hridoy-ultimate 9.0.0 → 9.0.2

package/src/api/socket/listenMqtt.js

@@ -16,7 +16,6 @@ const createListenMqtt = require("./core/connectMqtt");
 const createGetSeqID = require("./core/getSeqID");
 const getTaskResponseData = require("./core/getTaskResponseData");
 const createEmitAuth = require("./core/emitAuth");
-const lifecycle = require("./core/lifecycle");
 const createMiddlewareSystem = require("./middleware");
 const { createCommandHumanizer, createHumanizerMiddleware } = require("../../utils/humanizer");
 
@@ -27,6 +26,7 @@ const { createCommandHumanizer, createHumanizerMiddleware } = require("../../uti
 // session-touching requests. Reconnects still happen on actual socket
 // close/error. Pass { cycleMs: <ms> } to listenMqtt to re-enable.
 const CYCLE_MS_DEFAULT = 0;
+const RECONNECT_DELAY_MS_DEFAULT = 2000;
 const UNSUB_ALL_TIMEOUT_MS = 5000;
 
 const parseDelta = createParseDelta({ parseAndCheckLogin });
@@ -34,11 +34,7 @@ const emitAuth = createEmitAuth({ logger });
 const listenMqtt = createListenMqtt({ WebSocket, mqtt, HttpsProxyAgent, buildStream, buildProxy, topics, parseDelta, getTaskResponseData, logger, emitAuth });
 const getSeqIDFactory = createGetSeqID({ parseAndCheckLogin, listenMqtt, logger, emitAuth });
 
-const MQTT_DEFAULTS = Object.assign({
-  cycleMs: CYCLE_MS_DEFAULT,
-  autoReconnect: true,
-  reconnectAfterStop: false
-}, lifecycle.DEFAULTS); // reconnectDelayMs, maxReconnectDelayMs, reconnectJitter, maxReconnectAttempts
+const MQTT_DEFAULTS = { cycleMs: CYCLE_MS_DEFAULT, reconnectDelayMs: RECONNECT_DELAY_MS_DEFAULT, autoReconnect: true, reconnectAfterStop: false };
 function mqttConf(ctx, overrides) {
   ctx._mqttOpt = Object.assign({}, MQTT_DEFAULTS, ctx._mqttOpt || {}, overrides || {});
   if (typeof ctx._mqttOpt.autoReconnect === "boolean") ctx.globalOptions.autoReconnect = ctx._mqttOpt.autoReconnect;
@@ -59,10 +55,8 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
     ctx._humanizer = createCommandHumanizer(ctx.globalOptions.humanize);
   }
   if (!ctx._humanizerMiddlewareInstalled) {
-    // OPT-IN in hridoy-ultimate: the humanizer delays replies and silently drops
-    // commands inside its cooldown window, so it must never be an invisible default.
-    const hz = ctx.globalOptions.humanize;
-    const humanizeEnabled = hz === true || !!(hz && typeof hz === "object" && hz.enabled === true);
+    const humanizeEnabled = ctx.globalOptions.humanize === undefined ||
+      (ctx.globalOptions.humanize && ctx.globalOptions.humanize.enabled !== false);
     if (humanizeEnabled) {
       try {
         middleware.use("humanizer", createHumanizerMiddleware(ctx._humanizer, logger, api));
@@ -75,18 +69,6 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
   }
   api.getHumanizer = () => ctx._humanizer || null;
 
-  // Typing indicator middleware: shared by MQTT and E2EE events (listenE2EE uses the same
-  // ctx._middleware). When the humanizer is enabled it already shows typing during its own
-  // delay, so ours stays out of its way.
-  if (ctx._typing && !ctx._typingMiddlewareInstalled && !ctx._humanizerMiddlewareInstalled) {
-    try {
-      middleware.use("typing", ctx._typing.middleware());
-      ctx._typingMiddlewareInstalled = true;
-    } catch (e) {
-      logger(`Typing middleware install failed (non-fatal): ${e && e.message ? e.message : String(e)}`, "warn");
-    }
-  }
-
   function installPostGuard() {
     if (ctx._postGuarded) return defaultFuncs.post;
     const rawPost = defaultFuncs.post && defaultFuncs.post.bind(defaultFuncs);
@@ -115,8 +97,8 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
   let conf = mqttConf(ctx, opts);
 
   function getSeqIDWrapper() {
-    if (ctx._stopped || (ctx._ending && !ctx._cycling)) {
-      logger("mqtt getSeqID skipped - stopped/ending", "warn");
+    if (ctx._ending && !ctx._cycling) {
+      logger("mqtt getSeqID skipped - ending", "warn");
       return Promise.resolve();
     }
     const form = {
@@ -142,18 +124,14 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
         const errMsg = e && e.message ? e.message : String(e || "Unknown error");
         logger(`mqtt getSeqID error: ${errMsg}`, "error");
         // Don't reconnect if we're ending
-        if (ctx._ending || ctx._stopped) return;
-        // Retry with bounded exponential backoff if autoReconnect is enabled.
-        // The timer is tracked on ctx so stopListening()/logout() can cancel it.
+        if (ctx._ending) return;
+        // Retry after delay if autoReconnect is enabled
         if (ctx.globalOptions.autoReconnect) {
-          const res = lifecycle.scheduleReconnect(ctx, logger, getSeqIDWrapper, "getSeqID failed");
-          if (res === "exhausted") {
-            ctx._stopped = true;
-            lifecycle.clearListenerTimers(ctx, false);
-            const msg = `mqtt getSeqID retries exhausted (${errMsg})`;
-            logger(msg, "error");
-            globalCallback({ type: "stop_listen", error: msg }, null);
-          }
+          const d = conf.reconnectDelayMs;
+          logger(`mqtt getSeqID will retry in ${d}ms`, "warn");
+          setTimeout(() => {
+            if (!ctx._ending) getSeqIDWrapper();
+          }, d);
         }
       });
   }
@@ -203,7 +181,11 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
 
   function endQuietly(next) {
     const finish = () => {
-      lifecycle.detachClient(ctx.mqttClient);
+      try {
+        if (ctx.mqttClient) {
+          ctx.mqttClient.removeAllListeners();
+        }
+      } catch (_) { }
       ctx.mqttClient = undefined;
       ctx.lastSeqId = null;
       ctx.syncToken = undefined;
@@ -262,12 +244,9 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
   }
 
   function delayedReconnect() {
-    const res = lifecycle.scheduleReconnect(ctx, logger, refreshSessionAndReconnect, "cycle/restart");
-    if (res === "exhausted") {
-      ctx._stopped = true;
-      lifecycle.clearListenerTimers(ctx, false);
-      globalCallback({ type: "stop_listen", error: "mqtt reconnect attempts exhausted" }, null);
-    }
+    const d = conf.reconnectDelayMs;
+    logger(`mqtt reconnect in ${d}ms`, "info");
+    setTimeout(() => refreshSessionAndReconnect(), d);
   }
 
   function refreshSessionAndReconnect() {
@@ -284,7 +263,7 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
         logger(`Session refresh before reconnect failed (non-fatal): ${err && err.message ? err.message : String(err)}`, "warn");
       })
       .finally(() => {
-        if (!ctx._stopped) getSeqIDWrapper();
+        getSeqIDWrapper();
       });
   }
 
@@ -304,10 +283,9 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
     // Self-rescheduling timeout with ±15 min jitter around 90 min, instead of
     // a clockwork-exact 90:00.000 interval — perfectly periodic traffic is
     // trivial to fingerprint.
-    const BASE_MS = 90 * 60 * 1000;
-    const JITTER_MS = 15 * 60 * 1000;
+    const BASE_MS = 6 * 60 * 60 * 1000;
+    const JITTER_MS = 60 * 60 * 1000;
     const scheduleNext = function () {
-      if (ctx._stopped) { ctx._sessionKeeperInterval = null; return; } // stopped: do not re-arm
       const delay = BASE_MS - JITTER_MS + Math.floor(Math.random() * 2 * JITTER_MS);
       ctx._sessionKeeperInterval = setTimeout(function () {
         if (!ctx.loggedIn) { scheduleNext(); return; }
@@ -338,7 +316,7 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
       // chat message arrive". The old check force-cycled a perfectly healthy
       // connection every 45 quiet minutes (e.g. overnight), producing
       // re-auth bursts exactly when a real user would be asleep.
-      if (!isConnected() && !ctx._ending && !ctx._cycling && !ctx._stopped && !ctx._reconnectTimer) {
+      if (!isConnected() && !ctx._ending && !ctx._cycling) {
         logger("heartbeat: MQTT socket not connected, forcing reconnect", "warn");
         ctx.lastMqttActivity = Date.now();
         forceCycle();
@@ -347,32 +325,40 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
     if (ctx._heartbeatInterval.unref) ctx._heartbeatInterval.unref();
   }
 
-  // listen(callback[, options]) - options (all optional): cycleMs, autoReconnect, reconnectAfterStop,
-  // reconnectDelayMs, maxReconnectDelayMs, reconnectJitter, maxReconnectAttempts (0 = unlimited),
-  // tmsWaitTimeoutMs, connectTimeoutMs.
-  return function (callback, options) {
+  return function (callback) {
     class MessageEmitter extends EventEmitter {
       stopListening(callback2) {
         const cb = callback2 || function () { };
         logger("mqtt stop requested", "info");
         globalCallback = identity;
 
-        // Mark stopped FIRST so any in-flight reconnect/retry timer or
-        // getSeqID promise sees it, then cancel every timer we own.
-        ctx._stopped = true;
-        ctx._reconnectAttempt = 0;
-        lifecycle.clearListenerTimers(ctx, false);
-        if (ctx._typing && typeof ctx._typing.stopAll === "function") ctx._typing.stopAll();
+        if (ctx._autoCycleTimer) {
+          clearInterval(ctx._autoCycleTimer);
+          ctx._autoCycleTimer = null;
+          logger("mqtt auto-cycle cleared", "info");
+        }
+
+        if (ctx._sessionKeeperInterval) {
+          clearInterval(ctx._sessionKeeperInterval);
+          ctx._sessionKeeperInterval = null;
+        }
+
+        if (ctx._heartbeatInterval) {
+          clearInterval(ctx._heartbeatInterval);
+          ctx._heartbeatInterval = null;
+        }
+
+        if (ctx._reconnectTimer) {
+          clearTimeout(ctx._reconnectTimer);
+          ctx._reconnectTimer = null;
+        }
 
         ctx._ending = true;
         unsubAll(() => endQuietly(() => {
           logger("mqtt stopped", "info");
           cb();
           conf = mqttConf(ctx, conf);
-          if (conf.reconnectAfterStop) {
-            ctx._stopped = false; // explicit opt-in restart
-            delayedReconnect();
-          }
+          if (conf.reconnectAfterStop) delayedReconnect();
         }));
       }
       async stopListeningAsync() {
@@ -397,10 +383,7 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
       globalCallback = originalCallback;
     }
 
-    conf = mqttConf(ctx, options && typeof options === "object" ? options : conf);
-    ctx._stopped = false;
-    ctx._reconnectAttempt = 0;
-    lifecycle.clearReconnect(ctx);
+    conf = mqttConf(ctx, conf);
 
     installPostGuard();
 
@@ -425,8 +408,8 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
       listenMqtt(defaultFuncs, api, ctx, globalCallback);
     }
 
-    api.stopListening = msgEmitter.stopListening.bind(msgEmitter);
-    api.stopListeningAsync = msgEmitter.stopListeningAsync.bind(msgEmitter);
+    api.stopListening = msgEmitter.stopListening;
+    api.stopListeningAsync = msgEmitter.stopListeningAsync;
 
     // Store original callback for re-wrapping when middleware is added/removed
     let currentOriginalCallback = originalCallback;
@@ -497,3 +480,13 @@ module.exports = function (defaultFuncs, api, ctx, opts) {
   };
 };
 
+
+// mqtt stability patch
+try {
+  if (typeof client !== "undefined" && client) {
+    client.on("offline", () => console.log("[FCA] MQTT offline"));
+    client.on("reconnect", () => console.log("[FCA] MQTT reconnecting"));
+    client.on("close", () => console.log("[FCA] MQTT closed"));
+    client.on("error", (e) => console.log("[FCA] MQTT error:", e?.message || e));
+  }
+} catch (e) {}

package/src/utils/antiSuspension.js

@@ -63,9 +63,9 @@ class SendPacer {
 
         this.startedAt = Date.now();
         this.warmupWindowMs = 15 * 60 * 1000;
-        this.warmupHourlyCap = 40;
-        this.normalHourlyCap = 350;
-        this.dailyCap = 2500;
+        this.warmupHourlyCap = 20;
+        this.normalHourlyCap = 120;
+        this.dailyCap = 800;
 
         this.hourWindowStart = Date.now();
         this.hourSendCount = 0;

package/src/utils/fingerprint.js

@@ -6,24 +6,20 @@
 // claiming the exact same browser build is a trivially detectable pattern.
 // Keep this list current; entries that are far behind Chrome's real release
 // timeline are themselves a signal.
-// Builds taken from Google's published Chrome stable release notes (149.0.7827.102 on
-// 2026-06, 151.0.7922.75 on 2026-08). Chrome's release cadence is about one major per
-// 4 weeks (two weeks from Chrome 153 on), so refresh this list every few months.
 const CHROME_VERSIONS = [
-  "149.0.7827.102",
-  "151.0.7922.75"
+  "131.0.6778.140",
+  "132.0.6834.111",
+  "133.0.6943.98",
+  "134.0.6998.117",
+  "135.0.7049.85"
 ];
 
 function pickChromeVersion() {
   return CHROME_VERSIONS[Math.floor(Math.random() * CHROME_VERSIONS.length)];
 }
 
-// Real Chrome sends a *reduced* User-Agent ("Chrome/<major>.0.0.0"); the full build only
-// appears in Sec-CH-UA-Full-Version-List. A UA carrying the full build number is itself
-// an anomaly, so the UA is reduced here and the full build is kept in the fingerprint.
 function buildUserAgent(version) {
-  const major = String(version).split(".")[0];
-  return `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${major}.0.0.0 Safari/537.36`;
+  return `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${version} Safari/537.36`;
 }
 
 // Chrome's Sec-Ch-Ua "GREASE" brand slot rotates through a small set of
@@ -39,7 +35,31 @@ function greaseForVersion(major) {
 // to different hardcoded defaults) is itself inconsistent and detectable.
 let cachedFingerprint = null;
 
+// The fingerprint is also saved to disk. Picking a new random Chrome build
+// on every restart made the same account look like a new browser each time
+// the bot restarted, which is a common reason for "session dropped" logouts.
+// Best option of all: pass your real browser's User-Agent (the one the
+// cookies were exported from) via the userAgent option; this file is only
+// the fallback.
+const fs = require("fs");
+const path = require("path");
+function fingerprintFile() {
+  return path.join(process.cwd(), "data", "session", "fca-fingerprint.json");
+}
+
 function getFingerprint() {
+  if (!cachedFingerprint) {
+    try {
+      const saved = JSON.parse(fs.readFileSync(fingerprintFile(), "utf8"));
+      if (saved && CHROME_VERSIONS.includes(saved.version)) {
+        cachedFingerprint = {
+          userAgent: buildUserAgent(saved.version),
+          version: saved.version,
+          major: parseInt(saved.version.split(".")[0], 10)
+        };
+      }
+    } catch (_) { /* first run */ }
+  }
   if (!cachedFingerprint) {
     const version = pickChromeVersion();
     const major = parseInt(version.split(".")[0], 10);
@@ -48,6 +68,10 @@ function getFingerprint() {
       version,
       major
     };
+    try {
+      fs.mkdirSync(path.dirname(fingerprintFile()), { recursive: true });
+      fs.writeFileSync(fingerprintFile(), JSON.stringify({ version }), "utf8");
+    } catch (_) { /* read-only fs: fall back to per-process */ }
   }
   return cachedFingerprint;
 }
@@ -64,12 +88,7 @@ function clientHintsFromUA(ua) {
   const s = String(ua || getDefaultUserAgent());
   const chromeMatch = s.match(/Chrome\/(\d+)\.(\d+)\.(\d+)\.(\d+)/);
   const major = chromeMatch ? chromeMatch[1] : String(getFingerprint().major);
-  let full = chromeMatch ? chromeMatch[0].split("/")[1] : getFingerprint().version;
-  // Reduced UA ("151.0.0.0"): report the real full build for our own fingerprint major.
-  if (chromeMatch && chromeMatch[2] === "0" && chromeMatch[3] === "0" && chromeMatch[4] === "0" &&
-      String(getFingerprint().major) === major) {
-    full = getFingerprint().version;
-  }
+  const full = chromeMatch ? chromeMatch[0].split("/")[1] : getFingerprint().version;
   const isMobile = /Mobile|Android|iPhone|iPad/i.test(s);
 
   let platform = "Windows";

package/src/utils/headers.js

@@ -45,7 +45,7 @@ function getHeaders(url, options, ctx, customHeader) {
   const referer = options?.referer || "https://www.facebook.com/";
   const origin = referer.replace(/\/+$/, "");
   const contentType = options?.contentType || "application/x-www-form-urlencoded";
-  const acceptLang = options?.acceptLanguage || "en-US,en;q=0.9,vi;q=0.8";
+  const acceptLang = options?.acceptLanguage || "en-US,en;q=0.9";
   // NOTE: keep the && chain parenthesized — `||` binds looser than `&&`.
   const isNavigation = (u.pathname === "/" &&
     !url.includes("ajax") &&

package/src/utils/versionCheck.js

@@ -0,0 +1,47 @@
+"use strict";
+
+const https = require("https");
+const pkg = require("../../package.json");
+
+function getLatestVersion(cb) {
+  const req = https.get(
+    "https://registry.npmjs.org/hridoy-ultimate/latest",
+    { headers: { "Accept": "application/json" } },
+    (res) => {
+      let data = "";
+      res.on("data", chunk => { data += chunk; });
+      res.on("end", () => {
+        try { cb(null, JSON.parse(data).version); }
+        catch { cb(new Error("parse failed")); }
+      });
+    }
+  );
+  req.on("error", cb);
+  req.setTimeout(5000, () => { req.destroy(); cb(new Error("timeout")); });
+}
+
+function compareVersion(a, b) {
+  const pa = a.split(".").map(Number);
+  const pb = b.split(".").map(Number);
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] || 0) < (pb[i] || 0)) return -1;
+    if ((pa[i] || 0) > (pb[i] || 0)) return 1;
+  }
+  return 0;
+}
+
+function checkForUpdate(logger) {
+  const current = pkg.version;
+  getLatestVersion((err, latest) => {
+    if (err || !latest) return;
+    if (compareVersion(current, latest) < 0) {
+      if (typeof logger === "function") {
+        logger(`⚠️ hridoy-ultimate outdated! You are using v${current}, latest is v${latest}. Run: npm install hridoy-ultimate@latest`, "warn");
+      } else {
+        console.warn(`\x1b[33m[FCA-WARN] ⚠️ hridoy-ultimate outdated! v${current} → v${latest} | npm install hridoy-ultimate@latest\x1b[0m`);
+      }
+    }
+  });
+}
+
+module.exports = { checkForUpdate };

package/LICENSE

@@ -1,23 +0,0 @@
-MIT License
-
-Copyright (c) EryXenX and contributors (eryxenx-fca 1.0.0 - 1.1.9)
-Copyright (c) DongDev and contributors (original fca-unofficial lineage)
-Copyright (c) 2026 HR ID OY (hridoy-ultimate modifications)
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/MERGE_REPORT.md

@@ -1,54 +0,0 @@
-# Merge report - hridoy-ultimate 9.0.0
-
-## Inputs
-- 83 published packages, analysed statically (extract, per-version diff, `node --check`, reading
-  the core paths): `@eryxenx/fca` 1.0.0-1.1.9 (18), `fca-eryxenx` 1.0.0-29.0.0 (20),
-  3.0.2 + 30.0.0-39.1.8 (20), 4.0.x + 39.1.9-39.9.0 (20), 6.0.0-9.0.3 (5).
-- `fca.zip` = hridoy-ultimate 8.0.5, used as the base tree (already a hardened merge of
-  `@eryxenx/fca` 1.1.9 with `loginHelper.js` from 1.1.8, with a 36-test suite).
-- `messagix.so` / `messagix.dll` supplied by the maintainer.
-
-Nothing was run against Facebook. Not every one of the ~14,000 extracted files was read line by
-line; the 12,144 `.js/.cjs/.mjs` files contain only 352 distinct contents.
-
-## What the best builds contributed, and where it stands in 9.0.0
-Verified by reading the 8.0.5 code before touching it.
-
-| Improvement | Best source | Status |
-|---|---|---|
-| Stable MQTT (backoff, SUBACK, 8 s / 12 s timeouts, stale-client guard) | `fca-eryxenx` 20-23 | already in base (own implementation, tested) |
-| Native client reuse + `koffi.disposable` string free (leak fixes) | 39.2.0 / 39.2.1 | already in base |
-| 15 s `withTimeout` on native calls | 39.1.8 | already in base |
-| `getThreadInfo` E2EE branch | 39.1.6 | already in base |
-| E2EE group routing in react / unsend / edit | 39.2.2 | already in base (`isE2EEGroup`) |
-| Session keeper (cookie + `fb_dtsg` refresh) | 39.2.7 | already in base |
-| `Accept` header navigation vs XHR | 39.2.5 | already in base |
-| Attachment id fallback in `sendMessage` | 7.0.0 | already in base |
-| Native E2EE engine opt-in (not auto-connected) | 39.2.8 | already in base |
-| Logout stops MQTT / E2EE / timers | none (all builds lacked it) | already in base |
-| Typing indicator | none (only the opt-in humanizer had one) | **new in 9.0.0** |
-| Bundled `messagix` binaries | maintainer upload | **restored in 9.0.0, opt-in** |
-| Reduced UA + refreshed Chrome pool | fingerprint.js from 1.1.7, rebuilt | **new in 9.0.0** |
-| `setMessageReaction` thread `"0"` fallback | present in every build | **fixed in 9.0.0** |
-| `index.d.ts` coverage | 23 of 66 methods missing in 1.1.9 | **fixed in 9.0.0** |
-
-## Rejected on purpose
-- `autoLogin: true` default and the `minhdong.site` credential host (every `fca-eryxenx` build and
-  `@eryxenx/fca` 1.0.0-1.0.5). Credentials and the 2FA secret would go to a third party.
-- Default-on humanizer (silently drops commands inside its cooldown), default-on native engine
-  (kicks the vendored E2EE socket), bogus `versionCheck` (1.1.9), inert auto-update.
-- 39.3.0-39.9.0: branch cut from the 39.1.2-39.1.4 tree, loses the 39.2.x fixes, adds
-  `[E2EE-DEBUG]` logging of full reaction payloads. 39.1.0-39.1.4 / 39.3.0+ also ship a duplicate
-  17.5 MB native copy.
-- `fca-eryxenx` 9.0.0 (syntax error in `core/channel.js:178`), 3.0.2-6.0.0 (`editMessage` requires a
-  non-existent `../utils`), 4.0.4's dead "stability patch", the stray `index.js.nexca`, nested
-  `e2ee/e2ee/` copies.
-
-## Known issues kept (documented, not hidden)
-- `module/login.js` still installs process-wide `unhandledRejection` / `uncaughtException`
-  handlers that log and continue; they keep bots alive but can hide a fatal state.
-- `src/api/messaging/sendMessage.js` is loaded and then overridden by `src/api/socket/sendMessage.js`
-  (`loginHelper.js`); kept for backward compatibility.
-- Legacy HTTP paths still use the deprecated `request` library (`src/utils/nexca-utils.js`).
-- Native binaries: x86-64 only, stripped, license wording conflicts (see `THIRD_PARTY_NOTICES.md`).
-- Live Facebook behaviour (login, MQTT, send, react, E2EE, typing) is NOT verified here.

package/THIRD_PARTY_NOTICES.md

@@ -1,36 +0,0 @@
-# Third-party notices
-
-hridoy-ultimate is MIT licensed (see `LICENSE`). It contains or builds on the following.
-
-## Code lineage (MIT)
-- `eryxenx-fca` / `@eryxenx/fca` and its contributors (builds 1.x - 39.x were analysed and merged).
-- DongDev and the original `fca-unofficial` lineage (<https://github.com/dongp06>).
-- Optional dependency `fca-unofficial` from `github:VangBanLaNhat/fca-unofficial`.
-
-## Bundled native binaries (opt-in, `FCA_E2EE_NATIVE=1`)
-Location: `src/api/socket/e2ee/native/build/`
-
-| File | Size (bytes) | Type | SHA-256 |
-|---|---|---|---|
-| `messagix.so` | 17,504,872 | ELF 64-bit x86-64, stripped | `6249f50cc23de0b11a710266a2323c306d44cf46530880e58e0cd1cf4b5bf8d9` |
-| `messagix.dll` | 15,802,368 | PE32+ DLL x86-64, stripped | `f8597ba86c90c39cec19b660e75eba59f2022678eb20866b740cfa321036885e` |
-
-- Supplied by the maintainer. They are byte-identical to the copies found in every analysed
-  `eryxenx` package (58 `.so` and 45 `.dll` copies, no differing hash). They are stripped, so
-  they could **not** be audited here, and no source ships with them.
-- A test (`test/integration/package.test.js`) fails if either hash changes.
-- Platforms: x86-64 Linux and Windows only. macOS and ARM (e.g. Termux) need your own build via
-  `FCA_E2EE_NATIVE_LIB=/path/to/messagix`.
-- **License question to resolve before you redistribute:** the analysed packages disagree about the
-  upstream. `native/NOTICE.md` describes mautrix-go / mautrix-meta as MPL-2.0, while the
-  `vendor/stfca-native/NOTICE.md` that shipped in some builds (39.1.0-39.1.4, 39.3.0-39.9.0) says the
-  `messagix` part is AGPL-3.0. AGPL-3.0 carries network-use source-offer obligations. Check the
-  upstream repository for the exact build you use. See also `src/api/socket/e2ee/native/NOTICE.md`.
-
-## Vendored E2EE bundle
-`src/api/socket/e2ee/vendor/fme/dist/index.cjs` (bundled `fb-messenger-e2ee` client) has no license
-header or source in the analysed packages. Treat its terms as unknown.
-
-## Runtime dependencies
-Declared in `package.json`; each keeps its own license (axios, mqtt, ws, sequelize, sqlite3,
-@signalapp/libsignal-client, protobufjs, koffi and others).

package/docs/TEST_RESULTS.md

@@ -1,68 +0,0 @@
-# Test results (actual output)
-
-Environment: v22.22.2, Linux 6.18.44-fc-v114, no network, third-party modules stubbed (MOCKED where marked).
-Generated: 2026-10-13T20:03Z
-
-## npm test (node --test, spec reporter)
-```
-✔ [mocked] logout stops MQTT, disconnects E2EE and clears every timer (50.186778ms)
-✔ [mocked] logout works when no listener was ever started (14.258077ms)
-✔ [mocked] a failed logout request is reported, not swallowed, and the session stays usable (10.037149ms)
-✔ [mocked] sync queue is published only after every SUBACK (46.187501ms)
-✔ [mocked] reconnect after socket close uses backoff, then recovers (17.548562ms)
-✔ [mocked] stopListening during a cycle must not be revived by a pending retry (race regression) (16.384888ms)
-✔ [mocked] stopListening clears timers, ends the client and is safe to call twice (21.34972ms)
-✔ [mocked] late socket 'error' after stopListening does not throw (9.571458ms)
-✔ [mocked] calling listen twice replaces the old client (no duplicate connection) (12.14378ms)
-✔ [mocked] gives up after maxReconnectAttempts and reports stop_listen (no infinite loop) (9.182964ms)
-✔ [mocked] a healthy first sync resets the backoff counter (16.256224ms)
-✔ [mocked] humanizer middleware is NOT installed by default, and is when opted in (26.861027ms)
-✔ [mocked] emitAuth stops everything and reports account_inactive (8.374336ms)
-✔ [mocked] listen(callback, options) applies reconnect options per call (12.31406ms)
-✔ package metadata: name, version, owner, entry points exist (1.413356ms)
-✔ regression: every third-party module the source requires is declared (24.539389ms)
-✔ vendored E2EE bundle: its external requires are declared too (2.38059ms)
-✔ only the pinned messagix binaries ship, native stays opt-in, no default third-party credential host (125.254664ms)
-✔ every JS file in the package parses (6235.728346ms)
-✔ [mocked] package loads with consistent exports (23.934551ms)
-✔ [mocked] login with empty options reports an error via callback and never throws (3129.536404ms)
-✔ [mocked] typing middleware is installed by default and shows typing for a command without delaying delivery (44.078959ms)
-✔ [mocked] plain chat does not trigger typing, and stopListening clears pending typing timers (16.606205ms)
-✔ [mocked] typing middleware is NOT installed when the humanizer owns typing, or when no controller exists (24.276443ms)
-✔ fingerprint: UA is the reduced Chrome/<major>.0.0.0 form and the full build only appears in client hints (2.989355ms)
-✔ humanizer: first command accepted with a bounded delay, burst inside cooldown dropped (2.724519ms)
-✔ humanizer: non-command messages pass untouched; per-thread isolation (0.56259ms)
-✔ humanizer: enabled:false never delays or drops (1.317371ms)
-✔ computeBackoff grows exponentially, is bounded and never negative (5.845535ms)
-✔ computeBackoff jitter stays within +/- jitter and clamps to max (0.418652ms)
-✔ computeBackoff tolerates garbage input (0.318463ms)
-✔ scheduleReconnect: single timer, debounce, stop, exhaustion (1.587298ms)
-✔ scheduleReconnect: a timer that fires after stop does nothing (race regression) (0.359697ms)
-✔ maxReconnectAttempts: 0 means unlimited only when explicitly set (1.961505ms)
-✔ clearListenerTimers is idempotent and clears every owned timer (0.47163ms)
-✔ detachClient: a late 'error' after detach must not throw (0.605172ms)
-✔ extractDtsg handles each supported markup shape (2.885756ms)
-✔ extractDtsg: jazoest forms, empty and non-string input (1.591823ms)
-✔ fingerprint: default UA and client hints are mutually consistent (1.64789ms)
-✔ fingerprint: Android UA yields mobile Android hints (no desktop contradiction) (0.50116ms)
-✔ typing: command-like message starts typing; plain chat / own messages / non-message events do not (1.739404ms)
-✔ typing: GoatBot prefix and extra prefixes count as commands; onlyCommands:false types for any text (0.355195ms)
-✔ typing: middleware calls next() synchronously (zero added latency) and then starts typing (1.268156ms)
-✔ typing: sending a reply clears typing after the send resolves (16.890953ms)
-✔ typing: safety timeout stops a typing indicator that never got a reply (1.652981ms)
-✔ typing: repeated starts inside minGapMs do not re-publish; after the gap they do (0.464619ms)
-✔ typing: disabled by option false, and by GoatBot enableTypingIndicator:false unless explicitly overridden (0.321804ms)
-✔ typing: configure(false) clears active timers; stopAll is idempotent and publishes nothing (0.424433ms)
-✔ typing: a throwing / rejecting sendTypingIndicator never breaks the bot (11.013855ms)
-✔ typing: withTyping shows typing around fn and clears it even when fn throws (1.512949ms)
-ℹ tests 50
-ℹ suites 0
-ℹ pass 50
-ℹ fail 0
-ℹ cancelled 0
-ℹ skipped 0
-ℹ todo 0
-```
-
-## Not verified here
-Live Facebook login, MQTT traffic, sending, reactions, typing indicator on the wire, E2EE and the bundled native binaries (no network, no account).

package/scripts/run-tests.js

@@ -1,19 +0,0 @@
-"use strict";
-// Portable test runner (node --test needs explicit files on Node 18/20).
-// Usage: node scripts/run-tests.js [unit|integration|all]
-const fs = require("fs");
-const path = require("path");
-const { spawnSync } = require("child_process");
-
-const which = process.argv[2] || "all";
-const base = path.join(__dirname, "..", "test");
-const dirs = which === "all" ? ["unit", "integration"] : [which];
-const files = [];
-for (const d of dirs) {
-  const full = path.join(base, d);
-  if (!fs.existsSync(full)) continue;
-  for (const f of fs.readdirSync(full).sort()) if (f.endsWith(".test.js")) files.push(path.join(full, f));
-}
-if (!files.length) { console.error("no test files found"); process.exit(2); }
-const r = spawnSync(process.execPath, ["--test", ...files], { stdio: "inherit" });
-process.exit(r.status === null ? 1 : r.status);

package/scripts/syntax-check.js

@@ -1,22 +0,0 @@
-"use strict";
-// Dependency-free "lint": every .js/.cjs file in the package must parse.
-const fs = require("fs");
-const path = require("path");
-const { spawnSync } = require("child_process");
-const root = path.join(__dirname, "..");
-const skip = new Set(["node_modules", "Fca_Database", ".git"]);
-let bad = 0, n = 0;
-(function walk(dir) {
-  for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
-    if (skip.has(e.name)) continue;
-    const p = path.join(dir, e.name);
-    if (e.isDirectory()) walk(p);
-    else if (/\.(js|cjs)$/.test(e.name)) {
-      n++;
-      const r = spawnSync(process.execPath, ["--check", p], { encoding: "utf8" });
-      if (r.status !== 0) { bad++; console.error("SYNTAX ERROR:", path.relative(root, p), "\n" + r.stderr); }
-    }
-  }
-})(root);
-console.log(`checked ${n} files, ${bad} with syntax errors`);
-process.exit(bad ? 1 : 0);