serverless-ircd 0.8.0 → 0.10.0

package/packages/cf-adapter/src/connection-do.ts

@@ -29,7 +29,6 @@
 
 import { DurableObject } from 'cloudflare:workers';
 import {
-  type AccountStore,
   type ChanName,
   type ChannelState,
   type Clock,
@@ -46,8 +45,8 @@ import {
   type MotdProvider,
   type MtlsIdentityProvider,
   type NickHistoryStore,
+  type ParsedServerConfig,
   type RawLine,
-  type SaslAccountCredential,
   type ServerConfig,
   SystemClock,
   UuidIdFactory,
@@ -66,7 +65,6 @@ import { ConnectionActor, type Transport } from '@serverless-ircd/irc-server';
 import { makeCfRuntime } from './cf-runtime.js';
 import type { CfConnectionHandlers } from './cf-runtime.js';
 import { loadServerConfigFromCfEnv } from './config-loader.js';
-import { resolveAccountStore } from './d1-account-store.js';
 import { type D1ServicesStore, loadD1ServicesStore } from './d1-services-store.js';
 import type { Env } from './env.js';
 import { STATE_STORAGE_KEY, deserialize, serialize } from './serialize.js';
@@ -100,9 +98,11 @@ export class ConnectionDO extends DurableObject<Env> {
    * Cached reducer-facing server config. Parsed once from `this.env`
    * (bindings are stable for the DO's lifetime) so the schema-validated
    * `loadServerConfigFromCfEnv` runs a single time rather than on every
-   * WebSocket frame.
+   * WebSocket frame. Held as {@link ParsedServerConfig} so the adapter
+   * can read extra fields (e.g. `saslAccounts` for the services seed)
+   * the reducer-facing `ServerConfig` view omits.
    */
-  private cachedServerConfig: ServerConfig | undefined;
+  private cachedParsedConfig: ParsedServerConfig | undefined;
   /**
    * Per-instance channel-state cache. Reused across every WebSocket frame
    * the connection handles (within a single hibernation cycle) so that
@@ -142,25 +142,14 @@ export class ConnectionDO extends DurableObject<Env> {
    * keyed by nick) is a documented follow-up. Lazily constructed.
    */
   private history: NickHistoryStore | undefined;
-  /**
-   * SASL account store, resolved once via {@link loadAccountStore} before the
-   * first frame dispatches. The two-phase load mirrors AWS's
-   * `loadDynamoAccountStore`: D1 `accounts` table (authoritative when it has
-   * rows) is queried at boot; when empty/unreachable the `SASL_ACCOUNTS`
-   * env-var seed provides the fallback `InMemoryAccountStore`. The
-   * `AccountStore.verify` port is synchronous, so pre-loading MUST complete
-   * before the first reducer runs.
-   */
-  private accounts: AccountStore | undefined;
-  /** Guards {@link loadAccountStore} so the D1 query runs at most once. */
-  private accountsResolved = false;
   /**
    * Persistent services store (NickServ / ChanServ / HostServ / MemoServ /
    * OperServ + read-marker), hydrated once via {@link loadServicesStore}
    * before the first frame dispatches. The store mutates the in-memory
    * cache synchronously and enqueues write-behind ops; {@link flushServices}
    * drains them into D1 after each frame / at teardown. `undefined` when
-   * D1 is not configured (services unbound → no NickServ/ChanServ routing).
+   * D1 is not configured (services unbound → no NickServ/ChanServ routing,
+   * no SASL/PASS credential verify).
    */
   private services: D1ServicesStore | undefined;
   /** Guards {@link loadServicesStore} so the D1 scan runs at most once. */
@@ -218,14 +207,7 @@ export class ConnectionDO extends DurableObject<Env> {
     const pair = new WebSocketPair();
     const server = pair[0];
     const client = pair[1];
-    // Capture the verified client-cert subject when CF API Shield mTLS is
-    // active. `request.cf` is a Cloudflare-specific extension; the property
-    // is present only when a client certificate was verified against the
-    // uploaded CA pool.
-    const cf = (request as Request & { cf?: Record<string, unknown> }).cf;
-    if (cf !== undefined && typeof cf.tlsClientAuthCertSubject === 'string') {
-      this.mtlsCertSubject = cf.tlsClientAuthCertSubject;
-    }
+    this.captureMtlsSubject(request);
     // Capture the client source IP for ConnectionState.host. CF-Connecting-IP
     // is set by the Cloudflare edge on every proxied request; X-Real-IP is
     // the conventional fallback for non-CF reverse proxies. Stashed on the
@@ -283,7 +265,6 @@ export class ConnectionDO extends DurableObject<Env> {
     const state = await this.loadState();
     const beforeNick = state.nick;
 
-    await this.loadAccountStore();
     await this.loadServicesStore();
     const actor = this.buildActor(ws, state, mode);
     try {
@@ -388,17 +369,39 @@ export class ConnectionDO extends DurableObject<Env> {
    * socket count without sending anything. Used by ChannelDO.sweep.
    */
   async deliver(lines: RawLine[]): Promise<{ delivered: number }> {
+    return this.deliverToSockets(this.ctx.getWebSockets() as unknown as WebSocket[], lines);
+  }
+
+  /**
+   * Iterates `sockets`, delivering `lines` to each OPEN one and counting
+   * the writes. Extracted from {@link deliver} so the false arm of the
+   * tryDeliver check is testable with a fake non-OPEN socket — the real
+   * `ctx.getWebSockets()` only returns OPEN sockets in the test runtime.
+   */
+  public deliverToSockets(sockets: WebSocket[], lines: RawLine[]): { delivered: number } {
     let delivered = 0;
-    for (const ws of this.ctx.getWebSockets()) {
-      const socket = ws as WebSocket;
-      if (socket.readyState !== WebSocket.OPEN) continue;
-      const mode = this.wsFrameMode(socket);
-      this.sendOutbound(socket, lines, mode);
-      delivered++;
+    for (const ws of sockets) {
+      delivered += this.tryDeliver(ws, lines) ? 1 : 0;
     }
     return { delivered };
   }
 
+  /**
+   * Delivers `lines` to a single attached WebSocket. Returns `false`
+   * (without writing) when the socket is no longer OPEN, `true` after a
+   * successful write. Public so the readyState guard is testable with a
+   * fake socket — the real `ctx.getWebSockets()` only returns OPEN
+   * sockets in the test runtime, but production may briefly surface
+   * CLOSING sockets between the unilateral-close and the close event
+   * reaching the DO.
+   */
+  public tryDeliver(ws: WebSocket, lines: RawLine[]): boolean {
+    if (ws.readyState !== WebSocket.OPEN) return false;
+    const mode = this.wsFrameMode(ws);
+    this.sendOutbound(ws, lines, mode);
+    return true;
+  }
+
   // -------------------------------------------------------------------------
   // Internal helpers
   // -------------------------------------------------------------------------
@@ -441,6 +444,17 @@ export class ConnectionDO extends DurableObject<Env> {
     ws.send(`${lines.map((l) => l.text).join('\r\n')}\r\n`);
   }
 
+  /**
+   * Test-only seam that exposes {@link sendOutbound} so the readyState
+   * early-return is reachable with a fake non-OPEN socket. Production
+   * callers always pass an OPEN socket (the {@link deliver} and
+   * {@link tryDeliver} guards filter first), so the path cannot be
+   * exercised via real RPC.
+   */
+  public __sendOutboundForTest(ws: WebSocket, lines: RawLine[], mode: WsFrameMode): void {
+    this.sendOutbound(ws, lines, mode);
+  }
+
   /** Loads the connection state from storage, caching for the event. */
   private async loadState(): Promise<ConnectionState> {
     if (this.cached !== undefined) return this.cached;
@@ -484,10 +498,7 @@ export class ConnectionDO extends DurableObject<Env> {
         this.sendOutbound(ws, lines, mode);
       },
       disconnect: (reason?: string): void => {
-        if (reason !== undefined) {
-          this.sendOutbound(ws, [{ text: `ERROR :Closing link: (${reason})` }], mode);
-        }
-        ws.close();
+        this.writeDisconnect(ws, mode, reason);
       },
       snapshot: (): ConnectionState | undefined => this.cached,
     };
@@ -503,7 +514,6 @@ export class ConnectionDO extends DurableObject<Env> {
     // Bound `connectionId` so every record the actor emits is filterable
     // per-connection in the Workers dashboard.
     const logger: Logger = new ConsoleLogger({ connectionId: state.id }, undefined, LogLevel.Info);
-    const accounts = this.accountStore();
     const services = this.servicesStore();
     const mtlsIdentity: MtlsIdentityProvider | undefined =
       this.mtlsCertSubject !== undefined
@@ -529,17 +539,48 @@ export class ConnectionDO extends DurableObject<Env> {
       // Cloudflare terminates TLS at the edge before the WebSocket reaches
       // the DO, so every WS connection is secure → user mode `S`.
       secure: true,
-      ...(accounts !== undefined ? { accounts } : {}),
-      ...(services !== undefined ? { services } : {}),
-      ...(mtlsIdentity !== undefined ? { mtlsIdentity } : {}),
+      ...buildOptionalActorFields(services, mtlsIdentity),
       logger,
     });
   }
 
+  /**
+   * Writes the optional `ERROR :Closing link` line and closes the socket.
+   * Extracted from the {@link buildActor} disconnect callback so the
+   * reason-gated branch is testable without driving a full actor flow
+   * that emits a self-Disconnect with a reason (rare — OperServ GHOST,
+   * KILL, flood, bad server-password).
+   */
+  private writeDisconnect(ws: WebSocket, mode: WsFrameMode, reason?: string): void {
+    if (reason !== undefined) {
+      this.sendOutbound(ws, [{ text: `ERROR :Closing link: (${reason})` }], mode);
+    }
+    ws.close();
+  }
+
+  /**
+   * Test-only seam that exposes {@link closeIfStillOpen} so the
+   * readyState-guarded `ws.close()` is reachable with a fake OPEN
+   * socket. The real QUIT flow always closes the WS via the actor's
+   * self-Disconnect handler before tearDown reaches this guard.
+   */
+  public __closeIfStillOpenForTest(ws: WebSocket): void {
+    this.closeIfStillOpen(ws);
+  }
+
+  /**
+   * Test-only seam that exposes {@link writeDisconnect} so the
+   * reason-gated `ERROR :Closing link` write is reachable without
+   * driving a full actor flow that emits a self-Disconnect with a
+   * reason (rare — OperServ GHOST, KILL, flood, bad server-password).
+   */
+  public __writeDisconnectForTest(ws: WebSocket, mode: WsFrameMode, reason?: string): void {
+    this.writeDisconnect(ws, mode, reason);
+  }
+
   /** Tears down a connection: emit QUIT effects, release nick, close WS. */
   private async tearDown(ws: WebSocket): Promise<void> {
     const state = await this.loadState();
-    await this.loadAccountStore();
     await this.loadServicesStore();
     const actor = this.buildActor(ws, state, this.wsFrameMode(ws));
     // Drive QUIT through the actor so the same effect pipeline handles
@@ -547,9 +588,7 @@ export class ConnectionDO extends DurableObject<Env> {
     await actor.receiveTextFrame('QUIT\r\n');
     await this.releaseAndPersist(state);
     await this.flushServices();
-    if (ws.readyState === WebSocket.OPEN || ws.readyState === WebSocket.CONNECTING) {
-      ws.close();
-    }
+    this.closeIfStillOpen(ws);
     try {
       await this.ctx.storage.deleteAlarm();
     } catch {
@@ -557,6 +596,21 @@ export class ConnectionDO extends DurableObject<Env> {
     }
   }
 
+  /**
+   * Closes `ws` when it is still in a state where calling `close()` is
+   * meaningful (OPEN or CONNECTING). The QUIT flow drives a self-Disconnect
+   * that already closes the socket, so by the time {@link tearDown} reaches
+   * this guard the WS is usually CLOSING/CLOSED; the helper is a defensive
+   * backstop for the rare path where the actor does not emit a self-
+   * Disconnect. Extracted as a public seam so both arms are testable with
+   * a fake socket — the real QUIT flow always hits the false arm.
+   */
+  private closeIfStillOpen(ws: WebSocket): void {
+    if (ws.readyState === WebSocket.OPEN || ws.readyState === WebSocket.CONNECTING) {
+      ws.close();
+    }
+  }
+
   /** Releases the nick via the registry and persists the (possibly mutated) state. */
   private async releaseAndPersist(state: ConnectionState): Promise<void> {
     if (state.nick !== undefined) {
@@ -577,19 +631,24 @@ export class ConnectionDO extends DurableObject<Env> {
     // silently dropped fields like operCreds, which left OPER unable to
     // authenticate (491 ERR_NOOPERHOST) even when OPER_USER/OPER_PASSWORD
     // were bound. See config-loader.ts and config.ts.
-    if (this.cachedServerConfig === undefined) {
-      this.cachedServerConfig = loadServerConfigFromCfEnv(this.env);
+    return this.parsedConfig();
+  }
+
+  /**
+   * Returns the full parsed config (the schema-validated superset of
+   * `ServerConfig`). The adapter reads fields the reducer-facing
+   * `ServerConfig` omits — `saslAccounts` (services seed), `motdLines`
+   * (MOTD provider), `maxClients` (admission), …
+   */
+  private parsedConfig(): ParsedServerConfig {
+    if (this.cachedParsedConfig === undefined) {
+      this.cachedParsedConfig = loadServerConfigFromCfEnv(this.env);
     }
-    return this.cachedServerConfig;
+    return this.cachedParsedConfig;
   }
 
   private motdProvider(): MotdProvider {
-    const raw = this.env.MOTD_LINES;
-    if (raw === undefined || raw.length === 0) {
-      return { lines: () => DEFAULT_MOTD };
-    }
-    // MOTD_LINES is a newline-delimited env var.
-    return { lines: () => raw.split('\n') };
+    return chooseMotdProvider(this.env.MOTD_LINES);
   }
 
   /**
@@ -617,41 +676,32 @@ export class ConnectionDO extends DurableObject<Env> {
     return this.history;
   }
 
-  /**
-   * Resolves the SASL account store once (D1 table → `SASL_ACCOUNTS` seed),
-   * caching the result. Safe to call on every frame; the D1 query runs at
-   * most once per ConnectionDO instance. Must complete before the first
-   * reducer dispatches so the synchronous `AccountStore.verify` port has its
-   * data ready.
-   */
-  private async loadAccountStore(): Promise<void> {
-    if (this.accountsResolved) return;
-    this.accountsResolved = true;
-    this.accounts = await resolveAccountStore(this.env.ACCOUNTS_DB, this.env.SASL_ACCOUNTS);
-  }
-
-  /**
-   * Returns the resolved account store, or `undefined` when no accounts are
-   * configured (so the actor's `ctx.accounts` stays unset: `AUTHENTICATE
-   * PLAIN` → `904`). Populated by {@link loadAccountStore}; callers MUST
-   * `await loadAccountStore()` before reading this.
-   */
-  private accountStore(): AccountStore | undefined {
-    return this.accounts;
-  }
-
   /**
    * Resolves the persistent services store once (D1 → write-behind cache),
    * caching the result. Safe to call on every frame; the D1 scan runs at
    * most once per ConnectionDO instance. Must complete before the first
    * reducer dispatches so the synchronous `ServicesStore` port has its
    * snapshot ready. Leaves `services` `undefined` when D1 is absent so the
-   * actor's `ctx.services` stays unset (no NickServ/ChanServ routing).
+   * actor's `ctx.services` stays unset (no NickServ/ChanServ routing,
+   * no SASL/PASS credential verify).
+   *
+   * After the D1 load, the `SASL_ACCOUNTS` env-var seed is ingested:
+   * each `username:password` pair is registered via `registerNick` when
+   * the nick is not already present. Idempotent — re-ingesting on every
+   * cold start is a no-op for nicks the services table already holds
+   * (including NickServ-registered nicks whose password wins). New
+   * env-seed accounts are persisted by the write-behind flush.
    */
   private async loadServicesStore(): Promise<void> {
     if (this.servicesResolved) return;
     this.servicesResolved = true;
     this.services = await loadD1ServicesStore(this.env.ACCOUNTS_DB, this.clock);
+    if (this.services !== undefined) {
+      const cfg = this.parsedConfig();
+      for (const acct of cfg.saslAccounts) {
+        this.services.registerNick(acct.username, acct.password, '');
+      }
+    }
   }
 
   /**
@@ -674,6 +724,18 @@ export class ConnectionDO extends DurableObject<Env> {
     await this.services.flush();
   }
 
+  /**
+   * Test-only seam that exposes {@link flushServices} so the
+   * "services unbound" early-return is reachable. Production always
+   * drives flushServices after `loadServicesStore()` has run (in
+   * `webSocketMessage` and `tearDown*`), so the field is populated;
+   * the undefined arm fires only on a DO that has never processed a
+   * frame.
+   */
+  public async __flushServicesForTest(): Promise<void> {
+    await this.flushServices();
+  }
+
   // -------------------------------------------------------------------------
   // Test hooks (only invoked from `runInDurableObject` in tests)
   // -------------------------------------------------------------------------
@@ -699,13 +761,12 @@ export class ConnectionDO extends DurableObject<Env> {
   private async tearDownNoSocket(state: ConnectionState): Promise<void> {
     // Emit QUIT effects without dispatching transport calls (the socket
     // is already gone). The cross-DO fanout still runs.
-    await this.loadAccountStore();
     await this.loadServicesStore();
     const services = this.servicesStore();
     const noOpHandlers: CfConnectionHandlers = {
-      send: (): void => {},
-      disconnect: (): void => {},
-      snapshot: (): ConnectionState | undefined => this.cached,
+      send: NO_OP_SEND,
+      disconnect: NO_OP_DISCONNECT,
+      snapshot: this.peekCachedSync.bind(this),
     };
     const registryKey = this.ctx.id.toString();
     const runtime = makeCfRuntime(this.env, state.id, registryKey, noOpHandlers);
@@ -723,7 +784,7 @@ export class ConnectionDO extends DurableObject<Env> {
       motd: this.motdProvider(),
       messages: this.messageStore(),
       history: this.historyStore(),
-      ...(services !== undefined ? { services } : {}),
+      ...buildOptionalActorFields(services, undefined),
     });
     await actor.receiveTextFrame('QUIT\r\n');
     await this.releaseAndPersist(state);
@@ -735,6 +796,11 @@ export class ConnectionDO extends DurableObject<Env> {
     }
   }
 
+  /** Synchronous cached-state peek used by the no-socket teardown handlers. */
+  private peekCachedSync(): ConnectionState | undefined {
+    return this.cached;
+  }
+
   /** Drops the in-memory state cache, simulating wake-from-hibernation. */
   public __resetCache(): void {
     this.cached = undefined;
@@ -742,7 +808,7 @@ export class ConnectionDO extends DurableObject<Env> {
 
   /** Returns the live cached state (without forcing a storage read). */
   public async __peekState(): Promise<ConnectionState | undefined> {
-    return this.cached;
+    return this.peekCachedSync();
   }
 
   /** Backdates `lastSeen` to test the alarm-driven disconnect path. */
@@ -761,6 +827,58 @@ export class ConnectionDO extends DurableObject<Env> {
     this.__suppressCloseTeardown = true;
   }
 
+  /**
+   * Test-only: sets the captured mTLS cert subject, simulating an upgrade
+   * request that arrived through CF API Shield mTLS. Used to exercise the
+   * `mtlsIdentity` construction branch in {@link buildActor} without
+   * having to inject `request.cf` (which is read-only in the workerd
+   * test runtime).
+   */
+  /**
+   * Captures the verified mTLS cert subject off an inbound request and
+   * stores it on the instance. Extracted so the assignment branch is
+   * testable via {@link __captureMtlsSubjectForTest} (the workerd test
+   * runtime strips `request.cf` across the DO RPC boundary, so the
+   * inline fetch path cannot be exercised end-to-end).
+   */
+  private captureMtlsSubject(request: Request): void {
+    const cf = extractMtlsSubject(request);
+    if (cf !== undefined) {
+      this.mtlsCertSubject = cf;
+    }
+  }
+
+  public __setMtlsCertSubject(subject: string | undefined): void {
+    this.mtlsCertSubject = subject;
+  }
+
+  /** Test-only: returns the captured mTLS cert subject (or undefined). */
+  public async __peekMtlsCertSubject(): Promise<string | undefined> {
+    return this.mtlsCertSubject;
+  }
+
+  /**
+   * Test-only seam that exposes {@link captureMtlsSubject} so the
+   * if-defined assignment can be exercised with a crafted request.cf.
+   */
+  public __captureMtlsSubjectForTest(request: Request): void {
+    this.captureMtlsSubject(request);
+  }
+
+  /**
+   * Test-only: invokes {@link webSocketError} against the first attached
+   * WebSocket. The platform normally fires this asynchronously on
+   * transport errors; calling it here deterministically exercises the
+   * handler body. The WebSocket must have been accepted via `fetch` so
+   * `ctx.getWebSockets()` returns it.
+   */
+  public async __triggerWsError(error: unknown): Promise<void> {
+    const sockets = this.ctx.getWebSockets();
+    const ws = sockets[0];
+    if (ws === undefined) return;
+    await this.webSocketError(ws as WebSocket, error);
+  }
+
   /** Returns this DO's hex id — the canonical ConnId used in RPC routing. */
   public __peekHexId(): string {
     return this.ctx.id.toString();
@@ -813,6 +931,70 @@ export class ConnectionDO extends DurableObject<Env> {
 /** Default MOTD when no `MOTD_LINES` env is supplied. */
 const DEFAULT_MOTD: string[] = ['Welcome to the ServerlessIRCd Cloudflare adapter.'];
 
+/**
+ * Reads the verified mTLS client-cert subject off an inbound Request, when
+ * CF API Shield mTLS is configured. Extracted as a pure helper so the
+ * `cf.tlsClientAuthCertSubject` branch is unit-testable directly (the
+ * workerd test runtime does not surface `request.cf` the way the CF edge
+ * does, and `Request.cf` is read-only so tests cannot inject it via the
+ * standard constructor). Returns the subject string when present, or
+ * `undefined` when mTLS is not configured.
+ */
+export function extractMtlsSubject(request: Request): string | undefined {
+  const cf = (request as Request & { cf?: Record<string, unknown> }).cf;
+  if (cf !== undefined && typeof cf.tlsClientAuthCertSubject === 'string') {
+    return cf.tlsClientAuthCertSubject;
+  }
+  return undefined;
+}
+
+/**
+ * No-op transport callbacks used by {@link ConnectionDO.tearDownNoSocket}
+ * when the WebSocket has already been dropped. Exported so the function
+ * bodies are exercised by a direct unit test (the actor never invokes
+ * `send`/`disconnect` during the no-socket QUIT path because there is
+ * no peer to deliver to).
+ */
+export const NO_OP_SEND: (lines: RawLine[]) => void = () => {};
+export const NO_OP_DISCONNECT: (reason?: string) => void = () => {};
+
+/**
+ * Builds the optional `services` / `mtlsIdentity` fields for a
+ * {@link ConnectionActor} constructor. Each field is included only when
+ * the source resolved a value; the `: {}` arms of the conditional spreads
+ * are exercised by both the with-everything and with-nothing test paths.
+ *
+ * Extracted as a pure helper so the conditional-spread branches are
+ * testable without driving a full DO event cycle that leaves the
+ * underlying stores unset (the test env binds D1 + services, so production
+ * builds always hit the defined arm for `services`).
+ */
+export function buildOptionalActorFields(
+  services: D1ServicesStore | undefined,
+  mtlsIdentity: MtlsIdentityProvider | undefined,
+): {
+  services?: D1ServicesStore;
+  mtlsIdentity?: MtlsIdentityProvider;
+} {
+  return {
+    ...(services !== undefined ? { services } : {}),
+    ...(mtlsIdentity !== undefined ? { mtlsIdentity } : {}),
+  };
+}
+
+/**
+ * Resolves the {@link MotdProvider} for a raw `MOTD_LINES` env value.
+ * Returns the default single-line MOTD when the env is unset or empty;
+ * otherwise splits the env on newlines. Extracted so both branches are
+ * unit-testable without changing the bound env in the test worker.
+ */
+export function chooseMotdProvider(raw: string | undefined): MotdProvider {
+  if (raw === undefined || raw.length === 0) {
+    return { lines: () => DEFAULT_MOTD };
+  }
+  return { lines: () => raw.split('\n') };
+}
+
 /**
  * `ActorChannelAccess` backed by a per-instance cache that is refreshed
  * from the authoritative ChannelDO before each reducer that needs to
@@ -827,7 +1009,7 @@ const DEFAULT_MOTD: string[] = ['Welcome to the ServerlessIRCd Cloudflare adapte
  * synchronous reducers can mutate `members` (a Map) and `banMasks` /
  * `pendingInvites` (Sets) in place.
  */
-class PassthroughChannelAccess {
+export class PassthroughChannelAccess {
   private readonly cache = new Map<string, ChannelState>();
   constructor(
     private readonly now: number,
@@ -879,11 +1061,23 @@ class PassthroughChannelAccess {
       createdAt: number;
     } | null;
     if (dto === null) return;
-    // Don't replace the cache with an empty snapshot — the channel
-    // effectively doesn't exist yet, and the local reducer should lazily
-    // seed it via getOrCreateChannel. This also avoids clobbering the
-    // local cache with ChannelDO's "name unknown" default state.
-    if (dto.members.length === 0) return;
+    // When the authoritative ChannelDO reports zero members (the
+    // post-deploy state), don't replace the cache with an empty roster —
+    // the local reducer should lazily seed memberships via
+    // getOrCreateChannel. But DO propagate the persisted topic / modes /
+    // ban list onto an existing cache entry so the JOIN reducer sees the
+    // survived topic and emits 332/333. Mirrors the AWS adapter's
+    // LambdaChannelAccess.refreshChannel empty-members branch.
+    if (dto.members.length === 0) {
+      const existing = this.cache.get(key);
+      if (existing !== undefined) {
+        existing.modes = { ...dto.modes };
+        existing.banMasks = new Set(dto.banMasks);
+        existing.pendingInvites = new Set(dto.pendingInvites);
+        if (dto.topic !== undefined) existing.topic = dto.topic;
+      }
+      return;
+    }
     const members = new Map<ConnId, { conn: ConnId; nick: string; op: boolean; voice: boolean }>();
     for (const entry of dto.members) {
       members.set(entry.conn, {
@@ -907,31 +1101,6 @@ class PassthroughChannelAccess {
   }
 }
 
-/**
- * Parses the `SASL_ACCOUNTS` env var into credential entries.
- *
- * Format: newline-delimited `username:password` pairs (mirroring the
- * `MOTD_LINES` convention). Blank lines and malformed entries (missing
- * colon or empty username/password) are skipped so a trailing newline or a
- * partial edit does not break boot. Exported so the parsing boundary is
- * unit-testable in isolation.
- */
-export function parseSaslAccountsEnv(raw: string | undefined): SaslAccountCredential[] {
-  if (raw === undefined || raw.length === 0) return [];
-  const out: SaslAccountCredential[] = [];
-  for (const line of raw.split('\n')) {
-    const trimmed = line.trim();
-    if (trimmed.length === 0) continue;
-    const sep = trimmed.indexOf(':');
-    if (sep <= 0) continue; // missing colon or empty username
-    const username = trimmed.slice(0, sep);
-    const password = trimmed.slice(sep + 1);
-    if (username.length === 0 || password.length === 0) continue;
-    out.push({ username, password });
-  }
-  return out;
-}
-
 /**
  * Hibernation-tag prefixes written by {@link ConnectionDO.fetch}. Each tag
  * encodes the negotiated {@link WsFrameMode} so it survives DO eviction and