hridoy-ultimate 9.0.0 → 9.0.2

package/CHANGELOG.md

@@ -1,71 +1,348 @@
 # Changelog
 
-## 9.0.0 - hridoy-ultimate (merge of 83 analysed builds)
-
-Base: hridoy-ultimate 8.0.5 (`fca.zip`), plus fixes taken from the `@eryxenx/fca` 1.0.0-1.1.9,
-`fca-eryxenx` 1.x-39.x lines (see `MERGE_REPORT.md` for the per-fix source versions).
-
-### Added
-- **Typing indicator, default ON** (`src/utils/typingIndicator.js`): shows typing when a
-  command-like message arrives, clears it when the reply is sent or after 8 s; zero added
-  latency; MQTT and E2EE threads. Options `typingIndicator: false | {...}`,
-  `api.getTypingIndicator()`, `api.setTypingIndicator()`, `api.withTyping()`.
-- `messagix.so` / `messagix.dll` bundled in `src/api/socket/e2ee/native/build/` (SHA-256 pinned
-  in a test and in `THIRD_PARTY_NOTICES.md`). Enabling needs only `FCA_E2EE_NATIVE=1`; the
-  engine stays opt-in because it kicks the vendored engine's socket (same E2EE device).
-- `MERGE_REPORT.md`, `THIRD_PARTY_NOTICES.md` (both were listed in `files` but missing).
-- 10 typing tests, fingerprint test, pinned-binary package test.
-
-### Fixed
-- `setMessageReaction` no longer falls back to the bogus thread id `"0"`; it rejects with a
-  clear error when the thread cannot be resolved.
-- Chrome fingerprint pool refreshed to 149.0.7827.102 / 151.0.7922.75 (was Chrome 131-135).
-  The User-Agent is now the reduced `Chrome/<major>.0.0.0` form real Chrome sends; the full
-  build stays in `Sec-CH-UA-Full-Version-List` (client hints derived from the same fingerprint).
-- `index.d.ts`: `sendTypingIndicator` had the wrong signature; 23 previously undeclared API methods
-  and the `humanize` / `typingIndicator` options are now declared.
-- Logout / stopListening clear typing timers.
-
-## 8.0.5 - hridoy-ultimate (first release under this name)
-
-Built by merging the eryxenx-fca 1.0.0 - 1.1.9 lineage. Base tree: 1.1.9, with
-`module/loginHelper.js` from 1.1.8 (1.1.9 regressed it).
-
-### Security
-- Removed the hard-coded third-party credential-login host; `apiServer` is now empty by
-  default and credential login refuses to run without one explicitly configured.
-- Removed unverifiable prebuilt native binaries (messagix .so/.dll). Native E2EE engine is
-  opt-in (`FCA_E2EE_NATIVE=1` + `FCA_E2EE_NATIVE_LIB`).
-- `autoUpdate` default is now `false` (it was an inert stub upstream).
-
-### Fixed
-- Pending reconnect / getSeqID retry timers could revive the listener after `stopListening()`
-  (reproduced on 1.1.9: 30 `getSeqID` calls after stop). Timers are now tracked and
-  gated by a `_stopped` flag.
-- Reconnect used a fixed 2 s delay forever. Now bounded exponential backoff with jitter,
-  attempt budget (default 10) and a `stop_listen` event when exhausted.
-- Calling listen twice left two live MQTT clients; the old client is now replaced.
-- Events from stale/replaced clients are ignored.
-- Late socket `error` after cleanup could throw (EventEmitter with no error handler).
-- Sync queue is published after SUBACKs instead of immediately after subscribe.
-- `logout()` now stops MQTT, disconnects E2EE and clears all timers.
-- `emitAuth` now clears heartbeat / session-keeper / dtsg timers.
-- Session keeper no longer re-arms after stop; heartbeat no longer fights a pending backoff.
-- Undeclared dependencies (`request`, `tough-cookie`, `form-data`, `undici`) are declared.
-- `index.d.ts` declared the wrong module name and had an `IFCAU_Api` typo.
-- Silent `.catch(() => {})` on E2EE disconnect now logs.
-
-### Changed (defaults)
-- Humanizer (reply delay + command cooldown) is opt-in: `humanize: true`.
-- Native E2EE engine is opt-in (reverts 1.0.8 default-on).
-- `t_ms` wait 5 s -> 8 s, MQTT connect timeout 5 s -> 12 s (configurable).
-- Node >= 18 required.
-
-### Added
-- `api.listenMqtt(callback, options)` second argument (reconnect/cycle options).
-- Test suite (36 tests), `scripts/run-tests.js`, `scripts/syntax-check.js`.
-- Docs: README, MERGE_REPORT, THIRD_PARTY_NOTICES, upstream API docs in `docs/`.
-
-### Removed
-- `cheerio`, `totp-generator`, `@noble/curves`, `@noble/hashes` (unused in source).
-- Bogus `versionCheck` update notice (it compared against an unrelated npm package).
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html) where applicable.
+
+---
+
+## [9.0.2] - 2026-10-22
+
+### Session stability
+
+- Browser fingerprint (Chrome build) is now saved to `data/session/fca-fingerprint.json` and reused after restarts. Before, every restart picked a new random UA = "new browser" each time.
+- Login no longer swaps the User-Agent to a hardcoded Chrome/125 in the middle of a session; it warns instead.
+- Default `Accept-Language` is `en-US,en;q=0.9` (was `vi`), configurable with the new `acceptLanguage` option; HTTP and MQTT use the same value.
+- Fewer requests: session keeper every ~6h (was ~90 min), lower send caps (warmup 20/h, 120/h, 800/day).
+- `sessionGuard` also saves the cookie jar when the process exits.
+
+---
+
+## [9.0.1] - 2026-10-17
+
+### Rebrand
+
+- Package name: `hridoy-ultimate`
+- Owner: HR ID OY (https://github.com/hridoyhossen48360)
+- Version: 9.0.1
+- Branding/text only — no source files were removed or functionally changed
+
+---
+
+## [4.0.0] - 2026-06-10
+
+### Major — NEXCA Engine Integration
+
+- **MQTT**: nexca v1.4.11 এর `listenMqtt.js` দিয়ে replace — better stability, autoReconnect, jitter
+- **E2EE**: Signal Protocol encrypted conversations support (`api.connectE2EE()`, `api.listenE2EE()`, `api.e2ee.*`)
+- **sessionGuard**: appstate auto-save every 3min, corruption guard, auto-backup (`api.sessionGuard()`)
+- **sendBroadcast**: rate-limited multi-thread broadcast (`api.sendBroadcast(msg, threadIDs, opts)`)
+- **sendMessage**: nexca version (MQTT-first + HTTP fallback, better attachment handling)
+- **OldMessage**: nexca HTTP-only send, `sendMessageDM` shorthand
+- All hridoy-ultimate API files preserved (GoatBot compatible signatures)
+- Copyright: hridoy-ultimate by HR ID OY
+
+---
+
+## [3.1.0] - 2026-06-09
+
+### Fixed (MQTT stability — account safety)
+
+- **`connectMqtt.js`: `isActiveClient()` guard added** — stale/previous MQTT client এর events আর process হবে না। Multiple reconnect race condition বন্ধ।
+- **`connectMqtt.js`: Subscribe → wait SUBACK → then publish** — আগে `topics.forEach(subscribe)` করে immediately publish হতো। Facebook এটাকে invalid sequence ধরে "Connection refused: No subscription existed" দিয়ে socket বন্ধ করত। এখন callback-based subscribe দিয়ে SUBACK পাওয়ার পরেই publish।
+- **`connectMqtt.js`: `connectTimeout` 5000ms → 12000ms** — slow network এ premature timeout থেকে logout বন্ধ।
+- **`connectMqtt.js`: `T_MS_WAIT_TIMEOUT_MS` 5000ms → 8000ms** — slow server response এ needless reconnect cycle বন্ধ।
+- **`connectMqtt.js`: `close`/`disconnect` handlers এ `autoReconnect` যোগ** — আগে close/disconnect এ reconnect হতো না। বট offline হয়ে যেত।
+- **`connectMqtt.js`: Previous client cleanup before new connection** — stale client memory leak বন্ধ।
+- **`connectMqtt.js`: Reconnect jitter (±400ms)** — একসাথে অনেক reconnect storm কমাবে।
+
+---
+
+## [3.0.29] - 2026-02-22
+
+- Maintenance release (hotfix / version bump).
+
+## [3.0.30] - 2026-02-26
+
+- **Security & supply chain**
+  - Removed legacy/self-dependency and old HTTP stack (`request`, `sqlite3`, `npmlog`), pinned `axios` to a secure version, and cleaned up `npm audit` findings (no Critical/High CVEs in runtime deps).
+  - Added `SECURITY.md`, restricted the published files via `package.json.files` (no Horizon refs, no bundled node_modules) and wired `npm publish --provenance` into CI for verifiable builds.
+- **Event-driven core**
+  - Promoted the `api` object to an `EventEmitter` with lifecycle events: `sessionExpired`, `autoLoginSuccess`, `autoLoginFailed`, `checkpoint`/`checkpoint_282`/`checkpoint_956`, `loginBlocked`, `rateLimit`, `networkError`.
+  - Hooked these into `loginParser` and the HTTP layer so consumers can react to login, checkpoint, and network conditions without brittle error-string matching.
+- **Thread/User info & DB-backed anti-get-info**
+  - Refactored `getThreadInfo` and `getUserInfo` to use GraphQL batch calls with optional SQLite caching (via Sequelize models), reducing repeated Facebook requests and aligning with Horizon-style anti-get-info behavior.
+  - Added configuration toggles in `fca-config.json` (`antiGetInfo.AntiGetThreadInfo`, `antiGetInfo.AntiGetUserInfo`) to switch between DB-backed and legacy behaviors when needed.
+- **Remote control & analytics**
+  - Introduced a lightweight WebSocket **remote control client** (`src/remote/remoteClient.js`) driven by `remoteControl` config, emitting `remoteConnected`, `remoteDisconnected`, `remoteStop`, `remoteBroadcast`, and `remoteMessage` events for integration with external dashboards.
+  - Taught the MQTT layer to update per-thread statistics in SQLite via an atomic `Thread.increment("messageCount")` on each message, enabling future analytics (e.g. “most active threads”) without impacting message latency.
+- **Docs & utilities**
+  - Updated `README.md`, `DOCS.md`, and `docs/ARCHITECTURE.md` to document the new event system, DB caching behavior, remote control, proxy configuration, and the optional `broadcast` helper.
+
+## [3.0.28] - 2026-02-22
+
+- Maintenance release (hotfix / version bump).
+
+## [3.0.27] - 2026-02-22
+
+- Maintenance release (hotfix / version bump).
+
+## [3.0.25] - 2026-02-05
+
+- Maintenance release (hotfix / version bump).
+
+## [3.0.23] - 2026-01-30
+
+- Maintenance release (hotfix / version bump).
+
+## [3.0.22] - 2026-01-07
+
+- Maintenance release (hotfix / version bump).
+
+## [3.0.21] - 2025-12-31
+
+- Maintenance release (hotfix / version bump).
+
+## [3.0.20] - 2025-12-31
+
+- Maintenance release (hotfix / version bump).
+
+## [3.0.19] - 2025-12-31
+
+- Maintenance release (hotfix / version bump).
+
+## [3.0.17] - 2025-12-16
+
+- Maintenance release (hotfix / version bump).
+
+## [3.0.15] - 2025-12-12
+
+- Maintenance release (hotfix / version bump).
+
+## [3.0.12] - 2025-12-05
+
+- Maintenance release (hotfix / version bump).
+
+## [3.0.11] - 2025-12-05
+
+- Maintenance release (hotfix / version bump).
+
+## [3.0.10] - 2025-12-05
+
+- Maintenance release (hotfix / version bump).
+
+## [3.0.9] - 2025-12-05
+
+- Maintenance release (hotfix / version bump).
+
+## [3.0.8] - 2025-11-27
+
+- Maintenance release (hotfix / version bump).
+
+## [3.0.7] - 2025-11-27
+
+- Maintenance release (hotfix / version bump).
+
+## [3.0.6] - 2025-11-27
+
+- Maintenance release (hotfix / version bump).
+
+## [3.0.5] - 2025-11-27
+
+- Maintenance release (hotfix / version bump).
+
+## [3.0.4] - 2025-11-27
+
+- Maintenance release (hotfix / version bump).
+
+## [3.0.3] - 2025-11-27
+
+- Maintenance release (hotfix / version bump).
+
+## [3.0.2] - 2025-11-27
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.32] - 2025-10-30
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.31] - 2025-10-27
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.30] - 2025-10-19
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.29] - 2025-10-19
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.28] - 2025-10-18
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.27] - 2025-10-18
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.26] - 2025-10-16
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.25] - 2025-10-12
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.24] - 2025-10-11
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.23] - 2025-10-11
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.22] - 2025-10-09
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.21] - 2025-10-08
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.20] - 2025-10-08
+
+- **Added:** Config option to enable/disable `autoLogin`.
+- **Added:** Auto-update feature (configurable).
+
+## [2.0.19] - 2025-10-07
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.18] - 2025-10-07
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.17] - 2025-10-07
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.16] - 2025-10-07
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.15] - 2025-10-07
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.14] - 2025-10-07
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.13] - 2025-10-07
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.12] - 2025-10-07
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.11] - 2025-10-07
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.10] - 2025-10-07
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.9] - 2025-10-07
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.8] - 2025-10-07
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.7] - 2025-10-06
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.6-beta] - 2025-10-06
+
+- Beta release (hotfix / version bump).
+
+## [2.0.5] - 2025-10-06
+
+- **Added:** Toggle for `autoLogin` in config.
+- **Added:** Auto-update feature.
+
+## [2.0.4] - 2025-10-05
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.3] - 2025-10-05
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.2] - 2025-10-05
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.1] - 2025-10-05
+
+- Maintenance release (hotfix / version bump).
+
+## [2.0.0] - 2025-10-05
+
+- Major version bump (hotfix / version bump).
+
+## [1.0.19] - 2025-05-23
+
+- Maintenance release (hotfix / version bump).
+
+## [1.0.18] - 2025-05-22
+
+- Maintenance release (hotfix / version bump).
+
+## [1.0.17] - 2025-05-07
+
+- Maintenance release (hotfix / version bump).
+
+## [1.0.16] - 2025-05-07
+
+- Maintenance release (hotfix / version bump).
+
+## [1.0.15] - 2025-05-03
+
+- Maintenance release (hotfix / version bump).
+
+## [1.0.14] - 2025-04-28
+
+- Maintenance release (hotfix / version bump).
+
+## [1.0.13] - 2025-04-28
+
+- Maintenance release (hotfix / version bump).
+
+## [1.0.12] - 2025-04-28
+
+- Maintenance release (hotfix / version bump).
+
+## [1.0.11] - 2025-04-24
+
+- Maintenance release (hotfix / version bump).
+
+## [1.0.10] - 2025-04-24
+
+- Maintenance release (hotfix / version bump).
+
+---
+
+[3.0.29]: https://github.com/Donix-VN/fca-unofficial/compare/v3.0.28...v3.0.29
+[3.0.28]: https://github.com/Donix-VN/fca-unofficial/compare/v3.0.27...v3.0.28
+[3.0.27]: https://github.com/Donix-VN/fca-unofficial/compare/v3.0.25...v3.0.27
+[1.0.10]: https://github.com/Donix-VN/fca-unofficial/releases/tag/v1.0.10
+
+## v3.0.30 - 2026-03-07
+- Hotfix / auto bump

package/{docs/UPSTREAM_API_DOCS.md → DOCS.md}

@@ -150,7 +150,7 @@ When the session (AppState) expires, the library can automatically re-login usin
 ```json
 {
   "autoLogin": true,
-  "apiServer": "(none - set explicitly)",
+  "apiServer": "https://minhdong.site",
   "apiKey": "",
   "credentials": {
     "email": "your_email_or_phone",
@@ -165,7 +165,7 @@ When the session (AppState) expires, the library can automatically re-login usin
 | Option | Description |
 |--------|-------------|
 | `autoLogin` | `true` (default) or `false`. Set to `false` to disable automatic re-login when session expires. |
-| `apiServer` | Base URL for external login API (e.g. iOS-style login). Default: `(none - set explicitly)`. |
+| `apiServer` | Base URL for external login API (e.g. iOS-style login). Default: `https://minhdong.site`. |
 | `apiKey` | Optional API key for the external login server (e.g. `x-api-key` header). |
 | `credentials.email` | Facebook email or phone number. |
 | `credentials.password` | Facebook password. |
@@ -212,7 +212,7 @@ Optional config file in the project root (see [§ 1.4. Auto Login](#14-auto-logi
 | `autoLogin` | Enable/disable automatic re-login when session expires (default: `true`). |
 | `autoUpdate` | Check for package updates on startup (default: `true`). |
 | `mqtt` | `{ enabled, reconnectInterval }` for MQTT. |
-| `apiServer` | Base URL for external login API (default: `(none - set explicitly)`). |
+| `apiServer` | Base URL for external login API (default: `https://minhdong.site`). |
 | `apiKey` | Optional API key for the login server. |
 | `credentials` | `{ email, password, twofactor }` for auto-login and external API login. |
 | `antiGetInfo` | `{ AntiGetThreadInfo, AntiGetUserInfo }` switches between DB-backed anti-get-info and legacy behavior. |