serverless-ircd 0.6.0 → 0.8.0

package/README.md

@@ -6,7 +6,7 @@ platform-agnostic core, and two thin adapters run it on **Cloudflare Workers**
 
 One TypeScript codebase. Two serverless substrates.
 
-> **Status:** **v0.6.0 (preview).** The pure protocol core, the
+> **Status:** **v0.8.0 (preview).** The pure protocol core, the
 > `IrcRuntime` port + in-memory runtime, a runnable local CLI server,
 > the **Cloudflare Workers** adapter, and the **AWS** (API Gateway
 > WebSocket + Lambda + DynamoDB + CDK) adapter are all functional and
@@ -19,30 +19,44 @@ One TypeScript codebase. Two serverless substrates.
 > deferred IRC verbs (`KILL`, `REHASH`, `LUSERS` + `STATS`, `TRACE`,
 > `WALLOPS`, `SETNAME`) all land, and the S2S (`CONNECT` / `SQUIT` /
 > `LINKS`) and obsolete RFC 2812 (`SERVICE` / `SUMMON` / `USERS`) verbs
-> are formally dropped. **v0.6.0 lands the IRCv3 extension sweep
-> (Phase 12)** — ten caps (`account-notify`, `msgid`,
+> are formally dropped. v0.6.0 landed the **IRCv3 extension sweep**
+> — ten caps (`account-notify`, `msgid`,
 > `standard-replies`, `MONITOR`, `labeled-response`, `sts`,
 > `draft/typing`, `draft/multiline`, `draft/read-marker`,
 > `draft/pre-away`), the ISUPPORT tokens for the new caps, and the
-> read-only user mode `S` (TLS connected) — closes the
-> required-`serverName` config gate, ships a `tools/load-test`
-> 10k-connection harness, and lifts `aws-adapter` / `aws-stack` over
-> the 90% coverage gate (CF packages moved to istanbul coverage,
-> clearing the v0.5.0 workerd-incompatibility caveat). Remaining 0.x
-> work: the client compatibility sweep (WeeChat / HexChat / IRCCloud /
-> TheLounge), IRC services (NickServ / ChanServ / HostServ /
-> OperServ / MemoServ), a web client (vendored Kiwi IRC), and driving
-> the remaining sub-100% packages to full coverage. See
-> `CHANGELOG.md` for the per-release manifests.
+> read-only user mode `S` (TLS connected). **v0.7.0 lands the web
+> client**: a vendored **Kiwi IRC** SPA served at `/webclient/`
+> and a static landing page at `/` directly by the Cloudflare Worker,
+> with **Cross-Site WebSocket Hijacking (CSWSH) defense** wired into
+> the WS upgrade path (same-origin auto-derive by default, optional
+> `WEB_ORIGINS` allowlist for cross-origin deploys) — the browser
+> opens a native `wss://` straight to the existing IRC-over-WebSocket
+> endpoint. **v0.8.0 lands integrated IRC services** — NickServ
+> (`REGISTER` / `IDENTIFY` / `DROP` / `INFO` / `SET ENFORCE` +
+> nick enforcement), ChanServ (`REGISTER` / `DROP` / `SET` /
+> `ACCESS` / `LEVELS` + the `+r` / `+R` / `+M` channel modes),
+> HostServ (`ON` / `OFF` / `REQUEST` + oper `SET` / `APPROVE`),
+> OperServ (`AKILL` / `JUPE` / `RAW`), and MemoServ
+> (`SEND` / `LIST` / `READ` / `DEL`) — backed by a `ServicesStore`
+> port with **persistent D1 (Cloudflare) and DynamoDB (AWS)
+> backends** (write-behind, surviving redeploys). The SASL
+> `AccountStore` and NickServ accounts are **unified** under one
+> scrypt-hashed credential store, `PASS <nick>:<password>` identifies
+> at registration, and `draft/read-marker` gains the timestamp-based
+> `MARKREAD` verb. Remaining 0.x work: the client compatibility sweep
+> (WeeChat / HexChat / IRCCloud / TheLounge), the Playwright
+> browser-driven e2e for the SPA, and driving the remaining
+> sub-100% packages to full coverage. See `CHANGELOG.md` for the
+> per-release manifests.
 
 ---
 
 ## Why
 
 IRC servers have historically been long-running stateful processes. This
-project explores what happens when the protocol brain is a set of **pure
-reducers** and the only platform-specific code is the side-effect plumbing
-(transports, registries, fanout). The payoff:
+project moves the protocol logic into a set of **pure reducers** so that
+the only platform-specific code is the side-effect layer (transports,
+registries, fanout). The consequences:
 
 - Every command handler is a trivial unit test: arrange state, apply a message,
   assert the new state and emitted effects.
@@ -54,7 +68,7 @@ reducers** and the only platform-specific code is the side-effect plumbing
 
 ## Architecture
 
-Hexagonal / ports-and-adapters. The core reasons about IRC; adapters move bytes.
+Hexagonal / ports-and-adapters. The core implements the IRC protocol; adapters handle I/O.
 
 ```
 ┌─────────────────────────────────────────────────────────────────┐
@@ -94,7 +108,7 @@ function. Both feed the same `ConnectionActor` through a `Transport`
 seam (`WsTextFrameTransport` vs. `TcpByteStreamTransport`); the
 parser/reducer/dispatch pipeline is identical.
 
-### The key idea: pure reducers + location-of-authority
+### Design: pure reducers + location-of-authority
 
 Each command handler is a pure function:
 
@@ -119,6 +133,7 @@ Each reducer runs in whichever authority **owns** the state it mutates:
 | PRIVMSG/NOTICE to channel   | Channel entity          | Fanout (reads roster)        |
 | Nick collision check        | Registry entity         | Nick → Connection map        |
 | NAMES / WHO / WHOIS         | Reads snapshots         | (no mutation)                |
+| Services (`PRIVMSG NickServ`/`ChanServ`/…) | Connection entity | `ServicesStore` (account/channel/vhost/memo state) |
 
 ---
 
@@ -127,20 +142,21 @@ Each reducer runs in whichever authority **owns** the state it mutates:
 ```
 ServerlessIRCd/
 ├── packages/
-│   ├── irc-core/          pure protocol + reducers (the brain)
+│   ├── irc-core/          pure protocol + reducers
 │   ├── irc-server/        orchestration, IrcRuntime port, dispatch
 │   ├── in-memory-runtime/ reference runtime (used by tests + local CLI)
 │   ├── irc-test-support/  parametrized IRC scenario suite + harness seam
 │   ├── cf-adapter/        Durable Objects + CfRuntime
 │   └── aws-adapter/       Lambda + DynamoDB + AwsRuntime
 ├── apps/
-│   ├── cf-worker/         worker entry, DO migrations, bindings
+│   ├── cf-worker/         worker entry, DO migrations, bindings, [assets] + CSWSH gate
 │   ├── cf-tcp-container/  Spectrum + Container origin for irc+tls :6697
 │   ├── aws-stack/         CDK stack (APIGW WS + NLB + Lambda streaming + DynamoDB)
+│   ├── web/               vendored Kiwi IRC SPA (→ /webclient/) + static landing page (→ /)
 │   └── local-cli/         runnable WS + TCP server using in-memory-runtime
 ├── tools/
 │   ├── tcp-ws-forwarder/  local TCP↔ws/wss bridge for stock IRC clients
-│   ├── load-test/         synthetic WebSocket IRC client farm (10k conns, p50/p95/p99, drop rate)
+│   ├── load-test/         synthetic WebSocket IRC client pool (10k conns, p50/p95/p99, drop rate)
 │   ├── ci-hardening/      coverage-gate + mutation-config validators
 │   ├── seed-aws-accounts.ts  scrypt-hash SASL PLAIN accounts into DynamoDB
 │   └── seed-cf-accounts.ts   scrypt-hash SASL PLAIN accounts into Cloudflare D1
@@ -174,6 +190,7 @@ pin is resolved automatically:
 ```bash
 corepack enable            # lets the pinned pnpm@11 run on any Node ≥ 24
 
+git submodule update --init   # docs + apps/web Kiwi upstream sources
 pnpm install              # install workspace deps
 
 pnpm build                # build all packages (turbo)
@@ -191,6 +208,14 @@ pnpm mutation             # Stryker spot-check on irc-core (protocol + commands)
 pnpm clean                # remove dist/coverage/.turbo + node_modules
 ```
 
+The web client (`apps/web`) vendors Kiwi IRC as a git submodule. Building it
+needs the upstream sources (`git submodule update --init apps/web/upstream`)
+and `yarn` (Kiwi ships a `yarn.lock`; `corepack enable` provides it):
+
+```bash
+pnpm --filter web build   # builds the Kiwi SPA into apps/web/dist/webclient/ (/webclient/)
+```
+
 Coverage reports are written to `packages/*/coverage/`. CI (`.github/workflows/ci.yml`)
 runs lint, typecheck, the coverage gate, the parametrized contract suite, and a
 Stryker mutation spot-check on every push and pull request. Coverage thresholds
@@ -210,7 +235,7 @@ that share one runtime, so a TCP client and a WS client can see each other
 
 - a **WebSocket** listener (the serverless transport) on `--port`, and
 - an **RFC-style TCP** listener on `--tcp-port` (default `<port> + 1`) so
-  real IRC clients (WeeChat, HexChat, irssi, …) can dial in directly.
+  real IRC clients (WeeChat, HexChat, irssi, …) can connect directly.
 
 First build the workspace (the CLI runs from compiled `dist/`):
 
@@ -243,11 +268,55 @@ On startup it logs a JSON line like:
 | `--motd-file <p>`  | built-in      | Read MOTD lines from this file (one per line).         |
 | `--server-name <h>`| `irc.localhost` | Server hostname advertised in `001`/`005`. Production MUST override. |
 | `--network-name <n>`| `LocalNet`   | Network name advertised in `005 NETWORK=…`.            |
+| `--server-password <p>`|           | Server-password gate. When set, every connection must supply `PASS <p>` (or SASL-identify) before `001`. Treat as a secret. |
 | `-h, --help`       |               | Show help and exit.                                    |
 
 Pass `--host 0.0.0.0` to expose the server on all interfaces. `SIGINT` /
 `SIGTERM` perform a graceful shutdown (closes active sockets, then exits).
 
+### Server password (`SERVER_PASSWORD` / `--server-password`)
+
+All three adapters (Cloudflare Worker, AWS Lambda, local CLI) support an
+optional **server-password gate**. When the knob is set, every connection
+must supply the matching `PASS <value>` before `001 RPL_WELCOME` is
+emitted; when unset or empty the gate is disabled (the default).
+
+| Adapter        | Knob                                                                          |
+|----------------|-------------------------------------------------------------------------------|
+| Cloudflare     | `wrangler secret put SERVER_PASSWORD` (Workers secret; never a `[vars]` entry). |
+| AWS            | `SERVER_PASSWORD` Lambda env var (sourced from Secrets Manager / SSM).        |
+| local CLI      | `--server-password <p>` flag, or `serverPassword` on `StartServerOptions`.    |
+
+On a mismatched/missing `PASS` the server emits `464 ERR_PASSWDMISMATCH`
+and disconnects with reason `Bad Password`. **SASL short-circuit:** a
+connection that has authenticated an account via SASL
+(`AUTHENTICATE PLAIN` / `EXTERNAL`) is exempt — the reducer's gate
+treats `state.account !== undefined` as already authorised, so a
+deployment with both `SERVER_PASSWORD` and configured SASL accounts
+does not need to hand the shared password to identified users. The
+server-wide gate is a shared deployment secret (never log it); per-user
+credentials still go through the hashed SASL account store
+(`HashedAccountStore` / D1 / DynamoDB), which is unaffected.
+
+**PASS-based account login:** in addition to SASL, a client may identify
+to its NickServ account at registration by sending
+`PASS <nick>:<password>` (the same `<nick>:<password>` literal the
+`SASL_ACCOUNTS` seed tooling uses). When an `AccountStore` is configured,
+`NICK alice` + `PASS alice:hunter2` + `USER …` verifies the credentials
+against the account store and, on success, logs the connection in as
+`alice` — emitting `900 RPL_LOGGEDIN` + `903 RPL_SASLSUCCESS` (the same
+"account is set" numerics SASL uses) before `001 RPL_WELCOME`, stamping
+user mode `+r`, and running the same read-marker / away / memo replay as
+a SASL login. The nick left of the `:` must match the `NICK` sent; a bare
+`PASS <value>` with no colon is always treated as a server-password
+candidate, never as account credentials. A wrong password or unknown nick
+is indistinguishable (no `904`/`464` from the auth path) and the
+connection simply proceeds un-identified when no server password is set.
+This composes with the gate above by precedence: an already-identified
+connection (SASL or PASS-auth) satisfies the gate; a `<nick>:<password>`
+that fails verify never matches a bare shared secret, so a server with
+both configured still rejects it with `464`.
+
 ### Connecting
 
 The WebSocket listener speaks WebSocket text frames (one IRC message per
@@ -270,9 +339,9 @@ given.
 The local CLI ships a built-in TCP listener, so no bridge is needed for local
 development. Deployed stacks (Cloudflare Workers and AWS API Gateway) are
 WebSocket-only, so a stock TCP IRC client (WeeChat, HexChat, irssi, …) cannot
-dial them directly. `tools/tcp-ws-forwarder` is a local bridge for that case:
+connect to them directly. `tools/tcp-ws-forwarder` is a local bridge for that case:
 it listens on a TCP port and, for each connection, opens one WebSocket to a
-`ws://` / `wss://` target and pumps IRC lines both ways — reassembling the TCP
+`ws://` / `wss://` target and forwards IRC lines both directions — reassembling the TCP
 byte stream into one message per WS frame outbound, and normalizing inbound
 frames back to canonical CRLF.
 
@@ -317,9 +386,9 @@ against any line-oriented WebSocket endpoint.
 
 ## Load testing (`tools/load-test`)
 
-A synthetic WebSocket IRC client farm (PLAN §7, Phase 7). It opens N
+A synthetic WebSocket IRC client pool (PLAN §7). It opens N
 connections to a `ws://` / `wss://` target, registers each (NICK/USER),
-joins a channel, and optionally chats. Per-phase **p50 / p95 / p99
+joins a channel, and optionally chats. Per-stage **p50 / p95 / p99
 latency** (connect / register / join / message) and the **drop rate**
 are captured, then printed as a markdown report to stdout (and written
 to `--report <path>` when given).
@@ -364,6 +433,66 @@ report).
 
 ---
 
+## Web client (`apps/web`)
+
+A vendored **Kiwi IRC** SPA served at `/webclient/` and a static project
+landing page served at `/`, both baked out of `apps/web/dist/` and
+served directly by the Cloudflare Worker via its `[assets]` binding.
+The browser opens a native `wss://` directly to the Worker's
+IRC-over-WebSocket endpoint — no proxy, gateway, or transport
+adaptation in the request path. See `docs/WebClientGuide.md` for the
+end-to-end contributor/operator guide.
+
+Build the SPA + landing page (needs the submodule + `yarn`, provided by
+`corepack enable`):
+
+```bash
+git submodule update --init apps/web/upstream   # one-time per clone
+pnpm --filter web build:staging                 # or :prod / default
+# → apps/web/dist/index.html        (landing page, served at /)
+# → apps/web/dist/webclient/index.html    (Kiwi SPA, served at /webclient/)
+# → apps/web/dist/webclient/static/config.json  (baked, env-specific)
+```
+
+Then run everything locally (Worker serves SPA + landing page + WS on
+one origin):
+
+```bash
+pnpm build                                     # workspace packages
+pnpm --filter @serverless-ircd/cf-worker dev   # http://localhost:8787
+#   /        → landing page
+#   /webclient/    → Kiwi SPA (opens ws://localhost:8787/)
+#   /health  → plaintext liveness
+```
+
+Deploy staging (Worker + assets in one command):
+
+```bash
+pnpm deploy:cf:staging   # wrangler deploy --env staging
+```
+
+### WebSocket Origin policy (CSWSH defense)
+
+WebSocket upgrades do **not** follow the same-origin policy, so the
+Worker rejects browser upgrades whose `Origin` is not allowed — see
+`apps/cf-worker/src/origin-allowlist.ts` and the SPA guide §5. Two
+modes, evaluated in order:
+
+1. **Explicit allowlist** — set `WEB_ORIGINS` (comma-separated) for
+   cross-origin deploys (SPA on a different domain than the Worker,
+   e.g. Cloudflare Pages). Only listed origins proceed.
+2. **Same-origin auto-derive (the default)** — when `WEB_ORIGINS` is
+   unset/empty, the Worker compares the browser's `Origin` against the
+   request's own origin. Match → proceed; mismatch → `403 Forbidden`.
+
+`WEB_ORIGINS` is **optional** — same-origin auto-derive needs zero
+per-env config and works for `*.workers.dev`, custom domains, and
+preview URLs alike. Non-browser clients (curl, WeeChat, the
+`tcp-ws-forwarder`, scripted harnesses) never send `Origin` and pass
+through unchanged in both modes.
+
+---
+
 ## WebSocket transport (IRCv3 subprotocols)
 
 The WebSocket entry points (the local CLI, the Cloudflare Worker, and the
@@ -428,49 +557,49 @@ suite passes against every runtime, both adapters are deployed to staging,
 and ≥3 reference clients (WeeChat, HexChat, IRCCloud, TheLounge) connect
 cleanly. Per-release manifests live in `CHANGELOG.md`.
 
-- **Phase 0** — Foundation (monorepo, turbo, vitest, biome, CI). ✅
-- **Phase 1** — Pure protocol engine: reducers, IRCv3 caps, isupport,
+- **Foundation** (monorepo, turbo, vitest, biome, CI). ✅
+- **Pure protocol engine** — reducers, IRCv3 caps, isupport,
   SASL (`PLAIN`), token-bucket flood control, chat history. ✅ (most in
   **v0.1.0**; SASL/flood/chathistory landed in **v0.2.0**).
-- **Phase 2** — `IrcRuntime` port, in-memory runtime, `ConnectionActor`,
+- **`IrcRuntime` port** — in-memory runtime, `ConnectionActor`,
   local CLI, parametrized contract suite. ✅ landed in **v0.1.0**.
-- **Phase 3** — Cloudflare adapter (ConnectionDO / ChannelDO / RegistryDO).
+- **Cloudflare adapter** (ConnectionDO / ChannelDO / RegistryDO).
   ✅ landed in **v0.1.0** (staging deploy via CI; prod deploy is manual).
-- **Phase 4** — AWS adapter (APIGW WS + Lambda + DynamoDB + CDK).
+- **AWS adapter** (APIGW WS + Lambda + DynamoDB + CDK).
   ✅ landed in **v0.2.0** (staging deploy via CI; prod deploy is manual).
-- **Phase 5** — Observability, security hardening, config, CI gates.
+- **Observability, security hardening, config, CI gates.**
   ✅ landed across v0.2.0–v0.4.0 (logger port, server-password, cloaking,
   admission limits, coverage + mutation gates, OPER credential auth, the
   Cloudflare config loader, and AWS max-clients admission); the
   required-`serverName` gate closed in **v0.6.0**.
-- **Phase 6** — TLS hardening & raw TCP transport (`irc+tls :6697`).
+- **TLS hardening & raw TCP transport** (`irc+tls :6697`).
   ✅ landed in **v0.4.0**: generalized `ConnectionActor` transport seam,
   Cloudflare Spectrum + Container origin, AWS NLB + Lambda streaming,
   mTLS → SASL `EXTERNAL`, transport-parametrized contract suite, ADR-009.
-- **Phase 7 — Load testing & compatibility sweep.** 🔄 partial as of
+- **Load testing & compatibility sweep.** 🔄 partial as of
   **v0.6.0**: the `tools/load-test` 10k-connection harness is in-tree;
   the formal 10k-connection report per platform and the client
   compatibility matrix (WeeChat / HexChat / IRCCloud / TheLounge) are
   still pending.
-- **Phase 8 — PLAN-FIXES remediation.** ✅ landed across v0.3.0–v0.4.0
+- **PLAN-FIXES remediation.** ✅ landed across v0.3.0–v0.4.0
   (MessageStore wired into all three adapters, AccountStore end-to-end,
   the DynamoDB `Accounts` table decided, CF enumeration RPCs, AWS QUIT
   fanout, `OPER` / `TAGMSG` / `WHOWAS`, RFC 1459 case-mapping, real
   MOTD, config-driven server identity, AWS max-clients admission,
   CF D1 SASL store, and a sweep of dead-code / stale-comment cleanup).
-- **Phase 9 — Runtime & tooling baseline.** ✅ landed in **v0.4.0**
+- **Runtime & tooling baseline.** ✅ landed in **v0.4.0**
   (Node ≥ 24 / pnpm 11).
-- **Phase 10 — IRCv3 WebSocket extension.** ✅ landed in **v0.4.0**:
+- **IRCv3 WebSocket extension.** ✅ landed in **v0.4.0**:
   `text.ircv3.net` / `binary.ircv3.net` subprotocol negotiation +
   per-message framing across the CF Worker, AWS APIGW, local CLI, and
   `tcp-ws-forwarder` (510-byte budget, `1009`/`1003` close codes,
   legacy fallback).
-- **Phase 11 — Deferred IRC verbs.** ✅ landed in **v0.5.0**: `KILL`,
+- **Deferred IRC verbs.** ✅ landed in **v0.5.0**: `KILL`,
   `REHASH`, `LUSERS` + `STATS`, `TRACE`, `WALLOPS`, `SETNAME`, plus
   the formal drop of the S2S (`CONNECT`/`SQUIT`/`LINKS`) and obsolete
   RFC 2812 (`SERVICE`/`SUMMON`/`USERS`) verbs. The protocol surface is
   feature-complete for modern clients.
-- **Phase 12 — IRCv3 extension sweep.** ✅ landed in **v0.6.0**: ten
+- **IRCv3 extension sweep.** ✅ landed in **v0.6.0**: ten
   negotiated caps (`account-notify`, `msgid`, `standard-replies`,
   `MONITOR`, `labeled-response`, `sts`, `draft/typing`,
   `draft/multiline`, `draft/read-marker`, `draft/pre-away`), the
@@ -479,19 +608,32 @@ cleanly. Per-release manifests live in `CHANGELOG.md`.
   (TLS connected), and the async push fanout seam (Registry hooks →
   `MONITOR` online/offline, `BroadcastWallops`-style caps-gated
   delivery).
-- **Phase 13 — IRC services.** ⬳ pending: `ServicesStore` port +
-  NickServ / ChanServ / HostServ / OperServ / MemoServ. Adapter
-  backends (D1 / DynamoDB) ship alongside; until then
-  `draft/read-marker` and `draft/pre-away` use in-memory reference
-  stores and do not survive an adapter restart.
-- **Phase 14 — Web client.** ⬳ pending: vendored Kiwi IRC SPA served
-  from the Worker, WS Origin allowlist (CSWSH defense), landing page,
-  headless browser e2e.
-- **Coverage hardening.** 🔄 partial as of **v0.6.0**: `aws-adapter`
-  and `aws-stack` now clear the 90% gate (CI boots DynamoDB Local via
-  a JRE; the CDK synth no longer re-bundles under coverage), and the
-  CF packages moved to istanbul to clear the v0.5.0 workerd-incompat.
-  Follow-ups drive each remaining sub-100% package to 100%.
+- **IRC services.** ✅ landed in **v0.8.0**: `ServicesStore` port
+  + integrated NickServ (`REGISTER`/`IDENTIFY`/`DROP`/`INFO`/`SET
+  ENFORCE` + nick enforcement), ChanServ (`REGISTER`/`DROP`/`SET`/
+  `ACCESS`/`LEVELS` + `+r`/`+R`/`+M`), HostServ
+  (`ON`/`OFF`/`REQUEST` + oper `SET`/`APPROVE`), OperServ
+  (`AKILL`/`JUPE`/`RAW`), MemoServ (`SEND`/`LIST`/`READ`/`DEL`).
+  Persistent backends ship alongside — **D1** on Cloudflare,
+  **DynamoDB** on AWS — both write-behind so registrations survive
+  redeploys. The SASL `AccountStore` and NickServ accounts are
+  **unified** under one scrypt-hashed credential store, `PASS
+  <nick>:<password>` identifies at registration, and `draft/read-marker`
+  / `draft/pre-away` now persist through the `ServicesStore` (no longer
+  in-memory-only). See `docs/Services.md`.
+- **Web client.** 🔄 partial as of **v0.7.0**: a vendored
+  Kiwi IRC SPA is served at `/webclient/` and a static landing page at `/`
+  by the Cloudflare Worker via an `[assets]` binding, with a Zod-
+  validated per-env config matrix and **CSWSH defense** (same-origin
+  auto-derive + optional `WEB_ORIGINS` allowlist). The Playwright
+  headless-browser e2e is the remaining open ticket.
+  See `docs/WebClientGuide.md` for the contributor/operator guide.
+- **Coverage hardening.** 🔄 partial as of **v0.7.0**: `aws-adapter`
+  and `aws-stack` clear the 90% gate (v0.6.0); the CF packages run
+  under istanbul (v0.6.0). The remaining packages (`cf-adapter`,
+  `local-cli`, `load-test`, `cf-tcp-container`, `tcp-ws-forwarder`,
+  `irc-test-support`, `web`) are **above the gate but below 100%** —
+  follow-ups drive each to 100%.
 
 ---
 
@@ -516,10 +658,34 @@ RFC 2812 verbs `SERVICE`/`SUMMON`/`USERS` are **formally dropped** as of
 v0.5.0 — they return `421 ERR_UNKNOWNCOMMAND`, and their reserved
 numerics have been removed. S2S linking is a PLAN non-goal.)
 
-**Channel modes:** `o v b i k l t n m s p`.
+**Channel modes:** `o v b i k l t n m s p`, plus the
+services-derived modes `r` (registered), `R` (block unidentified
+join/message), `M` (moderated-identified) — settable only via ChanServ,
+not via `MODE`.
 **User modes:** `i`, `o` (local only), `w`, `s`, and the read-only `S`
 (TLS connected — set by the transport at registration, surfaced in WHOIS
-via `276 RPL_WHOISSECURE`, not settable via `MODE`).
+via `276 RPL_WHOISSECURE`, not settable via `MODE`) and the read-only
+`r` (registered — set by NickServ `IDENTIFY` / SASL login, surfaced as
+`+r`, not settable via `MODE`).
+
+**Integrated IRC services** (v0.8.0): the service nicks `NickServ`,
+`ChanServ`, `HostServ`, `OperServ`, and `MemoServ` are reserved and
+routed to dedicated pure reducers when a `ServicesStore` is bound —
+there is **no separate services process and no S2S link**. Reached via
+`PRIVMSG <Service> :<subcommand>`:
+NickServ (`REGISTER` / `IDENTIFY` / `DROP` / `INFO` / `SET ENFORCE` +
+nick enforcement on the `NICK` path), ChanServ (`REGISTER` / `DROP` /
+`SET` / `INFO` / `ACCESS` / `LEVELS` + auto-op on `JOIN`), HostServ
+(`ON` / `OFF` / `REQUEST` + oper `SET` / `APPROVE` / `LIST`, with
+`CHGHOST` fanout), OperServ (`AKILL` / `JUPE` / `UNJUPE` / `RAW`), and
+MemoServ (`SEND` / `LIST` / `READ` / `DEL` with queue delivery at
+identify). The SASL `AccountStore` and NickServ accounts share one
+scrypt-hashed credential store, so a registered nick is also a SASL
+login and vice versa. Backends: D1 on Cloudflare, DynamoDB on AWS,
+in-memory for the local CLI / tests (all write-behind; registrations
+survive redeploys). When no store is bound, services commands reply
+`501` and the rest of the daemon is unaffected. See
+`docs/Services.md` for the full reference.
 
 **IRCv3 extensions (negotiated via `CAP`):** `message-tags` (incl. the
 `TAGMSG` command), `server-time`, `account-tag`, `account-notify`
@@ -536,7 +702,9 @@ shared between live and `draft/chathistory` replay), `standard-replies`
 so compliant clients upgrade from plaintext to TLS and pin the secure
 listener), `draft/chathistory`, `safelist`, `draft/typing` (typing-indicator
 broadcast), `draft/multiline=<n>` (multi-line `BATCH`, default 4096-byte
-budget), `draft/read-marker` (per-account persisted last-read), and
+budget), `draft/read-marker` (per-account persisted last-read, with the
+timestamp-based `MARKREAD <target> [timestamp]` verb plus the
+`+draft/read-marker` tag fanout), and
 `draft/pre-away` (per-account persisted away reason, replayed at
 identify). Case-insensitive nick/channel comparison uses **RFC 1459**
 case-mapping (advertised via `005 CASEMAPPING=rfc1459`). The new
@@ -563,13 +731,32 @@ bridges a stock TCP client to a deployed WebSocket endpoint.
   `irc+tls :6697`, SASL `EXTERNAL`/mTLS, WHOWAS + remaining verbs, D1 account
   store, Node 24/pnpm 11), v0.5.0 (deferred IRC verbs `KILL` / `REHASH`
   / `LUSERS` + `STATS` / `TRACE` / `WALLOPS` / `SETNAME`, plus the formal
-  drop of the S2S and obsolete RFC 2812 verbs), and **v0.6.0** (the IRCv3
+  drop of the S2S and obsolete RFC 2812 verbs), v0.6.0 (the IRCv3
   extension sweep — `account-notify`, `msgid`, `standard-replies`,
   `MONITOR`, `labeled-response`, `sts`, `draft/typing`, `draft/multiline`,
   `draft/read-marker`, `draft/pre-away`, plus user mode `S`; the
   required-`serverName` gate; `tools/load-test`; aws-adapter / aws-stack
   coverage unblocks; CF packages moved to istanbul; deploys now
-  manual-only).
+  manual-only), and **v0.7.0** (the web client — vendored Kiwi IRC SPA
+  at `/webclient/`, static landing page at `/`, Cloudflare Worker
+  `[assets]` binding, per-env Zod-validated config matrix, and CSWSH
+  defense via same-origin auto-derive + optional `WEB_ORIGINS`;
+  `/health` becomes an explicit route; mutation-killing tests for
+  `irc-core`'s parser / batch / numerics), and **v0.8.0** (integrated
+  IRC services — NickServ / ChanServ / HostServ / OperServ / MemoServ
+  backed by a `ServicesStore` port with persistent D1 + DynamoDB
+  backends; unified SASL + NickServ scrypt-hashed account store;
+  `PASS <nick>:<password>` registration login; the `draft/read-marker`
+  `MARKREAD` verb).
+- `docs/Services.md` — operator and contributor reference for the
+  integrated IRC services: architecture (integrated vs. pseudo-client),
+  the per-service command tables, the `+r`/`+R`/`+M` modes, nick
+  enforcement, adapter backends, and an end-to-end registration
+  walkthrough.
+- `docs/WebClientGuide.md` — end-to-end contributor/operator doc for the
+  web client: build pipeline, per-env config matrix, CSWSH rationale and
+  the optional `WEB_ORIGINS` var, local dev, optional Cloudflare Pages
+  alternative, and troubleshooting.
 - `docs/Cloudflare-TCP-Deployment.md` and `docs/AWS-TCP-Deployment.md` —
   end-to-end guides for the `:6697` TCP+TLS variants (Spectrum/Container on
   CF, NLB + Lambda streaming on AWS), including mTLS trust-store setup.

package/apps/aws-stack/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/aws-stack",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "private": true,
   "description": "AWS CDK v2 stack: API Gateway v2 WebSocket API, Lambda, DynamoDB tables, least-privilege IAM",
   "license": "BSD-3-Clause",