serverless-ircd 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -10,6 +10,600 @@ For the release process itself — versioning policy, pre-release checklist,
 cutting a tag, rolling back — see [`docs/Release-Process.md`](docs/Release-Process.md).
 Cross-reference `progress.md` / `tickets.md` for per-ticket detail.
 
+## [0.11.0] - 2026-08-18
+
+This is the **security-audit remediation release**. The 2026-08-11
+static audit (`SECURITY-REPORT.md`, 43 findings) is now fully
+remediated: the Critical + first High findings (APIGW body logging,
+OIDC-only deploys) and the CSPRNG id fix shipped in v0.10.0; the
+remaining **40 findings (TICKET-182 … TICKET-222)** land here as a
+layered hardening pass over every edge: **admission control and
+rate limiting at every transport boundary** (global cap, per-IP
+caps, connect-rate windows, per-connection frame budgets, bounded
+line buffers), **credential hardening** (scrypt oper credentials,
+constant-time / timing-equalized comparisons, brute-force lockouts
+on every auth surface), **SASL `EXTERNAL` rebuilt behind an
+operator opt-in with DER-fingerprint account binding**, and a sweep
+of **protocol budget correctness fixes** (UTF-8 byte budgets, tag
+caps, bare-CR rejection).
+
+### Added — Admission control & rate limiting (`irc-core`, `cf-adapter`, `aws-adapter`, `aws-stack`)
+
+Layered throttling of connection establishment and frame intake,
+enforced at every transport edge (WS upgrade, NLB stream, TCP
+origin) with `429` rejections.
+
+- **Global `MAX_CLIENTS` cap with live-connection counter.**
+  Cloudflare reserves a slot in a `CounterDO` counter before
+  forwarding an upgrade and answers `429` (`ERROR :Closing link:
+  server full`) once the cap is reached; slots are released on
+  close and TTL-reaped if a DO dies without one. AWS keeps the
+  O(1) atomic counter from v0.8.0, now enforced against the
+  configured cap.
+- **Per-IP connection caps + sliding-window connect-rate limits.**
+  `MAX_CONNECTIONS_PER_IP` (default 10) caps simultaneous
+  connections per source IP; `PER_IP_CONNECTION_RATE_MAX` /
+  `PER_IP_CONNECTION_RATE_WINDOW_MS` (default 5 / 60 s) cap new
+  establishments per window. Cloudflare enforces both at the worker
+  edge via a new `RateLimitDO` (sliding-window admission timestamps
+  keyed on `CF-Connecting-IP`; rejections never consume budget, so
+  a blocked IP recovers after window decay). AWS `$connect` counts
+  live + in-window rows via a new `sourceIp+connectedSince` GSI on
+  `Connections`, the NLB path applies the same budget to new flows
+  (first chunk only, so active sessions are not starved), API
+  Gateway stage throttling (rate + burst parameters) backstops
+  globally, and an **opt-in WAFv2 per-IP rate rule**
+  (`-c wafConnectRateLimit=<n>`) sits at the edge.
+- **Per-connection inbound frame-rate window.**
+  `MAX_FRAMES_PER_WINDOW` / `FRAME_WINDOW_SECONDS` (default 50 /
+  5 s) enforced at the adapter boundary **before** the actor or any
+  storage write — a cheap early rejection for frame floods.
+- **Bounded line-buffer memory.** TCP input buffers are capped at
+  **8 KiB** at every transport edge (local CLI, container origin,
+  NLB handler, forwarder), and the NLB handler rejects oversized
+  payloads outright — an unauthenticated peer can no longer pin
+  memory with an unterminated byte stream.
+
+### Added — Cloudflare TCP origin hardening (`cf-tcp-container`)
+
+The Spectrum origin is rebuilt as a hardened TLS terminator.
+
+- **TLS terminates at the origin.** Spectrum switches to
+  `tls_mode = "full"` (encrypted all the way to the container, no
+  plaintext hop) and the container itself terminates TLS, pinned to
+  **TLS 1.2/1.3**.
+- **PROXY protocol v1 is required on every flow.** The container
+  parses the `PROXY TCP4/TCP6 …` header (incremental, 107-byte
+  budget) to recover the real client IP — and **rejects flows
+  without one** — so per-IP admission (above) cannot be spoofed by
+  connecting directly to the origin. Origin ingress is locked to
+  Spectrum's published IP ranges in the Terraform.
+- **Non-root runtime.** The container runs as the non-root `node`
+  user (UID 1000); the Dockerfile drops to an unprivileged user and
+  the cert files are owned by it.
+
+### Added — AWS stack hardening (`aws-stack`, `aws-adapter`)
+
+- **State tables protected.** Every DynamoDB state table
+  (`Connections`, `Nicks`, `Channels`, `Services`, …) now carries
+  `RETAIN` deletion policy, **deletion protection**, and
+  **point-in-time recovery (PITR)** — a stray `cdk destroy` or a
+  compromised console session can no longer silently destroy
+  persistent IRC state.
+- **NLB stream path integrity.** The streaming handler asserts the
+  flow is TLS-secured (surfacing user mode `S`), **rejects flows
+  with missing or malformed `x-forwarded-for` / `x-forwarded-port`
+  headers**, and its Lambda now holds the
+  `execute-api:ManageConnections` grant against the management API
+  stage (fixes silent fanout failure on the TCP path).
+- **APIGW logging role least-privilege.** The CloudWatch logging
+  role's policy is scoped to exact write-only grants on the
+  API-specific log groups.
+
+### Added — Credential hardening (`irc-core`)
+
+- **Scrypt-hashed oper credentials.** `OPER` verifies against a
+  scrypt hash + salt (`OPER_SALT` + `OPER_HASH`) with a timing-safe
+  compare; a new `tools/hash-oper-cred.ts` generates the pair
+  (`node --import tsx tools/hash-oper-cred.ts --user admin --stdin`).
+  The plaintext `OPER_PASSWORD` form still works but logs a
+  deprecation warning and will be removed.
+- **Constant-time server-password comparison.** The
+  `SERVER_PASSWORD` gate compares in constant time.
+- **Timing-equalized nick verification (no account enumeration).**
+  `verifyNick` runs a dummy scrypt verify for unknown accounts, so
+  response timing cannot distinguish "no such nick" from "wrong
+  password". NickServ `INFO` / `SET PASSWORD` replies are already
+  indistinguishable on the same axis.
+- **Brute-force lockouts on every auth surface.** A per-connection
+  **SASL failure lockout** (repeated `904`s disconnect with "too
+  many failed SASL attempts"), a **per-IP `OPER` failure lockout**
+  (with oper-broadcast on trip), and a **per-account NickServ
+  `IDENTIFY` freeze**. The `AUTHENTICATE` **flood-control exemption
+  is removed** — SASL frames now count against the connection's
+  message bucket, closing the timing-oracle bandwidth amplifier.
+- **Credential redaction from parse-error logs.** Parse-error log
+  records carry only a truncated leading token, the length, and a
+  stable reason code — never the raw line (a malformed line could
+  otherwise smuggle `PASS <secret>` past the parser into logs).
+  Workers log sampling is lowered to **10%** by default.
+
+### Changed — SASL `EXTERNAL` (mTLS) rebuilt behind an operator opt-in (`irc-core`, adapters)
+
+EXTERNAL is now advertised and accepted only when **all three**
+hold: a bound mTLS identity source (CF API Shield / APIGW client
+certs), the operator opt-in **`EXTERNAL_ENABLED`** (`true`/`1`,
+**default off** — surfaced via both adapters' config loaders), and
+a secure (TLS) connection. The `sasl` cap value and the
+`AUTHENTICATE` reducer share the same gate so advertisement and
+enforcement cannot drift; refusals answer `908 ERR_SASLMECHS`
+listing `PLAIN` only and do not count toward the SASL lockout.
+
+- **Accounts bind to the certificate's DER SHA-256 fingerprint**
+  (`fp:<hex>` entries in `RegisteredNick.certSubjects` — what
+  Cloudflare surfaces from `request.cf.tlsClientAuth`; the preferred
+  binding) **or a canonical subject DN** (the only identifier API
+  Gateway exposes). DNs are canonicalised before comparison —
+  attribute types lower-cased, whitespace collapsed, RDN/AVA
+  components sorted — so semantically equal DNs written differently
+  (including across cert re-issuance) still match. Legacy verbatim
+  bindings verify and are rewritten to the canonical spelling on
+  first use.
+- **Transports without a client-cert surface pin the mechanism off.**
+  The `cf-tcp-container` Spectrum origin (and the NLB stream handler
+  unless an mTLS provider is injected) reject
+  `AUTHENTICATE EXTERNAL` outright with a transport-specific
+  `904 ERR_SASLFAIL` instead of silently mis-binding.
+
+### Changed — Protocol budget correctness (`irc-core`, `irc-server`)
+
+- **All length budgets are enforced in UTF-8 bytes, not UTF-16 code
+  units** — the 512-byte line cap, `TOPICLEN` (truncated on
+  character boundaries, never mid-multibyte), `NICKLEN` /
+  `CHANNELLEN`, and the `draft/multiline` batch budget, which is
+  now also **enforced incrementally as lines arrive** (an
+  over-budget batch aborts mid-stream with `FAIL`, not just at
+  close).
+- **IRCv3 tag limits enforced in the parser**: at most **15 tags**
+  and an **8191-byte tag section** per message.
+- **Multi-target commands capped.** Comma-split
+  `PRIVMSG`/`NOTICE`/`TAGMSG`/`PART` targets beyond
+  `MAX_TARGETS_PER_COMMAND` are dropped with `407 ERR_TOOMANYTARGETS`.
+- **Long `353 NAMES` replies split** across multiple lines within
+  the 510-byte budget (previously one over-long line).
+- **`CHATHISTORY` limits capped** at a configurable ceiling
+  (default 100) — `CHATHISTORY LATEST #chan * 999999999` no longer
+  asks for an unbounded replay.
+- **Bare-CR smuggling rejected.** Any CR remaining after the
+  trailing CRLF strip is a parse error (`421`), and outbound
+  `RawLine.text` is sanitized of stray CR.
+- **Channel names validated in one shared module** — NUL and
+  control characters are forbidden outright.
+- **`USER` username/realname validated** (charset, byte length, no
+  control characters) before `001`.
+- **`OPER` requires a registered connection** (`451
+  ERR_NOTREGISTERED` pre-registration).
+- **`parseTags` builds a null-prototype map** — a `__proto__` tag
+  can no longer pollute the tags object (prototype pollution).
+
+### Changed — Services hardening (`irc-core`)
+
+- **ChanServ privilege guards.** `DEOP`/`KICK` cannot target the
+  founder from a non-founder, and roster-mutation commands check the
+  caller's access rank (`SOP`/`AOP`/`HOP`/`VOP`) before acting.
+- **HostServ auto-approve denylist/allowlist.** When vhost
+  auto-approve is enabled, requests are checked against a
+  configurable denylist (and optional allowlist) instead of
+  approving everything.
+
+### Added — CI / deploy guards (`ci-hardening`, deploy workflows)
+
+- **Env-var documentation drift guard.** The
+  `consumed-env-vars` block in `apps/cf-worker/wrangler.toml` is
+  contract-checked against the cf-adapter config loader source on
+  every CI run: every consumed var must be documented (classified
+  `[vars]` vs `[secret]`), no stale names, and no `[secret]`-class
+  var may ship as a plaintext `[vars]` entry.
+- **Placeholder-hostname deploy rejection.** The CF deploy workflow
+  refuses to ship while `SERVER_NAME` is still a repo placeholder
+  (`irc.example.com` / `irc.your-domain.invalid`).
+
+### Changed — Documentation
+
+- **`README.md` rewritten to current capabilities**: the abuse
+  controls & credential hardening surface (admission/rate table,
+  protocol budgets, lockouts, the SASL EXTERNAL triple gate), the
+  hardened TCP origins (PROXY v1 + origin TLS on CF, NLB assertions
+  on AWS), the new tools, accurate coverage state, and an updated
+  roadmap.
+
+### ⚠️ Migration required
+
+- **No persisted-DO-state schema change.** `PERSISTED_STATE_VERSION`
+  stays `1`; the D1/DynamoDB services tables are unchanged (the
+  canonical-DN rewrite happens lazily at compare time and is
+  backward-compatible). **Code rollback across this release is
+  safe.**
+- **SASL `EXTERNAL` is now OFF by default.** If you rely on mTLS
+  EXTERNAL, set `EXTERNAL_ENABLED=true` (Workers `[vars]` / Lambda
+  env) **and** ensure edge mTLS (API Shield / APIGW client certs)
+  is configured — the flag alone advertises nothing. Accounts
+  should re-bind to the certificate's DER fingerprint
+  (`fp:<hex>`) where the platform surfaces it.
+- **CF TCP origin: reconfigure Spectrum before deploying.** The
+  container now terminates TLS and **requires PROXY protocol v1**
+  on every flow. Update the Spectrum app to
+  `proxy_protocol = "v1"` + `tls_mode = "full"`, mount the origin
+  certificate readable by UID 1000, and keep origin ingress locked
+  to Spectrum's IP ranges. See `docs/Cloudflare-TCP-Deployment.md`.
+- **AWS: NLB target must preserve flow headers.** The stream
+  handler now rejects flows missing `x-forwarded-for` /
+  `x-forwarded-port` (an NLB target-group attribute) — a
+  misconfigured LB now fails loudly instead of mis-attributing IPs.
+- **Admission defaults are now ON.** `MAX_CONNECTIONS_PER_IP=10`,
+  per-user 5, connect-rate 5/60 s, and 50 frames / 5 s apply even
+  when unset. Deployments behind a shared NAT / proxy (offices,
+  bridges, health probes) should raise `MAX_CONNECTIONS_PER_IP` /
+  the rate budget to taste.
+- **Oper credentials: migrate off plaintext.** `OPER_PASSWORD`
+  still works but is deprecated. Generate
+  `OPER_SALT`/`OPER_HASH` with `tools/hash-oper-cred.ts` and set
+  them as Workers secrets / Lambda env.
+- **Client-visible behaviour changes.** (1) `AUTHENTICATE` frames
+  now count against flood control (a client that sent SASL at line
+  rate will be disconnected as an excess flood). (2) An inbound
+  frame with an embedded bare CR is now a parse error answered with
+  `421` (previously in legacy mode it could smuggle content).
+  (3) Multi-target commands beyond the cap get `407` for the
+  dropped targets. No compliant client is known to trip any of
+  these.
+
+### Known limitations
+
+- **Client compatibility sweep** (WeeChat / HexChat / IRCCloud /
+  TheLounge / matrix-IRC bridge) remains pending.
+- **Web client e2e** (Playwright headless-browser vs a deployed
+  stack) remains pending; the AWS staging frontend e2e
+  (TICKET-169) is still open.
+- Same transport limits as v0.10.0: the **CF TCP path requires
+  Cloudflare Spectrum (Enterprise tier)**; the **AWS TCP path** is
+  subject to Lambda stream-duration limits. WebSocket remains the
+  zero-extra-deps default.
+- **Coverage hardening is near-complete.** `irc-core`,
+  `irc-server`, `in-memory-runtime`, `irc-test-support`,
+  `cf-worker`, `local-cli`, `aws-stack`, `load-test`,
+  `cf-tcp-container`, `tcp-ws-forwarder`, `ci-hardening`, and
+  `deploy-scripts` sit at 100% lines; `cf-adapter` (~99.7%) and
+  `aws-adapter` (~98%) clear the 90% gate with follow-ups open;
+  `web` is at 100% lines / ~98% branches.
+
+### Security
+
+This release is itself a security remediation; the headline items:
+
+- **Admission + rate limiting at every edge** (above) — the audit's
+  "no throttling anywhere" theme: connection floods, per-IP
+  takeovers of the connection budget, and frame floods are now
+  bounded by default.
+- **Plaintext oper credentials replaced** with scrypt hashes +
+  timing-safe verify (above).
+- **Account-enumeration oracles closed**: timing-equalized
+  `verifyNick`, constant-time server-password compare (above).
+- **Brute-force lockouts** on SASL / OPER / NickServ `IDENTIFY`
+  (above).
+- **SASL `EXTERNAL` safe by default** (off unless the operator
+  opts in; fingerprint-based binding) and **bare-CR / prototype-
+  pollution / oversized-payload parser hardening** (above).
+- **Credential redaction from logs** + 10% default sampling
+  (above), complementing v0.10.0's `DataTraceEnabled` hard-lock.
+
+---
+
+## [0.10.0] - 2026-08-13
+
+The main change in this release is **AWS web client parity** — the
+vendored Kiwi IRC SPA is no longer Cloudflare-only. AWS now hosts it
+via an **S3 + CloudFront + OAC** `StaticSite` construct (opt-in via
+CDK context) with a **stack-output-driven two-phase deploy**, and the
+API Gateway `$connect` route gains an opt-in `WEB_ORIGINS` CSWSH
+defence that mirrors the CF Worker's. Alongside it: the SASL
+`AccountStore` is **collapsed into `ServicesStore`** as the single
+credential home (a one-shot backfill migration ships for existing
+deployments), **NickServ `SET PASSWORD`** lands as self-service
+password change, and the staging/prod deploy split is **collapsed**
+into a single target per platform. A round of **AWS deploy security
+hardening** ships: the CI workflow is **OIDC-only** (no long-lived
+access keys), and API Gateway full-frame body logging
+(`DataTraceEnabled`) is **off by default and hard-locked** so IRC
+frames are never written to CloudWatch. Finally, `UuidIdFactory` now
+sources its random bytes from `globalThis.crypto` (CSPRNG) instead of
+`Math.random`, so generated `msgid` / session ids are cryptographic-
+grade.
+
+### Added — AWS web client (`@serverless-ircd/aws-stack`, `@serverless-ircd/aws-adapter`, `@serverless-ircd/web`)
+
+The web client is no longer Cloudflare-only. AWS provisions a
+static-site origin for the SPA while the wss IRC endpoint stays on
+API Gateway — two origins, same `apps/web/dist/` artifact.
+
+- **`StaticSite` construct** (`apps/aws-stack/src/static-site.ts`): a
+  private S3 origin bucket fronted by a CloudFront distribution with
+  **Origin Access Control (OAC)** — direct S3 access is denied by the
+  bucket policy; only CloudFront URLs resolve. `defaultRootObject` is
+  `index.html` (the project landing page at `/`), and a custom error
+  response maps S3 `403`/`404` → `200 /webclient/index.html` so
+  client-side SPA routes resolve. Custom domain (ACM certificate +
+  Route53 `ARecord` alias) is opt-in via CDK context
+  (`webSiteCustomDomain` / `webSiteCertificateArn` /
+  `webSiteHostedZoneName` / `webSiteHostedZoneId`); omitted by default
+  to use `*.cloudfront.net`. Three stable CfnOutputs (`WebsiteURL`,
+  `WebsiteBucketName`, `WebsiteDistributionId`) drive the deploy
+  pipeline below.
+- **CloudFront directory-index viewer-request function**: S3 REST
+  (used with OAC) does not serve index documents, so `/docs/` or
+  `/docs` would 404 and fall through to the SPA error response
+  (serving the Kiwi shell instead of the rendered docs index). A
+  viewer-request CloudFront function now resolves directory-style
+  URIs: trailing-slash paths (`/docs/`, `/`) get `index.html`
+  appended as an internal rewrite, and extensionless paths without a
+  trailing slash (`/docs`) get a `301` redirect to the trailing-slash
+  form so the browser resolves relative asset links against the
+  directory. Real assets (`.html`, `.css`, `.js`, …) are served
+  unchanged. Mirrors the CF Worker `[assets]` binding, which resolves
+  directory indexes automatically.
+- **`$connect` Origin allowlist (CSWSH defence)**: API Gateway
+  WebSocket has no built-in `Origin` validation, so the `$connect`
+  Lambda now enforces it. `WEB_ORIGINS` (comma-separated) is parsed
+  into a normalised lowercase set at cold start; a browser-sent
+  `Origin` not in the set is denied with `403` (API Gateway closes
+  the upgrade). The defence is **opt-in** — unset `WEB_ORIGINS`
+  disables the check entirely so existing bare-IRC deployments without
+  a web frontend are unchanged on upgrade. Non-browser clients (curl,
+  WeeChat, the `tcp-ws-forwarder`, the NLB TCP+TLS path) never send
+  `Origin` and always proceed. Deliberate divergence from the CF
+  policy: **explicit-allowlist only** (no same-origin auto-derive),
+  because the SPA is on a CloudFront origin and the wss endpoint is
+  on an API Gateway origin, so the request's own host is never the
+  SPA's origin. Mirrors the CF Worker's parsing semantics (trimmed,
+  lowercased, scheme+host match).
+- **`prod-aws` build env**: a new `apps/web/static/config.prod-aws.json`
+  + `--env prod-aws` (and a `build:prod-aws` pnpm script) select the
+  AWS API-Gateway-shaped config. The `server` field carries
+  `{{API_ID}}` / `{{REGION}}` / `{{STAGE}}` placeholders the deploy
+  pipeline substitutes at bake time, so no concrete wss URL is
+  hardcoded in the repo. Because irc-framework prepends `wss://`
+  itself from `tls: true`, the baked URL is **split** into a
+  hostname-only `server` and a stage-name `direct_path` (e.g.
+  `/<stage>`) — baking the full `wss://` URL into `server` produced
+  a doubled-scheme `wss://wss//...` URL that Firefox rejects.
+- **Stack-output-driven deploy pipeline** (`scripts/deploy-web-aws.mjs`,
+  a new `@serverless-ircd/deploy-scripts` workspace package): unlike
+  the CF Worker (where `wrangler deploy` ships the SPA in the same
+  command as the runtime), the AWS SPA deploy is **two-phase** because
+  the baked `config.json` carries the API Gateway WebSocket URL as a
+  literal that does not exist at synth time. The script runs
+  `describe-stacks` → `pnpm --filter web build:prod-aws -- --api-url
+  <ConnectUrl>` → `aws s3 sync --delete` →
+  `cloudfront create-invalidation /*`. Fails loudly on missing stack
+  outputs or unsubstituted `{{...}}` placeholders. The
+  `deploy-web` CI job (`.github/workflows/deploy-aws.yml`) runs it
+  with `needs: deploy`.
+
+### Added — NickServ `SET PASSWORD` (`@serverless-ircd/irc-core`)
+
+- **Self-service password change.** `PRIVMSG NickServ :SET PASSWORD
+  <old> <new>` re-verifies the current password (defence against a
+  hijacked `+r` session), enforces a configurable minimum (default 8)
+  and a fixed maximum (256, the scrypt input budget), then re-hashes
+  and persists via `ServicesStore.setNickPassword`. The caller's
+  session stays `+r`; other sessions on the same account are not
+  kicked. Wrong old password is indistinguishable from "no such
+  account" (no enumeration vector). Wired through
+  `InMemoryServicesStore` and `PersistentServicesStore` with round-
+  trip tests on the D1 and DynamoDB backends.
+
+### Added — CSPRNG-backed ids (`@serverless-ircd/irc-core`)
+
+- **`UuidIdFactory` now uses `globalThis.crypto.getRandomValues`.** The
+  previous `Math.random`-based UUIDv4 generation was unsuitable for
+  unforgeable `msgid` / session ids — a predictable id would let a
+  client forge message attribution. The global `crypto.getRandomValues`
+  is available on Node ≥ 19 and Cloudflare Workers without an import.
+  Generated ids are now cryptographic-grade. The `IdFactory` port and
+  the deterministic `testIdFactory` test seam are unchanged, so
+  reducer determinism (reducers never touch real randomness) is
+  preserved; only the production factory changed.
+
+### Changed — Single credential home (`@serverless-ircd/irc-core`, `@serverless-ircd/cf-adapter`, `@serverless-ircd/aws-adapter`)
+
+The SASL `AccountStore` port is **removed**. `ServicesStore` is now
+the single credential home: SASL PLAIN, SASL EXTERNAL (CertFP),
+NickServ `IDENTIFY`, and `PASS <nick>:<password>` all verify through
+the same scrypt-hashed `verifyNick` / `verifyCertFP` surface. This
+closes the cross-store credential drift flagged as a known limitation
+in v0.9.0 — a nick registered via NickServ `REGISTER` after the worker
+booted now authenticates via SASL/PASS immediately, because there is
+no second store to drift out of sync with.
+
+- **`ServicesStore` grows CertFP**: `verifyCertFP` / `addCertFP` /
+  `removeCertFP` are added to the port, and `RegisteredNick` gains a
+  `certSubjects: string[]` field so SASL EXTERNAL resolves through the
+  services store (previously SASL EXTERNAL only worked against the
+  static `InMemoryAccountStore`, never the hashed D1/DynamoDB table).
+- **D1 `cert_subjects` column auto-migrates**: the CF D1 path runs
+  `ALTER TABLE nickserv_accounts ADD COLUMN cert_subjects` inside
+  `migrateServicesSchema` on cold start (`CREATE TABLE IF NOT EXISTS`
+  + the `ALTER`), so no manual DDL is needed. DynamoDB is schemaless.
+- **Removed**: `AccountStore` port, `InMemoryAccountStore`,
+  `HashedAccountStore`, the D1/DynamoDB `account-store`
+  implementations, `SaslPayload` / `SaslResult` / `SaslAccountCredential`
+  / `constantTimeEquals` / `ingestAccountCredential`, and the
+  `accounts` / `Accounts` table reads. The new code only reads
+  `nickserv_accounts` / `Services`.
+- **`tools/migrate-accounts-to-services.ts`**: a one-shot, idempotent,
+  never-overwrite backfill of legacy `accounts` / `Accounts` rows into
+  `nickserv_accounts` / `Services`. Reads the still-deployed
+  `SASL_ACCOUNTS` env var at run time so env-seeded accounts are
+  carried into the services table. `cert_subjects` defaults to `'[]'`
+  for every migrated row (the legacy table had no cert column).
+  **Run this before the v0.10.0 build deploys** — see the migration
+  section below.
+
+### Changed — Single deploy target per platform
+
+The staging/prod deploy split is **collapsed** into one target per
+platform. Staging vs production isolation is now driven by which
+account/region (AWS) or which Worker credentials (CF) the deploy
+targets, not by stack/table/Worker name templating.
+
+- **AWS CDK**: drops the `environmentName` prop, `prefixedTableName`,
+  and the `IrcAwsStack-<env>` stack id. Tables use bare logical ids
+  (`Connections`, `Nicks`, …); the stack is always `IrcAwsStack`.
+- **Cloudflare**: drops the `env.staging` blocks in the cf-worker and
+  cf-tcp-container wrangler configs.
+- **Web build**: drops `build:staging` / `config.staging.json`; `--env`
+  now accepts only `prod` (or the default dev config) and `prod-aws`.
+- **CI**: collapses `deploy-*: staging` jobs into single `deploy` /
+  `deploy-web` jobs; script names align (`pnpm deploy:cf`,
+  `pnpm deploy:aws`, `pnpm deploy:cf:tcp`, `pnpm smoke:aws`,
+  `pnpm smoke:cf`). Deploy workflows remain `workflow_dispatch`-only
+  (no push trigger).
+
+### Added — AWS deploy security
+
+- **OIDC-only CI deploys.** The GitHub Actions deploy workflow
+  (`deploy-aws.yml`) accepts **only** GitHub OIDC web-identity
+  credentials. `aws-access-key-id` / `aws-secret-access-key` inputs
+  are dropped from every `configure-aws-credentials` step in both the
+  `deploy` and `deploy-web` jobs; the workflow requires
+  `AWS_DEPLOY_ROLE_ARN` and fails fast with `::error::` if it is
+  unset, then asserts `aws sts get-caller-identity` matches the
+  configured role before any `cdk deploy` (defence-in-depth against a
+  silent fallback to ambient static credentials). Long-lived access
+  keys powerful enough to deploy CloudFormation + IAM + Lambda +
+  DynamoDB are effectively account-admin; a single exfil vector
+  yields full account takeover. The full IAM trust policy snippet,
+  condition keys, and verification steps are in
+  `docs/AWS-Deployment.md` §17. A `ci-hardening` lint + test suite
+  (`findAwsCredentialSteps`, `readWorkflowPermissions`) locks the
+  OIDC-only contract on every PR.
+- **API Gateway `DataTraceEnabled` off by default and hard-locked.**
+  Full-frame body tracing wrote every IRC frame (`PASS <password>`,
+  `AUTHENTICATE <base64-SASL-PLAIN>`, `JOIN #chan <key>`,
+  `PRIVMSG`/`NOTICE`) to the APIGW execution-log group, leaking
+  credentials to anyone with `logs:GetLogEvents`. Now safe-by-default
+  (`false`); because the staging/prod split collapsed, there is no
+  quiet "non-prod" path to re-enable it. The only way back on is an
+  explicit **two-step opt-in** (`-c allowDataTrace=true` **and** `-c
+  iUnderstandThisLeaksCredentials=true`) that refuses synthesis unless
+  both flags are set — see `docs/AWS-Deployment.md` §7.6. Tear the
+  sandbox stack down immediately after debugging; never deploy that
+  combination to a shared account.
+
+### Changed — Documentation
+
+- **`README.md` updated** to cover AWS web client hosting (the web
+  client section was previously Cloudflare-only), the AWS `$connect`
+  CSWSH defence, the OIDC-only deploy model, the `DataTraceEnabled`
+  hard-lock, and the `scripts/deploy-web-aws.mjs` two-phase deploy.
+  The CF-vs-AWS origin difference is laid out in a table, and the
+  CSWSH section now documents both adapters' modes (same-origin
+  auto-derive on CF; explicit-allowlist-only on AWS).
+
+### ⚠️ Migration required
+
+- **Run `tools/migrate-accounts-to-services.ts` BEFORE deploying
+  v0.10.0** if the deployment has any rows in the legacy `accounts`
+  (CF D1) / `Accounts` (AWS DynamoDB) table. The v0.10.0 build only
+  reads `nickserv_accounts` / `Services`, so legacy rows that are not
+  backfilled will stop authenticating. The script is one-shot,
+  idempotent (`INSERT OR IGNORE` on D1 / conditional `PutItem` on
+  DynamoDB), and never-overwrites a nick already registered in the
+  services table. It reads the still-deployed `SASL_ACCOUNTS` env var
+  at run time so env-seeded accounts are carried through. See the
+  script header for the per-platform invocation:
+
+  ```bash
+  # Cloudflare D1
+  node --import tsx tools/migrate-accounts-to-services.ts \
+    --platform cf --database <d1-name> --remote
+
+  # AWS DynamoDB
+  node --import tsx tools/migrate-accounts-to-services.ts \
+    --platform aws --accounts-table Accounts --services-table Services \
+    --region us-east-1
+  ```
+
+- **Single deploy target: rename your deploy commands.** The
+  staging-specific commands are gone. Update any scripts, runbooks, or
+  CI that called `pnpm deploy:cf:staging` / `pnpm deploy:aws:staging`
+  / `--env staging` to the single-target form (`pnpm deploy:cf`,
+  `pnpm deploy:aws`). Staging vs production isolation is now by
+  account/region (AWS) or by Worker credentials (CF), not by command
+  suffix.
+- **AWS CI: switch to OIDC.** If the repo still has
+  `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` secrets, delete them
+  and invalidate the underlying IAM access key. Configure
+  `AWS_DEPLOY_ROLE_ARN` (a GitHub-OIDC-trusted role) per
+  `docs/AWS-Deployment.md` §17; there is no static-key fallback.
+- **No persisted-DO-state schema change.** `PERSISTED_STATE_VERSION`
+  stays `1`. The `cert_subjects` D1 column is added by an idempotent
+  `ALTER TABLE` on cold start; the D1/DynamoDB services-row shape
+  change is backward-compatible for reads. **Code rollback across
+  this release is safe** provided the account-migration backfill was
+  run (rolling back the code re-introduces the legacy `accounts`/
+  `Accounts` reads, which still work as long as the table still
+  exists — it is not auto-dropped).
+
+### Known limitations
+
+- **The web client remains partial.** The Playwright headless-browser
+  e2e against a deployed frontend is still pending; the SPA is
+  exercised via the WS smoke (`scripts/smoke.mjs`) and the `apps/web`
+  unit / build-smoke suite.
+- **The AWS web client `StaticSite` requires a custom domain to
+  provision via `bin/aws.ts`.** Provisioning the construct without a
+  custom domain (default `*.cloudfront.net` only) currently requires
+  editing `bin/aws.ts` to pass `webSite: {}` directly. Tracked as a
+  follow-up.
+- Same transport limits as v0.9.0: the **CF TCP path requires
+  Cloudflare Spectrum (Enterprise tier)** plus a stateful Container
+  origin; the **AWS TCP path** uses NLB + Lambda streaming and is
+  subject to Lambda idle-timeout / stream-duration limits. The
+  WebSocket path remains the zero-extra-deps default.
+- **mTLS (for SASL `EXTERNAL`) requires a custom domain + uploaded
+  CA/trust-store** on both platforms and is not enabled by default.
+  The `cert_subjects` plumbing lands the server-side storage; the
+  adapter-side client-cert capture at the TLS edge remains a
+  follow-up.
+- **Client compatibility sweep** (WeeChat / HexChat / IRCCloud /
+  TheLounge / matrix-IRC bridge) remains pending.
+- **Coverage hardening is partial.** `irc-core`, `irc-server`,
+  `in-memory-runtime`, and **`cf-adapter`** (new this release) sit at
+  100%; `aws-adapter` and `aws-stack` clear the 90% gate. The
+  remaining packages (`local-cli`, `load-test`, `cf-tcp-container`,
+  `tcp-ws-forwarder`, `irc-test-support`, `web`) are **above the gate
+  but below 100%** — follow-ups drive each to full coverage.
+
+### Security
+
+- **OIDC-only AWS deploys** (above): removes long-lived access keys
+  from the deploy path — the highest-impact exfil vector against an
+  AWS account with deploy permissions.
+- **APIGW `DataTraceEnabled` hard-locked off** (above): IRC frames
+  (including `PASS`, `AUTHENTICATE <SASL-PLAIN>`, channel keys) are
+  no longer written to CloudWatch even if an operator toggles the
+  console setting by hand; the two-flag escape hatch cannot be set by
+  accident.
+- **CSPRNG-backed `msgid` / session ids** (above): generated ids are
+  now cryptographic-grade, closing a forgery vector in the previous
+  `Math.random`-based `UuidIdFactory`.
+- No other auth path changed. The scrypt-hashed credential store,
+  server-password gate, and CF-side CSWSH defence are unchanged from
+  v0.9.0.
+
+---
+
 ## [0.9.0] - 2026-08-10
 
 The main change in this release is **rounding out the integrated IRC