serverless-ircd 0.3.0 → 0.5.0

package/packages/cf-adapter/src/d1-account-store.ts

@@ -0,0 +1,198 @@
+/**
+ * D1-backed SASL account store primitives for the Cloudflare adapter.
+ *
+ * Mirrors the AWS `dynamo-account-store.ts` / `account-store.ts` pair:
+ * credentials are stored as scrypt hashes (never plaintext) in a D1
+ * `accounts` table and pre-loaded at {@link ConnectionDO} construction
+ * into the shared {@link HashedAccountStore}.
+ *
+ * Table-then-config precedence is implemented by {@link resolveAccountStore}:
+ * when the D1 table has rows it is authoritative; when it is empty (or
+ * unreachable, or the binding is absent) the code falls back to the
+ * `SASL_ACCOUNTS` env-var seed — preserving the config-seed behaviour for
+ * deployments that have not migrated to D1.
+ *
+ * The adapters diverge only at the scan/put boundary; the hashing helpers
+ * and the synchronous {@link HashedAccountStore} are shared via `irc-core`.
+ */
+
+import {
+  type AccountStore,
+  type HashedAccountCredential,
+  HashedAccountStore,
+  InMemoryAccountStore,
+  hashAccountCredential,
+} from '@serverless-ircd/irc-core';
+
+/**
+ * SQL to create the `accounts` table. Exported so the seed tool and
+ * provisioning docs reference one schema definition.
+ */
+export const CREATE_ACCOUNTS_TABLE_SQL =
+  'CREATE TABLE IF NOT EXISTS accounts (account TEXT PRIMARY KEY, algorithm TEXT NOT NULL, salt TEXT NOT NULL, hash TEXT NOT NULL)';
+
+/**
+ * A raw D1 row — the untyped shape returned by `prepare().all()`. Each
+ * column is `unknown` until validated into a {@link HashedAccountCredential}.
+ */
+type AccountsRow = Record<string, unknown>;
+
+/**
+ * Coerces a raw D1 row into a {@link HashedAccountCredential}, or returns
+ * `undefined` when the row is missing required columns or has the wrong
+ * types. Mirrors the silent-skip behaviour of the DynamoDB loader.
+ */
+function coerceRow(row: AccountsRow): HashedAccountCredential | undefined {
+  const { account, algorithm, salt, hash } = row;
+  if (
+    typeof account !== 'string' ||
+    typeof algorithm !== 'string' ||
+    typeof salt !== 'string' ||
+    typeof hash !== 'string'
+  ) {
+    return undefined;
+  }
+  return {
+    account,
+    algorithm: algorithm as HashedAccountCredential['algorithm'],
+    salt,
+    hash,
+  };
+}
+
+/**
+ * Queries the D1 `accounts` table and returns a fully-populated
+ * {@link HashedAccountStore}, or `undefined` when the table has no rows.
+ *
+ * Rows missing required attributes are silently skipped. Callers that need
+ * the table-then-config fallback should use {@link resolveAccountStore}
+ * rather than catching `undefined` themselves.
+ *
+ * @param db The D1 binding (may be `undefined` when D1 is not configured).
+ */
+export async function loadD1AccountStore(
+  db: D1Database | undefined,
+): Promise<HashedAccountStore | undefined> {
+  if (db === undefined) return undefined;
+  const result = await db
+    .prepare('SELECT account, algorithm, salt, hash FROM accounts')
+    .all<AccountsRow>();
+  const entries: HashedAccountCredential[] = [];
+  for (const row of result.results ?? []) {
+    const entry = coerceRow(row);
+    if (entry !== undefined) entries.push(entry);
+  }
+  if (entries.length === 0) return undefined;
+  return new HashedAccountStore(entries);
+}
+
+/**
+ * Writes (or re-seeds) a SASL PLAIN account into the D1 `accounts` table.
+ *
+ * The password is hashed via {@link hashAccountCredential} (scrypt, random
+ * salt) and stored as a {@link HashedAccountCredential} row — plaintext is
+ * never written. A repeat call for the same `username` overwrites the prior
+ * row (the PK is `account`), so this is the canonical CRUD/seed entry point
+ * for oper and SASL account provisioning.
+ *
+ * @returns The stored {@link HashedAccountCredential} (for tooling/tests).
+ */
+export async function putAccountCredential(
+  db: D1Database,
+  username: string,
+  password: string,
+): Promise<HashedAccountCredential> {
+  const entry = hashAccountCredential(username, password);
+  await db
+    .prepare('INSERT OR REPLACE INTO accounts (account, algorithm, salt, hash) VALUES (?, ?, ?, ?)')
+    .bind(entry.account, entry.algorithm, entry.salt, entry.hash)
+    .run();
+  return entry;
+}
+
+/**
+ * Builds a self-contained `INSERT OR REPLACE` SQL statement that writes a
+ * scrypt-hashed account row, suitable for `wrangler d1 execute --command`.
+ *
+ * The password is hashed via {@link hashAccountCredential}; the plaintext
+ * never appears in the SQL. The values are single-quoted with embedded
+ * single quotes doubled (`'` → `''`) to avoid injection through the
+ * username or the base64 output.
+ *
+ * This is the pure (non-IO) half of {@link putAccountCredential}; the seed
+ * CLI (`tools/seed-cf-accounts.ts`) calls this and pipes the result to
+ * `wrangler d1 execute`, while the runtime `ConnectionDO` path uses the
+ * bound-parameter {@link putAccountCredential}.
+ *
+ * @returns The hashed credential and the executable SQL string.
+ */
+export function buildAccountPutStatement(
+  username: string,
+  password: string,
+): { entry: HashedAccountCredential; sql: string } {
+  const entry = hashAccountCredential(username, password);
+  const sql = `INSERT OR REPLACE INTO accounts (account, algorithm, salt, hash) VALUES ('${sqlEscape(entry.account)}', '${sqlEscape(entry.algorithm)}', '${sqlEscape(entry.salt)}', '${sqlEscape(entry.hash)}')`;
+  return { entry, sql };
+}
+
+/** Doubles single quotes for safe embedding in a D1 SQL string literal. */
+function sqlEscape(value: string): string {
+  return value.replace(/'/g, "''");
+}
+
+/**
+ * Resolves the SASL account store for a CF deployment, applying the
+ * table-then-config precedence.
+ *
+ *   1. Queries the D1 `accounts` table (pre-loading every hashed credential
+ *      into a {@link HashedAccountStore}). When the table has one or more
+ *      rows it is authoritative — the table wins and the config seed is
+ *      ignored.
+ *   2. When the table is empty (or the binding is absent), falls back to
+ *      the `SASL_ACCOUNTS` env-var seed (an {@link InMemoryAccountStore})
+ *      so existing deployments that have not migrated to D1 keep working.
+ *   3. Returns `undefined` when neither source has accounts so the actor's
+ *      `ctx.accounts` stays unset (`AUTHENTICATE PLAIN` → `904`).
+ *
+ * Query failures are swallowed and treated as an empty table, falling
+ * through to the config seed — mirroring `resolveAccountStore` on AWS.
+ *
+ * @param db  The D1 binding (`undefined` when D1 is not configured).
+ * @param saslAccountsRaw The raw `SASL_ACCOUNTS` env var (newline-delimited
+ *   `username:password` pairs), or `undefined` when unset.
+ */
+export async function resolveAccountStore(
+  db: D1Database | undefined,
+  saslAccountsRaw: string | undefined,
+): Promise<AccountStore | undefined> {
+  try {
+    const store = await loadD1AccountStore(db);
+    if (store !== undefined) return store;
+  } catch {
+    // Table might not exist yet or be unreachable; fall through to seed.
+  }
+  const seed = parseSeed(saslAccountsRaw);
+  if (seed.length === 0) return undefined;
+  return new InMemoryAccountStore(seed);
+}
+
+/**
+ * Parses the `SASL_ACCOUNTS` env var into credential entries for the
+ * config-seed fallback. Re-exported from the in-memory account-store module
+ * so the precedence resolver is self-contained.
+ */
+function parseSeed(raw: string | undefined): Array<{ username: string; password: string }> {
+  if (raw === undefined || raw.length === 0) return [];
+  const out: Array<{ username: string; password: string }> = [];
+  for (const line of raw.split('\n')) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0) continue;
+    const sep = trimmed.indexOf(':');
+    if (sep <= 0) continue;
+    const username = trimmed.slice(0, sep);
+    const password = trimmed.slice(sep + 1);
+    if (username.length === 0 || password.length === 0) continue;
+    out.push({ username, password });
+  }
+  return out;
+}

package/packages/cf-adapter/src/env.ts

@@ -8,10 +8,11 @@
 
 /**
  * The production {@link Env} for `apps/cf-worker`. ConnectionDO uses the
- * three DO namespaces below to coordinate with the registry and channel
- * authorities. 036 (CfRuntime) is where the full wiring lives;
- * 033 (ConnectionDO) only needs `CONNECTION_DO` itself plus the
- * two collaborator namespaces.
+ * four DO namespaces below to coordinate with the registry, channel, and
+ * channel-registry authorities. The CfRuntime wires them together
+ * behind the platform-agnostic {@link IrcRuntime} port; ConnectionDO
+ * only needs `CONNECTION_DO` itself plus the three collaborator
+ * namespaces.
  *
  * RPC method shapes on {@link RegistryRpc} and {@link ChannelRpc} are
  * implemented by both the production DOs and the test stubs in
@@ -22,17 +23,20 @@ export interface Env {
   CONNECTION_DO: DurableObjectNamespace;
   /**
    * Nick registry authority. RPC: reserveNick / changeNick / releaseNick /
-   * lookupNick. Stubbed now (033); real impl in 034.
+   * lookupNick. Backed by the sharded {@link RegistryDO}, which keys
+   * instances by `hash(nick) % N` so the single-threaded DO gives the nick
+   * uniqueness invariant for free.
    *
    * Note: the production DO class is what's brand-typed; here we keep the
-   * namespace unparameterized and cast to the RPC surface at the call
-   * site. The full type plumbing lands with 034.
+   * namespace unparameterized and cast to the RPC surface at the call site.
    */
   REGISTRY_DO: DurableObjectNamespace;
   /**
    * Channel authority, keyed by lowercased channel name. RPC: broadcast /
-   * applyChannelDelta / getChannelSnapshot / listMembers. Stubbed now;
-   * real in 035.
+   * applyChannelDelta / getChannelSnapshot / listMembers. Backed by the
+   * {@link ChannelDO}, which owns the authoritative roster, modes,
+   * topic, and ban list and fans out broadcasts to each member's
+   * ConnectionDO.
    */
   CHANNEL_DO: DurableObjectNamespace;
   /**
@@ -42,9 +46,29 @@ export interface Env {
    * unregister / list.
    */
   CHANNEL_REGISTRY_DO: DurableObjectNamespace;
+  /**
+   * D1 database backing persistent SASL account credentials. The `accounts`
+   * table holds scrypt-hashed rows (`{ account PK, algorithm, salt, hash }`),
+   * loaded at {@link ConnectionDO} construction by `loadD1AccountStore`.
+   *
+   * Optional so deployments that have not migrated to D1 keep working: when
+   * unset, the precedence resolver falls straight through to the
+   * `SASL_ACCOUNTS` env-var seed (the legacy `InMemoryAccountStore`).
+   */
+  ACCOUNTS_DB?: D1Database;
   /** Server-level config knobs (name, MOTD lines, limits). */
   SERVER_NAME: string;
   NETWORK_NAME: string;
+  /**
+   * Server version surfaced in `002`/`004`/`351`/`371`. Optional; when unset
+   * the reducer falls back to the irc-core default version.
+   */
+  SERVER_VERSION?: string;
+  /**
+   * "Created" text for `003 RPL_CREATED`. Optional; when unset the reducer
+   * falls back to the default created text.
+   */
+  CREATED_AT?: string;
   MOTD_LINES: string;
   /**
    * SASL PLAIN accounts seeded into the in-worker `AccountStore`.
@@ -53,22 +77,41 @@ export interface Env {
    * end-to-end. Empty/undefined disables SASL account verification.
    */
   SASL_ACCOUNTS?: string;
+  /**
+   * IRC operator name consulted by the `OPER` reducer. Pair with
+   * {@link OPER_PASSWORD}; when either is set the connection-do threads
+   * both into the reducer-facing `ServerConfig.operCreds` via
+   * `loadServerConfigFromCfEnv`.
+   */
+  OPER_USER?: string;
+  /**
+   * IRC operator password paired with {@link OPER_USER}. Treat as a
+   * Cloudflare secret (never a plaintext `[vars]` entry) in production.
+   */
+  OPER_PASSWORD?: string;
 }
 
 /**
  * RPC contract ConnectionDO expects from the registry. The real
- * RegistryDO (034) and the test stub both implement this.
+ * RegistryDO and the test stub both implement this.
  */
 export interface RegistryRpc {
   reserveNick(nick: string, conn: string): Promise<{ ok: true } | { ok: false }>;
   changeNick(conn: string, oldNick: string, newNick: string): Promise<boolean>;
   releaseNick(nick: string): Promise<void>;
   lookupNick(nick: string): Promise<string | null>;
+  /**
+   * Enumerates every `(nickLower, connectionId)` entry in this shard. Used
+   * by global fan-out paths (e.g. `WALLOPS`) that need to reach connections
+   * regardless of shared channel membership. Returns a plain array so the
+   * RPC marshals cleanly across the DO boundary.
+   */
+  listEntries(): Promise<Array<[nickLower: string, connId: string]>>;
 }
 
 /**
  * RPC contract ConnectionDO expects from each channel instance. The real
- * ChannelDO (035) and the test stub both implement this.
+ * ChannelDO and the test stub both implement this.
  *
  * Note: `broadcast` accepts already-formatted raw line texts (no
  * `RawLine` wrapper) because that's what `cf-runtime.broadcast`

package/packages/cf-adapter/src/index.ts

@@ -2,14 +2,9 @@
  * @serverless-ircd/cf-adapter
  *
  * Cloudflare Workers adapter for ServerlessIRCd. Implements the three
- * Durable Objects (ConnectionDO, RegistryDO, ChannelDO) and a
- * CfRuntime that bridges them behind the platform-agnostic
- * {@link IrcRuntime} port.
- *
- * 033 shipped the {@link ConnectionDO} + a stub CfRuntime.
- * 034 ships the {@link RegistryDO} (real nick registry with
- * sharding). The {@link ChannelDO} (roster + modes + fanout) ships
- * here. The full CfRuntime lands in 036.
+ * Durable Objects (ConnectionDO, RegistryDO, ChannelDO), the
+ * ChannelRegistryDO index, and a CfRuntime that bridges them behind the
+ * platform-agnostic {@link IrcRuntime} port.
  */
 
 export {
@@ -28,7 +23,15 @@ export {
 } from './sharding.js';
 export { makeCfRuntime } from './cf-runtime.js';
 export type { CfConnectionHandlers } from './cf-runtime.js';
+export { CfStats } from './stats.js';
+export type { CfStatsRuntime } from './stats.js';
 export type { ChannelRpc, ChannelRegistryRpc, Env, RegistryRpc } from './env.js';
+export {
+  CREATE_ACCOUNTS_TABLE_SQL,
+  loadD1AccountStore,
+  putAccountCredential,
+  resolveAccountStore,
+} from './d1-account-store.js';
 export {
   PERSISTED_STATE_VERSION,
   STATE_STORAGE_KEY,

package/packages/cf-adapter/src/registry-do.ts

@@ -23,8 +23,8 @@
  * and the second sees the new owner and fails.
  *
  * RPC surface — implements {@link RegistryRpc}, the same shape the
- * stub `RecordingRegistryDO` exposed for 033. Consumers
- * (`CfRuntime`, 036) call these methods via `env.REGISTRY_DO`
+ * stub `RecordingRegistryDO` exposed for the connection tests. Consumers
+ * (`CfRuntime`) call these methods via `env.REGISTRY_DO`
  * after computing the shard key with {@link registryKeyForNick}.
  */
 
@@ -85,7 +85,7 @@ export class RegistryDO extends DurableObject implements RegistryRpc {
    *     `oldNick` after this conn abandoned it (defence in depth).
    *
    * Cross-shard changes (old and new hash to different shards) are
-   * orchestrated by `CfRuntime` in 036 as a two-phase
+   * orchestrated by `CfRuntime` as a two-phase
    * reserve-new-then-release-old. This DO only sees single-shard
    * changes and crash-recovery paths (where `oldNick` may not be
    * present); the latter is why the conditional delete is a soft check.
@@ -127,4 +127,23 @@ export class RegistryDO extends DurableObject implements RegistryRpc {
     const owner = await this.ctx.storage.get<string>(nickKey(nick.toLowerCase()));
     return owner ?? null;
   }
+
+  /**
+   * Enumerates every `(nickLower, connectionId)` pair in this shard.
+   * Backs the global WALLOPS fan-out: the caller scans every shard, collects
+   * all connection ids, and delivers to those carrying the `+w` mode. The
+   * walk is a single `list` over the `nick:` prefix; cost is proportional to
+   * the slice's live nick count (sharded, so bounded per DO).
+   */
+  async listEntries(): Promise<Array<[nickLower: string, connId: string]>> {
+    const out: Array<[nickLower: string, connId: string]> = [];
+    // `storage.list` resolves to a Map of `key → value` for the prefix.
+    // Each key is `nick:<lower>`; we strip the prefix to recover the nick.
+    const entries = await this.ctx.storage.list<string>({ prefix: NICK_KEY_PREFIX });
+    for (const [key, connId] of entries) {
+      const nickLower = key.slice(NICK_KEY_PREFIX.length);
+      out.push([nickLower, connId]);
+    }
+    return out;
+  }
 }

package/packages/cf-adapter/src/sharding.ts

@@ -22,8 +22,7 @@
  * `N` defaults to {@link DEFAULT_REGISTRY_SHARDS} (32) and is
  * configurable per deployment via the worker env. Changing N after
  * production traffic requires a migration (re-sharding every existing
- * nick→conn mapping); document this in `docs/deployment-cf.md`
- * (038).
+ * nick→conn mapping); document this in `docs/deployment-cf.md`.
  */
 
 /**

package/packages/cf-adapter/src/stats.ts

@@ -0,0 +1,65 @@
+/**
+ * Cloudflare Workers-flavoured {@link ServerStats} backend.
+ *
+ * Aggregates the network-wide counts the `LUSERS` / `STATS` reducers need
+ * by fanning out across the existing CF RPC surface: `listChannels` (via
+ * the {@link ChannelRegistryDO}) plus per-channel `listMembers` and
+ * per-member `getConnState`. Classification (oper / invisible / unknown)
+ * is delegated to the shared {@link computeStatsSnapshot} helper in
+ * irc-core so the classification rules live in exactly one place.
+ *
+ * **Limitation:** the CF runtime does not currently expose an
+ * "enumerate all connections" RPC, so a connection that has not joined
+ * any channel is not counted. This matches the ticket's "aggregate via
+ * listChannels / connection-enumeration RPCs" guidance; a future
+ * dedicated stats DO would close the gap (every connection would be
+ * counted regardless of channel membership).
+ *
+ * Constructed per `LUSERS` / `STATS` invocation alongside the
+ * {@link CfRuntime}; cheap to build, no caching. `uptimeStartedAt` is
+ * supplied by the caller (typically the worker's startup timestamp).
+ */
+
+import type {
+  ChanName,
+  ConnId,
+  ConnectionState,
+  ServerStatsSnapshot,
+} from '@serverless-ircd/irc-core';
+import { computeStatsSnapshot } from '@serverless-ircd/irc-core';
+
+/**
+ * The minimal slice of {@link CfRuntime} (or any adapter runtime) that
+ * {@link CfStats} needs. Defined structurally so unit tests can pass a
+ * stub without spinning up workerd / miniflare.
+ */
+export interface CfStatsRuntime {
+  listChannels(): Promise<ReadonlyArray<{ nameLower: string }>>;
+  getChannelConnections(name: ChanName): Promise<ReadonlyMap<ConnId, ConnectionState>>;
+}
+
+export class CfStats {
+  private readonly runtime: CfStatsRuntime;
+  private readonly uptimeStartedAt: number;
+
+  constructor(runtime: CfStatsRuntime, uptimeStartedAt: number) {
+    this.runtime = runtime;
+    this.uptimeStartedAt = uptimeStartedAt;
+  }
+
+  async getStats(): Promise<ServerStatsSnapshot> {
+    const channels = await this.runtime.listChannels();
+    // Fan out: gather every channel's members into one deduplicated map.
+    // A user in N channels is counted once.
+    const unique = new Map<ConnId, ConnectionState>();
+    await Promise.all(
+      channels.map(async (chan) => {
+        const members = await this.runtime.getChannelConnections(chan.nameLower as ChanName);
+        for (const [id, state] of members) {
+          unique.set(id, state);
+        }
+      }),
+    );
+    return computeStatsSnapshot(unique.values(), channels.length, this.uptimeStartedAt);
+  }
+}

package/packages/cf-adapter/tests/cf-harness.ts

@@ -1,6 +1,6 @@
 /**
  * CF-side {@link IrcHarnessFactory} — registers the parametrized IRC
- * scenario suite (032) against the Cloudflare adapter.
+ * scenario suite from `@serverless-ircd/irc-test-support` against the Cloudflare adapter.
  *
  * Each {@link CfHarness} instance is hermetic at the vitest-pool-workers
  * level: every test gets an isolated storage namespace
@@ -65,7 +65,8 @@ export interface CfHarnessEnv {
  */
 export function makeCfHarnessFactory(opts: CfHarnessFactoryOptions): IrcHarnessFactory {
   return Object.freeze({
-    name: 'cf',
+    name: 'cf+ws',
+    transport: 'ws',
     async create() {
       return new CfHarness(opts);
     },
@@ -204,6 +205,15 @@ class CfClientHandle implements ClientHarness {
     this.ws.send(`${line}\r\n`);
   }
 
+  async feed(chunk: string): Promise<void> {
+    if (this.closed) return;
+    // The CF harness speaks the WebSocket transport end-to-end (a real WS
+    // to a ConnectionDO), so one feed() is one text frame — identical to
+    // send() minus the framing. A CF+tcp factory (Spectrum + container
+    // origin) would route this through a TCP byte stream.
+    this.ws.send(chunk);
+  }
+
   async waitForLine(
     predicate: (line: string) => boolean,
     timeoutMs: number = DEFAULT_TIMEOUT_MS,

package/packages/cf-adapter/tests/cf-integration.test.ts

@@ -1,8 +1,8 @@
 /**
- * Parametrized IRC scenarios against the Cloudflare runtime — 036.
+ * Parametrized IRC scenarios against the Cloudflare runtime.
  *
  * Reuses the scenario runner from `@serverless-ircd/irc-test-support`
- * (032) and registers the CF harness factory built on top of the
+ * and registers the CF harness factory built on top of the
  * real ConnectionDO / RegistryDO / ChannelDO worker bindings. Each
  * scenario spawns one or more real WebSockets and drives the full
  * bytes → actor → CfRuntime pipeline inside `workerd`.
@@ -15,13 +15,13 @@
  * against the in-memory runtime; CF-specific failures stem from the
  * ConnectionDO's `PassthroughChannelAccess` not yet fetching
  * authoritative roster state from ChannelDO before running channel
- * reducers. That wiring lands in a follow-up to keep this ticket
+ * reducers. That wiring lands in a follow-up to keep this work
  * focused on the CfRuntime class itself):
  *   - Multi-client channel reads (NAMES of peers, KICK roster refresh)
  *     see only the local connection until the actor's channel access
  *     is upgraded to read from ChannelDO.
  *   - ChannelDO.getChannelSnapshot has an unrelated bug in the parallel
- *     ChannelDO ticket (035) that returns a malformed snapshot;
+ *     ChannelDO work that returns a malformed snapshot;
  *     that bug is not introduced here.
  */
 
@@ -62,7 +62,8 @@ afterAll(async () => {
 // guaranteed to be initialized.
 runIrcScenarios([
   {
-    name: 'cf',
+    name: 'cf+ws',
+    transport: 'ws',
     async create() {
       if (factory === undefined) {
         factory = makeCfHarnessFactory({ env });

package/packages/cf-adapter/tests/cf-runtime.test.ts

@@ -1,5 +1,5 @@
 /**
- * CfRuntime — 036.
+ * CfRuntime.
  *
  * Verifies that every {@link IrcRuntime} method on {@link CfRuntime} issues
  * the correct DO `stub()` call:
@@ -15,7 +15,7 @@
  *
  * Two envs are used:
  *   - `env`              — production bindings (recording stubs for the
- *                          033 unit suite; swapped to `_REAL` for
+ *                          ConnectionDO unit suite; swapped to `_REAL` for
  *                          the CfRuntime uniqueness + end-to-end tests).
  *   - `envWithRealDOs()` — a shim that re-exposes the real RegistryDO +
  *                          ChannelDO under the production binding names,
@@ -616,3 +616,39 @@ describe('CfRuntime — IrcRuntime structural conformance', () => {
     expect(handlers.sent).toEqual([':server 001 alice :Welcome']);
   });
 });
+
+describe('CfRuntime — reloadConfig (REHASH)', () => {
+  it('re-reads the bound Workers env and reparses the server config', async () => {
+    const realEnv = envWithRealDOs();
+    const rt = new CfRuntime(realEnv, 'conn-rehash', recordingHandlers());
+
+    const cfg = await rt.reloadConfig();
+
+    expect(cfg.serverName).toBe('irc.example.com');
+    expect(cfg.networkName).toBe('ExampleNet');
+  });
+
+  it('reflects a rotated env value on the next reload (no caching)', async () => {
+    const rotatingEnv = {
+      ...envWithRealDOs(),
+      OPER_USER: 'admin',
+      OPER_PASSWORD: 'old',
+    };
+    const rt = new CfRuntime(rotatingEnv, 'conn-rehash-2', recordingHandlers());
+
+    const first = await rt.reloadConfig();
+    expect(first.operCreds).toEqual([{ user: 'admin', password: 'old' }]);
+
+    // Rotate the env (simulate a re-deployed secret) and reload again.
+    rotatingEnv.OPER_PASSWORD = 'rotated';
+    const second = await rt.reloadConfig();
+    expect(second.operCreds).toEqual([{ user: 'admin', password: 'rotated' }]);
+  });
+
+  it('propagates a schema-validation failure so the actor applies the graceful 382', async () => {
+    const badEnv: Env = { ...envWithRealDOs(), NETWORK_NAME: '' };
+    const rt = new CfRuntime(badEnv, 'conn-rehash-bad', recordingHandlers());
+
+    await expect(rt.reloadConfig()).rejects.toThrow(/networkName/u);
+  });
+});

package/packages/cf-adapter/tests/channel-do.test.ts

@@ -1,7 +1,7 @@
 /**
  * ChannelDO — roster + modes + fanout via ConnectionDO stubs.
  *
- * TDD outline (from tickets.md):
+ * TDD outline:
  *   "Red on 'two members of a channel both receive PRIVMSG'; green;
  *    then gone-connection sweep."
  *
@@ -452,7 +452,7 @@ describe('ChannelDO — instance keying', () => {
 });
 
 // ---------------------------------------------------------------------------
-// Scale smoke test — exercises the 1k-member ceiling from the ticket.
+// Scale smoke test — exercises the 1k-member ceiling.
 // ---------------------------------------------------------------------------
 
 describe('ChannelDO — scale', () => {

package/packages/cf-adapter/tests/config-loader.test.ts

@@ -101,6 +101,28 @@ describe('loadServerConfigFromCfEnv — valid env', () => {
     });
     expect(cfg.quitMessage).toBe('Bye from CF');
   });
+
+  it('threads SERVER_VERSION into serverVersion', () => {
+    const cfg = loadServerConfigFromCfEnv({ ...baseEnv(), SERVER_VERSION: '1.2.3' });
+    expect(cfg.serverVersion).toBe('1.2.3');
+  });
+
+  it('passes CREATED_AT verbatim when it is non-numeric', () => {
+    const cfg = loadServerConfigFromCfEnv({ ...baseEnv(), CREATED_AT: '2024-06-01' });
+    expect(cfg.createdAt).toBe('2024-06-01');
+  });
+
+  it('parses a numeric CREATED_AT string into an epoch-ms number', () => {
+    const cfg = loadServerConfigFromCfEnv({ ...baseEnv(), CREATED_AT: '1700000000000' });
+    expect(cfg.createdAt).toBe(1_700_000_000_000);
+  });
+
+  it('applies the schema defaults for serverVersion/createdAt when unset', () => {
+    const cfg = loadServerConfigFromCfEnv(baseEnv());
+    expect(typeof cfg.serverVersion).toBe('string');
+    expect(cfg.serverVersion.length).toBeGreaterThan(0);
+    expect(cfg.createdAt).toBeDefined();
+  });
 });
 
 describe('loadServerConfigFromCfEnv — failure modes', () => {