serverless-ircd 0.9.0 → 0.11.0

package/packages/aws-adapter/tests/origin-allowlist.test.ts

@@ -0,0 +1,110 @@
+/**
+ * Unit tests for the `$connect` Origin-allowlist policy
+ * (`packages/aws-adapter/src/origin-allowlist.ts`).
+ *
+ * Mirrors the canonical CF Worker policy
+ * (`apps/cf-worker/src/origin-allowlist.ts`) for the parsing semantics
+ * (comma-separated, trimmed, lowercased) and the "missing Origin =
+ * non-browser → allow" branch. Deliberately diverges from CF by
+ * supporting ONLY the explicit-allowlist mode (the AWS SPA is served
+ * from a different CloudFront origin than the API Gateway WebSocket
+ * endpoint, so same-origin auto-derive does not apply); see the
+ * module docstring for the rationale.
+ */
+import { describe, expect, it } from 'vitest';
+import { decideConnectOrigin, parseWebOrigins } from '../src/origin-allowlist.js';
+
+describe('parseWebOrigins', () => {
+  it('returns an empty set for undefined input', () => {
+    expect(parseWebOrigins(undefined).size).toBe(0);
+  });
+
+  it('returns an empty set for an empty string', () => {
+    expect(parseWebOrigins('').size).toBe(0);
+  });
+
+  it('parses a single origin', () => {
+    expect(parseWebOrigins('https://app.example.com')).toEqual(
+      new Set(['https://app.example.com']),
+    );
+  });
+
+  it('parses multiple comma-separated origins', () => {
+    expect(parseWebOrigins('https://a.example.com,https://b.example.com')).toEqual(
+      new Set(['https://a.example.com', 'https://b.example.com']),
+    );
+  });
+
+  it('trims whitespace around each entry', () => {
+    expect(parseWebOrigins('  https://a.example.com , https://b.example.com  ')).toEqual(
+      new Set(['https://a.example.com', 'https://b.example.com']),
+    );
+  });
+
+  it('lowercases each entry so the match is case-insensitive on scheme/host', () => {
+    // Origins are scheme://host[:port]; scheme and host are case-insensitive
+    // per RFC 3986. Lowercasing the whole string is the simplest
+    // normalisation that matches the real browser-emitted form.
+    expect(parseWebOrigins('https://APP.Example.COM')).toEqual(
+      new Set(['https://app.example.com']),
+    );
+  });
+
+  it('drops empty entries (trailing comma tolerance)', () => {
+    expect(parseWebOrigins('https://a.example.com,,')).toEqual(new Set(['https://a.example.com']));
+  });
+
+  it('drops whitespace-only entries', () => {
+    expect(parseWebOrigins('https://a.example.com,   ,https://b.example.com')).toEqual(
+      new Set(['https://a.example.com', 'https://b.example.com']),
+    );
+  });
+});
+
+describe('decideConnectOrigin', () => {
+  it('allows a missing Origin header (non-browser client)', () => {
+    // curl, WeeChat, and the tcp-ws-forwarder never send `Origin`;
+    // their upgrades must pass through unchanged so existing
+    // non-browser tooling keeps working.
+    expect(decideConnectOrigin(undefined, new Set(['https://app.example.com']))).toBe('allow');
+    expect(decideConnectOrigin(null, new Set(['https://app.example.com']))).toBe('allow');
+    expect(decideConnectOrigin('', new Set(['https://app.example.com']))).toBe('allow');
+  });
+
+  it('allows every Origin when the allowlist is empty (opt-in defense)', () => {
+    // Unset `WEB_ORIGINS` skips the check entirely — existing AWS
+    // deployments without a web frontend are unchanged on upgrade.
+    expect(decideConnectOrigin('https://attacker.example.com', new Set())).toBe('allow');
+    expect(decideConnectOrigin('https://app.example.com', new Set())).toBe('allow');
+  });
+
+  it('allows an Origin that is in the allowlist (case-insensitively)', () => {
+    const allowlist = parseWebOrigins('https://app.example.com');
+    expect(decideConnectOrigin('https://app.example.com', allowlist)).toBe('allow');
+    // The header value is normalised (lowercased, trimmed) before the
+    // membership test, so a mixed-case header matches a lowercased entry.
+    expect(decideConnectOrigin('https://APP.Example.COM', allowlist)).toBe('allow');
+    expect(decideConnectOrigin('  https://app.example.com  ', allowlist)).toBe('allow');
+  });
+
+  it('denies an Origin that is not in the allowlist', () => {
+    const allowlist = parseWebOrigins('https://app.example.com');
+    expect(decideConnectOrigin('https://attacker.example.com', allowlist)).toBe('deny');
+  });
+
+  it('denies an Origin that matches a listed origin except for the scheme', () => {
+    // Origins are case-sensitive on scheme+host+port; `http://` is a
+    // different origin from `https://` and MUST NOT be admitted when
+    // only the `https://` form is allowlisted (defends against a
+    // stripped-TLS attacker on the same hostname).
+    const allowlist = parseWebOrigins('https://app.example.com');
+    expect(decideConnectOrigin('http://app.example.com', allowlist)).toBe('deny');
+  });
+
+  it('matches one of several allowlisted origins', () => {
+    const allowlist = parseWebOrigins('https://app.example.com, https://staging.app.example.com');
+    expect(decideConnectOrigin('https://staging.app.example.com', allowlist)).toBe('allow');
+    expect(decideConnectOrigin('https://app.example.com', allowlist)).toBe('allow');
+    expect(decideConnectOrigin('https://other.example.com', allowlist)).toBe('deny');
+  });
+});

package/packages/aws-adapter/tests/ping-checker.test.ts

@@ -490,7 +490,6 @@ function fakeParams(client: FakeScanDynamo): PingCheckParams {
       ChannelMeta: 'CM',
       ChannelMembers: 'CMem',
       Nicks: 'N',
-      Accounts: 'A',
     },
     managementApi: null,
     now: 100_000,

package/packages/aws-adapter/tests/stats.test.ts

@@ -238,7 +238,6 @@ describe('AwsStats — defensive Scan fallbacks (mocked client)', () => {
       ChannelMeta: 'ChannelMeta',
       ChannelMembers: 'ChannelMembers',
       Nicks: 'Nicks',
-      Accounts: 'Accounts',
     };
     // Pass `undefined` so the stub returns `{}` — no Items key — to
     // exercise the `?? []` fallback on the Connections scan, and
@@ -258,7 +257,6 @@ describe('AwsStats — defensive Scan fallbacks (mocked client)', () => {
       ChannelMeta: 'ChannelMeta',
       ChannelMembers: 'ChannelMembers',
       Nicks: 'Nicks',
-      Accounts: 'Accounts',
     };
     const dynamo = stubDynamo([], 0);
     const stats = new AwsStats({
@@ -279,7 +277,6 @@ describe('AwsStats — defensive Scan fallbacks (mocked client)', () => {
       ChannelMeta: 'ChannelMeta',
       ChannelMembers: 'ChannelMembers',
       Nicks: 'Nicks',
-      Accounts: 'Accounts',
     };
     // Two registered connection rows.
     const items = [

package/packages/aws-adapter/tests/sweeper.test.ts

@@ -393,7 +393,6 @@ function fakeSweepParams(client: FakeScanDynamo): SweepParams {
       ChannelMeta: 'CM',
       ChannelMembers: 'CMem',
       Nicks: 'N',
-      Accounts: 'A',
     },
     now: 10_000,
     staleAfterMs: 1_000,

package/packages/aws-adapter/tests/tables.test.ts

@@ -13,13 +13,12 @@ import {
 } from '../src/tables.js';
 
 describe('TABLE_NAMES', () => {
-  it('contains exactly the six canonical logical names', () => {
+  it('contains exactly the five canonical logical names', () => {
     expect(TABLE_NAMES).toEqual([
       'Connections',
       'ChannelMeta',
       'ChannelMembers',
       'Nicks',
-      'Accounts',
       'Services',
     ]);
   });
@@ -46,10 +45,6 @@ describe('TABLE_KEYS', () => {
   it('exposes the nickLower PK for Nicks', () => {
     expect(TABLE_KEYS.Nicks.pk).toBe('nickLower');
   });
-
-  it('exposes the account PK for Accounts', () => {
-    expect(TABLE_KEYS.Accounts.pk).toBe('account');
-  });
 });
 
 describe('tablesConfigFromNames', () => {
@@ -59,7 +54,6 @@ describe('tablesConfigFromNames', () => {
       ChannelMeta: 'p-ChannelMeta',
       ChannelMembers: 'p-ChannelMembers',
       Nicks: 'p-Nicks',
-      Accounts: 'p-Accounts',
     };
     expect(tablesConfigFromNames(names)).toEqual(names);
   });
@@ -70,7 +64,6 @@ describe('tablesConfigFromNames', () => {
       ChannelMeta: 'cm',
       ChannelMembers: 'cml',
       Nicks: 'n',
-      Accounts: 'a',
     };
     const out = tablesConfigFromNames(names);
     expect(out).not.toBe(names);

package/packages/aws-adapter/tests/transactions.test.ts

@@ -364,7 +364,6 @@ function fakeRuntime(client: FakeDynamo): AwsRuntime {
       ChannelMeta: 'CM',
       ChannelMembers: 'CMem',
       Nicks: 'N',
-      Accounts: 'A',
     },
     connId: 'probe',
     handlers,

package/packages/cf-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/cf-adapter",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "private": true,
   "description": "Cloudflare Workers adapter: Durable Objects (ConnectionDO, RegistryDO, ChannelDO) and CfRuntime implementing IrcRuntime",
   "license": "BSD-3-Clause",
@@ -11,10 +11,6 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
-    },
-    "./accounts": {
-      "types": "./dist/d1-account-store.d.ts",
-      "import": "./dist/d1-account-store.js"
     }
   },
   "scripts": {

package/packages/cf-adapter/src/cf-runtime.ts

@@ -162,6 +162,30 @@ export class CfRuntime implements IrcRuntime {
    * round-trip for the enumeration phase.
    */
   async broadcastWallops(lines: RawLine[], except?: ConnId): Promise<void> {
+    await this.fanOutByUserMode(lines, except, 'wallops');
+  }
+
+  /**
+   * Oper-only global notice fan-out (e.g. the OPER reducer's per-IP
+   * lockout notice). Identical enumeration to {@link broadcastWallops};
+   * the recipient gate is user mode `+o` instead of `+w`.
+   */
+  async broadcastOperNotice(lines: RawLine[], except?: ConnId): Promise<void> {
+    await this.fanOutByUserMode(lines, except, 'oper');
+  }
+
+  /**
+   * Shared fan-out behind {@link broadcastWallops} and
+   * {@link broadcastOperNotice}: enumerate every connId across all
+   * registry shards, fetch each candidate's state, gate on the requested
+   * user mode, and deliver via the ConnectionDO `deliver` RPC.
+   * `except` (the originator) and the bound connection are skipped.
+   */
+  private async fanOutByUserMode(
+    lines: RawLine[],
+    except: ConnId | undefined,
+    mode: 'wallops' | 'oper',
+  ): Promise<void> {
     // Phase 1 — enumerate every connId across all registry shards.
     const shardEntries = await Promise.all(
       Array.from({ length: this.registryShards }, (_, i) => this.registryShardRpc(i).listEntries()),
@@ -173,18 +197,20 @@ export class CfRuntime implements IrcRuntime {
       }
     }
 
-    // Phase 2 — fetch each candidate's state, filter +w, deliver.
+    // Phase 2 — fetch each candidate's state, filter by mode, deliver.
     // Bound the per-call fan-out by skipping the excepted/bound connection
-    // up front (the bound connection's own +w never needs a self-RPC).
+    // up front (the bound connection's own mode never needs a self-RPC).
     await Promise.all(
       Array.from(seen, async (connId) => {
         if (connId === except || connId === this.connId) return;
         const stub = this.env.CONNECTION_DO.get(this.env.CONNECTION_DO.idFromString(connId));
         const dto = await (stub as unknown as ConnectionRpc).getConnState();
-        if (dto === null) return;
-        const state = deserialize(dto);
-        if (!state.userModes.wallops) return;
-        await (stub as unknown as ConnectionRpc).deliver(lines);
+        await this.deliverToCandidateByMode(
+          stub as unknown as { deliver(lines: RawLine[]): Promise<unknown> },
+          dto,
+          lines,
+          mode,
+        );
       }),
     );
   }
@@ -284,7 +310,7 @@ export class CfRuntime implements IrcRuntime {
     }
     const stub = this.env.CONNECTION_DO.get(this.env.CONNECTION_DO.idFromString(conn));
     const dto = await (stub as unknown as ConnectionRpc).getConnState();
-    return dto === null ? null : deserialize(dto);
+    return this.deserializeConnState(dto);
   }
 
   async getChannelConnections(chan: ChanName): Promise<ReadonlyMap<ConnId, ConnectionState>> {
@@ -294,9 +320,7 @@ export class CfRuntime implements IrcRuntime {
       memberIds.map(async (id) => {
         const connStub = this.env.CONNECTION_DO.get(this.env.CONNECTION_DO.idFromString(id));
         const dto = await (connStub as unknown as ConnectionRpc).getConnState();
-        if (dto !== null) {
-          out.set(id, deserialize(dto));
-        }
+        this.collectChannelMember(out, id, dto);
       }),
     );
     return out;
@@ -320,6 +344,72 @@ export class CfRuntime implements IrcRuntime {
     return loadServerConfigFromCfEnv(this.env as unknown as CfConfigEnv);
   }
 
+  /**
+   * Phase 2 of {@link broadcastWallops}: rehydrates the candidate's
+   * persisted state, gates on user mode `+w`, and dispatches `lines`
+   * via the target stub's `deliver` RPC. Kept as a public test seam
+   * because every real ConnectionDO's `getConnState` always returns a
+   * non-null DTO (the storage layer is the source of truth and always
+   * has an entry post-`loadState`), so the `dto === null` and `!+w`
+   * defensive arms are unreachable through end-to-end RPC.
+   *
+   * Behavioural contract:
+   *   - `dto === null`           → no-op (candidate reported no state).
+   *   - `dto` with `+w` off      → no-op (recipient gate fails).
+   *   - `dto` with `+w` on       → `stub.deliver(lines)` awaited.
+   */
+  public async deliverWallopsToCandidate(
+    stub: { deliver(lines: RawLine[]): Promise<unknown> },
+    dto: PersistedConnectionState | null,
+    lines: RawLine[],
+  ): Promise<void> {
+    await this.deliverToCandidateByMode(stub, dto, lines, 'wallops');
+  }
+
+  /**
+   * Mode-parameterised gate behind {@link deliverWallopsToCandidate} and
+   * {@link fanOutByUserMode}: rehydrate the DTO, check the requested
+   * user mode (`+w` wallops / `+o` oper), deliver when it is set.
+   */
+  private async deliverToCandidateByMode(
+    stub: { deliver(lines: RawLine[]): Promise<unknown> },
+    dto: PersistedConnectionState | null,
+    lines: RawLine[],
+    mode: 'wallops' | 'oper',
+  ): Promise<void> {
+    if (dto === null) return;
+    const state = deserialize(dto);
+    if (!state.userModes[mode]) return;
+    await stub.deliver(lines);
+  }
+
+  /**
+   * Rehydrates a cross-connection DTO into a live {@link ConnectionState},
+   * returning `null` when the candidate reported no persisted state.
+   * Extracted as a public test seam because real ConnectionDOs always
+   * return a non-null DTO from `getConnState`, so the `dto === null`
+   * arm is unreachable through end-to-end RPC.
+   */
+  public deserializeConnState(dto: PersistedConnectionState | null): ConnectionState | null {
+    return dto === null ? null : deserialize(dto);
+  }
+
+  /**
+   * Per-member collector for {@link getChannelConnections}: rehydrates the
+   * DTO and adds it to `out` keyed by `id`. Extracted so the null-DTO arm
+   * (a member whose ConnectionDO reports no live state) is testable
+   * directly without constructing a DO whose `getConnState` always
+   * returns non-null.
+   */
+  public collectChannelMember(
+    out: Map<ConnId, ConnectionState>,
+    id: ConnId,
+    dto: PersistedConnectionState | null,
+  ): void {
+    if (dto === null) return;
+    out.set(id, deserialize(dto));
+  }
+
   // -------------------------------------------------------------------------
   // Internal
   // -------------------------------------------------------------------------

package/packages/cf-adapter/src/channel-do.ts

@@ -63,7 +63,7 @@ interface PersistedChannelState {
   modes: ChannelState['modes'];
   banMasks: string[];
   topic?: ChannelTopic;
-  members: Array<Omit<RosterEntry, 'conn'> & { conn: ConnId }>;
+  members: Array<Omit<RosterEntry, 'conn'> & { conn: ConnId; op?: boolean; voice?: boolean }>;
   pendingInvites: string[];
   createdAt: number;
 }
@@ -370,7 +370,13 @@ function serializeChannel(chan: ChannelState): PersistedChannelState {
   return out;
 }
 
-function deserializeChannel(record: PersistedChannelState): ChannelState {
+/**
+ * Rebuilds a live {@link ChannelState} from a JSON-friendly persisted
+ * record. Exported so the legacy-shape defensive arms (`op`/`voice`
+ * coalescing, missing-topic branch) are unit-testable without driving
+ * a full DO storage round-trip.
+ */
+export function deserializeChannel(record: PersistedChannelState): ChannelState {
   const chan: ChannelState = {
     name: record.name,
     nameLower: record.nameLower,
@@ -393,8 +399,12 @@ function deserializeChannel(record: PersistedChannelState): ChannelState {
  * Builds a JSON-friendly {@link ChannelSnapshotDto} from a live
  * {@link ChannelState}. Uses {@link toSnapshot} for the immutable
  * view, then flattens the `Map`/`Set` fields to arrays.
+ *
+ * Exported so the defensive `?:` arms (which fire when a state was
+ * built outside {@link createChannel} and lacks the `Set`/`Map`
+ * fields) are unit-testable directly.
  */
-function toDto(chan: ChannelState): ChannelSnapshotDto {
+export function toDto(chan: ChannelState): ChannelSnapshotDto {
   // Defensively rebuild arrays; in some test-pool code paths the cached
   // state's Set/Map fields may be missing if the channel was created
   // via an unusual path (e.g. direct storage put without going through

package/packages/cf-adapter/src/config-loader.ts

@@ -13,6 +13,15 @@
 
 import { type ParsedServerConfig, parseServerConfig } from '@serverless-ircd/irc-core';
 
+/**
+ * Documented schema defaults for `perIpConnectionRate`. Duplicated here
+ * (the schema inlines its `.default(...)`) so an operator setting only
+ * one half of the knob via env gets the documented default for the other
+ * half rather than a parse error.
+ */
+const DEFAULT_PER_IP_RATE_MAX = 5;
+const DEFAULT_PER_IP_RATE_WINDOW_MS = 60_000;
+
 /**
  * The subset of the Workers `Env` that this loader reads. Mirrors the
  * production {@link Env} in `env.ts` plus the optional knobs the schema
@@ -38,6 +47,20 @@ export interface CfConfigEnv {
   CHANNEL_PREFIXES?: string;
   OPER_USER?: string;
   OPER_PASSWORD?: string;
+  /**
+   * Scrypt salt (base64) for the hashed oper credential form. When set
+   * alongside `OPER_USER` + `OPER_HASH`, the loader builds a hashed
+   * `{user, salt, hash}` cred instead of the legacy plaintext
+   * `{user, password}` shape. The hashed form is preferred when both
+   * are present so deployments can rotate without removing the legacy
+   * vars in the same step. Generate via `tools/hash-oper-cred.ts`.
+   */
+  OPER_SALT?: string;
+  /**
+   * Scrypt hash (base64) for the hashed oper credential form. See
+   * `OPER_SALT` for the full set of vars.
+   */
+  OPER_HASH?: string;
   /**
    * Server-password gate. Treat as a wrangler secret in production
    * (never a plaintext `[vars]` entry); the loader threads it through
@@ -59,6 +82,40 @@ export interface CfConfigEnv {
    * path (vs the connection-do's direct env read) stays consistent.
    */
   SASL_ACCOUNTS?: string;
+  /**
+   * Per-connection inbound frame window ceiling enforced by
+   * `ConnectionDO.webSocketMessage` BEFORE the actor / storage write.
+   * Parsed into `ServerConfig.adapter.maxFramesPerWindow`.
+   */
+  MAX_FRAMES_PER_WINDOW?: string;
+  /**
+   * Sliding-window length (seconds) for the inbound frame limit; frames
+   * older than the window stop counting. Parsed into
+   * `ServerConfig.adapter.frameWindowSeconds`.
+   */
+  FRAME_WINDOW_SECONDS?: string;
+  /**
+   * Per-IP simultaneous-connection cap (`maxConnectionsPerIp`). Enforced
+   * by the adapters' admission gates; mirrors the Lambda loader's var of
+   * the same name.
+   */
+  MAX_CONNECTIONS_PER_IP?: string;
+  /**
+   * Per-IP connection-rate budget (`perIpConnectionRate.max`) — how many
+   * new connections one source IP may open per sliding window. The unset
+   * half of the knob falls back to the schema default.
+   */
+  PER_IP_CONNECTION_RATE_MAX?: string;
+  /** Sliding window length in ms (`perIpConnectionRate.windowMs`). */
+  PER_IP_CONNECTION_RATE_WINDOW_MS?: string;
+  /**
+   * Operator opt-in for certificate-backed SASL EXTERNAL. 'true'/'1'
+   * (case-insensitive) map to `sasl.externalEnabled: true`; any other
+   * value (and unset) leaves the mechanism off. EXTERNAL additionally
+   * requires edge mTLS (API Shield client certs) and a secure (TLS)
+   * connection — the flag alone advertises nothing.
+   */
+  EXTERNAL_ENABLED?: string;
 }
 
 /**
@@ -91,14 +148,36 @@ function buildConfigInput(env: CfConfigEnv): Record<string, unknown> {
     input.channelPrefixes = env.CHANNEL_PREFIXES;
   }
   if (env.OPER_USER !== undefined || env.OPER_PASSWORD !== undefined) {
-    // Build the cred object from whatever was supplied; the schema
-    // surfaces a `user`/`password` error if only one half was provided.
-    input.operCreds = [
-      {
-        user: env.OPER_USER ?? '',
-        password: env.OPER_PASSWORD ?? '',
-      },
-    ];
+    // Hashed form (OPER_USER + OPER_SALT + OPER_HASH) is preferred when
+    // both salt + hash are supplied — even if OPER_PASSWORD is also set,
+    // so a deployment can rotate to the hashed form without dropping the
+    // legacy var in the same release. The legacy plaintext
+    // `{user, password}` shape is retained for a single deprecation-
+    // cycle window.
+    const hasHashed = env.OPER_SALT !== undefined && env.OPER_HASH !== undefined;
+    if (hasHashed) {
+      input.operCreds = [
+        {
+          user: env.OPER_USER ?? '',
+          salt: env.OPER_SALT ?? '',
+          hash: env.OPER_HASH ?? '',
+        },
+      ];
+    } else {
+      // Build the legacy cred object from whatever was supplied; the
+      // schema surfaces a `user`/`password` error if only one half was
+      // provided. If only OPER_SALT/OPER_HASH (partial) are set, the
+      // schema will surface the missing hashed-form field via the
+      // superRefine error path.
+      input.operCreds = [
+        {
+          user: env.OPER_USER ?? '',
+          password: env.OPER_PASSWORD ?? '',
+          ...(env.OPER_SALT !== undefined ? { salt: env.OPER_SALT } : {}),
+          ...(env.OPER_HASH !== undefined ? { hash: env.OPER_HASH } : {}),
+        },
+      ];
+    }
   }
   if (env.SERVER_PASSWORD !== undefined) {
     input.serverPassword = env.SERVER_PASSWORD;
@@ -127,9 +206,55 @@ function buildConfigInput(env: CfConfigEnv): Record<string, unknown> {
   if (env.SASL_ACCOUNTS !== undefined && env.SASL_ACCOUNTS.length > 0) {
     input.saslAccounts = parseSaslAccountsLines(env.SASL_ACCOUNTS);
   }
+  if (env.MAX_FRAMES_PER_WINDOW !== undefined || env.FRAME_WINDOW_SECONDS !== undefined) {
+    // Partial sections are fine: the per-field schema defaults fill the
+    // knob(s) the env did not supply.
+    input.adapter = {
+      ...(env.MAX_FRAMES_PER_WINDOW !== undefined
+        ? { maxFramesPerWindow: Number.parseInt(env.MAX_FRAMES_PER_WINDOW, 10) }
+        : {}),
+      ...(env.FRAME_WINDOW_SECONDS !== undefined
+        ? { frameWindowSeconds: Number.parseInt(env.FRAME_WINDOW_SECONDS, 10) }
+        : {}),
+    };
+  }
+  if (env.MAX_CONNECTIONS_PER_IP !== undefined) {
+    input.maxConnectionsPerIp = Number.parseInt(env.MAX_CONNECTIONS_PER_IP, 10);
+  }
+  if (
+    env.PER_IP_CONNECTION_RATE_MAX !== undefined ||
+    env.PER_IP_CONNECTION_RATE_WINDOW_MS !== undefined
+  ) {
+    // The schema requires both halves; the unset one falls back to the
+    // documented schema defaults so an operator can tune just the budget
+    // (or just the window) without restating the other.
+    input.perIpConnectionRate = {
+      max:
+        env.PER_IP_CONNECTION_RATE_MAX !== undefined
+          ? Number.parseInt(env.PER_IP_CONNECTION_RATE_MAX, 10)
+          : DEFAULT_PER_IP_RATE_MAX,
+      windowMs:
+        env.PER_IP_CONNECTION_RATE_WINDOW_MS !== undefined
+          ? Number.parseInt(env.PER_IP_CONNECTION_RATE_WINDOW_MS, 10)
+          : DEFAULT_PER_IP_RATE_WINDOW_MS,
+    };
+  }
+  if (env.EXTERNAL_ENABLED !== undefined) {
+    input.sasl = { externalEnabled: parseEnabledFlag(env.EXTERNAL_ENABLED) };
+  }
   return input;
 }
 
+/**
+ * Parses a boolean feature-flag env var: 'true' / '1' (case-insensitive,
+ * whitespace-trimmed) are truthy; every other value is false. Flags
+ * default off, so a typo must never silently enable the feature.
+ */
+function parseEnabledFlag(raw: string): boolean {
+  const normalized = raw.trim().toLowerCase();
+  return normalized === 'true' || normalized === '1';
+}
+
 /**
  * Parses the `CREATED_AT` env var into the schema's `createdAt` field.
  *