@wacando/agent 2.3.0 → 2.4.1

package/packages/wacando/chunks/chunk-5Q4655F4.mjs

@@ -0,0 +1,811 @@
+// Embedded from lbframe/wacando@87b51a96aff0a13ca5ad6650c9c841bee72e1612 by scripts/embed-wacando.mjs. Do not edit; see provenance.json.
+import {
+  XMPP_DOMAIN
+} from "./chunk-4Z6TL6JY.mjs";
+
+// packages/xmpp/src/scram.ts
+import { client } from "@xmpp/client";
+import xml from "@xmpp/xml";
+
+// packages/xmpp/src/start.ts
+import { promise, timeout } from "@xmpp/events";
+var guarded = /* @__PURE__ */ new WeakSet();
+function guardStart(entity) {
+  if (guarded.has(entity)) return entity;
+  const target = entity;
+  target.start = async function start() {
+    if (this.status !== "offline") {
+      throw new Error("Connection is not offline");
+    }
+    const { service, domain, lang } = this.options;
+    await this.connect(service);
+    const online = promise(this, "online");
+    online.catch(() => {
+    });
+    await this.open({ domain, lang });
+    return online;
+  };
+  guarded.add(entity);
+  return entity;
+}
+
+// packages/xmpp/src/scram.ts
+var SASL1_NS = "urn:ietf:params:xml:ns:xmpp-sasl";
+var SASL2_NS = "urn:xmpp:sasl:2";
+var SCRAM_MIN_ITERATIONS = 4096;
+var SCRAM_MAX_ITERATIONS = 1e5;
+var HASH_BYTES = { "SHA-1": 20, "SHA-256": 32 };
+var REASON_TEXT = {
+  "missing-server-signature": "server sent no ServerSignature (v=)",
+  "server-signature-mismatch": "server ServerSignature (v=) does not match",
+  "malformed-server-message": "malformed SCRAM server message",
+  "server-error": "server reported a SCRAM error (e=)",
+  "nonce-mismatch": "server nonce does not extend the client nonce",
+  "weak-iteration-count": `server iteration count below ${SCRAM_MIN_ITERATIONS}`,
+  "excessive-iteration-count": `server iteration count above ${SCRAM_MAX_ITERATIONS}`,
+  "sasl2-refused": "server offers SASL2, which this client refuses (SASL1 SCRAM only)",
+  "no-scram-mechanism": "server offers no supported SCRAM mechanism",
+  "out-of-order": "SCRAM message out of order"
+};
+var ScramAuthError = class extends Error {
+  reason;
+  mechanism;
+  constructor(reason, mechanism) {
+    super(
+      `SCRAM authentication refused${mechanism ? ` (${mechanism})` : ""}: ${REASON_TEXT[reason]}`
+    );
+    this.name = "ScramAuthError";
+    this.reason = reason;
+    this.mechanism = mechanism;
+  }
+};
+var encoder = new TextEncoder();
+function utf8(text) {
+  return new Uint8Array(encoder.encode(text));
+}
+function bytesToBinary(bytes) {
+  let out = "";
+  for (const b of bytes) out += String.fromCharCode(b);
+  return out;
+}
+function binaryToBytes(binary) {
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i) & 255;
+  return out;
+}
+function base64Encode(bytes) {
+  return globalThis.btoa(bytesToBinary(bytes));
+}
+function base64Decode(text) {
+  if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(text)) {
+    return void 0;
+  }
+  try {
+    return binaryToBytes(globalThis.atob(text));
+  } catch {
+    return void 0;
+  }
+}
+function constantTimeEqual(a, b) {
+  let diff = a.length ^ b.length;
+  const n = Math.max(a.length, b.length);
+  for (let i = 0; i < n; i++) diff |= (a[i] ?? 0) ^ (b[i] ?? 0);
+  return diff === 0;
+}
+function xor(a, b) {
+  const out = new Uint8Array(a.length);
+  for (let i = 0; i < a.length; i++) out[i] = (a[i] ?? 0) ^ (b[i] ?? 0);
+  return out;
+}
+async function hmac(hash, key, data) {
+  const k = await globalThis.crypto.subtle.importKey("raw", key, { name: "HMAC", hash }, false, [
+    "sign"
+  ]);
+  return new Uint8Array(await globalThis.crypto.subtle.sign("HMAC", k, data));
+}
+async function digest(hash, data) {
+  return new Uint8Array(await globalThis.crypto.subtle.digest(hash, data));
+}
+async function hi(hash, password, salt, iterations) {
+  const key = await globalThis.crypto.subtle.importKey("raw", utf8(password), "PBKDF2", false, [
+    "deriveBits"
+  ]);
+  return new Uint8Array(
+    await globalThis.crypto.subtle.deriveBits(
+      { name: "PBKDF2", hash, salt, iterations },
+      key,
+      HASH_BYTES[hash] * 8
+    )
+  );
+}
+function parseAttributes(message) {
+  const attrs = /* @__PURE__ */ new Map();
+  for (const part of message.split(",")) {
+    const m = /^([A-Za-z])=(.*)$/s.exec(part);
+    if (!m) return void 0;
+    const [, key, value] = m;
+    if (attrs.has(key)) return void 0;
+    attrs.set(key, value);
+  }
+  return attrs;
+}
+function saslname(name) {
+  return name.replace(/=/g, "=3D").replace(/,/g, "=2C");
+}
+async function scramProofs(hash, password, salt, iterations, authMessage) {
+  const salted = await hi(hash, password, salt, iterations);
+  const clientKey = await hmac(hash, salted, utf8("Client Key"));
+  const storedKey = await digest(hash, clientKey);
+  const am = utf8(authMessage);
+  const clientSignature = await hmac(hash, storedKey, am);
+  const serverKey = await hmac(hash, salted, utf8("Server Key"));
+  return {
+    clientProof: xor(clientKey, clientSignature),
+    serverSignature: await hmac(hash, serverKey, am)
+  };
+}
+function verifyServerFinal(serverFinal, expected, mechanism) {
+  if (serverFinal === void 0 || serverFinal === "") {
+    throw new ScramAuthError("missing-server-signature", mechanism);
+  }
+  const attrs = parseAttributes(serverFinal);
+  if (!attrs) throw new ScramAuthError("malformed-server-message", mechanism);
+  if (attrs.has("e")) throw new ScramAuthError("server-error", mechanism);
+  const v = attrs.get("v");
+  if (v === void 0) throw new ScramAuthError("missing-server-signature", mechanism);
+  const received = base64Decode(v);
+  if (!received) throw new ScramAuthError("malformed-server-message", mechanism);
+  if (!constantTimeEqual(received, expected)) {
+    throw new ScramAuthError("server-signature-mismatch", mechanism);
+  }
+}
+var ScramMechanism = class {
+  constructor(hash, genNonce = defaultNonce) {
+    this.hash = hash;
+    this.genNonce = genNonce;
+    this.name = hash === "SHA-1" ? "SCRAM-SHA-1" : "SCRAM-SHA-256";
+  }
+  hash;
+  genNonce;
+  name;
+  clientFirst = true;
+  stage = "initial";
+  clientNonce = "";
+  clientFirstBare = "";
+  serverFirst = "";
+  expectedServerSignature;
+  pendingServerFinal;
+  verifiedFlag = false;
+  /** True once the server's ServerSignature has been verified. */
+  get verified() {
+    return this.verifiedFlag;
+  }
+  /** True once the client-final-message was sent (a `v=` is now due). */
+  get awaitingServerFinal() {
+    return this.stage === "final";
+  }
+  async response(cred) {
+    switch (this.stage) {
+      case "initial":
+        return this.clientFirstMessage(cred);
+      case "challenge":
+        return this.clientFinalMessage(cred);
+      case "final":
+        await this.final(this.pendingServerFinal);
+        return "";
+      default:
+        throw new ScramAuthError("out-of-order", this.name);
+    }
+  }
+  challenge(chal) {
+    if (this.stage === "challenge") {
+      this.serverFirst = utf8Decode(chal);
+      return;
+    }
+    if (this.stage === "final") {
+      this.pendingServerFinal = chal;
+      return;
+    }
+    throw new ScramAuthError("out-of-order", this.name);
+  }
+  /**
+   * server-final-message (binary string, as decoded from base64) from
+   * <success/> (SASL1), <additional-data/> (SASL2) or a last <challenge/>.
+   */
+  async final(data) {
+    if (this.verifiedFlag) return;
+    if (this.stage !== "final" || !this.expectedServerSignature) {
+      throw new ScramAuthError("out-of-order", this.name);
+    }
+    this.stage = "done";
+    const expected = this.expectedServerSignature;
+    this.expectedServerSignature = void 0;
+    verifyServerFinal(data === void 0 ? void 0 : utf8Decode(data), expected, this.name);
+    this.verifiedFlag = true;
+  }
+  clientFirstMessage(cred) {
+    this.clientNonce = this.genNonce();
+    this.clientFirstBare = `n=${saslname(cred.username ?? "")},r=${this.clientNonce}`;
+    this.stage = "challenge";
+    return utf8Binary(`n,,${this.clientFirstBare}`);
+  }
+  async clientFinalMessage(cred) {
+    const attrs = parseAttributes(this.serverFirst);
+    const nonce = attrs?.get("r");
+    const saltText = attrs?.get("s");
+    const iterText = attrs?.get("i");
+    if (attrs?.has("e")) throw new ScramAuthError("server-error", this.name);
+    if (!attrs || attrs.has("m") || !nonce || !saltText || !iterText) {
+      throw new ScramAuthError("malformed-server-message", this.name);
+    }
+    if (!nonce.startsWith(this.clientNonce) || nonce.length <= this.clientNonce.length) {
+      throw new ScramAuthError("nonce-mismatch", this.name);
+    }
+    const salt = base64Decode(saltText);
+    if (!salt || salt.length === 0 || !/^[1-9][0-9]{0,9}$/.test(iterText)) {
+      throw new ScramAuthError("malformed-server-message", this.name);
+    }
+    const iterations = Number(iterText);
+    if (iterations < SCRAM_MIN_ITERATIONS) {
+      throw new ScramAuthError("weak-iteration-count", this.name);
+    }
+    if (iterations > SCRAM_MAX_ITERATIONS) {
+      throw new ScramAuthError("excessive-iteration-count", this.name);
+    }
+    const withoutProof = `c=biws,r=${nonce}`;
+    const authMessage = `${this.clientFirstBare},${this.serverFirst},${withoutProof}`;
+    const { clientProof, serverSignature } = await scramProofs(
+      this.hash,
+      cred.password ?? "",
+      salt,
+      iterations,
+      authMessage
+    );
+    this.expectedServerSignature = serverSignature;
+    this.stage = "final";
+    return utf8Binary(`${withoutProof},p=${base64Encode(clientProof)}`);
+  }
+};
+function utf8Binary(text) {
+  return bytesToBinary(utf8(text));
+}
+function utf8Decode(binary) {
+  return new TextDecoder().decode(binaryToBytes(binary));
+}
+function defaultNonce() {
+  const bytes = new Uint8Array(24);
+  globalThis.crypto.getRandomValues(bytes);
+  return base64Encode(bytes);
+}
+var SCRAM_HASHES = ["SHA-256", "SHA-1"];
+var SCRAM_NAMES = SCRAM_HASHES.map(
+  (h) => h === "SHA-1" ? "SCRAM-SHA-1" : "SCRAM-SHA-256"
+);
+var NS_STREAM = "http://etherx.jabber.org/streams";
+function saslFeaturesRefusal(features) {
+  if (features.getChild("authentication", SASL2_NS)) return "sasl2-refused";
+  const sasl1 = features.getChild("mechanisms", SASL1_NS);
+  if (!sasl1) return void 0;
+  const offered = sasl1.getChildren("mechanism").map((m) => m.text().trim());
+  return SCRAM_NAMES.some((name) => offered.includes(name)) ? void 0 : "no-scram-mechanism";
+}
+var states = /* @__PURE__ */ new WeakMap();
+function scramClient(options) {
+  const { username, password, ...rest } = options;
+  let current;
+  let rejectFailure = () => {
+  };
+  const state = {
+    failure: new Promise((_, reject) => {
+      rejectFailure = reject;
+    })
+  };
+  state.failure.catch(() => {
+  });
+  const userAgent = xml("user-agent", { id: globalThis.crypto.randomUUID() });
+  const cut = (entity, err) => {
+    state.cutting ??= (async () => {
+      entity.reconnect?.stop();
+      await entity.stop().catch(() => {
+      });
+      rejectFailure(err);
+    })();
+    return state.cutting;
+  };
+  let refused;
+  const xmpp = client({
+    ...rest,
+    credentials: async (authenticate, mechanisms, _fast, entity) => {
+      const failClosed = async (err) => {
+        await cut(entity, err);
+        throw err;
+      };
+      if (refused) return failClosed(refused);
+      const mechanism = SCRAM_NAMES.find((name) => mechanisms.includes(name));
+      if (!mechanism) return failClosed(new ScramAuthError("no-scram-mechanism"));
+      let successData;
+      const onNonza = (el) => {
+        if (el.is("success", SASL1_NS)) successData = decodeSuccess(el.text());
+      };
+      entity.on("nonza", onNonza);
+      current = void 0;
+      try {
+        await authenticate({ username, password }, mechanism, userAgent);
+        const mech = current;
+        if (!mech) throw new ScramAuthError("out-of-order", mechanism);
+        if (!mech.verified) await mech.final(successData);
+      } catch (err) {
+        if (err instanceof ScramAuthError) return failClosed(err);
+        throw err;
+      } finally {
+        entity.removeListener("nonza", onNonza);
+        current = void 0;
+      }
+    }
+  });
+  const factory = xmpp.saslFactory;
+  const bound = SCRAM_HASHES.map((hash) => ({
+    name: hash === "SHA-1" ? "SCRAM-SHA-1" : "SCRAM-SHA-256",
+    mech: class extends ScramMechanism {
+      constructor() {
+        super(hash);
+        current = this;
+      }
+    }
+  }));
+  factory._mechs.splice(0, factory._mechs.length, ...bound);
+  xmpp.on("nonza", (el) => {
+    if (!el.is("features", NS_STREAM)) return;
+    const reason = saslFeaturesRefusal(el);
+    if (!reason) return;
+    refused = new ScramAuthError(reason);
+    void cut(xmpp, refused);
+  });
+  guardStart(xmpp);
+  states.set(xmpp, state);
+  return xmpp;
+}
+function decodeSuccess(text) {
+  const trimmed = text.trim();
+  if (trimmed === "" || trimmed === "=") return void 0;
+  try {
+    return globalThis.atob(trimmed);
+  } catch {
+    return void 0;
+  }
+}
+async function startScramClient(xmpp) {
+  const state = states.get(xmpp);
+  if (!state) return xmpp.start();
+  try {
+    return await Promise.race([xmpp.start(), state.failure]);
+  } catch (err) {
+    if (state.cutting) {
+      await state.cutting;
+      return state.failure;
+    }
+    throw err;
+  }
+}
+
+// packages/xmpp/src/muc.ts
+import xml2 from "@xmpp/xml";
+
+// packages/xmpp/src/jid.ts
+var COMPONENT_JID = `policy.${XMPP_DOMAIN}`;
+function occupantJid(room, nick) {
+  if (nick.length === 0) {
+    throw new Error("occupant nick must not be empty");
+  }
+  return `${room}/${nick}`;
+}
+
+// packages/xmpp/src/timeouts.ts
+var BASE_TIMEOUT_MS = 1e4;
+var scale = 1;
+function scaledTimeoutMs(ms) {
+  return Math.round(ms * scale);
+}
+function defaultTimeoutMs() {
+  return scaledTimeoutMs(BASE_TIMEOUT_MS);
+}
+
+// packages/xmpp/src/stanza.ts
+var StanzaWaitError = class extends Error {
+  constructor(reason, message, stanza) {
+    super(message);
+    this.reason = reason;
+    this.stanza = stanza;
+    this.name = "StanzaWaitError";
+  }
+  reason;
+  stanza;
+};
+function waitForElement(entity, event, predicate, timeoutMs = defaultTimeoutMs()) {
+  return new Promise((resolve, reject) => {
+    const seen = [];
+    const timer = setTimeout(() => {
+      cleanup();
+      const trail = seen.length ? `; last seen: ${seen.join(", ")}` : "; nothing arrived";
+      const status = entity.status;
+      const state = typeof status === "string" ? `; entity status: ${status}` : "";
+      reject(
+        new StanzaWaitError(
+          "timeout",
+          `no matching ${event} within ${timeoutMs}ms${trail}${state}`
+        )
+      );
+    }, timeoutMs);
+    const onElement = (el) => {
+      seen.push(describeElement(el));
+      if (seen.length > 8) seen.shift();
+      try {
+        if (predicate(el)) {
+          cleanup();
+          resolve(el);
+        }
+      } catch (err) {
+        cleanup();
+        reject(err);
+      }
+    };
+    const cleanup = () => {
+      clearTimeout(timer);
+      entity.off(event, onElement);
+    };
+    entity.on(event, onElement);
+  });
+}
+function waitForStanza(entity, predicate, timeoutMs = defaultTimeoutMs()) {
+  return waitForElement(entity, "stanza", predicate, timeoutMs);
+}
+function describeElement(el) {
+  const type = el.getAttr("type");
+  const from = el.getAttr("from");
+  const error = type === "error" ? ` error=${stanzaErrorCondition(el)}` : "";
+  return `<${el.name}${type ? ` type=${type}` : ""}${from ? ` from=${from}` : ""}${error}>`;
+}
+function stanzaErrorCondition(stanza) {
+  const error = stanza.getChild("error");
+  const condition = error?.children.find((c) => typeof c !== "string");
+  return condition?.getName() ?? "unknown";
+}
+
+// packages/xmpp/src/muc.ts
+var NS_MUC = "http://jabber.org/protocol/muc";
+var NS_MUC_USER = `${NS_MUC}#user`;
+var NS_MUC_ADMIN = `${NS_MUC}#admin`;
+var NS_MUC_OWNER = `${NS_MUC}#owner`;
+var NS_DATA_FORMS = "jabber:x:data";
+var MucError = class extends Error {
+  constructor(message, condition = "unknown", stanza) {
+    super(message);
+    this.condition = condition;
+    this.stanza = stanza;
+    this.name = "MucError";
+  }
+  condition;
+  stanza;
+};
+var MucJoinError = class extends MucError {
+  constructor(condition, stanza, room, nick) {
+    super(`join denied for ${occupantJid(room, nick)}: ${condition}`, condition, stanza);
+    this.room = room;
+    this.nick = nick;
+    this.name = "MucJoinError";
+  }
+  room;
+  nick;
+};
+function joinPresenceEl(room, nick) {
+  return xml2("presence", { to: occupantJid(room, nick) }, xml2("x", { xmlns: NS_MUC }));
+}
+async function joinRoom(entity, room, nick, timeoutMs = defaultTimeoutMs()) {
+  const self = occupantJid(room, nick);
+  const wait = waitForStanza(
+    entity,
+    (s) => s.is("presence") && s.getAttr("from") === self,
+    timeoutMs
+  );
+  try {
+    await entity.send(joinPresenceEl(room, nick));
+  } catch (err) {
+    void wait.catch(() => {
+    });
+    throw err;
+  }
+  const presence = await wait;
+  if (presence.getAttr("type") === "error") {
+    throw new MucJoinError(stanzaErrorCondition(presence), presence, room, nick);
+  }
+  return presence;
+}
+
+// packages/xmpp/src/origin.ts
+import { jid } from "@xmpp/jid";
+var NS_MUC_USER2 = "http://jabber.org/protocol/muc#user";
+var NS_FORWARD = "urn:xmpp:forward:0";
+var NS_WACANDO_POLICY = "urn:wacando:policy:0";
+var origins = /* @__PURE__ */ new WeakMap();
+function authenticatedMessageOrigin(stanza) {
+  return origins.get(stanza);
+}
+function itemJid(stanza) {
+  const xs = stanza.getChildren("x", NS_MUC_USER2);
+  if (xs.length !== 1) return;
+  const items = xs[0]?.getChildren("item");
+  if (items?.length !== 1) return;
+  const value = items[0]?.getAttr("jid");
+  return typeof value === "string" ? value : void 0;
+}
+function userBareJid(value) {
+  if (value === void 0) return;
+  try {
+    const parsed = jid(value);
+    return parsed.getLocal() ? parsed.bare().toString() : void 0;
+  } catch {
+    return;
+  }
+}
+function isTrustedRelay(value, trustedRelayJid) {
+  if (value === void 0 || trustedRelayJid === void 0) return false;
+  try {
+    const parsed = jid(value);
+    return !parsed.getLocal() && parsed.getDomain() === trustedRelayJid;
+  } catch {
+    return false;
+  }
+}
+function relaySender(stanza) {
+  const relays = stanza.getChildren("relay", NS_WACANDO_POLICY);
+  if (relays.length !== 1) return;
+  return userBareJid(relays[0]?.getAttr("jid"));
+}
+function recordMamOrigin(stanza, room, trustedRelayJid) {
+  if (!stanza.is("message") || stanza.getAttr("type") !== "groupchat" || !stanza.getAttr("from")?.startsWith(`${room}/`))
+    return;
+  const item = itemJid(stanza);
+  const senderBareJid = isTrustedRelay(item, trustedRelayJid) ? relaySender(stanza) : userBareJid(item);
+  if (senderBareJid) origins.set(stanza, { roomJid: room, senderBareJid });
+}
+function unwrapPolicyDelivery(stanza, policyJid) {
+  if (!stanza.is("message") || stanza.getAttr("type") === "error") return;
+  const from = stanza.getAttr("from");
+  if (typeof from !== "string" || !isTrustedRelay(from, policyJid)) return;
+  const deliveries = stanza.getChildren("delivery", NS_WACANDO_POLICY);
+  if (deliveries.length !== 1) return;
+  const delivery = deliveries[0];
+  const room = delivery?.getAttr("room");
+  const senderBareJid = userBareJid(delivery?.getAttr("sender"));
+  const inner = delivery?.getChild("forwarded", NS_FORWARD)?.getChild("message");
+  if (typeof room !== "string" || !senderBareJid || !inner) return;
+  if (inner.getAttr("type") !== "groupchat" || !inner.getAttr("from")?.startsWith(`${room}/`))
+    return;
+  origins.set(inner, { roomJid: room, senderBareJid });
+  return inner;
+}
+var MucOriginTracker = class {
+  /**
+   * `trustedRelayJid`: the policy component domain. When set, groupchat from
+   * an occupant whose real JID is exactly that domain is attributed to its
+   * `<relay jid>` (#39). Without it, relays carry no origin (fail closed).
+   */
+  constructor(entity, options = {}) {
+    this.entity = entity;
+    this.options = options;
+    entity.on("stanza", this.onStanza);
+    entity.on("offline", this.reset);
+    entity.on("disconnect", this.reset);
+  }
+  entity;
+  options;
+  rooms = /* @__PURE__ */ new Set();
+  occupants = /* @__PURE__ */ new Map();
+  /** Occupant full JIDs whose authenticated real JID is the policy component. */
+  relays = /* @__PURE__ */ new Set();
+  trackRoom(room) {
+    this.rooms.add(room);
+  }
+  reset = () => {
+    this.occupants.clear();
+    this.relays.clear();
+  };
+  onStanza = (stanza) => {
+    const from = stanza.getAttr("from");
+    if (typeof from !== "string") return;
+    const slash = from.indexOf("/");
+    if (slash < 1 || !this.rooms.has(from.slice(0, slash))) return;
+    if (stanza.is("presence")) {
+      const type = stanza.getAttr("type");
+      if (type === "unavailable" || type === "error") {
+        this.occupants.delete(from);
+        this.relays.delete(from);
+        if (stanza.getChild("x", NS_MUC_USER2)?.getChildren("status").some((s) => s.getAttr("code") === "110")) {
+          const prefix = `${from.slice(0, slash)}/`;
+          for (const occupant of this.occupants.keys()) {
+            if (occupant.startsWith(prefix)) this.occupants.delete(occupant);
+          }
+          for (const relay of [...this.relays]) {
+            if (relay.startsWith(prefix)) this.relays.delete(relay);
+          }
+        }
+      } else if (!type) {
+        const item = itemJid(stanza);
+        const sender = userBareJid(item);
+        if (sender) this.occupants.set(from, sender);
+        else this.occupants.delete(from);
+        if (isTrustedRelay(item, this.options.trustedRelayJid)) this.relays.add(from);
+        else this.relays.delete(from);
+      }
+    } else if (stanza.is("message") && stanza.getAttr("type") === "groupchat" && !stanza.getChild("delay", "urn:xmpp:delay")) {
+      const senderBareJid = this.relays.has(from) ? relaySender(stanza) : this.occupants.get(from);
+      if (senderBareJid) origins.set(stanza, { roomJid: from.slice(0, slash), senderBareJid });
+    }
+  };
+  close() {
+    this.entity.off("stanza", this.onStanza);
+    this.entity.off("offline", this.reset);
+    this.entity.off("disconnect", this.reset);
+    this.reset();
+  }
+};
+
+// packages/xmpp/src/mam.ts
+import xml3 from "@xmpp/xml";
+var NS_MAM = "urn:xmpp:mam:2";
+var NS_FORWARD2 = "urn:xmpp:forward:0";
+var NS_RSM = "http://jabber.org/protocol/rsm";
+var queryCounter = 0;
+function filterField(varName, value) {
+  return xml3("field", { var: varName }, xml3("value", {}, value));
+}
+function mamQueryEl(options) {
+  const fields = [xml3("field", { var: "FORM_TYPE", type: "hidden" }, xml3("value", {}, NS_MAM))];
+  if (options.withJid !== void 0) fields.push(filterField("with", options.withJid));
+  if (options.start !== void 0) fields.push(filterField("start", options.start));
+  if (options.end !== void 0) fields.push(filterField("end", options.end));
+  const children = [xml3("x", { xmlns: NS_DATA_FORMS, type: "submit" }, ...fields)];
+  if (options.max !== void 0) {
+    children.push(xml3("set", { xmlns: NS_RSM }, xml3("max", {}, String(options.max))));
+  }
+  return xml3("query", { xmlns: NS_MAM, queryid: options.queryId }, ...children);
+}
+async function queryMam(entity, options, timeoutMs = defaultTimeoutMs()) {
+  const queryId = options.queryId ?? `mam${++queryCounter}`;
+  const forwarded = [];
+  const onStanza = (stanza) => {
+    if (!stanza.is("message") || stanza.getAttr("from") !== options.to) return;
+    const result = stanza.getChild("result", NS_MAM);
+    if (!result || result.getAttr("queryid") !== queryId) return;
+    const fwd = result.getChild("forwarded", NS_FORWARD2);
+    if (fwd) {
+      const inner = forwardedStanza(fwd);
+      if (inner) recordMamOrigin(inner, options.to, options.trustedRelayJid);
+      forwarded.push(fwd);
+    }
+  };
+  entity.on("stanza", onStanza);
+  try {
+    const response = await entity.iqCaller.set(
+      mamQueryEl({ ...options, queryId }),
+      options.to,
+      timeoutMs
+    );
+    const fin = response?.getChild("fin", NS_MAM);
+    const rsmLast = fin?.getChild("set", NS_RSM)?.getChildText("last");
+    return {
+      queryId,
+      complete: fin?.getAttr("complete") === "true",
+      lastId: typeof rsmLast === "string" ? rsmLast : void 0,
+      messages: forwarded
+    };
+  } finally {
+    entity.off("stanza", onStanza);
+  }
+}
+function forwardedStanza(forwarded) {
+  return forwarded.children.find(
+    (c) => typeof c !== "string" && c.getName() !== "delay"
+  );
+}
+
+// packages/xmpp/src/roster.ts
+import { jid as parseJid } from "@xmpp/jid";
+import xml4 from "@xmpp/xml";
+function subscriptionRefusal(stanza) {
+  if (!stanza.is("presence") || stanza.getAttr("type") !== "subscribe") return null;
+  const from = stanza.getAttr("from");
+  if (typeof from !== "string" || from === "") return null;
+  let bare;
+  try {
+    bare = parseJid(from).bare().toString();
+  } catch {
+    return null;
+  }
+  return xml4("presence", { to: bare, type: "unsubscribed" });
+}
+function refuseSubscriptionRequests(entity) {
+  const onStanza = (stanza) => {
+    const refusal = subscriptionRefusal(stanza);
+    if (refusal) void entity.send(refusal).catch(() => {
+    });
+  };
+  entity.on("stanza", onStanza);
+  return () => entity.off("stanza", onStanza);
+}
+
+// packages/xmpp/src/presence.ts
+var UNKNOWN_PRESENCE = Object.freeze({
+  connection: "unknown",
+  availability: null
+});
+
+// packages/xmpp/src/pubsub.ts
+import xml5 from "@xmpp/xml";
+var NS_PUBSUB = "http://jabber.org/protocol/pubsub";
+var NS_PUBSUB_PUBLISH_OPTIONS = "http://jabber.org/protocol/pubsub#publish-options";
+function pepPublishEl(node, itemId, payload, accessModel = "open") {
+  return xml5(
+    "pubsub",
+    { xmlns: NS_PUBSUB },
+    xml5("publish", { node }, xml5("item", { id: itemId }, payload)),
+    xml5(
+      "publish-options",
+      {},
+      xml5(
+        "x",
+        { xmlns: NS_DATA_FORMS, type: "submit" },
+        xml5(
+          "field",
+          { var: "FORM_TYPE", type: "hidden" },
+          xml5("value", {}, NS_PUBSUB_PUBLISH_OPTIONS)
+        ),
+        xml5("field", { var: "pubsub#access_model" }, xml5("value", {}, accessModel))
+      )
+    )
+  );
+}
+function pubsubItemsEl(node, maxItems) {
+  const attrs = { node };
+  if (maxItems !== void 0) attrs.max_items = String(maxItems);
+  return xml5("pubsub", { xmlns: NS_PUBSUB }, xml5("items", attrs));
+}
+async function pepPublish(entity, to, node, itemId, payload, timeoutMs = defaultTimeoutMs()) {
+  await entity.iqCaller.set(pepPublishEl(node, itemId, payload), to, timeoutMs);
+}
+async function pepFetchItems(entity, to, node, timeoutMs = defaultTimeoutMs()) {
+  try {
+    const result = await entity.iqCaller.get(pubsubItemsEl(node), to, timeoutMs);
+    const pubsub = result?.getName() === "pubsub" ? result : result?.getChild("pubsub", NS_PUBSUB);
+    const items = pubsub?.getChild("items");
+    if (!items) return [];
+    return items.getChildren("item").map((item) => item.children.find((c) => typeof c !== "string")).filter((el) => el !== void 0);
+  } catch (err) {
+    if (isItemNotFound(err)) return [];
+    throw err;
+  }
+}
+function isItemNotFound(err) {
+  const cond = err?.condition;
+  if (cond === "item-not-found") return true;
+  const stanza = err?.stanza;
+  return stanza?.getChild("error")?.getChild("item-not-found") !== void 0;
+}
+
+export {
+  ScramAuthError,
+  scramClient,
+  startScramClient,
+  defaultTimeoutMs,
+  waitForStanza,
+  MucJoinError,
+  joinRoom,
+  authenticatedMessageOrigin,
+  unwrapPolicyDelivery,
+  MucOriginTracker,
+  queryMam,
+  forwardedStanza,
+  pepPublish,
+  pepFetchItems,
+  refuseSubscriptionRequests
+};