serverless-ircd 0.8.0 → 0.10.0

package/packages/aws-adapter/tests/migrate-accounts-to-services.test.ts

@@ -0,0 +1,164 @@
+/**
+ * Unit tests for the pure helpers exported from `tools/migrate-accounts-to-services.ts`.
+ *
+ * The helpers are side-effect-free (the CLI entry point is guarded behind
+ * `void main()` which only runs when the module is executed directly), so
+ * they can be imported and tested without triggering wrangler / DynamoDB
+ * IO.
+ */
+
+import {
+  type LegacyAccountRow,
+  buildMigrationSql,
+  buildServicesPutItem,
+  parseSaslAccountsForMigration,
+} from '@serverless-ircd/irc-core';
+import { describe, expect, it } from 'vitest';
+
+describe('parseSaslAccountsForMigration', () => {
+  it('returns an empty array for undefined', () => {
+    expect(parseSaslAccountsForMigration(undefined)).toEqual([]);
+  });
+
+  it('returns an empty array for an empty string', () => {
+    expect(parseSaslAccountsForMigration('')).toEqual([]);
+  });
+
+  it('parses a single username:password entry', () => {
+    expect(parseSaslAccountsForMigration('alice:s3cret')).toEqual([
+      { username: 'alice', password: 's3cret' },
+    ]);
+  });
+
+  it('parses multiple newline-delimited entries', () => {
+    expect(parseSaslAccountsForMigration('alice:s3cret\nbob:pw')).toEqual([
+      { username: 'alice', password: 's3cret' },
+      { username: 'bob', password: 'pw' },
+    ]);
+  });
+
+  it('skips blank lines and malformed entries', () => {
+    expect(
+      parseSaslAccountsForMigration('alice:s3cret\n\nnocolon\n:emptyuser\nemptypass:\n   \n'),
+    ).toEqual([{ username: 'alice', password: 's3cret' }]);
+  });
+});
+
+describe('buildMigrationSql — D1 migration SQL', () => {
+  const legacyRow = (account: string, salt = 'salt', hash = 'hash'): LegacyAccountRow => ({
+    account,
+    algorithm: 'scrypt',
+    salt,
+    hash,
+  });
+
+  it('(a) creates a nickserv_accounts row with cert_subjects "[]" for a legacy account', () => {
+    const stmts = buildMigrationSql([legacyRow('alice')], undefined);
+    // First statement is CREATE TABLE.
+    expect(stmts[0]).toContain('CREATE TABLE IF NOT EXISTS nickserv_accounts');
+    // Second statement is the INSERT OR IGNORE for alice.
+    expect(stmts[1]).toContain('INSERT OR IGNORE INTO nickserv_accounts');
+    expect(stmts[1]).toContain("'alice'");
+    expect(stmts[1]).toContain("'[]'");
+    expect(stmts[1]).toContain("'scrypt'");
+    expect(stmts[1]).toContain("'salt'");
+    expect(stmts[1]).toContain("'hash'");
+  });
+
+  it('uses INSERT OR IGNORE (never INSERT OR REPLACE) so existing rows are never clobbered', () => {
+    const stmts = buildMigrationSql([legacyRow('alice')], undefined);
+    expect(stmts[1]).toContain('INSERT OR IGNORE');
+    expect(stmts[1]).not.toContain('INSERT OR REPLACE');
+  });
+
+  it('(c) a legacy row never overwrites an existing NickServ registration (INSERT OR IGNORE)', () => {
+    // The SQL is INSERT OR IGNORE — if the nick_key already exists in
+    // nickserv_accounts, the INSERT is a no-op. The generated SQL encodes
+    // this; running it twice produces the same statements.
+    const stmts1 = buildMigrationSql([legacyRow('alice')], undefined);
+    const stmts2 = buildMigrationSql([legacyRow('alice')], undefined);
+    expect(stmts1).toEqual(stmts2);
+  });
+
+  it('carries SASL_ACCOUNTS env-seed entries not already in the legacy table', () => {
+    const stmts = buildMigrationSql([legacyRow('alice')], 'bob:bobspw\nalice:alicespw');
+    // CREATE TABLE + alice (legacy) + bob (env-seed).
+    // alice is in the legacy table so the env-seed alice is NOT duplicated.
+    expect(stmts).toHaveLength(3);
+    expect(stmts[1]).toContain("'alice'");
+    expect(stmts[1]).toContain("'salt'");
+    expect(stmts[2]).toContain("'bob'");
+    // bob's credential is freshly hashed from the plaintext password.
+    expect(stmts[2]).not.toContain("'bobspw'");
+  });
+
+  it('does not re-hash legacy rows (preserves the pre-hashed scrypt credential verbatim)', () => {
+    const stmts = buildMigrationSql([legacyRow('alice', 'mysalt', 'myhash')], undefined);
+    expect(stmts[1]).toContain("'mysalt'");
+    expect(stmts[1]).toContain("'myhash'");
+  });
+
+  it('produces only CREATE TABLE when both legacy rows and env-seed are empty', () => {
+    const stmts = buildMigrationSql([], undefined);
+    expect(stmts).toHaveLength(1);
+    expect(stmts[0]).toContain('CREATE TABLE');
+  });
+
+  it('escapes single quotes in usernames to prevent SQL injection', () => {
+    const stmts = buildMigrationSql([legacyRow("O'Brien")], undefined);
+    expect(stmts[1]).toContain("'O''Brien'");
+    expect(stmts[1]).not.toContain("'O'Brien'");
+  });
+});
+
+describe('buildServicesPutItem — DynamoDB migration', () => {
+  it('targets the NICK:<fold> partition with the nick-type discriminator', () => {
+    const input = buildServicesPutItem(
+      { account: 'alice', algorithm: 'scrypt', salt: 's', hash: 'h' },
+      'StagingServices',
+    );
+    expect(input.TableName).toBe('StagingServices');
+    expect(input.Item.pk).toBe('NICK:alice');
+    expect(input.Item.sk).toBe('#');
+    expect(input.Item.type).toBe('nick');
+  });
+
+  it('preserves the legacy scrypt credential fields on the item', () => {
+    const input = buildServicesPutItem(
+      { account: 'alice', algorithm: 'scrypt', salt: 'mysalt', hash: 'myhash' },
+      'Services',
+    );
+    expect(input.Item.algorithm).toBe('scrypt');
+    expect(input.Item.salt).toBe('mysalt');
+    expect(input.Item.hash).toBe('myhash');
+  });
+
+  it('defaults certSubjects to an empty array', () => {
+    const input = buildServicesPutItem(
+      { account: 'alice', algorithm: 'scrypt', salt: 's', hash: 'h' },
+      'Services',
+    );
+    expect(input.Item.certSubjects).toEqual([]);
+  });
+
+  it('folds the nick case-insensitively into the partition key', () => {
+    const input = buildServicesPutItem(
+      { account: 'Alice', algorithm: 'scrypt', salt: 's', hash: 'h' },
+      'Services',
+    );
+    // rfc1459 folding: Alice → alice
+    expect(input.Item.pk).toBe('NICK:alice');
+    expect(input.Item.nick).toBe('Alice');
+    expect(input.Item.account).toBe('Alice');
+  });
+
+  it('stamps the default email / enforce / createdAt fields', () => {
+    const input = buildServicesPutItem(
+      { account: 'alice', algorithm: 'scrypt', salt: 's', hash: 'h' },
+      'Services',
+    );
+    expect(input.Item.email).toBe('');
+    expect(input.Item.enforce).toBe('none');
+    expect(input.Item.createdAt).toBe(0);
+  });
+});

package/packages/aws-adapter/tests/nlb-stream.test.ts

@@ -9,9 +9,10 @@
  */
 
 import { CreateTableCommand, DeleteTableCommand } from '@aws-sdk/client-dynamodb';
+import { GetCommand } from '@aws-sdk/lib-dynamodb';
 import { type ParsedServerConfig, StaticMotdProvider } from '@serverless-ircd/irc-core';
 import { makeTestServerConfig } from '@serverless-ircd/irc-test-support';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { AwsRuntime } from '../src/aws-runtime.js';
 import type { PostToConnection } from '../src/aws-runtime.js';
 import { TABLE_DEFS } from '../src/cdk-table-defs.js';
@@ -164,6 +165,33 @@ describe.skipIf(!available)('NLB stream handler — byte framing', () => {
     expect(info?.registration).toBe('pre-registration');
   });
 
+  it('reads the Connections row strongly consistently on every chunk', async () => {
+    // The NLB handler has no $connect event — it writes its own row on the
+    // first chunk and reads it back on every subsequent chunk. An eventually-
+    // consistent Get can miss the just-written row under replication lag and
+    // drop the first frame(s) of a raw-IRC-over-:6697 connection. The Get
+    // MUST be strongly consistent.
+    const f = requireFx();
+    const sendSpy = vi.spyOn(f.client, 'send');
+    await handleNlbStream(nlbEvent('10.0.0.50', '50050', 'PING :tok\r\n'), {
+      dynamo: f.client,
+      tables: f.tables,
+      serverConfig: SERVER_CONFIG,
+      motd: MOTD,
+      messages: bindMessageStore(SERVER_CONFIG),
+      managementApi: f.mgmt,
+    });
+    const conGets = sendSpy.mock.calls
+      .map((call) => call[0] as unknown)
+      .filter(
+        (cmd): cmd is GetCommand =>
+          cmd instanceof GetCommand && (cmd.input.TableName?.endsWith('Connections') ?? false),
+      );
+    expect(conGets.length).toBeGreaterThan(0);
+    expect((conGets[0]?.input as { ConsistentRead?: boolean }).ConsistentRead).toBe(true);
+    sendSpy.mockRestore();
+  });
+
   it('returns a PONG in the response body for a single PING', async () => {
     const f = requireFx();
     // First chunk establishes the connection.

package/packages/aws-adapter/tests/origin-allowlist.test.ts

@@ -0,0 +1,110 @@
+/**
+ * Unit tests for the `$connect` Origin-allowlist policy
+ * (`packages/aws-adapter/src/origin-allowlist.ts`).
+ *
+ * Mirrors the canonical CF Worker policy
+ * (`apps/cf-worker/src/origin-allowlist.ts`) for the parsing semantics
+ * (comma-separated, trimmed, lowercased) and the "missing Origin =
+ * non-browser → allow" branch. Deliberately diverges from CF by
+ * supporting ONLY the explicit-allowlist mode (the AWS SPA is served
+ * from a different CloudFront origin than the API Gateway WebSocket
+ * endpoint, so same-origin auto-derive does not apply); see the
+ * module docstring for the rationale.
+ */
+import { describe, expect, it } from 'vitest';
+import { decideConnectOrigin, parseWebOrigins } from '../src/origin-allowlist.js';
+
+describe('parseWebOrigins', () => {
+  it('returns an empty set for undefined input', () => {
+    expect(parseWebOrigins(undefined).size).toBe(0);
+  });
+
+  it('returns an empty set for an empty string', () => {
+    expect(parseWebOrigins('').size).toBe(0);
+  });
+
+  it('parses a single origin', () => {
+    expect(parseWebOrigins('https://app.example.com')).toEqual(
+      new Set(['https://app.example.com']),
+    );
+  });
+
+  it('parses multiple comma-separated origins', () => {
+    expect(parseWebOrigins('https://a.example.com,https://b.example.com')).toEqual(
+      new Set(['https://a.example.com', 'https://b.example.com']),
+    );
+  });
+
+  it('trims whitespace around each entry', () => {
+    expect(parseWebOrigins('  https://a.example.com , https://b.example.com  ')).toEqual(
+      new Set(['https://a.example.com', 'https://b.example.com']),
+    );
+  });
+
+  it('lowercases each entry so the match is case-insensitive on scheme/host', () => {
+    // Origins are scheme://host[:port]; scheme and host are case-insensitive
+    // per RFC 3986. Lowercasing the whole string is the simplest
+    // normalisation that matches the real browser-emitted form.
+    expect(parseWebOrigins('https://APP.Example.COM')).toEqual(
+      new Set(['https://app.example.com']),
+    );
+  });
+
+  it('drops empty entries (trailing comma tolerance)', () => {
+    expect(parseWebOrigins('https://a.example.com,,')).toEqual(new Set(['https://a.example.com']));
+  });
+
+  it('drops whitespace-only entries', () => {
+    expect(parseWebOrigins('https://a.example.com,   ,https://b.example.com')).toEqual(
+      new Set(['https://a.example.com', 'https://b.example.com']),
+    );
+  });
+});
+
+describe('decideConnectOrigin', () => {
+  it('allows a missing Origin header (non-browser client)', () => {
+    // curl, WeeChat, and the tcp-ws-forwarder never send `Origin`;
+    // their upgrades must pass through unchanged so existing
+    // non-browser tooling keeps working.
+    expect(decideConnectOrigin(undefined, new Set(['https://app.example.com']))).toBe('allow');
+    expect(decideConnectOrigin(null, new Set(['https://app.example.com']))).toBe('allow');
+    expect(decideConnectOrigin('', new Set(['https://app.example.com']))).toBe('allow');
+  });
+
+  it('allows every Origin when the allowlist is empty (opt-in defense)', () => {
+    // Unset `WEB_ORIGINS` skips the check entirely — existing AWS
+    // deployments without a web frontend are unchanged on upgrade.
+    expect(decideConnectOrigin('https://attacker.example.com', new Set())).toBe('allow');
+    expect(decideConnectOrigin('https://app.example.com', new Set())).toBe('allow');
+  });
+
+  it('allows an Origin that is in the allowlist (case-insensitively)', () => {
+    const allowlist = parseWebOrigins('https://app.example.com');
+    expect(decideConnectOrigin('https://app.example.com', allowlist)).toBe('allow');
+    // The header value is normalised (lowercased, trimmed) before the
+    // membership test, so a mixed-case header matches a lowercased entry.
+    expect(decideConnectOrigin('https://APP.Example.COM', allowlist)).toBe('allow');
+    expect(decideConnectOrigin('  https://app.example.com  ', allowlist)).toBe('allow');
+  });
+
+  it('denies an Origin that is not in the allowlist', () => {
+    const allowlist = parseWebOrigins('https://app.example.com');
+    expect(decideConnectOrigin('https://attacker.example.com', allowlist)).toBe('deny');
+  });
+
+  it('denies an Origin that matches a listed origin except for the scheme', () => {
+    // Origins are case-sensitive on scheme+host+port; `http://` is a
+    // different origin from `https://` and MUST NOT be admitted when
+    // only the `https://` form is allowlisted (defends against a
+    // stripped-TLS attacker on the same hostname).
+    const allowlist = parseWebOrigins('https://app.example.com');
+    expect(decideConnectOrigin('http://app.example.com', allowlist)).toBe('deny');
+  });
+
+  it('matches one of several allowlisted origins', () => {
+    const allowlist = parseWebOrigins('https://app.example.com, https://staging.app.example.com');
+    expect(decideConnectOrigin('https://staging.app.example.com', allowlist)).toBe('allow');
+    expect(decideConnectOrigin('https://app.example.com', allowlist)).toBe('allow');
+    expect(decideConnectOrigin('https://other.example.com', allowlist)).toBe('deny');
+  });
+});

package/packages/aws-adapter/tests/ping-checker.test.ts

@@ -490,7 +490,6 @@ function fakeParams(client: FakeScanDynamo): PingCheckParams {
       ChannelMeta: 'CM',
       ChannelMembers: 'CMem',
       Nicks: 'N',
-      Accounts: 'A',
     },
     managementApi: null,
     now: 100_000,

package/packages/aws-adapter/tests/stats.test.ts

@@ -238,7 +238,6 @@ describe('AwsStats — defensive Scan fallbacks (mocked client)', () => {
       ChannelMeta: 'ChannelMeta',
       ChannelMembers: 'ChannelMembers',
       Nicks: 'Nicks',
-      Accounts: 'Accounts',
     };
     // Pass `undefined` so the stub returns `{}` — no Items key — to
     // exercise the `?? []` fallback on the Connections scan, and
@@ -258,7 +257,6 @@ describe('AwsStats — defensive Scan fallbacks (mocked client)', () => {
       ChannelMeta: 'ChannelMeta',
       ChannelMembers: 'ChannelMembers',
       Nicks: 'Nicks',
-      Accounts: 'Accounts',
     };
     const dynamo = stubDynamo([], 0);
     const stats = new AwsStats({
@@ -279,7 +277,6 @@ describe('AwsStats — defensive Scan fallbacks (mocked client)', () => {
       ChannelMeta: 'ChannelMeta',
       ChannelMembers: 'ChannelMembers',
       Nicks: 'Nicks',
-      Accounts: 'Accounts',
     };
     // Two registered connection rows.
     const items = [

package/packages/aws-adapter/tests/sweeper.test.ts

@@ -18,6 +18,7 @@ import { type ChanName, type Nick, createConnection } from '@serverless-ircd/irc
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
 import { cleanupConnection } from '../src/aws-runtime.js';
 import { TABLE_DEFS } from '../src/cdk-table-defs.js';
+import { CONNECTION_COUNT_META_ID } from '../src/connection-counter.js';
 import { createDynamoDocumentClient } from '../src/dynamo.js';
 import { type SweepParams, type SweepResult, handleSweep } from '../src/handlers/sweeper.js';
 import { marshalChannelMember, marshalConnection, marshalNick } from '../src/serialize.js';
@@ -392,7 +393,6 @@ function fakeSweepParams(client: FakeScanDynamo): SweepParams {
       ChannelMeta: 'CM',
       ChannelMembers: 'CMem',
       Nicks: 'N',
-      Accounts: 'A',
     },
     now: 10_000,
     staleAfterMs: 1_000,
@@ -424,4 +424,23 @@ describe('gone-connection sweeper — scan edge cases', () => {
     expect(result.scanned).toBe(1);
     expect(result.swept).toBe(0);
   });
+
+  it('skips the admission-counter meta row (never swept, never counted)', async () => {
+    // The atomic admission counter lives in the Connections table under a
+    // sentinel id. The sweeper must not treat it as a stale connection —
+    // it carries no idleSince and must never be torn down by the sweeper.
+    const client = new FakeScanDynamo([
+      {
+        items: [
+          { connectionId: CONNECTION_COUNT_META_ID, count: 7 },
+          { connectionId: 'real', idleSince: 0 },
+        ],
+      },
+    ]);
+    const result = await handleSweep(fakeSweepParams(client));
+    // The meta row is excluded from both `scanned` and `swept`; only the
+    // genuine stale connection is counted.
+    expect(result.scanned).toBe(1);
+    expect(result.swept).toBe(1);
+  });
 });

package/packages/aws-adapter/tests/tables.test.ts

@@ -13,13 +13,12 @@ import {
 } from '../src/tables.js';
 
 describe('TABLE_NAMES', () => {
-  it('contains exactly the six canonical logical names', () => {
+  it('contains exactly the five canonical logical names', () => {
     expect(TABLE_NAMES).toEqual([
       'Connections',
       'ChannelMeta',
       'ChannelMembers',
       'Nicks',
-      'Accounts',
       'Services',
     ]);
   });
@@ -46,10 +45,6 @@ describe('TABLE_KEYS', () => {
   it('exposes the nickLower PK for Nicks', () => {
     expect(TABLE_KEYS.Nicks.pk).toBe('nickLower');
   });
-
-  it('exposes the account PK for Accounts', () => {
-    expect(TABLE_KEYS.Accounts.pk).toBe('account');
-  });
 });
 
 describe('tablesConfigFromNames', () => {
@@ -59,7 +54,6 @@ describe('tablesConfigFromNames', () => {
       ChannelMeta: 'p-ChannelMeta',
       ChannelMembers: 'p-ChannelMembers',
       Nicks: 'p-Nicks',
-      Accounts: 'p-Accounts',
     };
     expect(tablesConfigFromNames(names)).toEqual(names);
   });
@@ -70,7 +64,6 @@ describe('tablesConfigFromNames', () => {
       ChannelMeta: 'cm',
       ChannelMembers: 'cml',
       Nicks: 'n',
-      Accounts: 'a',
     };
     const out = tablesConfigFromNames(names);
     expect(out).not.toBe(names);

package/packages/aws-adapter/tests/transactions.test.ts

@@ -364,7 +364,6 @@ function fakeRuntime(client: FakeDynamo): AwsRuntime {
       ChannelMeta: 'CM',
       ChannelMembers: 'CMem',
       Nicks: 'N',
-      Accounts: 'A',
     },
     connId: 'probe',
     handlers,

package/packages/cf-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/cf-adapter",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "private": true,
   "description": "Cloudflare Workers adapter: Durable Objects (ConnectionDO, RegistryDO, ChannelDO) and CfRuntime implementing IrcRuntime",
   "license": "BSD-3-Clause",
@@ -11,10 +11,6 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
-    },
-    "./accounts": {
-      "types": "./dist/d1-account-store.d.ts",
-      "import": "./dist/d1-account-store.js"
     }
   },
   "scripts": {

package/packages/cf-adapter/src/cf-runtime.ts

@@ -181,10 +181,11 @@ export class CfRuntime implements IrcRuntime {
         if (connId === except || connId === this.connId) return;
         const stub = this.env.CONNECTION_DO.get(this.env.CONNECTION_DO.idFromString(connId));
         const dto = await (stub as unknown as ConnectionRpc).getConnState();
-        if (dto === null) return;
-        const state = deserialize(dto);
-        if (!state.userModes.wallops) return;
-        await (stub as unknown as ConnectionRpc).deliver(lines);
+        await this.deliverWallopsToCandidate(
+          stub as unknown as { deliver(lines: RawLine[]): Promise<unknown> },
+          dto,
+          lines,
+        );
       }),
     );
   }
@@ -284,7 +285,7 @@ export class CfRuntime implements IrcRuntime {
     }
     const stub = this.env.CONNECTION_DO.get(this.env.CONNECTION_DO.idFromString(conn));
     const dto = await (stub as unknown as ConnectionRpc).getConnState();
-    return dto === null ? null : deserialize(dto);
+    return this.deserializeConnState(dto);
   }
 
   async getChannelConnections(chan: ChanName): Promise<ReadonlyMap<ConnId, ConnectionState>> {
@@ -294,9 +295,7 @@ export class CfRuntime implements IrcRuntime {
       memberIds.map(async (id) => {
         const connStub = this.env.CONNECTION_DO.get(this.env.CONNECTION_DO.idFromString(id));
         const dto = await (connStub as unknown as ConnectionRpc).getConnState();
-        if (dto !== null) {
-          out.set(id, deserialize(dto));
-        }
+        this.collectChannelMember(out, id, dto);
       }),
     );
     return out;
@@ -320,6 +319,58 @@ export class CfRuntime implements IrcRuntime {
     return loadServerConfigFromCfEnv(this.env as unknown as CfConfigEnv);
   }
 
+  /**
+   * Phase 2 of {@link broadcastWallops}: rehydrates the candidate's
+   * persisted state, gates on user mode `+w`, and dispatches `lines`
+   * via the target stub's `deliver` RPC. Extracted as a public test
+   * seam because every real ConnectionDO's `getConnState` always
+   * returns a non-null DTO (the storage layer is the source of truth
+   * and always has an entry post-`loadState`), so the `dto === null`
+   * and `!+w` defensive arms are unreachable through end-to-end RPC.
+   *
+   * Behavioural contract:
+   *   - `dto === null`           → no-op (candidate reported no state).
+   *   - `dto` with `+w` off      → no-op (recipient gate fails).
+   *   - `dto` with `+w` on       → `stub.deliver(lines)` awaited.
+   */
+  public async deliverWallopsToCandidate(
+    stub: { deliver(lines: RawLine[]): Promise<unknown> },
+    dto: PersistedConnectionState | null,
+    lines: RawLine[],
+  ): Promise<void> {
+    if (dto === null) return;
+    const state = deserialize(dto);
+    if (!state.userModes.wallops) return;
+    await stub.deliver(lines);
+  }
+
+  /**
+   * Rehydrates a cross-connection DTO into a live {@link ConnectionState},
+   * returning `null` when the candidate reported no persisted state.
+   * Extracted as a public test seam because real ConnectionDOs always
+   * return a non-null DTO from `getConnState`, so the `dto === null`
+   * arm is unreachable through end-to-end RPC.
+   */
+  public deserializeConnState(dto: PersistedConnectionState | null): ConnectionState | null {
+    return dto === null ? null : deserialize(dto);
+  }
+
+  /**
+   * Per-member collector for {@link getChannelConnections}: rehydrates the
+   * DTO and adds it to `out` keyed by `id`. Extracted so the null-DTO arm
+   * (a member whose ConnectionDO reports no live state) is testable
+   * directly without constructing a DO whose `getConnState` always
+   * returns non-null.
+   */
+  public collectChannelMember(
+    out: Map<ConnId, ConnectionState>,
+    id: ConnId,
+    dto: PersistedConnectionState | null,
+  ): void {
+    if (dto === null) return;
+    out.set(id, deserialize(dto));
+  }
+
   // -------------------------------------------------------------------------
   // Internal
   // -------------------------------------------------------------------------

package/packages/cf-adapter/src/channel-do.ts

@@ -63,7 +63,7 @@ interface PersistedChannelState {
   modes: ChannelState['modes'];
   banMasks: string[];
   topic?: ChannelTopic;
-  members: Array<Omit<RosterEntry, 'conn'> & { conn: ConnId }>;
+  members: Array<Omit<RosterEntry, 'conn'> & { conn: ConnId; op?: boolean; voice?: boolean }>;
   pendingInvites: string[];
   createdAt: number;
 }
@@ -370,7 +370,13 @@ function serializeChannel(chan: ChannelState): PersistedChannelState {
   return out;
 }
 
-function deserializeChannel(record: PersistedChannelState): ChannelState {
+/**
+ * Rebuilds a live {@link ChannelState} from a JSON-friendly persisted
+ * record. Exported so the legacy-shape defensive arms (`op`/`voice`
+ * coalescing, missing-topic branch) are unit-testable without driving
+ * a full DO storage round-trip.
+ */
+export function deserializeChannel(record: PersistedChannelState): ChannelState {
   const chan: ChannelState = {
     name: record.name,
     nameLower: record.nameLower,
@@ -393,8 +399,12 @@ function deserializeChannel(record: PersistedChannelState): ChannelState {
  * Builds a JSON-friendly {@link ChannelSnapshotDto} from a live
  * {@link ChannelState}. Uses {@link toSnapshot} for the immutable
  * view, then flattens the `Map`/`Set` fields to arrays.
+ *
+ * Exported so the defensive `?:` arms (which fire when a state was
+ * built outside {@link createChannel} and lacks the `Set`/`Map`
+ * fields) are unit-testable directly.
  */
-function toDto(chan: ChannelState): ChannelSnapshotDto {
+export function toDto(chan: ChannelState): ChannelSnapshotDto {
   // Defensively rebuild arrays; in some test-pool code paths the cached
   // state's Set/Map fields may be missing if the channel was created
   // via an unusual path (e.g. direct storage put without going through