serverless-ircd 0.8.0 → 0.9.0

package/README.md

@@ -6,48 +6,49 @@ platform-agnostic core, and two thin adapters run it on **Cloudflare Workers**
 
 One TypeScript codebase. Two serverless substrates.
 
-> **Status:** **v0.8.0 (preview).** The pure protocol core, the
-> `IrcRuntime` port + in-memory runtime, a runnable local CLI server,
-> the **Cloudflare Workers** adapter, and the **AWS** (API Gateway
+> **Status:** **preview.** The pure protocol core, the `IrcRuntime`
+> port + in-memory runtime, a runnable local CLI server, the
+> **Cloudflare Workers** adapter, and the **AWS** (API Gateway
 > WebSocket + Lambda + DynamoDB + CDK) adapter are all functional and
-> deployed to staging. v0.4.0 shipped **dual transport**: both adapters
-> speak a real `irc+tls :6697` (TLS-over-TCP) surface for stock IRC
-> clients — Cloudflare via Spectrum + a Container origin, AWS via a
-> Network Load Balancer + Lambda streaming — alongside the WebSocket
-> path, plus **SASL `EXTERNAL` via mTLS** and a **Cloudflare D1-backed
-> SASL account store**. v0.5.0 completed the **protocol surface**: the
-> deferred IRC verbs (`KILL`, `REHASH`, `LUSERS` + `STATS`, `TRACE`,
-> `WALLOPS`, `SETNAME`) all land, and the S2S (`CONNECT` / `SQUIT` /
-> `LINKS`) and obsolete RFC 2812 (`SERVICE` / `SUMMON` / `USERS`) verbs
-> are formally dropped. v0.6.0 landed the **IRCv3 extension sweep**
-> — ten caps (`account-notify`, `msgid`,
-> `standard-replies`, `MONITOR`, `labeled-response`, `sts`,
-> `draft/typing`, `draft/multiline`, `draft/read-marker`,
-> `draft/pre-away`), the ISUPPORT tokens for the new caps, and the
-> read-only user mode `S` (TLS connected). **v0.7.0 lands the web
-> client**: a vendored **Kiwi IRC** SPA served at `/webclient/`
-> and a static landing page at `/` directly by the Cloudflare Worker,
-> with **Cross-Site WebSocket Hijacking (CSWSH) defense** wired into
-> the WS upgrade path (same-origin auto-derive by default, optional
-> `WEB_ORIGINS` allowlist for cross-origin deploys) — the browser
-> opens a native `wss://` straight to the existing IRC-over-WebSocket
-> endpoint. **v0.8.0 lands integrated IRC services** — NickServ
-> (`REGISTER` / `IDENTIFY` / `DROP` / `INFO` / `SET ENFORCE` +
-> nick enforcement), ChanServ (`REGISTER` / `DROP` / `SET` /
-> `ACCESS` / `LEVELS` + the `+r` / `+R` / `+M` channel modes),
-> HostServ (`ON` / `OFF` / `REQUEST` + oper `SET` / `APPROVE`),
-> OperServ (`AKILL` / `JUPE` / `RAW`), and MemoServ
-> (`SEND` / `LIST` / `READ` / `DEL`) — backed by a `ServicesStore`
-> port with **persistent D1 (Cloudflare) and DynamoDB (AWS)
-> backends** (write-behind, surviving redeploys). The SASL
-> `AccountStore` and NickServ accounts are **unified** under one
-> scrypt-hashed credential store, `PASS <nick>:<password>` identifies
-> at registration, and `draft/read-marker` gains the timestamp-based
-> `MARKREAD` verb. Remaining 0.x work: the client compatibility sweep
-> (WeeChat / HexChat / IRCCloud / TheLounge), the Playwright
-> browser-driven e2e for the SPA, and driving the remaining
-> sub-100% packages to full coverage. See `CHANGELOG.md` for the
-> per-release manifests.
+> deployed to staging.
+>
+> **Dual transport.** Both adapters speak a real `irc+tls :6697`
+> (TLS-over-TCP) surface for stock IRC clients — Cloudflare via
+> Spectrum + a Container origin, AWS via a Network Load Balancer +
+> Lambda streaming — alongside the WebSocket path, plus **SASL
+> `EXTERNAL` via mTLS** and a **Cloudflare D1-backed SASL account
+> store**.
+>
+> **Complete protocol surface.** The deferred IRC verbs (`KILL`,
+> `REHASH`, `LUSERS` + `STATS`, `TRACE`, `WALLOPS`, `SETNAME`) are
+> implemented, and the S2S (`CONNECT` / `SQUIT` / `LINKS`) and obsolete
+> RFC 2812 (`SERVICE` / `SUMMON` / `USERS`) verbs are formally dropped.
+>
+> **IRCv3 extensions.** Negotiated caps include `account-notify`,
+> `msgid`, `standard-replies`, `MONITOR`, `labeled-response`, `sts`,
+> `draft/typing`, `draft/multiline`, `draft/read-marker`, and
+> `draft/pre-away`, plus the ISUPPORT tokens for each and the
+> read-only user mode `S` (TLS connected).
+>
+> **Web client.** A vendored **Kiwi IRC** SPA is served at
+> `/webclient/` and a static landing page at `/` directly by the
+> Cloudflare Worker, with **Cross-Site WebSocket Hijacking (CSWSH)
+> defense** wired into the WS upgrade path (same-origin auto-derive by
+> default, optional `WEB_ORIGINS` allowlist for cross-origin
+> deploys). The `docs/` wiki is rendered to standalone HTML at
+> `/docs/`.
+>
+> **Integrated IRC services.** NickServ, ChanServ, HostServ,
+> OperServ, and MemoServ run inside the daemon (no separate services
+> process, no S2S link) backed by a `ServicesStore` port with
+> **persistent D1 (Cloudflare) and DynamoDB (AWS) backends**
+> (write-behind, surviving redeploys). The SASL `AccountStore` and
+> NickServ accounts are **unified** under one scrypt-hashed credential
+> store, `PASS <nick>:<password>` identifies at or after registration,
+> and `draft/read-marker` / `draft/pre-away` persist through the
+> `ServicesStore`.
+>
+> See `CHANGELOG.md` for the per-release manifests.
 
 ---
 
@@ -299,23 +300,28 @@ credentials still go through the hashed SASL account store
 (`HashedAccountStore` / D1 / DynamoDB), which is unaffected.
 
 **PASS-based account login:** in addition to SASL, a client may identify
-to its NickServ account at registration by sending
-`PASS <nick>:<password>` (the same `<nick>:<password>` literal the
-`SASL_ACCOUNTS` seed tooling uses). When an `AccountStore` is configured,
-`NICK alice` + `PASS alice:hunter2` + `USER …` verifies the credentials
-against the account store and, on success, logs the connection in as
-`alice` — emitting `900 RPL_LOGGEDIN` + `903 RPL_SASLSUCCESS` (the same
-"account is set" numerics SASL uses) before `001 RPL_WELCOME`, stamping
-user mode `+r`, and running the same read-marker / away / memo replay as
-a SASL login. The nick left of the `:` must match the `NICK` sent; a bare
-`PASS <value>` with no colon is always treated as a server-password
-candidate, never as account credentials. A wrong password or unknown nick
-is indistinguishable (no `904`/`464` from the auth path) and the
-connection simply proceeds un-identified when no server password is set.
-This composes with the gate above by precedence: an already-identified
-connection (SASL or PASS-auth) satisfies the gate; a `<nick>:<password>`
-that fails verify never matches a bare shared secret, so a server with
-both configured still rejects it with `464`.
+to its NickServ account by sending `PASS <nick>:<password>` (the same
+`<nick>:<password>` literal the `SASL_ACCOUNTS` seed tooling uses).
+When an `AccountStore` is configured, `NICK alice` + `PASS alice:hunter2`
++ `USER …` verifies the credentials against the account store and, on
+success, logs the connection in as `alice` — emitting `900 RPL_LOGGEDIN`
++ `903 RPL_SASLSUCCESS` (the same "account is set" numerics SASL uses)
+before `001 RPL_WELCOME`, stamping user mode `+r`, and running the same
+read-marker / away / memo replay as a SASL login. The login is also
+honoured when `PASS <nick>:<password>` arrives **after** registration
+has completed (e.g. a client that sent `NICK`+`USER` before `PASS`, or
+any `PASS` arriving after `CAP END` resolved): the same verify +
+`applyAccountSuccess` pipeline runs, emitting `900`/`903` and stamping
+`+r` in-band. The nick left of the `:` must match the connection's
+current nick; a bare `PASS <value>` with no colon is always treated as
+a server-password candidate (silent no-op once registration has
+completed), never as account credentials. A wrong password or unknown
+nick is indistinguishable (no `904`/`464` from the auth path) and the
+connection simply proceeds un-identified when no server password is
+set. This composes with the gate above by precedence: an
+already-identified connection (SASL or PASS-auth) satisfies the gate;
+a `<nick>:<password>` that fails verify never matches a bare shared
+secret, so a server with both configured still rejects it with `464`.
 
 ### Connecting
 
@@ -386,7 +392,7 @@ against any line-oriented WebSocket endpoint.
 
 ## Load testing (`tools/load-test`)
 
-A synthetic WebSocket IRC client pool (PLAN §7). It opens N
+A synthetic WebSocket IRC client pool. It opens N
 connections to a `ws://` / `wss://` target, registers each (NICK/USER),
 joins a channel, and optionally chats. Per-stage **p50 / p95 / p99
 latency** (connect / register / join / message) and the **drop rate**
@@ -448,12 +454,22 @@ Build the SPA + landing page (needs the submodule + `yarn`, provided by
 
 ```bash
 git submodule update --init apps/web/upstream   # one-time per clone
+git submodule update --init docs                # one-time per clone (docs site)
 pnpm --filter web build:staging                 # or :prod / default
 # → apps/web/dist/index.html        (landing page, served at /)
 # → apps/web/dist/webclient/index.html    (Kiwi SPA, served at /webclient/)
 # → apps/web/dist/webclient/static/config.json  (baked, env-specific)
+# → apps/web/dist/docs/<slug>.html      (rendered docs/, served at /docs/)
 ```
 
+The build also renders the `docs/` submodule (the Gitea wiki, 23 GFM
+markdown files) to standalone HTML under `apps/web/dist/docs/` so the
+existing `[assets]` binding serves them at `/docs/<slug>.html` (and
+`/docs/` for the index — `Home.md` becomes `index.html`). Requires the
+`docs/` submodule checkout; the build fails loudly with the recovery
+command if it is missing or empty (mirroring the Kiwi `upstream/` guard).
+`Home.md` is the docs landing page; `ADR-Index.md` lists every ADR.
+
 Then run everything locally (Worker serves SPA + landing page + WS on
 one origin):
 
@@ -462,6 +478,7 @@ pnpm build                                     # workspace packages
 pnpm --filter @serverless-ircd/cf-worker dev   # http://localhost:8787
 #   /        → landing page
 #   /webclient/    → Kiwi SPA (opens ws://localhost:8787/)
+#   /docs/   → rendered docs/ (Home → index, per-page HTML)
 #   /health  → plaintext liveness
 ```
 
@@ -552,92 +569,33 @@ port and an `IdFactory` port are injected so tests are fully deterministic.
 
 ## Roadmap
 
-A v1 ships when `irc-core` is at 100% coverage, the parametrized contract
-suite passes against every runtime, both adapters are deployed to staging,
-and ≥3 reference clients (WeeChat, HexChat, IRCCloud, TheLounge) connect
-cleanly. Per-release manifests live in `CHANGELOG.md`.
-
-- **Foundation** (monorepo, turbo, vitest, biome, CI). ✅
-- **Pure protocol engine** — reducers, IRCv3 caps, isupport,
-  SASL (`PLAIN`), token-bucket flood control, chat history. ✅ (most in
-  **v0.1.0**; SASL/flood/chathistory landed in **v0.2.0**).
-- **`IrcRuntime` port** — in-memory runtime, `ConnectionActor`,
-  local CLI, parametrized contract suite. ✅ landed in **v0.1.0**.
-- **Cloudflare adapter** (ConnectionDO / ChannelDO / RegistryDO).
-  ✅ landed in **v0.1.0** (staging deploy via CI; prod deploy is manual).
-- **AWS adapter** (APIGW WS + Lambda + DynamoDB + CDK).
-  ✅ landed in **v0.2.0** (staging deploy via CI; prod deploy is manual).
-- **Observability, security hardening, config, CI gates.**
-  ✅ landed across v0.2.0–v0.4.0 (logger port, server-password, cloaking,
-  admission limits, coverage + mutation gates, OPER credential auth, the
-  Cloudflare config loader, and AWS max-clients admission); the
-  required-`serverName` gate closed in **v0.6.0**.
-- **TLS hardening & raw TCP transport** (`irc+tls :6697`).
-  ✅ landed in **v0.4.0**: generalized `ConnectionActor` transport seam,
-  Cloudflare Spectrum + Container origin, AWS NLB + Lambda streaming,
-  mTLS → SASL `EXTERNAL`, transport-parametrized contract suite, ADR-009.
-- **Load testing & compatibility sweep.** 🔄 partial as of
-  **v0.6.0**: the `tools/load-test` 10k-connection harness is in-tree;
-  the formal 10k-connection report per platform and the client
-  compatibility matrix (WeeChat / HexChat / IRCCloud / TheLounge) are
-  still pending.
-- **PLAN-FIXES remediation.** ✅ landed across v0.3.0–v0.4.0
-  (MessageStore wired into all three adapters, AccountStore end-to-end,
-  the DynamoDB `Accounts` table decided, CF enumeration RPCs, AWS QUIT
-  fanout, `OPER` / `TAGMSG` / `WHOWAS`, RFC 1459 case-mapping, real
-  MOTD, config-driven server identity, AWS max-clients admission,
-  CF D1 SASL store, and a sweep of dead-code / stale-comment cleanup).
-- **Runtime & tooling baseline.** ✅ landed in **v0.4.0**
-  (Node ≥ 24 / pnpm 11).
-- **IRCv3 WebSocket extension.** ✅ landed in **v0.4.0**:
-  `text.ircv3.net` / `binary.ircv3.net` subprotocol negotiation +
-  per-message framing across the CF Worker, AWS APIGW, local CLI, and
-  `tcp-ws-forwarder` (510-byte budget, `1009`/`1003` close codes,
-  legacy fallback).
-- **Deferred IRC verbs.** ✅ landed in **v0.5.0**: `KILL`,
-  `REHASH`, `LUSERS` + `STATS`, `TRACE`, `WALLOPS`, `SETNAME`, plus
-  the formal drop of the S2S (`CONNECT`/`SQUIT`/`LINKS`) and obsolete
-  RFC 2812 (`SERVICE`/`SUMMON`/`USERS`) verbs. The protocol surface is
-  feature-complete for modern clients.
-- **IRCv3 extension sweep.** ✅ landed in **v0.6.0**: ten
-  negotiated caps (`account-notify`, `msgid`, `standard-replies`,
-  `MONITOR`, `labeled-response`, `sts`, `draft/typing`,
-  `draft/multiline`, `draft/read-marker`, `draft/pre-away`), the
-  ISUPPORT tokens for the new caps (`MONITOR`/`MULTILINE`/`TYPING`/
-  `STATUSMSG`/`EXTBAN`/`ACCOUNTEXTBAN`), the read-only user mode `S`
-  (TLS connected), and the async push fanout seam (Registry hooks →
-  `MONITOR` online/offline, `BroadcastWallops`-style caps-gated
-  delivery).
-- **IRC services.** ✅ landed in **v0.8.0**: `ServicesStore` port
-  + integrated NickServ (`REGISTER`/`IDENTIFY`/`DROP`/`INFO`/`SET
-  ENFORCE` + nick enforcement), ChanServ (`REGISTER`/`DROP`/`SET`/
-  `ACCESS`/`LEVELS` + `+r`/`+R`/`+M`), HostServ
-  (`ON`/`OFF`/`REQUEST` + oper `SET`/`APPROVE`), OperServ
-  (`AKILL`/`JUPE`/`RAW`), MemoServ (`SEND`/`LIST`/`READ`/`DEL`).
-  Persistent backends ship alongside — **D1** on Cloudflare,
-  **DynamoDB** on AWS — both write-behind so registrations survive
-  redeploys. The SASL `AccountStore` and NickServ accounts are
-  **unified** under one scrypt-hashed credential store, `PASS
-  <nick>:<password>` identifies at registration, and `draft/read-marker`
-  / `draft/pre-away` now persist through the `ServicesStore` (no longer
-  in-memory-only). See `docs/Services.md`.
-- **Web client.** 🔄 partial as of **v0.7.0**: a vendored
-  Kiwi IRC SPA is served at `/webclient/` and a static landing page at `/`
-  by the Cloudflare Worker via an `[assets]` binding, with a Zod-
-  validated per-env config matrix and **CSWSH defense** (same-origin
-  auto-derive + optional `WEB_ORIGINS` allowlist). The Playwright
-  headless-browser e2e is the remaining open ticket.
-  See `docs/WebClientGuide.md` for the contributor/operator guide.
-- **Coverage hardening.** 🔄 partial as of **v0.7.0**: `aws-adapter`
-  and `aws-stack` clear the 90% gate (v0.6.0); the CF packages run
-  under istanbul (v0.6.0). The remaining packages (`cf-adapter`,
-  `local-cli`, `load-test`, `cf-tcp-container`, `tcp-ws-forwarder`,
-  `irc-test-support`, `web`) are **above the gate but below 100%** —
-  follow-ups drive each to 100%.
+A v1 ships when the parametrized contract suite passes against every
+runtime, the client compatibility matrix is signed off, and every
+package clears its coverage gate. Per-release manifests live in
+`CHANGELOG.md`.
+
+Active follow-ups:
+
+- **Client compatibility sweep** — formal sign-off on ≥3 reference
+  clients (WeeChat / HexChat / IRCCloud / TheLounge) against both
+  deployed adapters, on both the WebSocket and `irc+tls :6697`
+  surfaces.
+- **Web client e2e** — Playwright headless-browser e2e exercising the
+  vendored Kiwi IRC SPA against a deployed stack.
+- **Coverage hardening** — `aws-adapter` and `aws-stack` clear the 90%
+  gate; the CF packages run under istanbul. The remaining packages
+  (`cf-adapter`, `local-cli`, `load-test`, `cf-tcp-container`,
+  `tcp-ws-forwarder`, `irc-test-support`, `web`) sit above the gate
+  but below 100%; follow-ups drive each to full coverage. `irc-core`,
+  `irc-server`, and `in-memory-runtime` are at 100%.
+- **Persistent ChanServ ban list** — ban masks currently live on
+  `ChannelState.banMasks` and do not survive an empty-recreate of a
+  channel. Extending `ServicesStore` with a persistent ban list is the
+  documented next step.
 
 ---
 
-## Protocol scope (v1)
+## Protocol scope
 
 **Core (RFC 1459/2812 subset):** registration (`NICK`/`USER`/`CAP`/`PASS`),
 `PING`/`PONG`, `QUIT`, `JOIN`, `PART`, `PRIVMSG`, `NOTICE`, `MODE` (user +
@@ -654,9 +612,9 @@ disconnect), `REHASH` (config reload via `IrcRuntime.reloadConfig()`),
 `WALLOPS` (global broadcast to every `+w` user).
 
 (Out of scope: the S2S verbs `CONNECT`/`SQUIT`/`LINKS` and the obsolete
-RFC 2812 verbs `SERVICE`/`SUMMON`/`USERS` are **formally dropped** as of
-v0.5.0 — they return `421 ERR_UNKNOWNCOMMAND`, and their reserved
-numerics have been removed. S2S linking is a PLAN non-goal.)
+RFC 2812 verbs `SERVICE`/`SUMMON`/`USERS` are **formally dropped** —
+they return `421 ERR_UNKNOWNCOMMAND`, and their reserved numerics have
+been removed. S2S linking is a stated non-goal.)
 
 **Channel modes:** `o v b i k l t n m s p`, plus the
 services-derived modes `r` (registered), `R` (block unidentified
@@ -668,24 +626,45 @@ via `276 RPL_WHOISSECURE`, not settable via `MODE`) and the read-only
 `r` (registered — set by NickServ `IDENTIFY` / SASL login, surfaced as
 `+r`, not settable via `MODE`).
 
-**Integrated IRC services** (v0.8.0): the service nicks `NickServ`,
-`ChanServ`, `HostServ`, `OperServ`, and `MemoServ` are reserved and
-routed to dedicated pure reducers when a `ServicesStore` is bound —
-there is **no separate services process and no S2S link**. Reached via
-`PRIVMSG <Service> :<subcommand>`:
-NickServ (`REGISTER` / `IDENTIFY` / `DROP` / `INFO` / `SET ENFORCE` +
-nick enforcement on the `NICK` path), ChanServ (`REGISTER` / `DROP` /
-`SET` / `INFO` / `ACCESS` / `LEVELS` + auto-op on `JOIN`), HostServ
-(`ON` / `OFF` / `REQUEST` + oper `SET` / `APPROVE` / `LIST`, with
-`CHGHOST` fanout), OperServ (`AKILL` / `JUPE` / `UNJUPE` / `RAW`), and
-MemoServ (`SEND` / `LIST` / `READ` / `DEL` with queue delivery at
-identify). The SASL `AccountStore` and NickServ accounts share one
-scrypt-hashed credential store, so a registered nick is also a SASL
-login and vice versa. Backends: D1 on Cloudflare, DynamoDB on AWS,
-in-memory for the local CLI / tests (all write-behind; registrations
-survive redeploys). When no store is bound, services commands reply
-`501` and the rest of the daemon is unaffected. See
-`docs/Services.md` for the full reference.
+**Integrated IRC services:** the service nicks `NickServ`, `ChanServ`,
+`HostServ`, `OperServ`, and `MemoServ` are reserved and routed to
+dedicated pure reducers when a `ServicesStore` is bound — there is **no
+separate services process and no S2S link**. Each service also accepts a
+**shortcut verb** (`/NICKSERV`, `/NS`, `/CS`, `/HS`, `/MS`, `/OS`, …)
+that the daemon rewrites to the equivalent `PRIVMSG <Service> :<args>`
+for clients with a dedicated slash-command UX. Reached via `PRIVMSG
+<Service> :<subcommand>`:
+
+- **NickServ** — `REGISTER` / `IDENTIFY` (alias: `ID`) / `DROP` / `INFO`
+  (owner + oper only for the `Email:` line) / `SET ENFORCE` + nick
+  enforcement on the `NICK` path. `INFO <nick>` with no target resolves
+  to the caller's own account.
+- **ChanServ** — `REGISTER` / `DROP` / `SET` (`FOUNDER` / `MLOCK` /
+  `RESTRICTED` / `KEEPTOPIC`) / `INFO` / `ACCESS` (`SOP` / `AOP` / `HOP`
+  / `VOP`, each `ADD` / `DEL` / `LIST`) / `LEVELS`, plus the prefix /
+  roster mutation verbs `OP`, `DEOP`, `VOICE`, `DEVOICE`, `KICK`, and
+  `BAN` / `UNBAN` (each emits the corresponding `:ChanServ MODE` /
+  `KICK` broadcast and `ApplyChannelDelta` against the channel
+  authority). Auto-op / auto-voice on `JOIN` follows the access list;
+  the first joiner of a registered channel no longer gets auto-opped
+  merely for being first.
+- **HostServ** — `ON` / `OFF` / `REQUEST` + oper `SET` / `APPROVE` /
+  `ACTIVATE` / `REJECT` / `LIST`, with `CHGHOST` fanout. An assigned
+  vhost is **auto-applied on identify** (SASL, NickServ `IDENTIFY`, or
+  PASS-auth): `state.host` is set, `state.vhostActive` is stamped, and
+  any currently-joined `chghost`-capable peers see the broadcast.
+  Oper-only subcommands are hidden from non-opers in the help NOTICE.
+- **OperServ** — `AKILL` / `JUPE` / `UNJUPE` / `RAW` (oper-only).
+- **MemoServ** — `SEND` / `LIST` / `READ` / `DEL` with queue delivery
+  at identify.
+
+The SASL `AccountStore` and NickServ accounts share one scrypt-hashed
+credential store, so a registered nick is also a SASL login and vice
+versa. Backends: D1 on Cloudflare, DynamoDB on AWS, in-memory for the
+local CLI / tests (all write-behind; registrations survive redeploys).
+When no store is bound, services commands reply `501` and the rest of
+the daemon is unaffected. See `docs/Services.md` for the full
+reference.
 
 **IRCv3 extensions (negotiated via `CAP`):** `message-tags` (incl. the
 `TAGMSG` command), `server-time`, `account-tag`, `account-notify`
@@ -724,42 +703,23 @@ bridges a stock TCP client to a deployed WebSocket endpoint.
 
 ## Further reading
 
-- `CHANGELOG.md` — per-release manifests (Keep a Changelog format), including
-  the v0.2.0 work (AWS adapter, SASL, flood control, security hardening, CI
-  gates), v0.3.0 (OPER, TAGMSG, RFC 1459 case-mapping, real MOTD,
-  ChannelRegistryDO, SASL account persistence), v0.4.0 (dual transport
-  `irc+tls :6697`, SASL `EXTERNAL`/mTLS, WHOWAS + remaining verbs, D1 account
-  store, Node 24/pnpm 11), v0.5.0 (deferred IRC verbs `KILL` / `REHASH`
-  / `LUSERS` + `STATS` / `TRACE` / `WALLOPS` / `SETNAME`, plus the formal
-  drop of the S2S and obsolete RFC 2812 verbs), v0.6.0 (the IRCv3
-  extension sweep — `account-notify`, `msgid`, `standard-replies`,
-  `MONITOR`, `labeled-response`, `sts`, `draft/typing`, `draft/multiline`,
-  `draft/read-marker`, `draft/pre-away`, plus user mode `S`; the
-  required-`serverName` gate; `tools/load-test`; aws-adapter / aws-stack
-  coverage unblocks; CF packages moved to istanbul; deploys now
-  manual-only), and **v0.7.0** (the web client — vendored Kiwi IRC SPA
-  at `/webclient/`, static landing page at `/`, Cloudflare Worker
-  `[assets]` binding, per-env Zod-validated config matrix, and CSWSH
-  defense via same-origin auto-derive + optional `WEB_ORIGINS`;
-  `/health` becomes an explicit route; mutation-killing tests for
-  `irc-core`'s parser / batch / numerics), and **v0.8.0** (integrated
-  IRC services — NickServ / ChanServ / HostServ / OperServ / MemoServ
-  backed by a `ServicesStore` port with persistent D1 + DynamoDB
-  backends; unified SASL + NickServ scrypt-hashed account store;
-  `PASS <nick>:<password>` registration login; the `draft/read-marker`
-  `MARKREAD` verb).
+- `CHANGELOG.md` — per-release manifests in Keep a Changelog format.
 - `docs/Services.md` — operator and contributor reference for the
   integrated IRC services: architecture (integrated vs. pseudo-client),
-  the per-service command tables, the `+r`/`+R`/`+M` modes, nick
-  enforcement, adapter backends, and an end-to-end registration
-  walkthrough.
-- `docs/WebClientGuide.md` — end-to-end contributor/operator doc for the
-  web client: build pipeline, per-env config matrix, CSWSH rationale and
-  the optional `WEB_ORIGINS` var, local dev, optional Cloudflare Pages
-  alternative, and troubleshooting.
-- `docs/Cloudflare-TCP-Deployment.md` and `docs/AWS-TCP-Deployment.md` —
-  end-to-end guides for the `:6697` TCP+TLS variants (Spectrum/Container on
-  CF, NLB + Lambda streaming on AWS), including mTLS trust-store setup.
-- `README.md` in each `packages/*` and `apps/*` — per-package notes (e.g.
-  `packages/aws-adapter/README.md` for the DynamoDB-Local test setup,
-  `apps/aws-stack/README.md` for CDK commands and localstack validation).
+  the per-service command tables (including ChanServ `OP`/`DEOP`/
+  `VOICE`/`DEVOICE`/`KICK`/`BAN`/`UNBAN`, HostServ oper approval flow,
+  the `+r`/`+R`/`+M` modes, nick enforcement, the unified scrypt
+  account store, service shortcut verbs), adapter backends, and an
+  end-to-end registration walkthrough.
+- `docs/WebClientGuide.md` — end-to-end contributor/operator doc for
+  the web client: build pipeline, per-env config matrix, CSWSH
+  rationale and the optional `WEB_ORIGINS` var, local dev, optional
+  Cloudflare Pages alternative, and troubleshooting.
+- `docs/Cloudflare-TCP-Deployment.md` and `docs/AWS-TCP-Deployment.md`
+  — end-to-end guides for the `:6697` TCP+TLS variants
+  (Spectrum/Container on CF, NLB + Lambda streaming on AWS), including
+  mTLS trust-store setup.
+- `README.md` in each `packages/*` and `apps/*` — per-package notes
+  (e.g. `packages/aws-adapter/README.md` for the DynamoDB-Local test
+  setup, `apps/aws-stack/README.md` for CDK commands and localstack
+  validation).

package/apps/aws-stack/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/aws-stack",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "private": true,
   "description": "AWS CDK v2 stack: API Gateway v2 WebSocket API, Lambda, DynamoDB tables, least-privilege IAM",
   "license": "BSD-3-Clause",

package/apps/cf-tcp-container/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/cf-tcp-container",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "private": true,
   "description": "Cloudflare Container TCP origin for the irc+tls :6697 transport — Spectrum terminates TLS at the edge, this container runs the IRC core over plaintext TCP",
   "license": "BSD-3-Clause",

package/apps/cf-tcp-container/src/container-server.ts

@@ -95,6 +95,9 @@ interface ConnectionBindings {
 const DEFAULT_ID_FACTORY = {
   batchId: () => randomUUID(),
   nonce: () => randomUUID(),
+  // `sessionId` is required for `IdFactory` interface completeness; no
+  // current code path invokes it (only batchId/nonce/traceId are called).
+  // c8 ignore next 1
   sessionId: () => randomUUID(),
   traceId: () => randomUUID(),
 };
@@ -154,12 +157,21 @@ export async function startContainerServer(opts: StartContainerOptions): Promise
   const tcpServer = createServer((socket) => {
     sockets.add(socket);
 
+    // `remoteAddress` is always set on a TCP server's connection socket;
+    // the 'unknown' fallback is defensive and unreachable in practice.
+    /* c8 ignore start */
     const ip = socket.remoteAddress ?? 'unknown';
+    /* c8 ignore stop */
     const decision = runtime.admitConnection(ip, undefined);
     if (!decision.ok) {
+      // A freshly-accepted TCP socket is always writable; the else branch
+      // (skip the ERROR write) is a defensive guard against an impossible
+      // race and cannot be exercised over a real socket.
+      /* c8 ignore start */
       if (socket.writable) {
         socket.write(`ERROR :Closing link: (connection limit reached: ${decision.reason})\r\n`);
       }
+      /* c8 ignore stop */
       socket.destroy();
       sockets.delete(socket);
       return;
@@ -213,8 +225,12 @@ export async function startContainerServer(opts: StartContainerOptions): Promise
     const onListening = (): void => {
       tcpServer.removeListener('error', onError);
       const addr = tcpServer.address();
-      // c8 ignore next 1
+      // Inside the 'listening' handler `address()` is always an AddressInfo
+      // (TCP server, just bound); the null/string returns only occur for IPC
+      // sockets or before listening. The `opts.port` fallback is unreachable.
+      /* c8 ignore start */
       const port = typeof addr === 'object' && addr !== null ? addr.port : opts.port;
+      /* c8 ignore stop */
       resolve({
         port,
         host,
@@ -255,9 +271,13 @@ function attachConnection(
 ): ConnectionBindings {
   const id = randomUUID();
   const state = createConnection({ id, connectedSince: clock.now() });
+  // `transport.sourceHost` is always supplied (set to the peer IP) by the
+  // only call site above; the else branch is defensive and unreachable.
+  /* c8 ignore start */
   if (transport.sourceHost !== undefined) {
     state.host = transport.sourceHost;
   }
+  /* c8 ignore stop */
 
   const logger: Logger = new ConsoleLogger({ connectionId: id }, undefined, LogLevel.Info);
 

package/apps/cf-tcp-container/tests/config-loader.test.ts

@@ -161,6 +161,49 @@ describe('config-loader — container-specific knobs', () => {
     expect(cfg.server.operCreds).toEqual([{ user: 'admin', password: 'secret' }]);
   });
 
+  it('exercises the OPER_PASSWORD ?? "" default then rejects partial OPER_USER-only creds', () => {
+    // The `?? ''` default for the missing OPER_PASSWORD is exercised, but
+    // parseServerConfig then rejects the empty password — partial oper
+    // creds are a misconfiguration, not a silently-accepted one.
+    expect(() =>
+      loadContainerConfig({
+        SERVER_NAME: 'irc.test',
+        NETWORK_NAME: 'TestNet',
+        OPER_USER: 'admin',
+      }),
+    ).toThrowError(/password/u);
+  });
+
+  it('exercises the OPER_USER ?? "" default then rejects partial OPER_PASSWORD-only creds', () => {
+    expect(() =>
+      loadContainerConfig({
+        SERVER_NAME: 'irc.test',
+        NETWORK_NAME: 'TestNet',
+        OPER_PASSWORD: 'secret',
+      }),
+    ).toThrowError(/user/u);
+  });
+
+  it('treats an overflow-numeric CREATED_AT (Infinity) as a verbatim string', () => {
+    const cfg = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      // 400 nines overflows Number.MAX_VALUE → Number() yields Infinity,
+      // which is not finite, so parseCreatedAt falls through to the raw string.
+      CREATED_AT: '9'.repeat(400),
+    });
+    expect(cfg.server.createdAt).toBe('9'.repeat(400));
+  });
+
+  it('skips a SASL line whose username is set but password is empty', () => {
+    const cfg = loadContainerConfig({
+      SERVER_NAME: 'irc.test',
+      NETWORK_NAME: 'TestNet',
+      SASL_ACCOUNTS: 'alice:\nbob:valid',
+    });
+    expect(cfg.server.saslAccounts).toEqual([{ username: 'bob', password: 'valid' }]);
+  });
+
   it('skips malformed SASL account lines', () => {
     const cfg = loadContainerConfig({
       SERVER_NAME: 'irc.test',