serverless-ircd 0.7.0 → 0.8.0

package/apps/cf-worker/tests/smoke.test.ts

@@ -32,9 +32,9 @@ declare global {
       MOTD_LINES: string;
       // Static-assets binding (`[assets]` in `wrangler.test.toml`, pointed at
       // `tests/fixtures/web-dist`). Production points at `apps/web/dist`; the
-      // fixture mirrors the `app/index.html` + `index.html` layout so the
-      // worker's fall-through routing is exercised without depending on the
-      // Kiwi SPA build.
+      // fixture mirrors the `webclient/index.html` + `index.html` layout so
+      // the worker's fall-through routing is exercised without depending on
+      // the Kiwi SPA build.
       ASSETS: Fetcher;
     }
   }
@@ -61,8 +61,8 @@ describe('cf-worker deploy glue', () => {
     expect(body.toLowerCase()).toContain('serverlessircd');
   });
 
-  it('GET /app/ serves the SPA index from the [assets] binding', async () => {
-    const response = await worker.fetch(new Request('https://irc.example.com/app/'), env);
+  it('GET /webclient/ serves the SPA index from the [assets] binding', async () => {
+    const response = await worker.fetch(new Request('https://irc.example.com/webclient/'), env);
     expect(response.status).toBe(200);
     const body = await response.text();
     // The fixture SPA HTML carries this marker so the test asserts the

package/apps/cf-worker/wrangler.test.toml

@@ -14,15 +14,15 @@ compatibility_flags = ["nodejs_compat"]
 # Static-assets binding. Production points at `../../apps/web/dist` (the Kiwi
 # SPA + landing page built by `apps/web`); the test config points at a fixture
 # so the smoke suite does not depend on the (slow) Kiwi upstream build. The
-# fixture mirrors the `app/index.html` + `index.html` layout; the worker's
-# fall-through routing (`/health` → plaintext, else → ASSETS) is what's under
-# test, not the SPA contents.
+# fixture mirrors the `webclient/index.html` + `index.html` layout; the
+# worker's fall-through routing (`/health` → plaintext, else → ASSETS) is
+# what's under test, not the SPA contents.
 [assets]
 directory = "./tests/fixtures/web-dist"
 binding = "ASSETS"
-# `none` returns 404 for unmatched paths — the SPA lives at `/app/` and the
-# landing page at `/`, both with real `index.html` files, so no SPA fallback
-# is required.
+# `none` returns 404 for unmatched paths — the SPA lives at `/webclient/` and
+# the landing page at `/`, both with real `index.html` files, so no SPA
+# fallback is required.
 not_found_handling = "none"
 # Mirror production: route every request through the Worker first so WS
 # upgrades at `/` aren't intercepted by the asset platform (which would

package/apps/cf-worker/wrangler.toml

@@ -72,8 +72,9 @@ This is a deployed Cloudflare Worker.
 ## The `[assets]` binding serves `apps/web/dist` (built by `pnpm --filter web
 ## build`). The non-WS, non-`/health` branch of `worker.ts`'s `fetch` falls
 ## through to this binding, so:
-##   • `/app/`              → the Kiwi IRC SPA (`dist/app/index.html` + its
-##                            hashed assets under `/app/assets/...`).
+##   • `/webclient/`          → the Kiwi IRC SPA (`dist/webclient/index.html`
+##                            + its hashed assets under
+##                            `/webclient/assets/...`).
 ##   • `/`                  → the landing page (`dist/index.html`, shipped by
 ##                            the `apps/web` build).
 ##   • `/health`            → plaintext liveness (handled by the worker, not
@@ -86,9 +87,10 @@ This is a deployed Cloudflare Worker.
 directory = "../../apps/web/dist"
 ## Expose the asset `Fetcher` on `env.ASSETS` (see `WorkerEnv` in `worker.ts`).
 binding = "ASSETS"
-## Return 404 for unmatched paths. The SPA lives at `/app/` and the landing
-## page at `/`; both are concrete `index.html` files, so no SPA fallback is
-## required. Kiwi uses query/hash-based client routing, not path routing.
+## Return 404 for unmatched paths. The SPA lives at `/webclient/` and the
+## landing page at `/`; both are concrete `index.html` files, so no SPA
+## fallback is required. Kiwi uses query/hash-based client routing, not path
+## routing.
 not_found_handling = "none"
 ## Route EVERY request through the Worker before the asset platform serves a
 ## matching static file. Without this, the default (`run_worker_first = false`)

package/apps/local-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/local-cli",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "private": true,
   "description": "Runnable WebSocket IRC server using the in-memory runtime; manual-test harness and e2e fixture target",
   "license": "BSD-3-Clause",

package/apps/local-cli/src/config-loader.ts

@@ -35,6 +35,14 @@ export interface CliConfigInput {
   channelPrefixes?: string;
   maxClients?: number;
   operCreds?: Array<{ user: string; password: string }>;
+  /**
+   * Server-password gate. Treat as a secret; the loader threads it
+   * straight through (via `stripUndefined`) to `ServerConfig.serverPassword`
+   * so the registration reducer requires `PASS <value>` (or a SASL-
+   * identified connection) before `001 RPL_WELCOME`. Undefined disables
+   * the gate.
+   */
+  serverPassword?: string | undefined;
   maxChannelsPerUser?: number;
   maxTargetsPerCommand?: number;
   maxListEntries?: number;

package/apps/local-cli/src/main.ts

@@ -35,6 +35,12 @@ interface CliArgs {
   serverName: string;
   /** Network name advertised in 005 NETWORK=... */
   networkName: string;
+  /**
+   * Server-password gate. Undefined disables the gate; when set every
+   * connection must supply the matching `PASS <value>` (or SASL-identify)
+   * before `001 RPL_WELCOME`.
+   */
+  serverPassword: string | undefined;
 }
 
 const DEFAULT_PORT = 6667;
@@ -49,6 +55,7 @@ function parseArgs(argv: string[]): CliArgs {
     motdFile: undefined,
     serverName: DEFAULT_SERVER_NAME,
     networkName: DEFAULT_NETWORK_NAME,
+    serverPassword: undefined,
   };
   let tcpDisabled = false;
   let tcpPortOverride: number | undefined;
@@ -73,6 +80,9 @@ function parseArgs(argv: string[]): CliArgs {
     } else if (a === '--network-name' && next !== undefined) {
       out.networkName = next;
       i++;
+    } else if (a === '--server-password' && next !== undefined) {
+      out.serverPassword = next;
+      i++;
     } else if (a === '--no-tcp') {
       tcpDisabled = true;
     } else if (a === '--help' || a === '-h') {
@@ -92,6 +102,11 @@ function parseArgs(argv: string[]): CliArgs {
           '                     Optional; defaults to irc.localhost for the local CLI.',
           '  --network-name <n> Network name in 005 NETWORK=...',
           '                     Optional; defaults to LocalNet.',
+          '  --server-password <p>',
+          '                     Server-password gate (optional). When set, every',
+          '                     connection must supply the matching PASS <p> (or',
+          '                     SASL-identify) before 001 RPL_WELCOME. Treat as a',
+          '                     secret; do not log it.',
           '  -h, --help         Show this help and exit.',
           '',
         ].join('\n'),
@@ -119,6 +134,7 @@ async function main(): Promise<void> {
     tcpPort: args.tcpPort,
     serverName: args.serverName,
     networkName: args.networkName,
+    ...(args.serverPassword !== undefined ? { serverPassword: args.serverPassword } : {}),
     ...(motdLines !== undefined ? { motdLines } : {}),
   });
 

package/apps/local-cli/src/server.ts

@@ -302,6 +302,7 @@ export function startLocalServer(opts: StartServerOptions): Promise<LocalServer>
       ...(opts.topicLen !== undefined ? { topicLen: opts.topicLen } : {}),
       ...(opts.quitMessage !== undefined ? { quitMessage: opts.quitMessage } : {}),
       ...(opts.saslAccounts !== undefined ? { saslAccounts: opts.saslAccounts } : {}),
+      ...(opts.serverPassword !== undefined ? { serverPassword: opts.serverPassword } : {}),
     });
   } catch (err) {
     return Promise.reject(err);

package/apps/local-cli/tests/config-loader.test.ts

@@ -55,6 +55,20 @@ describe('loadServerConfigFromCliArgs — minimal input', () => {
     expect(cfg.maxClients).toBe(50);
     expect(cfg.operCreds).toEqual([{ user: 'op', password: 'p' }]);
   });
+
+  it('threads serverPassword through to the parsed config', () => {
+    const cfg = loadServerConfigFromCliArgs({
+      serverName: 's',
+      networkName: 'n',
+      serverPassword: 'hunter2',
+    });
+    expect(cfg.serverPassword).toBe('hunter2');
+  });
+
+  it('leaves serverPassword undefined when not supplied', () => {
+    const cfg = loadServerConfigFromCliArgs({ serverName: 's', networkName: 'n' });
+    expect(cfg.serverPassword).toBeUndefined();
+  });
 });
 
 describe('loadServerConfigFromCliArgs — failure modes', () => {

package/apps/web/landing/index.html

@@ -4,8 +4,8 @@
 
   Served at `/` by the Worker `[assets]` binding (apps/cf-worker/wrangler.toml).
   The build (`scripts/build.mjs`) copies this file verbatim to `dist/index.html`.
-  The Kiwi IRC SPA lives at `/app/`; this page links through to it plus the
-  project docs and source repo. Pure static HTML + inline CSS, no JavaScript.
+  The Kiwi IRC SPA lives at `/webclient/`; this page links through to it plus
+  the project docs and source repo. Pure static HTML + inline CSS, no JavaScript.
 -->
 <html lang="en">
   <head>
@@ -170,7 +170,7 @@
     <header>
       <div class="container">
         <h1>Serverless<span class="irc">IRCd</span></h1>
-        <p>A serverless IRC daemon. One TypeScript core, two serverless substrates.</p>
+        <p>An IRC daemon with a serverless deployment model.</p>
       </div>
     </header>
 
@@ -178,28 +178,26 @@
       <div class="container">
         <p>
           ServerlessIRCd is an IRC server where the protocol logic lives in a
-          pure, platform-agnostic core, and two thin adapters run it on
-          <strong>Cloudflare Workers</strong> (Durable Objects) or
+          platform-agnostic TypeScript core. Two adapters run that core on
+          <strong>Cloudflare Workers</strong> (Durable Objects) and
           <strong>AWS</strong> (API Gateway WebSockets + Lambda + DynamoDB).
-          The same code, unchanged, on both.
         </p>
 
         <ul class="features">
-          <li>Pure-reducer protocol core — every command is a trivial unit test</li>
-          <li>Dual transport: WebSocket <em>and</em> <code>irc+tls</code> on port 6697</li>
-          <li>Full IRCv3 surface: message-tags, chathistory, SASL, labeled-response, and more</li>
-          <li>Authoritative state in one place per datum — races are structurally impossible</li>
+          <li>Reducer-based protocol core: each command is a pure function</li>
+          <li>WebSocket and <code>irc+tls</code> (port 6697) transports</li>
+          <li>IRCv3 extensions: message-tags, chathistory, SASL, labeled-response</li>
+          <li>Per-datum authoritative state held in a single location</li>
         </ul>
 
         <div class="cta">
-          <a class="primary" href="/app/">Launch Web Client</a>
-          <a class="secondary" href="docs/">Read the Docs</a>
+          <a class="primary" href="/webclient/">Launch Web Client</a>
         </div>
 
         <div class="links">
-          <a href="https://github.com/fowlmouth/ServerlessIRCd">Source Code (GitHub)</a>
-          <a href="https://github.com/fowlmouth/ServerlessIRCd/issues">Issue Tracker</a>
-          <a href="/app/">Web IRC Client</a>
+          <a href="https://gitea.com/ServerlessIRCd/ServerlessIRCd">Source Code (Gitea)</a>
+          <a href="https://gitea.com/ServerlessIRCd/ServerlessIRCd/issues">Issue Tracker</a>
+          <a href="/webclient/">Web IRC Client</a>
         </div>
       </div>
     </main>
@@ -208,7 +206,7 @@
       <div class="container">
         <p>
           ServerlessIRCd &middot;
-          <a href="https://github.com/fowlmouth/ServerlessIRCd">GitHub</a> &middot;
+          <a href="https://gitea.com/ServerlessIRCd/ServerlessIRCd">Gitea</a> &middot;
           BSD-3-Clause License
         </p>
       </div>

package/apps/web/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@serverless-ircd/web",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "private": true,
-  "description": "Web client workspace: Kiwi IRC SPA served at /app/ and project landing page at /",
+  "description": "Web client workspace: Kiwi IRC SPA served at /webclient/ and project landing page at /",
   "license": "BSD-3-Clause",
   "type": "module",
   "scripts": {

package/apps/web/scripts/build.mjs

@@ -9,13 +9,13 @@ import { parseKiwiConfig } from '../src/config-schema.ts';
 const pkgRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const upstream = path.resolve(pkgRoot, 'upstream');
 const dist = path.resolve(pkgRoot, 'dist');
-const appDist = path.join(dist, 'app');
+const appDist = path.join(dist, 'webclient');
 const staticDir = path.join(pkgRoot, 'static');
 
-// The SPA is served at /app/ on the Worker (the [assets] binding arrives in a
-// later ticket). All hashed asset URLs must be /app/-prefixed so they load
-// from /app/static/... rather than /static/... (which would 404 at root).
-const PUBLIC_PATH = '/app/';
+// The SPA is served at /webclient/ on the Worker (the [assets] binding serves
+// `dist/`). All hashed asset URLs must be /webclient/-prefixed so they load
+// from /webclient/static/... rather than /static/... (which would 404 at root).
+const PUBLIC_PATH = '/webclient/';
 
 // Yarn runs from a pnpm lifecycle script. Kiwi v1.7.1's package.json has no
 // `packageManager` field, so yarn classic walks up and finds the workspace
@@ -45,15 +45,21 @@ if (!existsSync(upstream)) {
 }
 
 // 1. Install upstream deps. Kiwi ships a yarn.lock; --frozen-lockfile gives a
-//    reproducible tree. Contributors get yarn via `corepack enable`.
-if (!existsSync(path.join(upstream, 'node_modules'))) {
+//    reproducible tree. Contributors get yarn via `corepack enable`. The
+//    guard checks for the actual binary the build invokes, not just the
+//    `node_modules` directory — a stale/partial install (interrupted, or
+//    populated by a foreign package manager that skipped `.bin/` linking)
+//    leaves the directory present but `vue-cli-service` unresolvable, which
+//    would otherwise crash the build at step 2 with a confusing exit 127.
+const vueCliBin = path.join(upstream, 'node_modules', '.bin', 'vue-cli-service');
+if (!existsSync(vueCliBin)) {
   runYarn(['install', '--frozen-lockfile', '--ignore-engines']);
 }
 
-// 2. Build with publicPath=/app/. Upstream pins publicPath:'' (relative); we
-//    temporarily patch vue.config.js so webpack emits /app/-prefixed asset
-//    URLs and the runtime public_path matches the mount point. Restored in
-//    `finally` so the submodule stays clean.
+// 2. Build with publicPath=/webclient/. Upstream pins publicPath:'' (relative);
+//    we temporarily patch vue.config.js so webpack emits /webclient/-prefixed
+//    asset URLs and the runtime public_path matches the mount point. Restored
+//    in `finally` so the submodule stays clean.
 const vueConfigPath = path.join(upstream, 'vue.config.js');
 const originalVueConfig = await readFile(vueConfigPath, 'utf8');
 try {
@@ -67,14 +73,15 @@ try {
   await writeFile(vueConfigPath, originalVueConfig);
 }
 
-// 3. Copy the built SPA into dist/app/.
+// 3. Copy the built SPA into dist/webclient/.
 await rm(appDist, { recursive: true, force: true });
 await mkdir(appDist, { recursive: true });
 await cp(path.join(upstream, 'dist'), appDist, { recursive: true });
 
 // 3b. Webpack applies publicPath to the bundles it emits, but template-hardcoded
 //     refs (e.g. the favicon) stay relative. Prefix every bare `static/...`
-//     reference so all asset URLs resolve to /app/static/... when served at /app/.
+//     reference so all asset URLs resolve to /webclient/static/... when served
+//     at /webclient/.
 const indexDest = path.join(appDist, 'index.html');
 let indexHtml = await readFile(indexDest, 'utf8');
 indexHtml = indexHtml.replace(/((?:src|href)=["'])(static\/)/g, `$1${PUBLIC_PATH}$2`);
@@ -109,8 +116,8 @@ await writeFile(
 
 // 5. Landing page: copy the static landing page (landing/index.html) to
 //    dist/index.html so the Worker `[assets]` binding serves it at `/`. Pure
-//    static HTML + inline CSS (no JS); links to /app/ (the SPA), docs/, and
-//    the source repo.
+//    static HTML + inline CSS (no JS); links to /webclient/ (the SPA), docs/,
+//    and the source repo.
 await mkdir(dist, { recursive: true });
 const landingSrc = path.join(pkgRoot, 'landing', 'index.html');
 if (!existsSync(landingSrc)) {
@@ -121,5 +128,5 @@ if (!existsSync(landingSrc)) {
 await cp(landingSrc, path.join(dist, 'index.html'));
 
 console.log(
-  `Kiwi SPA built -> dist/app/ (publicPath=${PUBLIC_PATH}, config=${configFileName}, env=${configEnv})`,
+  `Kiwi SPA built -> dist/webclient/ (publicPath=${PUBLIC_PATH}, config=${configFileName}, env=${configEnv})`,
 );

package/apps/web/src/build-env.ts

@@ -4,7 +4,7 @@
  * Extracted from the build script so the `--env` → config-file mapping is
  * unit-testable without running the (slow) Kiwi upstream build. The build
  * script delegates here and then validates the selected file against
- * {@link parseKiwiConfig} before baking it into `dist/app/static/config.json`.
+ * {@link parseKiwiConfig} before baking it into `dist/webclient/static/config.json`.
  */
 
 /** argv values accepted by `--env`; mapped to a `static/config.<env>.json` file. */

package/apps/web/src/config-schema.ts

@@ -4,16 +4,16 @@
  * supply to drive the embedded Kiwi SPA.
  *
  * `build.mjs` runs {@link parseKiwiConfig} against the selected env config
- * before baking it into `dist/app/static/config.json`, so a malformed config
- * fails the build with a readable aggregated error rather than shipping a
- * broken SPA. The schema only models the fields ServerlessIRCd cares about
- * (server, port, channel, WS path); the rest of Kiwi's surface is passed
- * through untouched.
+ * before baking it into `dist/webclient/static/config.json`, so a malformed
+ * config fails the build with a readable aggregated error rather than
+ * shipping a broken SPA. The schema only models the fields ServerlessIRCd
+ * cares about (server, port, channel, WS path); the rest of Kiwi's surface
+ * is passed through untouched.
  *
  * Hosting layout reminder:
  *   - The Worker's WebSocket endpoint is at `/` (root), so Kiwi's
  *     `startupOptions.path` — when supplied — MUST be `/`.
- *   - The SPA itself is served from `/app/` by the Worker `[assets]`
+ *   - The SPA itself is served from `/webclient/` by the Worker `[assets]`
  *     binding (a separate concern handled by the public-path patch in
  *     `build.mjs`); that is independent of the WS path modelled here.
  */

package/apps/web/tests/build-smoke.test.ts

@@ -5,7 +5,7 @@ import { describe, expect, it } from 'vitest';
 import { parseKiwiConfig } from '../src/config-schema';
 
 const pkgRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const appDist = path.join(pkgRoot, 'dist', 'app');
+const appDist = path.join(pkgRoot, 'dist', 'webclient');
 const indexPath = path.join(appDist, 'index.html');
 const landingSrc = path.join(pkgRoot, 'landing', 'index.html');
 const landingDist = path.join(pkgRoot, 'dist', 'index.html');
@@ -19,12 +19,12 @@ const built = existsSync(indexPath);
 // artifact; gate the build-output assertion on its own presence.
 const landingBuilt = existsSync(landingDist) && statSync(landingDist).size > 0;
 
-describe.skipIf(!built)('Kiwi SPA build output (dist/app/)', () => {
-  it('emits dist/app/index.html', () => {
+describe.skipIf(!built)('Kiwi SPA build output (dist/webclient/)', () => {
+  it('emits dist/webclient/index.html', () => {
     expect(existsSync(indexPath)).toBe(true);
   });
 
-  it('layers a schema-valid static/config.json into dist/app/static/config.json', () => {
+  it('layers a schema-valid static/config.json into dist/webclient/static/config.json', () => {
     const configPath = path.join(appDist, 'static', 'config.json');
     expect(existsSync(configPath)).toBe(true);
     // The baked config must clear the Zod schema no matter which --env was
@@ -34,17 +34,17 @@ describe.skipIf(!built)('Kiwi SPA build output (dist/app/)', () => {
     expect(cfg.startupOptions.channel.startsWith('#')).toBe(true);
   });
 
-  it('prefixes every asset reference with /app/', () => {
+  it('prefixes every asset reference with /webclient/', () => {
     const html = readFileSync(indexPath, 'utf8');
     // No bare relative `static/...` references may remain.
     const bareStaticRefs = html.match(/(?:src|href)=["']static\//g) ?? [];
     expect(bareStaticRefs).toEqual([]);
-    // At least one asset must be /app/-prefixed (the main bundle).
-    const appPrefixed = html.match(/(?:src|href)=["']\/app\/static\//g) ?? [];
+    // At least one asset must be /webclient/-prefixed (the main bundle).
+    const appPrefixed = html.match(/(?:src|href)=["']\/webclient\/static\//g) ?? [];
     expect(appPrefixed.length).toBeGreaterThan(0);
   });
 
-  it('ships a hashed JS bundle under dist/app/static/js/', () => {
+  it('ships a hashed JS bundle under dist/webclient/static/js/', () => {
     const jsDir = path.join(appDist, 'static', 'js');
     expect(existsSync(jsDir)).toBe(true);
     const js = readdirSync(jsDir).filter((f) => f.endsWith('.js'));
@@ -65,19 +65,19 @@ describe('landing page source (landing/index.html)', () => {
     expect(html).toContain('<title>');
   });
 
-  it('links to the IRC client at /app/', () => {
+  it('links to the IRC client at /webclient/', () => {
     const html = readFileSync(landingSrc, 'utf8');
-    expect(html).toMatch(/href=["']\/app\/?["']/);
+    expect(html).toMatch(/href=["']\/webclient\/?["']/);
   });
 
-  it('links to the project docs', () => {
+  it('does not link to the project docs (docs button temporarily removed)', () => {
     const html = readFileSync(landingSrc, 'utf8');
-    expect(html).toMatch(/href=["'][^"']*docs\/?["']/);
+    expect(html).not.toMatch(/href=["'][^"']*docs\/?["']/);
   });
 
-  it('links to the source repository', () => {
+  it('links to the source repository on Gitea', () => {
     const html = readFileSync(landingSrc, 'utf8');
-    expect(html.toLowerCase()).toMatch(/github\.com/);
+    expect(html.toLowerCase()).toMatch(/gitea\.com/);
   });
 
   it('is responsive (declares a viewport meta tag)', () => {

package/apps/web/tests/config-schema.test.ts

@@ -250,7 +250,7 @@ describe('KiwiConfigSchema — WS path (direct_path)', () => {
     expect(() =>
       parseKiwiConfig(
         validConfig({
-          startupOptions: validStartupOptions({ direct_path: '/app/' }),
+          startupOptions: validStartupOptions({ direct_path: '/webclient/' }),
         }),
       ),
     ).toThrowError(/direct_path/u);

package/docs/AWS-Deployment.md

@@ -530,21 +530,24 @@ namespaces).
 
 ## 8. Secrets
 
-**As of v1 the Lambda consumes no Secrets-Manager/SSM bindings.** Server
-password and oper creds are handled by later hardening work; when they
-ship, the natural homes are AWS Secrets Manager or SSM Parameter Store
-(the AWS adapter architecture doc calls both out as supporting
-services). SASL account credentials, however, **are** persisted — in the
-`Accounts` DynamoDB table (see §8.1).
+**The Lambda consumes one optional secret: `SERVER_PASSWORD`.** When
+set (as a Lambda env var, conventionally sourced from AWS Secrets
+Manager or SSM Parameter Store), every connection must supply the
+matching `PASS <value>` (or SASL-identify) before `001 RPL_WELCOME`;
+when unset/empty the gate is disabled (the default). The adapter's
+config loader reads `process.env.SERVER_PASSWORD` at cold start via
+`loadServerConfigFromLambdaEnv` and threads it through to
+`ServerConfig.serverPassword`.
 
-When secrets land, the typical pattern will be:
+The typical provisioning pattern:
 
 1. Create the secret in Secrets Manager (or a `SecureString`
    parameter in SSM).
 2. Grant the Lambda role `secretsmanager:GetSecretValue` (or
    `ssm:GetParameter`) scoped to that one secret ARN.
 3. Read it inside `buildDepsFromEnv` (cold start) — never inside the
-   per-frame hot path.
+   per-frame hot path — and expose the value to the Lambda env as
+   `SERVER_PASSWORD`.
 
 ```bash
 aws secretsmanager create-secret \
@@ -552,6 +555,16 @@ aws secretsmanager create-secret \
   --secret-string "$(openssl rand -base64 32)"
 ```
 
+**SASL short-circuit:** a connection that has authenticated an account
+via SASL (`AUTHENTICATE PLAIN` / `EXTERNAL`) is exempt from the server
+password — the reducer's gate treats `state.account !== undefined` as
+already authorised. Oper creds (`OPER_USER` / `OPER_PASSWORD`) follow
+the same secret pattern; SASL account credentials are **not** secrets —
+they are persisted in the `Accounts` DynamoDB table (see §8.1). **Never
+log `SERVER_PASSWORD`** — treat it as a shared deployment secret,
+distinct from per-account SASL credentials (which go through the hashed
+`Accounts` table).
+
 ### 8.1 SASL accounts (`Accounts` table + seed tooling)
 
 SASL PLAIN credentials live in the `Accounts` DynamoDB table as

package/docs/Cloudflare-Deployment-Guide.md

@@ -365,11 +365,11 @@ managed separately in the dashboard.
 
 ## 8. Secrets
 
-**As of v1 the Worker consumes no secret bindings.** Server password and
-oper creds land in later tickets (TICKET-046 / TICKET-047). SASL account
-credentials are **not** secrets — they are persisted as scrypt hashes in
-D1 (see §8.1 below). When server password / oper secrets ship, they will
-be set via:
+**The Worker consumes one optional secret binding: `SERVER_PASSWORD`.**
+When set, every connection must supply the matching `PASS <value>` (or
+SASL-identify) before `001 RPL_WELCOME`; when unset/empty the gate is
+disabled (the default). Configure it as a wrangler secret, never a
+plaintext `[vars]` entry:
 
 ```bash
 wrangler secret put SERVER_PASSWORD --env staging
@@ -377,10 +377,26 @@ wrangler secret put SERVER_PASSWORD --env staging
 #   NOT in wrangler.toml or the repo.
 ```
 
+Unset (`wrangler secret delete SERVER_PASSWORD`) disables the gate.
+**SASL short-circuit:** a connection that has authenticated an account
+via SASL (`AUTHENTICATE PLAIN` / `EXTERNAL`) is exempt from the
+server password — the reducer's gate treats `state.account !== undefined`
+as already authorised, so a deployment with both `SERVER_PASSWORD` and
+configured SASL accounts does not need to hand the shared password to
+identified users.
+
+Oper creds (`OPER_USER` / `OPER_PASSWORD`) are still on the roadmap;
+when they ship they will follow the same wrangler-secret pattern. SASL
+account credentials are **not** secrets — they are persisted as scrypt
+hashes in D1 (see §8.1 below).
+
 Secrets are visible to the Worker as plain `env.SECRET_NAME` bindings,
 but their values are never written to disk, the bundle, or the
 dashboard's variable listing. To rotate, run `wrangler secret put`
-again; to remove, `wrangler secret delete <NAME>`.
+again; to remove, `wrangler secret delete <NAME>`. **Never log
+`SERVER_PASSWORD`** — treat it as a shared deployment secret, distinct
+from per-account SASL credentials (which go through the hashed D1
+store).
 
 **Never** put credentials, API tokens, or password hashes in
 `wrangler.toml`, in `[vars]`, or in committed files. The