // type for every text message
+login(cookie, { typingIndicator: { commands: ["#"], maxMs: 6000, groups: true, dms: true } });
+
+api.setTypingIndicator(false);                    // switch at runtime
+await api.withTyping(threadID, async () => { /* slow work */ });   // typing while fn runs
+api.sendTypingIndicator(threadID, true, { duration: 5000 });       // manual control
+```
+A GoatBot `config.enableTypingIndicator: false` also disables it unless you pass the option
+explicitly. When `humanize` is enabled the humanizer shows typing itself and this one stays out of the way.
+
 ## Opt-in features
 - **Humanizer** (`humanize: true`): delays command replies 2-3 s and *drops* commands inside a
   5.5 s cooldown. Drops are intentional and counted; it is off by default. It contains
   special handling for GoatBot globals.
-- **Optional native E2EE engine**: set `FCA_E2EE_NATIVE=1` and `FCA_E2EE_NATIVE_LIB=/path/to/messagix`.
-  The library is **not bundled** (provenance unverifiable). Without it, group E2EE and E2EE media are unavailable.
+- **Native E2EE engine** (group E2EE receive/send and E2EE media): the `messagix` binaries are
+  bundled in `src/api/socket/e2ee/native/build/` (x86-64 `.so` / `.dll`, SHA-256 pinned in
+  `THIRD_PARTY_NOTICES.md`). It is still **off by default**: set `FCA_E2EE_NATIVE=1` to enable it
+  (`FCA_E2EE_NATIVE_LIB=/path` overrides the bundled file, e.g. for ARM or macOS). Why off: the
+  native and vendored engines register the same E2EE device and kick each other, so enabling it
+  causes socket churn. Provenance of the binaries is "supplied by the maintainer, not
+  independently verifiable" - see `THIRD_PARTY_NOTICES.md`.
 
 ## API surface
 Package exports (verified by test): `login`, `default`, `createFcaClient`, `MessengerBot`,
@@ -134,12 +158,13 @@ Methods attached to `api` after login (one per file in `src/api/`; signatures in
 - Subscribe-then-publish ordering and the 8 s / 12 s timeouts follow upstream's changelog
   reasoning and mqtt.js semantics; not confirmed against live servers.
 - Legacy HTTP paths still use the deprecated `request` library (`nexca-utils.js`); porting to axios is future work.
-- `sequelize`+`sqlite3` are hard dependencies (heavy); `index.d.ts` is upstream-derived and not exhaustive.
+- `sequelize`+`sqlite3` are hard dependencies (heavy); `index.d.ts` is upstream-derived; newer methods are typed loosely (`any`).
 - Vendored E2EE bundle has no license header or source.
 
 ## Migration from eryxenx-fca 1.x
 - Package name `hridoy-ultimate`; Node >= 18.
 - Humanizer and native E2EE are now **opt-in** (they were default-on in 1.1.x / 1.0.8+).
+- 9.0.0: typing indicator is **on by default** (`typingIndicator: false` to disable); the native binaries are bundled again (still opt-in).
 - `apiServer` has no default; autoUpdate is off.
 - Reconnects are bounded: handle `{type:"stop_listen"}`.
 - `api.listenMqtt(cb, options)` gains an optional second argument.
@@ -149,6 +174,6 @@ Methods attached to `api` after login (one per file in `src/api/`; signatures in
 npm install
 npm test            # unit + integration (mocked) tests
 npm run lint        # syntax check of every source file
-npm pack            # builds hridoy-ultimate-8.0.5.tgz
+npm pack            # builds hridoy-ultimate-9.0.0.tgz
 ```
 Credits and licenses: `LICENSE`, `THIRD_PARTY_NOTICES.md`. Merge details: `MERGE_REPORT.md`.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,36 @@
+# Third-party notices
+
+hridoy-ultimate is MIT licensed (see `LICENSE`). It contains or builds on the following.
+
+## Code lineage (MIT)
+- `eryxenx-fca` / `@eryxenx/fca` and its contributors (builds 1.x - 39.x were analysed and merged).
+- DongDev and the original `fca-unofficial` lineage (<https://github.com/dongp06>).
+- Optional dependency `fca-unofficial` from `github:VangBanLaNhat/fca-unofficial`.
+
+## Bundled native binaries (opt-in, `FCA_E2EE_NATIVE=1`)
+Location: `src/api/socket/e2ee/native/build/`
+
+| File | Size (bytes) | Type | SHA-256 |
+|---|---|---|---|
+| `messagix.so` | 17,504,872 | ELF 64-bit x86-64, stripped | `6249f50cc23de0b11a710266a2323c306d44cf46530880e58e0cd1cf4b5bf8d9` |
+| `messagix.dll` | 15,802,368 | PE32+ DLL x86-64, stripped | `f8597ba86c90c39cec19b660e75eba59f2022678eb20866b740cfa321036885e` |
+
+- Supplied by the maintainer. They are byte-identical to the copies found in every analysed
+  `eryxenx` package (58 `.so` and 45 `.dll` copies, no differing hash). They are stripped, so
+  they could **not** be audited here, and no source ships with them.
+- A test (`test/integration/package.test.js`) fails if either hash changes.
+- Platforms: x86-64 Linux and Windows only. macOS and ARM (e.g. Termux) need your own build via
+  `FCA_E2EE_NATIVE_LIB=/path/to/messagix`.
+- **License question to resolve before you redistribute:** the analysed packages disagree about the
+  upstream. `native/NOTICE.md` describes mautrix-go / mautrix-meta as MPL-2.0, while the
+  `vendor/stfca-native/NOTICE.md` that shipped in some builds (39.1.0-39.1.4, 39.3.0-39.9.0) says the
+  `messagix` part is AGPL-3.0. AGPL-3.0 carries network-use source-offer obligations. Check the
+  upstream repository for the exact build you use. See also `src/api/socket/e2ee/native/NOTICE.md`.
+
+## Vendored E2EE bundle
+`src/api/socket/e2ee/vendor/fme/dist/index.cjs` (bundled `fb-messenger-e2ee` client) has no license
+header or source in the analysed packages. Treat its terms as unknown.
+
+## Runtime dependencies
+Declared in `package.json`; each keeps its own license (axios, mqtt, ws, sequelize, sqlite3,
+@signalapp/libsignal-client, protobufjs, koffi and others).

package/docs/TEST_RESULTS.md

@@ -1,70 +1,68 @@
 # Test results (actual output)
 
 Environment: v22.22.2, Linux 6.18.44-fc-v114, no network, third-party modules stubbed (MOCKED where marked).
-Generated: 2026-10-13T00:50Z
+Generated: 2026-10-13T20:03Z
 
 ## npm test (node --test, spec reporter)
 ```
-✔ [mocked] logout stops MQTT, disconnects E2EE and clears every timer (34.815074ms)
-✔ [mocked] logout works when no listener was ever started (10.349818ms)
-✔ [mocked] a failed logout request is reported, not swallowed, and the session stays usable (7.042588ms)
-✔ [mocked] sync queue is published only after every SUBACK (35.992484ms)
-✔ [mocked] reconnect after socket close uses backoff, then recovers (12.978848ms)
-✔ [mocked] stopListening during a cycle must not be revived by a pending retry (race regression) (10.298466ms)
-✔ [mocked] stopListening clears timers, ends the client and is safe to call twice (10.426547ms)
-✔ [mocked] late socket 'error' after stopListening does not throw (6.131105ms)
-✔ [mocked] calling listen twice replaces the old client (no duplicate connection) (8.659963ms)
-✔ [mocked] gives up after maxReconnectAttempts and reports stop_listen (no infinite loop) (7.160329ms)
-✔ [mocked] a healthy first sync resets the backoff counter (7.857639ms)
-✔ [mocked] humanizer middleware is NOT installed by default, and is when opted in (14.187447ms)
-✔ [mocked] emitAuth stops everything and reports account_inactive (7.957109ms)
-✔ [mocked] listen(callback, options) applies reconnect options per call (6.735507ms)
-✔ package metadata: name, version, owner, entry points exist (1.135404ms)
-✔ regression: every third-party module the source requires is declared (14.850827ms)
-✔ vendored E2EE bundle: its external requires are declared too (1.810192ms)
-✔ no prebuilt native binaries or default third-party credential host ship in the package (5.439855ms)
-✔ every JS file in the package parses (4215.825382ms)
-✔ [mocked] package loads with consistent exports (19.12184ms)
-✔ [mocked] login with empty options reports an error via callback and never throws (3230.691403ms)
-✔ humanizer: first command accepted with a bounded delay, burst inside cooldown dropped (1.957104ms)
-✔ humanizer: non-command messages pass untouched; per-thread isolation (0.413424ms)
-✔ humanizer: enabled:false never delays or drops (0.980328ms)
-✔ computeBackoff grows exponentially, is bounded and never negative (1.903627ms)
-✔ computeBackoff jitter stays within +/- jitter and clamps to max (0.181485ms)
-✔ computeBackoff tolerates garbage input (0.17167ms)
-✔ scheduleReconnect: single timer, debounce, stop, exhaustion (0.820579ms)
-✔ scheduleReconnect: a timer that fires after stop does nothing (race regression) (0.217074ms)
-✔ maxReconnectAttempts: 0 means unlimited only when explicitly set (1.317064ms)
-✔ clearListenerTimers is idempotent and clears every owned timer (0.41435ms)
-✔ detachClient: a late 'error' after detach must not throw (0.347064ms)
-✔ extractDtsg handles each supported markup shape (1.363764ms)
-✔ extractDtsg: jazoest forms, empty and non-string input (0.821093ms)
-✔ fingerprint: default UA and client hints are mutually consistent (0.728798ms)
-✔ fingerprint: Android UA yields mobile Android hints (no desktop contradiction) (0.272025ms)
-ℹ tests 36
-ℹ pass 36
+✔ [mocked] logout stops MQTT, disconnects E2EE and clears every timer (50.186778ms)
+✔ [mocked] logout works when no listener was ever started (14.258077ms)
+✔ [mocked] a failed logout request is reported, not swallowed, and the session stays usable (10.037149ms)
+✔ [mocked] sync queue is published only after every SUBACK (46.187501ms)
+✔ [mocked] reconnect after socket close uses backoff, then recovers (17.548562ms)
+✔ [mocked] stopListening during a cycle must not be revived by a pending retry (race regression) (16.384888ms)
+✔ [mocked] stopListening clears timers, ends the client and is safe to call twice (21.34972ms)
+✔ [mocked] late socket 'error' after stopListening does not throw (9.571458ms)
+✔ [mocked] calling listen twice replaces the old client (no duplicate connection) (12.14378ms)
+✔ [mocked] gives up after maxReconnectAttempts and reports stop_listen (no infinite loop) (9.182964ms)
+✔ [mocked] a healthy first sync resets the backoff counter (16.256224ms)
+✔ [mocked] humanizer middleware is NOT installed by default, and is when opted in (26.861027ms)
+✔ [mocked] emitAuth stops everything and reports account_inactive (8.374336ms)
+✔ [mocked] listen(callback, options) applies reconnect options per call (12.31406ms)
+✔ package metadata: name, version, owner, entry points exist (1.413356ms)
+✔ regression: every third-party module the source requires is declared (24.539389ms)
+✔ vendored E2EE bundle: its external requires are declared too (2.38059ms)
+✔ only the pinned messagix binaries ship, native stays opt-in, no default third-party credential host (125.254664ms)
+✔ every JS file in the package parses (6235.728346ms)
+✔ [mocked] package loads with consistent exports (23.934551ms)
+✔ [mocked] login with empty options reports an error via callback and never throws (3129.536404ms)
+✔ [mocked] typing middleware is installed by default and shows typing for a command without delaying delivery (44.078959ms)
+✔ [mocked] plain chat does not trigger typing, and stopListening clears pending typing timers (16.606205ms)
+✔ [mocked] typing middleware is NOT installed when the humanizer owns typing, or when no controller exists (24.276443ms)
+✔ fingerprint: UA is the reduced Chrome/<major>.0.0.0 form and the full build only appears in client hints (2.989355ms)
+✔ humanizer: first command accepted with a bounded delay, burst inside cooldown dropped (2.724519ms)
+✔ humanizer: non-command messages pass untouched; per-thread isolation (0.56259ms)
+✔ humanizer: enabled:false never delays or drops (1.317371ms)
+✔ computeBackoff grows exponentially, is bounded and never negative (5.845535ms)
+✔ computeBackoff jitter stays within +/- jitter and clamps to max (0.418652ms)
+✔ computeBackoff tolerates garbage input (0.318463ms)
+✔ scheduleReconnect: single timer, debounce, stop, exhaustion (1.587298ms)
+✔ scheduleReconnect: a timer that fires after stop does nothing (race regression) (0.359697ms)
+✔ maxReconnectAttempts: 0 means unlimited only when explicitly set (1.961505ms)
+✔ clearListenerTimers is idempotent and clears every owned timer (0.47163ms)
+✔ detachClient: a late 'error' after detach must not throw (0.605172ms)
+✔ extractDtsg handles each supported markup shape (2.885756ms)
+✔ extractDtsg: jazoest forms, empty and non-string input (1.591823ms)
+✔ fingerprint: default UA and client hints are mutually consistent (1.64789ms)
+✔ fingerprint: Android UA yields mobile Android hints (no desktop contradiction) (0.50116ms)
+✔ typing: command-like message starts typing; plain chat / own messages / non-message events do not (1.739404ms)
+✔ typing: GoatBot prefix and extra prefixes count as commands; onlyCommands:false types for any text (0.355195ms)
+✔ typing: middleware calls next() synchronously (zero added latency) and then starts typing (1.268156ms)
+✔ typing: sending a reply clears typing after the send resolves (16.890953ms)
+✔ typing: safety timeout stops a typing indicator that never got a reply (1.652981ms)
+✔ typing: repeated starts inside minGapMs do not re-publish; after the gap they do (0.464619ms)
+✔ typing: disabled by option false, and by GoatBot enableTypingIndicator:false unless explicitly overridden (0.321804ms)
+✔ typing: configure(false) clears active timers; stopAll is idempotent and publishes nothing (0.424433ms)
+✔ typing: a throwing / rejecting sendTypingIndicator never breaks the bot (11.013855ms)
+✔ typing: withTyping shows typing around fn and clears it even when fn throws (1.512949ms)
+ℹ tests 50
+ℹ suites 0
+ℹ pass 50
 ℹ fail 0
 ℹ cancelled 0
 ℹ skipped 0
-ℹ duration_ms 15939.95031
+ℹ todo 0
 ```
 
-## npm run lint
-```
-checked 151 files, 0 with syntax errors
-```
-
-## TypeScript consumer check (tsc, Node types stubbed)
-```
-tsc exit 0
-```
-
-## Same lifecycle tests against original eryxenx-fca 1.1.9
-```
-# tests 11
-# pass 1
-# fail 10
-```
-
-## NOT TESTED
-Live Facebook login/MQTT/sending/reactions/attachments, E2EE, clean-registry npm install.
+## Not verified here
+Live Facebook login, MQTT traffic, sending, reactions, typing indicator on the wire, E2EE and the bundled native binaries (no network, no account).

package/index.d.ts

@@ -1,6 +1,5 @@
-// Type definitions for hridoy-ultimate. Derived from the upstream (dongdev / EryXenX)
-// typings; they cover the classic FCA surface and are NOT exhaustive for
-// hridoy/nexca additions (see README "Known limitations").
+// Type definitions for hridoy-ultimate 9.0.0 (author: HR ID OY). Derived from the upstream
+// (dongdev / EryXenX) typings. Newer / internal methods are declared loosely (any) on purpose.
   import type EventEmitter from "events";
   import type { Duplex, Readable, Transform } from "stream";
 
@@ -147,9 +146,39 @@ declare function sendMessage(
     // Reactions & Interactions
     setMessageReaction: (reaction: string, messageID: string, threadID: string, callback?: (err?: Error) => void, forceCustomReaction?: boolean) => Promise<void>;
     setMessageReactionMqtt: (reaction: string, messageID: string, threadID: string, callback?: (err?: Error) => void) => Promise<void>;
-    sendTypingIndicator: (threadID: string, callback?: (err?: Error) => void) => Promise<void>;
+    sendTypingIndicator: (threadID: string | string[], isTyping: boolean, options?: IFCAU_TypingSendOptions | ((err?: Error) => void), callback?: (err?: Error) => void) => Promise<void>;
     sendTypingIndicatorMqtt: (isTyping: boolean, threadID: string, callback?: (err?: Error) => void) => Promise<void>;
 
+    // Typing indicator controller (hridoy-ultimate 9.0.0)
+    getTypingIndicator: () => IFCAU_TypingIndicator;
+    setTypingIndicator: (option: boolean | IFCAU_TypingIndicatorOptions) => IFCAU_TypingIndicatorOptions;
+    withTyping: <T>(threadID: string, fn: () => T | Promise<T>) => Promise<T>;
+
+    // Previously undeclared methods (typed loosely on purpose; see README "Known limitations")
+    OldMessage: (...args: any[]) => any;
+    sendMessageMqtt: (...args: any[]) => any;
+    listenE2EE: (callback: (err: Error | null, event: any) => void) => any;
+    getMessage: (...args: any[]) => any;
+    getUserInfoV2: (...args: any[]) => any;
+    searchForThread: (...args: any[]) => any;
+    shareContact: (...args: any[]) => any;
+    uploadAttachment: (...args: any[]) => any;
+    sendBroadcast: (...args: any[]) => any;
+    sessionGuard: (...args: any[]) => any;
+    refreshFb_dtsg: (...args: any[]) => any;
+    httpGet: (...args: any[]) => any;
+    httpPost: (...args: any[]) => any;
+    postFormData: (...args: any[]) => any;
+    addExternalModule: (...args: any[]) => any;
+    changeAvatar: (...args: any[]) => any;
+    changeBio: (...args: any[]) => any;
+    createThemeAI: (...args: any[]) => any;
+    getThemePictures: (...args: any[]) => any;
+    dismissScrapingWarning: (...args: any[]) => any;
+    handleFriendRequest: (...args: any[]) => any;
+    setPostReaction: (...args: any[]) => any;
+    unfriend: (...args: any[]) => any;
+
     // Polls
     createPoll: (title: string, threadID: string, options?: { [item: string]: boolean }, callback?: (err?: Error) => void) => Promise<void>;
 
@@ -749,4 +778,35 @@ declare function sendMessage(
     autoMarkRead: boolean;
     proxy: string;
     online: boolean;
+    /** Opt-in command anti-spam (reply delay + cooldown). Off by default. */
+    humanize: boolean | Record<string, any>;
+    /** Typing indicator. Default ON; false disables; object fine-tunes it. */
+    typingIndicator: boolean | IFCAU_TypingIndicatorOptions;
+  };
+
+  export type IFCAU_TypingIndicatorOptions = {
+    enabled?: boolean;
+    /** Only type for command-like messages (GoatBot prefix, "/", "!", "."). Default true. */
+    onlyCommands?: boolean;
+    /** Extra command prefixes. */
+    commands?: string[];
+    /** Safety stop in ms when no reply is sent. Default 8000. */
+    maxMs?: number;
+    /** Do not re-send typing for the same thread inside this window. Default 1500. */
+    minGapMs?: number;
+    groups?: boolean;
+    dms?: boolean;
   };
+
+  export type IFCAU_TypingSendOptions = { duration?: number; autoStop?: boolean; type?: number };
+
+  export interface IFCAU_TypingIndicator {
+    readonly enabled: boolean;
+    options: Required<IFCAU_TypingIndicatorOptions>;
+    configure(option: boolean | IFCAU_TypingIndicatorOptions): IFCAU_TypingIndicatorOptions;
+    isTyping(threadID: string): boolean;
+    start(threadID: string): boolean;
+    stop(threadID: string): boolean;
+    stopAll(): void;
+    withTyping<T>(threadID: string, fn: () => T | Promise<T>): Promise<T>;
+  }

package/index.js

@@ -22,6 +22,12 @@ module.exports.MessengerContext = MessengerContext;
 module.exports.attachThreadInfoRealtimeSync = attachThreadInfoRealtimeSync;
 module.exports.applyThreadInfoRealtimeEvent = applyThreadInfoRealtimeEvent;
 
+// Typing indicator (default on)
+const typingIndicator = require("./src/utils/typingIndicator");
+module.exports.TypingIndicator = typingIndicator.TypingIndicator;
+module.exports.createTypingIndicator = typingIndicator.createTypingIndicator;
+module.exports.typingIndicator = typingIndicator;
+
 // Command anti-spam / humanizer
 module.exports.CommandHumanizer = humanizer.CommandHumanizer;
 module.exports.createCommandHumanizer = humanizer.createCommandHumanizer;

package/module/login.js

@@ -100,7 +100,8 @@ function login(loginData, options, callback) {
     online: true,
     emitReady: false,
     userAgent: getDefaultUserAgent(),
-    humanize: undefined
+    humanize: undefined,
+    typingIndicator: undefined
   };
   setOptions(globalOptions, options);
   let prCallback = null;

package/module/loginHelper.js

@@ -1355,6 +1355,21 @@ function loginHelper(appState, Cookie, email, password, globalOptions, callback)
           logger(`sendMessage nexca override failed (non-fatal): ${e && e.message ? e.message : String(e)}`, "warn");
         }
 
+        // Typing indicator (default ON, zero added latency): shows "typing..." as soon as a
+        // command-like message arrives, clears it when the reply goes out. Must exist before
+        // the listenMqtt override below because that is where its middleware is installed.
+        try {
+          const { createTypingIndicator, wrapSendMessage } = require("../src/utils/typingIndicator");
+          const typing = createTypingIndicator(api, ctxMain, ctxMain.globalOptions && ctxMain.globalOptions.typingIndicator, logger);
+          ctxMain._typing = typing;
+          wrapSendMessage(api, typing);
+          api.getTypingIndicator = () => typing;
+          api.setTypingIndicator = (opt) => typing.configure(opt);
+          api.withTyping = (threadID, fn) => typing.withTyping(threadID, fn);
+        } catch (e) {
+          logger(`typing indicator init failed (non-fatal): ${e && e.message ? e.message : String(e)}`, "warn");
+        }
+
         // listenMqtt override with nexca version (better MQTT stability)
         try {
           api.listenMqtt = require("../src/api/socket/listenMqtt")(defaultFuncs, api, ctxMain);

package/module/options.js

@@ -29,6 +29,12 @@ function setOptions(globalOptions, options) {
         globalOptions.humanize = options.humanize;
         break;
       }
+      case "typingIndicator": {
+        // true/undefined = default (on), false = off, object = fine tuning
+        // (see src/utils/typingIndicator.js DEFAULTS)
+        globalOptions.typingIndicator = options.typingIndicator;
+        break;
+      }
       case "proxy": {
         if (typeof options.proxy !== "string") {
           delete globalOptions.proxy;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hridoy-ultimate",
-  "version": "8.0.5",
-  "description": "Unified Facebook Chat API (FCA) for Messenger bots - with a hardened MQTT lifecycle (bounded backoff, clean shutdown) and opt-in anti-spam/E2EE extras.",
+  "version": "9.0.0",
+  "description": "Unified Facebook Chat API (FCA) for Messenger bots - hardened MQTT lifecycle, default-on typing indicator, bundled (opt-in) native E2EE engine.",
   "main": "index.js",
   "types": "index.d.ts",
   "exports": {
@@ -43,7 +43,9 @@
     "mqtt",
     "bot",
     "unofficial",
-    "hridoy-ultimate"
+    "hridoy-ultimate",
+    "typing-indicator",
+    "e2ee"
   ],
   "author": {
     "name": "HR ID OY"

package/src/api/action/logout.js

@@ -68,6 +68,7 @@ module.exports = function(defaultFuncs, api, ctx) {
         ctx.loggedIn = false;
         ctx._stopped = true;
         lifecycle.clearListenerTimers(ctx, true);
+        if (ctx._typing && typeof ctx._typing.stopAll === "function") ctx._typing.stopAll();
         const steps = [];
         if (typeof api.stopListening === "function") {
           steps.push(new Promise(function(resolve) { api.stopListening(resolve); }));

package/src/api/messaging/setMessageReaction.js

@@ -23,7 +23,7 @@ module.exports = function (defaultFuncs, api, ctx) {
     // threadID না থাকলে e2ee bridge এর ম্যাপ থেকে বের করার চেষ্টা, তারপর ctx fallback
     const resolvedThreadID = threadID ||
       (api.e2ee && typeof api.e2ee.getThreadIdForMessage === "function" ? api.e2ee.getThreadIdForMessage(messageID) : null);
-    const finalThreadID = resolvedThreadID || ctx.lastThreadID || "0";
+    const finalThreadID = resolvedThreadID || ctx.lastThreadID; // hridoy-ultimate: no more bogus thread "0" fallback
 
     const isE2EEDM = ctx.threadTypes && ctx.threadTypes[String(finalThreadID)] === 'dm' &&
       api.e2ee && typeof api.e2ee.isConnected === "function" && api.e2ee.isConnected();
@@ -48,6 +48,11 @@ module.exports = function (defaultFuncs, api, ctx) {
         if (cb) cb(err);
         return reject(err);
       }
+      if (!finalThreadID) {
+        const err = new Error("setMessageReaction: threadID is required and could not be resolved from messageID");
+        if (cb) cb(err);
+        return reject(err);
+      }
       if (typeof ctx.wsReqNumber !== "number") ctx.wsReqNumber = 0;
       if (typeof ctx.wsTaskNumber !== "number") ctx.wsTaskNumber = 0;
       const reqID = ++ctx.wsReqNumber;

package/src/api/socket/e2ee/index.js

@@ -17,6 +17,7 @@
  */
 
 const path = require("path");
+const fs = require("fs");
 const logger = require("../../../utils/nexca-logger");
 const nativeMediaBridge = require("./native/nativeMediaBridge");
 const { decodeIncomingMedia } = require("./mediaDecode");
@@ -26,11 +27,26 @@ const localMediaServer = require("./localMediaServer");
 // unsend, markRead) is OPT-IN in hridoy-ultimate. It needs a prebuilt
 // "messagix" shared library (mautrix, MPL-2.0) that this package does NOT
 // bundle because its provenance could not be verified from the supplied
-// archives. Enable with FCA_E2EE_NATIVE=1 and point FCA_E2EE_NATIVE_LIB at a
-// binary you built/trust. Upstream 1.0.8 had flipped this to default-on; that
-// is rejected here (see MERGE_REPORT.md).
+// archives. hridoy-ultimate 9.0.0 now ships the user-supplied messagix.so /
+// messagix.dll under native/build/ (SHA-256 pinned in THIRD_PARTY_NOTICES.md),
+// but the engine stays OPT-IN: set FCA_E2EE_NATIVE=1 (FCA_E2EE_NATIVE_LIB can
+// still override the bundled path). Upstream 1.0.8 flipped this to default-on;
+// that is rejected here because the native and vendored engines share one E2EE
+// device and kick each other (see the note in connect()).
+function _bundledNativeLib() {
+    const base = path.join(__dirname, "native", "build");
+    if (process.platform === "win32") return path.join(base, "messagix.dll");
+    if (process.platform === "darwin") return path.join(base, "messagix.dylib");
+    return path.join(base, "messagix.so");
+}
+function _nativeLibAvailable() {
+    try {
+        if (process.env.FCA_E2EE_NATIVE_LIB) return fs.existsSync(process.env.FCA_E2EE_NATIVE_LIB);
+        return fs.existsSync(_bundledNativeLib());
+    } catch (_) { return false; }
+}
 function _nativeMediaEnabled() {
-    return process.env.FCA_E2EE_NATIVE === "1" && !!process.env.FCA_E2EE_NATIVE_LIB;
+    return process.env.FCA_E2EE_NATIVE === "1" && _nativeLibAvailable();
 }
 
 // Simple FIFO-bounded Map.set — evicts the oldest entry once maxSize is
@@ -388,11 +404,11 @@ class E2EEBridge {
         // loop (a fresh Noise handshake every few seconds). Until the two
         // engines can use distinct device ids, the native engine must stay
         // OFF for the vendored socket to stay alive. Opt back in with
-        // native engine not enabled (needs FCA_E2EE_NATIVE=1 + FCA_E2EE_NATIVE_LIB) (group E2EE receive + native media sends) if you
+        // native engine not enabled (set FCA_E2EE_NATIVE=1; bundled messagix binary is used unless FCA_E2EE_NATIVE_LIB overrides it) (group E2EE receive + native media sends) if you
         // accept the resulting socket churn.
         const _nativeEnabled = _nativeMediaEnabled();
         if (!_nativeEnabled) {
-            logger.info("E2EE", "[native-group] native engine disabled (native engine not enabled (needs FCA_E2EE_NATIVE=1 + FCA_E2EE_NATIVE_LIB)) — vendored socket kept exclusive to avoid server-side device kicks");
+            logger.info("E2EE", "[native-group] native engine disabled (native engine not enabled (set FCA_E2EE_NATIVE=1; bundled messagix binary is used unless FCA_E2EE_NATIVE_LIB overrides it)) — vendored socket kept exclusive to avoid server-side device kicks");
         }
         try {
             if (!_nativeEnabled) throw { _skipNative: true };
@@ -526,7 +542,7 @@ class E2EEBridge {
                 // Native engine disabled (default) — it shares the same E2EE
                 // device id as the vendored socket and triggers server-side
                 // device kicks. Group E2EE text send unavailable in this mode.
-                throw new Error("E2EE group text send requires the native engine, which is disabled (native engine not enabled (needs FCA_E2EE_NATIVE=1 + FCA_E2EE_NATIVE_LIB)) to protect the vendored socket from server-side device kicks.");
+                throw new Error("E2EE group text send requires the native engine, which is disabled (native engine not enabled (set FCA_E2EE_NATIVE=1; bundled messagix binary is used unless FCA_E2EE_NATIVE_LIB overrides it)) to protect the vendored socket from server-side device kicks.");
             }
             // Vendor's own group Sender-Key encryption is broken (see native-group
             // listener above) — group text sends go through native instead.
@@ -605,7 +621,7 @@ class E2EEBridge {
             let result;
             try {
                 if (!_nativeMediaEnabled()) {
-                    throw new Error("native engine disabled (native engine not enabled (needs FCA_E2EE_NATIVE=1 + FCA_E2EE_NATIVE_LIB)) — see native-group note");
+                    throw new Error("native engine disabled (native engine not enabled (set FCA_E2EE_NATIVE=1; bundled messagix binary is used unless FCA_E2EE_NATIVE_LIB overrides it)) — see native-group note");
                 }
                 result = await nativeMediaBridge.sendMedia(appState, threadId, mediaType, data, mimeType, {
                     caption: text || undefined,
@@ -723,7 +739,7 @@ class E2EEBridge {
         const isGroup = this._knownE2EEGroups.has(String(threadId));
         try {
             if (!_nativeMediaEnabled())
-                throw new Error("native engine disabled (native engine not enabled (needs FCA_E2EE_NATIVE=1 + FCA_E2EE_NATIVE_LIB))");
+                throw new Error("native engine disabled (native engine not enabled (set FCA_E2EE_NATIVE=1; bundled messagix binary is used unless FCA_E2EE_NATIVE_LIB overrides it))");
             return await nativeMediaBridge.sendReaction(this.api.getAppState(), threadId, messageId, senderJid, reaction, isGroup);
         } catch (err) {
             if (isGroup) {
@@ -746,7 +762,7 @@ class E2EEBridge {
         const isGroup = this._knownE2EEGroups.has(String(threadId));
         try {
             if (!_nativeMediaEnabled())
-                throw new Error("native engine disabled (native engine not enabled (needs FCA_E2EE_NATIVE=1 + FCA_E2EE_NATIVE_LIB))");
+                throw new Error("native engine disabled (native engine not enabled (set FCA_E2EE_NATIVE=1; bundled messagix binary is used unless FCA_E2EE_NATIVE_LIB overrides it))");
             return await nativeMediaBridge.unsendMessage(this.api.getAppState(), threadId, messageId, isGroup);
         } catch (err) {
             if (isGroup) {
@@ -764,7 +780,7 @@ class E2EEBridge {
         const isGroup = this._knownE2EEGroups.has(String(threadId));
         if (isGroup) {
             if (!_nativeMediaEnabled())
-                throw new Error("E2EE group edit requires the native engine, which is disabled (native engine not enabled (needs FCA_E2EE_NATIVE=1 + FCA_E2EE_NATIVE_LIB)).");
+                throw new Error("E2EE group edit requires the native engine, which is disabled (native engine not enabled (set FCA_E2EE_NATIVE=1; bundled messagix binary is used unless FCA_E2EE_NATIVE_LIB overrides it)).");
             // Vendor's group Sender-Key encryption is broken, so route
             // group edits through native (it doesn't need a chatJid — the
             // messageId alone identifies which chat/message to edit).

package/src/api/socket/e2ee/native/lib/index.mjs

@@ -28,7 +28,7 @@ function libPath() {
 __name(libPath, "libPath");
 var LIB_FILE = libPath();
 if (!fs.existsSync(LIB_FILE)) {
-  throw new Error(`Native library not found at ${LIB_FILE}. Set FCA_E2EE_NATIVE_LIB to a trusted messagix build for this platform.`);
+  throw new Error(`Native library not found at ${LIB_FILE}. No bundled build exists for this platform/arch (only x86-64 .so/.dll ship). Set FCA_E2EE_NATIVE_LIB to a trusted messagix build.`);
 }
 var lib = koffi.load(LIB_FILE);
 var mk = /* @__PURE__ */ __name((ret, name, args) => lib.func(name, ret, args), "mk");

package/src/api/socket/listenMqtt.js

@@ -75,6 +75,18 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
   }
   api.getHumanizer = () => ctx._humanizer || null;
 
+  // Typing indicator middleware: shared by MQTT and E2EE events (listenE2EE uses the same
+  // ctx._middleware). When the humanizer is enabled it already shows typing during its own
+  // delay, so ours stays out of its way.
+  if (ctx._typing && !ctx._typingMiddlewareInstalled && !ctx._humanizerMiddlewareInstalled) {
+    try {
+      middleware.use("typing", ctx._typing.middleware());
+      ctx._typingMiddlewareInstalled = true;
+    } catch (e) {
+      logger(`Typing middleware install failed (non-fatal): ${e && e.message ? e.message : String(e)}`, "warn");
+    }
+  }
+
   function installPostGuard() {
     if (ctx._postGuarded) return defaultFuncs.post;
     const rawPost = defaultFuncs.post && defaultFuncs.post.bind(defaultFuncs);
@@ -350,6 +362,7 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
         ctx._stopped = true;
         ctx._reconnectAttempt = 0;
         lifecycle.clearListenerTimers(ctx, false);
+        if (ctx._typing && typeof ctx._typing.stopAll === "function") ctx._typing.stopAll();
 
         ctx._ending = true;
         unsubAll(() => endQuietly(() => {

package/src/utils/fingerprint.js

@@ -6,20 +6,24 @@
 // claiming the exact same browser build is a trivially detectable pattern.
 // Keep this list current; entries that are far behind Chrome's real release
 // timeline are themselves a signal.
+// Builds taken from Google's published Chrome stable release notes (149.0.7827.102 on
+// 2026-06, 151.0.7922.75 on 2026-08). Chrome's release cadence is about one major per
+// 4 weeks (two weeks from Chrome 153 on), so refresh this list every few months.
 const CHROME_VERSIONS = [
-  "131.0.6778.140",
-  "132.0.6834.111",
-  "133.0.6943.98",
-  "134.0.6998.117",
-  "135.0.7049.85"
+  "149.0.7827.102",
+  "151.0.7922.75"
 ];
 
 function pickChromeVersion() {
   return CHROME_VERSIONS[Math.floor(Math.random() * CHROME_VERSIONS.length)];
 }
 
+// Real Chrome sends a *reduced* User-Agent ("Chrome/<major>.0.0.0"); the full build only
+// appears in Sec-CH-UA-Full-Version-List. A UA carrying the full build number is itself
+// an anomaly, so the UA is reduced here and the full build is kept in the fingerprint.
 function buildUserAgent(version) {
-  return `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${version} Safari/537.36`;
+  const major = String(version).split(".")[0];
+  return `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${major}.0.0.0 Safari/537.36`;
 }
 
 // Chrome's Sec-Ch-Ua "GREASE" brand slot rotates through a small set of
@@ -60,7 +64,12 @@ function clientHintsFromUA(ua) {
   const s = String(ua || getDefaultUserAgent());
   const chromeMatch = s.match(/Chrome\/(\d+)\.(\d+)\.(\d+)\.(\d+)/);
   const major = chromeMatch ? chromeMatch[1] : String(getFingerprint().major);
-  const full = chromeMatch ? chromeMatch[0].split("/")[1] : getFingerprint().version;
+  let full = chromeMatch ? chromeMatch[0].split("/")[1] : getFingerprint().version;
+  // Reduced UA ("151.0.0.0"): report the real full build for our own fingerprint major.
+  if (chromeMatch && chromeMatch[2] === "0" && chromeMatch[3] === "0" && chromeMatch[4] === "0" &&
+      String(getFingerprint().major) === major) {
+    full = getFingerprint().version;
+  }
   const isMobile = /Mobile|Android|iPhone|iPad/i.test(s);
 
   let platform = "Windows";

package/src/utils/typingIndicator.js

@@ -0,0 +1,202 @@
+"use strict";
+
+/**
+ * Typing indicator (hridoy-ultimate 9.0.0).
+ *
+ * Shows "typing…" in a thread as soon as a command-like message arrives and
+ * clears it when the bot sends its reply (or after a safety timeout). It never
+ * delays event delivery or the reply itself: next() is called first, the
+ * typing signal is fire-and-forget.
+ *
+ * Works for MQTT threads and E2EE threads (api.sendTypingIndicator routes to
+ * api.e2ee.sendTyping for connected E2EE DMs).
+ */
+
+const { isCommandLike, isNoPrefixAdminCommand } = require("./humanizer");
+
+const DEFAULTS = Object.freeze({
+  enabled: true,
+  onlyCommands: true, // type only when the incoming message looks like a command
+  commands: [],       // extra prefixes (GoatBot prefix and "/", "!", "." are always used)
+  maxMs: 8000,        // safety stop when no reply is sent
+  minGapMs: 1500,     // never re-send "typing" for the same thread inside this window
+  groups: true,
+  dms: true
+});
+
+function goatBotConfig() {
+  try {
+    return typeof global !== "undefined" && global.GoatBot && global.GoatBot.config ? global.GoatBot.config : null;
+  } catch (_) {
+    return null;
+  }
+}
+
+/** Normalise the user option: undefined/true -> defaults, false -> disabled, object -> merged. */
+function normalizeOptions(opt) {
+  if (opt === false) return Object.assign({}, DEFAULTS, { enabled: false });
+  const merged = Object.assign({}, DEFAULTS, opt && typeof opt === "object" ? opt : {});
+  // A GoatBot config that explicitly turns the feature off wins unless the caller
+  // passed an explicit option.
+  if (opt === undefined || opt === null) {
+    const cfg = goatBotConfig();
+    if (cfg && cfg.enableTypingIndicator === false) merged.enabled = false;
+  }
+  merged.maxMs = Math.max(1000, Number(merged.maxMs) || DEFAULTS.maxMs);
+  merged.minGapMs = Math.max(0, Number(merged.minGapMs) || 0);
+  merged.commands = Array.isArray(merged.commands) ? merged.commands.filter((p) => typeof p === "string" && p) : [];
+  return merged;
+}
+
+class TypingIndicator {
+  constructor(api, ctx, options, log) {
+    this.api = api;
+    this.ctx = ctx || {};
+    this.log = typeof log === "function" ? log : () => {};
+    this.options = normalizeOptions(options);
+    this.active = new Map(); // threadID -> { timer, startedAt }
+  }
+
+  configure(options) {
+    this.options = normalizeOptions(options);
+    if (!this.options.enabled) this.stopAll();
+    return this.options;
+  }
+
+  get enabled() {
+    return this.options.enabled === true;
+  }
+
+  isTyping(threadID) {
+    return this.active.has(String(threadID));
+  }
+
+  _prefixes() {
+    const list = ["/", "!", "."].concat(this.options.commands);
+    const cfg = goatBotConfig();
+    if (cfg && typeof cfg.prefix === "string" && cfg.prefix) list.push(cfg.prefix);
+    return list;
+  }
+
+  /** Should this incoming event trigger a typing indicator? */
+  wants(event) {
+    if (!this.enabled || !event || typeof event !== "object") return false;
+    if (event.type !== "message" && event.type !== "message_reply") return false;
+    if (!event.threadID || typeof event.body !== "string" || !event.body.trim()) return false;
+    if (this.ctx.userID && String(event.senderID) === String(this.ctx.userID)) return false;
+    if (event.isGroup === true && !this.options.groups) return false;
+    if (event.isGroup === false && !this.options.dms) return false;
+    if (!this.options.onlyCommands) return true;
+    return isCommandLike(event.body, this._prefixes()) || isNoPrefixAdminCommand(event);
+  }
+
+  _publish(threadID, state) {
+    const fn = this.api && this.api.sendTypingIndicator;
+    if (typeof fn !== "function") return;
+    try {
+      // autoStop:false -> we own the stop; duration keeps Facebook's own timeout just past ours.
+      const r = fn.call(this.api, threadID, state, { autoStop: false, duration: this.options.maxMs + 2000 });
+      if (r && typeof r.catch === "function") r.catch(() => {});
+    } catch (_) { /* typing is cosmetic: never throw into the bot */ }
+  }
+
+  start(threadID) {
+    if (!this.enabled || !threadID) return false;
+    const tid = String(threadID);
+    const now = Date.now();
+    const cur = this.active.get(tid);
+    if (cur) {
+      // Already typing: just push the safety stop out, and do not re-send inside minGapMs.
+      clearTimeout(cur.timer);
+      cur.timer = this._arm(tid);
+      if (now - cur.startedAt < this.options.minGapMs) return false;
+      cur.startedAt = now;
+      this._publish(tid, true);
+      return true;
+    }
+    this.active.set(tid, { timer: this._arm(tid), startedAt: now });
+    this._publish(tid, true);
+    return true;
+  }
+
+  _arm(tid) {
+    const t = setTimeout(() => this.stop(tid), this.options.maxMs);
+    if (t && typeof t.unref === "function") t.unref();
+    return t;
+  }
+
+  stop(threadID) {
+    if (!threadID) return false;
+    const tid = String(threadID);
+    const cur = this.active.get(tid);
+    if (!cur) return false;
+    clearTimeout(cur.timer);
+    this.active.delete(tid);
+    this._publish(tid, false);
+    return true;
+  }
+
+  /** Clear every timer without publishing (used on logout / stopListening: the socket is going away). */
+  stopAll() {
+    for (const cur of this.active.values()) clearTimeout(cur.timer);
+    this.active.clear();
+  }
+
+  /** Called by the sendMessage wrapper: clear typing once the message has gone out. */
+  noteSend(threadID, result) {
+    const ids = Array.isArray(threadID) ? threadID : [threadID];
+    const stopAfter = () => ids.forEach((id) => { if (id) this.stop(id); });
+    if (!ids.some((id) => id && this.isTyping(id))) return;
+    if (result && typeof result.then === "function") result.then(stopAfter, stopAfter);
+    else {
+      const t = setTimeout(stopAfter, 300);
+      if (t && typeof t.unref === "function") t.unref();
+    }
+  }
+
+  /** Run fn while "typing…" is shown in threadID; always clears afterwards. */
+  async withTyping(threadID, fn) {
+    this.start(threadID);
+    try {
+      return await fn();
+    } finally {
+      this.stop(threadID);
+    }
+  }
+
+  /** Middleware for ctx._middleware (shared by MQTT and E2EE listeners). */
+  middleware() {
+    return (event, next) => {
+      next(); // never delay event delivery
+      try {
+        if (this.wants(event)) this.start(event.threadID);
+      } catch (_) { /* cosmetic */ }
+    };
+  }
+}
+
+/** Wrap api.sendMessage so a reply clears the typing indicator of its thread. */
+function wrapSendMessage(api, typing) {
+  if (!api || typeof api.sendMessage !== "function" || api.sendMessage.__typingWrapped) return false;
+  const original = api.sendMessage;
+  const wrapped = function (msg, threadID) {
+    const result = original.apply(this, arguments);
+    try { typing.noteSend(threadID, result); } catch (_) { /* cosmetic */ }
+    return result;
+  };
+  wrapped.__typingWrapped = true;
+  api.sendMessage = wrapped;
+  return true;
+}
+
+function createTypingIndicator(api, ctx, options, log) {
+  return new TypingIndicator(api, ctx, options, log);
+}
+
+module.exports = {
+  TypingIndicator,
+  createTypingIndicator,
+  wrapSendMessage,
+  normalizeOptions,
+  DEFAULTS
+};

package/test/integration/package.test.js

@@ -21,7 +21,7 @@ function walk(dir, out = []) {
 
 test("package metadata: name, version, owner, entry points exist", () => {
   assert.equal(pkg.name, "hridoy-ultimate");
-  assert.equal(pkg.version, "8.0.5");
+  assert.equal(pkg.version, "9.0.0");
   assert.equal(pkg.author.name, "HR ID OY");
   assert.ok(pkg.maintainers.some((m) => m.name === "HR ID OY"));
   assert.ok(fs.existsSync(path.join(root, pkg.main)));
@@ -56,15 +56,25 @@ test("vendored E2EE bundle: its external requires are declared too", () => {
   for (const n of names) assert.ok(declared.has(n), `${n} used by vendor bundle but undeclared`);
 });
 
-test("no prebuilt native binaries or default third-party credential host ship in the package", () => {
+test("only the pinned messagix binaries ship, native stays opt-in, no default third-party credential host", () => {
+  const crypto = require("crypto");
   const files = walk(root);
-  const bin = files.filter((p) => /\.(so|dll|dylib|node|exe)$/.test(p));
-  assert.deepEqual(bin, []);
+  const bin = files.filter((p) => /\.(so|dll|dylib|node|exe)$/.test(p)).map((p) => path.relative(root, p).split(path.sep).join("/")).sort();
+  assert.deepEqual(bin, [
+    "src/api/socket/e2ee/native/build/messagix.dll",
+    "src/api/socket/e2ee/native/build/messagix.so"
+  ]);
+  const sha = (f) => crypto.createHash("sha256").update(fs.readFileSync(path.join(root, f))).digest("hex");
+  assert.equal(sha(bin[1]), "6249f50cc23de0b11a710266a2323c306d44cf46530880e58e0cd1cf4b5bf8d9");
+  assert.equal(sha(bin[0]), "f8597ba86c90c39cec19b660e75eba59f2022678eb20866b740cfa321036885e");
+  const e2ee = fs.readFileSync(path.join(root, "src/api/socket/e2ee/index.js"), "utf8");
+  assert.match(e2ee, /process\.env\.FCA_E2EE_NATIVE === "1" && _nativeLibAvailable\(\)/, "native engine must stay opt-in");
   const hits = files.filter((p) => /\.(js|cjs|mjs|json)$/.test(p) && fs.readFileSync(p, "utf8").includes("minhdong.site"));
   assert.deepEqual(hits.map((p) => path.relative(root, p)), []);
   const cfg = fs.readFileSync(path.join(root, "module/config.js"), "utf8");
   assert.match(cfg, /apiServer:\s*""/);
   assert.match(cfg, /autoUpdate:\s*false/);
+  assert.match(cfg, /autoLogin:\s*false/);
 });
 
 test("every JS file in the package parses", () => {
@@ -81,7 +91,7 @@ test("[mocked] package loads with consistent exports", () => {
   assert.equal(m.default, m.login);
   const expected = ["login", "default", "createFcaClient", "MessengerBot", "createMessengerBot", "MessengerContext",
     "attachThreadInfoRealtimeSync", "applyThreadInfoRealtimeEvent", "CommandHumanizer", "createCommandHumanizer",
-    "createHumanizerMiddleware", "humanizer"];
+    "createHumanizerMiddleware", "humanizer", "TypingIndicator", "createTypingIndicator", "typingIndicator"];
   assert.deepEqual(Object.keys(m).sort(), expected.sort(), "export surface changed: update README + this list");
   for (const k of expected) assert.notEqual(m[k], undefined, `${k} is undefined`);
 });

package/test/integration/typing-wiring.test.js

@@ -0,0 +1,71 @@
+"use strict";
+/**
+ * MOCKED integration: the typing indicator is wired into the real listenMqtt factory through the
+ * shared ctx._middleware (also used by listenE2EE) and is torn down by stopListening().
+ */
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const path = require("path");
+const os = require("os");
+const fs = require("fs");
+const root = process.env.HRIDOY_TEST_ROOT || path.join(__dirname, "..", "..");
+const stubs = require("../helpers/stub-modules");
+stubs.install();
+process.chdir(fs.mkdtempSync(path.join(os.tmpdir(), "hridoy-typing-")));
+
+function build({ withTyping = true, globalOptions = {} } = {}) {
+  stubs.purge(root);
+  stubs.FakeMqttClient.instances.length = 0;
+  const { TypingIndicator } = require(path.join(root, "src/utils/typingIndicator"));
+  const sent = [];
+  const api = {
+    getCookies: () => "c_user=1; xs=abc",
+    refreshFb_dtsg: () => Promise.resolve(),
+    sendTypingIndicator: (tid, state) => { sent.push([tid, state]); return Promise.resolve(); }
+  };
+  const ctx = {
+    userID: "100000000000001", clientId: "abcd1234", loggedIn: true, firstListen: true, lastSeqId: 42,
+    globalOptions: Object.assign({ autoReconnect: true, emitReady: true, userAgent: "UA" }, globalOptions),
+    tasks: new Map(), _mqttOpt: {}
+  };
+  if (withTyping) ctx._typing = new TypingIndicator(api, ctx, undefined);
+  const defaultFuncs = { get: () => Promise.resolve({ data: "" }), post: () => Promise.reject(new Error("network down (test)")) };
+  const factory = require(path.join(root, "src/api/socket/listenMqtt.js"));
+  const listen = factory(defaultFuncs, api, ctx);
+  const events = [];
+  const emitter = listen((err, msg) => events.push({ err, msg }));
+  return { ctx, api, sent, events, emitter };
+}
+
+const stopAndWait = (s) => new Promise((r) => s.emitter.stopListening(r));
+const msg = (over) => Object.assign({ type: "message", threadID: "t9", senderID: "42", body: "/ping", isGroup: false }, over);
+
+test("[mocked] typing middleware is installed by default and shows typing for a command without delaying delivery", async () => {
+  const s = build();
+  assert.ok(s.ctx._middleware.list().includes("typing"));
+  let delivered = null;
+  s.ctx._middleware.process(msg(), (err, ev) => { delivered = ev; });
+  assert.ok(delivered && delivered.body === "/ping", "event delivered synchronously");
+  assert.deepEqual(s.sent, [["t9", true]]);
+  await stopAndWait(s);
+});
+
+test("[mocked] plain chat does not trigger typing, and stopListening clears pending typing timers", async () => {
+  const s = build();
+  s.ctx._middleware.process(msg({ body: "hello everyone" }), () => {});
+  assert.deepEqual(s.sent, []);
+  s.ctx._middleware.process(msg(), () => {});
+  assert.equal(s.ctx._typing.isTyping("t9"), true);
+  await stopAndWait(s);
+  assert.equal(s.ctx._typing.isTyping("t9"), false, "stopListening tears typing down");
+});
+
+test("[mocked] typing middleware is NOT installed when the humanizer owns typing, or when no controller exists", async () => {
+  const hz = build({ globalOptions: { humanize: true } });
+  assert.ok(!hz.ctx._middleware.list().includes("typing"));
+  assert.ok(hz.ctx._middleware.list().includes("humanizer"));
+  await stopAndWait(hz);
+  const none = build({ withTyping: false });
+  assert.ok(!none.ctx._middleware.list().includes("typing"));
+  await stopAndWait(none);
+});

package/test/unit/fingerprint.test.js

@@ -0,0 +1,19 @@
+"use strict";
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const path = require("path");
+const root = process.env.HRIDOY_TEST_ROOT || path.join(__dirname, "..", "..");
+const fp = require(path.join(root, "src/utils/fingerprint"));
+
+test("fingerprint: UA is the reduced Chrome/<major>.0.0.0 form and the full build only appears in client hints", () => {
+  const ua = fp.getDefaultUserAgent();
+  const m = ua.match(/Chrome\/(\d+)\.(\d+)\.(\d+)\.(\d+)/);
+  assert.ok(m, ua);
+  assert.deepEqual([m[2], m[3], m[4]], ["0", "0", "0"], "UA must not leak the full build");
+  const { version, major } = fp.getFingerprint();
+  assert.equal(String(major), m[1]);
+  const h = fp.clientHintsFromUA(ua);
+  assert.ok(h["sec-ch-ua-full-version-list"].includes(`"Google Chrome";v="${version}"`));
+  assert.ok(h["sec-ch-ua"].includes(`"Google Chrome";v="${major}"`));
+  assert.ok(major >= 149, "pool must not fall back to years-old Chrome builds");
+});

package/test/unit/typing.test.js

@@ -0,0 +1,136 @@
+"use strict";
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const path = require("path");
+const root = process.env.HRIDOY_TEST_ROOT || path.join(__dirname, "..", "..");
+const { TypingIndicator, wrapSendMessage, normalizeOptions } = require(path.join(root, "src/utils/typingIndicator"));
+
+function fakeApi() {
+  const calls = [];
+  return {
+    calls,
+    sendTypingIndicator(threadID, state, opts) { calls.push([threadID, state, opts]); return Promise.resolve(); },
+    sendMessage(msg, threadID) { return Promise.resolve({ messageID: "m1", threadID }); }
+  };
+}
+const cmd = (over) => Object.assign({ type: "message", threadID: "t1", senderID: "u1", body: "/help", isGroup: true }, over);
+
+test("typing: command-like message starts typing; plain chat / own messages / non-message events do not", () => {
+  const api = fakeApi();
+  const t = new TypingIndicator(api, { userID: "bot" }, undefined);
+  assert.equal(t.wants(cmd()), true);
+  assert.equal(t.wants(cmd({ body: "hello there" })), false);
+  assert.equal(t.wants(cmd({ senderID: "bot" })), false);
+  assert.equal(t.wants(cmd({ type: "typ" })), false);
+  assert.equal(t.wants(cmd({ body: "   " })), false);
+  t.stopAll();
+});
+
+test("typing: GoatBot prefix and extra prefixes count as commands; onlyCommands:false types for any text", () => {
+  global.GoatBot = { config: { prefix: "+" } };
+  try {
+    const t = new TypingIndicator(fakeApi(), {}, { commands: ["#"] });
+    assert.equal(t.wants(cmd({ body: "+ping" })), true);
+    assert.equal(t.wants(cmd({ body: "#x" })), true);
+    const all = new TypingIndicator(fakeApi(), {}, { onlyCommands: false });
+    assert.equal(all.wants(cmd({ body: "just chatting" })), true);
+  } finally { delete global.GoatBot; }
+});
+
+test("typing: middleware calls next() synchronously (zero added latency) and then starts typing", () => {
+  const api = fakeApi();
+  const t = new TypingIndicator(api, {}, undefined);
+  const order = [];
+  const origStart = t.start.bind(t);
+  t.start = (tid) => { order.push("start"); return origStart(tid); };
+  t.middleware()(cmd(), () => order.push("next"));
+  assert.deepEqual(order, ["next", "start"]);
+  assert.equal(api.calls.length, 1);
+  assert.deepEqual(api.calls[0].slice(0, 2), ["t1", true]);
+  assert.equal(api.calls[0][2].autoStop, false);
+  t.stopAll();
+});
+
+test("typing: sending a reply clears typing after the send resolves", async () => {
+  const api = fakeApi();
+  const t = new TypingIndicator(api, {}, undefined);
+  assert.equal(wrapSendMessage(api, t), true);
+  assert.equal(wrapSendMessage(api, t), false, "wrapping is idempotent");
+  t.start("t1");
+  const res = await api.sendMessage("hi", "t1");
+  assert.equal(res.messageID, "m1", "result passes through unchanged");
+  await new Promise((r) => setImmediate(r));
+  assert.equal(t.isTyping("t1"), false);
+  assert.deepEqual(api.calls.map((c) => c[1]), [true, false]);
+});
+
+test("typing: safety timeout stops a typing indicator that never got a reply", (ctx) => {
+  ctx.mock.timers.enable({ apis: ["setTimeout", "Date"], now: 10_000 });
+  const api = fakeApi();
+  const t = new TypingIndicator(api, {}, { maxMs: 3000 });
+  t.start("t1");
+  assert.equal(t.isTyping("t1"), true);
+  ctx.mock.timers.tick(2999);
+  assert.equal(t.isTyping("t1"), true);
+  ctx.mock.timers.tick(2);
+  assert.equal(t.isTyping("t1"), false);
+  assert.deepEqual(api.calls.map((c) => c[1]), [true, false]);
+});
+
+test("typing: repeated starts inside minGapMs do not re-publish; after the gap they do", (ctx) => {
+  ctx.mock.timers.enable({ apis: ["setTimeout", "Date"], now: 50_000 });
+  const api = fakeApi();
+  const t = new TypingIndicator(api, {}, { minGapMs: 1500, maxMs: 8000 });
+  assert.equal(t.start("t1"), true);
+  ctx.mock.timers.tick(500);
+  assert.equal(t.start("t1"), false);
+  ctx.mock.timers.tick(1500);
+  assert.equal(t.start("t1"), true);
+  assert.equal(api.calls.filter((c) => c[1] === true).length, 2);
+  t.stopAll();
+});
+
+test("typing: disabled by option false, and by GoatBot enableTypingIndicator:false unless explicitly overridden", () => {
+  assert.equal(normalizeOptions(false).enabled, false);
+  assert.equal(normalizeOptions(undefined).enabled, true, "default is ON");
+  global.GoatBot = { config: { enableTypingIndicator: false } };
+  try {
+    assert.equal(normalizeOptions(undefined).enabled, false);
+    assert.equal(normalizeOptions(true).enabled, true, "explicit option wins");
+  } finally { delete global.GoatBot; }
+  const api = fakeApi();
+  const t = new TypingIndicator(api, {}, false);
+  assert.equal(t.start("t1"), false);
+  assert.equal(api.calls.length, 0);
+});
+
+test("typing: configure(false) clears active timers; stopAll is idempotent and publishes nothing", () => {
+  const api = fakeApi();
+  const t = new TypingIndicator(api, {}, undefined);
+  t.start("a"); t.start("b");
+  assert.equal(api.calls.length, 2);
+  t.configure(false);
+  t.stopAll();
+  assert.equal(t.isTyping("a") || t.isTyping("b"), false);
+  assert.equal(api.calls.length, 2, "no 'typing off' sent when tearing down");
+});
+
+test("typing: a throwing / rejecting sendTypingIndicator never breaks the bot", async () => {
+  const bad = { sendTypingIndicator() { throw new Error("boom"); } };
+  const rej = { sendTypingIndicator() { return Promise.reject(new Error("nope")); } };
+  const t1 = new TypingIndicator(bad, {}, undefined);
+  const t2 = new TypingIndicator(rej, {}, undefined);
+  assert.doesNotThrow(() => t1.middleware()(cmd(), () => {}));
+  assert.doesNotThrow(() => t2.middleware()(cmd(), () => {}));
+  await new Promise((r) => setImmediate(r));
+  t1.stopAll(); t2.stopAll();
+});
+
+test("typing: withTyping shows typing around fn and clears it even when fn throws", async () => {
+  const api = fakeApi();
+  const t = new TypingIndicator(api, {}, undefined);
+  assert.equal(await t.withTyping("t1", async () => 42), 42);
+  await assert.rejects(() => t.withTyping("t2", async () => { throw new Error("x"); }), /x/);
+  assert.equal(t.isTyping("t1") || t.isTyping("t2"), false);
+  assert.deepEqual(api.calls.map((c) => c[1]), [true, false, true, false]);
+});