serverless-ircd 0.9.0 → 0.11.0

package/packages/irc-core/src/commands/chanserv.ts

@@ -36,6 +36,14 @@
  *     threshold the JOIN hook compares against for the `AUTO*` ops.
  *     `SET <op> <level>` overrides; `LIST` enumerates; `RESET` clears
  *     every override so the {@link DEFAULT_CHANNEL_LEVELS} take effect.
+ *   - `OP|DEOP|VOICE|DEVOICE <#channel> <nick>` — grant or strip a channel
+ *     prefix via a ChanServ-sourced MODE broadcast (founder or
+ *     AUTOOP-threshold access entry). DEOP additionally enforces a
+ *     caller-vs-target rank guard: the target must not outrank the caller
+ *     (see {@link rankOf} / {@link FOUNDER_RANK}), so an access-list entry
+ *     cannot strip the founder — or any higher-ranked entry — mid-session.
+ *   - `KICK <#channel> <nick> [:<reason>]` — removes a member (founder
+ *     only) under the same target-rank guard.
  *
  * The reducer is a pure `Reducer<ConnectionState>`: all side effects are
  * emitted as {@link Effect}s. Channel-mode mutations are emitted as
@@ -47,6 +55,7 @@ import { caseFold } from '../case-fold.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
 import type { ChannelLevelOp, ServicesStore } from '../ports.js';
+import { isValidChannelName } from '../protocol/channel-name.js';
 import type { ChannelDelta, Roster } from '../state/channel.js';
 import type { ConnId, ConnectionState } from '../state/connection.js';
 import type { Ctx, Reducer } from '../types.js';
@@ -60,15 +69,6 @@ const SERVICES_HOST = 'services';
 /** Hostmask used as the source of ChanServ-emitted MODE prefix grants. */
 export const CHANSERV_HOSTMASK = `${CHANSERV_NICK}!${CHANSERV_NICK}@${SERVICES_HOST}`;
 
-/** Channel-name grammar; mirrors {@link isValidChannelName} in `join.ts`. */
-const CHANNEL_NAME_RE = /^[#&][^\s,:]+$/u;
-
-/** Returns true iff `name` looks like a channel target. */
-function isValidChannelName(name: string, maxLen: number): boolean {
-  if (name.length === 0 || name.length > maxLen) return false;
-  return CHANNEL_NAME_RE.test(name);
-}
-
 /** ON / OFF values accepted by SET RESTRICTED / SET KEEPTOPIC. */
 const ON_OFF = new Set<string>(['ON', 'OFF']);
 
@@ -111,6 +111,26 @@ export const SHORTHAND_LEVELS: Readonly<Record<'SOP' | 'AOP' | 'HOP' | 'VOP', nu
 /** Set of recognised shorthand verbs (uppercased). */
 const SHORTHAND_VERBS = new Set<string>(['SOP', 'AOP', 'HOP', 'VOP']);
 
+/**
+ * Rank of the channel founder in the DEOP/KICK caller-vs-target hierarchy.
+ * `Infinity` outranks every numeric access level, so no access-list entry
+ * can ever reach it — the only caller who can affect a founder-ranked
+ * target is the founder (an equal-rank, self-targeting action).
+ */
+export const FOUNDER_RANK = Number.POSITIVE_INFINITY;
+
+/**
+ * Maps a numeric ChanServ access level to the rank ordering used by the
+ * DEOP/KICK target guard: founder ({@link FOUNDER_RANK}) > SOP (10) > AOP
+ * (5) > HOP (4) > VOP (3) > no entry (0). The mapping is the identity for
+ * positive levels today; it exists as the single seam where a future
+ * privilege tier (e.g. a distinct SOP rank scale) can be introduced
+ * without touching the comparison call sites.
+ */
+export function rankOf(level: number): number {
+  return level > 0 ? level : 0;
+}
+
 /** Ordered list of level op names, for LEVELS LIST and validation. */
 const LEVEL_OPS: readonly ChannelLevelOp[] = ['AUTOOP', 'AUTOHALFOP', 'AUTOVOICE'];
 
@@ -794,16 +814,24 @@ interface PrefixCommandOpts {
  *       - `founderOnly: true`  → "Permission denied."
  *       - `founderOnly: false` → allowed when caller's access level meets the
  *         founder-configured `AUTOOP` threshold, otherwise "Permission denied."
+ *   - Target-rank guard (`guardTargetRankOf`): the nick named by the command
+ *     must not outrank the caller, otherwise "You do not have sufficient
+ *     privileges on <chan> to affect <nick>." Used by DEOP and KICK so an
+ *     access-list entry cannot strip the founder (or any higher-ranked
+ *     entry) mid-session. Equal ranks — self-targeting and peers — are
+ *     permitted; only a strictly higher-ranked target is protected.
  *
  * Privilege model: OP/DEOP/VOICE/DEVOICE accept the founder OR any
- * AUTOOP-level access entry; KICK/BAN/UNBAN are founder-only.
+ * AUTOOP-level access entry; KICK/BAN/UNBAN are founder-only. The
+ * target-rank guard applies only where the caller names a nick whose
+ * powers would be *removed* (DEOP/KICK), not where powers are granted.
  */
 function requirePrivilegedChanServ(
   state: ConnectionState,
   channel: string,
   ctx: Ctx,
   effects: EffectType[],
-  opts: { founderOnly: boolean },
+  opts: { founderOnly: boolean; guardTargetRankOf?: string },
 ): ServicesStore | null {
   const services = ctx.services as ServicesStore;
   if (state.account === undefined) {
@@ -815,18 +843,89 @@ function requirePrivilegedChanServ(
     effects.push(notice(state, `Channel ${channel} is not registered.`));
     return null;
   }
-  if (caseFold('rfc1459', founder) === caseFold('rfc1459', state.account)) {
-    return services;
+  const callerIsFounder = caseFold('rfc1459', founder) === caseFold('rfc1459', state.account);
+  if (callerIsFounder) {
+    return admitTargetRankGuard(state, services, FOUNDER_RANK, channel, founder, opts, effects);
   }
   if (!opts.founderOnly) {
     const level = services.getChannelAccess(channel, state.account);
     const autoOp = services.getChannelLevel(channel, 'AUTOOP') ?? DEFAULT_CHANNEL_LEVELS.AUTOOP;
-    if (level >= autoOp) return services;
+    if (level >= autoOp) {
+      return admitTargetRankGuard(state, services, rankOf(level), channel, founder, opts, effects);
+    }
   }
   effects.push(notice(state, 'Permission denied.'));
   return null;
 }
 
+/**
+ * Applies the DEOP/KICK target-rank guard at the tail of
+ * {@link requirePrivilegedChanServ}: the caller may affect the target nick
+ * only when the target's rank does not exceed theirs. Returns the store on
+ * success, `null` (with an insufficient-privileges NOTICE pushed) on
+ * failure.
+ *
+ * Rank rule: permitted iff `callerRank >= targetRank`. Equal ranks cover
+ * both self-targeting (the founder — or any access entry — releasing
+ * their own status) and peer-level actions (an AOP deopping a fellow
+ * AOP, who can simply re-op); any strictly higher-ranked target — the
+ * founder above every access entry, an SOP above an AOP — is protected.
+ */
+function admitTargetRankGuard(
+  state: ConnectionState,
+  services: ServicesStore,
+  callerRank: number,
+  channel: string,
+  founder: string,
+  opts: { founderOnly: boolean; guardTargetRankOf?: string },
+  effects: EffectType[],
+): ServicesStore | null {
+  if (
+    opts.guardTargetRankOf !== undefined &&
+    callerRank < targetRankOf(services, channel, founder, opts.guardTargetRankOf)
+  ) {
+    effects.push(
+      notice(
+        state,
+        `You do not have sufficient privileges on ${channel} to affect ${opts.guardTargetRankOf}.`,
+      ),
+    );
+    return null;
+  }
+  return services;
+}
+
+/**
+ * Resolves the rank of a target NICK for the DEOP/KICK guard.
+ *
+ * The ChanServ reducer operates on the caller's ConnectionState and cannot
+ * see the connection behind the target nick, so the target's account is
+ * resolved via the nick registry (`getNick`):
+ *   - a nick whose registered account matches the channel founder ranks as
+ *     the founder ({@link FOUNDER_RANK}) and is protected from every
+ *     non-founder caller;
+ *   - any other registered nick ranks at its access-list level;
+ *   - an unregistered (therefore unidentified) nick carries no account and
+ *     ranks at the minimum.
+ *
+ * Documented simplification: protection is keyed on the nick's registered
+ * account, not on whether the connection currently using the nick is
+ * identified — the reducer has no way to observe the latter, and erring
+ * toward protection cannot be abused to escalate privileges.
+ */
+function targetRankOf(
+  services: ServicesStore,
+  channel: string,
+  founder: string,
+  targetNick: string,
+): number {
+  const account = services.getNick(targetNick)?.account;
+  if (account !== undefined && caseFold('rfc1459', founder) === caseFold('rfc1459', account)) {
+    return FOUNDER_RANK;
+  }
+  return account === undefined ? rankOf(0) : rankOf(services.getChannelAccess(channel, account));
+}
+
 /**
  * Handles `OP|DEOP|VOICE|DEVOICE <#channel> <nick>`.
  *
@@ -862,6 +961,9 @@ function handlePrefixCommand(
 
   const services = requirePrivilegedChanServ(state, channel, ctx, effects, {
     founderOnly: false,
+    // Only DEOP removes powers, so only it carries the target-rank guard;
+    // OP/VOICE/DEVOICE never demote a higher-ranked user.
+    ...(opts.verb === 'DEOP' ? { guardTargetRankOf: targetNick } : {}),
   });
   if (services === null) return { state, effects };
 
@@ -915,6 +1017,7 @@ function handleKick(
 
   const services = requirePrivilegedChanServ(state, channel, ctx, effects, {
     founderOnly: true,
+    guardTargetRankOf: targetNick,
   });
   if (services === null) return { state, effects };
 

package/packages/irc-core/src/commands/chathistory.ts

@@ -20,6 +20,7 @@
  * actor layer); `undefined` means "no such channel" → `403`.
  */
 
+import { DEFAULT_MAX_CHATHISTORY_LIMIT } from '../config.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
 import type { StoredMessage } from '../ports.js';
@@ -154,7 +155,8 @@ function handleChannelSub(
   if (sub !== 'LATEST' && pivot === undefined && markerPivot === undefined) {
     return { effects: [Effect.send(ctx.connId, [needMoreParamsLine(ctx)])] };
   }
-  const limit = parseLimit(limitRaw);
+  const maxLimit = ctx.serverConfig.chathistory?.maxLimit ?? DEFAULT_MAX_CHATHISTORY_LIMIT;
+  const limit = parseLimit(limitRaw, maxLimit);
   if (limit === undefined) {
     return { effects: [Effect.send(ctx.connId, [invalidParamsLine(ctx)])] };
   }
@@ -295,12 +297,18 @@ function invalidParamsLine(ctx: Ctx): RawLine {
   return numericErr(ctx, Numerics.ERR_NEEDMOREPARAMS, 'Invalid parameters', 'CHATHISTORY');
 }
 
-/** Parses a non-negative integer limit; returns undefined on garbage. */
-function parseLimit(raw: string | undefined): number | undefined {
-  if (raw === undefined) return DEFAULT_QUERY_LIMIT;
+/**
+ * Parses a non-negative integer limit, silently capped at `maxLimit` (the
+ * deployment's chathistory ceiling); returns undefined on garbage. The cap
+ * keeps an oversized request (`CHATHISTORY LATEST #chan 999999999`) from
+ * asking the store to materialize a huge result set, regardless of the
+ * store's backing capacity.
+ */
+function parseLimit(raw: string | undefined, maxLimit: number): number | undefined {
+  if (raw === undefined) return Math.min(DEFAULT_QUERY_LIMIT, maxLimit);
   const n = Number(raw);
   if (!Number.isInteger(n) || n < 0) return undefined;
-  return n;
+  return Math.min(n, maxLimit);
 }
 
 /**

package/packages/irc-core/src/commands/hostserv.ts

@@ -15,10 +15,14 @@
  *     peers see the revert. Requires identification.
  *   - `REQUEST <vhost>` — proposes a vhost for the account. Behaviour
  *     depends on {@link ServerConfig.hostservAutoApproveVhosts}: when the
- *     knob is on (the default) the vhost is recorded against the account
- *     immediately (legacy auto-approve); when the knob is off the request
- *     is queued for oper review via {@link ServicesStore.requestVhost}
- *     and the requester is told it is pending. Requires identification.
+ *     knob is off (the default) the request is queued for oper review via
+ *     {@link ServicesStore.requestVhost} and the requester is told it is
+ *     pending. When the knob is on (deprecated legacy auto-approve) the
+ *     vhost is recorded against the account immediately, but only after
+ *     clearing a built-in denylist (reserved labels such as `admin` /
+ *     `staff` at any position, plus this server's own hostname) and
+ *     matching the mandatory {@link ServerConfig.hostservAutoApproveAllowlist}
+ *     (exact or `*.suffix` wildcard entries). Requires identification.
  *   - `SET <account> <vhost>` — oper-only. Records (or, with the literal
  *     `*` argument, clears) the vhost for `account` directly without
  *     going through REQUEST. The target account must be a registered nick.
@@ -67,6 +71,59 @@ function isValidVhost(vhost: string): boolean {
   return VHOST_RE.test(vhost);
 }
 
+/**
+ * Labels a user may never self-assign via auto-approved REQUEST, at any
+ * dot-separated position of the vhost (case-insensitive — DNS labels are).
+ * These names impersonate staff, operators, or off-network services, so the
+ * denylist is enforced even when the operator explicitly allowlists them.
+ */
+const RESERVED_VHOST_LABELS = new Set(['admin', 'oper', 'staff', 'irc', 'www', 'root', 'security']);
+
+/**
+ * Built-in denylist for auto-approved vhosts. Rejects any vhost containing
+ * a {@link RESERVED_VHOST_LABELS} label, plus the deployment's own hostname
+ * (exactly or as a suffix) so a user cannot cloak as
+ * `<anything>.<this-server>` and phish off its identity. Oper-vetted paths
+ * (SET, queue-mode APPROVE) intentionally bypass this — opers are trusted.
+ */
+function isDeniedVhost(vhost: string, serverName: string): boolean {
+  const lower = vhost.toLowerCase();
+  for (const label of lower.split('.')) {
+    if (RESERVED_VHOST_LABELS.has(label)) {
+      return true;
+    }
+  }
+  const server = serverName.toLowerCase();
+  return lower === server || lower.endsWith(`.${server}`);
+}
+
+/**
+ * Allowlist check for auto-approved vhosts. An entry matches when it is
+ * exactly the vhost (`users.example.net`) or a wildcard suffix
+ * (`*.users.example.com` matches `a.users.example.com` and any depth
+ * beneath it, but NOT the bare suffix). Matching is case-insensitive
+ * (DNS semantics). A missing allowlist matches nothing — the reducer
+ * fails closed; the config layer separately refuses to boot auto-approve
+ * mode without a non-empty allowlist.
+ */
+function isAllowlistedVhost(vhost: string, allowlist: ReadonlyArray<string> | undefined): boolean {
+  if (allowlist === undefined) {
+    return false;
+  }
+  const lower = vhost.toLowerCase();
+  for (const entry of allowlist) {
+    const normalized = entry.toLowerCase();
+    if (normalized.startsWith('*.')) {
+      if (lower.endsWith(normalized.slice(1))) {
+        return true;
+      }
+    } else if (lower === normalized) {
+      return true;
+    }
+  }
+  return false;
+}
+
 /**
  * Reducer for `PRIVMSG HostServ :<subcommand> <args…>`.
  * Authority: the invoking connection's {@link ConnectionState}.
@@ -185,13 +242,20 @@ function handleOff(
 /**
  * Handles `REQUEST <vhost>`. Behaviour is selected by
  * {@link ServerConfig.hostservAutoApproveVhosts}:
- *   - `true` (auto-approve) — the vhost is recorded against the account
- *     immediately (the path that shipped before the oper queue landed). The
- *     user is notified that the vhost has been requested and approved.
  *   - `false` or omitted (the default — queue mode) — the request is
  *     queued for oper review via {@link ServicesStore.requestVhost}; the
  *     vhost is NOT activated and no `CHGHOST` is emitted. The user is
- *     notified that the request is pending oper approval.
+ *     notified that the request is pending oper approval. Oper-vetted
+ *     vhosts are exempt from the denylist/allowlist below.
+ *   - `true` (auto-approve, deprecated) — the vhost is recorded against
+ *     the account immediately, but only if it survives hardening: the
+ *     built-in denylist ({@link isDeniedVhost}: reserved labels at any
+ *     position + this deployment's own hostname) rejects impersonation
+ *     vectors even when the operator allowlisted them, and the mandatory
+ *     allowlist ({@link isAllowlistedVhost}) must match the vhost exactly
+ *     or via a `*.suffix` wildcard entry. Config parsing refuses to boot
+ *     auto-approve mode without a non-empty allowlist; the reducer fails
+ *     closed regardless.
  *
  * Identified-only — otherwise a guest could plant a vhost (or a pending
  * request) against a registered account they do not own.
@@ -225,6 +289,18 @@ function handleRequest(
     return { state, effects };
   }
 
+  if (isDeniedVhost(vhost, ctx.serverName)) {
+    effects.push(
+      notice(state, `Vhost ${vhost} is not permitted (reserved label or this server's hostname).`),
+    );
+    return { state, effects };
+  }
+
+  if (!isAllowlistedVhost(vhost, ctx.serverConfig.hostservAutoApproveAllowlist)) {
+    effects.push(notice(state, `Vhost ${vhost} is not in the auto-approve allowlist.`));
+    return { state, effects };
+  }
+
   services.setVhost(state.account, vhost);
   effects.push(notice(state, `Vhost ${vhost} has been requested and approved.`));
   return { state, effects };

package/packages/irc-core/src/commands/index.ts

@@ -15,7 +15,7 @@ export {
   userReducer,
 } from './registration.js';
 export { quitReducer } from './quit.js';
-export { handleJoinZero, isValidChannelName, joinReducer } from './join.js';
+export { handleJoinZero, joinReducer } from './join.js';
 export { partReducer } from './part.js';
 export { motdReducer } from './motd.js';
 export { operReducer, matchOperCred } from './oper.js';
@@ -61,6 +61,7 @@ export { tagmsgChannelReducer, tagmsgUserReducer } from './tagmsg.js';
 export { markreadChannelReducer } from './markread.js';
 export {
   DEFAULT_MULTILINE_MAX_BYTES,
+  DEFAULT_MULTILINE_MAX_ENTRIES,
   MULTILINE_CAP,
   type FinalizeMultilineResult,
   type MultilineEntry,

package/packages/irc-core/src/commands/invite.ts

@@ -23,19 +23,13 @@
 import { caseFold } from '../case-fold.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
+import { isValidChannelName } from '../protocol/channel-name.js';
 import { Numerics } from '../protocol/numerics.js';
 import type { ChannelState } from '../state/channel.js';
 import { hostmaskOf } from '../state/connection.js';
 import type { ConnectionState } from '../state/connection.js';
 import type { Ctx, Reducer } from '../types.js';
 
-const CHANNEL_NAME_RE = /^[#&][^\s,:]+$/u;
-
-function isValidChannelName(name: string, maxLen: number): boolean {
-  if (name.length === 0 || name.length > maxLen) return false;
-  return CHANNEL_NAME_RE.test(name);
-}
-
 /** Returns the caller's hostmask, falling back to nick then `?`. */
 function callerHostmask(conn: ConnectionState): string {
   return hostmaskOf(conn) ?? conn.nick ?? '?';

package/packages/irc-core/src/commands/join.ts

@@ -20,6 +20,7 @@ import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
 import type { PersistedTopic, StoredMessage } from '../ports.js';
 import { wrapBatch } from '../protocol/batch.js';
+import { isValidChannelName } from '../protocol/channel-name.js';
 import { Numerics } from '../protocol/numerics.js';
 import { type ChanName, type ChannelState, type ChannelTopic, prefixOf } from '../state/channel.js';
 import { hostmaskOf } from '../state/connection.js';
@@ -29,22 +30,6 @@ import { CHANSERV_HOSTMASK, DEFAULT_CHANNEL_LEVELS } from './chanserv.js';
 import { CHATHISTORY_CAP, buildChathistoryBatch } from './chathistory.js';
 import { topicNumerics } from './topic.js';
 
-/**
- * RFC 1459/2812 channel-name grammar. The first character must be a channel
- * prefix (`#` or `&`); the rest may be any printable char except space, comma,
- * or colon (which all carry protocol meaning).
- */
-const CHANNEL_NAME_RE = /^[#&][^\s,:]+$/u;
-
-/**
- * Returns true iff `name` matches the IRC channel-name grammar and is within
- * the configured length cap.
- */
-export function isValidChannelName(name: string, maxLen: number): boolean {
-  if (name.length === 0 || name.length > maxLen) return false;
-  return CHANNEL_NAME_RE.test(name);
-}
-
 /**
  * Returns the 353 NAMES sigil for a channel given its modes:
  * `@` for `+p` (private), `*` for `+s` (secret), `=` otherwise (public).

package/packages/irc-core/src/commands/kick.ts

@@ -16,20 +16,13 @@
 import { caseFold } from '../case-fold.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
+import { isValidChannelName } from '../protocol/channel-name.js';
 import { Numerics } from '../protocol/numerics.js';
 import type { ChannelState } from '../state/channel.js';
 import { hostmaskOf } from '../state/connection.js';
 import type { ConnectionState } from '../state/connection.js';
 import type { Ctx, Reducer } from '../types.js';
 
-/** Channel-name validation mirrors JOIN: same grammar, same length cap. */
-const CHANNEL_NAME_RE = /^[#&][^\s,:]+$/u;
-
-function isValidChannelName(name: string, maxLen: number): boolean {
-  if (name.length === 0 || name.length > maxLen) return false;
-  return CHANNEL_NAME_RE.test(name);
-}
-
 /**
  * Formats a single numeric error line addressed to the connection's current
  * nick (or `*` when unregistered). Optional `middle` is emitted before the

package/packages/irc-core/src/commands/list.ts

@@ -29,18 +29,11 @@
 import { caseFold } from '../case-fold.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
+import { isValidChannelName } from '../protocol/channel-name.js';
 import { Numerics } from '../protocol/numerics.js';
 import type { ChanSnapshot } from '../state/channel.js';
 import type { Ctx, Reducer } from '../types.js';
 
-/** Channel-name grammar; mirrors {@link isValidChannelName} in `join.ts`. */
-const CHANNEL_NAME_RE = /^[#&][^\s,:]+$/u;
-
-function isValidChannelName(name: string, maxLen: number): boolean {
-  if (name.length === 0 || name.length > maxLen) return false;
-  return CHANNEL_NAME_RE.test(name);
-}
-
 /**
  * Returns true iff the requester is permitted to see `chan` in LIST output.
  * Secret channels require membership; everything else is public.

package/packages/irc-core/src/commands/memoserv.ts

@@ -19,7 +19,7 @@
  *
  * The reducer is a pure `Reducer<ConnectionState>`: all side effects are
  * emitted as {@link Effect}s. The services store is synchronous (mirrors
- * the {@link AccountStore} / {@link MessageStore} pattern).
+ * the {@link MessageStore} pattern).
  */
 
 import { caseFold } from '../case-fold.js';

package/packages/irc-core/src/commands/mode.ts

@@ -31,6 +31,7 @@
 import { caseFold } from '../case-fold.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
+import { isValidChannelName } from '../protocol/channel-name.js';
 import { Numerics } from '../protocol/numerics.js';
 import type { BooleanChannelMode, ChannelState } from '../state/channel.js';
 import type {
@@ -45,14 +46,6 @@ import type { ConnectionState } from '../state/connection.js';
 import type { Ctx, Reducer } from '../types.js';
 import { positiveMlockLetters } from './chanserv.js';
 
-/** Channel-name grammar; mirrors {@link isValidChannelName} in `join.ts`. */
-const CHANNEL_NAME_RE = /^[#&][^\s,:]+$/u;
-
-function isValidChannelName(name: string, maxLen: number): boolean {
-  if (name.length === 0 || name.length > maxLen) return false;
-  return CHANNEL_NAME_RE.test(name);
-}
-
 /** Returns the caller's hostmask, falling back to nick then `?`. */
 function callerHostmask(conn: ConnectionState): string {
   return hostmaskOf(conn) ?? conn.nick ?? '?';

package/packages/irc-core/src/commands/multiline.ts

@@ -26,11 +26,13 @@
 
 import {
   DEFAULT_MULTILINE_MAX_BYTES,
+  DEFAULT_MULTILINE_MAX_ENTRIES,
   MULTILINE_CAP_NAME,
   multilineCapValue,
 } from '../caps/capabilities.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
+import { byteLength } from '../protocol/bytes.js';
 import { hostmaskOf } from '../state/connection.js';
 import type { Ctx } from '../types.js';
 
@@ -41,7 +43,7 @@ import type { Ctx } from '../types.js';
  */
 export const MULTILINE_CAP = MULTILINE_CAP_NAME;
 
-export { DEFAULT_MULTILINE_MAX_BYTES, multilineCapValue };
+export { DEFAULT_MULTILINE_MAX_BYTES, DEFAULT_MULTILINE_MAX_ENTRIES, multilineCapValue };
 
 /**
  * One accumulated inner line of a multi-line batch. The actor collects these
@@ -79,21 +81,13 @@ export function multilineByteLength(entries: readonly MultilineEntry[]): number
   if (entries.length === 0) return 0;
   let total = 0;
   for (const entry of entries) {
-    total += utf8ByteLength(entry.text);
+    total += byteLength(entry.text);
   }
   // `(n - 1)` separators join `n` entries.
   total += entries.length - 1;
   return total;
 }
 
-/** Shared `TextEncoder` for UTF-8 byte-length accounting (Web standard). */
-const TEXT_ENCODER = new TextEncoder();
-
-/** Returns the UTF-8 byte length of `s` (the wire encoding for IRC content). */
-function utf8ByteLength(s: string): number {
-  return TEXT_ENCODER.encode(s).length;
-}
-
 /** Resolves the sender's hostmask, falling back to nick then `?`. */
 function senderHostmask(conn: Ctx['connection']): string {
   return hostmaskOf(conn) ?? conn.nick ?? '?';

package/packages/irc-core/src/commands/names.ts

@@ -31,17 +31,22 @@
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
 import { wrapBatch } from '../protocol/batch.js';
+import { byteLength } from '../protocol/bytes.js';
+import { isValidChannelName } from '../protocol/channel-name.js';
 import { Numerics } from '../protocol/numerics.js';
 import type { ChannelState, RosterEntry } from '../state/channel.js';
 import type { Ctx, Reducer } from '../types.js';
 
-/** Channel-name grammar; mirrors {@link isValidChannelName} in `join.ts`. */
-const CHANNEL_NAME_RE = /^[#&][^\s,:]+$/u;
+/**
+ * RFC 1459 §2.3: maximum IRC line length in bytes, including the trailing
+ * CR-LF. Transports append `\r\n` after the text produced here, so the
+ * budget for the line text itself is 512 − 2 = 510 bytes. Declared locally
+ * (mirroring `cap.ts` / `motd-lines.ts`) to keep this module self-contained.
+ */
+const MAX_LINE_BYTES = 512;
 
-function isValidChannelName(name: string, maxLen: number): boolean {
-  if (name.length === 0 || name.length > maxLen) return false;
-  return CHANNEL_NAME_RE.test(name);
-}
+/** Length of the trailing CR-LF the wire layer appends to each line. */
+const TRAILING_CRLF_LEN = 2;
 
 /** Formats a numeric error/reply line addressed to the connection's nick. */
 function numericErr(ctx: Ctx, code: number, trailing: string, middle: string): RawLine {
@@ -90,14 +95,50 @@ function prefixFormatter(ctx: Ctx): (entry: RosterEntry) => string {
   return ctx.connection.caps.has('multi-prefix') ? allPrefixes : highestPrefix;
 }
 
-/** Builds the space-separated NAMES list with mode prefixes for a channel. */
-function buildNamesList(state: ChannelState, ctx: Ctx): string {
+/**
+ * Greedy-packs the formatted member list into one or more `353 RPL_NAMREPLY`
+ * lines so every emitted line fits the 510-byte text budget (RFC 2812 §3.2.5:
+ * long NAMES lists are split across multiple `353` replies rather than
+ * truncated mid-nick by the outbound line limiter).
+ *
+ * The full line is measured: the fixed `:{server} 353 {nick} {sigil} {chan} :`
+ * header, each member's mode-prefix bytes (`@`/`+`), the nicks themselves
+ * (UTF-8 bytes, not UTF-16 code units), and the separating spaces. A member
+ * that alone overflows the budget (only possible with pathological config —
+ * nicks are capped at `nickLen`) still gets its own line rather than being
+ * dropped, leaving any last-resort truncation to the outbound limiter.
+ *
+ * A channel with no members still yields exactly one `353` with an empty
+ * trailing parameter, so the reply shape (`353`…`366`) is stable for clients.
+ */
+function packNamesLines(state: ChannelState, ctx: Ctx, nick: string, sigil: string): RawLine[] {
   const format = prefixFormatter(ctx);
-  const names: string[] = [];
+  const header = `:${ctx.serverName} 353 ${nick} ${sigil} ${state.name} :`;
+  const budget = MAX_LINE_BYTES - TRAILING_CRLF_LEN;
+  const headerBytes = byteLength(header);
+
+  const lines: RawLine[] = [];
+  let current = '';
+  let usedBytes = 0;
+  let empty = true;
+
   for (const entry of state.members.values()) {
-    names.push(format(entry) + entry.nick);
+    const token = format(entry) + entry.nick;
+    const tokenBytes = byteLength(token);
+    // One extra byte for the space separator when appending to a non-empty list.
+    const costBytes = empty ? tokenBytes : tokenBytes + 1;
+    if (!empty && headerBytes + usedBytes + costBytes > budget) {
+      lines.push({ text: `${header}${current}` });
+      current = token;
+      usedBytes = tokenBytes;
+    } else {
+      current = empty ? token : `${current} ${token}`;
+      usedBytes += costBytes;
+    }
+    empty = false;
   }
-  return names.join(' ');
+  lines.push({ text: `${header}${current}` });
+  return lines;
 }
 
 /**
@@ -143,9 +184,8 @@ export const namesReducer: Reducer<ChannelState> = (state, msg, ctx) => {
 
   const nick = ctx.connection.nick ?? '*';
   const sigil = namesSigil(state);
-  const names = buildNamesList(state, ctx);
   const replyLines: RawLine[] = [
-    { text: `:${ctx.serverName} 353 ${nick} ${sigil} ${state.name} :${names}` },
+    ...packNamesLines(state, ctx, nick, sigil),
     { text: `:${ctx.serverName} 366 ${nick} ${state.name} :End of /NAMES list.` },
   ];