serverless-ircd 0.4.0 → 0.6.0

package/packages/irc-core/src/commands/multiline.ts

@@ -0,0 +1,256 @@
+/**
+ * Pure reducer for IRCv3 `draft/multiline` (multi-line `BATCH`).
+ *
+ * Spec: https://ircv3.net/specs/extensions/multiline
+ *
+ * A cap-enabled client opens a multi-line batch with
+ *   `BATCH +id draft/multiline :<target>`
+ * followed by N `PRIVMSG`/`NOTICE` lines addressed to the same target, then
+ * closes it with `BATCH -id`. The server concatenates the per-line trailing
+ * parameters with `\n`, enforces the advertised byte budget, and fans the
+ * result out:
+ *
+ *   - to peers that also negotiated `draft/multiline`: a replayed
+ *     `BATCH +newid draft/multiline :<target>` containing the original
+ *     per-line `PRIVMSG`/`NOTICE` messages;
+ *   - to everyone else: a single joined `PRIVMSG`/`NOTICE` carrying the
+ *     `+draft/multiline` client tag so message-tags-aware (but not
+ *     multiline-aware) clients can recognise the joined form.
+ *
+ * This module owns the pure finalization step (concatenation, byte-budget
+ * enforcement, fanout construction). The stateful accumulation of the inner
+ * lines — buffering `PRIVMSG`/`NOTICE` between the `BATCH +` and `BATCH -`
+ * markers — lives in the actor layer, which calls
+ * {@link finalizeMultilineBatch} once the batch closes.
+ */
+
+import {
+  DEFAULT_MULTILINE_MAX_BYTES,
+  MULTILINE_CAP_NAME,
+  multilineCapValue,
+} from '../caps/capabilities.js';
+import { Effect } from '../effects.js';
+import type { Effect as EffectType, RawLine } from '../effects.js';
+import { hostmaskOf } from '../state/connection.js';
+import type { Ctx } from '../types.js';
+
+/**
+ * Wire name of the IRCv3 `draft/multiline` capability. Aliased from
+ * {@link MULTILINE_CAP_NAME} (the canonical home in the cap data table) for
+ * ergonomic use inside the reducer.
+ */
+export const MULTILINE_CAP = MULTILINE_CAP_NAME;
+
+export { DEFAULT_MULTILINE_MAX_BYTES, multilineCapValue };
+
+/**
+ * One accumulated inner line of a multi-line batch. The actor collects these
+ * as the client streams `PRIVMSG`/`NOTICE` lines between the batch markers,
+ * then hands the list to {@link finalizeMultilineBatch}. Only the trailing
+ * parameter (message text) is stored per line: the spec requires every inner
+ * line of a batch to share both the command and the target, so those live on
+ * the batch as a whole and are passed to the reducer separately.
+ */
+export interface MultilineEntry {
+  /** The trailing parameter (message text) of the inner line. */
+  readonly text: string;
+}
+
+/** Result of {@link finalizeMultilineBatch}: either accepted or rejected. */
+export type FinalizeMultilineResult =
+  | { readonly ok: true; readonly effects: EffectType[] }
+  | { readonly ok: false; readonly effects: EffectType[] };
+
+/**
+ * Concatenates the per-line texts of a multi-line batch with `\n`, per the
+ * IRCv3 spec. The joined value is what legacy (non-multiline) peers receive
+ * as the trailing parameter of the single relayed PRIVMSG/NOTICE.
+ */
+export function joinMultiline(entries: readonly MultilineEntry[]): string {
+  return entries.map((e) => e.text).join('\n');
+}
+
+/**
+ * Returns the byte length of the joined multi-line content as the byte budget
+ * sees it: the sum of every entry's UTF-8 byte length plus one byte per `\n`
+ * separator. This is the quantity compared against `draft/multiline=<max>`.
+ */
+export function multilineByteLength(entries: readonly MultilineEntry[]): number {
+  if (entries.length === 0) return 0;
+  let total = 0;
+  for (const entry of entries) {
+    total += utf8ByteLength(entry.text);
+  }
+  // `(n - 1)` separators join `n` entries.
+  total += entries.length - 1;
+  return total;
+}
+
+/** Shared `TextEncoder` for UTF-8 byte-length accounting (Web standard). */
+const TEXT_ENCODER = new TextEncoder();
+
+/** Returns the UTF-8 byte length of `s` (the wire encoding for IRC content). */
+function utf8ByteLength(s: string): number {
+  return TEXT_ENCODER.encode(s).length;
+}
+
+/** Resolves the sender's hostmask, falling back to nick then `?`. */
+function senderHostmask(conn: Ctx['connection']): string {
+  return hostmaskOf(conn) ?? conn.nick ?? '?';
+}
+
+/**
+ * Pre-built wire lines for a finalized multi-line batch, independent of the
+ * delivery mechanism (channel `Broadcast` vs. nick-target `Send`). The caller
+ * picks the appropriate variant per recipient based on the recipient's caps:
+ *
+ *   - `draft/multiline` + `batch` → `batchedReplay` (replayed BATCH frame).
+ *   - `message-tags` only        → `taggedJoined` (joined PRIVMSG with
+ *                                   `+draft/multiline` client tag).
+ *   - neither                     → `bareJoined` (joined PRIVMSG, no tag).
+ */
+export interface MultilineFanout {
+  /** Replayed `BATCH +id draft/multiline <target>` … `BATCH -id`. */
+  readonly batchedReplay: RawLine[];
+  /** Joined PRIVMSG/NOTICE carrying the `+draft/multiline` client tag. */
+  readonly taggedJoined: RawLine;
+  /** Joined PRIVMSG/NOTICE with no tag prefix (for legacy peers). */
+  readonly bareJoined: RawLine;
+  /** The `\n`-joined trailing parameter (for chathistory recording). */
+  readonly joined: string;
+}
+
+/**
+ * Builds the wire-line variants for a finalized multi-line batch. Pure: no
+ * context, no effects — just string construction. Shared by the channel
+ * broadcast path ({@link finalizeMultilineBatch}) and the actor-side nick
+ * target path so both emit identical wire forms.
+ *
+ * @param target   The batch target (channel name or nick).
+ * @param command  The inner-line command (`PRIVMSG` or `NOTICE`).
+ * @param entries  The accumulated inner lines in arrival order.
+ * @param hostmask The sender's `nick!user@host` (or fallback).
+ * @param batchId  A fresh batch reference id for the replayed BATCH frame.
+ */
+export function buildMultilineFanout(
+  target: string,
+  command: 'PRIVMSG' | 'NOTICE',
+  entries: readonly MultilineEntry[],
+  hostmask: string,
+  batchId: string,
+): MultilineFanout {
+  const joined = joinMultiline(entries);
+
+  const taggedJoined: RawLine = {
+    text: `@+draft/multiline :${hostmask} ${command} ${target} :${joined}`,
+  };
+  const bareJoined: RawLine = {
+    text: `:${hostmask} ${command} ${target} :${joined}`,
+  };
+
+  const inner: RawLine[] = entries.map(
+    (e) => ({ text: `:${hostmask} ${command} ${target} :${e.text}` }) as RawLine,
+  );
+  const batchedReplay: RawLine[] = [
+    { text: `BATCH +${batchId} draft/multiline ${target}` },
+    ...inner,
+    { text: `BATCH -${batchId}` },
+  ];
+
+  return { batchedReplay, taggedJoined, bareJoined, joined };
+}
+
+/**
+ * Finalizes a closed multi-line batch: enforces the byte budget and builds
+ * the fanout effects for both multiline-capable and legacy peers.
+ *
+ * On success the joined body is also recorded into the bound
+ * {@link MessageStore} (if any) as a single entry carrying the
+ * `+draft/multiline` client tag, so `CHATHISTORY` playback returns exactly
+ * one entry per batch.
+ *
+ * @param target    The batch's relay target (channel name). The actor
+ *                  validates that every inner line addressed this same target
+ *                  before calling.
+ * @param command   The inner-line command (`PRIVMSG` or `NOTICE`); the actor
+ *                  guarantees every inner line used the same one.
+ * @param entries   The accumulated inner lines in arrival order.
+ * @param maxBytes  The advertised byte budget (`draft/multiline=<n>`).
+ * @param ctx       Per-invocation context.
+ * @returns         `{ ok: true, effects }` on success; `{ ok: false, effects }`
+ *                  when the joined content exceeds `maxBytes` (the effects
+ *                  carry the `FAIL` rejection back to the sender).
+ */
+export function finalizeMultilineBatch(
+  target: string,
+  command: 'PRIVMSG' | 'NOTICE',
+  entries: readonly MultilineEntry[],
+  maxBytes: number,
+  ctx: Ctx,
+): FinalizeMultilineResult {
+  if (entries.length === 0) {
+    return { ok: true, effects: [] };
+  }
+
+  const bytes = multilineByteLength(entries);
+  if (bytes > maxBytes) {
+    return {
+      ok: false,
+      effects: [
+        Effect.send(ctx.connId, [
+          {
+            text: `:${ctx.serverName} FAIL BATCH MULTILINE_MAX_BYTES ${target} :Multi-line batch exceeds the ${maxBytes} byte limit`,
+          },
+        ]),
+      ],
+    };
+  }
+
+  const hostmask = senderHostmask(ctx.connection);
+  const batchId = ctx.ids.batchId();
+  const fanout = buildMultilineFanout(target, command, entries, hostmask, batchId);
+  const msgid = ctx.ids.nonce();
+  recordMultilineMessage(ctx, target, command, fanout.joined, msgid);
+
+  const effects: EffectType[] = [
+    Effect.broadcast(
+      target,
+      [fanout.taggedJoined],
+      ctx.connId,
+      MULTILINE_CAP,
+      fanout.batchedReplay,
+    ),
+  ];
+
+  return { ok: true, effects };
+}
+
+/**
+ * Records one finalized multi-line batch into the bound {@link MessageStore}
+ * (when present) as a single chathistory entry. The joined body is stored
+ * verbatim, the assigned `msgid` is the chathistory pivot, and the
+ * `+draft/multiline` client tag is attached so the chathistory replay can
+ * mark the line as originating from a multi-line batch. Shared by the
+ * channel broadcast path ({@link finalizeMultilineBatch}) and the actor-side
+ * nick-target path.
+ */
+export function recordMultilineMessage(
+  ctx: Ctx,
+  target: string,
+  command: 'PRIVMSG' | 'NOTICE',
+  joined: string,
+  msgid: string,
+): void {
+  if (ctx.messages === undefined) return;
+  ctx.messages.record({
+    msgid,
+    time: ctx.clock.now(),
+    chan: target.toLowerCase(),
+    command,
+    nick: (ctx.connection.nick as string) ?? '?',
+    user: ctx.connection.user as string,
+    host: ctx.connection.host as string,
+    text: joined,
+    clientTags: ['+draft/multiline'],
+  });
+}

package/packages/irc-core/src/commands/names.ts

@@ -14,7 +14,7 @@
  * `@` (private `+p`). Private wins over secret when both are set, matching
  * the JOIN reducer's NAMES reply and RFC 2812 §3.2.4.
  *
- * Visibility rules (PLAN §3 + ticket spec):
+ * Visibility rules (PLAN §3):
  *   - `+s` or `+p` set: requester must be a member to receive the NAMES list.
  *     Otherwise `442 ERR_NOTONCHANNEL`.
  *   - Otherwise: any connection may list.
@@ -44,12 +44,10 @@ function isValidChannelName(name: string, maxLen: number): boolean {
 }
 
 /** Formats a numeric error/reply line addressed to the connection's nick. */
-function numericErr(ctx: Ctx, code: number, trailing: string, middle?: string): RawLine {
+function numericErr(ctx: Ctx, code: number, trailing: string, middle: string): RawLine {
   const nick = ctx.connection.nick ?? '*';
   const codeStr = code.toString().padStart(3, '0');
-  const parts = [`:${ctx.serverName}`, codeStr, nick];
-  if (middle !== undefined) parts.push(middle);
-  parts.push(`:${trailing}`);
+  const parts = [`:${ctx.serverName}`, codeStr, nick, middle, `:${trailing}`];
   return { text: parts.join(' ') };
 }
 

package/packages/irc-core/src/commands/part.ts

@@ -33,12 +33,10 @@ function isValidChannelName(name: string, maxLen: number): boolean {
  * nick (or `*` when unregistered). Optional `middle` is emitted before the
  * trailing `:`-prefixed text.
  */
-function numericErr(ctx: Ctx, code: number, trailing: string, middle?: string): RawLine {
+function numericErr(ctx: Ctx, code: number, trailing: string, middle: string): RawLine {
   const nick = ctx.connection.nick ?? '*';
   const codeStr = code.toString().padStart(3, '0');
-  const parts = [`:${ctx.serverName}`, codeStr, nick];
-  if (middle !== undefined) parts.push(middle);
-  parts.push(`:${trailing}`);
+  const parts = [`:${ctx.serverName}`, codeStr, nick, middle, `:${trailing}`];
   return { text: parts.join(' ') };
 }
 

package/packages/irc-core/src/commands/pre-away.ts

@@ -0,0 +1,112 @@
+/**
+ * Pure helpers for IRCv3 `draft/pre-away` (persistent away status).
+ *
+ * Spec (work-in-progress): https://github.com/ircv3/ircv3-specifications/pull/415
+ *
+ * Flow:
+ *   - The {@link awayReducer} sets/clears {@link ConnectionState.away} as
+ *     usual. When an {@link AwayStore} is bound AND the connection is
+ *     identified (has an `account`), the change is mirrored into the
+ *     per-`account` record via {@link persistAway} (on set) or
+ *     {@link clearPersistedAway} (on unset).
+ *   - On SASL identify, the actor calls {@link replayPersistedAway} so a
+ *     fresh connection's `away` is restored from the persisted reason and
+ *     `306 RPL_NOWAWAY` is emitted as if the client had sent
+ *     `AWAY :reason` themselves.
+ *
+ * Mirrors the {@link ReadMarkerStore} plumbing from the read-marker cap.
+ */
+
+import { PRE_AWAY_CAP_NAME } from '../caps/capabilities.js';
+import type { AwayStore } from '../ports.js';
+import { Numerics } from '../protocol/numerics.js';
+import type { ConnectionState } from '../state/connection.js';
+import type { Ctx } from '../types.js';
+
+/**
+ * Wire name of the IRCv3 `draft/pre-away` capability. Aliased from
+ * {@link PRE_AWAY_CAP_NAME} (the canonical home in the cap data table)
+ * for ergonomic use inside the reducer.
+ */
+export const PRE_AWAY_CAP = PRE_AWAY_CAP_NAME;
+
+/**
+ * Records the away reason for the connection's account and stamps the
+ * in-memory {@link ConnectionState.away} so the current session tracks
+ * the new reason.
+ *
+ * Mirrors {@link persistReadMarker}: the store write is gated on both an
+ * {@link AwayStore} being bound AND the connection being identified.
+ * Unidentified connections still get the in-memory write so the session's
+ * own view (numerics, WHO/WHOIS) stays consistent.
+ */
+export function persistAway(ctx: Ctx, reason: string): void {
+  ctx.connection.away = reason;
+  const store = ctx.away;
+  const account = ctx.connection.account;
+  if (store !== undefined && account !== undefined) {
+    store.set(account, reason);
+  }
+}
+
+/**
+ * Clears the persisted away reason for the connection's account and the
+ * in-memory {@link ConnectionState.away}.
+ *
+ * Mirrors {@link persistAway}'s gating: a store write (delete) is gated
+ * on both a store being bound AND the connection being identified. The
+ * in-memory clear is unconditional so the session's own view stays
+ * consistent regardless of identification.
+ */
+export function clearPersistedAway(ctx: Ctx): void {
+  // biome-ignore lint/performance/noDelete: exactOptionalPropertyTypes forbids `= undefined`.
+  delete ctx.connection.away;
+  const store = ctx.away;
+  const account = ctx.connection.account;
+  if (store !== undefined && account !== undefined) {
+    store.clear(account);
+  }
+}
+
+/**
+ * Restores a fresh connection's {@link ConnectionState.away} from the
+ * persisted reason for `account`. Called at SASL identify so a reconnect
+ * resumes the user's away state.
+ *
+ * Existing in-memory `away` is preserved: a session may have already set
+ * a different reason, and the session's own value wins. Returns the
+ * persisted reason (or `undefined`) so the caller can emit the
+ * `306 RPL_NOWAWAY` numeric only when the replay actually applied a value.
+ */
+export function replayPersistedAway(
+  conn: ConnectionState,
+  store: AwayStore,
+  account: string,
+): string | undefined {
+  if (conn.away !== undefined) return undefined;
+  const reason = store.get(account);
+  if (reason === undefined) return undefined;
+  conn.away = reason;
+  return reason;
+}
+
+/**
+ * Builds the `306 RPL_NOWAWAY` line emitted after a successful away
+ * replay at identify time. Mirrors the line the {@link awayReducer}
+ * emits when a client sets `AWAY :reason` themselves, so the
+ * `draft/pre-away` replay is wire-identical to a direct AWAY set as far
+ * as the identified user is concerned.
+ *
+ * The companion `away-notify` broadcast (`:<hostmask> AWAY :<reason>` to
+ * cap-enabled peers in shared channels) is intentionally NOT emitted
+ * here: at SASL identify time the connection has not yet joined any
+ * channels, so the broadcast would have no audience. Peers learn the
+ * away state through the normal `AWAY` / `WHO` / `WHOIS` queries once
+ * the user joins.
+ */
+export function nowAwayLine(conn: ConnectionState, serverName: string): { text: string } {
+  const nick = conn.nick ?? '*';
+  return {
+    text: `:${serverName} ${Numerics.RPL_NOWAWAY.toString().padStart(3, '0')} ${nick} :You have been marked as being away`,
+  };
+}

package/packages/irc-core/src/commands/privmsg.ts

@@ -175,18 +175,18 @@ function buildChannelReducer(command: MessageCommand): Reducer<ChannelState> {
 
     // All checks passed: persist the message for chathistory playback when a
     // MessageStore is bound. The msgid/time are generated once here and travel
-    // on the StoredMessage; the live broadcast line stays bare (per-recipient
-    // server-time/msgid decoration is the dispatch layer's job). Recording is
-    // gated on ctx.messages so deployments with chathistory disabled see no
-    // change whatsoever.
+    // on the StoredMessage AND on the live fanout line (IRCv3 msgid). A single
+    // nonce is shared between the live tag and the record so the value a cap
+    // enabled peer sees live matches the value replayed by chathistory.
     //
     // By this point the sender's hostmask has already been computed and used
     // in the `+b` ban check above, so the connection's nick/user/host are all
     // defined for any registered PRIVMSG (registration sets all three); the
     // fallbacks mirror `senderHostmask` purely for the type-checker.
+    const msgid = ctx.ids.nonce();
     if (ctx.messages !== undefined) {
       ctx.messages.record({
-        msgid: ctx.ids.nonce(),
+        msgid,
         time: ctx.clock.now(),
         chan: state.nameLower,
         command,
@@ -197,14 +197,21 @@ function buildChannelReducer(command: MessageCommand): Reducer<ChannelState> {
       });
     }
 
-    // All checks passed: broadcast to the channel, excluding the sender.
-    const line: RawLine = { text: `:${hostmask} ${command} ${state.name} :${text}` };
-    effects.push(Effect.broadcast(state.name, [line], ctx.connId));
-
-    // IRCv3 echo-message: echo the same line back to the sender, after
-    // the broadcast effect so clients observe their own message last.
+    // All checks passed: broadcast to the channel, excluding the sender. The
+    // bare line goes to every member; the `@msgid=<id>` decorated line is sent
+    // only to members who negotiated the `msgid` cap (IRCv3 msgid). The
+    // dispatch layer's cap-split resolves per-recipient.
+    const body = `${command} ${state.name} :${text}`;
+    const line: RawLine = { text: `:${hostmask} ${body}` };
+    const msgidLine: RawLine = { text: `@msgid=${msgid} :${hostmask} ${body}` };
+    effects.push(Effect.broadcast(state.name, [line], ctx.connId, 'msgid', [msgidLine]));
+
+    // IRCv3 echo-message: echo the line back to the sender, after the
+    // broadcast effect so clients observe their own message last. A sender
+    // that also negotiated `msgid` sees the decorated echo.
     if (ctx.connection.caps.has('echo-message')) {
-      effects.push(Effect.send(ctx.connId, [line]));
+      const echoLine = ctx.connection.caps.has('msgid') ? msgidLine : line;
+      effects.push(Effect.send(ctx.connId, [echoLine]));
     }
 
     return { state, effects };

package/packages/irc-core/src/commands/read-marker.ts

@@ -0,0 +1,108 @@
+/**
+ * Pure helpers for IRCv3 `draft/read-marker` (persistent last-read marker).
+ *
+ * Spec (work-in-progress): https://ircv3.net/specs/extensions/read-marker
+ *
+ * The serverless-ircd deployment diverges from the work-in-progress draft:
+ * instead of the draft's `MARKREAD` command + server-time timestamp, this
+ * implementation is **msgid-based** so it composes with the
+ * per-`(connection, channel)` last-read marker the chathistory command
+ * already maintains in {@link ConnectionState.lastReadMarkers}.
+ *
+ * Flow:
+ *   - A cap-enabled client marks a message read by sending a
+ *     `TAGMSG <target>` carrying `+draft/read-marker=<msgid>`. The
+ *     {@link tagmsgChannelReducer} detects the tag, calls
+ *     {@link persistReadMarker} to advance the per-`(account, channel)`
+ *     record in the bound {@link ReadMarkerStore}, and fans the TAGMSG out
+ *     (carrying the tag) so the user's other connections learn the new
+ *     read position.
+ *   - On SASL identify, the actor calls {@link seedReadMarkers} so a fresh
+ *     connection's `lastReadMarkers` is restored from the stored values and
+ *     a reconnect resumes at the user's last read position.
+ */
+
+import { READ_MARKER_CAP_NAME } from '../caps/capabilities.js';
+import type { ReadMarkerStore } from '../ports.js';
+import type { ConnectionState } from '../state/connection.js';
+import type { Ctx } from '../types.js';
+
+/**
+ * Wire name of the IRCv3 `draft/read-marker` capability. Aliased from
+ * {@link READ_MARKER_CAP_NAME} (the canonical home in the cap data table)
+ * for ergonomic use inside the reducer.
+ */
+export const READ_MARKER_CAP = READ_MARKER_CAP_NAME;
+
+/**
+ * The client-tag key that carries a read-marker update. Presence of this key
+ * (with a non-empty value) on a `TAGMSG` identifies a read-marker update the
+ * server persists and propagates.
+ */
+export const READ_MARKER_TAG = '+draft/read-marker';
+
+/** Returns true iff `tags` carries the `+draft/read-marker` client tag. */
+export function isReadMarkerTagmsg(tags: Readonly<Record<string, string>>): boolean {
+  return READ_MARKER_TAG in tags;
+}
+
+/**
+ * Returns the msgid carried by the `+draft/read-marker` tag, or `undefined`
+ * when the tag is absent or valueless. A valueless tag carries no msgid and
+ * therefore no marker to persist.
+ */
+export function readMarkerMsgid(tags: Readonly<Record<string, string>>): string | undefined {
+  const value = tags[READ_MARKER_TAG];
+  if (value === undefined || value === '') return undefined;
+  return value;
+}
+
+/**
+ * Advances the per-`(account, channel)` last-read marker.
+ *
+ * Always advances the connection's in-memory {@link ConnectionState.lastReadMarkers}
+ * so the current session tracks the read position. When a {@link ReadMarkerStore}
+ * is bound AND the connection is identified (has an `account`), the marker is
+ * also persisted so it survives reconnects and is shared across the account's
+ * connections.
+ *
+ * `chanLower` is the lowercased channel name (the storage key); callers pass
+ * the authoritative `ChannelState.nameLower`.
+ */
+export function persistReadMarker(ctx: Ctx, chanLower: string, msgid: string): void {
+  if (ctx.connection.lastReadMarkers === undefined) {
+    ctx.connection.lastReadMarkers = new Map<string, string>();
+  }
+  ctx.connection.lastReadMarkers.set(chanLower, msgid);
+
+  const store = ctx.readMarkers;
+  const account = ctx.connection.account;
+  if (store !== undefined && account !== undefined) {
+    store.set(account, chanLower, msgid);
+  }
+}
+
+/**
+ * Seeds a fresh connection's `lastReadMarkers` from the persisted values for
+ * `account`. Called at SASL identify so a reconnect restores the user's last
+ * read position across every channel they have a marker for.
+ *
+ * Existing in-memory markers are preserved: a session may have already
+ * advanced past the stored value, and the in-memory (newer) marker wins.
+ */
+export function seedReadMarkers(
+  conn: ConnectionState,
+  store: ReadMarkerStore,
+  account: string,
+): void {
+  const entries = store.forAccount(account);
+  if (entries.length === 0) return;
+  if (conn.lastReadMarkers === undefined) {
+    conn.lastReadMarkers = new Map<string, string>();
+  }
+  for (const entry of entries) {
+    if (!conn.lastReadMarkers.has(entry.channel)) {
+      conn.lastReadMarkers.set(entry.channel, entry.msgid);
+    }
+  }
+}

package/packages/irc-core/src/commands/registration.ts

@@ -117,6 +117,14 @@ export function emitWelcomeIfReady(state: ConnectionState, ctx: Ctx): EffectType
   // so the `001` hostmask and every downstream message uses the cloak.
   applyCloakIfEnabled(state, ctx);
 
+  // Surface the transport's TLS fact as read-only user mode `S` so clients
+  // learn the connection is secure via `221` / `WHOIS`. The adapter sets
+  // `state.secure` from the platform's transport metadata at construction;
+  // the mode is not settable via `MODE` (the parser rejects `+S`/`-S`).
+  if (state.secure) {
+    state.userModes.tls = true;
+  }
+
   state.registration = 'registered';
   return [Effect.send(ctx.connId, buildWelcomeLines(state, ctx))];
 }