serverless-ircd 0.2.0 → 0.3.0

package/packages/irc-core/src/commands/motd.ts

@@ -11,38 +11,16 @@
  * D1, or Secrets Manager) so the reducer itself stays pure and
  * deterministic — no IO in the handler.
  *
- * Wire format (RFC 2812 §5):
- *   - `375 RPL_MOTDSTART`  — `:<server> 375 <nick> :- <server> Message of the day -`
- *   - `372 RPL_MOTD`        — `:<server> 372 <nick> :- <line>`  (one per MOTD line)
- *   - `376 RPL_ENDOFMOTD`  — `:<server> 376 <nick> :End of MOTD command`
- *   - `422 ERR_NOMOTD`     — `:<server> 422 <nick> :MOTD File is missing`
- *
- * Per RFC 1459 §2.3 the maximum wire line length is 512 bytes including the
- * trailing CR-LF. Over-long MOTD content lines are hard-wrapped at the
- * 372-line content budget so every emitted line fits within the 512-byte
- * limit (also leaving headroom for message-tags).
+ * The numeric rendering (`375`/`372`×N/`376`, or `422 ERR_NOMOTD`) is shared
+ * with the registration welcome block via {@link buildMotdNumerics} so the
+ * two paths cannot drift.
  */
 
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
-import { Numerics } from '../protocol/numerics.js';
 import type { ConnectionState } from '../state/connection.js';
 import type { Ctx, Reducer } from '../types.js';
-
-/** RFC 1459 §2.3: maximum IRC line length in bytes, including the trailing CR-LF. */
-const MAX_LINE_BYTES = 512;
-
-/** Length of the trailing CR-LF that the wire layer appends to each line. */
-const TRAILING_CRLF_LEN = 2;
-
-/** Fixed text emitted for `375 RPL_MOTDSTART` (after `:- `). */
-const MOTDSTART_TRAILING_TEXT = '- $server Message of the day -';
-
-/** Fixed text emitted for `376 RPL_ENDOFMOTD`. */
-const ENDOFMOTD_TRAILING_TEXT = 'End of MOTD command';
-
-/** Fixed text emitted for `422 ERR_NOMOTD`. */
-const NOMOTD_TRAILING_TEXT = 'MOTD File is missing';
+import { buildMotdNumerics } from './motd-lines.js';
 
 /**
  * Handles `MOTD [server]`.
@@ -56,91 +34,9 @@ const NOMOTD_TRAILING_TEXT = 'MOTD File is missing';
 export const motdReducer: Reducer<ConnectionState> = (state, _msg, ctx) => {
   state.lastSeen = ctx.clock.now();
 
-  const lines = ctx.motd.lines();
-
-  if (lines.length === 0) {
-    return {
-      state,
-      effects: [
-        Effect.send(ctx.connId, [numericLine(ctx, Numerics.ERR_NOMOTD, NOMOTD_TRAILING_TEXT)]),
-      ],
-    };
-  }
-
-  const out: RawLine[] = [
-    numericLine(
-      ctx,
-      Numerics.RPL_MOTDSTART,
-      MOTDSTART_TRAILING_TEXT.replace('$server', ctx.serverName),
-    ),
-  ];
-
-  const maxContent = maxMotdContentLen(ctx);
-  for (const raw of lines) {
-    for (const chunk of splitForMotd(raw, maxContent)) {
-      out.push(numericLine(ctx, Numerics.RPL_MOTD, `- ${chunk}`));
-    }
-  }
-
-  out.push(numericLine(ctx, Numerics.RPL_ENDOFMOTD, ENDOFMOTD_TRAILING_TEXT));
+  const nick = ctx.connection.nick ?? '*';
+  const out: RawLine[] = buildMotdNumerics(ctx.serverName, nick, ctx.motd.lines());
 
   const effects: EffectType[] = [Effect.send(ctx.connId, out)];
   return { state, effects };
 };
-
-/**
- * Builds a `:<server> <code> <nick> :<trailing>` line. The nick falls back
- * to `*` when the connection has not yet registered one, matching the rest
- * of the codebase's numeric-error formatting.
- */
-function numericLine(ctx: Ctx, code: number, trailing: string): RawLine {
-  const nick = ctx.connection.nick ?? '*';
-  const codeStr = code.toString().padStart(3, '0');
-  return { text: `:${ctx.serverName} ${codeStr} ${nick} :${trailing}` };
-}
-
-/**
- * Returns the maximum content-byte length that fits in a single `372 RPL_MOTD`
- * line for this connection, given the server name and the connection's nick.
- *
- * The 372 wire format is `:<server> 372 <nick> :- <chunk>\r\n`, so the
- * per-chunk budget is:
- *
- *   512
- *   - 2                              (trailing CR-LF)
- *   - 1                              (leading `:`)
- *   - <server>.length
- *   - 5                              (` 372 `)
- *   - <nick>.length
- *   - 4                              (` :- `)
- *
- * The result is clamped at 0 so a pathologically long server/nick combo
- * cannot drive the budget negative.
- */
-function maxMotdContentLen(ctx: Ctx): number {
-  const nick = ctx.connection.nick ?? '*';
-  const overhead = TRAILING_CRLF_LEN + 1 + ctx.serverName.length + 5 + nick.length + 4;
-  return Math.max(0, MAX_LINE_BYTES - overhead);
-}
-
-/**
- * Splits a single MOTD content line into chunks that each fit the per-372
- * content budget.
- *
- * Hard-wraps at the byte budget (no word-boundary awareness) — matching the
- * behavior of mainstream IRC daemons and keeping the reducer deterministic.
- *
- * Edge cases:
- *   - Empty string → `['']` (one empty 372 line, still RFC-conformant).
- *   - Zero/negative budget (impossible in practice but defensive) → `['']`
- *     so the reducer always emits at least one 372 per input line.
- */
-function splitForMotd(text: string, maxLen: number): string[] {
-  if (maxLen <= 0) return [''];
-  if (text.length === 0) return [''];
-  const chunks: string[] = [];
-  for (let i = 0; i < text.length; i += maxLen) {
-    chunks.push(text.slice(i, i + maxLen));
-  }
-  return chunks;
-}

package/packages/irc-core/src/commands/oper.ts

@@ -0,0 +1,151 @@
+/**
+ * Pure reducer for the IRC `OPER` command.
+ *
+ * PLAN §2.1 location-of-authority: OPER runs in the Connection entity — it
+ * authenticates the caller against the deployment's configured operator
+ * credentials and, on success, grants the `o` user mode by setting
+ * `state.userModes.oper = true`. The reducer's `state` argument is the
+ * caller's authoritative {@link ConnectionState}.
+ *
+ * Oper is the *only* path that sets `userModes.oper`: a user `MODE +o` is
+ * hard-rejected with `481 ERR_NOPRIVILEGES` (see `mode.ts`). Once oper is
+ * granted here, the `RPL_WHOISOPERATOR` (313) branch of WHOIS and the `*`
+ * oper flag of WHO become reachable.
+ *
+ * Wire format (RFC 2812 §5.4.1, §4.1):
+ *   - `OPER <name> <password>` — authenticates and (on success) grants oper.
+ *   - `381 RPL_YOUREOPER`:
+ *     `:<server> 381 <nick> :You are now an IRC operator`
+ *   - `461 ERR_NEEDMOREPARAMS`:
+ *     `:<server> 461 <nick> OPER :Not enough parameters`
+ *   - `464 ERR_PASSWDMISMATCH`:
+ *     `:<server> 464 <nick> :Password Incorrect`
+ *   - `491 ERR_NOOPERHOST`:
+ *     `:<server> 491 <nick> :No O-lines for your host`
+ *
+ * Behaviour:
+ *   - Missing `<name>` or `<password>` → `461 ERR_NEEDMOREPARAMS`.
+ *   - Already an operator → graceful idempotent no-op that re-confirms with
+ *     `381` (no re-authentication required; the connection is already privy).
+ *   - No operator credentials configured (absent or empty) →
+ *     `491 ERR_NOOPERHOST`.
+ *   - Matching credential pair → grant oper, emit `381`.
+ *   - Wrong password / unknown name → `464 ERR_PASSWDMISMATCH`.
+ */
+
+import { Effect } from '../effects.js';
+import type { RawLine } from '../effects.js';
+import { Numerics } from '../protocol/numerics.js';
+import type { ConnectionState } from '../state/connection.js';
+import type { OperCred } from '../types.js';
+import type { Ctx, Reducer } from '../types.js';
+
+/** Fixed text emitted for `381 RPL_YOUREOPER`. */
+const YOUREOPER_TRAILING_TEXT = 'You are now an IRC operator';
+
+/** Fixed text emitted for `464 ERR_PASSWDMISMATCH`. */
+const PASSWDMISMATCH_TRAILING_TEXT = 'Password Incorrect';
+
+/** Fixed text emitted for `491 ERR_NOOPERHOST`. */
+const NOOPERHOST_TRAILING_TEXT = 'No O-lines for your host';
+
+/** Fixed text emitted for `461 ERR_NEEDMOREPARAMS`. */
+const NEEDMOREPARAMS_TRAILING_TEXT = 'Not enough parameters';
+
+/**
+ * Returns true iff a credential pair in `creds` matches `name` / `password`
+ * exactly. Extracted as a pure helper so the match logic is testable in
+ * isolation and independent of connection state. Comparison is case
+ * sensitive and byte-exact (case-mapping is owned elsewhere).
+ */
+export function matchOperCred(
+  creds: ReadonlyArray<OperCred>,
+  name: string,
+  password: string,
+): boolean {
+  return creds.some((c) => c.user === name && c.password === password);
+}
+
+/**
+ * Handles `OPER <name> <password>`.
+ *
+ * Verifies the supplied pair against `serverConfig.operCreds` and, on
+ * success, grants the oper user mode. Emits the appropriate numeric reply
+ * in every branch. See the file header for the full decision table.
+ */
+export const operReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
+  state.lastSeen = ctx.clock.now();
+
+  const name = msg.params[0];
+  const password = msg.params[1];
+
+  if (name === undefined || password === undefined) {
+    return {
+      state,
+      effects: [
+        Effect.send(ctx.connId, [
+          numericLine(ctx, Numerics.ERR_NEEDMOREPARAMS, NEEDMOREPARAMS_TRAILING_TEXT, 'OPER'),
+        ]),
+      ],
+    };
+  }
+
+  // Already an operator: graceful idempotent re-confirm, no re-auth needed.
+  if (state.userModes.oper) {
+    return {
+      state,
+      effects: [
+        Effect.send(ctx.connId, [
+          numericLine(ctx, Numerics.RPL_YOUREOPER, YOUREOPER_TRAILING_TEXT),
+        ]),
+      ],
+    };
+  }
+
+  const creds = ctx.serverConfig.operCreds;
+  if (creds === undefined || creds.length === 0) {
+    return {
+      state,
+      effects: [
+        Effect.send(ctx.connId, [
+          numericLine(ctx, Numerics.ERR_NOOPERHOST, NOOPERHOST_TRAILING_TEXT),
+        ]),
+      ],
+    };
+  }
+
+  if (matchOperCred(creds, name, password)) {
+    state.userModes.oper = true;
+    return {
+      state,
+      effects: [
+        Effect.send(ctx.connId, [
+          numericLine(ctx, Numerics.RPL_YOUREOPER, YOUREOPER_TRAILING_TEXT),
+        ]),
+      ],
+    };
+  }
+
+  return {
+    state,
+    effects: [
+      Effect.send(ctx.connId, [
+        numericLine(ctx, Numerics.ERR_PASSWDMISMATCH, PASSWDMISMATCH_TRAILING_TEXT),
+      ]),
+    ],
+  };
+};
+
+/**
+ * Builds a `:<server> <code> <nick> [<middle>] :<trailing>` line. The nick
+ * falls back to `*` when the connection has not yet registered one, matching
+ * the rest of the codebase's numeric formatting.
+ */
+function numericLine(ctx: Ctx, code: number, trailing: string, middle?: string): RawLine {
+  const nick = ctx.connection.nick ?? '*';
+  const codeStr = code.toString().padStart(3, '0');
+  const parts = [`:${ctx.serverName}`, codeStr, nick];
+  if (middle !== undefined) parts.push(middle);
+  parts.push(`:${trailing}`);
+  return { text: parts.join(' ') };
+}

package/packages/irc-core/src/commands/registration.ts

@@ -21,6 +21,7 @@ import { hostmaskOf } from '../state/connection.js';
 import type { ConnectionState } from '../state/connection.js';
 import type { Ctx, Reducer } from '../types.js';
 import { generateIsupport } from './isupport.js';
+import { buildMotdNumerics } from './motd-lines.js';
 
 /**
  * Server version reported in `002` / `004`. Placeholder until a config-driven
@@ -55,9 +56,9 @@ export function isValidNick(nick: string, maxLen: number): boolean {
 
 /**
  * Builds the welcome numeric block emitted once registration completes:
- * `001`–`005` (with `005` as a placeholder) followed by
- * the `375`/`372`/`376` MOTD placeholders (real MOTD content via the
- * `MotdProvider` port).
+ * `001`–`005` (with `005` generated from the server config) followed by
+ * the MOTD numerics rendered from {@link Ctx.motd} — `375`/`372`×N/`376`
+ * for a configured MOTD, or `422 ERR_NOMOTD` when none is configured.
  *
  * Caller guarantees `state.nick` and `state.user` are set.
  */
@@ -81,10 +82,10 @@ export function buildWelcomeLines(state: ConnectionState, ctx: Ctx): RawLine[] {
     },
     // 005 RPL_ISUPPORT — real tokens generated from serverConfig.
     ...generateIsupport(ctx.serverConfig, state.caps, nick),
-    // MOTD placeholders — filled via MotdProvider elsewhere.
-    { text: `${prefix} 375 ${nick} :- ${ctx.serverName} Message of the day -` },
-    { text: `${prefix} 372 ${nick} :- MOTD placeholder` },
-    { text: `${prefix} 376 ${nick} :End of MOTD command` },
+    // MOTD — rendered from the configured MotdProvider (375/372/376, or
+    // 422 ERR_NOMOTD when no MOTD is configured). Shares the exact rendering
+    // path with the standalone MOTD command.
+    ...buildMotdNumerics(ctx.serverName, nick, ctx.motd.lines()),
   ];
 }
 

package/packages/irc-core/src/commands/tagmsg.ts

@@ -0,0 +1,205 @@
+/**
+ * Pure reducer for the IRCv3 `message-tags` `TAGMSG` command.
+ *
+ * Spec: https://ircv3.net/specs/extensions/message-tags#the-tagmsg-command
+ *
+ * TAGMSG carries ONLY message tags — no text body. Wire format:
+ *   `@+client-tag=value;vendor/tag=value :nick!user@host TAGMSG #target`
+ *
+ * The command is gated behind the `message-tags` capability: clients that
+ * did not negotiate it see `421 ERR_UNKNOWNCOMMAND` (matching the spec's
+ * permitted "unknown command" fallback, same as `draft/chathistory`).
+ *
+ * After the cap gate passes, TAGMSG follows NOTICE semantics: **no numeric
+ * error replies are ever emitted.** All rejection paths (+n, +m, +b,
+ * missing target) silently return an empty effect list.
+ *
+ * Recording mirrors the PRIVMSG/NOTICE channel path so chathistory replay
+ * (which already handles `command === 'TAGMSG'` in `formatReplayLine`)
+ * picks up TAGMSG lines for free.
+ */
+
+import { Effect } from '../effects.js';
+import type { Effect as EffectType, RawLine } from '../effects.js';
+import { Numerics } from '../protocol/numerics.js';
+import { escapeTagValue } from '../protocol/serializer.js';
+import type { ChannelState } from '../state/channel.js';
+import { hostmaskOf } from '../state/connection.js';
+import type { ConnectionState } from '../state/connection.js';
+import type { Ctx, Reducer } from '../types.js';
+
+/** The cap name advertising message-tags support. */
+const MESSAGE_TAGS_CAP = 'message-tags';
+
+/**
+ * Returns true iff `hostmask` matches the IRC ban mask `mask`. Identical to
+ * the implementation in `privmsg.ts`; duplicated to keep the message path
+ * self-contained (ban-matching consolidation is planned).
+ */
+function matchesBanMask(mask: string, hostmask: string): boolean {
+  let pattern = '^';
+  for (const ch of mask) {
+    if (ch === '*') {
+      pattern += '.*';
+    } else if (ch === '?') {
+      pattern += '.';
+    } else if (/[A-Za-z0-9]/.test(ch)) {
+      pattern += ch;
+    } else {
+      pattern += `\\${ch}`;
+    }
+  }
+  pattern += '$';
+  return new RegExp(pattern, 'i').test(hostmask);
+}
+
+/** Formats a numeric error line addressed to the connection's nick (or `*`). */
+function numericErr(ctx: Ctx, code: number, trailing: string, middle: string): RawLine {
+  const nick = ctx.connection.nick ?? '*';
+  const codeStr = code.toString().padStart(3, '0');
+  return { text: [`:${ctx.serverName}`, codeStr, nick, middle, `:${trailing}`].join(' ') };
+}
+
+/** Resolves the sender's hostmask, falling back to nick then `?`. */
+function senderHostmask(conn: ConnectionState): string {
+  return hostmaskOf(conn) ?? conn.nick ?? '?';
+}
+
+/**
+ * Returns true iff `entry` may speak on a moderated channel: ops and voiced
+ * members pass; everyone else is blocked.
+ */
+function maySpeakOnModerated(entry: { op: boolean; voice: boolean } | undefined): boolean {
+  if (entry === undefined) return false;
+  return entry.op || entry.voice;
+}
+
+/**
+ * Serializes `tags` into the `@key=val;… ` wire prefix used by TAGMSG.
+ * Returns an empty string when there are no tags (so the line has no `@…`
+ * prefix at all). A valueless tag (empty string) renders as just the key.
+ */
+function serializeTags(tags: Readonly<Record<string, string>>): string {
+  const entries = Object.entries(tags);
+  if (entries.length === 0) return '';
+  const section = entries
+    .map(([key, value]) => (value === '' ? key : `${key}=${escapeTagValue(value)}`))
+    .join(';');
+  return `@${section} `;
+}
+
+/** Reducer for `TAGMSG <channel>`. Authority: ChannelState. */
+export const tagmsgChannelReducer: Reducer<ChannelState> = (state, msg, ctx) => {
+  ctx.connection.lastSeen = ctx.clock.now();
+
+  // Cap gate: clients that did not negotiate message-tags see RFC 2812 only.
+  if (!ctx.connection.caps.has(MESSAGE_TAGS_CAP)) {
+    return {
+      state,
+      effects: [
+        Effect.send(ctx.connId, [
+          numericErr(ctx, Numerics.ERR_UNKNOWNCOMMAND, 'Unknown command', 'TAGMSG'),
+        ]),
+      ],
+    };
+  }
+
+  const effects: EffectType[] = [];
+
+  const target = msg.params[0];
+
+  // NOTICE-style silence: missing target → empty effects.
+  if (target === undefined) {
+    return { state, effects };
+  }
+
+  const senderEntry = state.members.get(ctx.connId);
+  const hostmask = senderHostmask(ctx.connection);
+
+  // +n (no external messages): sender must be a member. Silent.
+  if (state.modes.noExternal && senderEntry === undefined) {
+    return { state, effects };
+  }
+
+  // +m (moderated): sender must be op or voiced. Silent.
+  if (state.modes.moderated && !maySpeakOnModerated(senderEntry)) {
+    return { state, effects };
+  }
+
+  // +b (ban): sender's hostmask must not match any ban mask. Silent.
+  if (state.banMasks.size > 0) {
+    for (const mask of state.banMasks) {
+      if (matchesBanMask(mask, hostmask)) {
+        return { state, effects };
+      }
+    }
+  }
+
+  // Persist for chathistory playback when a MessageStore is bound.
+  if (ctx.messages !== undefined) {
+    ctx.messages.record({
+      msgid: ctx.ids.nonce(),
+      time: ctx.clock.now(),
+      chan: state.nameLower,
+      command: 'TAGMSG',
+      nick: ctx.connection.nick as string,
+      user: ctx.connection.user as string,
+      host: ctx.connection.host as string,
+      text: '',
+    });
+  }
+
+  // Broadcast the tag-bearing line to message-tags-enabled members only.
+  const tagPrefix = serializeTags(msg.tags);
+  const line: RawLine = { text: `${tagPrefix}:${hostmask} TAGMSG ${state.name}` };
+  effects.push(Effect.broadcast(state.name, [line], ctx.connId, MESSAGE_TAGS_CAP));
+
+  // IRCv3 echo-message: echo the same line back to the sender, after
+  // the broadcast effect so clients observe their own message last.
+  if (ctx.connection.caps.has('echo-message')) {
+    effects.push(Effect.send(ctx.connId, [line]));
+  }
+
+  return { state, effects };
+};
+
+/** Reducer for `TAGMSG <nick>`. Authority: sender's ConnectionState. */
+export const tagmsgUserReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
+  state.lastSeen = ctx.clock.now();
+
+  // Cap gate: clients that did not negotiate message-tags see RFC 2812 only.
+  if (!ctx.connection.caps.has(MESSAGE_TAGS_CAP)) {
+    return {
+      state,
+      effects: [
+        Effect.send(ctx.connId, [
+          numericErr(ctx, Numerics.ERR_UNKNOWNCOMMAND, 'Unknown command', 'TAGMSG'),
+        ]),
+      ],
+    };
+  }
+
+  const effects: EffectType[] = [];
+
+  const target = msg.params[0];
+
+  // NOTICE-style silence: missing target → empty effects.
+  if (target === undefined) {
+    return { state, effects };
+  }
+
+  const hostmask = senderHostmask(state);
+  const tagPrefix = serializeTags(msg.tags);
+  const line: RawLine = { text: `${tagPrefix}:${hostmask} TAGMSG ${target}` };
+
+  // No notFoundLines — TAGMSG is silent like NOTICE for offline recipients.
+  effects.push(Effect.sendToNick(target, ctx.connId, [line]));
+
+  // IRCv3 echo-message: echo the same line back to the sender, after
+  // the SendToNick effect so clients observe their own message last.
+  if (ctx.connection.caps.has('echo-message')) {
+    effects.push(Effect.send(ctx.connId, [line]));
+  }
+
+  return { state, effects };
+};

package/packages/irc-core/src/config.ts

@@ -10,9 +10,10 @@
  *
  * The reducer-facing {@link ServerConfig} (in `types.ts`) is a strict
  * subset of this schema — the reducers do not care about MOTD text,
- * channel-prefix policy, max-clients, or oper creds (those are consumed
- * by adapter-side plumbing: the MOTD provider, the JOIN validator's
- * prefix table, the connection admission gate, and the OPER auth path).
+ * channel-prefix policy, or max-clients (those are consumed by
+ * adapter-side plumbing: the MOTD provider, the JOIN validator's prefix
+ * table, and the connection admission gate). Oper credentials ARE surfaced
+ * on the reducer-facing config so the OPER reducer can authenticate.
  */
 
 import { z } from 'zod';
@@ -28,6 +29,17 @@ export const OperCredSchema = z.object({
   password: z.string().min(1),
 });
 
+/**
+ * Schema for a single SASL PLAIN account credential. The `username` is also
+ * the canonical account name recorded on the connection (for `extended-join`
+ * / `account-tag`). Both fields are non-empty strings; adapters seed an
+ * {@link InMemoryAccountStore} from this list at boot.
+ */
+export const SaslAccountSchema = z.object({
+  username: z.string().min(1),
+  password: z.string().min(1),
+});
+
 /**
  * Cloaking configuration. When enabled, the visible hostmask of every
  * connecting client is replaced by `<cloak>.<suffix>` where `<cloak>` is a
@@ -182,6 +194,17 @@ export const ServerConfigSchema = z.object({
    */
   operCreds: z.array(OperCredSchema).default([]),
 
+  /**
+   * SASL PLAIN account credentials. The adapter seeds an
+   * `InMemoryAccountStore` from this list at boot so `AUTHENTICATE PLAIN`
+   * succeeds end-to-end for the listed accounts. Empty array (the default)
+   * disables SASL account verification: `ctx.accounts` is then omitted and
+   * a client completing `AUTHENTICATE PLAIN` receives `904 ERR_SASLFAIL`.
+   * A persistent variant (DynamoDB `Accounts`, D1) is a documented
+   * follow-up; swapping it in means replacing the construction call.
+   */
+  saslAccounts: z.array(SaslAccountSchema).default([]),
+
   // --- Reducer-facing limit knobs (mirrored on `ServerConfig`) ---
 
   /** Maximum channels a single connection may JOIN. */

package/packages/irc-core/src/index.ts

@@ -12,12 +12,14 @@ export * from './effects.js';
 export * from './ports.js';
 export * from './flood-control.js';
 export * from './cloak.js';
+export * from './case-fold.js';
 export * from './admission.js';
 export * from './config.js';
 export type {
   BuildCtxOptions,
   CloakingConfig,
   Ctx,
+  OperCred,
   Reducer,
   ReducerResult,
   ServerConfig,