toru-fca 1.0.0 → 1.0.5

package/CHANGELOG.md

@@ -1,64 +1,54 @@
-# Changelog — alpha-fca
+# CHANGELOG — toru-fca
 
-## v1.0.0 (2026-09-01) — Initial Release
+## v1.0.5 (Latest) — Full Advanced Fixed, Anti-Restriction, Smooth & Comfortable
 
-### 🎯 What This Is
-A clean, merged, audited Facebook Chat API built from analyzing 6 FCA variants.
+### 🔥 New in v1.0.5
 
-### ✅ Inclusions (Best-of-all merge)
+#### ✅ Anti-Logout System v3 (Enhanced)
+- fb_dtsg auto-refresh interval: **30min → 20min** (more stable session)
+- Cookie revalidation: every **15min** background check (NEW)
+- `api.stopAutomationGuard()` — graceful stop added
+- Startup feature banner (log summary of all enabled features)
 
-**From hridoy-custom (base):**
-- Full E2EE bridge with Node.js < 22 undici webidl compatibility patch
-- Self-listen filter for E2EE messages (both ID-map and cookie-UID approaches)
-- Multi-domain cookie collection for E2EE (`_cookiesFromJar`)
-- `stopped` flag on bridge to prevent reconnect loops after `disconnect()`
-- MQTT patch stream (fixes Facebook's non-standard PUBACK/SUBACK flag bits)
-- MQTT spinner + connection banner
-- `sessionGuard()` — auto-save appstate with debounce
-- Layered config system (FCA config → bot CWD config → runtime options)
-- Logout disabled (no-op) to preserve Facebook session
-- AdvancedSystem queue for controlled task execution
+#### ✅ Session Guard v2 (Improved)
+- Auto-save interval: **5min → 4min** (faster appstate persistence)
+- Debounce: **30s → 20s** (faster reaction to cookie changes)
+- `minCookieCount` config field — skip save if state has too few cookies
 
-**From hridoy-akash:**
-- Global `process.on("unhandledRejection")` handler with network-error classification
-- Global `process.on("uncaughtException")` handler (non-exit)
-- Clean `BOOL_OPTIONS` setOptions pattern
+#### ✅ Smooth Mode v2
+- Message delay: **500ms → 400ms** (faster but still human-like)
 
-**From ST-FCA (extra API methods):**
-- `sendButtons` — send interactive buttons
-- `sendFriendRequest` — send friend request
-- `searchFriends` — search friends list
-- `setActiveStatus` — set active/online status
-- `setProfileLock` — lock profile visibility
-- `storyManager` — story management utilities
-- `suggestFriend` — suggest a friend
-- `setThreadTheme` — set thread theme
-- `setStorySeen` — mark story as seen
-- `metaTheme` — Meta theme utilities
-- `note` — note utilities
+#### ✅ Anti-Ban v2 (Tuned)
+- Human delay range: **300-1200ms → 200-900ms** (faster, still safe)
 
-**Architecture improvements:**
-- Size-capped E2EE message maps (`_cappedMapSet`, cap: 2000) — prevents memory leak
-- Jittered E2EE reconnect delay (3–4s) — prevents thundering-herd on restarts
-- Fresh `sid` + `cid` on every MQTT reconnect (strips stale params from endpoint)
-- Reconnect state object (`ctx._reconnectState`) with `stopped` flag
-- `stopListenMqtt()` properly cleans up reconnect timers
-- `stopListeningAsync()` on the message emitter
-- Health monitor via `api.getHealth()`
-- Non-blocking update check via `checkUpdate.js`
-- E2EE `devicePath` parent directory auto-created on first use
+#### ✅ MQTT Reconnect v2 (Tuned)
+- Backoff range: **3s-60s → 2s-45s** (faster recovery on disconnect)
 
-### ❌ Removed / Disabled
-- All background polling/automation (off by default)
-- Aggressive repeated requests
-- Unnecessary logout flows
-- Duplicate event listeners
-- Dead code from outdated API patterns
-- Third-party image upload to unknown accounts (imgbb/imagekit keys must be user-supplied)
-- Sequelize/SQLite database dependency (removed bloat)
-- `fca-unofficial` package dependency (inlined)
+#### ✅ Login Retry (NEW)
+- Transient network error e automatically 3x retry with 5s delay
+- Config: `loginSafety.maxRetries`, `loginSafety.retryDelayMs`
 
-### ⚠️ Known Limitations
-- E2EE binary (`messagix.so` / `.dll`) is pre-built for x86_64; ARM support depends on available binaries
-- Live MQTT/E2EE behavior cannot be statically tested — depends on active Facebook endpoints
-- Facebook API changes may break parsing without warning (inherent to all unofficial FCAs)
+#### ✅ send.js Fix (Critical)
+- `ctx.mqttClient` null check added — crash hobe na MQTT not ready thakte
+
+#### ✅ Inbox v2
+- `inbox.replyToDM` / `inbox.replyToGroup` separate config field
+- DM + Group dono jaigai bot reply correctly kore
+
+#### ✅ typingDuration
+- Default: **4000ms → 3500ms** (slightly faster typing indicator)
+
+#### ✅ Examples Updated
+- `basic-bot.js`: `!health`, `!help` commands, graceful final save on SIGINT
+
+---
+
+## v1.0.4 — Ultimate Merged, Fixed & Anti-Restriction
+- Anti-Logout v2, Session Guard, Cookie String support, GoatBot defaults
+- sendTypingV2 fix, MQTT exponential backoff
+- Merged: toru-fca v1.0.3 · shan-fca · hridoy-fca · ws3-fca
+
+## v1.0.3 — sendTypingIndicatorV2 fix, antiBan humanDelay, cookieProtect
+## v1.0.2 — Anti-Logout, Session Guard, Smooth Mode, E2EE, GoatBot defaults
+## v1.0.1 — Initial merged release
+## v1.0.0 — Base alpha-fca release

package/README.md

@@ -1,319 +1,166 @@
-# alpha-fca v1.0.0
+# toru-fca v1.0.5
 
-> **Ultimate Merged Facebook Chat API** — Stable Inbox · E2EE Bridge · E2EE Group · Low Automation · Clean Architecture
-
-Built by analyzing, comparing, auditing and merging the best implementations from **6 FCA variants**:
-`hridoy-akash` · `fca-unofficial` · `ST-FCA` · `fca-azad` · `mahmud-fca` · `hridoy-custom`
+> **Ultimate Merged, Fixed & Advanced Facebook Chat API**
+> Anti-Logout v3 · Anti-Ban v2 · Smooth Inbox · GoatBot Compatible · Error-Free · Login Retry
 
 ---
 
-## ✨ Features
-
-| Feature | Status | Details |
-|---|---|---|
-| 📩 Inbox / Normal Messages | ✅ Stable | MQTT-based, auto-reconnect, no duplicate listeners |
-| 🔐 E2EE Bridge | ✅ Working | Labyrinth native bridge, auto-reconnect with jitter |
-| 👥 E2EE Group Messages | ✅ Working | Group JID detection, full event mapping |
-| 🔄 Session / Reconnect | ✅ Stable | sessionGuard, backoff reconnect, no unnecessary logouts |
-| ⚙️ Low Automation | ✅ Enforced | No background polling; automation off by default |
-| 🛡️ Error Handling | ✅ Robust | Global unhandledRejection + uncaughtException guards |
-| 🧠 Memory Safety | ✅ Capped | E2EE message maps size-capped at 2000 entries |
-| 📦 Node.js 18–22 | ✅ Compatible | undici webidl patch for Node < 22 |
+## ✅ Features
+
+| Feature | Status | Notes |
+|---------|--------|-------|
+| Anti-Logout v3 (Browser Logout Fix) | ✅ Enabled | fb_dtsg refresh every 20min |
+| Automation Logout Fix | ✅ Enabled | Cookie revalidate every 15min |
+| Login Retry | ✅ Enabled | 3x retry on network error |
+| Inbox Bot Reply (DM + Group) | ✅ Working | Both work correctly |
+| GoatBot Compatible | ✅ Compatible | Auto-detect GoatBot config |
+| Facebook Account Safe | ✅ Protected | Human delay, no automation |
+| Error-Free (Global Handler) | ✅ Enabled | MQTT/Network non-fatal |
+| Session Guard v2 (Auto-Save) | ✅ Enabled | Every 4min + backup |
+| E2EE Bridge (Labyrinth) | ✅ Enabled | DM + Group |
+| MQTT Auto-Reconnect v2 | ✅ Enabled | 2s-45s backoff |
+| Anti-Ban v2 Human Delay | ✅ Enabled | 200-900ms |
+| Cookie String Support | ✅ Supported | Raw c_user=xxx format |
+| send.js MQTT null fix | ✅ Fixed | No crash if MQTT not ready |
 
 ---
 
-## 📦 Installation
+## 📦 Usage
 
-```bash
-# Clone or copy the folder, then:
-npm install
-```
+```js
+const login = require('toru-fca');
+const fs = require('fs');
 
-**Requirements:**
-- Node.js >= 18.0.0
-- `build/messagix.so` (Linux) or `build/messagix.dll` (Windows) — included
-- `lib/index.mjs` — E2EE ESM bundle — included
+login(
+  { appState: JSON.parse(fs.readFileSync('appstate.json', 'utf8')) },
+  (err, api) => {
+    if (err) return console.error(err);
 
----
+    // Session guard — auto save + backup (optional but recommended)
+    api.sessionGuard('./appstate.json', { interval: 4 * 60 * 1000, backup: true });
 
-## 🚀 Quick Start
+    api.listen((err, event) => {
+      if (err) return;
+      if (event.type === 'message') {
+        api.sendMessage('Hello! 👋', event.threadID);
+      }
+    });
+  }
+);
+```
 
-### 1. Prepare your appstate
+---
 
-Export your Facebook cookies as JSON (using a browser extension like [c3c-fbstate](https://github.com/c3cbot/c3c-fbstate) or similar), save as `appstate.json`.
+## 🔒 Anti-Logout System v3
 
-### 2. Basic bot
+Bot run korle browser theke **logout hobe na**। Facebook automation dia **id logout korbe na**।
 
 ```js
-const login = require("alpha-fca");
-const fs    = require("fs");
+// Fully automatic — kono extra code lagbe na
+// api.logout() is blocked by default (safe no-op)
 
-const appState = JSON.parse(fs.readFileSync("appstate.json", "utf8"));
+// Manual save (optional)
+api.saveSession('./appstate.json');
 
-login({ appState }, { listenEvents: true, autoReconnect: true }, (err, api) => {
-  if (err) return console.error(err);
-
-  console.log("Logged in as:", api.getCurrentUserID());
-
-  // Auto-save session every 3 minutes
-  api.sessionGuard("appstate.json", { interval: 3 * 60 * 1000 });
-
-  // Listen for messages
-  api.listenMqtt((err, event) => {
-    if (err) return console.error(err);
-    if (event.type === "message") {
-      console.log(`[${event.threadID}] ${event.senderID}: ${event.body}`);
-      if (event.body === "ping") api.sendMessage("pong!", event.threadID);
-    }
-  });
+// Session guard with auto-backup
+const guard = api.sessionGuard('./appstate.json', {
+  interval: 240000, // 4 min
+  backup  : true    // .bak file rakhe
 });
+
+// Graceful stop timers (on shutdown)
+api.stopAntiLogout();
+api.stopAutomationGuard();
 ```
 
-### 3. E2EE bot
+---
 
-Enable E2EE in `config.json`:
-```json
-{
-  "e2ee": { "enable": true, "saveType": "memory" }
-}
-```
+## 📬 Inbox Bot Reply (DM + Group)
 
-Then:
 ```js
-// After login:
-api.connectE2EE((err, event) => {
-  if (err) return console.error(err);
-  // event.type === "e2ee_ready" → "e2ee_fully_ready"
-  // event.type === "message" with event.isE2EE = true → E2EE message
-  if (event.type === "message" && event.isE2EE) {
-    api.sendMessage("Hello E2EE!", event.threadID);
+api.listen((err, event) => {
+  if (event.type === 'message') {
+    const { threadID, isGroup, body } = event;
+    // threadID automatically correct — DM + Group dono te kaje kore
+    api.sendMessage(`Reply: ${body}`, threadID);
   }
 });
 ```
 
-See `examples/e2ee-bot.js` for a complete example.
-
 ---
 
-## ⚙️ Configuration (`config.json`)
+## ⚙️ Config (`config.json`)
 
 ```json
 {
-  "automation":  { "enabled": false },
-  "inbox":       { "enabled": true },
-  "smooth":      { "enabled": false, "messageDelay": 400 },
-  "e2ee": {
-    "enable":        false,
-    "saveType":      "memory",
-    "devicePath":    "./data/e2ee-device.json",
-    "autoReconnect": true,
-    "logLevel":      "none"
-  },
-  "enableTypingIndicator": false,
-  "typingDuration": 4000
+  "antiLogout"   : { "enabled": true, "refreshIntervalMs": 1200000 },
+  "sessionGuard" : { "enabled": true, "intervalMs": 240000, "backupEnabled": true },
+  "automation"   : { "enabled": false },
+  "antiBan"      : { "enabled": true, "humanDelay": true, "minHumanDelayMs": 200, "maxHumanDelayMs": 900 },
+  "smooth"       : { "enabled": true, "messageDelay": 400 },
+  "inbox"        : { "enabled": true, "replyToDM": true, "replyToGroup": true },
+  "loginSafety"  : { "enabled": true, "maxRetries": 3, "retryDelayMs": 5000 },
+  "cookieProtect": { "enabled": true, "validateOnStart": true, "revalidateIntervalMs": 900000 }
 }
 ```
 
-| Key | Default | Description |
-|---|---|---|
-| `automation.enabled` | `false` | Background task automation. **Keep false.** |
-| `inbox.enabled` | `true` | Enables getThreadList / inbox access |
-| `smooth.enabled` | `false` | Shows typing indicator before sending |
-| `e2ee.enable` | `false` | Activates E2EE Labyrinth bridge |
-| `e2ee.saveType` | `"memory"` | `"memory"` = keys lost on restart · `"path"` = persistent |
-| `e2ee.devicePath` | `"./data/e2ee-device.json"` | Used only when saveType = `"path"` |
-| `enableTypingIndicator` | `false` | Auto typing indicator on sendMessage |
+> ⚠️ `automation.enabled` সবসময় `false` রাখবে। True করলে Facebook restriction আসবে।
 
 ---
 
-## 📚 API Reference
-
-### Login
+## 🤖 GoatBot Compatible
 
 ```js
-login(loginData, options, callback)
-// or: await login(loginData, options)
-```
-
-**loginData:**
-- `{ appState }` — cookie-based login (recommended)
-- `{ email, password }` — credentials (use appState instead)
-
-**options (defaults):**
-```js
-{
-  selfListen    : false,
-  listenEvents  : true,
-  listenTyping  : false,
-  updatePresence: false,
-  autoMarkRead  : false,
-  autoReconnect : true,
-  online        : false
-}
+// GoatBot config.js
+module.exports = {
+  enableTypingIndicator: true,
+  typingDuration: 3500
+};
+// global.GoatBot.config auto-detected by toru-fca ✅
 ```
 
 ---
 
-### Messaging
-
-```js
-api.sendMessage(msg, threadID, [callback], [replyToMessageID])
-api.sendMessage({ body, attachment, sticker, emoji, mentions, url }, threadID)
-api.unsendMessage(messageID, [callback])
-api.editMessage(body, messageID, [callback])
-api.setMessageReaction(reaction, messageID, [callback])
-api.forwardMessage(messageID, threadID, [callback])
-api.forwardAttachment(attachmentID, userIDs, [callback])
-```
-
-### Threads
-
-```js
-api.getThreadList(limit, cursor, tags, [callback])
-api.getThreadInfo(threadID, [callback])
-api.getThreadHistory(threadID, amount, timestamp, [callback])
-api.createNewGroup(participantIDs, [groupTitle], [callback])
-api.addUserToGroup(userID, threadID, [callback])
-api.removeUserFromGroup(userID, threadID, [callback])
-api.changeAdminStatus(threadID, adminID, adminStatus, [callback])
-api.setTitle(newTitle, threadID, [callback])
-api.changeGroupImage(imageStream, threadID, [callback])
-api.muteThread(threadID, muteSeconds, [callback])
-api.deleteThread(threadID, [callback])
-api.changeArchivedStatus(threadID, archive, [callback])
-api.createPoll(title, threadID, options, [callback])
-api.pinMessage(messageID, threadID, [callback])
-api.markAsRead(threadID, [read], [callback])
-api.markAsDelivered(threadID, messageID, [callback])
-api.markAsSeen([callback])
-```
-
-### Users
-
-```js
-api.getUserInfo(userIDs, [callback])
-api.getUserID(name, [callback])
-api.getFriendsList([callback])
-api.handleFriendRequest(userID, accept, [callback])
-api.addFriend(userID, [callback])
-api.unfriend(userID, [callback])
-```
-
-### E2EE
-
-```js
-api.connectE2EE(callback)           // Start E2EE bridge
-api.getE2EEBridge()                 // Get live bridge instance
-api.getE2EEDeviceData([callback])   // Get E2EE device keys
-api.downloadE2EEMedia(options)      // Decrypt E2EE attachment
-api.resolveE2EEAttachment(att)      // Download + return local URL
-api.sendTypingE2EE(chatJid, bool)   // Send E2EE typing indicator
-```
-
-### Session
+## 📋 Available APIs
 
 ```js
-api.sessionGuard(accountPath, { interval, debounce })
-api.getAppState()                   // Get current cookie state
-api.setOptions(options)             // Update runtime options
-api.getHealth()                     // Health status object
-```
-
-### Listening
-
-```js
-const msgEmitter = api.listenMqtt(callback)
-msgEmitter.stopListening([callback])
-await msgEmitter.stopListeningAsync()
-api.stopListenMqtt()
-```
-
----
-
-## 🔐 E2EE Events
-
-| event.type | Description |
-|---|---|
-| `e2ee_ready` | Bridge loaded, syncing device |
-| `e2ee_fully_ready` | Ready to send/receive messages |
-| `e2ee_connected` | Transport connected |
-| `e2ee_disconnected` | Transport lost (auto-reconnects) |
-| `e2ee_device_data_changed` | Device keys updated |
-| `message` + `isE2EE: true` | Incoming E2EE message (DM or group) |
-| `e2ee_message_edit` | Message was edited |
-| `e2ee_message_reaction` | Reaction added |
-| `e2ee_receipt` | Read/delivery receipt |
-
-> **Normal and E2EE listeners never conflict.** The MQTT inbox handles normal chats; the E2EE bridge handles encrypted chats. Both can run simultaneously.
-
----
-
-## 🔄 Session Stability
-
-alpha-fca never calls logout automatically. Session is preserved as long as:
-1. `api.sessionGuard(path)` is active (auto-saves fresh cookies)
-2. The Facebook account is not independently logged out
-
-On MQTT disconnect, auto-reconnect fires with exponential backoff (3s–60s).
-
----
-
-## ⚠️ Limitations
-
-- **Cannot test live network behavior** — all MQTT/E2EE behavior depends on Facebook's active endpoints and your account cookies.
-- **E2EE requires** the native `build/messagix.so` (Linux) or `build/messagix.dll` (Windows) binary. These are pre-built for x86_64.
-- **Facebook API changes** may break parsing without warning — this is inherent to all unofficial FCAs.
-- **Rate limits** — avoid bulk-sending. alpha-fca does not bypass Facebook's rate limits.
-
----
-
-## 📁 Project Structure
-
-```
-alpha-fca/
-├── index.js             # Main entry — login() function
-├── utils.js             # HTTP helpers, cookie management
-├── e2ee.js              # E2EE bridge (Labyrinth)
-├── advancedSystem.js    # Minimal task queue + health monitor
-├── checkUpdate.js       # Non-blocking version check
-├── config.json          # Default config
-├── fca-config.example.json  # Documented config template
-├── package.json
-├── README.md
-├── CHANGELOG.md
-├── build/
-│   ├── messagix.so      # E2EE native binary (Linux x86_64)
-│   └── messagix.dll     # E2EE native binary (Windows x64)
-├── lib/
-│   └── index.mjs        # E2EE ESM bundle (Labyrinth client)
-├── src/                 # API method modules (95+ files)
-│   ├── listenMqtt.js    # Core inbox listener
-│   ├── sendMessage.js   # Message sending (normal + E2EE routing)
-│   ├── OldMessage.js    # Legacy DM fallback
-│   ├── stopListenMqtt.js
-│   ├── logout.js        # No-op (session preserved)
-│   └── ... (all other FCA methods)
-└── examples/
-    ├── basic-bot.js     # Normal inbox bot
-    └── e2ee-bot.js      # E2EE + normal combined bot
+// Messaging
+api.sendMessage(msg, threadID, callback)
+api.sendTypingIndicator(typing, threadID, callback)
+api.sendTypingIndicatorV2(typing, threadID, callback)  // MQTT-based
+
+// Inbox
+api.getThreadList(limit, timestamp, tags, callback)
+api.getThreadHistory(threadID, amount, timestamp, callback)
+api.getThreadInfo(threadID, callback)
+
+// Session & Anti-Logout
+api.saveSession(filePath)
+api.sessionGuard(filePath, opts)
+api.stopAntiLogout()
+api.stopAutomationGuard()
+api.forceLogout(callback)     // opt-in only
+
+// Health & Info
+api.getHealth()               // MQTT status, uptime, queue
+api.version                   // "1.0.5"
+api.name                      // "toru-fca"
+
+// Aliases
+api.listen                    // = api.listenMqtt
+api.send                      // = api.sendMessage
+api.getInbox                  // = api.getThreadList
 ```
 
 ---
 
-## 🔬 Merge Analysis
+## 🔧 Merged From
 
-| Feature | Winner | Reason |
-|---|---|---|
-| E2EE Bridge | hridoy-custom | undici Node<22 patch, self-listen filter, capped maps, stopped flag |
-| MQTT Core | hridoy-custom | MQTT patch stream, spinner, clean reconnect state |
-| Login/Session | hridoy-custom | Cookie parsing, 2FA, sessionGuard, no unnecessary logouts |
-| Error Handling | hridoy-akash | Global unhandledRejection/uncaughtException with network-specific handling |
-| Extra API Methods | ST-FCA | sendButtons, sendFriendRequest, searchFriends, setActiveStatus, etc. |
-| Low Automation | alpha-fca | All background polling disabled by default, config-driven opt-in only |
-| Config System | alpha-fca | Layered config (FCA defaults → bot CWD override → runtime options) |
+- **toru-fca v1.0.4** — Base, Anti-Logout v2, Session Guard, Cookie String
+- **shan-fca** — sendComment, setProfileLock, thread functions
+- **hridoy-fca** — sessionGuard enhanced, pinMessage, refreshFb_dtsg
+- **ws3-fca** — MQTT improvements, realtime
 
 ---
 
-## 📄 License
-
-MIT
+**toru-fca v1.0.5** — Ultimate Merged FCA | Anti-Logout v3 · Login Retry · Smooth & Safe

package/checkUpdate.js

@@ -1,37 +1,59 @@
 "use strict";
-
-const CURRENT_VERSION = "1.0.0";
-
 /**
- * Lightweight, non-blocking update check.
- * Only runs once per process lifetime (guarded by global._alphaFcaUpdateChecked).
- * Never blocks login or throws on failure.
+ * toru-fca v1.0.5 — checkUpdate.js
+ * Non-blocking update check. Bot startup e delay dibe na.
  */
+
+const axios = require("axios");
+const fs    = require("fs");
+const path  = require("path");
+const log   = require("npmlog");
+
+const CURRENT_VERSION = "1.0.5";
+const NPM_REGISTRY    = "https://registry.npmjs.org/toru-fca/latest";
+const TIMEOUT_MS      = 5000;
+
+function getCurrentVersion() {
+  try {
+    var pkg = JSON.parse(fs.readFileSync(path.join(__dirname, "package.json"), "utf8"));
+    if (pkg && pkg.version) return pkg.version;
+  } catch (_) {}
+  try {
+    var pkg2 = JSON.parse(fs.readFileSync(path.join(process.cwd(), "node_modules", "toru-fca", "package.json"), "utf8"));
+    if (pkg2 && pkg2.version) return pkg2.version;
+  } catch (_) {}
+  return CURRENT_VERSION;
+}
+
+function compareVersions(a, b) {
+  var pa = a.split(".").map(Number);
+  var pb = b.split(".").map(Number);
+  for (var i = 0; i < 3; i++) {
+    var na = pa[i] || 0, nb = pb[i] || 0;
+    if (na > nb) return 1;
+    if (na < nb) return -1;
+  }
+  return 0;
+}
+
 async function checkForFCAUpdate() {
   try {
-    // Try to fetch latest version from npm registry (or GitHub)
-    const https = require("https");
-    const pkgUrl = "https://registry.npmjs.org/hridoy-ultimate/latest";
-    const data = await new Promise((resolve) => {
-      const req = https.get(pkgUrl, { timeout: 5000 }, (res) => {
-        let body = "";
-        res.on("data", (c) => { body += c; });
-        res.on("end", () => {
-          try { resolve(JSON.parse(body)); }
-          catch (_) { resolve(null); }
-        });
-      });
-      req.on("error", () => resolve(null));
-      req.on("timeout", () => { req.destroy(); resolve(null); });
-    });
-    if (data && data.version && data.version !== CURRENT_VERSION) {
-      const log = require("npmlog");
-      log.warn("alpha-fca", `Update available: v${CURRENT_VERSION} → v${data.version}`);
-      log.warn("alpha-fca", "Run: npm update alpha-fca");
+    var res = await axios.get(NPM_REGISTRY, { timeout: TIMEOUT_MS });
+    var latestVersion  = res.data && res.data.version;
+    var currentVersion = getCurrentVersion();
+
+    if (!latestVersion) return false;
+
+    if (compareVersions(latestVersion, currentVersion) > 0) {
+      log.info("toru-fca", "Update available: v" + latestVersion + " (current: v" + currentVersion + ")");
+      log.info("toru-fca", "Run: npm install toru-fca@" + latestVersion);
+    } else {
+      log.info("toru-fca", "Up to date (v" + currentVersion + ")");
     }
   } catch (_) {
-    // Silently ignore — update check must never crash the bot
+    // Silent — update check is non-critical
   }
+  return false;
 }
 
-module.exports = { checkForFCAUpdate, CURRENT_VERSION };
+module.exports = { checkForFCAUpdate };