serverless-ircd 0.2.0 → 0.4.0

package/packages/cf-adapter/src/connection-do.ts

@@ -6,8 +6,8 @@
  * `HibernatingWebSocketHandler` so idle WebSocket connections cost
  * nothing between messages. When a message arrives the DO wakes, replays
  * the persisted {@link ConnectionState} from `state.storage`, runs the
- * frame through {@link ConnectionActor} with a stub {@link CfRuntime},
- * and persists the updated state back.
+ * frame through {@link ConnectionActor} with the {@link CfRuntime}, and
+ * persists the updated state back.
  *
  * Lifecycle:
  *   - `fetch()`                       WebSocket upgrade; `acceptWebSocket`.
@@ -16,19 +16,21 @@
  *   - `alarm()`                       PING sweep; missing PONG disconnects.
  *
  * Cross-DO coordination:
- *   - `REGISTRY_DO` (RPC stub today, real in 034).
- *   - `CHANNEL_DO` per lowercased channel (stub today, real in 035).
+ *   - `REGISTRY_DO` — sharded nick registry (034).
+ *   - `CHANNEL_DO` per lowercased channel — authoritative roster/modes
+ *     (035).
  *
  * The actor's `ActorChannelAccess` is a passthrough that returns
  * throwaway {@link ChannelState} objects — reducers mutate the local
  * view and emit `ApplyChannelDelta` effects that the CfRuntime forwards
- * to the authoritative ChannelDO. Sufficient for connection-authority
- * commands and JOIN/QUIT fan-out; richer channel reads (NAMES of remote
- * state) ship in 036.
+ * to the authoritative ChannelDO. Connection-authority commands and
+ * JOIN/QUIT fan-out are fully wired; richer channel reads (NAMES of
+ * remote state) are served via the ChannelDO snapshot RPC.
  */
 
 import { DurableObject } from 'cloudflare:workers';
 import {
+  type AccountStore,
   type ChanName,
   type ChannelState,
   type Clock,
@@ -37,15 +39,19 @@ import {
   ConsoleLogger,
   type IdFactory,
   InMemoryMessageStore,
+  InMemoryMtlsIdentityProvider,
+  InMemoryNickHistoryStore,
   LogLevel,
   type Logger,
   type MessageStore,
   type MotdProvider,
+  type MtlsIdentityProvider,
+  type NickHistoryStore,
   type RawLine,
+  type SaslAccountCredential,
   type ServerConfig,
   SystemClock,
   UuidIdFactory,
-  applyChannelDelta,
   createChannel,
   createConnection,
   toSnapshot,
@@ -53,8 +59,10 @@ import {
 import { ConnectionActor } from '@serverless-ircd/irc-server';
 import { makeCfRuntime } from './cf-runtime.js';
 import type { CfConnectionHandlers } from './cf-runtime.js';
+import { resolveAccountStore } from './d1-account-store.js';
 import type { Env } from './env.js';
-import { PERSISTED_STATE_VERSION, STATE_STORAGE_KEY, deserialize, serialize } from './serialize.js';
+import { STATE_STORAGE_KEY, deserialize, serialize } from './serialize.js';
+import type { PersistedConnectionState } from './serialize.js';
 
 /** Default PING cadence (ms) — tuned for typical IRC client behavior. */
 export const DEFAULT_PING_INTERVAL_MS = 60_000;
@@ -104,12 +112,53 @@ export class ConnectionDO extends DurableObject<Env> {
    * follow-up. Lazily constructed so the first frame seeds it.
    */
   private messages: MessageStore | undefined;
+  /**
+   * Per-connection nick-history store backing `WHOWAS`. The minimum-viable
+   * in-worker ring buffer is scoped to this connection: sign-offs this
+   * connection records are queryable by the same connection. A
+   * Durable-Object-backed persistent variant (shared across connections,
+   * keyed by nick) is a documented follow-up. Lazily constructed.
+   */
+  private history: NickHistoryStore | undefined;
+  /**
+   * SASL account store, resolved once via {@link loadAccountStore} before the
+   * first frame dispatches. The two-phase load mirrors AWS's
+   * `loadDynamoAccountStore`: D1 `accounts` table (authoritative when it has
+   * rows) is queried at boot; when empty/unreachable the `SASL_ACCOUNTS`
+   * env-var seed provides the fallback `InMemoryAccountStore`. The
+   * `AccountStore.verify` port is synchronous, so pre-loading MUST complete
+   * before the first reducer runs.
+   */
+  private accounts: AccountStore | undefined;
+  /** Guards {@link loadAccountStore} so the D1 query runs at most once. */
+  private accountsResolved = false;
+  /**
+   * Verified client-cert subject captured at WebSocket upgrade time when
+   * CF API Shield mTLS is configured. Surfaced to the SASL EXTERNAL reducer
+   * via an {@link MtlsIdentityProvider} so `AUTHENTICATE EXTERNAL` can map
+   * the cert subject to an account.
+   *
+   * CF API Shield mTLS setup:
+   * 1. Upload the client CA to API Shield (dashboard → Security → API Shield).
+   * 2. Create an mTLS policy on the custom hostname that requires client certs.
+   * 3. The verified subject is injected into `request.cf.tlsClientAuthCertSubject`
+   *    on every request, which the Worker reads at upgrade time.
+   * When unset (no mTLS configured), EXTERNAL auth fails with `904`.
+   */
+  private mtlsCertSubject: string | undefined;
   private readonly clock: Clock = SystemClock;
   private readonly ids: IdFactory = new UuidIdFactory();
   private readonly pingIntervalMs: number = DEFAULT_PING_INTERVAL_MS;
   private readonly pongTimeoutMs: number = DEFAULT_PONG_TIMEOUT_MS;
-  /** Outstanding outbound lines, drained when the WS sends complete. */
-  // (Reserved for a future batching optimization; kept off until 036.)
+  // Outbound lines are batched per call, not via a reserved instance
+  // field: `deliver()` joins every line of a ChannelDO broadcast into a
+  // single `WebSocket.send()`, and the actor `send` handler in
+  // `buildActor` does the same for one frame's response. Cross-call
+  // per-microtask coalescing (the optimization previously reserved here)
+  // was dropped — it would add a drain queue and ordering hazards between
+  // independent fan-out calls for no measured benefit (see ADR-003 and
+  // the CF adapter load-test report). Revisit only if WS round-trips
+  // become a demonstrated bottleneck.
 
   // -------------------------------------------------------------------------
   // WebSocket upgrade
@@ -123,6 +172,14 @@ export class ConnectionDO extends DurableObject<Env> {
     const pair = new WebSocketPair();
     const server = pair[0];
     const client = pair[1];
+    // Capture the verified client-cert subject when CF API Shield mTLS is
+    // active. `request.cf` is a Cloudflare-specific extension; the property
+    // is present only when a client certificate was verified against the
+    // uploaded CA pool.
+    const cf = (request as Request & { cf?: Record<string, unknown> }).cf;
+    if (cf !== undefined && typeof cf.tlsClientAuthCertSubject === 'string') {
+      this.mtlsCertSubject = cf.tlsClientAuthCertSubject;
+    }
     // Hibernation: `acceptWebSocket` accepts the server side implicitly.
     // Calling `server.accept()` first throws "already accepted".
     this.ctx.acceptWebSocket(server);
@@ -139,9 +196,9 @@ export class ConnectionDO extends DurableObject<Env> {
   override async webSocketMessage(ws: WebSocket, message: string | ArrayBuffer): Promise<void> {
     const text = typeof message === 'string' ? message : new TextDecoder().decode(message);
     const state = await this.loadState();
-    const before = new Set(state.joinedChannels);
     const beforeNick = state.nick;
 
+    await this.loadAccountStore();
     const actor = this.buildActor(ws, state);
     try {
       await actor.receiveTextFrame(text);
@@ -154,17 +211,11 @@ export class ConnectionDO extends DurableObject<Env> {
     if (beforeNick === undefined && state.nick !== undefined) {
       await this.ctx.storage.setAlarm(Date.now() + this.pingIntervalMs);
     }
-    // Detect newly joined channels so we can register them with the
-    // channel DO — necessary for the close handler to fan out QUIT to
-    // them. The stub channel DO records the call; the real ChannelDO
-    // (035) maintains authoritative roster state.
-    for (const chan of state.joinedChannels) {
-      if (!before.has(chan)) {
-        // joinReducer already emitted an ApplyChannelDelta; the stub
-        // ChannelDO records it. No extra work needed here for 033.
-        void chan;
-      }
-    }
+    // No per-ConnectionDO channel-registration step is needed here: channel
+    // membership is driven solely by the `ApplyChannelDelta` effect the
+    // joinReducer emits, which the CfRuntime forwards to the authoritative
+    // ChannelDO. The ChannelDO roster IS the fan-out registration target, so
+    // a second loop over newly joined channels here would be redundant.
   }
 
   /** QUIT fanout + nick release. RFC 1459: a missing close is a QUIT. */
@@ -299,9 +350,9 @@ export class ConnectionDO extends DurableObject<Env> {
       },
       snapshot: (): ConnectionState | undefined => this.cached,
     };
-    // For 033 stub routing we look up the per-connection registry
-    // stub by the DO instance's hex id. Production (034) shards the
-    // registry by nick instead, at which point `registryKey` is unused.
+    // The CfRuntime shards the registry by nick (034); the per-connection
+    // key passed here is ignored by `makeCfRuntime` (kept in the signature
+    // for call-site stability).
     const registryKey = this.ctx.id.toString();
     const runtime = makeCfRuntime(this.env, state.id, registryKey, handlers);
     if (this.channelAccess === undefined) {
@@ -311,6 +362,11 @@ export class ConnectionDO extends DurableObject<Env> {
     // Bound `connectionId` so every record the actor emits is filterable
     // per-connection in the Workers dashboard.
     const logger: Logger = new ConsoleLogger({ connectionId: state.id }, undefined, LogLevel.Info);
+    const accounts = this.accountStore();
+    const mtlsIdentity: MtlsIdentityProvider | undefined =
+      this.mtlsCertSubject !== undefined
+        ? new InMemoryMtlsIdentityProvider([{ connId: state.id, identity: this.mtlsCertSubject }])
+        : undefined;
     return new ConnectionActor({
       state,
       runtime,
@@ -320,6 +376,9 @@ export class ConnectionDO extends DurableObject<Env> {
       ids: this.ids,
       motd,
       messages: this.messageStore(),
+      history: this.historyStore(),
+      ...(accounts !== undefined ? { accounts } : {}),
+      ...(mtlsIdentity !== undefined ? { mtlsIdentity } : {}),
       logger,
     });
   }
@@ -327,6 +386,7 @@ export class ConnectionDO extends DurableObject<Env> {
   /** Tears down a connection: emit QUIT effects, release nick, close WS. */
   private async tearDown(ws: WebSocket): Promise<void> {
     const state = await this.loadState();
+    await this.loadAccountStore();
     const actor = this.buildActor(ws, state);
     // Drive QUIT through the actor so the same effect pipeline handles
     // fanout as during normal operation.
@@ -359,6 +419,8 @@ export class ConnectionDO extends DurableObject<Env> {
       ...DEFAULT_SERVER_CONFIG,
       ...(this.env.SERVER_NAME !== undefined ? { serverName: this.env.SERVER_NAME } : {}),
       ...(this.env.NETWORK_NAME !== undefined ? { networkName: this.env.NETWORK_NAME } : {}),
+      ...(this.env.SERVER_VERSION !== undefined ? { serverVersion: this.env.SERVER_VERSION } : {}),
+      ...(this.env.CREATED_AT !== undefined ? { createdAt: this.env.CREATED_AT } : {}),
     };
   }
 
@@ -384,6 +446,41 @@ export class ConnectionDO extends DurableObject<Env> {
     return this.messages;
   }
 
+  /**
+   * Lazily constructs the per-connection nick-history store. A future
+   * persistent variant (DO/KV-backed, keyed by nick) will replace this
+   * without touching the actor wiring.
+   */
+  private historyStore(): NickHistoryStore {
+    if (this.history === undefined) {
+      this.history = new InMemoryNickHistoryStore(this.clock);
+    }
+    return this.history;
+  }
+
+  /**
+   * Resolves the SASL account store once (D1 table → `SASL_ACCOUNTS` seed),
+   * caching the result. Safe to call on every frame; the D1 query runs at
+   * most once per ConnectionDO instance. Must complete before the first
+   * reducer dispatches so the synchronous `AccountStore.verify` port has its
+   * data ready.
+   */
+  private async loadAccountStore(): Promise<void> {
+    if (this.accountsResolved) return;
+    this.accountsResolved = true;
+    this.accounts = await resolveAccountStore(this.env.ACCOUNTS_DB, this.env.SASL_ACCOUNTS);
+  }
+
+  /**
+   * Returns the resolved account store, or `undefined` when no accounts are
+   * configured (so the actor's `ctx.accounts` stays unset: `AUTHENTICATE
+   * PLAIN` → `904`). Populated by {@link loadAccountStore}; callers MUST
+   * `await loadAccountStore()` before reading this.
+   */
+  private accountStore(): AccountStore | undefined {
+    return this.accounts;
+  }
+
   // -------------------------------------------------------------------------
   // Test hooks (only invoked from `runInDurableObject` in tests)
   // -------------------------------------------------------------------------
@@ -409,6 +506,7 @@ export class ConnectionDO extends DurableObject<Env> {
   private async tearDownNoSocket(state: ConnectionState): Promise<void> {
     // Emit QUIT effects without dispatching transport calls (the socket
     // is already gone). The cross-DO fanout still runs.
+    await this.loadAccountStore();
     const noOpHandlers: CfConnectionHandlers = {
       send: (): void => {},
       disconnect: (): void => {},
@@ -428,6 +526,7 @@ export class ConnectionDO extends DurableObject<Env> {
       ids: this.ids,
       motd: this.motdProvider(),
       messages: this.messageStore(),
+      history: this.historyStore(),
     });
     await actor.receiveTextFrame('QUIT\r\n');
     await this.releaseAndPersist(state);
@@ -470,6 +569,38 @@ export class ConnectionDO extends DurableObject<Env> {
     const state = await this.loadState();
     return toSnapshot(state);
   }
+
+  /**
+   * Cross-connection RPC: returns the full connection state as a
+   * JSON-friendly DTO ({@link PersistedConnectionState}). Called by
+   * another connection's {@link CfRuntime} when a `GetConnection`
+   * lookup targets this connection (e.g. WHOIS). The DTO survives DO
+   * RPC because `Set`/`Map` fields are pre-flattened to arrays by
+   * {@link serialize}; the caller rehydrates via {@link deserialize}.
+   */
+  public async getConnState(): Promise<PersistedConnectionState | null> {
+    const state = await this.loadState();
+    return serialize(state);
+  }
+
+  /**
+   * Cross-connection RPC: tears down this connection. Reuses the same
+   * QUIT fan-out / nick-release / WebSocket-close path as the normal
+   * `webSocketClose` handler so KICK and operator-driven disconnect
+   * produce identical side effects. If no live socket is attached the
+   * no-socket teardown path still releases the nick.
+   */
+  public async disconnect(reason?: string): Promise<void> {
+    void reason;
+    const sockets = this.ctx.getWebSockets();
+    const ws = sockets[0];
+    if (ws === undefined) {
+      const state = await this.loadState();
+      await this.tearDownNoSocket(state);
+      return;
+    }
+    await this.tearDown(ws as WebSocket);
+  }
 }
 
 /** Default MOTD when no `MOTD_LINES` env is supplied. */
@@ -569,8 +700,27 @@ class PassthroughChannelAccess {
   }
 }
 
-// Reference `applyChannelDelta` to ensure the import is used downstream by
-// tests that exercise state migrations; harmless if the symbol is unused
-// in production today. (Removed from the ConnectionDO path because the
-// authoritative delta application lives in the ChannelDO stub today.)
-export { applyChannelDelta, PERSISTED_STATE_VERSION };
+/**
+ * Parses the `SASL_ACCOUNTS` env var into credential entries.
+ *
+ * Format: newline-delimited `username:password` pairs (mirroring the
+ * `MOTD_LINES` convention). Blank lines and malformed entries (missing
+ * colon or empty username/password) are skipped so a trailing newline or a
+ * partial edit does not break boot. Exported so the parsing boundary is
+ * unit-testable in isolation.
+ */
+export function parseSaslAccountsEnv(raw: string | undefined): SaslAccountCredential[] {
+  if (raw === undefined || raw.length === 0) return [];
+  const out: SaslAccountCredential[] = [];
+  for (const line of raw.split('\n')) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0) continue;
+    const sep = trimmed.indexOf(':');
+    if (sep <= 0) continue; // missing colon or empty username
+    const username = trimmed.slice(0, sep);
+    const password = trimmed.slice(sep + 1);
+    if (username.length === 0 || password.length === 0) continue;
+    out.push({ username, password });
+  }
+  return out;
+}

package/packages/cf-adapter/src/d1-account-store.ts

@@ -0,0 +1,198 @@
+/**
+ * D1-backed SASL account store primitives for the Cloudflare adapter.
+ *
+ * Mirrors the AWS `dynamo-account-store.ts` / `account-store.ts` pair:
+ * credentials are stored as scrypt hashes (never plaintext) in a D1
+ * `accounts` table and pre-loaded at {@link ConnectionDO} construction
+ * into the shared {@link HashedAccountStore}.
+ *
+ * Table-then-config precedence is implemented by {@link resolveAccountStore}:
+ * when the D1 table has rows it is authoritative; when it is empty (or
+ * unreachable, or the binding is absent) the code falls back to the
+ * `SASL_ACCOUNTS` env-var seed — preserving the config-seed behaviour for
+ * deployments that have not migrated to D1.
+ *
+ * The adapters diverge only at the scan/put boundary; the hashing helpers
+ * and the synchronous {@link HashedAccountStore} are shared via `irc-core`.
+ */
+
+import {
+  type AccountStore,
+  type HashedAccountCredential,
+  HashedAccountStore,
+  InMemoryAccountStore,
+  hashAccountCredential,
+} from '@serverless-ircd/irc-core';
+
+/**
+ * SQL to create the `accounts` table. Exported so the seed tool and
+ * provisioning docs reference one schema definition.
+ */
+export const CREATE_ACCOUNTS_TABLE_SQL =
+  'CREATE TABLE IF NOT EXISTS accounts (account TEXT PRIMARY KEY, algorithm TEXT NOT NULL, salt TEXT NOT NULL, hash TEXT NOT NULL)';
+
+/**
+ * A raw D1 row — the untyped shape returned by `prepare().all()`. Each
+ * column is `unknown` until validated into a {@link HashedAccountCredential}.
+ */
+type AccountsRow = Record<string, unknown>;
+
+/**
+ * Coerces a raw D1 row into a {@link HashedAccountCredential}, or returns
+ * `undefined` when the row is missing required columns or has the wrong
+ * types. Mirrors the silent-skip behaviour of the DynamoDB loader.
+ */
+function coerceRow(row: AccountsRow): HashedAccountCredential | undefined {
+  const { account, algorithm, salt, hash } = row;
+  if (
+    typeof account !== 'string' ||
+    typeof algorithm !== 'string' ||
+    typeof salt !== 'string' ||
+    typeof hash !== 'string'
+  ) {
+    return undefined;
+  }
+  return {
+    account,
+    algorithm: algorithm as HashedAccountCredential['algorithm'],
+    salt,
+    hash,
+  };
+}
+
+/**
+ * Queries the D1 `accounts` table and returns a fully-populated
+ * {@link HashedAccountStore}, or `undefined` when the table has no rows.
+ *
+ * Rows missing required attributes are silently skipped. Callers that need
+ * the table-then-config fallback should use {@link resolveAccountStore}
+ * rather than catching `undefined` themselves.
+ *
+ * @param db The D1 binding (may be `undefined` when D1 is not configured).
+ */
+export async function loadD1AccountStore(
+  db: D1Database | undefined,
+): Promise<HashedAccountStore | undefined> {
+  if (db === undefined) return undefined;
+  const result = await db
+    .prepare('SELECT account, algorithm, salt, hash FROM accounts')
+    .all<AccountsRow>();
+  const entries: HashedAccountCredential[] = [];
+  for (const row of result.results ?? []) {
+    const entry = coerceRow(row);
+    if (entry !== undefined) entries.push(entry);
+  }
+  if (entries.length === 0) return undefined;
+  return new HashedAccountStore(entries);
+}
+
+/**
+ * Writes (or re-seeds) a SASL PLAIN account into the D1 `accounts` table.
+ *
+ * The password is hashed via {@link hashAccountCredential} (scrypt, random
+ * salt) and stored as a {@link HashedAccountCredential} row — plaintext is
+ * never written. A repeat call for the same `username` overwrites the prior
+ * row (the PK is `account`), so this is the canonical CRUD/seed entry point
+ * for oper and SASL account provisioning.
+ *
+ * @returns The stored {@link HashedAccountCredential} (for tooling/tests).
+ */
+export async function putAccountCredential(
+  db: D1Database,
+  username: string,
+  password: string,
+): Promise<HashedAccountCredential> {
+  const entry = hashAccountCredential(username, password);
+  await db
+    .prepare('INSERT OR REPLACE INTO accounts (account, algorithm, salt, hash) VALUES (?, ?, ?, ?)')
+    .bind(entry.account, entry.algorithm, entry.salt, entry.hash)
+    .run();
+  return entry;
+}
+
+/**
+ * Builds a self-contained `INSERT OR REPLACE` SQL statement that writes a
+ * scrypt-hashed account row, suitable for `wrangler d1 execute --command`.
+ *
+ * The password is hashed via {@link hashAccountCredential}; the plaintext
+ * never appears in the SQL. The values are single-quoted with embedded
+ * single quotes doubled (`'` → `''`) to avoid injection through the
+ * username or the base64 output.
+ *
+ * This is the pure (non-IO) half of {@link putAccountCredential}; the seed
+ * CLI (`tools/seed-cf-accounts.ts`) calls this and pipes the result to
+ * `wrangler d1 execute`, while the runtime `ConnectionDO` path uses the
+ * bound-parameter {@link putAccountCredential}.
+ *
+ * @returns The hashed credential and the executable SQL string.
+ */
+export function buildAccountPutStatement(
+  username: string,
+  password: string,
+): { entry: HashedAccountCredential; sql: string } {
+  const entry = hashAccountCredential(username, password);
+  const sql = `INSERT OR REPLACE INTO accounts (account, algorithm, salt, hash) VALUES ('${sqlEscape(entry.account)}', '${sqlEscape(entry.algorithm)}', '${sqlEscape(entry.salt)}', '${sqlEscape(entry.hash)}')`;
+  return { entry, sql };
+}
+
+/** Doubles single quotes for safe embedding in a D1 SQL string literal. */
+function sqlEscape(value: string): string {
+  return value.replace(/'/g, "''");
+}
+
+/**
+ * Resolves the SASL account store for a CF deployment, applying the
+ * table-then-config precedence.
+ *
+ *   1. Queries the D1 `accounts` table (pre-loading every hashed credential
+ *      into a {@link HashedAccountStore}). When the table has one or more
+ *      rows it is authoritative — the table wins and the config seed is
+ *      ignored.
+ *   2. When the table is empty (or the binding is absent), falls back to
+ *      the `SASL_ACCOUNTS` env-var seed (an {@link InMemoryAccountStore})
+ *      so existing deployments that have not migrated to D1 keep working.
+ *   3. Returns `undefined` when neither source has accounts so the actor's
+ *      `ctx.accounts` stays unset (`AUTHENTICATE PLAIN` → `904`).
+ *
+ * Query failures are swallowed and treated as an empty table, falling
+ * through to the config seed — mirroring `resolveAccountStore` on AWS.
+ *
+ * @param db  The D1 binding (`undefined` when D1 is not configured).
+ * @param saslAccountsRaw The raw `SASL_ACCOUNTS` env var (newline-delimited
+ *   `username:password` pairs), or `undefined` when unset.
+ */
+export async function resolveAccountStore(
+  db: D1Database | undefined,
+  saslAccountsRaw: string | undefined,
+): Promise<AccountStore | undefined> {
+  try {
+    const store = await loadD1AccountStore(db);
+    if (store !== undefined) return store;
+  } catch {
+    // Table might not exist yet or be unreachable; fall through to seed.
+  }
+  const seed = parseSeed(saslAccountsRaw);
+  if (seed.length === 0) return undefined;
+  return new InMemoryAccountStore(seed);
+}
+
+/**
+ * Parses the `SASL_ACCOUNTS` env var into credential entries for the
+ * config-seed fallback. Re-exported from the in-memory account-store module
+ * so the precedence resolver is self-contained.
+ */
+function parseSeed(raw: string | undefined): Array<{ username: string; password: string }> {
+  if (raw === undefined || raw.length === 0) return [];
+  const out: Array<{ username: string; password: string }> = [];
+  for (const line of raw.split('\n')) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0) continue;
+    const sep = trimmed.indexOf(':');
+    if (sep <= 0) continue;
+    const username = trimmed.slice(0, sep);
+    const password = trimmed.slice(sep + 1);
+    if (username.length === 0 || password.length === 0) continue;
+    out.push({ username, password });
+  }
+  return out;
+}

package/packages/cf-adapter/src/env.ts

@@ -8,10 +8,11 @@
 
 /**
  * The production {@link Env} for `apps/cf-worker`. ConnectionDO uses the
- * three DO namespaces below to coordinate with the registry and channel
- * authorities. 036 (CfRuntime) is where the full wiring lives;
- * 033 (ConnectionDO) only needs `CONNECTION_DO` itself plus the
- * two collaborator namespaces.
+ * four DO namespaces below to coordinate with the registry, channel, and
+ * channel-registry authorities. The CfRuntime (036) wires them together
+ * behind the platform-agnostic {@link IrcRuntime} port; ConnectionDO
+ * (033) only needs `CONNECTION_DO` itself plus the three collaborator
+ * namespaces.
  *
  * RPC method shapes on {@link RegistryRpc} and {@link ChannelRpc} are
  * implemented by both the production DOs and the test stubs in
@@ -22,22 +23,60 @@ export interface Env {
   CONNECTION_DO: DurableObjectNamespace;
   /**
    * Nick registry authority. RPC: reserveNick / changeNick / releaseNick /
-   * lookupNick. Stubbed now (033); real impl in 034.
+   * lookupNick. Backed by the sharded {@link RegistryDO} (034), which keys
+   * instances by `hash(nick) % N` so the single-threaded DO gives the nick
+   * uniqueness invariant for free.
    *
    * Note: the production DO class is what's brand-typed; here we keep the
-   * namespace unparameterized and cast to the RPC surface at the call
-   * site. The full type plumbing lands with 034.
+   * namespace unparameterized and cast to the RPC surface at the call site.
    */
   REGISTRY_DO: DurableObjectNamespace;
   /**
    * Channel authority, keyed by lowercased channel name. RPC: broadcast /
-   * applyChannelDelta / getChannelSnapshot. Stubbed now; real in 035.
+   * applyChannelDelta / getChannelSnapshot / listMembers. Backed by the
+   * {@link ChannelDO} (035), which owns the authoritative roster, modes,
+   * topic, and ban list and fans out broadcasts to each member's
+   * ConnectionDO.
    */
   CHANNEL_DO: DurableObjectNamespace;
+  /**
+   * Channel registry authority. A single DO instance tracks the set of
+   * all channel names so {@link CfRuntime.listChannels} can enumerate
+   * them without scanning every per-channel DO. RPC: register /
+   * unregister / list.
+   */
+  CHANNEL_REGISTRY_DO: DurableObjectNamespace;
+  /**
+   * D1 database backing persistent SASL account credentials. The `accounts`
+   * table holds scrypt-hashed rows (`{ account PK, algorithm, salt, hash }`),
+   * loaded at {@link ConnectionDO} construction by `loadD1AccountStore`.
+   *
+   * Optional so deployments that have not migrated to D1 keep working: when
+   * unset, the precedence resolver falls straight through to the
+   * `SASL_ACCOUNTS` env-var seed (the legacy `InMemoryAccountStore`).
+   */
+  ACCOUNTS_DB?: D1Database;
   /** Server-level config knobs (name, MOTD lines, limits). */
   SERVER_NAME: string;
   NETWORK_NAME: string;
+  /**
+   * Server version surfaced in `002`/`004`/`351`/`371`. Optional; when unset
+   * the reducer falls back to the irc-core default version.
+   */
+  SERVER_VERSION?: string;
+  /**
+   * "Created" text for `003 RPL_CREATED`. Optional; when unset the reducer
+   * falls back to the default created text.
+   */
+  CREATED_AT?: string;
   MOTD_LINES: string;
+  /**
+   * SASL PLAIN accounts seeded into the in-worker `AccountStore`.
+   * Newline-delimited `username:password` pairs; the connection-do parses
+   * these into an `InMemoryAccountStore` so `AUTHENTICATE PLAIN` works
+   * end-to-end. Empty/undefined disables SASL account verification.
+   */
+  SASL_ACCOUNTS?: string;
 }
 
 /**
@@ -64,4 +103,15 @@ export interface ChannelRpc {
   broadcast(lines: unknown[], except?: string): Promise<void>;
   applyChannelDelta(delta: unknown): Promise<void>;
   getChannelSnapshot(): Promise<unknown>;
+  listMembers(): Promise<string[]>;
+}
+
+/**
+ * RPC contract for the channel registry DO. Tracks the set of all
+ * channel names so {@link CfRuntime.listChannels} can enumerate them.
+ */
+export interface ChannelRegistryRpc {
+  register(name: string): Promise<void>;
+  unregister(name: string): Promise<void>;
+  list(): Promise<string[]>;
 }