serverless-ircd 0.3.0 → 0.4.0

package/packages/cf-adapter/tests/d1-account-store.test.ts

@@ -0,0 +1,226 @@
+/**
+ * D1-backed SASL account store + precedence resolver.
+ *
+ * Exercises the real D1 round-trip via miniflare: `putAccountCredential`
+ * writes a hashed row, `loadD1AccountStore` reads it back, and
+ * `resolveAccountStore` applies the table-then-config precedence.
+ */
+
+import { env } from 'cloudflare:test';
+import { hashAccountCredential } from '@serverless-ircd/irc-core';
+import { beforeEach, describe, expect, it } from 'vitest';
+import {
+  buildAccountPutStatement,
+  loadD1AccountStore,
+  putAccountCredential,
+  resolveAccountStore,
+} from '../src/d1-account-store';
+
+declare global {
+  namespace Cloudflare {
+    interface Env {
+      ACCOUNTS_DB: D1Database;
+    }
+  }
+}
+
+const CREATE_TABLE =
+  'CREATE TABLE IF NOT EXISTS accounts (account TEXT PRIMARY KEY, algorithm TEXT NOT NULL, salt TEXT NOT NULL, hash TEXT NOT NULL)';
+
+async function resetDb(): Promise<void> {
+  await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS accounts');
+  await env.ACCOUNTS_DB.exec(CREATE_TABLE);
+}
+
+describe('loadD1AccountStore', () => {
+  beforeEach(async () => {
+    await resetDb();
+  });
+
+  it('returns undefined when the table has no rows', async () => {
+    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
+    expect(store).toBeUndefined();
+  });
+
+  it('verifies an account after a row is written via putAccountCredential', async () => {
+    await putAccountCredential(env.ACCOUNTS_DB, 'alice', 's3cret');
+    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
+    expect(store).toBeDefined();
+    expect(
+      store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 's3cret' }),
+    ).toEqual({ ok: true, account: 'alice' });
+  });
+
+  it('rejects a wrong password after round-trip', async () => {
+    await putAccountCredential(env.ACCOUNTS_DB, 'alice', 'right');
+    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
+    expect(store).toBeDefined();
+    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'wrong' }).ok).toBe(
+      false,
+    );
+  });
+
+  it('loads multiple distinct accounts', async () => {
+    await putAccountCredential(env.ACCOUNTS_DB, 'alice', 'a1');
+    await putAccountCredential(env.ACCOUNTS_DB, 'bob', 'b2');
+    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
+    expect(store?.size).toBe(2);
+    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'a1' }).ok).toBe(
+      true,
+    );
+    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'bob', password: 'b2' }).ok).toBe(
+      true,
+    );
+  });
+
+  it('overwrites an existing account on re-seed', async () => {
+    await putAccountCredential(env.ACCOUNTS_DB, 'alice', 'old');
+    await putAccountCredential(env.ACCOUNTS_DB, 'alice', 'new');
+    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
+    expect(store?.size).toBe(1);
+    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'old' }).ok).toBe(
+      false,
+    );
+    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'new' }).ok).toBe(
+      true,
+    );
+  });
+
+  it('skips rows missing required columns', async () => {
+    // Use a permissive table (no NOT NULL) to simulate a row with a missing
+    // salt — the production schema's NOT NULL prevents this, but the loader
+    // stays defensive against schema drift / manual edits.
+    await env.ACCOUNTS_DB.exec('DROP TABLE accounts');
+    await env.ACCOUNTS_DB.exec(
+      'CREATE TABLE accounts (account TEXT PRIMARY KEY, algorithm TEXT, salt TEXT, hash TEXT)',
+    );
+    await env.ACCOUNTS_DB.prepare(
+      "INSERT INTO accounts (account, algorithm, hash) VALUES ('bad', 'scrypt', 'bbbb')",
+    ).run();
+    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
+    expect(store).toBeUndefined();
+  });
+});
+
+describe('putAccountCredential', () => {
+  beforeEach(async () => {
+    await resetDb();
+  });
+
+  it('writes a hashed row that round-trips through the store', async () => {
+    const entry = await putAccountCredential(env.ACCOUNTS_DB, 'carol', 'p@ss');
+    expect(entry.account).toBe('carol');
+    expect(entry.algorithm).toBe('scrypt');
+
+    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
+    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'carol', password: 'p@ss' })).toEqual({
+      ok: true,
+      account: 'carol',
+    });
+  });
+
+  it('never writes the plaintext password to the row', async () => {
+    const entry = await putAccountCredential(env.ACCOUNTS_DB, 'alice', 'hunter2-secret');
+    expect(entry.account).not.toContain('hunter2');
+    expect(entry.salt).not.toContain('hunter2');
+    expect(entry.hash).not.toContain('hunter2');
+  });
+
+  it('matches a manually-hashed entry written via raw D1 insert', async () => {
+    const hashed = hashAccountCredential('dave', 'pw');
+    await env.ACCOUNTS_DB.prepare(
+      'INSERT INTO accounts (account, algorithm, salt, hash) VALUES (?, ?, ?, ?)',
+    )
+      .bind(hashed.account, hashed.algorithm, hashed.salt, hashed.hash)
+      .run();
+    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
+    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'dave', password: 'pw' }).ok).toBe(
+      true,
+    );
+  });
+});
+
+describe('buildAccountPutStatement (seed SQL builder)', () => {
+  it('produces an INSERT OR REPLACE statement with scrypt-hashed values', () => {
+    const { entry, sql } = buildAccountPutStatement('alice', 's3cret');
+    expect(entry.account).toBe('alice');
+    expect(entry.algorithm).toBe('scrypt');
+    expect(sql).toContain('INSERT OR REPLACE INTO accounts');
+    // Plaintext must never appear in the SQL.
+    expect(sql).not.toContain('s3cret');
+  });
+
+  it('the generated SQL round-trips through loadD1AccountStore', async () => {
+    await resetDb();
+    const { sql } = buildAccountPutStatement('carol', 'p@ss');
+    await env.ACCOUNTS_DB.exec(sql);
+    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
+    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'carol', password: 'p@ss' })).toEqual({
+      ok: true,
+      account: 'carol',
+    });
+  });
+
+  it('escapes single quotes in the username to avoid breaking the SQL', async () => {
+    await resetDb();
+    const { sql } = buildAccountPutStatement("o'brien", 'pw');
+    await env.ACCOUNTS_DB.exec(sql);
+    const store = await loadD1AccountStore(env.ACCOUNTS_DB);
+    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: "o'brien", password: 'pw' }).ok).toBe(
+      true,
+    );
+  });
+
+  it('escapes single quotes in the base64 hash output', () => {
+    // The hash is base64 so it won't contain quotes, but the escaper is
+    // still exercised — verify the SQL is well-formed.
+    const { sql } = buildAccountPutStatement('alice', 'secret');
+    // A valid INSERT with four quoted values.
+    expect(sql.match(/'/g)?.length).toBe(8);
+  });
+});
+
+describe('resolveAccountStore precedence', () => {
+  beforeEach(async () => {
+    await resetDb();
+  });
+
+  it('returns the D1 store when the table has rows (table wins)', async () => {
+    await putAccountCredential(env.ACCOUNTS_DB, 'alice', 'table-secret');
+    const store = await resolveAccountStore(env.ACCOUNTS_DB, 'envuser:env-secret');
+    expect(store).toBeDefined();
+    expect(
+      store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'table-secret' }).ok,
+    ).toBe(true);
+    // Config account does NOT verify (table is authoritative).
+    expect(
+      store?.verify('PLAIN', { kind: 'PLAIN', username: 'envuser', password: 'env-secret' }).ok,
+    ).toBe(false);
+  });
+
+  it('falls back to the SASL_ACCOUNTS seed when the table is empty', async () => {
+    const store = await resolveAccountStore(env.ACCOUNTS_DB, 'envuser:env-secret');
+    expect(store).toBeDefined();
+    expect(
+      store?.verify('PLAIN', { kind: 'PLAIN', username: 'envuser', password: 'env-secret' }).ok,
+    ).toBe(true);
+  });
+
+  it('returns undefined when the table is empty and no seed is set', async () => {
+    const store = await resolveAccountStore(env.ACCOUNTS_DB, undefined);
+    expect(store).toBeUndefined();
+  });
+
+  it('returns undefined when the table is empty and the seed is blank', async () => {
+    const store = await resolveAccountStore(env.ACCOUNTS_DB, '');
+    expect(store).toBeUndefined();
+  });
+
+  it('falls back to the seed when the D1 binding is undefined', async () => {
+    const store = await resolveAccountStore(undefined, 'envuser:env-secret');
+    expect(store).toBeDefined();
+    expect(
+      store?.verify('PLAIN', { kind: 'PLAIN', username: 'envuser', password: 'env-secret' }).ok,
+    ).toBe(true);
+  });
+});

package/packages/cf-adapter/tests/raw-modules.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Ambient declaration so `?raw` imports (Vite's built-in transform that
+ * inlines a file's text at bundle time) typecheck under the strict
+ * `tsconfig.test.json`. Used by source-level regression guards that
+ * assert dead code stays removed.
+ */
+declare module '*?raw' {
+  const content: string;
+  // eslint-disable-next-line import/no-default-export
+  export default content;
+}

package/packages/cf-adapter/tests/worker/main.ts

@@ -25,7 +25,14 @@ import { RegistryDO } from '../../src/registry-do';
 import { RecordingChannelDO } from './stubs/channel-stub';
 import { RecordingRegistryDO } from './stubs/registry-stub';
 
-export { ChannelDO, ChannelRegistryDO, ConnectionDO, RegistryDO, RecordingRegistryDO, RecordingChannelDO };
+export {
+  ChannelDO,
+  ChannelRegistryDO,
+  ConnectionDO,
+  RegistryDO,
+  RecordingRegistryDO,
+  RecordingChannelDO,
+};
 
 export default {
   async fetch(): Promise<Response> {

package/packages/cf-adapter/wrangler.test.toml

@@ -14,6 +14,14 @@ MOTD_LINES = "Welcome to the ServerlessIRCd integration-test harness.\nAll scena
 # an InMemoryAccountStore so AUTHENTICATE PLAIN works end-to-end in tests.
 SASL_ACCOUNTS = "cf-sasl:s3cret"
 
+# D1 database backing persistent SASL accounts. The D1 account-store suite
+# creates the `accounts` table in a beforeEach and exercises the real
+# load/put/resolve path.
+[[d1_databases]]
+binding = "ACCOUNTS_DB"
+database_name = "cf-adapter-test-accounts"
+database_id = "test-d1-accounts"
+
 # Production bindings: REGISTRY_DO and CHANNEL_DO point at the real DO
 # classes so CfRuntime, ConnectionDO, and the integration suite all
 # exercise the actual sharded-registry + per-channel fanout path.

package/packages/in-memory-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/in-memory-runtime",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "private": true,
   "description": "Single-process reference implementation of the IrcRuntime port, backed by Maps",
   "license": "BSD-3-Clause",

package/packages/irc-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/irc-core",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "private": true,
   "description": "Platform-agnostic IRC protocol core: parser, serializer, command reducers, state shapes",
   "license": "BSD-3-Clause",
@@ -18,6 +18,10 @@
     }
   },
   "scripts": {
+    "prepare": "node scripts/generate-build-info.mjs",
+    "prebuild": "node scripts/generate-build-info.mjs",
+    "pretypecheck": "node scripts/generate-build-info.mjs",
+    "pretest": "node scripts/generate-build-info.mjs",
     "build": "tsc -p tsconfig.build.json",
     "typecheck": "tsc -p tsconfig.test.json --noEmit",
     "test": "vitest run",
@@ -35,6 +39,7 @@
   "devDependencies": {
     "@stryker-mutator/core": "^9.6.1",
     "@stryker-mutator/vitest-runner": "^9.6.1",
+    "@types/node": "^26.1.1",
     "vitest": "^4.1.0"
   }
 }

package/packages/irc-core/scripts/generate-build-info.mjs

@@ -0,0 +1,31 @@
+/**
+ * Generates `src/build-info.ts` containing the build timestamp.
+ *
+ * Runs as a `prebuild` / `pretest` / `pretypecheck` / `prepare` hook so the
+ * file always exists before tsc or vitest resolves `./build-info.js` imports.
+ * The emitted file is gitignored — it is regenerated on every build so the
+ * published `dist/index.js` carries the timestamp of the build that produced
+ * it, never a stale committed value.
+ *
+ * Output shape:
+ *
+ * ```ts
+ * // AUTO-GENERATED by scripts/generate-build-info.mjs — do not edit.
+ * export const BUILD_DATE = '2024-01-01T00:00:00.000Z';
+ * ```
+ *
+ * Failures here must abort the build rather than emit a half-file: a missing
+ * or malformed `build-info.ts` would break every downstream tsc invocation.
+ */
+import { writeFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const target = resolve(here, '..', 'src', 'build-info.ts');
+
+const iso = new Date().toISOString();
+const contents = `// AUTO-GENERATED by scripts/generate-build-info.mjs — do not edit.\nexport const BUILD_DATE = ${JSON.stringify(iso)};\n`;
+
+writeFileSync(target, contents, 'utf8');
+console.log(`[generate-build-info] wrote ${target} (BUILD_DATE=${iso})`);

package/packages/irc-core/src/caps/capabilities.ts

@@ -13,7 +13,11 @@
 export interface Capability {
   /** Wire name (`server-time`, `sasl`, …). */
   name: string;
-  /** Optional value (`PLAIN,EXTERNAL` for `sasl`); bare name when absent. */
+  /**
+   * Optional value parameter. For `sasl` this is the base mechanism list
+   * (`PLAIN`); the {@link saslCapValue} helper upgrades it to include
+   * `EXTERNAL` when mTLS is configured for a connection.
+   */
   value?: string;
 }
 
@@ -33,10 +37,27 @@ export const SUPPORTED_CAPABILITIES: ReadonlyArray<Capability> = Object.freeze([
   { name: 'message-tags' },
   { name: 'multi-prefix' },
   { name: 'safelist' },
-  { name: 'sasl', value: 'PLAIN,EXTERNAL' },
+  { name: 'sasl', value: 'PLAIN' },
   { name: 'server-time' },
 ]);
 
+/** Wire name of the SASL capability. */
+export const SASL_CAP_NAME = 'sasl';
+
+/**
+ * Returns the `sasl` cap value to advertise given whether an mTLS identity
+ * provider is bound for the connection.
+ *
+ * PLAIN is always available. EXTERNAL is advertised only when mTLS is
+ * configured (an `MtlsIdentityProvider` is bound) so clients on
+ * non-mTLS connections do not attempt a mechanism that cannot succeed.
+ * Operators enable EXTERNAL by configuring mTLS at the edge (CF API Shield
+ * mTLS, AWS custom-domain mTLS) — no code change required.
+ */
+export function saslCapValue(hasMtls: boolean): string {
+  return hasMtls ? 'PLAIN,EXTERNAL' : 'PLAIN';
+}
+
 /** Set form for fast membership checks during `CAP REQ`. */
 export const SUPPORTED_CAP_NAMES: ReadonlySet<string> = new Set<string>(
   SUPPORTED_CAPABILITIES.map((c) => c.name),

package/packages/irc-core/src/cloak.ts

@@ -11,7 +11,7 @@
  *
  * Implementation note: this uses a self-contained FNV-1a 32-bit hash plus a
  * short base32 encoding so the module stays pure-TS and runs unchanged on
- * Node 20, Cloudflare Workers, and Lambda. It is NOT a cryptographic MAC:
+ * Node 24, Cloudflare Workers, and Lambda. It is NOT a cryptographic MAC:
  * an attacker who learns one cloak cannot recover the secret, but a
  * determined attacker with the secret can forge cloaks. Deployments that
  * need stronger unforgeability should override this module.

package/packages/irc-core/src/commands/cap.ts

@@ -33,9 +33,11 @@
  */
 
 import {
+  SASL_CAP_NAME,
   SUPPORTED_CAPABILITIES,
   capToLsString,
   isSupportedCap,
+  saslCapValue,
   splitCapsForWire,
 } from '../caps/capabilities.js';
 import { Effect } from '../effects.js';
@@ -88,7 +90,12 @@ function handleLs(state: ConnectionState, ctx: Ctx): ReducerResult<ConnectionSta
   state.capNegotiating = true;
 
   const target = state.nick ?? '*';
-  const tokens = SUPPORTED_CAPABILITIES.map(capToLsString);
+  const hasMtls = ctx.mtlsIdentity !== undefined;
+  const tokens = SUPPORTED_CAPABILITIES.map((cap) =>
+    cap.name === SASL_CAP_NAME
+      ? capToLsString({ ...cap, value: saslCapValue(hasMtls) })
+      : capToLsString(cap),
+  );
   const maxLen = maxCapsContentLen(ctx, target);
   const chunks = splitCapsForWire(tokens, maxLen);
 

package/packages/irc-core/src/commands/index.ts

@@ -34,6 +34,7 @@ export { channelModeReducer, userModeReducer } from './mode.js';
 export { inviteReducer } from './invite.js';
 export { whoReducer } from './who.js';
 export { whoisReducer } from './whois.js';
+export { whowasReducer } from './whowas.js';
 export { generateIsupport } from './isupport.js';
 export { capReducer } from './cap.js';
 export { emitChghost } from './chghost.js';
@@ -47,3 +48,11 @@ export {
   CHATHISTORY_CAP,
 } from './chathistory.js';
 export { tagmsgChannelReducer, tagmsgUserReducer } from './tagmsg.js';
+export {
+  versionReducer,
+  timeReducer,
+  adminReducer,
+  infoReducer,
+} from './server-info.js';
+export { userhostReducer, formatUserhostReply } from './userhost.js';
+export { isonReducer } from './ison.js';

package/packages/irc-core/src/commands/ison.ts

@@ -0,0 +1,61 @@
+/**
+ * Pure reducer for the IRC `ISON` command.
+ *
+ * PLAN §2.1 location-of-authority: ISON is read-only — it checks which of the
+ * requested nicks are currently online and emits a single `303 RPL_ISON`
+ * line. The reducer itself does not perform lookups (those are async and
+ * belong to the actor / runtime layer); it receives the set of online nicks
+ * and the requested list, then reports the intersection.
+ *
+ * Wire format (RFC 2812 §5.8):
+ *   - `ISON <nick>{ <nick>}`
+ *   - `303 RPL_ISON`:
+ *     `:<server> 303 <nick> :<online_nick1> <online_nick2> …`
+ *
+ * Matching is case-insensitive per rfc1459 case-mapping. The reply carries
+ * the registered (display) spelling from the online map, not the requester's
+ * spelling, so a request for `BOB` reports `Bob` when that is the registered
+ * form.
+ */
+
+import { Effect } from '../effects.js';
+import type { Effect as EffectType, RawLine } from '../effects.js';
+import { Numerics } from '../protocol/numerics.js';
+import type { ConnectionState } from '../state/connection.js';
+import type { Ctx, ReducerResult } from '../types.js';
+
+/**
+ * Handles `ISON <nick>{ <nick>}`.
+ *
+ * `online` maps each online nick's case-folded (lowercased) form to its
+ * display spelling. Each requested nick is folded and looked up; matches are
+ * reported using the display spelling from the map.
+ *
+ * Signature is bespoke (not {@link Reducer}) because the actor must resolve
+ * the nicks asynchronously before formatting — mirrors `whoReducer` /
+ * `whoisReducer`.
+ */
+export function isonReducer(
+  online: ReadonlyMap<string, string>,
+  msg: { params: readonly string[] },
+  ctx: Ctx,
+): ReducerResult<ConnectionState> {
+  ctx.connection.lastSeen = ctx.clock.now();
+
+  const found: string[] = [];
+  for (const requested of msg.params) {
+    if (requested.length === 0) continue;
+    const display = online.get(requested.toLowerCase());
+    if (display !== undefined) {
+      found.push(display);
+    }
+  }
+
+  const nick = ctx.connection.nick ?? '*';
+  const codeStr = Numerics.RPL_ISON.toString().padStart(3, '0');
+  const trailing = found.join(' ');
+  const line: RawLine = { text: `:${ctx.serverName} ${codeStr} ${nick} :${trailing}` };
+
+  const effects: EffectType[] = [Effect.send(ctx.connId, [line])];
+  return { state: ctx.connection, effects };
+}

package/packages/irc-core/src/commands/quit.ts

@@ -52,6 +52,18 @@ export const quitReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
       );
     }
     effects.push(Effect.releaseNick(nick));
+    // Record the sign-off into nick history so WHOWAS can replay it. Only
+    // consulted when a NickHistoryStore is bound; absent → no-op.
+    if (ctx.history !== undefined) {
+      ctx.history.record({
+        nick,
+        connId: ctx.connId,
+        signoffTime: ctx.clock.now(),
+        ...(state.user !== undefined ? { username: state.user } : {}),
+        ...(state.host !== undefined ? { hostname: state.host } : {}),
+        ...(state.realname !== undefined ? { realname: state.realname } : {}),
+      });
+    }
   }
 
   effects.push(Effect.disconnect(ctx.connId));

package/packages/irc-core/src/commands/registration.ts

@@ -14,6 +14,7 @@
  */
 
 import { cloakHost } from '../cloak.js';
+import { formatCreatedAt, resolveServerVersion } from '../config.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
 import { Numerics } from '../protocol/numerics.js';
@@ -23,15 +24,6 @@ import type { Ctx, Reducer } from '../types.js';
 import { generateIsupport } from './isupport.js';
 import { buildMotdNumerics } from './motd-lines.js';
 
-/**
- * Server version reported in `002` / `004`. Placeholder until a config-driven
- * version lands.
- */
-const SERVER_VERSION = '0.2.0';
-
-/** "Created" text for `003 RPL_CREATED`. Placeholder. */
-const CREATED_TEXT = 'Phase 1';
-
 /** User mode letters for `004 RPL_MYINFO` (invisible, oper, wallops, server-notices). */
 const USER_MODES_004 = 'iosw';
 
@@ -70,15 +62,17 @@ export function buildWelcomeLines(state: ConnectionState, ctx: Ctx): RawLine[] {
   // always defined, so hostmaskOf always returns at least `nick`. The cast
   // avoids a dead `??` branch that v8 coverage cannot satisfy.
   const hostmask = hostmaskOf(state) as string;
+  const version = resolveServerVersion(ctx.serverConfig);
+  const created = formatCreatedAt(ctx.serverConfig.createdAt);
 
   return [
     { text: `${prefix} 001 ${nick} :Welcome to the ${ctx.networkName} IRC Network, ${hostmask}` },
     {
-      text: `${prefix} 002 ${nick} :Your host is ${ctx.serverName}, running version ${SERVER_VERSION}`,
+      text: `${prefix} 002 ${nick} :Your host is ${ctx.serverName}, running version ${version}`,
     },
-    { text: `${prefix} 003 ${nick} :This server was created in ${CREATED_TEXT}` },
+    { text: `${prefix} 003 ${nick} :This server was created in ${created}` },
     {
-      text: `${prefix} 004 ${nick} ${ctx.serverName} ${SERVER_VERSION} ${USER_MODES_004} ${CHANNEL_MODES_004}`,
+      text: `${prefix} 004 ${nick} ${ctx.serverName} ${version} ${USER_MODES_004} ${CHANNEL_MODES_004}`,
     },
     // 005 RPL_ISUPPORT — real tokens generated from serverConfig.
     ...generateIsupport(ctx.serverConfig, state.caps, nick),
@@ -214,6 +208,18 @@ export const nickReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
     }
     // hostmaskOf is guaranteed non-undefined here because oldNick is defined.
     const source = hostmaskOf(state) as string;
+    // Record the old nick into history so WHOWAS can replay it. Only
+    // consulted when a NickHistoryStore is bound; absent → no-op.
+    if (ctx.history !== undefined) {
+      ctx.history.record({
+        nick: oldNick,
+        connId: ctx.connId,
+        signoffTime: ctx.clock.now(),
+        ...(state.user !== undefined ? { username: state.user } : {}),
+        ...(state.host !== undefined ? { hostname: state.host } : {}),
+        ...(state.realname !== undefined ? { realname: state.realname } : {}),
+      });
+    }
     state.nick = nick;
     effects.push(Effect.changeNick(ctx.connId, oldNick, nick));
     effects.push(Effect.send(ctx.connId, [{ text: `:${source} NICK ${nick}` }]));