serverless-ircd 0.9.0 → 0.10.0

package/packages/irc-core/src/ports.ts

@@ -63,10 +63,11 @@ export interface IdFactory {
 }
 
 /**
- * Production id factory. Generates UUIDv4-shaped strings without relying
- * on `crypto` so the same code runs on Node 24, Cloudflare Workers, and
- * Lambda without per-platform type wrangling. Uniqueness is statistical;
- * for cryptographic IDs, adapters can supply their own {@link IdFactory}.
+ * Production id factory. Generates UUIDv4-shaped strings from a CSPRNG
+ * (`globalThis.crypto.getRandomValues`), which is available on Node 19+
+ * and Cloudflare Workers as a global. The randomness is cryptographic-
+ * grade, so generated ids are suitable as unforgeable msgids / session
+ * ids as well as opaque batch references.
  */
 export class UuidIdFactory implements IdFactory {
   batchId(): string {
@@ -83,22 +84,29 @@ export class UuidIdFactory implements IdFactory {
   }
 }
 
-// RFC 4122 v4 shape (random). Six fixed bits identify the version/variant;
-// the remaining 122 bits come from Math.random. Good enough for non-security
-// identifiers like BATCH ref ids and msgid tags.
 const HEX = '0123456789abcdef';
+
+/**
+ * RFC 4122 v4 (random) UUID. Six fixed bits identify the version/variant;
+ * the remaining 122 bits are sourced from `globalThis.crypto.getRandomValues`
+ * as a single 16-byte buffer (one syscall per id). The global is used — not
+ * `node:crypto` — so the same code runs unmodified on Node and Cloudflare
+ * Workers.
+ */
 function uuidV4(): string {
+  const bytes = globalThis.crypto.getRandomValues(new Uint8Array(16));
   let out = '';
-  for (let i = 0; i < 36; i++) {
-    if (i === 8 || i === 13 || i === 18 || i === 23) {
-      out += '-';
-    } else if (i === 14) {
-      out += '4';
-    } else if (i === 19) {
-      out += HEX[(Math.random() * 4) | 0 | 0x8];
-    } else {
-      out += HEX[(Math.random() * 16) | 0];
-    }
+  let i = 0;
+  for (let b of bytes) {
+    // Version nibble (bits 48-51 of the 128-bit id) = 0b0100 (v4).
+    if (i === 6) b = (b & 0x0f) | 0x40;
+    // Variant nibble (bits 64-65) = 0b10 (RFC 4122 / Leach-Salz).
+    else if (i === 8) b = (b & 0x3f) | 0x80;
+    // Dashes sit at byte offsets 4, 6, 8, 10 between the 4-2-2-2-6 byte groups.
+    if (i === 4 || i === 6 || i === 8 || i === 10) out += '-';
+    out += HEX.charAt(b >> 4);
+    out += HEX.charAt(b & 0x0f);
+    i++;
   }
   return out;
 }
@@ -169,121 +177,6 @@ export class StaticMotdProvider implements MotdProvider {
 /** Convenience: a {@link MotdProvider} that always reports "no MOTD". */
 export const EmptyMotdProvider: MotdProvider = new StaticMotdProvider([]);
 
-/**
- * Parsed SASL credentials handed to an {@link AccountStore}.
- *
- * `PLAIN` is the structured form produced by base64-decoding and splitting
- * the `\0authzid\0authcid\0passwd` payload. `RAW` carries the decoded bytes
- * for any other mechanism the server wants to forward verbatim.
- */
-export type SaslPayload =
-  | { kind: 'PLAIN'; username: string; password: string }
-  | { kind: 'RAW'; data: string }
-  | { kind: 'EXTERNAL'; identity: string };
-
-/**
- * Outcome of an {@link AccountStore.verify} call: either the canonical
- * account name to record on the connection, or a human-readable reason
- * for the failure that surfaces as `904 ERR_SASLFAIL`.
- */
-export type SaslResult = { ok: true; account: string } | { ok: false; reason: string };
-
-/**
- * Port that verifies SASL credentials against the deployment's account
- * backend.
- *
- * The method is **synchronous** on purpose: reducers must stay pure and
- * cannot await. Adapters that need an async lookup (D1, DynamoDB, Secrets
- * Manager) pre-load the credentials they need into a synchronously-readable
- * store (mirroring the {@link MotdProvider} pattern). For Phase 1 the
- * in-memory reference adapter and tests inject a fake directly.
- */
-export interface AccountStore {
-  verify(mech: string, payload: SaslPayload): SaslResult;
-}
-
-/**
- * One SASL PLAIN credential entry seeded into an {@link InMemoryAccountStore}.
- * The `username` is also the canonical account name recorded on the
- * connection for `extended-join` / `account-tag`.
- */
-export interface SaslAccountCredential {
-  username: string;
-  password: string;
-  /**
-   * Optional mTLS client-certificate subject (e.g. `CN=alice` or a
-   * fingerprint hash). When set, SASL `EXTERNAL` authentications that
-   * present this subject are mapped to {@link username} as the account.
-   */
-  certSubject?: string;
-}
-
-/**
- * Reference in-memory {@link AccountStore} backed by a static list of PLAIN
- * credentials seeded at construction.
- *
- * Mirrors the {@link InMemoryMessageStore} / {@link StaticMotdProvider}
- * pattern: the port is synchronous, so adapters that need an async backend
- * (D1, DynamoDB, Secrets Manager) pre-load their credentials into this store
- * at boot. All three adapters (local-cli, CF, AWS) use this as the minimum
- * viable `AccountStore`; a persistent variant (DynamoDB `Accounts` table, D1)
- * is a documented follow-up that swaps in by replacing the construction call.
- *
- * Password comparison is constant-time to avoid the early-return timing
- * oracle a naive `===` would expose. Only `PLAIN` is verified; any other
- * mechanism returns failure (matching the reducer's mech gating).
- */
-export class InMemoryAccountStore implements AccountStore {
-  private readonly creds: ReadonlyMap<string, string>;
-  private readonly certMap: ReadonlyMap<string, string>;
-
-  constructor(credentials: ReadonlyArray<SaslAccountCredential>) {
-    this.creds = new Map(credentials.map((c) => [c.username, c.password]));
-    this.certMap = new Map(
-      credentials
-        .filter((c) => c.certSubject !== undefined)
-        .map((c) => [c.certSubject as string, c.username]),
-    );
-  }
-
-  verify(mech: string, payload: SaslPayload): SaslResult {
-    const m = mech.toUpperCase();
-    if (m === 'PLAIN' && payload.kind === 'PLAIN') {
-      const expected = this.creds.get(payload.username);
-      if (expected === undefined) {
-        return { ok: false, reason: 'invalid credentials' };
-      }
-      if (!constantTimeEquals(payload.password, expected)) {
-        return { ok: false, reason: 'invalid credentials' };
-      }
-      return { ok: true, account: payload.username };
-    }
-    if (m === 'EXTERNAL' && payload.kind === 'EXTERNAL') {
-      const account = this.certMap.get(payload.identity);
-      if (account === undefined) {
-        return { ok: false, reason: 'untrusted certificate' };
-      }
-      return { ok: true, account };
-    }
-    return { ok: false, reason: `unsupported mechanism: ${mech}` };
-  }
-}
-
-/**
- * Constant-time string equality. Compares every byte regardless of early
- * mismatches so a remote attacker cannot short-circuit the comparison via a
- * timing side-channel. Returns `false` when the lengths differ (the length
- * is not considered secret for SASL PLAIN passwords).
- */
-function constantTimeEquals(a: string, b: string): boolean {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++) {
-    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  }
-  return diff === 0;
-}
-
 // ============================================================================
 // mTLS identity (SASL EXTERNAL)
 // ============================================================================
@@ -395,7 +288,7 @@ export interface TargetEntry {
 /**
  * Persistence port for IRCv3 `draft/chathistory` playback.
  *
- * Mirrors the {@link MotdProvider} / {@link AccountStore} pattern: the port
+ * Mirrors the {@link MotdProvider} pattern: the port
  * is **synchronous** (reducers must stay pure and free of IO) and injected
  * via {@link Ctx}. Adapters that need async storage (D1, R2, DynamoDB)
  * pre-load the relevant slice into a synchronously-readable store; Phase 1
@@ -744,6 +637,13 @@ export type NickEnforcePolicy = 'none' | 'ghost' | 'kill';
  * lands). Lookups against the store are case-insensitive (rfc1459-folded);
  * the returned `nick` / `account` preserve the original spelling so the
  * wire renders the user's preferred casing.
+ *
+ * `certSubjects` is the list of mTLS client-certificate subjects (e.g.
+ * `CN=alice`) attached to the account via {@link ServicesStore.addCertFP}.
+ * SASL EXTERNAL resolves the verified edge subject against this list
+ * (byte-exact comparison; subjects are NOT case-folded). Defaults to an
+ * empty array on a fresh registration; an upcoming NickServ `CERT` command
+ * surfaces the mutators to the user (Atheme parity).
  */
 export interface RegisteredNick {
   /** Display spelling stored at registration. */
@@ -756,6 +656,12 @@ export interface RegisteredNick {
   createdAt: number;
   /** Per-account nick-enforcement policy. */
   enforce: NickEnforcePolicy;
+  /**
+   * Client-certificate subjects attached to this account for SASL EXTERNAL
+   * (CertFP). Byte-exact comparisons; never case-folded. Empty on a fresh
+   * registration; populated via {@link ServicesStore.addCertFP}.
+   */
+  certSubjects: string[];
 }
 
 /**
@@ -943,6 +849,14 @@ export interface ServicesStore {
    * not registered (the policy stays {@link NickEnforcePolicy.None}).
    */
   setNickEnforce(nick: string, policy: NickEnforcePolicy): void;
+  /**
+   * Overwrites the stored credential for `nick` with a fresh scrypt hash of
+   * `newPassword` (the plaintext is NEVER persisted). Used by NickServ
+   * `SET PASSWORD`. No-op when the nick is not registered. Write-behind
+   * persistent subclasses re-persist the full nick row (hashed credential
+   * included) so a backend reload keeps `verifyNick` working.
+   */
+  setNickPassword(nick: string, newPassword: string): void;
   /**
    * Returns the nick-enforcement policy for `nick`, or
    * {@link NickEnforcePolicy.None} when the nick is not registered.
@@ -956,6 +870,34 @@ export interface ServicesStore {
    */
   getNick(nick: string): RegisteredNick | undefined;
 
+  /**
+   * Verifies a client-certificate subject (CertFP) for SASL EXTERNAL.
+   * Returns `{ ok: true, account }` for the account whose
+   * {@link RegisteredNick.certSubjects} contains `subject` (byte-exact,
+   * case-sensitive comparison — cert subjects are NOT folded), or
+   * `{ ok: false, reason }` when no registered nick carries `subject`.
+   *
+   * The edge (CF API Shield / AWS APIGW mTLS) still resolves the verified
+   * subject via {@link MtlsIdentityProvider}; only the subject→account
+   * lookup lives here.
+   */
+  verifyCertFP(subject: string): ServicesAuthResult;
+  /**
+   * Attaches a client-certificate subject to `nick` for SASL EXTERNAL.
+   * No-op (and returns `false`) when the nick is not registered.
+   * Byte-exact: a duplicate subject (case-sensitive) is a no-op (idempotent
+   * returns `true`). Future NickServ `CERT ADD` will surface this.
+   * Returns `true` when the subject was newly attached (or already
+   * present), `false` when the nick is unknown.
+   */
+  addCertFP(nick: string, subject: string): boolean;
+  /**
+   * Detaches a client-certificate subject from `nick`. Returns `true` when
+   * a subject was removed, `false` when the nick is unknown or the subject
+   * was not attached. Future NickServ `CERT DEL` will surface this.
+   */
+  removeCertFP(nick: string, subject: string): boolean;
+
   // ----- ChanServ -----
 
   /**
@@ -1344,7 +1286,7 @@ type StoredJupe = JupeEntry & { nameKey: string };
  *
  * Backed by plain `Map`s keyed by rfc1459-folded nick / account / channel.
  * Password verification uses the same scrypt path as the SASL
- * {@link HashedAccountStore} ({@link verifyHashedPassword}) so a NickServ
+ * {@link verifyHashedPassword} so a NickServ
  * registration IS a SASL account — both stores carry credentials in the
  * same hashed shape, and SASL PLAIN's services fallback verifies against
  * a row created by `NickServ REGISTER` without a second registration.
@@ -1405,7 +1347,11 @@ export class InMemoryServicesStore implements ServicesStore {
    */
   protected hydrate(snap: ServicesSnapshot): void {
     for (const row of snap.nicks) {
-      this.nicks.set(folded(row.nick), { ...row, credential: { ...row.credential } });
+      this.nicks.set(folded(row.nick), {
+        ...row,
+        certSubjects: [...(row.certSubjects ?? [])],
+        credential: { ...row.credential },
+      });
     }
     for (const row of snap.channels) {
       const stored: RegisteredChannel = { ...row };
@@ -1477,7 +1423,11 @@ export class InMemoryServicesStore implements ServicesStore {
   snapshot(): ServicesSnapshot {
     const nicks: ServicesNickRow[] = [];
     for (const rec of this.nicks.values()) {
-      nicks.push({ ...rec, credential: { ...rec.credential } });
+      nicks.push({
+        ...rec,
+        certSubjects: [...rec.certSubjects],
+        credential: { ...rec.credential },
+      });
     }
     const channels: RegisteredChannel[] = [];
     for (const rec of this.channels.values()) {
@@ -1554,6 +1504,7 @@ export class InMemoryServicesStore implements ServicesStore {
       email,
       createdAt: now,
       enforce: 'none',
+      certSubjects: [],
       credential,
     });
     return { ok: true, account: nick };
@@ -1585,6 +1536,12 @@ export class InMemoryServicesStore implements ServicesStore {
     rec.enforce = policy;
   }
 
+  setNickPassword(nick: string, newPassword: string): void {
+    const rec = this.nicks.get(folded(nick));
+    if (rec === undefined) return;
+    rec.credential = hashAccountCredential(rec.account, newPassword);
+  }
+
   getNickEnforce(nick: string): NickEnforcePolicy {
     return this.nicks.get(folded(nick))?.enforce ?? 'none';
   }
@@ -1600,43 +1557,33 @@ export class InMemoryServicesStore implements ServicesStore {
       email: rec.email,
       createdAt: rec.createdAt,
       enforce: rec.enforce,
+      certSubjects: [...rec.certSubjects],
     };
   }
 
-  /**
-   * Adopts a pre-hashed SASL account credential as a registered nick.
-   *
-   * This is the unification seam: an account seeded into the SASL
-   * `AccountStore` (the `accounts`/`Accounts` table, populated by the
-   * seed tooling) is treated as a NickServ registration so `INFO`
-   * resolves it, `SET ENFORCE` applies, and NickServ `IDENTIFY` succeeds
-   * with the seeded password. The resulting {@link RegisteredNick} carries
-   * an empty email, the default `'none'` enforcement policy, and
-   * `createdAt = clock.now()`; the supplied {@link HashedAccountCredential}
-   * is stored verbatim so `verifyNick` re-derives via the same scrypt
-   * path as `registerNick`.
-   *
-   * Returns `true` when a new registration was created; `false` when the
-   * nick (case-insensitive) is already registered — the existing record
-   * wins and the supplied credential is NOT overwritten. Idempotent in
-   * the sense that re-ingesting the same credential is a no-op.
-   *
-   * Adapters call this once per cold start, after both the SASL store and
-   * the services store have been loaded, to merge the SASL account set
-   * into the unified services account set.
-   */
-  ingestAccountCredential(credential: HashedAccountCredential): boolean {
-    const key = folded(credential.account);
-    if (this.nicks.has(key)) return false;
-    const account = credential.account;
-    this.nicks.set(key, {
-      nick: account,
-      account,
-      email: '',
-      createdAt: this.clock.now(),
-      enforce: 'none',
-      credential: { ...credential },
-    });
+  verifyCertFP(subject: string): ServicesAuthResult {
+    for (const rec of this.nicks.values()) {
+      if (rec.certSubjects.includes(subject)) {
+        return { ok: true, account: rec.account };
+      }
+    }
+    return { ok: false, reason: 'untrusted certificate' };
+  }
+
+  addCertFP(nick: string, subject: string): boolean {
+    const rec = this.nicks.get(folded(nick));
+    if (rec === undefined) return false;
+    if (rec.certSubjects.includes(subject)) return true;
+    rec.certSubjects.push(subject);
+    return true;
+  }
+
+  removeCertFP(nick: string, subject: string): boolean {
+    const rec = this.nicks.get(folded(nick));
+    if (rec === undefined) return false;
+    const idx = rec.certSubjects.indexOf(subject);
+    if (idx === -1) return false;
+    rec.certSubjects.splice(idx, 1);
     return true;
   }
 
@@ -1654,7 +1601,13 @@ export class InMemoryServicesStore implements ServicesStore {
    */
   protected getStoredNick(nick: string): ServicesNickRow | undefined {
     const rec = this.nicks.get(folded(nick));
-    return rec === undefined ? undefined : { ...rec, credential: { ...rec.credential } };
+    return rec === undefined
+      ? undefined
+      : {
+          ...rec,
+          certSubjects: [...rec.certSubjects],
+          credential: { ...rec.credential },
+        };
   }
 
   // ----- ChanServ -----
@@ -2127,13 +2080,40 @@ export abstract class PersistentServicesStore extends InMemoryServicesStore {
     this.enqueue({ kind: 'upsertNick', row });
   }
 
-  override ingestAccountCredential(credential: HashedAccountCredential): boolean {
-    const created = super.ingestAccountCredential(credential);
-    if (created) {
-      const row = this.getStoredNick(credential.account) as ServicesNickRow | undefined;
-      if (row !== undefined) this.enqueue({ kind: 'upsertNick', row });
+  override setNickPassword(nick: string, newPassword: string): void {
+    if (!this.isRegisteredNick(nick)) return;
+    super.setNickPassword(nick, newPassword);
+    // The `isRegisteredNick` guard above guarantees the nick is present, so
+    // `getStoredNick` is defined — read it back to capture the freshly-hashed
+    // credential so a backend reload keeps `verifyNick` working.
+    const row = this.getStoredNick(nick) as ServicesNickRow;
+    this.enqueue({ kind: 'upsertNick', row });
+  }
+
+  override addCertFP(nick: string, subject: string): boolean {
+    if (!this.isRegisteredNick(nick)) return false;
+    // Suppress the spurious write on an idempotent re-add (the subject is
+    // already attached → super is a no-op). `getNick` returns a defensive
+    // copy, so this check reflects the pre-call state. The
+    // `isRegisteredNick` guard above guarantees the nick is present, so
+    // `getNick` returns a defined record.
+    const before = this.getNick(nick);
+    const alreadyPresent = before?.certSubjects.includes(subject) === true;
+    const attached = super.addCertFP(nick, subject);
+    if (attached && !alreadyPresent) {
+      const row = this.getStoredNick(nick) as ServicesNickRow;
+      this.enqueue({ kind: 'upsertNick', row });
     }
-    return created;
+    return attached;
+  }
+
+  override removeCertFP(nick: string, subject: string): boolean {
+    const removed = super.removeCertFP(nick, subject);
+    if (removed) {
+      const row = this.getStoredNick(nick) as ServicesNickRow;
+      this.enqueue({ kind: 'upsertNick', row });
+    }
+    return removed;
   }
 
   // ----- ChanServ -----
@@ -2454,7 +2434,7 @@ export interface MonitorPush {
  * (nick → set of watcher connIds) and the **online set** the actor consults
  * when synchronously resolving `MONITOR +` / `MONITOR S`.
  *
- * Mirrors the {@link MessageStore} / {@link AccountStore} pattern: the port
+ * Mirrors the {@link MessageStore} pattern: the port
  * is **synchronous** (reducers must stay pure and free of IO). The actor
  * layer drains pending pushes after each command via {@link drainPushes};
  * adapters that need to fan notifications out across processes (CF
@@ -2681,7 +2661,7 @@ export interface ServerStatsSnapshot {
 /**
  * Port that aggregates network-wide statistics for `LUSERS` and `STATS`.
  *
- * Unlike the synchronous {@link MotdProvider} / {@link AccountStore} ports
+ * Unlike the synchronous {@link MotdProvider} ports
  * (which reducers consume directly via {@link Ctx}), this port is
  * **asynchronous** (`Promise`-returning) because the aggregation crosses
  * every connection and channel in the deployment — it cannot be pre-loaded

package/packages/irc-core/src/types.ts

@@ -9,7 +9,6 @@
 import type { Effect } from './effects.js';
 import type { FloodControlConfig } from './flood-control.js';
 import type {
-  AccountStore,
   AwayStore,
   Clock,
   IdFactory,
@@ -63,6 +62,24 @@ export interface OperCred {
   readonly password: string;
 }
 
+/**
+ * NickServ-specific tunables as seen by reducers. Mirrors the
+ * `nickServ` sub-schema of {@link ServerConfigSchema}; the NickServ
+ * `SET PASSWORD` reducer reads `minPasswordLength` (falling back to
+ * {@link DEFAULT_MIN_PASSWORD_LENGTH} when unset).
+ *
+ * Optional fields are widened to `T | undefined` to mirror Zod's
+ * `.optional()` output under `exactOptionalPropertyTypes: true`.
+ */
+export interface NickServConfig {
+  /**
+   * Minimum length a new password must meet to be accepted by
+   * `SET PASSWORD`. Omitted → the reducer falls back to
+   * {@link DEFAULT_MIN_PASSWORD_LENGTH} (8).
+   */
+  readonly minPasswordLength?: number | undefined;
+}
+
 /**
  * Per-deployment server configuration. Adapters load this from a KV store
  * (CF) or Secrets Manager / SSM (AWS); the core only reads it.
@@ -209,6 +226,19 @@ export interface ServerConfig {
    * `exactOptionalPropertyTypes: true`.
    */
   readonly nickEnforceGraceMs?: number | undefined;
+  /**
+   * NickServ-specific tunables consulted by the NickServ reducer. Currently
+   * only the minimum length enforced by `SET PASSWORD` is configurable
+   * (`minPasswordLength`); the maximum (256) is fixed to bound the scrypt
+   * input budget.
+   *
+   * Typed `NickServConfig | undefined` to mirror Zod's optional output
+   * shape under `exactOptionalPropertyTypes: true` so inline
+   * `ServerConfig` literals in tests may omit it (the reducer falls back
+   * to {@link DEFAULT_MIN_PASSWORD_LENGTH} when `minPasswordLength` is
+   * unset).
+   */
+  readonly nickServ?: NickServConfig | undefined;
   /**
    * HostServ approval mode for `REQUEST <vhost>`. `true` (the parsed
    * default) preserves the legacy auto-approve behaviour — the vhost is
@@ -235,8 +265,6 @@ export interface Ctx {
   readonly ids: IdFactory;
   /** Pre-loaded MOTD source for the `MOTD` reducer. */
   readonly motd: MotdProvider;
-  /** SASL account verification source (absent when no accounts are configured). */
-  readonly accounts?: AccountStore;
   /**
    * mTLS client-cert identity source for SASL EXTERNAL (absent when mTLS
    * is not configured). When present, `AUTHENTICATE EXTERNAL` resolves the
@@ -280,11 +308,13 @@ export interface Ctx {
    * marker via {@link ServicesStore.setLastReadMarker}, SASL identify seeds
    * the connection's `lastReadMarkers` from
    * {@link ServicesStore.listReadMarkers} so a reconnect restores the user's
-   * read position, and SASL PLAIN falls back to this store for nicks
-   * registered via NickServ. Omitted (→ `ctx.services` undefined) preserves
-   * the no-services behaviour: `PRIVMSG NickServ :…` is not intercepted,
-   * read-marker persistence stays session-only, and SASL PLAIN consults
-   * only {@link Ctx.accounts}.
+   * read position, SASL PLAIN consults `services.verifyNick`, SASL EXTERNAL
+   * consults `services.verifyCertFP`, and PASS-based account auth
+   * (`PASS <nick>:<password>`) consults `services.verifyNick`. Omitted (→
+   * `ctx.services` undefined) preserves the no-services behaviour:
+   * `PRIVMSG NickServ :…` is not intercepted, read-marker persistence stays
+   * session-only, and every SASL/PASS credential verify fails with
+   * `904` / silent no-op.
    */
   readonly services?: ServicesStore;
   /** The connection invoking the command. Reducers mutate this freely. */
@@ -323,7 +353,6 @@ export interface BuildCtxOptions {
   clock: Clock;
   ids: IdFactory;
   motd: MotdProvider;
-  accounts?: AccountStore;
   mtlsIdentity?: MtlsIdentityProvider;
   messages?: MessageStore;
   history?: NickHistoryStore;
@@ -349,7 +378,6 @@ export function buildCtx(opts: BuildCtxOptions): Ctx {
     motd: opts.motd,
     connection: opts.connection,
     connId: opts.connection.id,
-    ...(opts.accounts !== undefined ? { accounts: opts.accounts } : {}),
     ...(opts.mtlsIdentity !== undefined ? { mtlsIdentity: opts.mtlsIdentity } : {}),
     ...(opts.messages !== undefined ? { messages: opts.messages } : {}),
     ...(opts.history !== undefined ? { history: opts.history } : {}),