serverless-ircd 0.3.0 → 0.5.0

package/.github/workflows/ci.yml

@@ -39,7 +39,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
           cache: pnpm
 
       - name: Install dependencies
@@ -112,7 +112,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
           cache: pnpm
 
       - name: Install dependencies

package/.github/workflows/deploy-aws.yml

@@ -63,13 +63,11 @@ jobs:
 
       - name: Setup pnpm
         uses: pnpm/action-setup@v4
-        with:
-          version: 9
 
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
           cache: pnpm
 
       - name: Install dependencies

package/.github/workflows/deploy-cf-tcp.yml

@@ -0,0 +1,87 @@
+name: deploy-cf-tcp
+
+# Cloudflare TCP+TLS deploy pipeline (Spectrum + Container origin).
+#
+# Deploys the IRC TCP container origin (apps/cf-tcp-container) to Cloudflare
+# Containers and applies the Spectrum TLS config (terraform). Spectrum
+# terminates TLS on :6697 and forwards plaintext TCP to the container.
+#
+# This pipeline runs alongside deploy-cf.yml (the WebSocket path). The two
+# are independent: a deployment can enable either or both transports.
+#
+# Secrets (configure under repo Settings → Secrets and variables → Actions):
+#   CLOUDFLARE_API_TOKEN    Spectrum/Containers API token.
+#   CLOUDFLARE_ACCOUNT_ID   Account ID for the target zone.
+#   CF_ZONE_ID              Zone ID for the Spectrum hostname.
+#   CF_TCP_ORIGIN_ADDRESS   Hostname/IP of the container origin.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'apps/cf-tcp-container/**'
+      - '.github/workflows/deploy-cf-tcp.yml'
+  workflow_dispatch:
+
+concurrency:
+  group: cf-tcp-staging
+  cancel-in-progress: false
+
+jobs:
+  deploy-staging:
+    name: deploy cf-tcp staging
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build workspace
+        run: pnpm build
+
+      - name: Typecheck
+        run: pnpm typecheck
+
+      - name: Test
+        run: pnpm --filter '@serverless-ircd/cf-tcp-container' test
+
+      - name: Deploy container to staging
+        working-directory: apps/cf-tcp-container
+        env:
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: wrangler deploy --env staging
+
+      - name: Apply Spectrum TLS config
+        working-directory: apps/cf-tcp-container/terraform
+        env:
+          TF_VAR_zone_id: ${{ secrets.CF_ZONE_ID }}
+          TF_VAR_origin_address: ${{ secrets.CF_TCP_ORIGIN_ADDRESS }}
+          TF_VAR_hostname: irc-staging.example.com
+        run: |
+          terraform init
+          terraform apply -auto-approve
+
+      - name: Smoke e2e (irc+tls)
+        if: ${{ vars.CF_TCP_SMOKE_HOST != '' }}
+        env:
+          SMOKE_HOST: ${{ vars.CF_TCP_SMOKE_HOST }}
+          SMOKE_PORT: '6697'
+        run: |
+          # Minimal smoke: connect over TLS, register, join, privmsg, quit.
+          # Uses openssl s_client for the TLS handshake + IRC line exchange.
+          echo "NICK smoke\r\nUSER smoke 0 * :Smoke\r\nQUIT :smoke\r\n" | \
+            timeout 10 openssl s_client -connect "${SMOKE_HOST}:${SMOKE_PORT}" -quiet 2>/dev/null | \
+            grep -q "001" && echo "SMOKE PASS" || (echo "SMOKE FAIL" && exit 1)

package/.github/workflows/deploy-cf.yml

@@ -49,7 +49,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
           cache: pnpm
 
       - name: Install dependencies

package/.node-version

@@ -0,0 +1 @@
+24

package/.nvmrc

@@ -0,0 +1 @@
+24

package/CHANGELOG.md

@@ -10,6 +10,339 @@ For the release process itself — versioning policy, pre-release checklist,
 cutting a tag, rolling back — see [`docs/release.md`](docs/release.md).
 Cross-reference `progress.md` / `tickets.md` for per-ticket detail.
 
+## [0.5.0] - 2026-08-02
+
+The headline is **protocol completion**: the deferred IRC verbs land
+(Phase 11), and the S2S / obsolete RFC 2812 verbs are **formally
+dropped** rather than left "deferred". With this release every standard
+IRC verb a modern client expects is implemented — the only remaining
+`421 ERR_UNKNOWNCOMMAND` paths are the deliberately-unimplemented S2S
+and obsolete verbs. The roadmap's 0.x protocol surface is complete;
+what remains is the load/compat sweep (10k-connection load test +
+client compatibility matrix) and the required-`serverName` config gate.
+
+### Added — Deferred IRC verbs (`@serverless-ircd/irc-core`, `@serverless-ircd/irc-server`)
+
+Six Phase 11 tickets light up the remaining command surface. Each ships
+a pure reducer, an actor route case (no more `421`), new numerics in
+`protocol/numerics.ts`, and unit + actor coverage. (The remaining two
+Phase 11 tickets are drops — see below.)
+
+- **`KILL`** (oper-gated force-disconnect): `KILL <nick>
+  <comment>` resolves the target via the nick registry + a live
+  connection fetch (mirroring WHOIS), checks the oper gate (`481
+  ERR_NOPRIVILEGES`), and emits a `Disconnect` effect carrying the
+  classic `Killed (<oper> (<comment>))` reason. Peer `QUIT` fanout in
+  the target's shared channels happens via the runtime's existing
+  `disconnect` path. Missing params → `461`; unknown nick → `401`; an
+  oper may `KILL` themselves (RFC-permitted).
+  **Platform asymmetry:** on Cloudflare the `disconnect` RPC closes the
+  target DO's socket immediately; on AWS a `$default` Lambda invocation
+  cannot close a *remote* APIGW WebSocket, so the target's
+  live socket only closes on its next `$disconnect` / sweeper cycle —
+  the QUIT fanout to peers still fires. The reducer is identical; the
+  difference is the bound runtime's `disconnect` semantics.
+- **`REHASH`** (oper-gated config reload): emits `382
+  RPL_REHASHING :<source>` and re-fetches `ServerConfig` from the
+  adapter's bound source via a new `IrcRuntime.reloadConfig()` port
+  method. The refreshed value swaps into the actor's live config
+  reference so subsequent commands observe it (rotated oper passwords,
+  new MOTD source, etc.). On reload failure the previous config stays
+  in effect and a graceful error-suffixed `382` follows — the oper is
+  **not** disconnected (a bad store read must never sever a live link).
+  Already-open connections keep their negotiated caps and registration;
+  transport/TLS reload requires a redeploy.
+- **`LUSERS` + `STATS`** (network statistics): backed by a
+  new async `ServerStats` port (`getStats(): Promise<ServerStatsSnapshot>`)
+  and an `InMemoryStats` reference impl. `LUSERS` emits the full
+  `251`–`255` sequence (only the non-zero counts, per RFC) plus the
+  optional `265` / `266` local/global counts. `STATS <query>` supports
+  the `u` (uptime, `242 RPL_STATSUPTIME`) and `l` (link info,
+  `211 RPL_STATSLINKINFO`) letters; unknown letters get the
+  charybdis-style empty body terminated by `219 RPL_ENDOFSTATS`. A
+  `<server>` argument that does not match the local server (case-
+  insensitive) yields `402 ERR_NOSUCHSERVER` (single-server network —
+  S2S aggregation is a PLAN non-goal). The `computeStatsSnapshot`
+  helper centralizes the oper/invisible/unknown classification so each
+  adapter's backend only has to gather raw counts.
+- **`TRACE`** (routing diagnostics): in a single-server
+  serverless IRCd `TRACE` collapses to a local-server line + the
+  `262 RPL_ENDOFTRACE` terminator. Per-connection `204
+  RPL_TRACEOPERATOR` / `205 RPL_TRACEUSER` detail is **oper-gated** —
+  non-opers see only the server line + `262` (no enumeration of `+i`
+  users they don't share a channel with). `TRACE <server>` where
+  `<server>` is not the local server → `402`.
+- **`WALLOPS`** (oper broadcast): `WALLOPS :<message>` is
+  oper-only to send (modern ircd convention — non-oper → `481`);
+  delivery fans out to every connection whose `+w` user mode is set via
+  a new `BroadcastWallops` effect interpreted by the runtime's
+  `broadcastWallops` method (global cross-connection fanout, not
+  channel-scoped). The originator is always excluded (skip-self,
+  matching NOTICE/PRIVMSG semantics). Empty message → `461`. The `+w`
+  user mode was already accepted by `MODE` and advertised in `004
+  RPL_MYINFO`; this lights up the consumer.
+- **`SETNAME`** (realname change): `SETNAME :<realname>`
+  updates `state.realname` so a subsequent `WHOIS` reflects the new
+  value in `311 RPL_WHOISUSER`. No broadcast is emitted in v1 (there
+  is no standard IRCv3 cap for relaying a realname change — a
+  `draft/setname` relay is a documented follow-up). Empty/missing
+  realname → `461`; the registration-time realname length cap applies.
+
+### Changed — S2S & obsolete verbs formally dropped (`@serverless-ircd/irc-core`)
+
+The remaining two Phase 11 tickets convert the "deferred" framing into
+an explicit **drop**. There is no behaviour change on the wire — the verbs
+already returned `421 ERR_UNKNOWNCOMMAND` — but the framing, comments,
+and reserved numerics are cleaned up so the codebase no longer carries
+dead scaffolding.
+
+- **S2S verbs** (`CONNECT`, `SQUIT`, `LINKS`): dropped as a PLAN
+  non-goal (single-server serverless IRCd; no mesh to connect, split,
+  or list). The now-unused numerics `RPL_LINKS (364)`,
+  `RPL_ENDOFLINKS (365)`, and `ERR_CANTKILLSERVER (483)` are removed
+  from `numerics.ts` and its auto-derived `numericToName` reverse map.
+  `ERR_NOSUCHSERVER (402)` is retained — `LUSERS` / `STATS` / `TRACE`
+  use it for remote-server gating.
+- **Obsolete RFC 2812 verbs** (`SERVICE`, `SUMMON`, `USERS`): dropped
+  (never widely implemented; no modern client uses them). The now-unused
+  numerics `RPL_YOURESERVICE (383)`, `ERR_NOSUCHSERVICE (408)`,
+  `ERR_SUMMONDISABLED (445)`, and `ERR_USERSDISABLED (446)` are removed.
+- The `actor.ts` default-branch triage comment was rewritten: the
+  six verbs are documented as **deliberately unimplemented** rather
+  than "deferred".
+- Source-level regression guards
+  (`packages/irc-core/tests/dropped-s2s-and-obsolete-verbs.test.ts`)
+  and a behaviour guard in `actor.test.ts` (the verbs still emit
+  `421`) pin the drop so the numerics or the "deferred" framing cannot
+  creep back in.
+
+### Added — Runtime ports for the new verbs
+
+- **`ServerStats` port** (`packages/irc-core/src/ports.ts`): async
+  `getStats()` returning `ServerStatsSnapshot` (users / invisible /
+  opers / unknown / channels / servers / local+global conn counts /
+  uptime anchor). Asynchronous because the aggregation crosses every
+  connection and channel — it cannot be pre-loaded into a synchronous
+  view the way MOTD or a credential table can. Each adapter implements
+  it against its authoritative store; `InMemoryStats` is the reference
+  impl. The `computeStatsSnapshot` helper holds the shared
+  classification logic (oper / invisible / unknown).
+- **`reloadConfig()` on `IrcRuntime`** (`packages/irc-server/src/runtime.ts`):
+  request/response port method the `REHASH` route calls to re-fetch
+  `ServerConfig` from the adapter's bound source (CF: KV/secret env;
+  AWS: Secrets Manager/SSM env; local-cli: the config file/options).
+  Modelled as a runtime method rather than a fire-and-forget effect
+  because the refreshed value must come back to the actor.
+
+### ⚠️ Migration required
+
+- **For adapter authors wiring the new ports.** `ServerStats` and
+  `reloadConfig` are optional at the type level (the actor falls back
+  to a zero-count snapshot when no `ServerStats` is bound, and
+  `REHASH` still emits `382` even if `reloadConfig` rejects — the
+  previous config is retained). To surface real counts and live
+  reloads, each adapter wires its own backend. No Durable-Object
+  persisted-state schema change (`PERSISTED_STATE_VERSION` stays `1`);
+  code rollback across this release is safe.
+- No toolchain change. Node ≥ 24 / pnpm 11 (from v0.4.0) still apply.
+
+### Known limitations
+
+- Same as v0.4.0's transport limits: the **CF TCP path requires
+  Cloudflare Spectrum (Enterprise tier)** plus a stateful Container
+  origin; the **AWS TCP path** uses NLB + Lambda streaming and is
+  subject to Lambda idle-timeout / stream-duration limits. The
+  WebSocket path remains the zero-extra-deps default.
+- **mTLS (for SASL `EXTERNAL`) requires a custom domain + uploaded
+  CA/trust-store** on both platforms and is not enabled by default.
+- `serverName` still defaults to the `irc.example.com` placeholder when
+  an adapter config omits it (pending).
+- `STATS` ships the `u` + `l` query letters; the full RFC matrix
+  (`k`, `K`, `q`, `g`, `x`, `z`, …) is intentionally out of scope for
+  v1 — unknown letters get the charybdis-style empty body + `219`.
+- Load testing (10k concurrent connections) and the client
+  compatibility sweep (WeeChat / HexChat / IRCCloud / TheLounge)
+  remain pending.
+- **Local coverage instrumentation on the Cloudflare-backed packages
+  (`@serverless-ircd/cf-adapter`, `@serverless-ircd/cf-worker`) is
+  incompatible with the current vitest toolchain.** `@vitest/coverage-v8`
+  v4.1.x imports `node:inspector/promises`, which the
+  `@cloudflare/vitest-pool-workers` (workerd) test pool cannot resolve.
+  The packages' test suites themselves pass (cf-adapter 185/185,
+  cf-worker 3/3); only `pnpm coverage` fails to load the coverage
+  module under the workerd pool. This is a documented [vitest-pool-workers
+  known issue](https://developers.cloudflare.com/workers/testing/vitest-integration/known-issues/#module-resolution)
+  and is expected to resolve with an upstream `@vitest/coverage-v8` or
+  pool-workers release. No production code is affected; CI behavior
+  depends on its installed versions.
+
+### Security
+
+- None. No vulnerabilities have been reported or fixed in this release.
+  The dropped S2S / obsolete verbs and their reserved numerics carried
+  no reachable code path; their removal reduces surface area but fixes
+  no defect.
+
+---
+
+## [0.4.0] - 2026-07-31
+
+The headline is **dual transport**: both adapters now speak a real
+`irc+tls :6697` (TLS-over-TCP) surface for stock IRC clients in
+production — not just the local CLI — alongside the WebSocket path. This
+lands **SASL `EXTERNAL` via mTLS**, the **remaining standard IRC verbs**
+(WHOWAS, VERSION, TIME, ADMIN, INFO, USERHOST, ISON), a **Cloudflare
+D1-backed SASL account store**, config-driven server identity, and a
+**Node 24 / pnpm 11** toolchain. Phase 7 (TLS hardening & raw TCP) is
+complete.
+
+### Added — Dual transport: WebSocket + `irc+tls :6697`
+
+The wss-only transport decision (ADR-005) is superseded by **ADR-009**
+(dual transport). The shared `ConnectionActor` now drives either
+transport through a generalized seam; the parser/reducer/dispatch
+pipeline is unchanged.
+
+- **Transport seam** (`@serverless-ircd/irc-server`,
+  `@serverless-ircd/irc-core`): the `\r\n` line-framing is extracted into
+  a `Transport` abstraction. `ConnectionActor` accepts a
+  `WsTextFrameTransport` (one message per WS frame, prior behavior) or a
+  `TcpByteStreamTransport` (stateful `\r\n` framing across chunks with
+  partial-line buffering). Both produce identical reducer invocations.
+- **Cloudflare TCP+TLS** (`@serverless-ircd/cf-tcp-container`): a new
+  workspace app — **Cloudflare Spectrum** terminates TLS at the edge and
+  forwards plaintext TCP to a stateful **Container** origin running the
+  IRC core. Ships a `Dockerfile`, config loader, deploy pipeline
+  (`.github/workflows/deploy-cf-tcp.yml`), and root
+  `deploy:cf-tcp:staging` / `deploy:cf-tcp:prod` scripts.
+- **AWS TCP+TLS** (`@serverless-ircd/aws-adapter`, `@serverless-ircd/aws-stack`):
+  a **Network Load Balancer** with a `tls` listener terminates TLS and
+  invokes a **Lambda streaming function** (`nlb-stream.ts`) as the target.
+  Connection identity is derived from NLB flow metadata; bidirectional
+  traffic flows over the Lambda response stream, reusing `AwsRuntime`.
+  CDK constructs for NLB + target group + ACM cert are added.
+- **Transport-parametrized contract suite** (`@serverless-ircd/irc-test-support`):
+  every scenario now runs across a `Transport` dimension
+  (in-memory+WS, in-memory+TCP, …), with TCP-specific framing scenarios
+  (chunk boundaries, mixed `\r\n`/`\n` line endings, partial sends).
+- **Docs**: `docs/Cloudflare-TCP-Deployment.md` and
+  `docs/AWS-TCP-Deployment.md` — end-to-end :6697 deployment guides
+  (prerequisites, mTLS trust-store setup, cost/ops caveats).
+
+### Added — SASL `EXTERNAL` via mTLS (`@serverless-ircd/irc-core`, adapters)
+
+- **mTLS support**: an `MtlsIdentityProvider` port in `irc-core` feeds
+  the verified client-certificate subject into `AccountStore`. Cloudflare
+  uses API Shield mTLS (uploaded CA pool); AWS uses API Gateway
+  custom-domain mTLS (PEM trust store, subject in the `$connect` event).
+  Identity is plumbed via a port — no cloud deps in `irc-core`.
+- **`EXTERNAL` now authenticates** (was a stubbed `904 ERR_SASLFAIL` in
+  v0.2.0): `AUTHENTICATE EXTERNAL` against a bound provider succeeds with
+  `900 RPL_LOGGEDIN` / `903 RPL_SASLSUCCESS` when the cert maps to an
+  account.
+- **mTLS-conditional advertisement**: the `sasl` cap value and
+  `908 ERR_SASLMECHS` are now driven by whether an mTLS provider is bound
+  — `PLAIN` only by default, `PLAIN,EXTERNAL` when one is. `AUTHENTICATE
+  EXTERNAL` without mTLS returns `908` (mechanism not available) instead
+  of the misleading `904`. Operators enable EXTERNAL by configuring edge
+  mTLS — no code change required.
+
+### Added — Remaining IRC query verbs (`@serverless-ircd/irc-core`)
+
+- **`WHOWAS`**: a nick-history store (port + in-memory reference impl)
+  records `(nick, connId, username, hostname, signoffTime)` on QUIT /
+  NICK-change and purges past a TTL. `WHOWAS <nick>{,<nick>} [<count>]`
+  queries it — `314 RPL_WHOWASUSER` per match, `369 RPL_ENDOFWHOWAS`
+  terminator, `406 ERR_WASNOSUCHNICK` when no match.
+- **`VERSION`** (`351`), **`TIME`** (`391`, uses the injected `Clock`),
+  **`ADMIN`** (`256`/`257`/`258`), **`INFO`** (`371`/`374`),
+  **`USERHOST`** (`302`), **`ISON`** (`303`) — each a reducer + a route
+  case with spec-correct numerics. Completes the standard query-verb set.
+
+### Added — Server identity from config (`@serverless-ircd/irc-core`)
+
+- The `002` / `003` / `004` registration replies now reflect
+  `ServerConfig.serverVersion` / `createdAt` — the hardcoded
+  `'0.1.0'` / `'Phase 1'` placeholders are gone. A build step
+  (`scripts/generate-build-info.mjs`) bakes the package version and a
+  build timestamp into `RPL_CREATED` (`003`) when the config omits them.
+
+### Added — Cloudflare D1-backed SASL account store (`@serverless-ircd/cf-adapter`, `@serverless-ircd/irc-core`)
+
+- Brings the CF adapter to parity with the AWS `DynamoAccountStore`. A
+  persistent `AccountStore` pre-loads scrypt-hashed rows from a new
+  **D1** database (`ACCOUNTS_DB` binding) at `ConnectionDO`
+  construction.
+- **Shared scrypt hashing**: `hashAccountCredential` /
+  `verifyHashedPassword` are extracted to `irc-core` so both adapters use
+  one implementation (never plaintext).
+- **Table-then-env precedence**: when the D1 table has rows it is
+  authoritative; when empty or unreachable the adapter falls back to the
+  `SASL_ACCOUNTS` env-var seed, preserving current behavior.
+- **`tools/seed-cf-accounts.ts`**: provisioning CLI that scrypt-hashes
+  `username:password` pairs into the D1 `accounts` table (re-run
+  overwrites the prior row).
+
+### Added — AWS max-clients admission (`@serverless-ircd/aws-adapter`)
+
+- `$connect` now enforces `serverConfig.maxClients` (was a reserved
+  no-op — `void params.serverConfig;`). Connections over the cap are
+  rejected at accept time, matching the Cloudflare admission gate.
+
+### Changed
+
+- **Toolchain**: bumped from Node ≥ 20 / pnpm 9 to **Node ≥ 24 / pnpm
+  11** (aligns the Lambda and Cloudflare Workers runtimes). Re-run
+  `corepack enable` to pick up the pinned pnpm.
+- `@serverless-ircd/irc-core`: the request/response lookup `Effect`
+  variants (`LookupNick`, `GetConnectionInfo`, `GetChannelSnapshot`) are
+  removed from `effects.ts` and `dispatch` — they were dead scaffolding
+  with no producer or consumer.
+- `@serverless-ircd/cf-adapter`: the dead channel-registration loop in
+  `ConnectionDO.webSocketMessage` and the reserved outbound-batching
+  field are removed (the latter was a never-wired optimization).
+
+### ⚠️ Migration required
+
+- **Cloudflare: new D1 binding for SASL accounts.** To persist SASL
+  accounts, create the D1 database and add the `ACCOUNTS_DB` binding
+  (default + staging) to `wrangler.toml`:
+  ```bash
+  wrangler d1 create serverless-ircd-accounts
+  wrangler d1 execute serverless-ircd-accounts --command \
+    "CREATE TABLE IF NOT EXISTS accounts (account TEXT PRIMARY KEY, algorithm TEXT NOT NULL, salt TEXT NOT NULL, hash TEXT NOT NULL)"
+  ```
+  **No action is required to keep working** — when the D1 table is empty
+  or unreachable the adapter falls back to the `SASL_ACCOUNTS` env-var
+  seed. There is **no Durable-Object persisted-state schema change**
+  (`PERSISTED_STATE_VERSION` stays `1`); code rollback across this
+  release is safe.
+- **Local toolchain**: Node ≥ 24 / pnpm 11 is now required. Re-run
+  `corepack enable`.
+
+### Known limitations
+
+- The **CF TCP path requires Cloudflare Spectrum (Enterprise tier)** plus
+  a stateful Container origin; the **AWS TCP path** uses NLB + Lambda
+  streaming and is subject to Lambda idle-timeout / stream-duration
+  limits. The WebSocket path remains the zero-extra-deps default.
+- **mTLS (for SASL `EXTERNAL`) requires a custom domain + uploaded
+  CA/trust-store** on both platforms and is not enabled by default.
+- Oper-gated verbs (`KILL`, `REHASH`, `CONNECT`, `SQUIT`, `TRACE`,
+  `WALLOPS`, `SETNAME`, …) still return `421 ERR_UNKNOWNCOMMAND`.
+- `serverName` still defaults to the `irc.example.com` placeholder when
+  an adapter config omits it (pending).
+
+### Security
+
+- SASL `EXTERNAL` no longer returns a misleading `904 ERR_SASLFAIL` when
+  mTLS isn't configured — it returns `908 ERR_SASLMECHS` and the
+  mechanism is not advertised until a trust store is bound. SASL
+  credentials remain scrypt-hashed only (never plaintext), now via a
+  single shared implementation across both adapters.
+
+---
+
 ## [0.3.0] - 2026-07-25
 
 ### Added — Operator authentication (`@serverless-ircd/irc-core`)
@@ -378,31 +711,29 @@ manual per `docs/release.md` §8.3.
 
 ### Known limitations
 
-- **No AWS adapter.** Tickets TICKET-039 through TICKET-044 (CDK
-  stack, APIGW WebSocket handlers, DynamoDB transactions, EventBridge
-  timers, deploy pipeline, deployment doc) are pending. Cloudflare is
-  the only deployable platform in 0.1.0.
+- **No AWS adapter.** The CDK stack, APIGW WebSocket handlers, DynamoDB
+  transactions, EventBridge timers, deploy pipeline, and deployment doc
+  are pending. Cloudflare is the only deployable platform in 0.1.0.
 - **No SASL.** `CAP sasl` is advertised in the capability list but
   `AUTHENTICATE` is not wired into the dispatcher. Plain-text password
-  authentication via `PASS` is also not enforced (TICKET-046).
-- **No flood control.** A token-bucket wrapper (TICKET-028) is
-  pending. Misbehaving clients can send unbounded commands.
+  authentication via `PASS` is also not enforced.
+- **No flood control.** A token-bucket wrapper is pending. Misbehaving
+  clients can send unbounded commands.
 - **No server-password enforcement, rate limits, cloaking, or oper
-  credentials** (TICKET-046).
+  credentials.**
 - **No config loader.** Server name, network name, MOTD, channel
-  prefixes, max clients, oper creds are hardcoded defaults
-  (TICKET-047). The `MOTD.txt` file at the repo root is informational
-  only; the live MOTD is compiled into the Worker from
-  `[vars].MOTD_LINES`.
+  prefixes, max clients, oper creds are hardcoded defaults. The
+  `MOTD.txt` file at the repo root is informational only; the live MOTD
+  is compiled into the Worker from `[vars].MOTD_LINES`.
 - **No CI coverage gate.** Coverage is computed and uploaded as an
-  artifact, but no threshold is enforced (TICKET-048). Inspect
+  artifact, but no threshold is enforced. Inspect
   `packages/*/coverage/` before deploying.
 - **No TLS / raw TCP transport.** v1 is WebSocket text frames only.
-  TLS-hardened and `irc+tls` transports are 0.x work (TICKET-052
-  through TICKET-058). Stock TCP IRC clients reach the server through
-  the local `tcp-ws-forwarder` bridge.
-- **No `chathistory` playback.** TICKET-063 is pending; clients that
-  request backlog on JOIN will see an empty batch or no response.
+  TLS-hardened and `irc+tls` transports are 0.x work. Stock TCP IRC
+  clients reach the server through the local `tcp-ws-forwarder` bridge.
+- **No `chathistory` playback.** Chat-history playback is pending;
+  clients that request backlog on JOIN will see an empty batch or no
+  response.
 
 ### Security