serverless-ircd 0.10.0 → 0.11.0

package/packages/in-memory-runtime/tests/in-memory-runtime.test.ts

@@ -893,3 +893,77 @@ describe('InMemoryRuntime — broadcastWallops', () => {
     expect(c1Received).toBe(0);
   });
 });
+
+describe('InMemoryRuntime — broadcastOperNotice', () => {
+  it('delivers lines to every connection with the +o user mode set', async () => {
+    const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
+    const received: Record<string, RawLine[][]> = { c1: [], c2: [], c3: [] };
+    const push = (id: string) => (lines: RawLine[]) => received[id]?.push(lines);
+    // c1 has +w but NOT +o; c2 and c3 are opers.
+    const c1 = makeConn('c1', 'alice');
+    c1.userModes.wallops = true;
+    rt.registerConnection(c1, { send: push('c1'), disconnect: () => {} });
+    const c2 = makeConn('c2', 'bob');
+    c2.userModes.oper = true;
+    rt.registerConnection(c2, { send: push('c2'), disconnect: () => {} });
+    const c3 = makeConn('c3', 'carol');
+    c3.userModes.oper = true;
+    rt.registerConnection(c3, { send: push('c3'), disconnect: () => {} });
+
+    await rt.broadcastOperNotice([L(':srv NOTICE * :OPER lockout triggered for 10.0.0.1')]);
+
+    // +w without +o is NOT enough — the oper notice is oper-only.
+    expect(received.c1).toHaveLength(0);
+    expect(received.c2).toHaveLength(1);
+    expect(received.c3).toHaveLength(1);
+  });
+
+  it('skips the except connection even when it is an oper', async () => {
+    const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
+    const received: Record<string, RawLine[][]> = { c1: [], c2: [] };
+    const push = (id: string) => (lines: RawLine[]) => received[id]?.push(lines);
+    const oper = makeConn('c1', 'alice');
+    oper.userModes.oper = true;
+    rt.registerConnection(oper, { send: push('c1'), disconnect: () => {} });
+    const peer = makeConn('c2', 'bob');
+    peer.userModes.oper = true;
+    rt.registerConnection(peer, { send: push('c2'), disconnect: () => {} });
+
+    await rt.broadcastOperNotice([L(':srv NOTICE * :hi')], 'c1');
+
+    expect(received.c1).toHaveLength(0);
+    expect(received.c2).toHaveLength(1);
+  });
+
+  it('is a no-op when no connection has +o', async () => {
+    const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
+    let c1Received = 0;
+    rt.registerConnection(makeConn('c1', 'alice'), {
+      send: () => {
+        c1Received++;
+      },
+      disconnect: () => {},
+    });
+
+    await rt.broadcastOperNotice([L(':srv NOTICE * :hi')]);
+    expect(c1Received).toBe(0);
+  });
+});
+
+describe('InMemoryRuntime — operFailures tracker', () => {
+  it('exposes one shared OperFailureStats instance bound to the runtime clock', async () => {
+    const clock = new FakeClock(1_000);
+    const rt = new InMemoryRuntime({ clock });
+
+    const tracker = rt.operFailures;
+    expect(tracker).toBeDefined();
+    // Same instance every read: adapters hand it to every connection's
+    // actor so the per-IP budget is shared fleet-wide.
+    expect(rt.operFailures).toBe(tracker);
+
+    tracker.recordFailure('10.0.0.1');
+    clock.advance(1_000);
+    tracker.recordFailure('10.0.0.1');
+    expect(tracker.recentFailures('10.0.0.1', 300_000)).toBe(2);
+  });
+});

package/packages/irc-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/irc-core",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "private": true,
   "description": "Platform-agnostic IRC protocol core: parser, serializer, command reducers, state shapes",
   "license": "BSD-3-Clause",

package/packages/irc-core/src/caps/capabilities.ts

@@ -16,7 +16,8 @@ export interface Capability {
   /**
    * Optional value parameter. For `sasl` this is the base mechanism list
    * (`PLAIN`); the {@link saslCapValue} helper upgrades it to include
-   * `EXTERNAL` when mTLS is configured for a connection.
+   * `EXTERNAL` when the mechanism is available for the connection (mTLS
+   * source + operator opt-in + secure transport).
    */
   value?: string;
 }
@@ -40,6 +41,14 @@ export const PRE_AWAY_CAP_NAME = 'draft/pre-away';
  */
 export const DEFAULT_MULTILINE_MAX_BYTES = 4096;
 
+/**
+ * Default per-batch entry ceiling enforced incrementally while a
+ * `draft/multiline` batch is open. Defense-in-depth against a client that
+ * streams many tiny lines (each under the byte budget) and never closes the
+ * batch; deployments override via `ServerConfig.multilineMaxEntries`.
+ */
+export const DEFAULT_MULTILINE_MAX_ENTRIES = 100;
+
 /**
  * Builds the `draft/multiline` cap *value* (the substring after `=`) for the
  * advertised byte budget. The {@link CapReducer} and the multi-line reducer
@@ -79,17 +88,18 @@ export const SUPPORTED_CAPABILITIES: ReadonlyArray<Capability> = Object.freeze([
 ]);
 
 /**
- * Returns the `sasl` cap value to advertise given whether an mTLS identity
- * provider is bound for the connection.
+ * Returns the `sasl` cap value to advertise given whether the SASL
+ * EXTERNAL mechanism is available for the connection.
  *
- * PLAIN is always available. EXTERNAL is advertised only when mTLS is
- * configured (an `MtlsIdentityProvider` is bound) so clients on
- * non-mTLS connections do not attempt a mechanism that cannot succeed.
- * Operators enable EXTERNAL by configuring mTLS at the edge (CF API Shield
- * mTLS, AWS custom-domain mTLS) — no code change required.
+ * PLAIN is always available. EXTERNAL is advertised only when the
+ * caller's three-way gate holds (mTLS identity source bound +
+ * `sasl.externalEnabled` operator opt-in + secure transport — see
+ * `commands/sasl.ts`), so clients on connections where the mechanism
+ * cannot succeed do not attempt an exchange the server would refuse
+ * with `908 ERR_SASLMECHS`.
  */
-export function saslCapValue(hasMtls: boolean): string {
-  return hasMtls ? 'PLAIN,EXTERNAL' : 'PLAIN';
+export function saslCapValue(externalAvailable: boolean): string {
+  return externalAvailable ? 'PLAIN,EXTERNAL' : 'PLAIN';
 }
 
 /** Set form for fast membership checks during `CAP REQ`. */

package/packages/irc-core/src/certfp.ts

@@ -0,0 +1,178 @@
+/**
+ * CertFP — canonical client-certificate identity for SASL EXTERNAL.
+ *
+ * The edge platforms terminate TLS and surface the verified client
+ * certificate to the adapter, but neither Cloudflare Workers nor AWS API
+ * Gateway hands over the certificate DER itself:
+ *
+ * - Cloudflare surfaces the SHA-256 fingerprint of the DER on
+ *   `request.cf.tlsClientAuth.certFingerprintSHA256` (lowercase hex) — the
+ *   strongest identifier available and the preferred account binding.
+ * - AWS API Gateway surfaces only `requestContext.identity.clientCertSubjectDN`
+ *   (no fingerprint, no DER) — the subject DN is the only identifier.
+ *
+ * To make subject-DN bindings robust across those platforms (and across
+ * cert re-issuances that reorder or re-space the same DN), the DN is
+ * canonicalised before comparison:
+ *
+ * 1. Attribute **types** are lowercased (`CN=` → `cn=`); attribute
+ *    **values** keep their case (values are compared case-sensitively).
+ * 2. Whitespace around types/values is trimmed and runs of whitespace
+ *    inside a value collapse to a single space (escaped whitespace, e.g.
+ *    a trailing `\ `, is preserved verbatim).
+ * 3. RDNs (`a,b`) and the AVAs of a multi-valued RDN (`a+b`) are sorted,
+ *    so two semantically-equal DNs written in different orders collapse
+ *    to one canonical spelling.
+ * 4. RFC 4514 escapes (`\,`, `\+`, `\=` …) are kept intact — the
+ *    canonicaliser never splits on an escaped separator.
+ *
+ * Accounts bind to either a DER fingerprint (`fp:<hex>` entries in
+ * `RegisteredNick.certSubjects`, preferred) or a canonical DN. Legacy
+ * verbatim subject bindings still verify — `ServicesStore.verifyCertFP`
+ * canonicalises stored entries at compare time and rewrites them to the
+ * canonical spelling on first use.
+ */
+
+/**
+ * Marker prefix for fingerprint bindings stored in
+ * `RegisteredNick.certSubjects` (vs canonical-DN bindings).
+ */
+export const CERT_FP_PREFIX = 'fp:';
+
+/**
+ * The verified client-certificate identity of one connection, as resolved
+ * by an {@link MtlsIdentityProvider}.
+ *
+ * - `subject` — the raw platform-surfaced subject string, verbatim.
+ * - `canonicalDn` — {@link canonicalizeCertSubject} of `subject`.
+ * - `fingerprint` — the SHA-256 fingerprint of the certificate DER
+ *   (lowercase hex) when the platform surfaces one; absent otherwise
+ *   (API Gateway surfaces no fingerprint today).
+ */
+export interface CertIdentity {
+  readonly subject: string;
+  readonly canonicalDn: string;
+  readonly fingerprint?: string;
+}
+
+/**
+ * Splits `s` on unescaped `sep` characters, keeping RFC 4514 `\x` escape
+ * pairs intact within each part.
+ */
+function splitUnescaped(s: string, sep: string): string[] {
+  const parts: string[] = [];
+  let current = '';
+  for (let i = 0; i < s.length; i += 1) {
+    const ch = s.charAt(i);
+    const next = s.charAt(i + 1);
+    if (ch === '\\' && next !== '') {
+      current += ch + next;
+      i += 1;
+    } else if (ch === sep) {
+      parts.push(current);
+      current = '';
+    } else {
+      current += ch;
+    }
+  }
+  parts.push(current);
+  return parts;
+}
+
+/**
+ * Index of the first unescaped occurrence of `ch`, or `-1`. Used to split
+ * an AVA into type and value without splitting on `\=`.
+ */
+function indexUnescaped(s: string, ch: string): number {
+  for (let i = 0; i < s.length; i += 1) {
+    if (s.charAt(i) === '\\') {
+      i += 1;
+      continue;
+    }
+    if (s.charAt(i) === ch) return i;
+  }
+  return -1;
+}
+
+/**
+ * Collapses runs of unescaped whitespace to single spaces and trims
+ * leading/trailing unescaped whitespace. Escape pairs (`\x`) pass through
+ * verbatim and terminate any pending whitespace run.
+ */
+function collapseWhitespace(s: string): string {
+  let out = '';
+  let pendingSpace = false;
+  let started = false;
+  for (let i = 0; i < s.length; i += 1) {
+    const ch = s.charAt(i);
+    const next = s.charAt(i + 1);
+    if (ch === '\\' && next !== '') {
+      if (pendingSpace) {
+        out += ' ';
+        pendingSpace = false;
+      }
+      out += ch + next;
+      i += 1;
+      started = true;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      if (started) pendingSpace = true;
+      continue;
+    }
+    if (pendingSpace) {
+      out += ' ';
+      pendingSpace = false;
+    }
+    out += ch;
+    started = true;
+  }
+  return out;
+}
+
+/** Canonicalises one attribute-value assertion (`type=value`). */
+function canonicalAva(ava: string): string {
+  const eq = indexUnescaped(ava, '=');
+  if (eq === -1) return collapseWhitespace(ava);
+  const type = collapseWhitespace(ava.slice(0, eq)).toLowerCase();
+  const value = collapseWhitespace(ava.slice(eq + 1));
+  return `${type}=${value}`;
+}
+
+/**
+ * Canonicalises an RFC 4514-style DN for byte-stable comparison:
+ * lowercase attribute types (values keep their case), collapsed/trimmed
+ * whitespace, sorted RDNs, and sorted AVAs inside multi-valued RDNs.
+ * Escape sequences pass through unchanged.
+ */
+export function canonicalizeCertSubject(dn: string): string {
+  return splitUnescaped(dn, ',')
+    .map((rdn) =>
+      splitUnescaped(rdn, '+')
+        .map((ava) => canonicalAva(ava))
+        .sort()
+        .join('+'),
+    )
+    .sort()
+    .join(',');
+}
+
+/**
+ * Normalises a DER SHA-256 fingerprint into the stored binding form:
+ * `fp:` + trimmed, lowercased, colon-free hex.
+ */
+export function certFingerprintId(fingerprint: string): string {
+  return `${CERT_FP_PREFIX}${fingerprint.trim().toLowerCase().replace(/:/g, '')}`;
+}
+
+/**
+ * Builds the {@link CertIdentity} for a platform-surfaced subject (and the
+ * platform fingerprint, when one was provided). Pure; adapters call this
+ * at admission time.
+ */
+export function certIdentityFromSubject(subject: string, fingerprint?: string): CertIdentity {
+  const canonicalDn = canonicalizeCertSubject(subject);
+  return fingerprint === undefined
+    ? { subject, canonicalDn }
+    : { subject, canonicalDn, fingerprint };
+}

package/packages/irc-core/src/commands/cap.ts

@@ -94,11 +94,19 @@ function handleLs(state: ConnectionState, ctx: Ctx): ReducerResult<ConnectionSta
   state.capNegotiating = true;
 
   const target = state.nick ?? '*';
-  const hasMtls = ctx.mtlsIdentity !== undefined;
+  // Same gate as the AUTHENTICATE reducer (no transport-level override +
+  // mTLS source + operator opt-in + secure transport), so the `sasl` cap
+  // never advertises a mechanism the reducer would refuse — with 908, or
+  // with the transport-specific 904 under the override.
+  const external =
+    ctx.serverConfig.sasl?.externalUnsupportedMessage === undefined &&
+    ctx.mtlsIdentity !== undefined &&
+    (ctx.serverConfig.sasl?.externalEnabled ?? false) &&
+    ctx.connection.secure;
   const multilineMax = ctx.serverConfig.multilineMaxBytes ?? DEFAULT_MULTILINE_MAX_BYTES;
   const tokens = SUPPORTED_CAPABILITIES.map((cap) => {
     if (cap.name === SASL_CAP_NAME) {
-      return capToLsString({ ...cap, value: saslCapValue(hasMtls) });
+      return capToLsString({ ...cap, value: saslCapValue(external) });
     }
     if (cap.name === MULTILINE_CAP_NAME) {
       return capToLsString({ ...cap, value: multilineCapValue(multilineMax) });

package/packages/irc-core/src/commands/chanserv.ts

@@ -36,6 +36,14 @@
  *     threshold the JOIN hook compares against for the `AUTO*` ops.
  *     `SET <op> <level>` overrides; `LIST` enumerates; `RESET` clears
  *     every override so the {@link DEFAULT_CHANNEL_LEVELS} take effect.
+ *   - `OP|DEOP|VOICE|DEVOICE <#channel> <nick>` — grant or strip a channel
+ *     prefix via a ChanServ-sourced MODE broadcast (founder or
+ *     AUTOOP-threshold access entry). DEOP additionally enforces a
+ *     caller-vs-target rank guard: the target must not outrank the caller
+ *     (see {@link rankOf} / {@link FOUNDER_RANK}), so an access-list entry
+ *     cannot strip the founder — or any higher-ranked entry — mid-session.
+ *   - `KICK <#channel> <nick> [:<reason>]` — removes a member (founder
+ *     only) under the same target-rank guard.
  *
  * The reducer is a pure `Reducer<ConnectionState>`: all side effects are
  * emitted as {@link Effect}s. Channel-mode mutations are emitted as
@@ -47,6 +55,7 @@ import { caseFold } from '../case-fold.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
 import type { ChannelLevelOp, ServicesStore } from '../ports.js';
+import { isValidChannelName } from '../protocol/channel-name.js';
 import type { ChannelDelta, Roster } from '../state/channel.js';
 import type { ConnId, ConnectionState } from '../state/connection.js';
 import type { Ctx, Reducer } from '../types.js';
@@ -60,15 +69,6 @@ const SERVICES_HOST = 'services';
 /** Hostmask used as the source of ChanServ-emitted MODE prefix grants. */
 export const CHANSERV_HOSTMASK = `${CHANSERV_NICK}!${CHANSERV_NICK}@${SERVICES_HOST}`;
 
-/** Channel-name grammar; mirrors {@link isValidChannelName} in `join.ts`. */
-const CHANNEL_NAME_RE = /^[#&][^\s,:]+$/u;
-
-/** Returns true iff `name` looks like a channel target. */
-function isValidChannelName(name: string, maxLen: number): boolean {
-  if (name.length === 0 || name.length > maxLen) return false;
-  return CHANNEL_NAME_RE.test(name);
-}
-
 /** ON / OFF values accepted by SET RESTRICTED / SET KEEPTOPIC. */
 const ON_OFF = new Set<string>(['ON', 'OFF']);
 
@@ -111,6 +111,26 @@ export const SHORTHAND_LEVELS: Readonly<Record<'SOP' | 'AOP' | 'HOP' | 'VOP', nu
 /** Set of recognised shorthand verbs (uppercased). */
 const SHORTHAND_VERBS = new Set<string>(['SOP', 'AOP', 'HOP', 'VOP']);
 
+/**
+ * Rank of the channel founder in the DEOP/KICK caller-vs-target hierarchy.
+ * `Infinity` outranks every numeric access level, so no access-list entry
+ * can ever reach it — the only caller who can affect a founder-ranked
+ * target is the founder (an equal-rank, self-targeting action).
+ */
+export const FOUNDER_RANK = Number.POSITIVE_INFINITY;
+
+/**
+ * Maps a numeric ChanServ access level to the rank ordering used by the
+ * DEOP/KICK target guard: founder ({@link FOUNDER_RANK}) > SOP (10) > AOP
+ * (5) > HOP (4) > VOP (3) > no entry (0). The mapping is the identity for
+ * positive levels today; it exists as the single seam where a future
+ * privilege tier (e.g. a distinct SOP rank scale) can be introduced
+ * without touching the comparison call sites.
+ */
+export function rankOf(level: number): number {
+  return level > 0 ? level : 0;
+}
+
 /** Ordered list of level op names, for LEVELS LIST and validation. */
 const LEVEL_OPS: readonly ChannelLevelOp[] = ['AUTOOP', 'AUTOHALFOP', 'AUTOVOICE'];
 
@@ -794,16 +814,24 @@ interface PrefixCommandOpts {
  *       - `founderOnly: true`  → "Permission denied."
  *       - `founderOnly: false` → allowed when caller's access level meets the
  *         founder-configured `AUTOOP` threshold, otherwise "Permission denied."
+ *   - Target-rank guard (`guardTargetRankOf`): the nick named by the command
+ *     must not outrank the caller, otherwise "You do not have sufficient
+ *     privileges on <chan> to affect <nick>." Used by DEOP and KICK so an
+ *     access-list entry cannot strip the founder (or any higher-ranked
+ *     entry) mid-session. Equal ranks — self-targeting and peers — are
+ *     permitted; only a strictly higher-ranked target is protected.
  *
  * Privilege model: OP/DEOP/VOICE/DEVOICE accept the founder OR any
- * AUTOOP-level access entry; KICK/BAN/UNBAN are founder-only.
+ * AUTOOP-level access entry; KICK/BAN/UNBAN are founder-only. The
+ * target-rank guard applies only where the caller names a nick whose
+ * powers would be *removed* (DEOP/KICK), not where powers are granted.
  */
 function requirePrivilegedChanServ(
   state: ConnectionState,
   channel: string,
   ctx: Ctx,
   effects: EffectType[],
-  opts: { founderOnly: boolean },
+  opts: { founderOnly: boolean; guardTargetRankOf?: string },
 ): ServicesStore | null {
   const services = ctx.services as ServicesStore;
   if (state.account === undefined) {
@@ -815,18 +843,89 @@ function requirePrivilegedChanServ(
     effects.push(notice(state, `Channel ${channel} is not registered.`));
     return null;
   }
-  if (caseFold('rfc1459', founder) === caseFold('rfc1459', state.account)) {
-    return services;
+  const callerIsFounder = caseFold('rfc1459', founder) === caseFold('rfc1459', state.account);
+  if (callerIsFounder) {
+    return admitTargetRankGuard(state, services, FOUNDER_RANK, channel, founder, opts, effects);
   }
   if (!opts.founderOnly) {
     const level = services.getChannelAccess(channel, state.account);
     const autoOp = services.getChannelLevel(channel, 'AUTOOP') ?? DEFAULT_CHANNEL_LEVELS.AUTOOP;
-    if (level >= autoOp) return services;
+    if (level >= autoOp) {
+      return admitTargetRankGuard(state, services, rankOf(level), channel, founder, opts, effects);
+    }
   }
   effects.push(notice(state, 'Permission denied.'));
   return null;
 }
 
+/**
+ * Applies the DEOP/KICK target-rank guard at the tail of
+ * {@link requirePrivilegedChanServ}: the caller may affect the target nick
+ * only when the target's rank does not exceed theirs. Returns the store on
+ * success, `null` (with an insufficient-privileges NOTICE pushed) on
+ * failure.
+ *
+ * Rank rule: permitted iff `callerRank >= targetRank`. Equal ranks cover
+ * both self-targeting (the founder — or any access entry — releasing
+ * their own status) and peer-level actions (an AOP deopping a fellow
+ * AOP, who can simply re-op); any strictly higher-ranked target — the
+ * founder above every access entry, an SOP above an AOP — is protected.
+ */
+function admitTargetRankGuard(
+  state: ConnectionState,
+  services: ServicesStore,
+  callerRank: number,
+  channel: string,
+  founder: string,
+  opts: { founderOnly: boolean; guardTargetRankOf?: string },
+  effects: EffectType[],
+): ServicesStore | null {
+  if (
+    opts.guardTargetRankOf !== undefined &&
+    callerRank < targetRankOf(services, channel, founder, opts.guardTargetRankOf)
+  ) {
+    effects.push(
+      notice(
+        state,
+        `You do not have sufficient privileges on ${channel} to affect ${opts.guardTargetRankOf}.`,
+      ),
+    );
+    return null;
+  }
+  return services;
+}
+
+/**
+ * Resolves the rank of a target NICK for the DEOP/KICK guard.
+ *
+ * The ChanServ reducer operates on the caller's ConnectionState and cannot
+ * see the connection behind the target nick, so the target's account is
+ * resolved via the nick registry (`getNick`):
+ *   - a nick whose registered account matches the channel founder ranks as
+ *     the founder ({@link FOUNDER_RANK}) and is protected from every
+ *     non-founder caller;
+ *   - any other registered nick ranks at its access-list level;
+ *   - an unregistered (therefore unidentified) nick carries no account and
+ *     ranks at the minimum.
+ *
+ * Documented simplification: protection is keyed on the nick's registered
+ * account, not on whether the connection currently using the nick is
+ * identified — the reducer has no way to observe the latter, and erring
+ * toward protection cannot be abused to escalate privileges.
+ */
+function targetRankOf(
+  services: ServicesStore,
+  channel: string,
+  founder: string,
+  targetNick: string,
+): number {
+  const account = services.getNick(targetNick)?.account;
+  if (account !== undefined && caseFold('rfc1459', founder) === caseFold('rfc1459', account)) {
+    return FOUNDER_RANK;
+  }
+  return account === undefined ? rankOf(0) : rankOf(services.getChannelAccess(channel, account));
+}
+
 /**
  * Handles `OP|DEOP|VOICE|DEVOICE <#channel> <nick>`.
  *
@@ -862,6 +961,9 @@ function handlePrefixCommand(
 
   const services = requirePrivilegedChanServ(state, channel, ctx, effects, {
     founderOnly: false,
+    // Only DEOP removes powers, so only it carries the target-rank guard;
+    // OP/VOICE/DEVOICE never demote a higher-ranked user.
+    ...(opts.verb === 'DEOP' ? { guardTargetRankOf: targetNick } : {}),
   });
   if (services === null) return { state, effects };
 
@@ -915,6 +1017,7 @@ function handleKick(
 
   const services = requirePrivilegedChanServ(state, channel, ctx, effects, {
     founderOnly: true,
+    guardTargetRankOf: targetNick,
   });
   if (services === null) return { state, effects };
 

package/packages/irc-core/src/commands/chathistory.ts

@@ -20,6 +20,7 @@
  * actor layer); `undefined` means "no such channel" → `403`.
  */
 
+import { DEFAULT_MAX_CHATHISTORY_LIMIT } from '../config.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
 import type { StoredMessage } from '../ports.js';
@@ -154,7 +155,8 @@ function handleChannelSub(
   if (sub !== 'LATEST' && pivot === undefined && markerPivot === undefined) {
     return { effects: [Effect.send(ctx.connId, [needMoreParamsLine(ctx)])] };
   }
-  const limit = parseLimit(limitRaw);
+  const maxLimit = ctx.serverConfig.chathistory?.maxLimit ?? DEFAULT_MAX_CHATHISTORY_LIMIT;
+  const limit = parseLimit(limitRaw, maxLimit);
   if (limit === undefined) {
     return { effects: [Effect.send(ctx.connId, [invalidParamsLine(ctx)])] };
   }
@@ -295,12 +297,18 @@ function invalidParamsLine(ctx: Ctx): RawLine {
   return numericErr(ctx, Numerics.ERR_NEEDMOREPARAMS, 'Invalid parameters', 'CHATHISTORY');
 }
 
-/** Parses a non-negative integer limit; returns undefined on garbage. */
-function parseLimit(raw: string | undefined): number | undefined {
-  if (raw === undefined) return DEFAULT_QUERY_LIMIT;
+/**
+ * Parses a non-negative integer limit, silently capped at `maxLimit` (the
+ * deployment's chathistory ceiling); returns undefined on garbage. The cap
+ * keeps an oversized request (`CHATHISTORY LATEST #chan 999999999`) from
+ * asking the store to materialize a huge result set, regardless of the
+ * store's backing capacity.
+ */
+function parseLimit(raw: string | undefined, maxLimit: number): number | undefined {
+  if (raw === undefined) return Math.min(DEFAULT_QUERY_LIMIT, maxLimit);
   const n = Number(raw);
   if (!Number.isInteger(n) || n < 0) return undefined;
-  return n;
+  return Math.min(n, maxLimit);
 }
 
 /**