@wacando/agent 2.3.0 → 2.4.0

package/STATUS.md

@@ -1,5 +1,26 @@
 # Handoff — October 15, 2026
 
+## Runtime 2.4.0 — October 17, 2026
+
+Verified XMPP server (lbframe/wacando-agent#26): every XMPP connection of
+the runtime now goes through the embedded `scramClient` of lbframe/wacando#186.
+Only SCRAM-SHA-256/SHA-1 over SASL1 is used (no PLAIN, no SASL2/FAST,
+iteration count between 4096 and 100000), and the session is bound only after
+the server's ServerSignature (`v=`) was verified. A forged or missing `v=`, a
+SASL2 offer or a server without SCRAM closes the connection before any
+session: state `refused`, error `XMPP_SERVER_UNVERIFIED`, no retry and no
+reconnection in the process; the daemon exits with code 4 (code 3 for
+`SESSION_REPLACED`), at the first connection as at a reconnection. An error while
+the XMPP stream opens (a WebSocket cut on Node.js 24, a TCP reset) no longer
+kills the process with an unhandled rejection: it is an ordinary, retried
+connection failure. A repository-wide
+test forbids any raw `@xmpp/client` `client()` outside the embedded code. See
+[agent tools](docs/AGENT_TOOLS.md); evidence `docs/evidence/issue-26/`.
+
+Embedded Wacando code rebuilt from lbframe/wacando main `40dd0c3`, which also
+brings lbframe/wacando#166: `downloadFile` refuses more than 10 MiB and fails
+closed on size ([embedded Wacando code](docs/WACANDO_PACKAGES.md)).
+
 ## Runtime 2.3.0 — October 17, 2026
 
 Default origin (fix): the runtime now defaults to the production API

package/bin/wacando-agent.mjs

@@ -7,7 +7,7 @@ import { fileURLToPath } from 'node:url';
 import { pluginVersion } from '../packages/onboarding/version.mjs';
 import { configuredOrigin } from '../packages/onboarding/network.mjs';
 import { SafeError } from '../packages/onboarding/storage.mjs';
-import { SESSION_REPLACED } from '../packages/onboarding/service.mjs';
+import { SESSION_REPLACED, XMPP_SERVER_UNVERIFIED } from '../packages/onboarding/service.mjs';
 
 const root = fileURLToPath(new URL('../', import.meta.url));
 const self = fileURLToPath(import.meta.url);
@@ -174,28 +174,41 @@ commands.set('files', async flags => {
   await withConversations(parseFlags(rest, conversationFlags), c => c.listFiles(id));
 });
 
+/** Daemon exit code of a terminal connection error: 3 replaced, 4 unverified server. */
+function terminalExitCode(error) {
+  if (!(error instanceof SafeError)) return undefined;
+  if (error.message === SESSION_REPLACED) return 3;
+  if (error.message === XMPP_SERVER_UNVERIFIED) return 4;
+  return undefined;
+}
+
 commands.set('daemon', async flags => {
   const options = parseFlags(flags, ['--agent', '--host', '--origin']);
   // Keep the process alive between heartbeats/retries until a stop signal, or
-  // until the server hands this identity to a newer session (terminal).
+  // until the server hands this identity to a newer session or fails SCRAM
+  // verification (both terminal).
   let keepAlive;
-  let replaced;
+  let terminal;
   const stop = new Promise(resolve => {
     keepAlive = setInterval(() => {}, 3600000);
-    replaced = () => resolve('replaced');
+    terminal = reason => resolve(reason);
     process.once('SIGINT', resolve); process.once('SIGTERM', resolve);
   });
   const agent = await runtime(options, event => {
     // Diagnostics carry only local enums and public ids (never content).
     process.stderr.write(`${JSON.stringify({ component: 'wacando-connection', ...event })}\n`);
-    if (event.state === 'replaced') replaced();
+    if (event.state === 'replaced' || event.state === 'refused') terminal(event.state);
   });
   try {
     try { print(await agent.connect(options.agent)); }
     catch (error) {
       // A retry stays scheduled unless the identity was rejected for good or
       // another process already runs it (identity lock).
-      if (!(error instanceof SafeError) || /revoked|classic OMEMO|No saved identity|Several saved|SESSION_REPLACED/.test(error.message)) throw error;
+      // The terminal exit codes hold whether the first connection or a later
+      // reconnection hits them (a supervisor must not restart into a loop).
+      const exitCode = terminalExitCode(error);
+      if (exitCode) throw Object.assign(error, { exitCode });
+      if (!(error instanceof SafeError) || /revoked|classic OMEMO|No saved identity|Several saved/.test(error.message)) throw error;
       if (/Failed step: local identity/.test(error.message)) throw new SafeError('This identity is already running in another process (identity lock). Stop it first.');
       console.error(error.message);
     }
@@ -207,9 +220,13 @@ commands.set('daemon', async flags => {
         decrypted: entry.text !== null || Boolean(entry.file), ...(entry.file ? { file: { fileId: entry.file.fileId ?? null, state: entry.file.state } } : {}) })));
     } catch (error) { if (!(error instanceof SafeError)) throw error; console.error(error.message); }
     console.error('Daemon running; stop with Ctrl-C or SIGTERM.');
-    if ((await stop) === 'replaced') {
+    const reason = await stop;
+    if (reason === 'replaced') {
       console.error(SESSION_REPLACED);
       process.exitCode = 3;
+    } else if (reason === 'refused') {
+      console.error(XMPP_SERVER_UNVERIFIED);
+      process.exitCode = 4;
     }
   } finally { clearInterval(keepAlive); await agent.close(); }
 });
@@ -283,6 +300,6 @@ if (invoked === self) {
     if (error instanceof UsageError) console.error(usage);
     else if (error instanceof SafeError) console.error(error.message);
     else console.error('Wacando command failed. Check arguments, local state permissions and service availability.');
-    process.exitCode = error instanceof UsageError ? 2 : 1;
+    process.exitCode = error instanceof UsageError ? 2 : (Number.isInteger(error?.exitCode) ? error.exitCode : 1);
   });
 }

package/docs/AGENT_TOOLS.md

@@ -96,6 +96,18 @@ Rules enforced by the runtime (and, independently, by the server):
   identity back. After an ordinary network loss the conversation client moves
   to the new session (one OMEMO provider per identity) and re-joins rooms on
   demand.
+- **Verified XMPP server** (lbframe/wacando-agent#26, lbframe/wacando#186):
+  every XMPP login of the runtime uses the embedded `scramClient`: SCRAM-SHA-256
+  or SCRAM-SHA-1 over SASL1 only (no PLAIN, no SASL2/FAST), iteration count
+  between 4096 and 100000, and the session is bound only after the server's
+  ServerSignature (`v=`) was verified. A forged or missing `v=`, a SCRAM `e=`
+  error, a SASL2 offer or a server without SCRAM closes the connection before
+  any session: state `refused`, error `XMPP_SERVER_UNVERIFIED`, no retry and no
+  reconnection in the process (a further connect is refused). The daemon exits
+  with code 4, whether the first connection or a reconnection is refused (and
+  with code 3 for `SESSION_REPLACED`, likewise). Ordinary failures (wrong or
+  expired grant, network cut, timeout) stay `retrying`. Check the configured
+  service, then restart the runtime.
 - **Message text on the CLI**: pass `-` instead of the text to read it from
   stdin, so it stays out of `ps` and shell history.
 - **Presence**: after connecting, the runtime waits for the server's echo of

package/docs/WACANDO_PACKAGES.md

@@ -42,7 +42,18 @@ source repository; a URL is cloned into a temporary directory.
 result is byte-identical to `packages/wacando/` and `provenance.json` (it needs
 access to the private repository, so it is not part of `npm run check`).
 
-Current source (2.2.0, unchanged in 2.3.0): lbframe/wacando main
+Current source (2.4.0): lbframe/wacando main
+`40dd0c30b3653095f08994f9534fd5110e1d0925`. It brings lbframe/wacando#186:
+`#wacando/xmpp` now also exports `scramClient`, `startScramClient` and
+`ScramAuthError` (SCRAM client verifying the ServerSignature `v=`, SASL2
+refused, iteration count capped at 100000), through which the runtime makes
+every XMPP connection (`packages/runtime/session.mjs`; `@xmpp/client` is now
+also a recorded external of the embedded code); and lbframe/wacando#166:
+`downloadFile` refuses more than 10 MiB and fails closed on size.
+`tests/scram-wiring.test.mjs` forbids any raw `@xmpp/client` `client()`
+outside the embedded code.
+
+2.2.0 and 2.3.0 embedded lbframe/wacando main
 `618922ecaf2213da18949a8b27d343c8767b64c5`, which adds the review copy of
 lbframe/wacando#169 (`fileReviewFor`, `formatFileReview`, `parseFileReview`,
 `decryptFileReview`, `isFileReviewBody` in `#wacando/omemo`). Before it,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wacando/agent",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "description": "Wacando agent runtime: CLI/daemon, MCP server and Node SDK on official libsignal OMEMO, with thin Codex, Cursor and Claude Code plugins.",
   "license": "UNLICENSED",
   "type": "module",

package/packages/onboarding/service.mjs

@@ -13,6 +13,13 @@ const identifier = value => typeof value === 'string' && /^[a-zA-Z0-9_-]{1,200}$
 const secret = (value, prefix) => typeof value === 'string' && value.startsWith(prefix) && /^[a-zA-Z0-9_.-]{8,512}$/.test(value);
 const lostEnrollment = 'Enrollment result was not safely saved. Check the agent status on the site. If the token was consumed and no durable credential was saved, revoke this identity and create a new one with a different handle. No automatic recovery exists in v1.';
 export const SESSION_REPLACED = 'SESSION_REPLACED: this identity was taken over by a newer session elsewhere (one session per agent). Nothing reconnects automatically; restart this runtime to take it back.';
+/**
+ * lbframe/wacando-agent#26: the server failed SCRAM verification (forged or
+ * missing ServerSignature `v=`, SASL2 offered, no SCRAM mechanism, iteration
+ * count out of bounds...). Terminal: never retried automatically.
+ */
+export const XMPP_SERVER_UNVERIFIED = 'XMPP_SERVER_UNVERIFIED: the XMPP server did not prove it knows this identity\'s credential (SCRAM-SHA-256/SHA-1 with a verified server signature over SASL1 is required). The connection was closed before any session; connection attempts have stopped. Check the configured service, then restart this runtime.';
+export const SCRAM_REFUSED = 'SCRAM_REFUSED';
 const retryConnection = 'Agent credential is saved, but connection was not confirmed. Automatic retry is scheduled while this MCP host stays open. The same enrollment tool can also resume without consuming the temporary token or recreating the agent.';
 
 export class OnboardingService {
@@ -32,6 +39,9 @@ export class OnboardingService {
     // Identities whose session the server replaced (<conflict/>): terminal for
     // this process, so two runtimes never steal the session from each other.
     this.replaced = new Set();
+    // Identities whose XMPP server failed SCRAM verification (#26): terminal
+    // for this process, never retried in a loop against that server.
+    this.refused = new Set();
     this.schedule = schedule; this.cancel = cancel; this.random = random; this.report = report;
     this.onStanza = onStanza;
     this.onSession = onSession;
@@ -128,7 +138,7 @@ export class OnboardingService {
       catch {
         // open() schedules network recovery itself. Lock/storage failures also
         // remain observable and retryable, except after terminal access rejection.
-        if (!this.closed && !this.timers.has(agent.agentId) && !['revoked', 'replaced'].includes(this.states.get(agent.agentId)?.state)) this.retry(agent, 'local operation');
+        if (!this.closed && !this.timers.has(agent.agentId) && !['revoked', 'replaced', 'refused'].includes(this.states.get(agent.agentId)?.state)) this.retry(agent, 'local operation');
       }
       finally { this.recoveries.delete(recovery); }
     }, delay);
@@ -150,10 +160,18 @@ export class OnboardingService {
     this.status(agent, 'replaced', phase);
     await this.disconnect(agent.agentId);
   }
+  /** The XMPP server failed SCRAM verification: stop for good in this process. */
+  async markRefused(agent, phase = 'XMPP connection') {
+    this.refused.add(agent.agentId);
+    this.cancel(this.timers.get(agent.agentId)); this.timers.delete(agent.agentId);
+    if (this.states.get(agent.agentId)?.state !== 'refused') this.status(agent, 'refused', phase);
+    await this.disconnect(agent.agentId);
+  }
   async open(agent) {
     this.cancel(this.timers.get(agent.agentId)); this.timers.delete(agent.agentId);
     let release;
     let phase = 'local identity';
+    if (this.refused.has(agent.agentId)) throw new SafeError(XMPP_SERVER_UNVERIFIED);
     if (this.replaced.has(agent.agentId) || this.sessions.get(agent.agentId)?.session?.isReplaced?.()) {
       await this.markReplaced(agent);
       throw new SafeError(SESSION_REPLACED);
@@ -211,6 +229,12 @@ export class OnboardingService {
         await this.store.write(agent.origin, this.host, 'agent', agent.agentId, { ...agent, revoked: true });
         throw new SafeError('Agent revoked or durable access rejected. Connection attempts have stopped. Check the identity on the site.');
       }
+      if (error?.code === SCRAM_REFUSED) {
+        // Forged/missing ServerSignature or SASL2 offer: the connection is
+        // already closed; no automatic retry against this server.
+        await this.markRefused(agent, phase);
+        throw new SafeError(XMPP_SERVER_UNVERIFIED);
+      }
       const active = this.sessions.get(agent.agentId);
       if (this.replaced.has(agent.agentId) || active?.session?.isReplaced?.()) {
         // Another process took this identity over (newest session wins). Never

package/packages/onboarding/version.mjs

@@ -1,2 +1,2 @@
 // Must match all distributed plugin manifests; checked by the test suite.
-export const pluginVersion = '2.3.0';
+export const pluginVersion = '2.4.0';

package/packages/runtime/session.mjs

@@ -1,10 +1,39 @@
-import { client } from '@xmpp/client';
-import { announceAvailable, refuseSubscriptionRequests, xml } from '#wacando/xmpp';
+import { announceAvailable, refuseSubscriptionRequests, ScramAuthError, scramClient, startScramClient, xml } from '#wacando/xmpp';
+import { SCRAM_REFUSED, XMPP_SERVER_UNVERIFIED } from '../onboarding/service.mjs';
 import { SafeError } from '../onboarding/storage.mjs';
 import { loadDevice } from './device.mjs';
 
+/**
+ * @xmpp/connection 0.14.0 `start()` creates its "online" promise (rejected by
+ * any entity 'error') BEFORE awaiting `open()`. When an 'error' is emitted
+ * while the stream opens (Node.js 24's WebSocket reports a socket cut that
+ * way), `open()` rejects, `start()` throws without ever awaiting that promise
+ * and its rejection is unhandled: the whole process (daemon, MCP server)
+ * dies. Same steps, with the "online" promise always observed.
+ */
+function observeOnlinePromise(xmpp) {
+  xmpp.start = async function start() {
+    if (this.status !== 'offline') throw new Error('Connection is not offline');
+    const { service, domain, lang } = this.options;
+    await this.connect(service);
+    const online = new Promise((resolve, reject) => {
+      const settle = () => { this.removeListener('online', onOnline); this.removeListener('error', onError); };
+      const onOnline = value => { settle(); resolve(value); };
+      const onError = error => { settle(); reject(error); };
+      this.on('online', onOnline);
+      this.on('error', onError);
+    });
+    online.catch(() => {});
+    await this.open({ domain, lang });
+    return online;
+  };
+}
+
 const unavailable = () => new SafeError('Secure messaging is unavailable. Retry the saved identity.');
 
+/** SafeError for a ScramAuthError: the fixed message plus its local reason enum (no secret). */
+const serverUnverified = error => Object.assign(new SafeError(XMPP_SERVER_UNVERIFIED), { code: SCRAM_REFUSED, reason: error.reason });
+
 /**
  * One XMPP c2s stream (WebSocket) + this identity's native OMEMO device.
  *
@@ -13,12 +42,18 @@ const unavailable = () => new SafeError('Secure messaging is unavailable. Retry
  * delivery addressed to the bare JID after that point reaches this resource
  * and none can be missed between "online" and the caller subscribing.
  * Raw XMPP errors, stanzas and credentials are never logged.
+ *
+ * The client is the embedded `scramClient` (lbframe/wacando#186): SCRAM only,
+ * SASL1 only, and authentication succeeds only once the server's
+ * ServerSignature (`v=`) was verified. A refusal closes the connection,
+ * stops @xmpp/client's reconnect and rejects with `code: 'SCRAM_REFUSED'`.
  */
 export async function connectSession({ jid, password, service, stateBaseDir, onStanza, onReplaced, timeoutMs = 15000 }) {
   const provider = await loadDevice(jid, stateBaseDir);
   const at = jid.indexOf('@');
   const domain = jid.slice(at + 1);
-  const xmpp = client({ service, domain, username: jid.slice(0, at), password });
+  const xmpp = scramClient({ service, domain, username: jid.slice(0, at), password });
+  observeOnlinePromise(xmpp);
   // One server-enforced session per agent (lbframe/wacando #15): a newer login
   // ends this one with <conflict/>. Remember it so nothing reconnects in a loop.
   let replaced = false;
@@ -31,15 +66,16 @@ export async function connectSession({ jid, password, service, stateBaseDir, onS
   let timer;
   const deadline = new Promise((_, reject) => { timer = setTimeout(() => reject(new Error('timeout')), timeoutMs); });
   try {
-    await Promise.race([xmpp.start(), deadline]);
+    await Promise.race([startScramClient(xmpp), deadline]);
     xmpp.reconnect?.stop();
     // The control plane owns the roster (#13): never approve a subscription.
     refuseSubscriptionRequests(xmpp);
     if (onStanza) xmpp.on('stanza', stanza => onStanza(stanza, xmpp));
     await Promise.race([announceAvailable(xmpp, timeoutMs), deadline]);
-  } catch {
+  } catch (error) {
+    xmpp.reconnect?.stop();
     await xmpp.stop().catch(() => {});
-    throw unavailable();
+    throw error instanceof ScramAuthError ? serverUnverified(error) : unavailable();
   } finally { clearTimeout(timer); }
   return {
     client: xmpp, provider, bareJid: provider.bareJid, domain,

package/packages/wacando/chunks/{chunk-PHGOH4AU.mjs → chunk-F7J3K43U.mjs}

@@ -1,7 +1,7 @@
-// Embedded from lbframe/wacando@618922ecaf2213da18949a8b27d343c8767b64c5 by scripts/embed-wacando.mjs. Do not edit; see provenance.json.
+// Embedded from lbframe/wacando@40dd0c30b3653095f08994f9534fd5110e1d0925 by scripts/embed-wacando.mjs. Do not edit; see provenance.json.
 import {
   DomainError
-} from "./chunk-PZDQXGA6.mjs";
+} from "./chunk-FFLYSYV6.mjs";
 
 // packages/omemo/src/ns.ts
 var NS_OMEMO = "eu.siacs.conversations.axolotl";

package/packages/wacando/chunks/{chunk-PZDQXGA6.mjs → chunk-FFLYSYV6.mjs}

@@ -1,4 +1,4 @@
-// Embedded from lbframe/wacando@618922ecaf2213da18949a8b27d343c8767b64c5 by scripts/embed-wacando.mjs. Do not edit; see provenance.json.
+// Embedded from lbframe/wacando@40dd0c30b3653095f08994f9534fd5110e1d0925 by scripts/embed-wacando.mjs. Do not edit; see provenance.json.
 
 // packages/contracts/src/errors.ts
 var DomainError = class extends Error {

package/packages/wacando/chunks/{chunk-53E7SSTF.mjs → chunk-FUNUGIGH.mjs}

@@ -1,10 +1,370 @@
-// Embedded from lbframe/wacando@618922ecaf2213da18949a8b27d343c8767b64c5 by scripts/embed-wacando.mjs. Do not edit; see provenance.json.
+// Embedded from lbframe/wacando@40dd0c30b3653095f08994f9534fd5110e1d0925 by scripts/embed-wacando.mjs. Do not edit; see provenance.json.
 import {
   XMPP_DOMAIN
-} from "./chunk-PZDQXGA6.mjs";
+} from "./chunk-FFLYSYV6.mjs";
 
-// packages/xmpp/src/muc.ts
+// packages/xmpp/src/scram.ts
+import { client } from "@xmpp/client";
 import xml from "@xmpp/xml";
+var SASL1_NS = "urn:ietf:params:xml:ns:xmpp-sasl";
+var SASL2_NS = "urn:xmpp:sasl:2";
+var SCRAM_MIN_ITERATIONS = 4096;
+var SCRAM_MAX_ITERATIONS = 1e5;
+var HASH_BYTES = { "SHA-1": 20, "SHA-256": 32 };
+var REASON_TEXT = {
+  "missing-server-signature": "server sent no ServerSignature (v=)",
+  "server-signature-mismatch": "server ServerSignature (v=) does not match",
+  "malformed-server-message": "malformed SCRAM server message",
+  "server-error": "server reported a SCRAM error (e=)",
+  "nonce-mismatch": "server nonce does not extend the client nonce",
+  "weak-iteration-count": `server iteration count below ${SCRAM_MIN_ITERATIONS}`,
+  "excessive-iteration-count": `server iteration count above ${SCRAM_MAX_ITERATIONS}`,
+  "sasl2-refused": "server offers SASL2, which this client refuses (SASL1 SCRAM only)",
+  "no-scram-mechanism": "server offers no supported SCRAM mechanism",
+  "out-of-order": "SCRAM message out of order"
+};
+var ScramAuthError = class extends Error {
+  reason;
+  mechanism;
+  constructor(reason, mechanism) {
+    super(
+      `SCRAM authentication refused${mechanism ? ` (${mechanism})` : ""}: ${REASON_TEXT[reason]}`
+    );
+    this.name = "ScramAuthError";
+    this.reason = reason;
+    this.mechanism = mechanism;
+  }
+};
+var encoder = new TextEncoder();
+function utf8(text) {
+  return new Uint8Array(encoder.encode(text));
+}
+function bytesToBinary(bytes) {
+  let out = "";
+  for (const b of bytes) out += String.fromCharCode(b);
+  return out;
+}
+function binaryToBytes(binary) {
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i) & 255;
+  return out;
+}
+function base64Encode(bytes) {
+  return globalThis.btoa(bytesToBinary(bytes));
+}
+function base64Decode(text) {
+  if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(text)) {
+    return void 0;
+  }
+  try {
+    return binaryToBytes(globalThis.atob(text));
+  } catch {
+    return void 0;
+  }
+}
+function constantTimeEqual(a, b) {
+  let diff = a.length ^ b.length;
+  const n = Math.max(a.length, b.length);
+  for (let i = 0; i < n; i++) diff |= (a[i] ?? 0) ^ (b[i] ?? 0);
+  return diff === 0;
+}
+function xor(a, b) {
+  const out = new Uint8Array(a.length);
+  for (let i = 0; i < a.length; i++) out[i] = (a[i] ?? 0) ^ (b[i] ?? 0);
+  return out;
+}
+async function hmac(hash, key, data) {
+  const k = await globalThis.crypto.subtle.importKey("raw", key, { name: "HMAC", hash }, false, [
+    "sign"
+  ]);
+  return new Uint8Array(await globalThis.crypto.subtle.sign("HMAC", k, data));
+}
+async function digest(hash, data) {
+  return new Uint8Array(await globalThis.crypto.subtle.digest(hash, data));
+}
+async function hi(hash, password, salt, iterations) {
+  const key = await globalThis.crypto.subtle.importKey("raw", utf8(password), "PBKDF2", false, [
+    "deriveBits"
+  ]);
+  return new Uint8Array(
+    await globalThis.crypto.subtle.deriveBits(
+      { name: "PBKDF2", hash, salt, iterations },
+      key,
+      HASH_BYTES[hash] * 8
+    )
+  );
+}
+function parseAttributes(message) {
+  const attrs = /* @__PURE__ */ new Map();
+  for (const part of message.split(",")) {
+    const m = /^([A-Za-z])=(.*)$/s.exec(part);
+    if (!m) return void 0;
+    const [, key, value] = m;
+    if (attrs.has(key)) return void 0;
+    attrs.set(key, value);
+  }
+  return attrs;
+}
+function saslname(name) {
+  return name.replace(/=/g, "=3D").replace(/,/g, "=2C");
+}
+async function scramProofs(hash, password, salt, iterations, authMessage) {
+  const salted = await hi(hash, password, salt, iterations);
+  const clientKey = await hmac(hash, salted, utf8("Client Key"));
+  const storedKey = await digest(hash, clientKey);
+  const am = utf8(authMessage);
+  const clientSignature = await hmac(hash, storedKey, am);
+  const serverKey = await hmac(hash, salted, utf8("Server Key"));
+  return {
+    clientProof: xor(clientKey, clientSignature),
+    serverSignature: await hmac(hash, serverKey, am)
+  };
+}
+function verifyServerFinal(serverFinal, expected, mechanism) {
+  if (serverFinal === void 0 || serverFinal === "") {
+    throw new ScramAuthError("missing-server-signature", mechanism);
+  }
+  const attrs = parseAttributes(serverFinal);
+  if (!attrs) throw new ScramAuthError("malformed-server-message", mechanism);
+  if (attrs.has("e")) throw new ScramAuthError("server-error", mechanism);
+  const v = attrs.get("v");
+  if (v === void 0) throw new ScramAuthError("missing-server-signature", mechanism);
+  const received = base64Decode(v);
+  if (!received) throw new ScramAuthError("malformed-server-message", mechanism);
+  if (!constantTimeEqual(received, expected)) {
+    throw new ScramAuthError("server-signature-mismatch", mechanism);
+  }
+}
+var ScramMechanism = class {
+  constructor(hash, genNonce = defaultNonce) {
+    this.hash = hash;
+    this.genNonce = genNonce;
+    this.name = hash === "SHA-1" ? "SCRAM-SHA-1" : "SCRAM-SHA-256";
+  }
+  hash;
+  genNonce;
+  name;
+  clientFirst = true;
+  stage = "initial";
+  clientNonce = "";
+  clientFirstBare = "";
+  serverFirst = "";
+  expectedServerSignature;
+  pendingServerFinal;
+  verifiedFlag = false;
+  /** True once the server's ServerSignature has been verified. */
+  get verified() {
+    return this.verifiedFlag;
+  }
+  /** True once the client-final-message was sent (a `v=` is now due). */
+  get awaitingServerFinal() {
+    return this.stage === "final";
+  }
+  async response(cred) {
+    switch (this.stage) {
+      case "initial":
+        return this.clientFirstMessage(cred);
+      case "challenge":
+        return this.clientFinalMessage(cred);
+      case "final":
+        await this.final(this.pendingServerFinal);
+        return "";
+      default:
+        throw new ScramAuthError("out-of-order", this.name);
+    }
+  }
+  challenge(chal) {
+    if (this.stage === "challenge") {
+      this.serverFirst = utf8Decode(chal);
+      return;
+    }
+    if (this.stage === "final") {
+      this.pendingServerFinal = chal;
+      return;
+    }
+    throw new ScramAuthError("out-of-order", this.name);
+  }
+  /**
+   * server-final-message (binary string, as decoded from base64) from
+   * <success/> (SASL1), <additional-data/> (SASL2) or a last <challenge/>.
+   */
+  async final(data) {
+    if (this.verifiedFlag) return;
+    if (this.stage !== "final" || !this.expectedServerSignature) {
+      throw new ScramAuthError("out-of-order", this.name);
+    }
+    this.stage = "done";
+    const expected = this.expectedServerSignature;
+    this.expectedServerSignature = void 0;
+    verifyServerFinal(data === void 0 ? void 0 : utf8Decode(data), expected, this.name);
+    this.verifiedFlag = true;
+  }
+  clientFirstMessage(cred) {
+    this.clientNonce = this.genNonce();
+    this.clientFirstBare = `n=${saslname(cred.username ?? "")},r=${this.clientNonce}`;
+    this.stage = "challenge";
+    return utf8Binary(`n,,${this.clientFirstBare}`);
+  }
+  async clientFinalMessage(cred) {
+    const attrs = parseAttributes(this.serverFirst);
+    const nonce = attrs?.get("r");
+    const saltText = attrs?.get("s");
+    const iterText = attrs?.get("i");
+    if (attrs?.has("e")) throw new ScramAuthError("server-error", this.name);
+    if (!attrs || attrs.has("m") || !nonce || !saltText || !iterText) {
+      throw new ScramAuthError("malformed-server-message", this.name);
+    }
+    if (!nonce.startsWith(this.clientNonce) || nonce.length <= this.clientNonce.length) {
+      throw new ScramAuthError("nonce-mismatch", this.name);
+    }
+    const salt = base64Decode(saltText);
+    if (!salt || salt.length === 0 || !/^[1-9][0-9]{0,9}$/.test(iterText)) {
+      throw new ScramAuthError("malformed-server-message", this.name);
+    }
+    const iterations = Number(iterText);
+    if (iterations < SCRAM_MIN_ITERATIONS) {
+      throw new ScramAuthError("weak-iteration-count", this.name);
+    }
+    if (iterations > SCRAM_MAX_ITERATIONS) {
+      throw new ScramAuthError("excessive-iteration-count", this.name);
+    }
+    const withoutProof = `c=biws,r=${nonce}`;
+    const authMessage = `${this.clientFirstBare},${this.serverFirst},${withoutProof}`;
+    const { clientProof, serverSignature } = await scramProofs(
+      this.hash,
+      cred.password ?? "",
+      salt,
+      iterations,
+      authMessage
+    );
+    this.expectedServerSignature = serverSignature;
+    this.stage = "final";
+    return utf8Binary(`${withoutProof},p=${base64Encode(clientProof)}`);
+  }
+};
+function utf8Binary(text) {
+  return bytesToBinary(utf8(text));
+}
+function utf8Decode(binary) {
+  return new TextDecoder().decode(binaryToBytes(binary));
+}
+function defaultNonce() {
+  const bytes = new Uint8Array(24);
+  globalThis.crypto.getRandomValues(bytes);
+  return base64Encode(bytes);
+}
+var SCRAM_HASHES = ["SHA-256", "SHA-1"];
+var SCRAM_NAMES = SCRAM_HASHES.map(
+  (h) => h === "SHA-1" ? "SCRAM-SHA-1" : "SCRAM-SHA-256"
+);
+var NS_STREAM = "http://etherx.jabber.org/streams";
+function saslFeaturesRefusal(features) {
+  if (features.getChild("authentication", SASL2_NS)) return "sasl2-refused";
+  const sasl1 = features.getChild("mechanisms", SASL1_NS);
+  if (!sasl1) return void 0;
+  const offered = sasl1.getChildren("mechanism").map((m) => m.text().trim());
+  return SCRAM_NAMES.some((name) => offered.includes(name)) ? void 0 : "no-scram-mechanism";
+}
+var states = /* @__PURE__ */ new WeakMap();
+function scramClient(options) {
+  const { username, password, ...rest } = options;
+  let current;
+  let rejectFailure = () => {
+  };
+  const state = {
+    failure: new Promise((_, reject) => {
+      rejectFailure = reject;
+    })
+  };
+  state.failure.catch(() => {
+  });
+  const userAgent = xml("user-agent", { id: globalThis.crypto.randomUUID() });
+  const cut = (entity, err) => {
+    state.cutting ??= (async () => {
+      entity.reconnect?.stop();
+      await entity.stop().catch(() => {
+      });
+      rejectFailure(err);
+    })();
+    return state.cutting;
+  };
+  let refused;
+  const xmpp = client({
+    ...rest,
+    credentials: async (authenticate, mechanisms, _fast, entity) => {
+      const failClosed = async (err) => {
+        await cut(entity, err);
+        throw err;
+      };
+      if (refused) return failClosed(refused);
+      const mechanism = SCRAM_NAMES.find((name) => mechanisms.includes(name));
+      if (!mechanism) return failClosed(new ScramAuthError("no-scram-mechanism"));
+      let successData;
+      const onNonza = (el) => {
+        if (el.is("success", SASL1_NS)) successData = decodeSuccess(el.text());
+      };
+      entity.on("nonza", onNonza);
+      current = void 0;
+      try {
+        await authenticate({ username, password }, mechanism, userAgent);
+        const mech = current;
+        if (!mech) throw new ScramAuthError("out-of-order", mechanism);
+        if (!mech.verified) await mech.final(successData);
+      } catch (err) {
+        if (err instanceof ScramAuthError) return failClosed(err);
+        throw err;
+      } finally {
+        entity.removeListener("nonza", onNonza);
+        current = void 0;
+      }
+    }
+  });
+  const factory = xmpp.saslFactory;
+  const bound = SCRAM_HASHES.map((hash) => ({
+    name: hash === "SHA-1" ? "SCRAM-SHA-1" : "SCRAM-SHA-256",
+    mech: class extends ScramMechanism {
+      constructor() {
+        super(hash);
+        current = this;
+      }
+    }
+  }));
+  factory._mechs.splice(0, factory._mechs.length, ...bound);
+  xmpp.on("nonza", (el) => {
+    if (!el.is("features", NS_STREAM)) return;
+    const reason = saslFeaturesRefusal(el);
+    if (!reason) return;
+    refused = new ScramAuthError(reason);
+    void cut(xmpp, refused);
+  });
+  states.set(xmpp, state);
+  return xmpp;
+}
+function decodeSuccess(text) {
+  const trimmed = text.trim();
+  if (trimmed === "" || trimmed === "=") return void 0;
+  try {
+    return globalThis.atob(trimmed);
+  } catch {
+    return void 0;
+  }
+}
+async function startScramClient(xmpp) {
+  const state = states.get(xmpp);
+  if (!state) return xmpp.start();
+  try {
+    return await Promise.race([xmpp.start(), state.failure]);
+  } catch (err) {
+    if (state.cutting) {
+      await state.cutting;
+      return state.failure;
+    }
+    throw err;
+  }
+}
+
+// packages/xmpp/src/muc.ts
+import xml2 from "@xmpp/xml";
 
 // packages/xmpp/src/jid.ts
 var COMPONENT_JID = `policy.${XMPP_DOMAIN}`;
@@ -113,7 +473,7 @@ var MucJoinError = class extends MucError {
   nick;
 };
 function joinPresenceEl(room, nick) {
-  return xml("presence", { to: occupantJid(room, nick) }, xml("x", { xmlns: NS_MUC }));
+  return xml2("presence", { to: occupantJid(room, nick) }, xml2("x", { xmlns: NS_MUC }));
 }
 async function joinRoom(entity, room, nick, timeoutMs = defaultTimeoutMs()) {
   const self = occupantJid(room, nick);
@@ -266,24 +626,24 @@ var MucOriginTracker = class {
 };
 
 // packages/xmpp/src/mam.ts
-import xml2 from "@xmpp/xml";
+import xml3 from "@xmpp/xml";
 var NS_MAM = "urn:xmpp:mam:2";
 var NS_FORWARD2 = "urn:xmpp:forward:0";
 var NS_RSM = "http://jabber.org/protocol/rsm";
 var queryCounter = 0;
 function filterField(varName, value) {
-  return xml2("field", { var: varName }, xml2("value", {}, value));
+  return xml3("field", { var: varName }, xml3("value", {}, value));
 }
 function mamQueryEl(options) {
-  const fields = [xml2("field", { var: "FORM_TYPE", type: "hidden" }, xml2("value", {}, NS_MAM))];
+  const fields = [xml3("field", { var: "FORM_TYPE", type: "hidden" }, xml3("value", {}, NS_MAM))];
   if (options.withJid !== void 0) fields.push(filterField("with", options.withJid));
   if (options.start !== void 0) fields.push(filterField("start", options.start));
   if (options.end !== void 0) fields.push(filterField("end", options.end));
-  const children = [xml2("x", { xmlns: NS_DATA_FORMS, type: "submit" }, ...fields)];
+  const children = [xml3("x", { xmlns: NS_DATA_FORMS, type: "submit" }, ...fields)];
   if (options.max !== void 0) {
-    children.push(xml2("set", { xmlns: NS_RSM }, xml2("max", {}, String(options.max))));
+    children.push(xml3("set", { xmlns: NS_RSM }, xml3("max", {}, String(options.max))));
   }
-  return xml2("query", { xmlns: NS_MAM, queryid: options.queryId }, ...children);
+  return xml3("query", { xmlns: NS_MAM, queryid: options.queryId }, ...children);
 }
 async function queryMam(entity, options, timeoutMs = defaultTimeoutMs()) {
   const queryId = options.queryId ?? `mam${++queryCounter}`;
@@ -326,7 +686,7 @@ function forwardedStanza(forwarded) {
 
 // packages/xmpp/src/roster.ts
 import { jid as parseJid } from "@xmpp/jid";
-import xml3 from "@xmpp/xml";
+import xml4 from "@xmpp/xml";
 function subscriptionRefusal(stanza) {
   if (!stanza.is("presence") || stanza.getAttr("type") !== "subscribe") return null;
   const from = stanza.getAttr("from");
@@ -337,7 +697,7 @@ function subscriptionRefusal(stanza) {
   } catch {
     return null;
   }
-  return xml3("presence", { to: bare, type: "unsubscribed" });
+  return xml4("presence", { to: bare, type: "unsubscribed" });
 }
 function refuseSubscriptionRequests(entity) {
   const onStanza = (stanza) => {
@@ -356,26 +716,26 @@ var UNKNOWN_PRESENCE = Object.freeze({
 });
 
 // packages/xmpp/src/pubsub.ts
-import xml4 from "@xmpp/xml";
+import xml5 from "@xmpp/xml";
 var NS_PUBSUB = "http://jabber.org/protocol/pubsub";
 var NS_PUBSUB_PUBLISH_OPTIONS = "http://jabber.org/protocol/pubsub#publish-options";
 function pepPublishEl(node, itemId, payload, accessModel = "open") {
-  return xml4(
+  return xml5(
     "pubsub",
     { xmlns: NS_PUBSUB },
-    xml4("publish", { node }, xml4("item", { id: itemId }, payload)),
-    xml4(
+    xml5("publish", { node }, xml5("item", { id: itemId }, payload)),
+    xml5(
       "publish-options",
       {},
-      xml4(
+      xml5(
         "x",
         { xmlns: NS_DATA_FORMS, type: "submit" },
-        xml4(
+        xml5(
           "field",
           { var: "FORM_TYPE", type: "hidden" },
-          xml4("value", {}, NS_PUBSUB_PUBLISH_OPTIONS)
+          xml5("value", {}, NS_PUBSUB_PUBLISH_OPTIONS)
         ),
-        xml4("field", { var: "pubsub#access_model" }, xml4("value", {}, accessModel))
+        xml5("field", { var: "pubsub#access_model" }, xml5("value", {}, accessModel))
       )
     )
   );
@@ -383,7 +743,7 @@ function pepPublishEl(node, itemId, payload, accessModel = "open") {
 function pubsubItemsEl(node, maxItems) {
   const attrs = { node };
   if (maxItems !== void 0) attrs.max_items = String(maxItems);
-  return xml4("pubsub", { xmlns: NS_PUBSUB }, xml4("items", attrs));
+  return xml5("pubsub", { xmlns: NS_PUBSUB }, xml5("items", attrs));
 }
 async function pepPublish(entity, to, node, itemId, payload, timeoutMs = defaultTimeoutMs()) {
   await entity.iqCaller.set(pepPublishEl(node, itemId, payload), to, timeoutMs);
@@ -408,6 +768,9 @@ function isItemNotFound(err) {
 }
 
 export {
+  ScramAuthError,
+  scramClient,
+  startScramClient,
   defaultTimeoutMs,
   waitForStanza,
   MucJoinError,

package/packages/wacando/omemo-wire.mjs

@@ -1,4 +1,4 @@
-// Embedded from lbframe/wacando@618922ecaf2213da18949a8b27d343c8767b64c5 by scripts/embed-wacando.mjs. Do not edit; see provenance.json.
+// Embedded from lbframe/wacando@40dd0c30b3653095f08994f9534fd5110e1d0925 by scripts/embed-wacando.mjs. Do not edit; see provenance.json.
 import {
   BODY_MARKER,
   GCM_IV_BYTES,
@@ -29,8 +29,8 @@ import {
   signerJid,
   signerRole,
   targetJid
-} from "./chunks/chunk-PHGOH4AU.mjs";
-import "./chunks/chunk-PZDQXGA6.mjs";
+} from "./chunks/chunk-F7J3K43U.mjs";
+import "./chunks/chunk-FFLYSYV6.mjs";
 
 // packages/omemo/src/policy-wire.ts
 import xml from "@xmpp/xml";

package/packages/wacando/omemo.mjs

@@ -1,9 +1,9 @@
-// Embedded from lbframe/wacando@618922ecaf2213da18949a8b27d343c8767b64c5 by scripts/embed-wacando.mjs. Do not edit; see provenance.json.
+// Embedded from lbframe/wacando@40dd0c30b3653095f08994f9534fd5110e1d0925 by scripts/embed-wacando.mjs. Do not edit; see provenance.json.
 import {
   authenticatedMessageOrigin,
   pepFetchItems,
   pepPublish
-} from "./chunks/chunk-53E7SSTF.mjs";
+} from "./chunks/chunk-FUNUGIGH.mjs";
 import {
   BODY_MARKER,
   GCM_IV_BYTES,
@@ -37,13 +37,13 @@ import {
   signerJid,
   signerRole,
   utf8Encode
-} from "./chunks/chunk-PHGOH4AU.mjs";
+} from "./chunks/chunk-F7J3K43U.mjs";
 import {
   ALLOWED_MEDIA_TYPES,
   MAX_FILE_BYTES,
   MIN_FILE_BYTES,
   looksLikePlaintext
-} from "./chunks/chunk-PZDQXGA6.mjs";
+} from "./chunks/chunk-FFLYSYV6.mjs";
 
 // packages/omemo/src/libsignal.ts
 import { jid as parseJid2 } from "@xmpp/jid";
@@ -585,8 +585,8 @@ var OmemoProvider = class {
   /**
    * Resolve OMEMO device targets for a member set via PEP — fail closed:
    * missing devicelist or missing bundle throws OmemoError before any
-   * plaintext is touched. Bundle elements are kept raw: each session
-   * backend parses the flavor it accepts (kyber → PQXDH, else classic).
+   * plaintext is touched. Bundle elements are kept raw: the session
+   * backend parses them and refuses any non-PQXDH (classic) bundle.
    */
   async resolveDeviceTargets(entity, memberBareJids, timeoutMs = 1e4) {
     const recipients = [.../* @__PURE__ */ new Set([...memberBareJids, this.bareJid])];
@@ -1175,6 +1175,7 @@ var NAME_INVISIBLE = new RegExp(
   "g"
 );
 var NAME_RESERVED = /[<>:"|?*]/g;
+var NAME_DOT_LOOKALIKE = /[\uff0e\ufe52\u2024]/g;
 var WINDOWS_DEVICE = /^(con|prn|aux|nul|conin\$|conout\$|clock\$|com[0-9\u00b9\u00b2\u00b3]|lpt[0-9\u00b9\u00b2\u00b3])\s*(\..*)?$/i;
 function utf8Length(s) {
   return new TextEncoder().encode(s).length;
@@ -1188,7 +1189,7 @@ function cutUtf8(s, max) {
   return out;
 }
 function sanitizeFileName(raw) {
-  let name = raw.normalize("NFC").replace(NAME_INVISIBLE, "");
+  let name = raw.normalize("NFC").replace(NAME_INVISIBLE, "").replace(NAME_DOT_LOOKALIKE, ".");
   name = name.split(/[/\\]/).pop() ?? "";
   name = name.replace(NAME_RESERVED, "_").trim();
   name = name.replace(/^[.\s]+/, "").replace(/[.\s]+$/, "");
@@ -1540,7 +1541,10 @@ function fileIdOfShare(share) {
 }
 async function downloadFile(share, opts) {
   const { fetchUrl } = parseAesgcmUrl(share.url, opts.pin);
-  const limit = share.ciphertextSize;
+  const expected = share.ciphertextSize;
+  if (!Number.isSafeInteger(expected) || expected < FILE_TAG_BYTES)
+    throw new FileCryptoError("invalid_descriptor", "file share: ciphertext size");
+  const limit = Math.min(expected, MAX_FILE_CIPHERTEXT_BYTES);
   const doFetch = opts.fetch ?? globalThis.fetch;
   const signal = AbortSignal.timeout(opts.timeoutMs ?? FILE_DOWNLOAD_TIMEOUT_MS);
   const failed = (what) => new FileCryptoError("download_failed", `download ${what}`);
@@ -1593,6 +1597,7 @@ async function downloadFile(share, opts) {
     if (e instanceof FileCryptoError) throw e;
     throw failed(signal.aborted ? "timed out" : "interrupted");
   }
+  if (total !== expected) throw failed("truncated");
   const out = new Uint8Array(total);
   let at = 0;
   for (const c of chunks) {

package/packages/wacando/xmpp.mjs

@@ -1,17 +1,20 @@
-// Embedded from lbframe/wacando@618922ecaf2213da18949a8b27d343c8767b64c5 by scripts/embed-wacando.mjs. Do not edit; see provenance.json.
+// Embedded from lbframe/wacando@40dd0c30b3653095f08994f9534fd5110e1d0925 by scripts/embed-wacando.mjs. Do not edit; see provenance.json.
 import {
   MucJoinError,
   MucOriginTracker,
+  ScramAuthError,
   authenticatedMessageOrigin,
   defaultTimeoutMs,
   forwardedStanza,
   joinRoom,
   queryMam,
   refuseSubscriptionRequests,
+  scramClient,
+  startScramClient,
   unwrapPolicyDelivery,
   waitForStanza
-} from "./chunks/chunk-53E7SSTF.mjs";
-import "./chunks/chunk-PZDQXGA6.mjs";
+} from "./chunks/chunk-FUNUGIGH.mjs";
+import "./chunks/chunk-FFLYSYV6.mjs";
 
 // packages/xmpp/src/index.ts
 import { default as default2 } from "@xmpp/xml";
@@ -73,6 +76,7 @@ async function requestUploadSlot(entity, service, req, timeoutMs = defaultTimeou
 export {
   MucJoinError,
   MucOriginTracker,
+  ScramAuthError,
   announceAvailable,
   authenticatedMessageOrigin,
   forwardedStanza,
@@ -80,6 +84,8 @@ export {
   queryMam,
   refuseSubscriptionRequests,
   requestUploadSlot,
+  scramClient,
+  startScramClient,
   unwrapPolicyDelivery,
   uploadServiceJid,
   default2 as xml

package/plugins/wacando/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wacando",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "description": "Connect agents with Wacando onboarding and view conversations in the built-in Codex browser.",
   "author": { "name": "Wacando" },
   "skills": "./skills/",

package/plugins/wacando-claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "wacando-claude",
   "displayName": "Wacando",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "description": "Connect agents with Wacando onboarding and view live Claude Code conversations locally.",
   "author": { "name": "Wacando" },
   "keywords": ["agents", "conversation", "local", "observability"],

package/plugins/wacando-cursor/.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "wacando-cursor",
   "displayName": "Wacando",
-  "version": "2.3.0",
+  "version": "2.4.0",
   "description": "Connect agents with Wacando onboarding and view conversations in the built-in Cursor browser.",
   "author": { "name": "Wacando" },
   "keywords": ["agents", "conversation", "local", "observability"],

package/provenance.json

@@ -240,11 +240,11 @@
     "source": {
       "repository": "lbframe/wacando",
       "branch": "main",
-      "commit": "618922ecaf2213da18949a8b27d343c8767b64c5",
+      "commit": "40dd0c30b3653095f08994f9534fd5110e1d0925",
       "trees": {
-        "packages/contracts/src": "1dbaf861fdfc561b90b8ca6d4d7249d2faf2008b",
-        "packages/xmpp/src": "d1747bc876f1cdc3594d3b8f40c35d2e72baed72",
-        "packages/omemo/src": "f1339fc6872b0a5a057b0537d30b475106a69698"
+        "packages/contracts/src": "bf79bedbbb5bd0dc5cbf7d3a027a30f76a3f6904",
+        "packages/xmpp/src": "d8dbc0ea4b286c26bfb3e7b347c3210b27365c9b",
+        "packages/omemo/src": "850b707c9705211a6136486c78c38882699e8b39"
       },
       "packages": [
         {
@@ -273,6 +273,7 @@
     },
     "externals": {
       "@signalapp/libsignal-client": "0.102.2",
+      "@xmpp/client": "0.14.0",
       "@xmpp/jid": "0.14.0",
       "@xmpp/xml": "0.14.0",
       "base64-js": "1.5.1",
@@ -325,6 +326,7 @@
       "packages/xmpp/src/presence.ts",
       "packages/xmpp/src/pubsub.ts",
       "packages/xmpp/src/roster.ts",
+      "packages/xmpp/src/scram.ts",
       "packages/xmpp/src/single-session.ts",
       "packages/xmpp/src/stanza.ts",
       "packages/xmpp/src/timeouts.ts",
@@ -332,34 +334,34 @@
     ],
     "files": [
       {
-        "path": "packages/wacando/chunks/chunk-53E7SSTF.mjs",
-        "bytes": 14356,
-        "sha256": "c9571af753d39674c6c17ee01542605bf9ca5b59e17e98e1672deee8fa30b096"
-      },
-      {
-        "path": "packages/wacando/chunks/chunk-PHGOH4AU.mjs",
+        "path": "packages/wacando/chunks/chunk-F7J3K43U.mjs",
         "bytes": 13681,
-        "sha256": "79249a0223eeb7ac621ff0f6476ded8926264ea5c4a87edd0c886ec9ee80cc75"
+        "sha256": "5b2797e10cb4c5ca5c976f2f670c5c41b18b403d28dc9622a07617e71dc33e80"
       },
       {
-        "path": "packages/wacando/chunks/chunk-PZDQXGA6.mjs",
+        "path": "packages/wacando/chunks/chunk-FFLYSYV6.mjs",
         "bytes": 2164,
-        "sha256": "a5ab4ba0eac4ac3a24530aa8268df803cd2e0d856bc3752fa49f4489ed02b73b"
+        "sha256": "d84c6ca7a529acc6be0da790124bb73a35fd6c7703beb370fb4e8003eb2ca0e0"
+      },
+      {
+        "path": "packages/wacando/chunks/chunk-FUNUGIGH.mjs",
+        "bytes": 26532,
+        "sha256": "b237936a6254b8263768aef19c80c427183ed3f607c9af9f33595477bc0bddc9"
       },
       {
         "path": "packages/wacando/omemo-wire.mjs",
         "bytes": 5683,
-        "sha256": "c2d98f80d487ed1ea7ba3c989bdf3893ff50d1328a6101bf6633173f29892409"
+        "sha256": "bf44f885b9e3e65da624f9251ec1b2148e8e647a6398c22750003cda3c961e84"
       },
       {
         "path": "packages/wacando/omemo.mjs",
-        "bytes": 109430,
-        "sha256": "61f802bf70445d4dc12d7301a94f7608f2077293503566721bf43f8fc29371b3"
+        "bytes": 109777,
+        "sha256": "334fe2228f4bdc5c66e9968c707094b6bc76f5a60a8f9fa59dad4a8cb1788c49"
       },
       {
         "path": "packages/wacando/xmpp.mjs",
-        "bytes": 2728,
-        "sha256": "58a7e1a996412a9be7440c74d4a4d6202a60b9ca7ce49de46c2461d1dc119496"
+        "bytes": 2834,
+        "sha256": "1d5536b43cf9d38414c1ccd4c73334a07db60b57c6b584f6a61916010a3453e1"
       }
     ]
   }