serverless-ircd 0.3.0 → 0.4.0

package/packages/aws-adapter/tests/sweeper.test.ts

@@ -34,6 +34,11 @@ interface Fixture {
 
 let fx: Fixture | null;
 
+function requireFx(): Fixture {
+  if (!fx) throw new Error('test fixture not initialized');
+  return fx;
+}
+
 async function makeFixture(): Promise<Fixture> {
   if (endpoint === undefined) throw new Error('DYNAMO_ENDPOINT missing');
   const prefix = `s${Date.now()}-${Math.floor(Math.random() * 1e6)}-`;
@@ -81,8 +86,8 @@ async function makeFixture(): Promise<Fixture> {
 
 function params(overrides: Partial<SweepParams> = {}): SweepParams {
   return {
-    dynamo: fx!.client,
-    tables: fx!.tables,
+    dynamo: requireFx().client,
+    tables: requireFx().tables,
     ...overrides,
   };
 }
@@ -100,18 +105,18 @@ async function seedConnection(opts: {
   if (opts.nick !== undefined) {
     state.nick = opts.nick as Nick;
     state.user = opts.nick;
-    await fx!.client.send(
+    await requireFx().client.send(
       new PutCommand({
-        TableName: fx!.tables.Nicks,
+        TableName: requireFx().tables.Nicks,
         Item: marshalNick(opts.nick as Nick, opts.connId, opts.idleSince),
       }),
     );
   }
   for (const chan of opts.channels ?? []) {
     state.joinedChannels.add(chan);
-    await fx!.client.send(
+    await requireFx().client.send(
       new PutCommand({
-        TableName: fx!.tables.ChannelMembers,
+        TableName: requireFx().tables.ChannelMembers,
         Item: marshalChannelMember(chan.toLowerCase(), {
           conn: opts.connId,
           nick: (opts.nick ?? 'x') as Nick,
@@ -121,9 +126,9 @@ async function seedConnection(opts: {
       }),
     );
   }
-  await fx!.client.send(
+  await requireFx().client.send(
     new PutCommand({
-      TableName: fx!.tables.Connections,
+      TableName: requireFx().tables.Connections,
       Item: marshalConnection(state, opts.idleSince),
     }),
   );
@@ -131,16 +136,16 @@ async function seedConnection(opts: {
 
 async function connectionExists(connId: string): Promise<boolean> {
   const { GetCommand } = await import('@aws-sdk/lib-dynamodb');
-  const res = await fx!.client.send(
-    new GetCommand({ TableName: fx!.tables.Connections, Key: { connectionId: connId } }),
+  const res = await requireFx().client.send(
+    new GetCommand({ TableName: requireFx().tables.Connections, Key: { connectionId: connId } }),
   );
   return res.Item !== undefined;
 }
 
 async function membersOf(channelKey: string): Promise<{ connectionId: string }[]> {
-  const res = await fx!.client.send(
+  const res = await requireFx().client.send(
     new QueryCommand({
-      TableName: fx!.tables.ChannelMembers,
+      TableName: requireFx().tables.ChannelMembers,
       KeyConditionExpression: 'channelName = :k',
       ExpressionAttributeValues: { ':k': channelKey },
     }),
@@ -150,8 +155,8 @@ async function membersOf(channelKey: string): Promise<{ connectionId: string }[]
 
 async function nickExists(nick: string): Promise<boolean> {
   const { GetCommand } = await import('@aws-sdk/lib-dynamodb');
-  const res = await fx!.client.send(
-    new GetCommand({ TableName: fx!.tables.Nicks, Key: { nickLower: nick.toLowerCase() } }),
+  const res = await requireFx().client.send(
+    new GetCommand({ TableName: requireFx().tables.Nicks, Key: { nickLower: nick.toLowerCase() } }),
   );
   return res.Item !== undefined;
 }
@@ -281,8 +286,10 @@ describe.skipIf(!available)('gone-connection sweeper', () => {
 
   it('cleanupConnection is safe to call on a row the sweeper already removed (no throw)', async () => {
     await seedConnection({ connId: 'stale', idleSince: 0, nick: 'zed' });
-    await cleanupConnection(fx!.client, fx!.tables, 'stale', null);
-    await expect(cleanupConnection(fx!.client, fx!.tables, 'stale', null)).resolves.toBeUndefined();
+    await cleanupConnection(requireFx().client, requireFx().tables, 'stale', null);
+    await expect(
+      cleanupConnection(requireFx().client, requireFx().tables, 'stale', null),
+    ).resolves.toBeUndefined();
   });
 
   it('uses Date.now() when now is omitted (real-clock default path)', async () => {
@@ -297,9 +304,9 @@ describe.skipIf(!available)('gone-connection sweeper', () => {
 
   it('skips a row whose idleSince is not a number (defensive — corrupted row)', async () => {
     // Write a Connections row directly with a non-numeric idleSince.
-    await fx!.client.send(
+    await requireFx().client.send(
       new PutCommand({
-        TableName: fx!.tables.Connections,
+        TableName: requireFx().tables.Connections,
         Item: {
           connectionId: 'corrupt',
           registration: 'registered',

package/packages/aws-adapter/tests/transactions.test.ts

@@ -37,6 +37,11 @@ interface Fixture {
 
 let fx: Fixture | null;
 
+function requireFx(): Fixture {
+  if (!fx) throw new Error('test fixture not initialized');
+  return fx;
+}
+
 async function makeFixture(): Promise<Fixture> {
   if (endpoint === undefined) throw new Error('DYNAMO_ENDPOINT missing');
   const prefix = `x${Date.now()}-${Math.floor(Math.random() * 1e6)}-`;
@@ -89,8 +94,8 @@ function makeRuntime(connId: string): AwsRuntime {
     snapshot: () => undefined,
   };
   return new AwsRuntime({
-    dynamo: fx!.client,
-    tables: fx!.tables,
+    dynamo: requireFx().client,
+    tables: requireFx().tables,
     connId,
     handlers,
     managementApi: null,
@@ -100,9 +105,9 @@ function makeRuntime(connId: string): AwsRuntime {
 /** Persists a fresh Connections row with no joined channels. */
 async function seedConnection(connId: string, idleSince = 1_000): Promise<void> {
   const state = createConnection({ id: connId, connectedSince: idleSince });
-  await fx!.client.send(
+  await requireFx().client.send(
     new PutCommand({
-      TableName: fx!.tables.Connections,
+      TableName: requireFx().tables.Connections,
       Item: marshalConnection(state, idleSince),
     }),
   );
@@ -110,9 +115,9 @@ async function seedConnection(connId: string, idleSince = 1_000): Promise<void>
 
 /** Reads the raw Connections row (so we can inspect the stored shape). */
 async function readConnection(connId: string): Promise<{ joinedChannels?: unknown } | undefined> {
-  const res = await fx!.client.send(
+  const res = await requireFx().client.send(
     new GetCommand({
-      TableName: fx!.tables.Connections,
+      TableName: requireFx().tables.Connections,
       Key: { connectionId: connId },
     }),
   );
@@ -121,9 +126,9 @@ async function readConnection(connId: string): Promise<{ joinedChannels?: unknow
 
 /** Reads every ChannelMembers row for a channel. */
 async function readMembers(channelKey: string): Promise<{ connectionId: string }[]> {
-  const res = await fx!.client.send(
+  const res = await requireFx().client.send(
     new QueryCommand({
-      TableName: fx!.tables.ChannelMembers,
+      TableName: requireFx().tables.ChannelMembers,
       KeyConditionExpression: 'channelName = :k',
       ExpressionAttributeValues: { ':k': channelKey },
     }),
@@ -137,15 +142,15 @@ async function seedMembership(connId: string, nick: string, channel: ChanName):
   state.registration = 'registered';
   state.nick = nick as Nick;
   state.joinedChannels.add(channel);
-  await fx!.client.send(
+  await requireFx().client.send(
     new PutCommand({
-      TableName: fx!.tables.Connections,
+      TableName: requireFx().tables.Connections,
       Item: marshalConnection(state, 1_000),
     }),
   );
-  await fx!.client.send(
+  await requireFx().client.send(
     new PutCommand({
-      TableName: fx!.tables.ChannelMembers,
+      TableName: requireFx().tables.ChannelMembers,
       Item: marshalChannelMember(channel.toLowerCase(), {
         conn: connId,
         nick: nick as Nick,
@@ -182,8 +187,8 @@ describe.skipIf(!available)('membership transactions', () => {
 
     const row = await readConnection('c1');
     expect(row).toBeDefined();
-    expect(row!.joinedChannels).toBeInstanceOf(Set);
-    expect((row!.joinedChannels as Set<string>).has('#foo')).toBe(true);
+    expect(row?.joinedChannels).toBeInstanceOf(Set);
+    expect((row?.joinedChannels as Set<string>).has('#foo')).toBe(true);
   });
 
   it('PART removes both the ChannelMembers row and the channel from joinedChannels', async () => {
@@ -199,7 +204,7 @@ describe.skipIf(!available)('membership transactions', () => {
 
     const row = await readConnection('c1');
     expect(row).toBeDefined();
-    expect((row!.joinedChannels as Set<string> | undefined)?.has('#foo') ?? false).toBe(false);
+    expect((row?.joinedChannels as Set<string> | undefined)?.has('#foo') ?? false).toBe(false);
   });
 
   it('KICK (remove of a different connection) drops the target from joinedChannels', async () => {
@@ -211,7 +216,7 @@ describe.skipIf(!available)('membership transactions', () => {
     });
 
     const row = await readConnection('target');
-    expect((row!.joinedChannels as Set<string> | undefined)?.has('#room') ?? false).toBe(false);
+    expect((row?.joinedChannels as Set<string> | undefined)?.has('#room') ?? false).toBe(false);
     expect(await readMembers('#room')).toHaveLength(0);
   });
 
@@ -234,7 +239,7 @@ describe.skipIf(!available)('membership transactions', () => {
     ]);
 
     const row = await readConnection('c1');
-    const joined = row!.joinedChannels as Set<string>;
+    const joined = row?.joinedChannels as Set<string>;
     expect(joined.has('#foo')).toBe(true);
     expect(joined.has('#bar')).toBe(true);
 
@@ -260,7 +265,7 @@ describe.skipIf(!available)('membership transactions', () => {
 
     expect(await readMembers('#foo')).toHaveLength(1);
     const row = await readConnection('c1');
-    const joined = row!.joinedChannels as Set<string>;
+    const joined = row?.joinedChannels as Set<string>;
     expect(joined.has('#foo')).toBe(true);
     expect([...joined].filter((c) => c === '#foo')).toHaveLength(1);
   });
@@ -283,7 +288,7 @@ describe.skipIf(!available)('membership transactions', () => {
 
     expect(await readMembers('#foo')).toHaveLength(0);
     const row = await readConnection('c1');
-    expect((row!.joinedChannels as Set<string> | undefined)?.size ?? 0).toBe(0);
+    expect((row?.joinedChannels as Set<string> | undefined)?.size ?? 0).toBe(0);
   });
 
   // -------------------------------------------------------------------------
@@ -303,7 +308,7 @@ describe.skipIf(!available)('membership transactions', () => {
 
     expect(await readMembers('#foo')).toHaveLength(0);
     const row = await readConnection('c1');
-    expect((row!.joinedChannels as Set<string> | undefined)?.size ?? 0).toBe(0);
+    expect((row?.joinedChannels as Set<string> | undefined)?.size ?? 0).toBe(0);
   });
 });
 

package/packages/cf-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/cf-adapter",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "private": true,
   "description": "Cloudflare Workers adapter: Durable Objects (ConnectionDO, RegistryDO, ChannelDO) and CfRuntime implementing IrcRuntime",
   "license": "BSD-3-Clause",

package/packages/cf-adapter/src/cf-runtime.ts

@@ -39,9 +39,9 @@ import {
 } from '@serverless-ircd/irc-core';
 import type { IrcRuntime } from '@serverless-ircd/irc-server';
 import type { ChannelRegistryRpc, Env, RegistryRpc } from './env.js';
-import { DEFAULT_REGISTRY_SHARDS, registryKeyForNick, shardNick } from './sharding.js';
 import type { PersistedConnectionState } from './serialize.js';
 import { deserialize } from './serialize.js';
+import { DEFAULT_REGISTRY_SHARDS, registryKeyForNick, shardNick } from './sharding.js';
 
 /** Per-connection transport callbacks the ConnectionDO wires up. */
 export interface CfConnectionHandlers {
@@ -247,9 +247,7 @@ export class CfRuntime implements IrcRuntime {
     const out = new Map<ConnId, ConnectionState>();
     await Promise.all(
       memberIds.map(async (id) => {
-        const connStub = this.env.CONNECTION_DO.get(
-          this.env.CONNECTION_DO.idFromString(id),
-        );
+        const connStub = this.env.CONNECTION_DO.get(this.env.CONNECTION_DO.idFromString(id));
         const dto = await (connStub as unknown as ConnectionRpc).getConnState();
         if (dto !== null) {
           out.set(id, deserialize(dto));

package/packages/cf-adapter/src/config-loader.ts

@@ -22,6 +22,17 @@ import { type ParsedServerConfig, parseServerConfig } from '@serverless-ircd/irc
 export interface CfConfigEnv {
   SERVER_NAME?: string;
   NETWORK_NAME?: string;
+  /**
+   * Server version surfaced in `002`/`004`/`351`/`371`. When unset the
+   * schema default ({@link DEFAULT_SERVER_VERSION}) applies.
+   */
+  SERVER_VERSION?: string;
+  /**
+   * "Created" text for `003 RPL_CREATED`. A numeric string is parsed into
+   * an epoch-ms number so the reducer formats it as a UTC timestamp; any
+   * other value is passed through verbatim.
+   */
+  CREATED_AT?: string;
   MOTD_LINES?: string;
   MAX_CLIENTS?: string;
   CHANNEL_PREFIXES?: string;
@@ -56,6 +67,12 @@ function buildConfigInput(env: CfConfigEnv): Record<string, unknown> {
     serverName: env.SERVER_NAME,
     networkName: env.NETWORK_NAME,
   };
+  if (env.SERVER_VERSION !== undefined) {
+    input.serverVersion = env.SERVER_VERSION;
+  }
+  if (env.CREATED_AT !== undefined) {
+    input.createdAt = parseCreatedAt(env.CREATED_AT);
+  }
   if (env.MOTD_LINES !== undefined && env.MOTD_LINES.length > 0) {
     input.motdLines = env.MOTD_LINES.split('\n');
   }
@@ -102,6 +119,22 @@ function buildConfigInput(env: CfConfigEnv): Record<string, unknown> {
   return input;
 }
 
+/**
+ * Parses the `CREATED_AT` env var into the schema's `createdAt` field.
+ *
+ * A purely numeric string is treated as epoch-ms (returned as a number so
+ * the reducer formats it as a UTC timestamp); any other value is returned
+ * verbatim as a human-readable string. Empty strings fall through to the
+ * schema default (the caller only invokes this when the env var is set).
+ */
+function parseCreatedAt(raw: string): string | number {
+  if (/^\d+$/.test(raw.trim())) {
+    const n = Number(raw.trim());
+    if (Number.isFinite(n)) return n;
+  }
+  return raw;
+}
+
 /**
  * Parses a newline-delimited `username:password` string into the config's
  * `saslAccounts` shape. Malformed entries are skipped so a trailing

package/packages/cf-adapter/src/connection-do.ts

@@ -6,8 +6,8 @@
  * `HibernatingWebSocketHandler` so idle WebSocket connections cost
  * nothing between messages. When a message arrives the DO wakes, replays
  * the persisted {@link ConnectionState} from `state.storage`, runs the
- * frame through {@link ConnectionActor} with a stub {@link CfRuntime},
- * and persists the updated state back.
+ * frame through {@link ConnectionActor} with the {@link CfRuntime}, and
+ * persists the updated state back.
  *
  * Lifecycle:
  *   - `fetch()`                       WebSocket upgrade; `acceptWebSocket`.
@@ -16,15 +16,16 @@
  *   - `alarm()`                       PING sweep; missing PONG disconnects.
  *
  * Cross-DO coordination:
- *   - `REGISTRY_DO` (RPC stub today, real in 034).
- *   - `CHANNEL_DO` per lowercased channel (stub today, real in 035).
+ *   - `REGISTRY_DO` — sharded nick registry (034).
+ *   - `CHANNEL_DO` per lowercased channel — authoritative roster/modes
+ *     (035).
  *
  * The actor's `ActorChannelAccess` is a passthrough that returns
  * throwaway {@link ChannelState} objects — reducers mutate the local
  * view and emit `ApplyChannelDelta` effects that the CfRuntime forwards
- * to the authoritative ChannelDO. Sufficient for connection-authority
- * commands and JOIN/QUIT fan-out; richer channel reads (NAMES of remote
- * state) ship in 036.
+ * to the authoritative ChannelDO. Connection-authority commands and
+ * JOIN/QUIT fan-out are fully wired; richer channel reads (NAMES of
+ * remote state) are served via the ChannelDO snapshot RPC.
  */
 
 import { DurableObject } from 'cloudflare:workers';
@@ -37,18 +38,20 @@ import {
   type ConnectionState,
   ConsoleLogger,
   type IdFactory,
-  InMemoryAccountStore,
   InMemoryMessageStore,
+  InMemoryMtlsIdentityProvider,
+  InMemoryNickHistoryStore,
   LogLevel,
   type Logger,
   type MessageStore,
   type MotdProvider,
+  type MtlsIdentityProvider,
+  type NickHistoryStore,
   type RawLine,
   type SaslAccountCredential,
   type ServerConfig,
   SystemClock,
   UuidIdFactory,
-  applyChannelDelta,
   createChannel,
   createConnection,
   toSnapshot,
@@ -56,8 +59,9 @@ import {
 import { ConnectionActor } from '@serverless-ircd/irc-server';
 import { makeCfRuntime } from './cf-runtime.js';
 import type { CfConnectionHandlers } from './cf-runtime.js';
+import { resolveAccountStore } from './d1-account-store.js';
 import type { Env } from './env.js';
-import { PERSISTED_STATE_VERSION, STATE_STORAGE_KEY, deserialize, serialize } from './serialize.js';
+import { STATE_STORAGE_KEY, deserialize, serialize } from './serialize.js';
 import type { PersistedConnectionState } from './serialize.js';
 
 /** Default PING cadence (ms) — tuned for typical IRC client behavior. */
@@ -109,18 +113,52 @@ export class ConnectionDO extends DurableObject<Env> {
    */
   private messages: MessageStore | undefined;
   /**
-   * In-worker SASL account store seeded from the `SASL_ACCOUNTS` env var.
-   * Lazily constructed so the first frame that needs it parses the env once.
-   * A Durable-Object / D1-backed persistent variant is a documented
-   * follow-up; swapping it in means replacing {@link accountStore}.
+   * Per-connection nick-history store backing `WHOWAS`. The minimum-viable
+   * in-worker ring buffer is scoped to this connection: sign-offs this
+   * connection records are queryable by the same connection. A
+   * Durable-Object-backed persistent variant (shared across connections,
+   * keyed by nick) is a documented follow-up. Lazily constructed.
+   */
+  private history: NickHistoryStore | undefined;
+  /**
+   * SASL account store, resolved once via {@link loadAccountStore} before the
+   * first frame dispatches. The two-phase load mirrors AWS's
+   * `loadDynamoAccountStore`: D1 `accounts` table (authoritative when it has
+   * rows) is queried at boot; when empty/unreachable the `SASL_ACCOUNTS`
+   * env-var seed provides the fallback `InMemoryAccountStore`. The
+   * `AccountStore.verify` port is synchronous, so pre-loading MUST complete
+   * before the first reducer runs.
    */
   private accounts: AccountStore | undefined;
+  /** Guards {@link loadAccountStore} so the D1 query runs at most once. */
+  private accountsResolved = false;
+  /**
+   * Verified client-cert subject captured at WebSocket upgrade time when
+   * CF API Shield mTLS is configured. Surfaced to the SASL EXTERNAL reducer
+   * via an {@link MtlsIdentityProvider} so `AUTHENTICATE EXTERNAL` can map
+   * the cert subject to an account.
+   *
+   * CF API Shield mTLS setup:
+   * 1. Upload the client CA to API Shield (dashboard → Security → API Shield).
+   * 2. Create an mTLS policy on the custom hostname that requires client certs.
+   * 3. The verified subject is injected into `request.cf.tlsClientAuthCertSubject`
+   *    on every request, which the Worker reads at upgrade time.
+   * When unset (no mTLS configured), EXTERNAL auth fails with `904`.
+   */
+  private mtlsCertSubject: string | undefined;
   private readonly clock: Clock = SystemClock;
   private readonly ids: IdFactory = new UuidIdFactory();
   private readonly pingIntervalMs: number = DEFAULT_PING_INTERVAL_MS;
   private readonly pongTimeoutMs: number = DEFAULT_PONG_TIMEOUT_MS;
-  /** Outstanding outbound lines, drained when the WS sends complete. */
-  // (Reserved for a future batching optimization; kept off until 036.)
+  // Outbound lines are batched per call, not via a reserved instance
+  // field: `deliver()` joins every line of a ChannelDO broadcast into a
+  // single `WebSocket.send()`, and the actor `send` handler in
+  // `buildActor` does the same for one frame's response. Cross-call
+  // per-microtask coalescing (the optimization previously reserved here)
+  // was dropped — it would add a drain queue and ordering hazards between
+  // independent fan-out calls for no measured benefit (see ADR-003 and
+  // the CF adapter load-test report). Revisit only if WS round-trips
+  // become a demonstrated bottleneck.
 
   // -------------------------------------------------------------------------
   // WebSocket upgrade
@@ -134,6 +172,14 @@ export class ConnectionDO extends DurableObject<Env> {
     const pair = new WebSocketPair();
     const server = pair[0];
     const client = pair[1];
+    // Capture the verified client-cert subject when CF API Shield mTLS is
+    // active. `request.cf` is a Cloudflare-specific extension; the property
+    // is present only when a client certificate was verified against the
+    // uploaded CA pool.
+    const cf = (request as Request & { cf?: Record<string, unknown> }).cf;
+    if (cf !== undefined && typeof cf.tlsClientAuthCertSubject === 'string') {
+      this.mtlsCertSubject = cf.tlsClientAuthCertSubject;
+    }
     // Hibernation: `acceptWebSocket` accepts the server side implicitly.
     // Calling `server.accept()` first throws "already accepted".
     this.ctx.acceptWebSocket(server);
@@ -150,9 +196,9 @@ export class ConnectionDO extends DurableObject<Env> {
   override async webSocketMessage(ws: WebSocket, message: string | ArrayBuffer): Promise<void> {
     const text = typeof message === 'string' ? message : new TextDecoder().decode(message);
     const state = await this.loadState();
-    const before = new Set(state.joinedChannels);
     const beforeNick = state.nick;
 
+    await this.loadAccountStore();
     const actor = this.buildActor(ws, state);
     try {
       await actor.receiveTextFrame(text);
@@ -165,17 +211,11 @@ export class ConnectionDO extends DurableObject<Env> {
     if (beforeNick === undefined && state.nick !== undefined) {
       await this.ctx.storage.setAlarm(Date.now() + this.pingIntervalMs);
     }
-    // Detect newly joined channels so we can register them with the
-    // channel DO — necessary for the close handler to fan out QUIT to
-    // them. The stub channel DO records the call; the real ChannelDO
-    // (035) maintains authoritative roster state.
-    for (const chan of state.joinedChannels) {
-      if (!before.has(chan)) {
-        // joinReducer already emitted an ApplyChannelDelta; the stub
-        // ChannelDO records it. No extra work needed here for 033.
-        void chan;
-      }
-    }
+    // No per-ConnectionDO channel-registration step is needed here: channel
+    // membership is driven solely by the `ApplyChannelDelta` effect the
+    // joinReducer emits, which the CfRuntime forwards to the authoritative
+    // ChannelDO. The ChannelDO roster IS the fan-out registration target, so
+    // a second loop over newly joined channels here would be redundant.
   }
 
   /** QUIT fanout + nick release. RFC 1459: a missing close is a QUIT. */
@@ -310,9 +350,9 @@ export class ConnectionDO extends DurableObject<Env> {
       },
       snapshot: (): ConnectionState | undefined => this.cached,
     };
-    // For 033 stub routing we look up the per-connection registry
-    // stub by the DO instance's hex id. Production (034) shards the
-    // registry by nick instead, at which point `registryKey` is unused.
+    // The CfRuntime shards the registry by nick (034); the per-connection
+    // key passed here is ignored by `makeCfRuntime` (kept in the signature
+    // for call-site stability).
     const registryKey = this.ctx.id.toString();
     const runtime = makeCfRuntime(this.env, state.id, registryKey, handlers);
     if (this.channelAccess === undefined) {
@@ -323,6 +363,10 @@ export class ConnectionDO extends DurableObject<Env> {
     // per-connection in the Workers dashboard.
     const logger: Logger = new ConsoleLogger({ connectionId: state.id }, undefined, LogLevel.Info);
     const accounts = this.accountStore();
+    const mtlsIdentity: MtlsIdentityProvider | undefined =
+      this.mtlsCertSubject !== undefined
+        ? new InMemoryMtlsIdentityProvider([{ connId: state.id, identity: this.mtlsCertSubject }])
+        : undefined;
     return new ConnectionActor({
       state,
       runtime,
@@ -332,7 +376,9 @@ export class ConnectionDO extends DurableObject<Env> {
       ids: this.ids,
       motd,
       messages: this.messageStore(),
+      history: this.historyStore(),
       ...(accounts !== undefined ? { accounts } : {}),
+      ...(mtlsIdentity !== undefined ? { mtlsIdentity } : {}),
       logger,
     });
   }
@@ -340,6 +386,7 @@ export class ConnectionDO extends DurableObject<Env> {
   /** Tears down a connection: emit QUIT effects, release nick, close WS. */
   private async tearDown(ws: WebSocket): Promise<void> {
     const state = await this.loadState();
+    await this.loadAccountStore();
     const actor = this.buildActor(ws, state);
     // Drive QUIT through the actor so the same effect pipeline handles
     // fanout as during normal operation.
@@ -372,6 +419,8 @@ export class ConnectionDO extends DurableObject<Env> {
       ...DEFAULT_SERVER_CONFIG,
       ...(this.env.SERVER_NAME !== undefined ? { serverName: this.env.SERVER_NAME } : {}),
       ...(this.env.NETWORK_NAME !== undefined ? { networkName: this.env.NETWORK_NAME } : {}),
+      ...(this.env.SERVER_VERSION !== undefined ? { serverVersion: this.env.SERVER_VERSION } : {}),
+      ...(this.env.CREATED_AT !== undefined ? { createdAt: this.env.CREATED_AT } : {}),
     };
   }
 
@@ -398,17 +447,37 @@ export class ConnectionDO extends DurableObject<Env> {
   }
 
   /**
-   * Lazily constructs the in-worker SASL account store from the
-   * `SASL_ACCOUNTS` env var. Returns `undefined` when no accounts are
-   * configured so the actor's `ctx.accounts` stays unset (preserving the
-   * no-store behaviour: `AUTHENTICATE PLAIN` → `904`). A Durable-Object /
-   * D1-backed persistent variant is a documented follow-up.
+   * Lazily constructs the per-connection nick-history store. A future
+   * persistent variant (DO/KV-backed, keyed by nick) will replace this
+   * without touching the actor wiring.
+   */
+  private historyStore(): NickHistoryStore {
+    if (this.history === undefined) {
+      this.history = new InMemoryNickHistoryStore(this.clock);
+    }
+    return this.history;
+  }
+
+  /**
+   * Resolves the SASL account store once (D1 table → `SASL_ACCOUNTS` seed),
+   * caching the result. Safe to call on every frame; the D1 query runs at
+   * most once per ConnectionDO instance. Must complete before the first
+   * reducer dispatches so the synchronous `AccountStore.verify` port has its
+   * data ready.
+   */
+  private async loadAccountStore(): Promise<void> {
+    if (this.accountsResolved) return;
+    this.accountsResolved = true;
+    this.accounts = await resolveAccountStore(this.env.ACCOUNTS_DB, this.env.SASL_ACCOUNTS);
+  }
+
+  /**
+   * Returns the resolved account store, or `undefined` when no accounts are
+   * configured (so the actor's `ctx.accounts` stays unset: `AUTHENTICATE
+   * PLAIN` → `904`). Populated by {@link loadAccountStore}; callers MUST
+   * `await loadAccountStore()` before reading this.
    */
   private accountStore(): AccountStore | undefined {
-    if (this.accounts !== undefined) return this.accounts;
-    const creds = parseSaslAccountsEnv(this.env.SASL_ACCOUNTS);
-    if (creds.length === 0) return undefined;
-    this.accounts = new InMemoryAccountStore(creds);
     return this.accounts;
   }
 
@@ -437,6 +506,7 @@ export class ConnectionDO extends DurableObject<Env> {
   private async tearDownNoSocket(state: ConnectionState): Promise<void> {
     // Emit QUIT effects without dispatching transport calls (the socket
     // is already gone). The cross-DO fanout still runs.
+    await this.loadAccountStore();
     const noOpHandlers: CfConnectionHandlers = {
       send: (): void => {},
       disconnect: (): void => {},
@@ -456,6 +526,7 @@ export class ConnectionDO extends DurableObject<Env> {
       ids: this.ids,
       motd: this.motdProvider(),
       messages: this.messageStore(),
+      history: this.historyStore(),
     });
     await actor.receiveTextFrame('QUIT\r\n');
     await this.releaseAndPersist(state);
@@ -629,12 +700,6 @@ class PassthroughChannelAccess {
   }
 }
 
-// Reference `applyChannelDelta` to ensure the import is used downstream by
-// tests that exercise state migrations; harmless if the symbol is unused
-// in production today. (Removed from the ConnectionDO path because the
-// authoritative delta application lives in the ChannelDO stub today.)
-export { applyChannelDelta, PERSISTED_STATE_VERSION };
-
 /**
  * Parses the `SASL_ACCOUNTS` env var into credential entries.
  *