serverless-ircd 0.8.0 → 0.10.0

package/CHANGELOG.md

@@ -10,6 +10,556 @@ For the release process itself — versioning policy, pre-release checklist,
 cutting a tag, rolling back — see [`docs/Release-Process.md`](docs/Release-Process.md).
 Cross-reference `progress.md` / `tickets.md` for per-ticket detail.
 
+## [0.10.0] - 2026-08-13
+
+The main change in this release is **AWS web client parity** — the
+vendored Kiwi IRC SPA is no longer Cloudflare-only. AWS now hosts it
+via an **S3 + CloudFront + OAC** `StaticSite` construct (opt-in via
+CDK context) with a **stack-output-driven two-phase deploy**, and the
+API Gateway `$connect` route gains an opt-in `WEB_ORIGINS` CSWSH
+defence that mirrors the CF Worker's. Alongside it: the SASL
+`AccountStore` is **collapsed into `ServicesStore`** as the single
+credential home (a one-shot backfill migration ships for existing
+deployments), **NickServ `SET PASSWORD`** lands as self-service
+password change, and the staging/prod deploy split is **collapsed**
+into a single target per platform. A round of **AWS deploy security
+hardening** ships: the CI workflow is **OIDC-only** (no long-lived
+access keys), and API Gateway full-frame body logging
+(`DataTraceEnabled`) is **off by default and hard-locked** so IRC
+frames are never written to CloudWatch. Finally, `UuidIdFactory` now
+sources its random bytes from `globalThis.crypto` (CSPRNG) instead of
+`Math.random`, so generated `msgid` / session ids are cryptographic-
+grade.
+
+### Added — AWS web client (`@serverless-ircd/aws-stack`, `@serverless-ircd/aws-adapter`, `@serverless-ircd/web`)
+
+The web client is no longer Cloudflare-only. AWS provisions a
+static-site origin for the SPA while the wss IRC endpoint stays on
+API Gateway — two origins, same `apps/web/dist/` artifact.
+
+- **`StaticSite` construct** (`apps/aws-stack/src/static-site.ts`): a
+  private S3 origin bucket fronted by a CloudFront distribution with
+  **Origin Access Control (OAC)** — direct S3 access is denied by the
+  bucket policy; only CloudFront URLs resolve. `defaultRootObject` is
+  `index.html` (the project landing page at `/`), and a custom error
+  response maps S3 `403`/`404` → `200 /webclient/index.html` so
+  client-side SPA routes resolve. Custom domain (ACM certificate +
+  Route53 `ARecord` alias) is opt-in via CDK context
+  (`webSiteCustomDomain` / `webSiteCertificateArn` /
+  `webSiteHostedZoneName` / `webSiteHostedZoneId`); omitted by default
+  to use `*.cloudfront.net`. Three stable CfnOutputs (`WebsiteURL`,
+  `WebsiteBucketName`, `WebsiteDistributionId`) drive the deploy
+  pipeline below.
+- **CloudFront directory-index viewer-request function**: S3 REST
+  (used with OAC) does not serve index documents, so `/docs/` or
+  `/docs` would 404 and fall through to the SPA error response
+  (serving the Kiwi shell instead of the rendered docs index). A
+  viewer-request CloudFront function now resolves directory-style
+  URIs: trailing-slash paths (`/docs/`, `/`) get `index.html`
+  appended as an internal rewrite, and extensionless paths without a
+  trailing slash (`/docs`) get a `301` redirect to the trailing-slash
+  form so the browser resolves relative asset links against the
+  directory. Real assets (`.html`, `.css`, `.js`, …) are served
+  unchanged. Mirrors the CF Worker `[assets]` binding, which resolves
+  directory indexes automatically.
+- **`$connect` Origin allowlist (CSWSH defence)**: API Gateway
+  WebSocket has no built-in `Origin` validation, so the `$connect`
+  Lambda now enforces it. `WEB_ORIGINS` (comma-separated) is parsed
+  into a normalised lowercase set at cold start; a browser-sent
+  `Origin` not in the set is denied with `403` (API Gateway closes
+  the upgrade). The defence is **opt-in** — unset `WEB_ORIGINS`
+  disables the check entirely so existing bare-IRC deployments without
+  a web frontend are unchanged on upgrade. Non-browser clients (curl,
+  WeeChat, the `tcp-ws-forwarder`, the NLB TCP+TLS path) never send
+  `Origin` and always proceed. Deliberate divergence from the CF
+  policy: **explicit-allowlist only** (no same-origin auto-derive),
+  because the SPA is on a CloudFront origin and the wss endpoint is
+  on an API Gateway origin, so the request's own host is never the
+  SPA's origin. Mirrors the CF Worker's parsing semantics (trimmed,
+  lowercased, scheme+host match).
+- **`prod-aws` build env**: a new `apps/web/static/config.prod-aws.json`
+  + `--env prod-aws` (and a `build:prod-aws` pnpm script) select the
+  AWS API-Gateway-shaped config. The `server` field carries
+  `{{API_ID}}` / `{{REGION}}` / `{{STAGE}}` placeholders the deploy
+  pipeline substitutes at bake time, so no concrete wss URL is
+  hardcoded in the repo. Because irc-framework prepends `wss://`
+  itself from `tls: true`, the baked URL is **split** into a
+  hostname-only `server` and a stage-name `direct_path` (e.g.
+  `/<stage>`) — baking the full `wss://` URL into `server` produced
+  a doubled-scheme `wss://wss//...` URL that Firefox rejects.
+- **Stack-output-driven deploy pipeline** (`scripts/deploy-web-aws.mjs`,
+  a new `@serverless-ircd/deploy-scripts` workspace package): unlike
+  the CF Worker (where `wrangler deploy` ships the SPA in the same
+  command as the runtime), the AWS SPA deploy is **two-phase** because
+  the baked `config.json` carries the API Gateway WebSocket URL as a
+  literal that does not exist at synth time. The script runs
+  `describe-stacks` → `pnpm --filter web build:prod-aws -- --api-url
+  <ConnectUrl>` → `aws s3 sync --delete` →
+  `cloudfront create-invalidation /*`. Fails loudly on missing stack
+  outputs or unsubstituted `{{...}}` placeholders. The
+  `deploy-web` CI job (`.github/workflows/deploy-aws.yml`) runs it
+  with `needs: deploy`.
+
+### Added — NickServ `SET PASSWORD` (`@serverless-ircd/irc-core`)
+
+- **Self-service password change.** `PRIVMSG NickServ :SET PASSWORD
+  <old> <new>` re-verifies the current password (defence against a
+  hijacked `+r` session), enforces a configurable minimum (default 8)
+  and a fixed maximum (256, the scrypt input budget), then re-hashes
+  and persists via `ServicesStore.setNickPassword`. The caller's
+  session stays `+r`; other sessions on the same account are not
+  kicked. Wrong old password is indistinguishable from "no such
+  account" (no enumeration vector). Wired through
+  `InMemoryServicesStore` and `PersistentServicesStore` with round-
+  trip tests on the D1 and DynamoDB backends.
+
+### Added — CSPRNG-backed ids (`@serverless-ircd/irc-core`)
+
+- **`UuidIdFactory` now uses `globalThis.crypto.getRandomValues`.** The
+  previous `Math.random`-based UUIDv4 generation was unsuitable for
+  unforgeable `msgid` / session ids — a predictable id would let a
+  client forge message attribution. The global `crypto.getRandomValues`
+  is available on Node ≥ 19 and Cloudflare Workers without an import.
+  Generated ids are now cryptographic-grade. The `IdFactory` port and
+  the deterministic `testIdFactory` test seam are unchanged, so
+  reducer determinism (reducers never touch real randomness) is
+  preserved; only the production factory changed.
+
+### Changed — Single credential home (`@serverless-ircd/irc-core`, `@serverless-ircd/cf-adapter`, `@serverless-ircd/aws-adapter`)
+
+The SASL `AccountStore` port is **removed**. `ServicesStore` is now
+the single credential home: SASL PLAIN, SASL EXTERNAL (CertFP),
+NickServ `IDENTIFY`, and `PASS <nick>:<password>` all verify through
+the same scrypt-hashed `verifyNick` / `verifyCertFP` surface. This
+closes the cross-store credential drift flagged as a known limitation
+in v0.9.0 — a nick registered via NickServ `REGISTER` after the worker
+booted now authenticates via SASL/PASS immediately, because there is
+no second store to drift out of sync with.
+
+- **`ServicesStore` grows CertFP**: `verifyCertFP` / `addCertFP` /
+  `removeCertFP` are added to the port, and `RegisteredNick` gains a
+  `certSubjects: string[]` field so SASL EXTERNAL resolves through the
+  services store (previously SASL EXTERNAL only worked against the
+  static `InMemoryAccountStore`, never the hashed D1/DynamoDB table).
+- **D1 `cert_subjects` column auto-migrates**: the CF D1 path runs
+  `ALTER TABLE nickserv_accounts ADD COLUMN cert_subjects` inside
+  `migrateServicesSchema` on cold start (`CREATE TABLE IF NOT EXISTS`
+  + the `ALTER`), so no manual DDL is needed. DynamoDB is schemaless.
+- **Removed**: `AccountStore` port, `InMemoryAccountStore`,
+  `HashedAccountStore`, the D1/DynamoDB `account-store`
+  implementations, `SaslPayload` / `SaslResult` / `SaslAccountCredential`
+  / `constantTimeEquals` / `ingestAccountCredential`, and the
+  `accounts` / `Accounts` table reads. The new code only reads
+  `nickserv_accounts` / `Services`.
+- **`tools/migrate-accounts-to-services.ts`**: a one-shot, idempotent,
+  never-overwrite backfill of legacy `accounts` / `Accounts` rows into
+  `nickserv_accounts` / `Services`. Reads the still-deployed
+  `SASL_ACCOUNTS` env var at run time so env-seeded accounts are
+  carried into the services table. `cert_subjects` defaults to `'[]'`
+  for every migrated row (the legacy table had no cert column).
+  **Run this before the v0.10.0 build deploys** — see the migration
+  section below.
+
+### Changed — Single deploy target per platform
+
+The staging/prod deploy split is **collapsed** into one target per
+platform. Staging vs production isolation is now driven by which
+account/region (AWS) or which Worker credentials (CF) the deploy
+targets, not by stack/table/Worker name templating.
+
+- **AWS CDK**: drops the `environmentName` prop, `prefixedTableName`,
+  and the `IrcAwsStack-<env>` stack id. Tables use bare logical ids
+  (`Connections`, `Nicks`, …); the stack is always `IrcAwsStack`.
+- **Cloudflare**: drops the `env.staging` blocks in the cf-worker and
+  cf-tcp-container wrangler configs.
+- **Web build**: drops `build:staging` / `config.staging.json`; `--env`
+  now accepts only `prod` (or the default dev config) and `prod-aws`.
+- **CI**: collapses `deploy-*: staging` jobs into single `deploy` /
+  `deploy-web` jobs; script names align (`pnpm deploy:cf`,
+  `pnpm deploy:aws`, `pnpm deploy:cf:tcp`, `pnpm smoke:aws`,
+  `pnpm smoke:cf`). Deploy workflows remain `workflow_dispatch`-only
+  (no push trigger).
+
+### Added — AWS deploy security
+
+- **OIDC-only CI deploys.** The GitHub Actions deploy workflow
+  (`deploy-aws.yml`) accepts **only** GitHub OIDC web-identity
+  credentials. `aws-access-key-id` / `aws-secret-access-key` inputs
+  are dropped from every `configure-aws-credentials` step in both the
+  `deploy` and `deploy-web` jobs; the workflow requires
+  `AWS_DEPLOY_ROLE_ARN` and fails fast with `::error::` if it is
+  unset, then asserts `aws sts get-caller-identity` matches the
+  configured role before any `cdk deploy` (defence-in-depth against a
+  silent fallback to ambient static credentials). Long-lived access
+  keys powerful enough to deploy CloudFormation + IAM + Lambda +
+  DynamoDB are effectively account-admin; a single exfil vector
+  yields full account takeover. The full IAM trust policy snippet,
+  condition keys, and verification steps are in
+  `docs/AWS-Deployment.md` §17. A `ci-hardening` lint + test suite
+  (`findAwsCredentialSteps`, `readWorkflowPermissions`) locks the
+  OIDC-only contract on every PR.
+- **API Gateway `DataTraceEnabled` off by default and hard-locked.**
+  Full-frame body tracing wrote every IRC frame (`PASS <password>`,
+  `AUTHENTICATE <base64-SASL-PLAIN>`, `JOIN #chan <key>`,
+  `PRIVMSG`/`NOTICE`) to the APIGW execution-log group, leaking
+  credentials to anyone with `logs:GetLogEvents`. Now safe-by-default
+  (`false`); because the staging/prod split collapsed, there is no
+  quiet "non-prod" path to re-enable it. The only way back on is an
+  explicit **two-step opt-in** (`-c allowDataTrace=true` **and** `-c
+  iUnderstandThisLeaksCredentials=true`) that refuses synthesis unless
+  both flags are set — see `docs/AWS-Deployment.md` §7.6. Tear the
+  sandbox stack down immediately after debugging; never deploy that
+  combination to a shared account.
+
+### Changed — Documentation
+
+- **`README.md` updated** to cover AWS web client hosting (the web
+  client section was previously Cloudflare-only), the AWS `$connect`
+  CSWSH defence, the OIDC-only deploy model, the `DataTraceEnabled`
+  hard-lock, and the `scripts/deploy-web-aws.mjs` two-phase deploy.
+  The CF-vs-AWS origin difference is laid out in a table, and the
+  CSWSH section now documents both adapters' modes (same-origin
+  auto-derive on CF; explicit-allowlist-only on AWS).
+
+### ⚠️ Migration required
+
+- **Run `tools/migrate-accounts-to-services.ts` BEFORE deploying
+  v0.10.0** if the deployment has any rows in the legacy `accounts`
+  (CF D1) / `Accounts` (AWS DynamoDB) table. The v0.10.0 build only
+  reads `nickserv_accounts` / `Services`, so legacy rows that are not
+  backfilled will stop authenticating. The script is one-shot,
+  idempotent (`INSERT OR IGNORE` on D1 / conditional `PutItem` on
+  DynamoDB), and never-overwrites a nick already registered in the
+  services table. It reads the still-deployed `SASL_ACCOUNTS` env var
+  at run time so env-seeded accounts are carried through. See the
+  script header for the per-platform invocation:
+
+  ```bash
+  # Cloudflare D1
+  node --import tsx tools/migrate-accounts-to-services.ts \
+    --platform cf --database <d1-name> --remote
+
+  # AWS DynamoDB
+  node --import tsx tools/migrate-accounts-to-services.ts \
+    --platform aws --accounts-table Accounts --services-table Services \
+    --region us-east-1
+  ```
+
+- **Single deploy target: rename your deploy commands.** The
+  staging-specific commands are gone. Update any scripts, runbooks, or
+  CI that called `pnpm deploy:cf:staging` / `pnpm deploy:aws:staging`
+  / `--env staging` to the single-target form (`pnpm deploy:cf`,
+  `pnpm deploy:aws`). Staging vs production isolation is now by
+  account/region (AWS) or by Worker credentials (CF), not by command
+  suffix.
+- **AWS CI: switch to OIDC.** If the repo still has
+  `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` secrets, delete them
+  and invalidate the underlying IAM access key. Configure
+  `AWS_DEPLOY_ROLE_ARN` (a GitHub-OIDC-trusted role) per
+  `docs/AWS-Deployment.md` §17; there is no static-key fallback.
+- **No persisted-DO-state schema change.** `PERSISTED_STATE_VERSION`
+  stays `1`. The `cert_subjects` D1 column is added by an idempotent
+  `ALTER TABLE` on cold start; the D1/DynamoDB services-row shape
+  change is backward-compatible for reads. **Code rollback across
+  this release is safe** provided the account-migration backfill was
+  run (rolling back the code re-introduces the legacy `accounts`/
+  `Accounts` reads, which still work as long as the table still
+  exists — it is not auto-dropped).
+
+### Known limitations
+
+- **The web client remains partial.** The Playwright headless-browser
+  e2e against a deployed frontend is still pending; the SPA is
+  exercised via the WS smoke (`scripts/smoke.mjs`) and the `apps/web`
+  unit / build-smoke suite.
+- **The AWS web client `StaticSite` requires a custom domain to
+  provision via `bin/aws.ts`.** Provisioning the construct without a
+  custom domain (default `*.cloudfront.net` only) currently requires
+  editing `bin/aws.ts` to pass `webSite: {}` directly. Tracked as a
+  follow-up.
+- Same transport limits as v0.9.0: the **CF TCP path requires
+  Cloudflare Spectrum (Enterprise tier)** plus a stateful Container
+  origin; the **AWS TCP path** uses NLB + Lambda streaming and is
+  subject to Lambda idle-timeout / stream-duration limits. The
+  WebSocket path remains the zero-extra-deps default.
+- **mTLS (for SASL `EXTERNAL`) requires a custom domain + uploaded
+  CA/trust-store** on both platforms and is not enabled by default.
+  The `cert_subjects` plumbing lands the server-side storage; the
+  adapter-side client-cert capture at the TLS edge remains a
+  follow-up.
+- **Client compatibility sweep** (WeeChat / HexChat / IRCCloud /
+  TheLounge / matrix-IRC bridge) remains pending.
+- **Coverage hardening is partial.** `irc-core`, `irc-server`,
+  `in-memory-runtime`, and **`cf-adapter`** (new this release) sit at
+  100%; `aws-adapter` and `aws-stack` clear the 90% gate. The
+  remaining packages (`local-cli`, `load-test`, `cf-tcp-container`,
+  `tcp-ws-forwarder`, `irc-test-support`, `web`) are **above the gate
+  but below 100%** — follow-ups drive each to full coverage.
+
+### Security
+
+- **OIDC-only AWS deploys** (above): removes long-lived access keys
+  from the deploy path — the highest-impact exfil vector against an
+  AWS account with deploy permissions.
+- **APIGW `DataTraceEnabled` hard-locked off** (above): IRC frames
+  (including `PASS`, `AUTHENTICATE <SASL-PLAIN>`, channel keys) are
+  no longer written to CloudWatch even if an operator toggles the
+  console setting by hand; the two-flag escape hatch cannot be set by
+  accident.
+- **CSPRNG-backed `msgid` / session ids** (above): generated ids are
+  now cryptographic-grade, closing a forgery vector in the previous
+  `Math.random`-based `UuidIdFactory`.
+- No other auth path changed. The scrypt-hashed credential store,
+  server-password gate, and CF-side CSWSH defence are unchanged from
+  v0.9.0.
+
+---
+
+## [0.9.0] - 2026-08-10
+
+The main change in this release is **rounding out the integrated IRC
+services surface** that landed in v0.8.0: ChanServ gains the prefix and
+roster mutation verbs operators expect (`OP` / `DEOP` / `VOICE` /
+`DEVOICE` / `KICK` / `BAN` / `UNBAN`), HostServ **auto-applies an
+assigned vhost on identify** (no per-session `HostServ ON`), HostServ
+HELP hides oper-only commands from non-opers, NickServ grows an `ID`
+alias for `IDENTIFY`, and **NickServ `INFO` no longer leaks the
+registrant's email** to non-owners. Alongside it: service **shortcut
+verbs** (`/NICKSERV`, `/NS`, `/CS`, `/HS`, `/MS`, `/OS`, …) that the
+daemon rewrites to the equivalent `PRIVMSG <Service>`, `echo-message`
+reflection of `PRIVMSG` to service nicks, and the long-missing **JOIN
+`332`/`333` topic numerics** on reconnect/rejoin (regardless of how the
+topic came to be set). A real PASS-login bug is fixed: a client that
+completes registration before sending `PASS <nick>:<password>` is now
+logged in instead of receiving a silent no-op. The AWS adapter gets
+another round of consistency hardening — every `Connections` `GetCommand`
+now uses `ConsistentRead: true`. The web client renders the `docs/` wiki
+to standalone HTML at `/docs/` and gains a client-specific "how to
+connect" section on the landing page.
+
+### Added — Services surface expansion (`@serverless-ircd/irc-core`)
+
+- **ChanServ `OP` / `DEOP` / `VOICE` / `DEVOICE` / `KICK` / `BAN` /
+  `UNBAN`**: founder-or-`AUTOOP`-level callers can grant/remove prefix
+  modes on demand, kick through ChanServ, and manage channel bans. Each
+  verb emits the corresponding `:ChanServ!ChanServ@services MODE` /
+  `KICK` broadcast and an `ApplyChannelDelta` against the channel
+  authority (the same mechanism MLOCK reasserts use), so the roster
+  and ban list update atomically with the broadcast. A target not on
+  the channel produces a NOTICE and no state change. Privilege gating
+  reuses the existing access-list check — no new store methods.
+- **HostServ auto-applies an assigned vhost on identify.** SASL
+  PLAIN/EXTERNAL, NickServ `IDENTIFY`, and PASS-auth now consult
+  `services.getVhost(account)` on a successful login: when an assigned
+  vhost exists, `applyVhost` runs immediately — `state.host` is set,
+  `state.vhostActive` is stamped, and any currently-joined
+  `chghost`-capable peers see the `CHGHOST` broadcast. At SASL/PASS-auth
+  time (pre-JOIN) there are no peers so no broadcast, but the vhost is
+  visible in the subsequent `001` welcome. Users no longer need to run
+  `HostServ ON` every session.
+- **NickServ `ID` alias for `IDENTIFY`.** `PRIVMSG NickServ :ID <pw>`
+  and `ID <nick> <pw>` behave identically to `IDENTIFY` — the alias
+  is not advertised in HELP (mirrors Atheme's hidden shorthand).
+- **Service shortcut verbs** (`@serverless-ircd/irc-server`):
+  `/NICKSERV`, `/NS`, `/CS`, `/HS`, `/MS`, `/OS` (and their long forms)
+  are rewritten at the actor to the equivalent
+  `PRIVMSG <ServiceNick> :<args>`. Clients with a dedicated
+  slash-command UX (WeeChat, HexChat, IRCCloud) now work without a
+  custom alias file. The aliases are case-insensitive and accept both
+  colon-trailing and space-joined arg shapes.
+- **`echo-message` reflection for service PRIVMSG**: a client that
+  has negotiated `echo-message` now sees its own
+  `PRIVMSG NickServ :IDENTIFY hunter2` reflected back before the
+  NickServ NOTICE reply, matching the echo behaviour for every other
+  PRIVMSG target. The echo is emitted before the reply so labeled-
+  response batches wrap both correctly.
+
+### Added — Web client (`apps/web`)
+
+- **`docs/` wiki rendered to `/docs/`.** The Gitea-wiki markdown under
+  the `docs/` submodule is now rendered to standalone HTML at
+  `apps/web/dist/docs/<slug>.html` and served by the existing
+  `[assets]` binding at `/docs/<slug>.html` (with `Home.md` →
+  `/docs/index.html`). Intra-docs Markdown links are rewritten to
+  `.html`, a shared stylesheet is emitted, and an `ADR-Index` page
+  links every ADR. Requires `git submodule update --init docs` before
+  build; the build fails loudly with the recovery command if the
+  submodule is missing or empty.
+- **Landing-page "how to connect" section.** The static landing page
+  gains a CSS-only tabbed picker with copy-paste connect snippets for
+  the common stock IRC clients (WeeChat, HexChat, irssi, IRCCloud),
+  replacing the previous per-client static guides. The picker covers
+  both the WebSocket path and the `irc+tls :6697` path.
+
+### Changed — PASS-based account login (`@serverless-ircd/irc-core`)
+
+- **A late `PASS <nick>:<password>` now logs the connection in.**
+  Previously, a client that completed registration (`NICK` + `USER`
+  resolving before `PASS` arrived, or any `PASS` sent after `CAP END`
+  resolved) was silently rejected — the `passReducer` short-circuited
+  at `state.registration === 'registered'` and emitted `462
+  ERR_ALREADYREGISTRED` for any post-registration `PASS`. The shared
+  verify + `applyAccountSuccess` pipeline now runs on a
+  post-registration `PASS <nick>:<password>`: on success it emits
+  `900 RPL_LOGGEDIN` + `903 RPL_SASLSUCCESS`, stamps `+r`, and runs
+  the read-marker / away / memo replay in-band, exactly like the
+  at-registration path. A bare `PASS <value>` (no colon) is a silent
+  no-op once registration has completed — a server password is
+  meaningless post-registration, and emitting `462` for it was
+  counterproductive. The pre-registration duplicate-PASS `462` (two
+  `PASS`es before `NICK`+`USER`) is preserved unchanged.
+
+### Fixed — Channel correctness (`@serverless-ircd/irc-core`)
+
+- **JOIN now emits `332 RPL_TOPIC` / `333 RPL_TOPICWHOISTIME` from any
+  source of the topic.** The previous JOIN reducer keyed topic
+  emission solely on the ChanServ KEEPTOPIC restore path (an empty
+  channel this join), so reconnecting clients after a deploy saw the
+  NAMES list but no topic — even when the topic survived the deploy
+  in storage. The emission now keys off `state.topic`, so a topic
+  restored from a KEEPTOPIC snapshot, a deploy snapshot with
+  KEEPTOPIC off, or an earlier joiner all produce the correct
+  numerics. The KEEPTOPIC restore path still maintains `state.topic`
+  for an empty channel; only the emission trigger changed.
+- **No auto-op for the first joiner of a registered channel off the
+  access list.** A registered channel that had been emptied (so its
+  roster snapshot was fresh) used to auto-op the first joiner
+  unconditionally as a "founder fallback", which let any client claim
+  `+o` by joining an empty registered channel. The fallback now only
+  fires when the joiner is identified as the founder (or is on the
+  access list); an unidentified first joiner joins without prefix
+  modes.
+
+### Fixed — AWS adapter (`@serverless-ircd/aws-adapter`)
+
+- **Strongly-consistent `Connections` reads across every handler.**
+  `$disconnect`'s `cleanupConnection` and the NLB streaming handler's
+  per-chunk row read were eventually consistent, so under DynamoDB
+  replication lag they could miss the row that was just written (or
+  updated) — dropping the first frame of a raw `:6697` connection or
+  skipping nick release + membership fanout on `$disconnect`. Every
+  `GetCommand` against the `Connections` table in `aws-adapter/src/**`
+  now sets `ConsistentRead: true`, matching the `$default` fix from
+  v0.8.0. A unit test asserts each call site carries the flag.
+- **Bounded `docker info` probe in the test global-setup.** On hosts
+  with Docker Desktop installed but not running, the macOS `docker`
+  CLI hangs indefinitely waiting for the daemon to spin up — and
+  `testcontainers` inherits that hang, stalling the whole `pnpm test`
+  run. The aws-adapter `globalSetup` now pre-probes `docker info`
+  with a 5-second exec timeout; if Docker is not reachable, it logs
+  and falls through to the Java ZIP fallback (or skip) instead of
+  hanging. No behaviour change when Docker is up.
+
+### Fixed — HostServ help leak (`@serverless-ircd/irc-core`)
+
+- **HostServ HELP hides oper-only commands from non-opers.** The
+  help/unknown NOTICE previously listed all seven HostServ commands
+  (`ON, OFF, REQUEST, SET, APPROVE, REJECT, LIST`) to every caller,
+  leaking the existence and names of oper commands. The notice
+  helpers now branch on `state.userModes.oper`: a non-oper sees only
+  `ON, OFF, REQUEST`; an oper sees the full list. The per-handler
+  oper gates are unchanged, so a non-oper who guesses an oper
+  command name still gets the existing permission-denied NOTICE.
+
+### Fixed — NickServ INFO privacy (`@serverless-ircd/irc-core`)
+
+- **NickServ `INFO` no longer leaks the registrant's email to
+  non-owners.** `handleInfo` previously returned the `Email:` line
+  unconditionally to any caller, identified or not — a remote,
+  unidentified user could enumerate registered nicks and harvest
+  email addresses. The `Email:` line is now gated behind
+  `state.account === rec.account` (the owner) or
+  `state.userModes.oper === true` (an oper). The owner path still
+  shows the full record; `INFO` with no target defaults to the
+  caller's own nick (owner path). The `Nick:` / `Account:` lines
+  remain visible to all callers (consistent with how a WHOIS against
+  a registered nick surfaces the account name).
+
+### Changed — Local CLI (`apps/local-cli`)
+
+- **`operCreds` plumbed through the config schema.** The local CLI's
+  `ServerConfig` now carries `operCreds` end-to-end (was wired ad-hoc
+  through constructor options); OPER auth against configured creds
+  works the same way it does in the cloud adapters. The transport
+  seams (WS / TCP) are also extracted into named helpers for
+  readability.
+
+### Changed — CI / tooling
+
+- CI workflows now explicitly checkout every submodule (`docs/`,
+  `apps/web/upstream/`) so the render-docs and Kiwi build steps run
+  deterministically on every runner, not just maintainer laptops.
+
+### ⚠️ Migration required
+
+- **No persisted-DO-state schema change.** `PERSISTED_STATE_VERSION`
+  stays `1`. The ChanServ roster commands, HostServ auto-vhost, and
+  the JOIN topic-numeric fix are runtime behaviour, not persisted DO
+  fields. **Code rollback across this release is safe.**
+- **No D1 / DynamoDB schema change.** The existing services tables
+  (`nickserv_accounts`, `chanserv_channels`, …) carry the new
+  behaviour unchanged. The `cert_subjects` column flagged for the
+  in-progress services credential consolidation is **not yet
+  present** — operators do not need to run any migration command for
+  this release.
+- **Behaviour change: late `PASS` no longer emits `462`.** A
+  post-registration `PASS <value>` used to reply
+  `462 ERR_ALREADYREGISTRED`; it is now silent. Clients that keyed
+  off the `462` to detect "you already sent PASS" will no longer see
+  it. No client is known to do this (the numeric is informational),
+  but scripted regression tests against this behaviour must be
+  updated (the in-tree `irc-test-support` scenario was updated).
+- **Behaviour change: late `PASS <nick>:<password>` now logs in.**
+  Clients that intentionally sent the colon form post-registration
+  expecting it to be ignored will now be logged in. This is the
+  intended fix; flag it in operator runbooks if the deployment was
+  relying on the silent-reject for some access-control flow.
+
+### Known limitations
+
+- **The `AccountStore` / `ServicesStore` credential drift is still
+  present.** A nick registered via NickServ `REGISTER` after the
+  worker booted still cannot authenticate via SASL PLAIN/EXTERNAL or
+  `PASS <nick>:<password>` against the *fresh* password — those paths
+  consult the SASL `AccountStore` (`accounts` table), which
+  `registerNick` does not write back to. The PASS-login fix above
+  makes the at-registration and post-registration paths symmetric,
+  but the underlying cross-store drift remains tracked for a
+  follow-up release that consolidates the credential into a single
+  store. Operators who need a NickServ-registered nick to work with
+  SASL/PASS immediately should re-seed via
+  `tools/seed-cf-accounts.ts` (D1) / `tools/seed-aws-accounts.ts`
+  (DynamoDB) with the same password.
+- Same transport limits as v0.8.0: the **CF TCP path requires
+  Cloudflare Spectrum (Enterprise tier)** plus a stateful Container
+  origin; the **AWS TCP path** uses NLB + Lambda streaming and is
+  subject to Lambda idle-timeout / stream-duration limits. The
+  WebSocket path remains the zero-extra-deps default.
+- **mTLS (for SASL `EXTERNAL`) requires a custom domain + uploaded
+  CA/trust-store** on both platforms and is not enabled by default.
+- **Client compatibility sweep** (WeeChat / HexChat / IRCCloud /
+  TheLounge / matrix-IRC bridge) remains pending.
+- **Coverage hardening is partial.** `irc-core`, `irc-server`, and
+  `in-memory-runtime` sit at 100%; `aws-adapter` and `aws-stack`
+  clear the 90% gate. The remaining packages (`cf-adapter`,
+  `local-cli`, `load-test`, `cf-tcp-container`, `tcp-ws-forwarder`,
+  `irc-test-support`, `web`) are **above the gate but below 100%** —
+  follow-ups drive each to full coverage.
+
+### Security
+
+- **NickServ `INFO` email disclosure** (Fixed above): a remote,
+  unidentified client could harvest email addresses from every
+  registered nick. The disclosure is now gated behind owner-or-oper.
+- **First-joiner op-takeover on empty registered channels** (Fixed
+  above): an unidentified client could claim `+o` by being the first
+  to join an empty registered channel. The auto-op fallback now
+  requires founder/access-list identification.
+- No other auth path changed. The scrypt-hashed credential store,
+  server-password gate, and CSWSH defense are unchanged from v0.8.0.
+
+---
+
 ## [0.8.0] - 2026-08-08
 
 The main change in this release is **integrated IRC services**: NickServ,