serverless-ircd 0.9.0 → 0.11.0

package/packages/cf-adapter/tests/worker/main.ts

@@ -21,6 +21,8 @@
 import { ChannelDO } from '../../src/channel-do';
 import { ChannelRegistryDO } from '../../src/channel-registry-do';
 import { ConnectionDO } from '../../src/connection-do';
+import { CounterDO } from '../../src/counter-do';
+import { RateLimitDO } from '../../src/rate-limit-do';
 import { RegistryDO } from '../../src/registry-do';
 import { RecordingChannelDO } from './stubs/channel-stub';
 import { RecordingRegistryDO } from './stubs/registry-stub';
@@ -29,6 +31,8 @@ export {
   ChannelDO,
   ChannelRegistryDO,
   ConnectionDO,
+  CounterDO,
+  RateLimitDO,
   RegistryDO,
   RecordingRegistryDO,
   RecordingChannelDO,

package/packages/cf-adapter/wrangler.test.toml

@@ -49,6 +49,23 @@ class_name = "ChannelDO"
 name = "CHANNEL_REGISTRY_DO"
 class_name = "ChannelRegistryDO"
 
+# Global live-connection admission counter — single DO instance keyed by
+# the fixed name `global`. The worker edge reserves a slot per upgrade
+# (maxClients cap); ConnectionDO releases it on every teardown path and
+# heartbeats it from the PING alarm so the lazy TTL reap only evicts
+# entries from DOs that stopped heartbeating.
+[[durable_objects.bindings]]
+name = "COUNTER_DO"
+class_name = "CounterDO"
+
+# Per-IP upgrade rate limiter — single DO instance keyed by the fixed
+# name `global`, maintaining one sliding-window admission-timestamp list
+# per CF-Connecting-IP. The worker edge checks the budget before
+# forwarding an upgrade and rejects over-budget IPs with 429.
+[[durable_objects.bindings]]
+name = "RATE_LIMIT_DO"
+class_name = "RateLimitDO"
+
 # Recording stubs (kept under separate names for any test that wants to
 # assert "this exact RPC was emitted" rather than the end-to-end effect).
 [[durable_objects.bindings]]
@@ -71,4 +88,4 @@ class_name = "ChannelDO"
 
 [[migrations]]
 tag = "v1"
-new_classes = ["ConnectionDO", "RegistryDO", "ChannelDO", "ChannelRegistryDO", "RecordingRegistryDO", "RecordingChannelDO"]
+new_classes = ["ConnectionDO", "RegistryDO", "ChannelDO", "ChannelRegistryDO", "CounterDO", "RateLimitDO", "RecordingRegistryDO", "RecordingChannelDO"]

package/packages/in-memory-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/in-memory-runtime",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "private": true,
   "description": "Single-process reference implementation of the IrcRuntime port, backed by Maps",
   "license": "BSD-3-Clause",

package/packages/in-memory-runtime/src/in-memory-runtime.ts

@@ -25,6 +25,7 @@ import {
   type ConnSnapshot,
   type ConnectionState,
   type Nick,
+  OperFailureStats,
   type RawLine,
   type ServerConfig,
   applyChannelDelta as applyDelta,
@@ -84,10 +85,20 @@ export class InMemoryRuntime implements IrcRuntime {
   private readonly admissionStats: AdmissionStats | undefined;
   private readonly admissionConfig: AdmissionConfig | undefined;
   private readonly configLoader: (() => Promise<ServerConfig>) | undefined;
+  /**
+   * Per-IP failed-`OPER` counter shared across every connection's actor
+   * (see `ctx.operFailures`). Bound to the runtime's clock so the OPER
+   * reducer's lockout window advances with the same time source the
+   * actors observe. Adapters hand `runtime.operFailures` to each
+   * `ConnectionActor`'s options; the counter is then per-IP across the
+   * whole process, not per-connection.
+   */
+  readonly operFailures: OperFailureStats;
 
   constructor(opts: InMemoryRuntimeOptions) {
     this.clock = opts.clock;
     this.configLoader = opts.configLoader;
+    this.operFailures = new OperFailureStats(opts.clock);
     if (opts.admission !== undefined) {
       this.admissionConfig = opts.admission;
       this.admissionStats = new AdmissionStats(this.clock);
@@ -270,6 +281,20 @@ export class InMemoryRuntime implements IrcRuntime {
     }
   }
 
+  /**
+   * Oper-only notice fanout — the recipient gate for the OPER reducer's
+   * per-IP lockout notice (`:<server> NOTICE * :OPER lockout triggered
+   * for <host>`). Identical enumeration to {@link broadcastWallops} but
+   * filtered on user mode `+o` instead of `+w`.
+   */
+  async broadcastOperNotice(lines: RawLine[], except?: ConnId): Promise<void> {
+    for (const [connId, tracked] of this.connections) {
+      if (connId === except) continue;
+      if (!tracked.state.userModes.oper) continue;
+      tracked.handlers.send(lines);
+    }
+  }
+
   // ------------------------------------------------------------------
   // IrcRuntime — nick registry
   // ------------------------------------------------------------------

package/packages/in-memory-runtime/tests/in-memory-runtime.test.ts

@@ -893,3 +893,77 @@ describe('InMemoryRuntime — broadcastWallops', () => {
     expect(c1Received).toBe(0);
   });
 });
+
+describe('InMemoryRuntime — broadcastOperNotice', () => {
+  it('delivers lines to every connection with the +o user mode set', async () => {
+    const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
+    const received: Record<string, RawLine[][]> = { c1: [], c2: [], c3: [] };
+    const push = (id: string) => (lines: RawLine[]) => received[id]?.push(lines);
+    // c1 has +w but NOT +o; c2 and c3 are opers.
+    const c1 = makeConn('c1', 'alice');
+    c1.userModes.wallops = true;
+    rt.registerConnection(c1, { send: push('c1'), disconnect: () => {} });
+    const c2 = makeConn('c2', 'bob');
+    c2.userModes.oper = true;
+    rt.registerConnection(c2, { send: push('c2'), disconnect: () => {} });
+    const c3 = makeConn('c3', 'carol');
+    c3.userModes.oper = true;
+    rt.registerConnection(c3, { send: push('c3'), disconnect: () => {} });
+
+    await rt.broadcastOperNotice([L(':srv NOTICE * :OPER lockout triggered for 10.0.0.1')]);
+
+    // +w without +o is NOT enough — the oper notice is oper-only.
+    expect(received.c1).toHaveLength(0);
+    expect(received.c2).toHaveLength(1);
+    expect(received.c3).toHaveLength(1);
+  });
+
+  it('skips the except connection even when it is an oper', async () => {
+    const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
+    const received: Record<string, RawLine[][]> = { c1: [], c2: [] };
+    const push = (id: string) => (lines: RawLine[]) => received[id]?.push(lines);
+    const oper = makeConn('c1', 'alice');
+    oper.userModes.oper = true;
+    rt.registerConnection(oper, { send: push('c1'), disconnect: () => {} });
+    const peer = makeConn('c2', 'bob');
+    peer.userModes.oper = true;
+    rt.registerConnection(peer, { send: push('c2'), disconnect: () => {} });
+
+    await rt.broadcastOperNotice([L(':srv NOTICE * :hi')], 'c1');
+
+    expect(received.c1).toHaveLength(0);
+    expect(received.c2).toHaveLength(1);
+  });
+
+  it('is a no-op when no connection has +o', async () => {
+    const rt = new InMemoryRuntime({ clock: new FakeClock(0) });
+    let c1Received = 0;
+    rt.registerConnection(makeConn('c1', 'alice'), {
+      send: () => {
+        c1Received++;
+      },
+      disconnect: () => {},
+    });
+
+    await rt.broadcastOperNotice([L(':srv NOTICE * :hi')]);
+    expect(c1Received).toBe(0);
+  });
+});
+
+describe('InMemoryRuntime — operFailures tracker', () => {
+  it('exposes one shared OperFailureStats instance bound to the runtime clock', async () => {
+    const clock = new FakeClock(1_000);
+    const rt = new InMemoryRuntime({ clock });
+
+    const tracker = rt.operFailures;
+    expect(tracker).toBeDefined();
+    // Same instance every read: adapters hand it to every connection's
+    // actor so the per-IP budget is shared fleet-wide.
+    expect(rt.operFailures).toBe(tracker);
+
+    tracker.recordFailure('10.0.0.1');
+    clock.advance(1_000);
+    tracker.recordFailure('10.0.0.1');
+    expect(tracker.recentFailures('10.0.0.1', 300_000)).toBe(2);
+  });
+});

package/packages/irc-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/irc-core",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "private": true,
   "description": "Platform-agnostic IRC protocol core: parser, serializer, command reducers, state shapes",
   "license": "BSD-3-Clause",

package/packages/irc-core/src/account-migration.ts

@@ -0,0 +1,140 @@
+/**
+ * Pure helpers for the one-shot `accounts` → `nickserv_accounts` /
+ * `Services` migration (`tools/migrate-accounts-to-services.ts`).
+ *
+ * Lives in `irc-core` so both adapter test suites can import the helpers
+ * without a cross-adapter dependency. The CLI entry point (wrangler /
+ * DynamoDB IO) lives in the tools script; these helpers are side-effect-
+ * free and fully unit-testable.
+ */
+
+import { caseFold } from './case-fold.js';
+import { hashAccountCredential } from './credential-hashing.js';
+
+/**
+ * DDL for the `nickserv_accounts` table (the migration target). Inlined
+ * rather than imported from `@serverless-ircd/cf-adapter` so the helpers
+ * are testable from any package. Kept in sync with
+ * `cf-adapter/src/d1-services-store.ts`.
+ */
+export const MIGRATION_NICKSERV_ACCOUNTS_SQL =
+  "CREATE TABLE IF NOT EXISTS nickserv_accounts (nick_key TEXT PRIMARY KEY, nick TEXT NOT NULL, account TEXT NOT NULL, email TEXT NOT NULL, created_at INTEGER NOT NULL, enforce TEXT NOT NULL, cert_subjects TEXT NOT NULL DEFAULT '[]', algorithm TEXT NOT NULL, salt TEXT NOT NULL, hash TEXT NOT NULL)";
+
+/** Parsed `SASL_ACCOUNTS` env var entry. */
+export interface ParsedSaslAccount {
+  username: string;
+  password: string;
+}
+
+/** A raw legacy `accounts` row read from D1 or DynamoDB. */
+export interface LegacyAccountRow {
+  account: string;
+  algorithm: string;
+  salt: string;
+  hash: string;
+}
+
+/** Parses the `SASL_ACCOUNTS` env var into credential entries. */
+export function parseSaslAccountsForMigration(raw: string | undefined): ParsedSaslAccount[] {
+  if (raw === undefined || raw.length === 0) return [];
+  const out: ParsedSaslAccount[] = [];
+  for (const line of raw.split('\n')) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0) continue;
+    const sep = trimmed.indexOf(':');
+    if (sep <= 0) continue;
+    const username = trimmed.slice(0, sep);
+    const password = trimmed.slice(sep + 1);
+    if (username.length === 0 || password.length === 0) continue;
+    out.push({ username, password });
+  }
+  return out;
+}
+
+/**
+ * Builds the set of `INSERT OR IGNORE` SQL statements that backfill the
+ * legacy `accounts` rows plus the `SASL_ACCOUNTS` env-seed entries into
+ * `nickserv_accounts`. Pure (no IO).
+ *
+ * - Legacy rows are copied verbatim (the pre-hashed scrypt credential is
+ *   preserved; the plaintext is NOT re-hashed). The services row carries
+ *   `cert_subjects = '[]'`, email `''`, enforce `'none'`, `created_at 0`.
+ * - `SASL_ACCOUNTS` env-seed entries are hashed fresh (the env var carries
+ *   plaintext passwords). Only entries whose username is NOT already
+ *   present in the legacy rows are emitted (legacy rows win over the env
+ *   seed).
+ * - `INSERT OR IGNORE` guarantees idempotency: an existing
+ *   `nickserv_accounts` row (registered via NickServ or a prior seed) is
+ *   never clobbered.
+ *
+ * @returns The array of executable SQL statements (CREATE TABLE + INSERTs).
+ */
+export function buildMigrationSql(
+  legacyRows: ReadonlyArray<LegacyAccountRow>,
+  saslAccountsRaw: string | undefined,
+): string[] {
+  const statements: string[] = [MIGRATION_NICKSERV_ACCOUNTS_SQL];
+
+  const seen = new Set<string>();
+
+  for (const row of legacyRows) {
+    const nickKey = caseFold('rfc1459', row.account);
+    seen.add(nickKey);
+    statements.push(buildInsertOrIgnore(row.account, row));
+  }
+
+  for (const acct of parseSaslAccountsForMigration(saslAccountsRaw)) {
+    const nickKey = caseFold('rfc1459', acct.username);
+    if (seen.has(nickKey)) continue;
+    seen.add(nickKey);
+    const cred = hashAccountCredential(acct.username, acct.password);
+    statements.push(buildInsertOrIgnore(acct.username, cred));
+  }
+
+  return statements;
+}
+
+function buildInsertOrIgnore(
+  username: string,
+  cred: { algorithm: string; salt: string; hash: string },
+): string {
+  const nickKey = caseFold('rfc1459', username);
+  return `INSERT OR IGNORE INTO nickserv_accounts (nick_key, nick, account, email, created_at, enforce, cert_subjects, algorithm, salt, hash) VALUES ('${sqlEscape(nickKey)}', '${sqlEscape(username)}', '${sqlEscape(username)}', '', 0, 'none', '[]', '${sqlEscape(cred.algorithm)}', '${sqlEscape(cred.salt)}', '${sqlEscape(cred.hash)}')`;
+}
+
+/** Doubles single quotes for safe embedding in a D1 SQL string literal. */
+function sqlEscape(value: string): string {
+  return value.replace(/'/g, "''");
+}
+
+/**
+ * Builds the DynamoDB `PutItem` input for a legacy row, targeting the
+ * `Services` table's `NICK:<fold>` / `#` item. Pure.
+ *
+ * The caller wraps this in a conditional PutItem
+ * (`ConditionExpression: attribute_not_exists(pk)`) so an existing nick
+ * registration is never clobbered.
+ */
+export function buildServicesPutItem(
+  row: { account: string; algorithm: string; salt: string; hash: string },
+  tableName: string,
+): { TableName: string; Item: Record<string, unknown> } {
+  const fold = caseFold('rfc1459', row.account);
+  return {
+    TableName: tableName,
+    Item: {
+      pk: `NICK:${fold}`,
+      sk: '#',
+      type: 'nick',
+      nick: row.account,
+      account: row.account,
+      email: '',
+      createdAt: 0,
+      enforce: 'none',
+      certSubjects: [],
+      algorithm: row.algorithm,
+      salt: row.salt,
+      hash: row.hash,
+    },
+  };
+}

package/packages/irc-core/src/caps/capabilities.ts

@@ -16,7 +16,8 @@ export interface Capability {
   /**
    * Optional value parameter. For `sasl` this is the base mechanism list
    * (`PLAIN`); the {@link saslCapValue} helper upgrades it to include
-   * `EXTERNAL` when mTLS is configured for a connection.
+   * `EXTERNAL` when the mechanism is available for the connection (mTLS
+   * source + operator opt-in + secure transport).
    */
   value?: string;
 }
@@ -40,6 +41,14 @@ export const PRE_AWAY_CAP_NAME = 'draft/pre-away';
  */
 export const DEFAULT_MULTILINE_MAX_BYTES = 4096;
 
+/**
+ * Default per-batch entry ceiling enforced incrementally while a
+ * `draft/multiline` batch is open. Defense-in-depth against a client that
+ * streams many tiny lines (each under the byte budget) and never closes the
+ * batch; deployments override via `ServerConfig.multilineMaxEntries`.
+ */
+export const DEFAULT_MULTILINE_MAX_ENTRIES = 100;
+
 /**
  * Builds the `draft/multiline` cap *value* (the substring after `=`) for the
  * advertised byte budget. The {@link CapReducer} and the multi-line reducer
@@ -79,17 +88,18 @@ export const SUPPORTED_CAPABILITIES: ReadonlyArray<Capability> = Object.freeze([
 ]);
 
 /**
- * Returns the `sasl` cap value to advertise given whether an mTLS identity
- * provider is bound for the connection.
+ * Returns the `sasl` cap value to advertise given whether the SASL
+ * EXTERNAL mechanism is available for the connection.
  *
- * PLAIN is always available. EXTERNAL is advertised only when mTLS is
- * configured (an `MtlsIdentityProvider` is bound) so clients on
- * non-mTLS connections do not attempt a mechanism that cannot succeed.
- * Operators enable EXTERNAL by configuring mTLS at the edge (CF API Shield
- * mTLS, AWS custom-domain mTLS) — no code change required.
+ * PLAIN is always available. EXTERNAL is advertised only when the
+ * caller's three-way gate holds (mTLS identity source bound +
+ * `sasl.externalEnabled` operator opt-in + secure transport — see
+ * `commands/sasl.ts`), so clients on connections where the mechanism
+ * cannot succeed do not attempt an exchange the server would refuse
+ * with `908 ERR_SASLMECHS`.
  */
-export function saslCapValue(hasMtls: boolean): string {
-  return hasMtls ? 'PLAIN,EXTERNAL' : 'PLAIN';
+export function saslCapValue(externalAvailable: boolean): string {
+  return externalAvailable ? 'PLAIN,EXTERNAL' : 'PLAIN';
 }
 
 /** Set form for fast membership checks during `CAP REQ`. */

package/packages/irc-core/src/certfp.ts

@@ -0,0 +1,178 @@
+/**
+ * CertFP — canonical client-certificate identity for SASL EXTERNAL.
+ *
+ * The edge platforms terminate TLS and surface the verified client
+ * certificate to the adapter, but neither Cloudflare Workers nor AWS API
+ * Gateway hands over the certificate DER itself:
+ *
+ * - Cloudflare surfaces the SHA-256 fingerprint of the DER on
+ *   `request.cf.tlsClientAuth.certFingerprintSHA256` (lowercase hex) — the
+ *   strongest identifier available and the preferred account binding.
+ * - AWS API Gateway surfaces only `requestContext.identity.clientCertSubjectDN`
+ *   (no fingerprint, no DER) — the subject DN is the only identifier.
+ *
+ * To make subject-DN bindings robust across those platforms (and across
+ * cert re-issuances that reorder or re-space the same DN), the DN is
+ * canonicalised before comparison:
+ *
+ * 1. Attribute **types** are lowercased (`CN=` → `cn=`); attribute
+ *    **values** keep their case (values are compared case-sensitively).
+ * 2. Whitespace around types/values is trimmed and runs of whitespace
+ *    inside a value collapse to a single space (escaped whitespace, e.g.
+ *    a trailing `\ `, is preserved verbatim).
+ * 3. RDNs (`a,b`) and the AVAs of a multi-valued RDN (`a+b`) are sorted,
+ *    so two semantically-equal DNs written in different orders collapse
+ *    to one canonical spelling.
+ * 4. RFC 4514 escapes (`\,`, `\+`, `\=` …) are kept intact — the
+ *    canonicaliser never splits on an escaped separator.
+ *
+ * Accounts bind to either a DER fingerprint (`fp:<hex>` entries in
+ * `RegisteredNick.certSubjects`, preferred) or a canonical DN. Legacy
+ * verbatim subject bindings still verify — `ServicesStore.verifyCertFP`
+ * canonicalises stored entries at compare time and rewrites them to the
+ * canonical spelling on first use.
+ */
+
+/**
+ * Marker prefix for fingerprint bindings stored in
+ * `RegisteredNick.certSubjects` (vs canonical-DN bindings).
+ */
+export const CERT_FP_PREFIX = 'fp:';
+
+/**
+ * The verified client-certificate identity of one connection, as resolved
+ * by an {@link MtlsIdentityProvider}.
+ *
+ * - `subject` — the raw platform-surfaced subject string, verbatim.
+ * - `canonicalDn` — {@link canonicalizeCertSubject} of `subject`.
+ * - `fingerprint` — the SHA-256 fingerprint of the certificate DER
+ *   (lowercase hex) when the platform surfaces one; absent otherwise
+ *   (API Gateway surfaces no fingerprint today).
+ */
+export interface CertIdentity {
+  readonly subject: string;
+  readonly canonicalDn: string;
+  readonly fingerprint?: string;
+}
+
+/**
+ * Splits `s` on unescaped `sep` characters, keeping RFC 4514 `\x` escape
+ * pairs intact within each part.
+ */
+function splitUnescaped(s: string, sep: string): string[] {
+  const parts: string[] = [];
+  let current = '';
+  for (let i = 0; i < s.length; i += 1) {
+    const ch = s.charAt(i);
+    const next = s.charAt(i + 1);
+    if (ch === '\\' && next !== '') {
+      current += ch + next;
+      i += 1;
+    } else if (ch === sep) {
+      parts.push(current);
+      current = '';
+    } else {
+      current += ch;
+    }
+  }
+  parts.push(current);
+  return parts;
+}
+
+/**
+ * Index of the first unescaped occurrence of `ch`, or `-1`. Used to split
+ * an AVA into type and value without splitting on `\=`.
+ */
+function indexUnescaped(s: string, ch: string): number {
+  for (let i = 0; i < s.length; i += 1) {
+    if (s.charAt(i) === '\\') {
+      i += 1;
+      continue;
+    }
+    if (s.charAt(i) === ch) return i;
+  }
+  return -1;
+}
+
+/**
+ * Collapses runs of unescaped whitespace to single spaces and trims
+ * leading/trailing unescaped whitespace. Escape pairs (`\x`) pass through
+ * verbatim and terminate any pending whitespace run.
+ */
+function collapseWhitespace(s: string): string {
+  let out = '';
+  let pendingSpace = false;
+  let started = false;
+  for (let i = 0; i < s.length; i += 1) {
+    const ch = s.charAt(i);
+    const next = s.charAt(i + 1);
+    if (ch === '\\' && next !== '') {
+      if (pendingSpace) {
+        out += ' ';
+        pendingSpace = false;
+      }
+      out += ch + next;
+      i += 1;
+      started = true;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      if (started) pendingSpace = true;
+      continue;
+    }
+    if (pendingSpace) {
+      out += ' ';
+      pendingSpace = false;
+    }
+    out += ch;
+    started = true;
+  }
+  return out;
+}
+
+/** Canonicalises one attribute-value assertion (`type=value`). */
+function canonicalAva(ava: string): string {
+  const eq = indexUnescaped(ava, '=');
+  if (eq === -1) return collapseWhitespace(ava);
+  const type = collapseWhitespace(ava.slice(0, eq)).toLowerCase();
+  const value = collapseWhitespace(ava.slice(eq + 1));
+  return `${type}=${value}`;
+}
+
+/**
+ * Canonicalises an RFC 4514-style DN for byte-stable comparison:
+ * lowercase attribute types (values keep their case), collapsed/trimmed
+ * whitespace, sorted RDNs, and sorted AVAs inside multi-valued RDNs.
+ * Escape sequences pass through unchanged.
+ */
+export function canonicalizeCertSubject(dn: string): string {
+  return splitUnescaped(dn, ',')
+    .map((rdn) =>
+      splitUnescaped(rdn, '+')
+        .map((ava) => canonicalAva(ava))
+        .sort()
+        .join('+'),
+    )
+    .sort()
+    .join(',');
+}
+
+/**
+ * Normalises a DER SHA-256 fingerprint into the stored binding form:
+ * `fp:` + trimmed, lowercased, colon-free hex.
+ */
+export function certFingerprintId(fingerprint: string): string {
+  return `${CERT_FP_PREFIX}${fingerprint.trim().toLowerCase().replace(/:/g, '')}`;
+}
+
+/**
+ * Builds the {@link CertIdentity} for a platform-surfaced subject (and the
+ * platform fingerprint, when one was provided). Pure; adapters call this
+ * at admission time.
+ */
+export function certIdentityFromSubject(subject: string, fingerprint?: string): CertIdentity {
+  const canonicalDn = canonicalizeCertSubject(subject);
+  return fingerprint === undefined
+    ? { subject, canonicalDn }
+    : { subject, canonicalDn, fingerprint };
+}

package/packages/irc-core/src/commands/account-auth.ts

@@ -13,8 +13,10 @@
  *
  * {@link passBasedAccountAuth} is the legacy IRC convention of carrying
  * NickServ credentials in `PASS <nick>:<password>` at registration; it
- * resolves at registration completion via the injected
- * {@link AccountStore} and, on success, delegates to
+ * resolves at registration completion via the bound
+ * {@link ServicesStore} (`services.verifyNick` — the same single
+ * credential home NickServ `REGISTER`, SASL PLAIN, and NickServ
+ * `IDENTIFY` consult) and, on success, delegates to
  * {@link applyAccountSuccess}.
  */
 
@@ -129,17 +131,20 @@ export function passBasedAccountAuth(state: ConnectionState, ctx: Ctx): EffectTy
  * in `passReducer` (reading the `PASS` param directly), so the two entry
  * points share one verify+success path and never diverge.
  *
- * Returns the account-login success effects (`900`/`903`/`+r`/read-marker
+ * Credentials are verified against the bound {@link ServicesStore} via
+ * `services.verifyNick` — the same single credential home NickServ
+ * `REGISTER`, SASL PLAIN, and NickServ `IDENTIFY` consult. Returns the
+ * account-login success effects (`900`/`903`/`+r`/read-marker
  * seeding/away replay/memo delivery/`account-notify`), or `[]` for every
  * other outcome:
  *   - already identified (`state.account` set, e.g. via SASL) → no-op;
  *   - no `<nick>:<password>` form (bare value or undefined) → no-op;
  *   - payload nick does not match `state.nick` (when set) → no-op;
- *   - no {@link AccountStore} bound → no-op;
+ *   - no {@link ServicesStore} bound → no-op;
  *   - verify failure (unknown nick or wrong password) → no-op.
  *
  * A failed verify is followed by a verify against a fixed dummy entry so
- * the failure path performs the same AccountStore work whether the payload
+ * the failure path performs the same scrypt work whether the payload
  * nick was unknown or the password was wrong — the observable outcome
  * (no numerics, no disconnect, no state change) is identical for both
  * cases, giving no information to a remote attacker.
@@ -153,24 +158,16 @@ export function attemptPassAccountAuth(
   const parsed = parsePassAccountAttempt(attempt);
   if (parsed === null) return [];
   if (state.nick !== undefined && state.nick !== parsed.nick) return [];
-  const store = ctx.accounts;
-  if (store === undefined) return [];
-  const result = store.verify('PLAIN', {
-    kind: 'PLAIN',
-    username: parsed.nick,
-    password: parsed.password,
-  });
+  const services = ctx.services;
+  if (services === undefined) return [];
+  const result = services.verifyNick(parsed.nick, parsed.password);
   if (result.ok) {
     return applyAccountSuccess(state, ctx, result.account);
   }
   // Equalise timing: perform a verify against a fixed dummy entry so a
-  // failed PASS-auth always costs one extra AccountStore call regardless
-  // of whether the payload nick was unknown or the password was wrong.
-  store.verify('PLAIN', {
-    kind: 'PLAIN',
-    username: PASS_AUTH_DUMMY_NICK,
-    password: PASS_AUTH_DUMMY_PASSWORD,
-  });
+  // failed PASS-auth always costs one extra scrypt verify regardless of
+  // whether the payload nick was unknown or the password was wrong.
+  services.verifyNick(PASS_AUTH_DUMMY_NICK, PASS_AUTH_DUMMY_PASSWORD);
   return [];
 }
 

package/packages/irc-core/src/commands/cap.ts

@@ -94,11 +94,19 @@ function handleLs(state: ConnectionState, ctx: Ctx): ReducerResult<ConnectionSta
   state.capNegotiating = true;
 
   const target = state.nick ?? '*';
-  const hasMtls = ctx.mtlsIdentity !== undefined;
+  // Same gate as the AUTHENTICATE reducer (no transport-level override +
+  // mTLS source + operator opt-in + secure transport), so the `sasl` cap
+  // never advertises a mechanism the reducer would refuse — with 908, or
+  // with the transport-specific 904 under the override.
+  const external =
+    ctx.serverConfig.sasl?.externalUnsupportedMessage === undefined &&
+    ctx.mtlsIdentity !== undefined &&
+    (ctx.serverConfig.sasl?.externalEnabled ?? false) &&
+    ctx.connection.secure;
   const multilineMax = ctx.serverConfig.multilineMaxBytes ?? DEFAULT_MULTILINE_MAX_BYTES;
   const tokens = SUPPORTED_CAPABILITIES.map((cap) => {
     if (cap.name === SASL_CAP_NAME) {
-      return capToLsString({ ...cap, value: saslCapValue(hasMtls) });
+      return capToLsString({ ...cap, value: saslCapValue(external) });
     }
     if (cap.name === MULTILINE_CAP_NAME) {
       return capToLsString({ ...cap, value: multilineCapValue(multilineMax) });