serverless-ircd 0.3.0 → 0.5.0

package/packages/cf-adapter/tests/worker/stubs/registry-stub.ts

@@ -3,7 +3,7 @@
  * {@link ConnectionDO} into its `state.storage`. Tests inspect the call
  * log via `runInDurableObject` after exercising the connection.
  *
- * PLAN §2.1 — the real RegistryDO ships in 034. For 033 we
+ * PLAN §2.1 — the real RegistryDO ships separately. We
  * only need enough surface area to assert that ConnectionDO closes
  * release the nick and fan out QUIT correctly. The stub records the
  * requested operations verbatim; it does not enforce uniqueness.
@@ -12,7 +12,7 @@
 import { DurableObject } from 'cloudflare:workers';
 
 export interface RecordedRegistryCall {
-  method: 'reserveNick' | 'changeNick' | 'releaseNick' | 'lookupNick';
+  method: 'reserveNick' | 'changeNick' | 'releaseNick' | 'lookupNick' | 'listEntries';
   args: unknown[];
 }
 
@@ -21,6 +21,7 @@ interface RegistryRpc {
   changeNick(conn: string, oldNick: string, newNick: string): Promise<boolean>;
   releaseNick(nick: string): Promise<void>;
   lookupNick(nick: string): Promise<string | null>;
+  listEntries(): Promise<Array<[nickLower: string, connId: string]>>;
 }
 
 const LOG_KEY = 'registry-call-log';
@@ -54,4 +55,9 @@ export class RecordingRegistryDO extends DurableObject implements RegistryRpc {
     await this.append({ method: 'lookupNick', args: [nick] });
     return null;
   }
+
+  async listEntries(): Promise<Array<[nickLower: string, connId: string]>> {
+    await this.append({ method: 'listEntries', args: [] });
+    return [];
+  }
 }

package/packages/cf-adapter/wrangler.test.toml

@@ -8,11 +8,26 @@ compatibility_flags = ["nodejs_compat"]
 # integration-test harness so scenario 18 (MOTD) asserts against the same
 # body text in every runtime factory.
 [vars]
+SERVER_NAME = "irc.example.com"
+NETWORK_NAME = "ServerlessIRCd"
 MOTD_LINES = "Welcome to the ServerlessIRCd integration-test harness.\nAll scenarios run parametrized over the IrcRuntime factory matrix."
 # SASL PLAIN accounts seeded into the in-worker AccountStore. Newline-
 # delimited `username:password` pairs; the connection-do parses these into
 # an InMemoryAccountStore so AUTHENTICATE PLAIN works end-to-end in tests.
 SASL_ACCOUNTS = "cf-sasl:s3cret"
+# IRC operator credentials consulted by the OPER reducer. The DO must
+# thread these from env into the reducer-facing ServerConfig so
+# `OPER <user> <pass>` returns 381 rather than 491 ERR_NOOPERHOST.
+OPER_USER = "cf-oper"
+OPER_PASSWORD = "oper-secret"
+
+# D1 database backing persistent SASL accounts. The D1 account-store suite
+# creates the `accounts` table in a beforeEach and exercises the real
+# load/put/resolve path.
+[[d1_databases]]
+binding = "ACCOUNTS_DB"
+database_name = "cf-adapter-test-accounts"
+database_id = "test-d1-accounts"
 
 # Production bindings: REGISTRY_DO and CHANNEL_DO point at the real DO
 # classes so CfRuntime, ConnectionDO, and the integration suite all

package/packages/in-memory-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/in-memory-runtime",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "private": true,
   "description": "Single-process reference implementation of the IrcRuntime port, backed by Maps",
   "license": "BSD-3-Clause",

package/packages/in-memory-runtime/src/in-memory-runtime.ts

@@ -26,6 +26,7 @@ import {
   type ConnectionState,
   type Nick,
   type RawLine,
+  type ServerConfig,
   applyChannelDelta as applyDelta,
   caseFold,
   createChannel,
@@ -64,6 +65,15 @@ export interface InMemoryRuntimeOptions {
    * deployment's `ServerConfig`.
    */
   readonly admission?: AdmissionConfig;
+  /**
+   * Config-reload source for `REHASH`. When bound, the runtime re-invokes
+   * it on every {@link InMemoryRuntime.reloadConfig} call and returns the
+   * fresh {@link ServerConfig}; the local-cli binds the loader that
+   * re-derives config from its original options. When omitted
+   * `reloadConfig` rejects so the actor's graceful failure path applies a
+   * consistent error-suffixed `382`.
+   */
+  readonly configLoader?: () => Promise<ServerConfig>;
 }
 
 export class InMemoryRuntime implements IrcRuntime {
@@ -73,9 +83,11 @@ export class InMemoryRuntime implements IrcRuntime {
   private readonly nicks = new Map<string, ConnId>();
   private readonly admissionStats: AdmissionStats | undefined;
   private readonly admissionConfig: AdmissionConfig | undefined;
+  private readonly configLoader: (() => Promise<ServerConfig>) | undefined;
 
   constructor(opts: InMemoryRuntimeOptions) {
     this.clock = opts.clock;
+    this.configLoader = opts.configLoader;
     if (opts.admission !== undefined) {
       this.admissionConfig = opts.admission;
       this.admissionStats = new AdmissionStats(this.clock);
@@ -242,6 +254,22 @@ export class InMemoryRuntime implements IrcRuntime {
     }
   }
 
+  /**
+   * Global cross-connection fanout for `WALLOPS`. Scans the connection map
+   * and delivers `lines` to every live connection whose `+w` user mode is
+   * set, skipping `except` (the originator). Unlike {@link broadcast} this
+   * is NOT channel-scoped — it reaches connections with no shared channel
+   * membership. This is the reference implementation the CF and AWS
+   * adapters mirror against their own enumeration primitives.
+   */
+  async broadcastWallops(lines: RawLine[], except?: ConnId): Promise<void> {
+    for (const [connId, tracked] of this.connections) {
+      if (connId === except) continue;
+      if (!tracked.state.userModes.wallops) continue;
+      tracked.handlers.send(lines);
+    }
+  }
+
   // ------------------------------------------------------------------
   // IrcRuntime — nick registry
   // ------------------------------------------------------------------
@@ -333,4 +361,15 @@ export class InMemoryRuntime implements IrcRuntime {
   async listChannels(): Promise<ChanSnapshot[]> {
     return Array.from(this.channels.values(), (c) => toChannelSnapshot(c));
   }
+
+  // ------------------------------------------------------------------
+  // IrcRuntime — config reload (REHASH)
+  // ------------------------------------------------------------------
+
+  async reloadConfig(): Promise<ServerConfig> {
+    if (this.configLoader === undefined) {
+      throw new Error('no config loader bound to InMemoryRuntime');
+    }
+    return this.configLoader();
+  }
 }

package/packages/in-memory-runtime/tests/in-memory-runtime.test.ts

@@ -5,6 +5,7 @@ import {
   type ConnectionState,
   FakeClock,
   type RawLine,
+  type ServerConfig,
   createConnection,
 } from '@serverless-ircd/irc-core';
 import { describe, expect, it } from 'vitest';
@@ -124,6 +125,26 @@ describe('InMemoryRuntime — changeNick', () => {
     expect(await rt.lookupNick('alice')).toBe('c1');
     expect(await rt.lookupNick('bob')).toBe('c2');
   });
+
+  it('does not clobber a third party that grabbed the old nick via re-reserve (stale-release guard)', async () => {
+    // Covers the defensive branch on the old-mapping clear: c1 held
+    // `alice`, released it, c2 re-reserved it, then c1 reports a nick
+    // change FROM `alice` (stale state). The guard must NOT delete the
+    // alice mapping that now belongs to c2.
+    const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
+    rt.registerConnection(makeConn('c1'), { send: () => {}, disconnect: () => {} });
+    rt.registerConnection(makeConn('c2'), { send: () => {}, disconnect: () => {} });
+
+    await rt.reserveNick('alice', 'c1');
+    await rt.releaseNick('alice'); // nicks[alice] deleted (still pointed at c1)
+    await rt.reserveNick('alice', 'c2'); // nicks[alice] = c2
+
+    const ok = await rt.changeNick('c1', 'alice', 'bob');
+    expect(ok).toBe(true);
+    // c1 got `bob`, c2 still holds `alice` (the stale clear was skipped).
+    expect(await rt.lookupNick('alice')).toBe('c2');
+    expect(await rt.lookupNick('bob')).toBe('c1');
+  });
 });
 
 describe('InMemoryRuntime — releaseNick', () => {
@@ -255,6 +276,100 @@ describe('InMemoryRuntime — applyChannelDelta / getChannelSnapshot', () => {
   });
 });
 
+describe('InMemoryRuntime — getChannel (peek-only)', () => {
+  it('returns the authoritative ChannelState when the channel exists', async () => {
+    const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
+    await rt.applyChannelDelta('#foo', {
+      memberships: [{ type: 'add', conn: 'c1', nick: 'alice' }],
+    });
+
+    const chan = rt.getChannel('#foo');
+    expect(chan).toBeDefined();
+    expect(chan?.name).toBe('#foo');
+    expect(chan?.members.has('c1')).toBe(true);
+  });
+
+  it('returns undefined for an unknown channel (does not create it)', async () => {
+    const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
+    expect(rt.getChannel('#nope')).toBeUndefined();
+    // Peek-only: the channel map is still empty.
+    expect(await rt.listChannels()).toEqual([]);
+  });
+
+  it('folds the channel name with rfc1459 case-mapping on lookup', async () => {
+    const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
+    await rt.applyChannelDelta('#Foo', {
+      memberships: [{ type: 'add', conn: 'c1', nick: 'alice' }],
+    });
+    expect(rt.getChannel('#foo')).toBeDefined();
+    expect(rt.getChannel('#FOO')).toBeDefined();
+  });
+});
+
+describe('InMemoryRuntime — getChannelConnections', () => {
+  it('returns the live ConnectionState for each registered member', async () => {
+    const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
+    rt.registerConnection(makeConn('c1', 'alice'), { send: () => {}, disconnect: () => {} });
+    rt.registerConnection(makeConn('c2', 'bob'), { send: () => {}, disconnect: () => {} });
+    await rt.applyChannelDelta('#foo', {
+      memberships: [
+        { type: 'add', conn: 'c1', nick: 'alice' },
+        { type: 'add', conn: 'c2', nick: 'bob' },
+      ],
+    });
+
+    const conns = await rt.getChannelConnections('#foo');
+    expect(conns.size).toBe(2);
+    expect(conns.get('c1')?.nick).toBe('alice');
+    expect(conns.get('c2')?.nick).toBe('bob');
+  });
+
+  it('returns an empty map for an unknown channel', async () => {
+    const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
+    expect(await rt.getChannelConnections('#nope')).toEqual(new Map());
+  });
+
+  it('skips members whose connection is no longer tracked', async () => {
+    const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
+    rt.registerConnection(makeConn('c1', 'alice'), { send: () => {}, disconnect: () => {} });
+    // c2 is referenced by a membership but was never registered (and c1's
+    // registration is dropped mid-test to exercise the filter branch).
+    await rt.applyChannelDelta('#foo', {
+      memberships: [
+        { type: 'add', conn: 'c1', nick: 'alice' },
+        { type: 'add', conn: 'c2', nick: 'bob' },
+      ],
+    });
+
+    const conns = await rt.getChannelConnections('#foo');
+    expect(conns.size).toBe(1);
+    expect(conns.get('c1')?.nick).toBe('alice');
+    expect(conns.has('c2')).toBe(false);
+  });
+});
+
+describe('InMemoryRuntime — listChannels', () => {
+  it('returns an empty array when no channels exist', async () => {
+    const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
+    expect(await rt.listChannels()).toEqual([]);
+  });
+
+  it('returns a snapshot per channel, preserving original casing', async () => {
+    const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
+    await rt.applyChannelDelta('#Foo', {
+      memberships: [{ type: 'add', conn: 'c1', nick: 'alice' }],
+    });
+    await rt.applyChannelDelta('#bar', {
+      memberships: [{ type: 'add', conn: 'c1', nick: 'alice' }],
+    });
+
+    const list = await rt.listChannels();
+    expect(list).toHaveLength(2);
+    const names = list.map((c) => c.name).sort();
+    expect(names).toEqual(['#Foo', '#bar']);
+  });
+});
+
 describe('InMemoryRuntime — send', () => {
   it('delivers lines to the target connection send handler', async () => {
     const sent: RawLine[][] = [];
@@ -430,6 +545,28 @@ describe('InMemoryRuntime — sendToNick', () => {
     const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
     await expect(rt.sendToNick('ghost', 'c1', [L('hi')], [L('401')])).resolves.toBeUndefined();
   });
+
+  it('falls through to notFoundLines when the owner nick is registered but its connection is gone', async () => {
+    // Covers the stale-nick defensive branch in sendToNick: `this.nicks`
+    // still maps the nick to a connId, but that conn is no longer tracked
+    // (unregisterConnection deletes the conn without releasing its nick —
+    // the comment on unregisterConnection documents this split).
+    const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
+    const senderOut: RawLine[][] = [];
+    rt.registerConnection(makeConn('c1', 'alice'), { send: () => {}, disconnect: () => {} });
+    rt.registerConnection(makeConn('c2', 'bob'), {
+      send: (lines) => {
+        senderOut.push(lines);
+      },
+      disconnect: () => {},
+    });
+    await rt.reserveNick('alice', 'c1');
+    // Remove c1 from the connection map while leaving the nick mapping intact.
+    rt.unregisterConnection('c1');
+
+    await rt.sendToNick('alice', 'c2', [L('hi')], [L('401 bob alice :No such nick')]);
+    expect(senderOut).toEqual([[{ text: '401 bob alice :No such nick' }]]);
+  });
 });
 
 describe('InMemoryRuntime — disconnect', () => {
@@ -634,3 +771,125 @@ describe('InMemoryRuntime — admission gate', () => {
     }
   });
 });
+
+describe('InMemoryRuntime — reloadConfig (REHASH)', () => {
+  const baseConfig: ServerConfig = {
+    serverName: 'irc.example.com',
+    networkName: 'ExampleNet',
+    maxChannelsPerUser: 30,
+    maxTargetsPerCommand: 10,
+    maxListEntries: 50,
+    nickLen: 30,
+    channelLen: 50,
+    topicLen: 390,
+    quitMessage: 'Client Quit',
+  };
+
+  it('re-invokes the bound loader and returns the fresh config', async () => {
+    let version = 1;
+    const rt = new InMemoryRuntime({
+      clock: new FakeClock(0),
+      configLoader: async () => ({ ...baseConfig, serverName: `v${version}.example.com` }),
+    });
+
+    const first = await rt.reloadConfig();
+    expect(first.serverName).toBe('v1.example.com');
+    version = 2;
+    const second = await rt.reloadConfig();
+    expect(second.serverName).toBe('v2.example.com');
+  });
+
+  it('propagates a loader rejection so the actor can apply the graceful failure path', async () => {
+    const rt = new InMemoryRuntime({
+      clock: new FakeClock(0),
+      configLoader: async () => {
+        throw new Error('store unreachable');
+      },
+    });
+
+    await expect(rt.reloadConfig()).rejects.toThrow('store unreachable');
+  });
+
+  it('rejects when no loader was bound at construction', async () => {
+    const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
+
+    await expect(rt.reloadConfig()).rejects.toThrow('no config loader bound');
+  });
+});
+
+describe('InMemoryRuntime — broadcastWallops', () => {
+  it('delivers lines to every connection with the +w user mode set', async () => {
+    const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
+    const received: Record<string, RawLine[][]> = { c1: [], c2: [], c3: [] };
+    const push = (id: string) => (lines: RawLine[]) => received[id]?.push(lines);
+    // c1 has NO +w; c2 and c3 do.
+    rt.registerConnection(makeConn('c1', 'alice'), { send: push('c1'), disconnect: () => {} });
+    const c2 = makeConn('c2', 'bob');
+    c2.userModes.wallops = true;
+    rt.registerConnection(c2, { send: push('c2'), disconnect: () => {} });
+    const c3 = makeConn('c3', 'carol');
+    c3.userModes.wallops = true;
+    rt.registerConnection(c3, { send: push('c3'), disconnect: () => {} });
+
+    await rt.broadcastWallops([L(':alice WALLOPS :reboot')]);
+
+    // c1 has no +w → no delivery.
+    expect(received.c1).toHaveLength(0);
+    expect(received.c2).toHaveLength(1);
+    expect(received.c3).toHaveLength(1);
+  });
+
+  it('skips the except connection even when it has +w', async () => {
+    const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
+    const received: Record<string, RawLine[][]> = { c1: [], c2: [] };
+    const push = (id: string) => (lines: RawLine[]) => received[id]?.push(lines);
+    const oper = makeConn('c1', 'alice');
+    oper.userModes.wallops = true;
+    oper.userModes.oper = true;
+    rt.registerConnection(oper, { send: push('c1'), disconnect: () => {} });
+    const listener = makeConn('c2', 'bob');
+    listener.userModes.wallops = true;
+    rt.registerConnection(listener, { send: push('c2'), disconnect: () => {} });
+
+    await rt.broadcastWallops([L(':alice WALLOPS :hi')], 'c1');
+
+    // The oper (except) never receives their own wallops; the +w peer does.
+    expect(received.c1).toHaveLength(0);
+    expect(received.c2).toHaveLength(1);
+  });
+
+  it('does not deliver to +w connections that have unregistered', async () => {
+    const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
+    let c2Received = 0;
+    rt.registerConnection(makeConn('c1', 'alice'), {
+      send: () => {},
+      disconnect: () => {},
+    });
+    const c2 = makeConn('c2', 'bob');
+    c2.userModes.wallops = true;
+    rt.registerConnection(c2, {
+      send: () => {
+        c2Received++;
+      },
+      disconnect: () => {},
+    });
+
+    rt.unregisterConnection('c2');
+    await rt.broadcastWallops([L(':alice WALLOPS :hi')]);
+    expect(c2Received).toBe(0);
+  });
+
+  it('is a no-op when no connection has +w', async () => {
+    const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
+    let c1Received = 0;
+    rt.registerConnection(makeConn('c1', 'alice'), {
+      send: () => {
+        c1Received++;
+      },
+      disconnect: () => {},
+    });
+
+    await rt.broadcastWallops([L(':a WALLOPS :hi')]);
+    expect(c1Received).toBe(0);
+  });
+});

package/packages/irc-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/irc-core",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "private": true,
   "description": "Platform-agnostic IRC protocol core: parser, serializer, command reducers, state shapes",
   "license": "BSD-3-Clause",
@@ -18,6 +18,10 @@
     }
   },
   "scripts": {
+    "prepare": "node scripts/generate-build-info.mjs",
+    "prebuild": "node scripts/generate-build-info.mjs",
+    "pretypecheck": "node scripts/generate-build-info.mjs",
+    "pretest": "node scripts/generate-build-info.mjs",
     "build": "tsc -p tsconfig.build.json",
     "typecheck": "tsc -p tsconfig.test.json --noEmit",
     "test": "vitest run",
@@ -35,6 +39,7 @@
   "devDependencies": {
     "@stryker-mutator/core": "^9.6.1",
     "@stryker-mutator/vitest-runner": "^9.6.1",
+    "@types/node": "^26.1.1",
     "vitest": "^4.1.0"
   }
 }

package/packages/irc-core/scripts/generate-build-info.mjs

@@ -0,0 +1,31 @@
+/**
+ * Generates `src/build-info.ts` containing the build timestamp.
+ *
+ * Runs as a `prebuild` / `pretest` / `pretypecheck` / `prepare` hook so the
+ * file always exists before tsc or vitest resolves `./build-info.js` imports.
+ * The emitted file is gitignored — it is regenerated on every build so the
+ * published `dist/index.js` carries the timestamp of the build that produced
+ * it, never a stale committed value.
+ *
+ * Output shape:
+ *
+ * ```ts
+ * // AUTO-GENERATED by scripts/generate-build-info.mjs — do not edit.
+ * export const BUILD_DATE = '2024-01-01T00:00:00.000Z';
+ * ```
+ *
+ * Failures here must abort the build rather than emit a half-file: a missing
+ * or malformed `build-info.ts` would break every downstream tsc invocation.
+ */
+import { writeFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const target = resolve(here, '..', 'src', 'build-info.ts');
+
+const iso = new Date().toISOString();
+const contents = `// AUTO-GENERATED by scripts/generate-build-info.mjs — do not edit.\nexport const BUILD_DATE = ${JSON.stringify(iso)};\n`;
+
+writeFileSync(target, contents, 'utf8');
+console.log(`[generate-build-info] wrote ${target} (BUILD_DATE=${iso})`);

package/packages/irc-core/src/admission.ts

@@ -123,18 +123,18 @@ export class AdmissionStats {
     if (rec === undefined) return;
     this.records.delete(recordId);
 
-    const ipCount = this.perIpCount.get(rec.ip);
-    if (ipCount !== undefined) {
-      const next = ipCount - 1;
-      if (next <= 0) this.perIpCount.delete(rec.ip);
-      else this.perIpCount.set(rec.ip, next);
-    }
-    const userCount = this.perUserCount.get(rec.user);
-    if (userCount !== undefined) {
-      const next = userCount - 1;
-      if (next <= 0) this.perUserCount.delete(rec.user);
-      else this.perUserCount.set(rec.user, next);
-    }
+    // recordAdmission always sets both counters, so they are present for
+    // any id found in `records`. The decrement-and-delete-if-zero keeps
+    // the maps compact (no zero entries hanging around).
+    const ipCount = this.perIpCount.get(rec.ip) as number;
+    const ipNext = ipCount - 1;
+    if (ipNext <= 0) this.perIpCount.delete(rec.ip);
+    else this.perIpCount.set(rec.ip, ipNext);
+
+    const userCount = this.perUserCount.get(rec.user) as number;
+    const userNext = userCount - 1;
+    if (userNext <= 0) this.perUserCount.delete(rec.user);
+    else this.perUserCount.set(rec.user, userNext);
   }
 
   /**
@@ -147,9 +147,10 @@ export class AdmissionStats {
     if (times === undefined || times.length === 0) return 0;
     const cutoff = this.clock.now() - windowMs;
     let writeIdx = 0;
-    for (let i = 0; i < times.length; i++) {
-      const t = times[i];
-      if (t === undefined) continue;
+    // `times` is dense (only ever appended to via push, never spliced), so
+    // iterating values via for-of avoids the noUncheckedIndexedAccess trap
+    // while still allowing in-place compaction of stale entries.
+    for (const t of times) {
       if (t >= cutoff) {
         times[writeIdx++] = t;
       }

package/packages/irc-core/src/caps/capabilities.ts

@@ -3,7 +3,7 @@
  *
  * The CAP *negotiation reducer* ships separately; this module is the
  * pure-data table that advertises what caps this server supports. PLAN §3
- * lists the v1 cap set; later tickets implement each cap's behavior.
+ * lists the v1 cap set; later phases implement each cap's behavior.
  *
  * The table is exposed as a frozen, sorted list so the `CAP LS` response
  * (and any future `CAP NEW` push) serializes deterministically.
@@ -13,7 +13,11 @@
 export interface Capability {
   /** Wire name (`server-time`, `sasl`, …). */
   name: string;
-  /** Optional value (`PLAIN,EXTERNAL` for `sasl`); bare name when absent. */
+  /**
+   * Optional value parameter. For `sasl` this is the base mechanism list
+   * (`PLAIN`); the {@link saslCapValue} helper upgrades it to include
+   * `EXTERNAL` when mTLS is configured for a connection.
+   */
   value?: string;
 }
 
@@ -33,10 +37,27 @@ export const SUPPORTED_CAPABILITIES: ReadonlyArray<Capability> = Object.freeze([
   { name: 'message-tags' },
   { name: 'multi-prefix' },
   { name: 'safelist' },
-  { name: 'sasl', value: 'PLAIN,EXTERNAL' },
+  { name: 'sasl', value: 'PLAIN' },
   { name: 'server-time' },
 ]);
 
+/** Wire name of the SASL capability. */
+export const SASL_CAP_NAME = 'sasl';
+
+/**
+ * Returns the `sasl` cap value to advertise given whether an mTLS identity
+ * provider is bound for the connection.
+ *
+ * PLAIN is always available. EXTERNAL is advertised only when mTLS is
+ * configured (an `MtlsIdentityProvider` is bound) so clients on
+ * non-mTLS connections do not attempt a mechanism that cannot succeed.
+ * Operators enable EXTERNAL by configuring mTLS at the edge (CF API Shield
+ * mTLS, AWS custom-domain mTLS) — no code change required.
+ */
+export function saslCapValue(hasMtls: boolean): string {
+  return hasMtls ? 'PLAIN,EXTERNAL' : 'PLAIN';
+}
+
 /** Set form for fast membership checks during `CAP REQ`. */
 export const SUPPORTED_CAP_NAMES: ReadonlySet<string> = new Set<string>(
   SUPPORTED_CAPABILITIES.map((c) => c.name),

package/packages/irc-core/src/cloak.ts

@@ -11,7 +11,7 @@
  *
  * Implementation note: this uses a self-contained FNV-1a 32-bit hash plus a
  * short base32 encoding so the module stays pure-TS and runs unchanged on
- * Node 20, Cloudflare Workers, and Lambda. It is NOT a cryptographic MAC:
+ * Node 24, Cloudflare Workers, and Lambda. It is NOT a cryptographic MAC:
  * an attacker who learns one cloak cannot recover the secret, but a
  * determined attacker with the secret can forge cloaks. Deployments that
  * need stronger unforgeability should override this module.

package/packages/irc-core/src/commands/cap.ts

@@ -33,9 +33,11 @@
  */
 
 import {
+  SASL_CAP_NAME,
   SUPPORTED_CAPABILITIES,
   capToLsString,
   isSupportedCap,
+  saslCapValue,
   splitCapsForWire,
 } from '../caps/capabilities.js';
 import { Effect } from '../effects.js';
@@ -88,7 +90,12 @@ function handleLs(state: ConnectionState, ctx: Ctx): ReducerResult<ConnectionSta
   state.capNegotiating = true;
 
   const target = state.nick ?? '*';
-  const tokens = SUPPORTED_CAPABILITIES.map(capToLsString);
+  const hasMtls = ctx.mtlsIdentity !== undefined;
+  const tokens = SUPPORTED_CAPABILITIES.map((cap) =>
+    cap.name === SASL_CAP_NAME
+      ? capToLsString({ ...cap, value: saslCapValue(hasMtls) })
+      : capToLsString(cap),
+  );
   const maxLen = maxCapsContentLen(ctx, target);
   const chunks = splitCapsForWire(tokens, maxLen);
 

package/packages/irc-core/src/commands/index.ts

@@ -19,6 +19,8 @@ export { handleJoinZero, isValidChannelName, joinReducer } from './join.js';
 export { partReducer } from './part.js';
 export { motdReducer } from './motd.js';
 export { operReducer, matchOperCred } from './oper.js';
+export { rehashReducer, rehashLine, buildRehashTrailing } from './rehash.js';
+export type { RehashResult } from './rehash.js';
 export {
   isChannelTarget,
   noticeChannelReducer,
@@ -27,6 +29,8 @@ export {
   privmsgUserReducer,
 } from './privmsg.js';
 export { kickReducer } from './kick.js';
+export { killReducer, formatKillReason } from './kill.js';
+export { wallopsReducer, wallopsLine } from './wallops.js';
 export { topicReducer } from './topic.js';
 export { namesReducer } from './names.js';
 export { listReducer } from './list.js';
@@ -34,11 +38,16 @@ export { channelModeReducer, userModeReducer } from './mode.js';
 export { inviteReducer } from './invite.js';
 export { whoReducer } from './who.js';
 export { whoisReducer } from './whois.js';
+export { whowasReducer } from './whowas.js';
+export { traceReducer } from './trace.js';
+export { lusersReducer } from './lusers.js';
+export { statsReducer } from './stats.js';
 export { generateIsupport } from './isupport.js';
 export { capReducer } from './cap.js';
 export { emitChghost } from './chghost.js';
 export type { ChgHostInput } from './chghost.js';
 export { awayReducer } from './away.js';
+export { setnameReducer } from './setname.js';
 export { authenticateReducer } from './sasl.js';
 export {
   chathistoryReducer,
@@ -47,3 +56,11 @@ export {
   CHATHISTORY_CAP,
 } from './chathistory.js';
 export { tagmsgChannelReducer, tagmsgUserReducer } from './tagmsg.js';
+export {
+  versionReducer,
+  timeReducer,
+  adminReducer,
+  infoReducer,
+} from './server-info.js';
+export { userhostReducer, formatUserhostReply } from './userhost.js';
+export { isonReducer } from './ison.js';