serverless-ircd 0.2.0 → 0.4.0

package/packages/aws-adapter/tests/sweeper.test.ts

@@ -34,6 +34,11 @@ interface Fixture {
 
 let fx: Fixture | null;
 
+function requireFx(): Fixture {
+  if (!fx) throw new Error('test fixture not initialized');
+  return fx;
+}
+
 async function makeFixture(): Promise<Fixture> {
   if (endpoint === undefined) throw new Error('DYNAMO_ENDPOINT missing');
   const prefix = `s${Date.now()}-${Math.floor(Math.random() * 1e6)}-`;
@@ -81,8 +86,8 @@ async function makeFixture(): Promise<Fixture> {
 
 function params(overrides: Partial<SweepParams> = {}): SweepParams {
   return {
-    dynamo: fx!.client,
-    tables: fx!.tables,
+    dynamo: requireFx().client,
+    tables: requireFx().tables,
     ...overrides,
   };
 }
@@ -100,18 +105,18 @@ async function seedConnection(opts: {
   if (opts.nick !== undefined) {
     state.nick = opts.nick as Nick;
     state.user = opts.nick;
-    await fx!.client.send(
+    await requireFx().client.send(
       new PutCommand({
-        TableName: fx!.tables.Nicks,
+        TableName: requireFx().tables.Nicks,
         Item: marshalNick(opts.nick as Nick, opts.connId, opts.idleSince),
       }),
     );
   }
   for (const chan of opts.channels ?? []) {
     state.joinedChannels.add(chan);
-    await fx!.client.send(
+    await requireFx().client.send(
       new PutCommand({
-        TableName: fx!.tables.ChannelMembers,
+        TableName: requireFx().tables.ChannelMembers,
         Item: marshalChannelMember(chan.toLowerCase(), {
           conn: opts.connId,
           nick: (opts.nick ?? 'x') as Nick,
@@ -121,9 +126,9 @@ async function seedConnection(opts: {
       }),
     );
   }
-  await fx!.client.send(
+  await requireFx().client.send(
     new PutCommand({
-      TableName: fx!.tables.Connections,
+      TableName: requireFx().tables.Connections,
       Item: marshalConnection(state, opts.idleSince),
     }),
   );
@@ -131,16 +136,16 @@ async function seedConnection(opts: {
 
 async function connectionExists(connId: string): Promise<boolean> {
   const { GetCommand } = await import('@aws-sdk/lib-dynamodb');
-  const res = await fx!.client.send(
-    new GetCommand({ TableName: fx!.tables.Connections, Key: { connectionId: connId } }),
+  const res = await requireFx().client.send(
+    new GetCommand({ TableName: requireFx().tables.Connections, Key: { connectionId: connId } }),
   );
   return res.Item !== undefined;
 }
 
 async function membersOf(channelKey: string): Promise<{ connectionId: string }[]> {
-  const res = await fx!.client.send(
+  const res = await requireFx().client.send(
     new QueryCommand({
-      TableName: fx!.tables.ChannelMembers,
+      TableName: requireFx().tables.ChannelMembers,
       KeyConditionExpression: 'channelName = :k',
       ExpressionAttributeValues: { ':k': channelKey },
     }),
@@ -150,8 +155,8 @@ async function membersOf(channelKey: string): Promise<{ connectionId: string }[]
 
 async function nickExists(nick: string): Promise<boolean> {
   const { GetCommand } = await import('@aws-sdk/lib-dynamodb');
-  const res = await fx!.client.send(
-    new GetCommand({ TableName: fx!.tables.Nicks, Key: { nickLower: nick.toLowerCase() } }),
+  const res = await requireFx().client.send(
+    new GetCommand({ TableName: requireFx().tables.Nicks, Key: { nickLower: nick.toLowerCase() } }),
   );
   return res.Item !== undefined;
 }
@@ -281,8 +286,10 @@ describe.skipIf(!available)('gone-connection sweeper', () => {
 
   it('cleanupConnection is safe to call on a row the sweeper already removed (no throw)', async () => {
     await seedConnection({ connId: 'stale', idleSince: 0, nick: 'zed' });
-    await cleanupConnection(fx!.client, fx!.tables, 'stale', null);
-    await expect(cleanupConnection(fx!.client, fx!.tables, 'stale', null)).resolves.toBeUndefined();
+    await cleanupConnection(requireFx().client, requireFx().tables, 'stale', null);
+    await expect(
+      cleanupConnection(requireFx().client, requireFx().tables, 'stale', null),
+    ).resolves.toBeUndefined();
   });
 
   it('uses Date.now() when now is omitted (real-clock default path)', async () => {
@@ -297,9 +304,9 @@ describe.skipIf(!available)('gone-connection sweeper', () => {
 
   it('skips a row whose idleSince is not a number (defensive — corrupted row)', async () => {
     // Write a Connections row directly with a non-numeric idleSince.
-    await fx!.client.send(
+    await requireFx().client.send(
       new PutCommand({
-        TableName: fx!.tables.Connections,
+        TableName: requireFx().tables.Connections,
         Item: {
           connectionId: 'corrupt',
           registration: 'registered',

package/packages/aws-adapter/tests/transactions.test.ts

@@ -37,6 +37,11 @@ interface Fixture {
 
 let fx: Fixture | null;
 
+function requireFx(): Fixture {
+  if (!fx) throw new Error('test fixture not initialized');
+  return fx;
+}
+
 async function makeFixture(): Promise<Fixture> {
   if (endpoint === undefined) throw new Error('DYNAMO_ENDPOINT missing');
   const prefix = `x${Date.now()}-${Math.floor(Math.random() * 1e6)}-`;
@@ -89,8 +94,8 @@ function makeRuntime(connId: string): AwsRuntime {
     snapshot: () => undefined,
   };
   return new AwsRuntime({
-    dynamo: fx!.client,
-    tables: fx!.tables,
+    dynamo: requireFx().client,
+    tables: requireFx().tables,
     connId,
     handlers,
     managementApi: null,
@@ -100,9 +105,9 @@ function makeRuntime(connId: string): AwsRuntime {
 /** Persists a fresh Connections row with no joined channels. */
 async function seedConnection(connId: string, idleSince = 1_000): Promise<void> {
   const state = createConnection({ id: connId, connectedSince: idleSince });
-  await fx!.client.send(
+  await requireFx().client.send(
     new PutCommand({
-      TableName: fx!.tables.Connections,
+      TableName: requireFx().tables.Connections,
       Item: marshalConnection(state, idleSince),
     }),
   );
@@ -110,9 +115,9 @@ async function seedConnection(connId: string, idleSince = 1_000): Promise<void>
 
 /** Reads the raw Connections row (so we can inspect the stored shape). */
 async function readConnection(connId: string): Promise<{ joinedChannels?: unknown } | undefined> {
-  const res = await fx!.client.send(
+  const res = await requireFx().client.send(
     new GetCommand({
-      TableName: fx!.tables.Connections,
+      TableName: requireFx().tables.Connections,
       Key: { connectionId: connId },
     }),
   );
@@ -121,9 +126,9 @@ async function readConnection(connId: string): Promise<{ joinedChannels?: unknow
 
 /** Reads every ChannelMembers row for a channel. */
 async function readMembers(channelKey: string): Promise<{ connectionId: string }[]> {
-  const res = await fx!.client.send(
+  const res = await requireFx().client.send(
     new QueryCommand({
-      TableName: fx!.tables.ChannelMembers,
+      TableName: requireFx().tables.ChannelMembers,
       KeyConditionExpression: 'channelName = :k',
       ExpressionAttributeValues: { ':k': channelKey },
     }),
@@ -137,15 +142,15 @@ async function seedMembership(connId: string, nick: string, channel: ChanName):
   state.registration = 'registered';
   state.nick = nick as Nick;
   state.joinedChannels.add(channel);
-  await fx!.client.send(
+  await requireFx().client.send(
     new PutCommand({
-      TableName: fx!.tables.Connections,
+      TableName: requireFx().tables.Connections,
       Item: marshalConnection(state, 1_000),
     }),
   );
-  await fx!.client.send(
+  await requireFx().client.send(
     new PutCommand({
-      TableName: fx!.tables.ChannelMembers,
+      TableName: requireFx().tables.ChannelMembers,
       Item: marshalChannelMember(channel.toLowerCase(), {
         conn: connId,
         nick: nick as Nick,
@@ -182,8 +187,8 @@ describe.skipIf(!available)('membership transactions', () => {
 
     const row = await readConnection('c1');
     expect(row).toBeDefined();
-    expect(row!.joinedChannels).toBeInstanceOf(Set);
-    expect((row!.joinedChannels as Set<string>).has('#foo')).toBe(true);
+    expect(row?.joinedChannels).toBeInstanceOf(Set);
+    expect((row?.joinedChannels as Set<string>).has('#foo')).toBe(true);
   });
 
   it('PART removes both the ChannelMembers row and the channel from joinedChannels', async () => {
@@ -199,7 +204,7 @@ describe.skipIf(!available)('membership transactions', () => {
 
     const row = await readConnection('c1');
     expect(row).toBeDefined();
-    expect((row!.joinedChannels as Set<string> | undefined)?.has('#foo') ?? false).toBe(false);
+    expect((row?.joinedChannels as Set<string> | undefined)?.has('#foo') ?? false).toBe(false);
   });
 
   it('KICK (remove of a different connection) drops the target from joinedChannels', async () => {
@@ -211,7 +216,7 @@ describe.skipIf(!available)('membership transactions', () => {
     });
 
     const row = await readConnection('target');
-    expect((row!.joinedChannels as Set<string> | undefined)?.has('#room') ?? false).toBe(false);
+    expect((row?.joinedChannels as Set<string> | undefined)?.has('#room') ?? false).toBe(false);
     expect(await readMembers('#room')).toHaveLength(0);
   });
 
@@ -234,7 +239,7 @@ describe.skipIf(!available)('membership transactions', () => {
     ]);
 
     const row = await readConnection('c1');
-    const joined = row!.joinedChannels as Set<string>;
+    const joined = row?.joinedChannels as Set<string>;
     expect(joined.has('#foo')).toBe(true);
     expect(joined.has('#bar')).toBe(true);
 
@@ -260,7 +265,7 @@ describe.skipIf(!available)('membership transactions', () => {
 
     expect(await readMembers('#foo')).toHaveLength(1);
     const row = await readConnection('c1');
-    const joined = row!.joinedChannels as Set<string>;
+    const joined = row?.joinedChannels as Set<string>;
     expect(joined.has('#foo')).toBe(true);
     expect([...joined].filter((c) => c === '#foo')).toHaveLength(1);
   });
@@ -283,7 +288,7 @@ describe.skipIf(!available)('membership transactions', () => {
 
     expect(await readMembers('#foo')).toHaveLength(0);
     const row = await readConnection('c1');
-    expect((row!.joinedChannels as Set<string> | undefined)?.size ?? 0).toBe(0);
+    expect((row?.joinedChannels as Set<string> | undefined)?.size ?? 0).toBe(0);
   });
 
   // -------------------------------------------------------------------------
@@ -303,7 +308,7 @@ describe.skipIf(!available)('membership transactions', () => {
 
     expect(await readMembers('#foo')).toHaveLength(0);
     const row = await readConnection('c1');
-    expect((row!.joinedChannels as Set<string> | undefined)?.size ?? 0).toBe(0);
+    expect((row?.joinedChannels as Set<string> | undefined)?.size ?? 0).toBe(0);
   });
 });
 

package/packages/cf-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/cf-adapter",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "private": true,
   "description": "Cloudflare Workers adapter: Durable Objects (ConnectionDO, RegistryDO, ChannelDO) and CfRuntime implementing IrcRuntime",
   "license": "BSD-3-Clause",

package/packages/cf-adapter/src/cf-runtime.ts

@@ -38,7 +38,9 @@ import {
   toSnapshot,
 } from '@serverless-ircd/irc-core';
 import type { IrcRuntime } from '@serverless-ircd/irc-server';
-import type { Env, RegistryRpc } from './env.js';
+import type { ChannelRegistryRpc, Env, RegistryRpc } from './env.js';
+import type { PersistedConnectionState } from './serialize.js';
+import { deserialize } from './serialize.js';
 import { DEFAULT_REGISTRY_SHARDS, registryKeyForNick, shardNick } from './sharding.js';
 
 /** Per-connection transport callbacks the ConnectionDO wires up. */
@@ -64,6 +66,10 @@ export interface ConnectionRpc {
   deliver(lines: RawLine[]): Promise<{ delivered: number }>;
   /** Returns a serializable snapshot of the connection state. */
   getConnSnapshot(): Promise<ConnSnapshot | null>;
+  /** Returns the full connection state as a serializable DTO. */
+  getConnState(): Promise<PersistedConnectionState | null>;
+  /** Cross-connection disconnect: closes the WebSocket and runs teardown. */
+  disconnect(reason?: string): Promise<void>;
 }
 
 /**
@@ -117,12 +123,8 @@ export class CfRuntime implements IrcRuntime {
       this.handlers.disconnect(reason);
       return;
     }
-    // Cross-connection disconnect is a teardown signal; we route it via
-    // the target's ConnectionDO RPC as well. (ConnectionDO doesn't expose
-    // a dedicated `disconnect` RPC today — the canonical teardown path is
-    // the WebSocket close, which is owned by the connection itself. We
-    // therefore no-op for cross-connection disconnects; this preserves
-    // the IrcRuntime contract without inventing a new RPC.)
+    const stub = this.env.CONNECTION_DO.get(this.env.CONNECTION_DO.idFromString(conn));
+    await (stub as unknown as ConnectionRpc).disconnect(reason);
   }
 
   async sendToNick(
@@ -232,29 +234,35 @@ export class CfRuntime implements IrcRuntime {
   }
 
   async getConnection(conn: ConnId): Promise<ConnectionState | null> {
-    // CF stores ConnectionState inside each ConnectionDO; the only
-    // authoritative view this runtime can hand out without a new RPC is
-    // the local connection's live state. Remote connections return null
-    // until a dedicated `getConnState` RPC lands alongside the broader
-    // WHOIS-over-CF work — the actor degrades to "unknown nick" for them.
     if (conn === this.connId) {
       return this.handlers.snapshot() ?? null;
     }
-    return null;
+    const stub = this.env.CONNECTION_DO.get(this.env.CONNECTION_DO.idFromString(conn));
+    const dto = await (stub as unknown as ConnectionRpc).getConnState();
+    return dto === null ? null : deserialize(dto);
   }
 
-  async getChannelConnections(_chan: ChanName): Promise<ReadonlyMap<ConnId, ConnectionState>> {
-    // CF has no single source of truth for full ConnectionStates across
-    // all ConnectionDOs. The WHO command (the only current consumer)
-    // ships in a later ticket; return an empty map until then.
-    return new Map();
+  async getChannelConnections(chan: ChanName): Promise<ReadonlyMap<ConnId, ConnectionState>> {
+    const memberIds = await this.channelRpc(chan).listMembers();
+    const out = new Map<ConnId, ConnectionState>();
+    await Promise.all(
+      memberIds.map(async (id) => {
+        const connStub = this.env.CONNECTION_DO.get(this.env.CONNECTION_DO.idFromString(id));
+        const dto = await (connStub as unknown as ConnectionRpc).getConnState();
+        if (dto !== null) {
+          out.set(id, deserialize(dto));
+        }
+      }),
+    );
+    return out;
   }
 
   async listChannels(): Promise<ChanSnapshot[]> {
-    // CF has no central channel registry; each ChannelDO is independent.
-    // The LIST command (the only current consumer) ships in a later
-    // ticket; return an empty array until then.
-    return [];
+    const names = await this.channelRegistryRpc().list();
+    const snapshots = await Promise.all(
+      names.map((nameLower) => this.getChannelSnapshot(nameLower)),
+    );
+    return snapshots.filter((s): s is ChanSnapshot => s !== null);
   }
 
   // -------------------------------------------------------------------------
@@ -278,6 +286,7 @@ export class CfRuntime implements IrcRuntime {
     broadcast(lines: unknown[], except?: string): Promise<void>;
     applyChannelDelta(delta: unknown): Promise<void>;
     getChannelSnapshot(): Promise<unknown>;
+    listMembers(): Promise<string[]>;
   } {
     const lower = name.toLowerCase();
     const stub = this.env.CHANNEL_DO.get(this.env.CHANNEL_DO.idFromName(lower));
@@ -285,8 +294,17 @@ export class CfRuntime implements IrcRuntime {
       broadcast(lines: unknown[], except?: string): Promise<void>;
       applyChannelDelta(delta: unknown): Promise<void>;
       getChannelSnapshot(): Promise<unknown>;
+      listMembers(): Promise<string[]>;
     };
   }
+
+  /** Returns the channel registry DO RPC stub. */
+  private channelRegistryRpc(): ChannelRegistryRpc {
+    const stub = this.env.CHANNEL_REGISTRY_DO.get(
+      this.env.CHANNEL_REGISTRY_DO.idFromName('channels'),
+    );
+    return stub as unknown as ChannelRegistryRpc;
+  }
 }
 
 /**

package/packages/cf-adapter/src/channel-do.ts

@@ -46,7 +46,7 @@ import {
   createChannel,
   toSnapshot,
 } from '@serverless-ircd/irc-core';
-import type { Env } from './env.js';
+import type { ChannelRegistryRpc, Env } from './env.js';
 
 /** Storage key under which the per-channel state is persisted. */
 const STATE_STORAGE_KEY = 'channel-state';
@@ -129,8 +129,10 @@ export class ChannelDO extends DurableObject<Env> {
    */
   async applyChannelDelta(delta: ChannelDelta): Promise<void> {
     const state = await this.loadState();
+    const wasEmpty = state.members.size === 0;
     const next = applyChannelDelta(state, delta);
     await this.persistState(next);
+    await this.syncRegistry(wasEmpty, next);
   }
 
   // -------------------------------------------------------------------------
@@ -160,10 +162,12 @@ export class ChannelDO extends DurableObject<Env> {
     const payload = lines.map((text) => ({ text }));
     const pruned = await this.fanoutAndCollect(state, payload, except);
     if (pruned.length > 0) {
+      const wasEmpty = false;
       const next = applyChannelDelta(state, {
         memberships: pruned.map((conn) => ({ type: 'remove' as const, conn })),
       });
       await this.persistState(next);
+      await this.syncRegistry(wasEmpty, next);
     }
   }
 
@@ -182,10 +186,12 @@ export class ChannelDO extends DurableObject<Env> {
     // OPEN-socket count without sending bytes).
     const pruned = await this.fanoutAndCollect(state, [], undefined);
     if (pruned.length > 0) {
+      const wasEmpty = false;
       const next = applyChannelDelta(state, {
         memberships: pruned.map((conn) => ({ type: 'remove' as const, conn })),
       });
       await this.persistState(next);
+      await this.syncRegistry(wasEmpty, next);
     }
     return pruned.length;
   }
@@ -206,6 +212,16 @@ export class ChannelDO extends DurableObject<Env> {
     return toDto(state);
   }
 
+  /**
+   * Returns the ConnIds of every member of this channel. Used by
+   * {@link CfRuntime.getChannelConnections} to enumerate the
+   * ConnectionStates of all members (for WHO).
+   */
+  async listMembers(): Promise<string[]> {
+    const state = await this.loadState();
+    return Array.from(state.members.keys());
+  }
+
   // -------------------------------------------------------------------------
   // Internal helpers
   // -------------------------------------------------------------------------
@@ -289,6 +305,29 @@ export class ChannelDO extends DurableObject<Env> {
     }
   }
 
+  /**
+   * Keeps the channel registry in sync: registers the channel when it
+   * transitions from empty to non-empty, unregisters on the reverse
+   * transition. Called after every membership-mutating path so the
+   * registry always reflects the live channel set.
+   */
+  private async syncRegistry(wasEmpty: boolean, next: ChannelState): Promise<void> {
+    const isEmpty = next.members.size === 0;
+    if (wasEmpty && !isEmpty) {
+      await this.channelRegistry().register(next.nameLower);
+    } else if (!wasEmpty && isEmpty) {
+      await this.channelRegistry().unregister(next.nameLower);
+    }
+  }
+
+  /** Returns the channel registry DO RPC stub. */
+  private channelRegistry(): ChannelRegistryRpc {
+    const stub = this.env.CHANNEL_REGISTRY_DO.get(
+      this.env.CHANNEL_REGISTRY_DO.idFromName('channels'),
+    );
+    return stub as unknown as ChannelRegistryRpc;
+  }
+
   // -------------------------------------------------------------------------
   // Test hooks (only invoked from `runInDurableObject` in tests)
   // -------------------------------------------------------------------------

package/packages/cf-adapter/src/channel-registry-do.ts

@@ -0,0 +1,58 @@
+/**
+ * `ChannelRegistryDO` — Cloudflare Durable Object that tracks the set
+ * of all channel names.
+ *
+ * A single DO instance (keyed by the literal name `channels`) maintains
+ * the complete channel-name set so {@link CfRuntime.listChannels} can
+ * enumerate every channel without scanning each per-channel DO
+ * individually.
+ *
+ * Storage layout:
+ *   - One key per channel: `chan:<lower>` → `1`
+ *
+ * Per-channel keys keep storage proportional to the live channel count
+ * and let individual register/unregister calls stay O(1).
+ *
+ * RPC surface — implements {@link ChannelRegistryRpc}. The ChannelDO
+ * calls `register` / `unregister` whenever its membership transitions
+ * between empty and non-empty; CfRuntime calls `list` for LIST.
+ */
+
+import { DurableObject } from 'cloudflare:workers';
+import type { ChannelRegistryRpc } from './env.js';
+
+/** Storage key prefix for per-channel entries. */
+const CHAN_KEY_PREFIX = 'chan:';
+
+/** Returns the storage key for `nameLower`. */
+function chanKey(nameLower: string): string {
+  return `${CHAN_KEY_PREFIX}${nameLower}`;
+}
+
+/**
+ * Channel registry authority.
+ *
+ * The class is exported as a binding target in `wrangler.toml`; the
+ * Workers runtime instantiates it with `(ctx, env)`.
+ */
+export class ChannelRegistryDO extends DurableObject implements ChannelRegistryRpc {
+  /** Adds `name` to the registry (idempotent). */
+  async register(name: string): Promise<void> {
+    await this.ctx.storage.put(chanKey(name.toLowerCase()), 1);
+  }
+
+  /** Removes `name` from the registry (idempotent). */
+  async unregister(name: string): Promise<void> {
+    await this.ctx.storage.delete(chanKey(name.toLowerCase()));
+  }
+
+  /** Returns all registered channel names (lowercased). */
+  async list(): Promise<string[]> {
+    const entries = await this.ctx.storage.list({ prefix: CHAN_KEY_PREFIX });
+    const names: string[] = [];
+    for (const key of entries.keys()) {
+      names.push(key.slice(CHAN_KEY_PREFIX.length));
+    }
+    return names;
+  }
+}

package/packages/cf-adapter/src/config-loader.ts

@@ -22,6 +22,17 @@ import { type ParsedServerConfig, parseServerConfig } from '@serverless-ircd/irc
 export interface CfConfigEnv {
   SERVER_NAME?: string;
   NETWORK_NAME?: string;
+  /**
+   * Server version surfaced in `002`/`004`/`351`/`371`. When unset the
+   * schema default ({@link DEFAULT_SERVER_VERSION}) applies.
+   */
+  SERVER_VERSION?: string;
+  /**
+   * "Created" text for `003 RPL_CREATED`. A numeric string is parsed into
+   * an epoch-ms number so the reducer formats it as a UTC timestamp; any
+   * other value is passed through verbatim.
+   */
+  CREATED_AT?: string;
   MOTD_LINES?: string;
   MAX_CLIENTS?: string;
   CHANNEL_PREFIXES?: string;
@@ -34,6 +45,12 @@ export interface CfConfigEnv {
   TOPIC_LEN?: string;
   MAX_LIST_ENTRIES?: string;
   QUIT_MESSAGE?: string;
+  /**
+   * SASL PLAIN accounts. Newline-delimited `username:password` pairs.
+   * Parsed into the `saslAccounts` config field so the config-driven
+   * path (vs the connection-do's direct env read) stays consistent.
+   */
+  SASL_ACCOUNTS?: string;
 }
 
 /**
@@ -50,6 +67,12 @@ function buildConfigInput(env: CfConfigEnv): Record<string, unknown> {
     serverName: env.SERVER_NAME,
     networkName: env.NETWORK_NAME,
   };
+  if (env.SERVER_VERSION !== undefined) {
+    input.serverVersion = env.SERVER_VERSION;
+  }
+  if (env.CREATED_AT !== undefined) {
+    input.createdAt = parseCreatedAt(env.CREATED_AT);
+  }
   if (env.MOTD_LINES !== undefined && env.MOTD_LINES.length > 0) {
     input.motdLines = env.MOTD_LINES.split('\n');
   }
@@ -90,9 +113,48 @@ function buildConfigInput(env: CfConfigEnv): Record<string, unknown> {
   if (env.QUIT_MESSAGE !== undefined) {
     input.quitMessage = env.QUIT_MESSAGE;
   }
+  if (env.SASL_ACCOUNTS !== undefined && env.SASL_ACCOUNTS.length > 0) {
+    input.saslAccounts = parseSaslAccountsLines(env.SASL_ACCOUNTS);
+  }
   return input;
 }
 
+/**
+ * Parses the `CREATED_AT` env var into the schema's `createdAt` field.
+ *
+ * A purely numeric string is treated as epoch-ms (returned as a number so
+ * the reducer formats it as a UTC timestamp); any other value is returned
+ * verbatim as a human-readable string. Empty strings fall through to the
+ * schema default (the caller only invokes this when the env var is set).
+ */
+function parseCreatedAt(raw: string): string | number {
+  if (/^\d+$/.test(raw.trim())) {
+    const n = Number(raw.trim());
+    if (Number.isFinite(n)) return n;
+  }
+  return raw;
+}
+
+/**
+ * Parses a newline-delimited `username:password` string into the config's
+ * `saslAccounts` shape. Malformed entries are skipped so a trailing
+ * newline or partial edit does not break boot.
+ */
+function parseSaslAccountsLines(raw: string): Array<{ username: string; password: string }> {
+  const out: Array<{ username: string; password: string }> = [];
+  for (const line of raw.split('\n')) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0) continue;
+    const sep = trimmed.indexOf(':');
+    if (sep <= 0) continue;
+    const username = trimmed.slice(0, sep);
+    const password = trimmed.slice(sep + 1);
+    if (username.length === 0 || password.length === 0) continue;
+    out.push({ username, password });
+  }
+  return out;
+}
+
 /**
  * Loads and validates the server config from a Cloudflare Workers env.
  *