serverless-ircd 0.1.0 → 0.2.0

package/apps/local-cli/src/server.ts

@@ -28,15 +28,50 @@ import { randomUUID } from 'node:crypto';
 import { type Server, type Socket, createServer } from 'node:net';
 import { InMemoryRuntime } from '@serverless-ircd/in-memory-runtime';
 import {
+  type AdmissionConfig,
   type ChanName,
   type ConnectionState,
+  ConsoleLogger,
+  InMemoryMessageStore,
+  LogLevel,
+  type Logger,
+  type MessageStore,
   type RawLine,
   createConnection,
 } from '@serverless-ircd/irc-core';
 import { ConnectionActor } from '@serverless-ircd/irc-server';
 import { WebSocket, WebSocketServer } from 'ws';
+import { loadServerConfigFromCliArgs } from './config-loader.js';
 import { LineScanner } from './line-scanner.js';
 
+/**
+ * The fully-resolved config object passed to `attachConnection`. Legacy
+ * fields always have values (sane defaults); the security knobs remain
+ * optional because `undefined` is meaningful (= feature disabled).
+ */
+type ResolvedServerConfig = Omit<
+  Required<LocalServerConfig>,
+  | 'serverPassword'
+  | 'cloaking'
+  | 'maxConnectionsPerIp'
+  | 'maxConnectionsPerUser'
+  | 'perIpConnectionRate'
+  | 'historyMaxPerChannel'
+> &
+  Pick<
+    LocalServerConfig,
+    | 'serverPassword'
+    | 'cloaking'
+    | 'maxConnectionsPerIp'
+    | 'maxConnectionsPerUser'
+    | 'perIpConnectionRate'
+  >;
+
+/** Default per-IP / per-user caps used when callers don't override. */
+const DEFAULT_MAX_CONNECTIONS_PER_IP = 10;
+const DEFAULT_MAX_CONNECTIONS_PER_USER = 5;
+const DEFAULT_PER_IP_CONNECTION_RATE = { max: 5, windowMs: 60_000 };
+
 /** Default server config; `startLocalServer` accepts overrides. */
 export interface LocalServerConfig {
   serverName?: string;
@@ -49,6 +84,43 @@ export interface LocalServerConfig {
   channelLen?: number;
   topicLen?: number;
   quitMessage?: string;
+  /**
+   * Server password gate. Undefined / empty disables enforcement;
+   * otherwise every connection must supply the matching value via
+   * `PASS <password>` (or SASL PLAIN) before registration completes.
+   */
+  readonly serverPassword?: string;
+  /**
+   * Hostmask cloaking policy. Undefined disables cloaking; passing
+   * `{ enabled: true, secret: '...' }` replaces every connection's
+   * visible host with a deterministic cloak derived from the secret
+   * and the connection's source identifier.
+   */
+  readonly cloaking?: { enabled: boolean; secret: string; cloakedSuffix?: string } | undefined;
+  /**
+   * Per-IP simultaneous-connection cap. The local server enforces this
+   * at WebSocket upgrade time. Defaults to disabled (no cap) when
+   * omitted; pass a positive integer to enforce.
+   */
+  readonly maxConnectionsPerIp?: number;
+  /**
+   * Per-user (SASL account, falling back to source IP) simultaneous-
+   * connection cap. Same enforcement path as `maxConnectionsPerIp`.
+   */
+  readonly maxConnectionsPerUser?: number;
+  /**
+   * Per-IP connection-rate limit (sliding window). Caps how fast one
+   * source IP may open new connections.
+   */
+  readonly perIpConnectionRate?: { max: number; windowMs: number };
+  /**
+   * Maximum back-log messages retained per channel for IRCv3
+   * `draft/chathistory` playback. When omitted, the shared
+   * {@link InMemoryMessageStore} default (100) applies. Only consulted
+   * when chathistory playback is enabled (it always is for the local
+   * CLI — the store is bound unconditionally).
+   */
+  historyMaxPerChannel?: number;
 }
 
 export interface StartServerOptions extends LocalServerConfig {
@@ -73,6 +145,12 @@ export interface LocalServer {
    */
   readonly tcpPort?: number | undefined;
   readonly runtime: InMemoryRuntime;
+  /**
+   * The per-process chat-history store backing `draft/chathistory`
+   * playback. Shared across every connection so a message recorded by
+   * one client is replayable by another. Exposed for test assertions.
+   */
+  readonly messages: MessageStore;
   close(): Promise<void>;
   /**
    * Test-only seam: live server-side WebSockets. Exposed so tests can
@@ -92,7 +170,15 @@ interface ConnectionBindings {
   actor: ConnectionActor;
 }
 
-const DEFAULT_CONFIG: Required<LocalServerConfig> = {
+const DEFAULT_CONFIG: Omit<
+  Required<LocalServerConfig>,
+  | 'serverPassword'
+  | 'cloaking'
+  | 'maxConnectionsPerIp'
+  | 'maxConnectionsPerUser'
+  | 'perIpConnectionRate'
+  | 'historyMaxPerChannel'
+> = {
   serverName: 'irc.example.com',
   networkName: 'ExampleNet',
   motdLines: ['Welcome to the local-cli ServerlessIRCd instance.'],
@@ -120,6 +206,7 @@ export const DEFAULT_ID_FACTORY = {
   batchId: () => randomUUID(),
   nonce: () => randomUUID(),
   sessionId: () => randomUUID(),
+  traceId: () => randomUUID(),
 };
 
 /**
@@ -132,20 +219,106 @@ export const DEFAULT_ID_FACTORY = {
  * don't leak a half-started server.
  */
 export function startLocalServer(opts: StartServerOptions): Promise<LocalServer> {
-  const cfg: Required<LocalServerConfig> = { ...DEFAULT_CONFIG, ...stripUndefined(opts) };
+  // Validate the user-supplied config through the shared ServerConfigSchema
+  // (sourced from `irc-core`). Both adapters consume the same schema; here
+  // we discard the parsed result and only retain the side-effect of
+  // throwing on a malformed config at boot. The actor still consumes the
+  // `LocalServerConfig` projection so existing callers (and the e2e
+  // harness) keep their permissive defaults.
+  let parsed: ReturnType<typeof loadServerConfigFromCliArgs>;
+  try {
+    parsed = loadServerConfigFromCliArgs({
+      serverName: opts.serverName ?? DEFAULT_CONFIG.serverName,
+      networkName: opts.networkName ?? DEFAULT_CONFIG.networkName,
+      ...(opts.motdLines !== undefined ? { motdLines: opts.motdLines } : {}),
+      ...(opts.maxChannelsPerUser !== undefined
+        ? { maxChannelsPerUser: opts.maxChannelsPerUser }
+        : {}),
+      ...(opts.maxTargetsPerCommand !== undefined
+        ? { maxTargetsPerCommand: opts.maxTargetsPerCommand }
+        : {}),
+      ...(opts.maxListEntries !== undefined ? { maxListEntries: opts.maxListEntries } : {}),
+      ...(opts.nickLen !== undefined ? { nickLen: opts.nickLen } : {}),
+      ...(opts.channelLen !== undefined ? { channelLen: opts.channelLen } : {}),
+      ...(opts.topicLen !== undefined ? { topicLen: opts.topicLen } : {}),
+      ...(opts.quitMessage !== undefined ? { quitMessage: opts.quitMessage } : {}),
+    });
+  } catch (err) {
+    return Promise.reject(err);
+  }
+  const cfg: ResolvedServerConfig = {
+    serverName: parsed.serverName,
+    networkName: parsed.networkName,
+    motdLines: parsed.motdLines.length > 0 ? parsed.motdLines : DEFAULT_CONFIG.motdLines,
+    maxChannelsPerUser: parsed.maxChannelsPerUser,
+    maxTargetsPerCommand: parsed.maxTargetsPerCommand,
+    maxListEntries: parsed.maxListEntries,
+    nickLen: parsed.nickLen,
+    channelLen: parsed.channelLen,
+    topicLen: parsed.topicLen,
+    quitMessage: parsed.quitMessage,
+    ...(opts.serverPassword !== undefined ? { serverPassword: opts.serverPassword } : {}),
+    ...(opts.cloaking !== undefined ? { cloaking: opts.cloaking } : {}),
+    ...(opts.maxConnectionsPerIp !== undefined
+      ? { maxConnectionsPerIp: opts.maxConnectionsPerIp }
+      : {}),
+    ...(opts.maxConnectionsPerUser !== undefined
+      ? { maxConnectionsPerUser: opts.maxConnectionsPerUser }
+      : {}),
+    ...(opts.perIpConnectionRate !== undefined
+      ? { perIpConnectionRate: opts.perIpConnectionRate }
+      : {}),
+  };
   const hostname = opts.hostname ?? '127.0.0.1';
 
-  const runtime = new InMemoryRuntime({ clock: { now: () => Date.now() } });
+  // Admission gate: enabled as soon as any cap or rate limit is configured.
+  // Defaults mirror irc-core's ServerConfigSchema so local-CLI behaviour
+  // matches the production adapters.
+  const admission: AdmissionConfig | undefined =
+    opts.maxConnectionsPerIp !== undefined ||
+    opts.maxConnectionsPerUser !== undefined ||
+    opts.perIpConnectionRate !== undefined
+      ? {
+          maxConnectionsPerIp: opts.maxConnectionsPerIp ?? DEFAULT_MAX_CONNECTIONS_PER_IP,
+          maxConnectionsPerUser: opts.maxConnectionsPerUser ?? DEFAULT_MAX_CONNECTIONS_PER_USER,
+          perIpConnectionRate: opts.perIpConnectionRate ?? DEFAULT_PER_IP_CONNECTION_RATE,
+        }
+      : undefined;
+
+  const runtime = new InMemoryRuntime({
+    clock: { now: () => Date.now() },
+    ...(admission !== undefined ? { admission } : {}),
+  });
+
+  // Per-process chat-history store: one ring buffer shared by every
+  // connection so cross-connection playback works (a message alice sends
+  // is replayable when bob queries CHATHISTORY). The cap is config-driven.
+  const messages = new InMemoryMessageStore(opts.historyMaxPerChannel);
 
   const wss = new WebSocketServer({ port: opts.port, host: hostname });
   const wsConnections = new Map<WebSocket, ConnectionBindings>();
 
-  wss.on('connection', (ws) => {
-    const { state, actor } = attachConnection(runtime, cfg, {
+  wss.on('connection', (ws, req) => {
+    // Admission gate: refuse the connection BEFORE we attach an actor / emit
+    // any IRC state. Keeps per-IP / per-user counters authoritative and
+    // avoids burning a nick or runtime slot on a denied client.
+    const ip = req.socket.remoteAddress ?? 'unknown';
+    const decision = runtime.admitConnection(ip, undefined);
+    if (!decision.ok) {
+      ws.send(`ERROR :Closing link: (connection limit reached: ${decision.reason})\r\n`);
+      ws.close();
+      return;
+    }
+    const admissionRecordId = decision.recordId;
+    runtime.commitAdmission(ip, undefined, admissionRecordId);
+
+    const { state, actor } = attachConnection(runtime, cfg, messages, {
       sendText: (text) => {
         if (ws.readyState === WebSocket.OPEN) ws.send(text);
       },
       closeTransport: () => ws.close(),
+      admissionRecordId,
+      sourceHost: ip,
     });
     wsConnections.set(ws, { state, actor });
 
@@ -161,7 +334,8 @@ export function startLocalServer(opts: StartServerOptions): Promise<LocalServer>
 
     // 'close' and 'error' both end in the same cleanup: drop the connection
     // map entry and unregister the conn from the runtime so it stops
-    // receiving broadcasts.
+    // receiving broadcasts. unregisterConnection also releases the
+    // admission record (if any) so per-IP / per-user counters stay accurate.
     const cleanup = (): void => {
       wsConnections.delete(ws);
       runtime.unregisterConnection(state.id);
@@ -199,7 +373,23 @@ export function startLocalServer(opts: StartServerOptions): Promise<LocalServer>
       const tcpServer = createServer((socket) => {
         tcpSockets.add(socket);
         const scanner = new LineScanner();
-        const { state, actor } = attachConnection(runtime, cfg, {
+
+        // Admission gate — same policy as the WS path: refuse before the
+        // actor is attached so per-IP / per-user counters stay authoritative.
+        const ip = socket.remoteAddress ?? 'unknown';
+        const decision = runtime.admitConnection(ip, undefined);
+        if (!decision.ok) {
+          if (socket.writable) {
+            socket.write(`ERROR :Closing link: (connection limit reached: ${decision.reason})\r\n`);
+          }
+          socket.destroy();
+          tcpSockets.delete(socket);
+          return;
+        }
+        const admissionRecordId = decision.recordId;
+        runtime.commitAdmission(ip, undefined, admissionRecordId);
+
+        const { state, actor } = attachConnection(runtime, cfg, messages, {
           sendText: (text) => {
             if (socket.writable) socket.write(text);
           },
@@ -209,6 +399,8 @@ export function startLocalServer(opts: StartServerOptions): Promise<LocalServer>
             // callers go through `ws.close()`; TCP callers go through here.
             socket.destroy();
           },
+          admissionRecordId,
+          sourceHost: ip,
         });
         tcpConnections.set(socket, { state, actor });
 
@@ -261,6 +453,7 @@ export function startLocalServer(opts: StartServerOptions): Promise<LocalServer>
         tcpPort,
         hostname,
         runtime,
+        messages,
         testSockets: wss.clients,
         testTcpSockets: tcpSockets,
         close: () =>
@@ -286,11 +479,28 @@ export function startLocalServer(opts: StartServerOptions): Promise<LocalServer>
  */
 function attachConnection(
   runtime: InMemoryRuntime,
-  cfg: Required<LocalServerConfig>,
-  transport: { sendText: (text: string) => void; closeTransport: () => void },
+  cfg: ResolvedServerConfig,
+  messages: MessageStore,
+  transport: {
+    sendText: (text: string) => void;
+    closeTransport: () => void;
+    admissionRecordId?: string;
+    sourceHost?: string;
+  },
 ): ConnectionBindings {
   const id = randomUUID();
   const state = createConnection({ id, connectedSince: Date.now() });
+  // Record the transport-visible source host up front. Used as the cloak
+  // input when cloaking is enabled, and as the visible host otherwise.
+  if (transport.sourceHost !== undefined) {
+    state.host = transport.sourceHost;
+  }
+
+  // Per-connection logger: every record the actor emits
+  // carries this connection's id so the local-cli log stream can be
+  // filtered per client. traceId is generated per inbound frame by the
+  // actor itself.
+  const logger: Logger = new ConsoleLogger({ connectionId: id }, undefined, LogLevel.Info);
 
   const actor = new ConnectionActor({
     state,
@@ -306,27 +516,35 @@ function attachConnection(
       channelLen: cfg.channelLen,
       topicLen: cfg.topicLen,
       quitMessage: cfg.quitMessage,
+      ...(cfg.serverPassword !== undefined ? { serverPassword: cfg.serverPassword } : {}),
+      ...(cfg.cloaking !== undefined ? { cloaking: cfg.cloaking } : {}),
     },
     clock: { now: () => Date.now() },
     ids: DEFAULT_ID_FACTORY,
     motd: { lines: () => cfg.motdLines },
+    messages,
+    logger,
   });
 
-  runtime.registerConnection(state, {
-    send: (lines: RawLine[]) => {
-      const text = `${lines.map((l) => l.text).join('\r\n')}\r\n`;
-      transport.sendText(text);
-    },
-    disconnect: (reason?: string) => {
-      // If a reason was supplied, send the RFC-style ERROR notice before
-      // closing. (QUIT does not supply one; future paths like flood
-      // control will.)
-      if (reason !== undefined) {
-        transport.sendText(`ERROR :Closing link: (${reason})\r\n`);
-      }
-      transport.closeTransport();
+  runtime.registerConnection(
+    state,
+    {
+      send: (lines: RawLine[]) => {
+        const text = `${lines.map((l) => l.text).join('\r\n')}\r\n`;
+        transport.sendText(text);
+      },
+      disconnect: (reason?: string) => {
+        // If a reason was supplied, send the RFC-style ERROR notice before
+        // closing. (QUIT does not supply one; future paths like flood
+        // control will.)
+        if (reason !== undefined) {
+          transport.sendText(`ERROR :Closing link: (${reason})\r\n`);
+        }
+        transport.closeTransport();
+      },
     },
-  });
+    transport.admissionRecordId,
+  );
 
   return { state, actor };
 }
@@ -382,15 +600,6 @@ function closeEverything(args: {
   return Promise.all([wsClosed, tcpClosed]).then(() => undefined);
 }
 
-function stripUndefined<T extends object>(obj: T): Partial<T> {
-  const out: Partial<T> = {};
-  for (const key of Object.keys(obj) as Array<keyof T>) {
-    const v = obj[key];
-    if (v !== undefined) out[key] = v;
-  }
-  return out;
-}
-
 function logError(msg: string, err: unknown): void {
   // Structured JSON per acceptance criteria.
   const payload = { ts: new Date().toISOString(), level: 'error', msg, err: stringifyErr(err) };

package/apps/local-cli/tests/config-loader.test.ts

@@ -0,0 +1,107 @@
+/**
+ * Config loading for the local-cli app.
+ *
+ * Verifies the shared `ServerConfigSchema` (from `irc-core`) is also
+ * consumed by the local-cli harness — both adapters consume the same
+ * schema, only the input plumbing differs.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { loadServerConfigFromCliArgs } from '../src/config-loader';
+
+describe('loadServerConfigFromCliArgs — minimal input', () => {
+  it('returns a parsed config from serverName + networkName alone', () => {
+    const cfg = loadServerConfigFromCliArgs({
+      serverName: 'irc.local.example.com',
+      networkName: 'LocalNet',
+    });
+    expect(cfg.serverName).toBe('irc.local.example.com');
+    expect(cfg.networkName).toBe('LocalNet');
+    expect(cfg.channelPrefixes.length).toBeGreaterThan(0);
+    expect(cfg.maxClients).toBeGreaterThan(0);
+  });
+
+  it('accepts motdLines and threads them through to the parsed config', () => {
+    const cfg = loadServerConfigFromCliArgs({
+      serverName: 's',
+      networkName: 'n',
+      motdLines: ['hello', 'world'],
+    });
+    expect(cfg.motdLines).toEqual(['hello', 'world']);
+  });
+
+  it('passes numeric limit overrides through', () => {
+    const cfg = loadServerConfigFromCliArgs({
+      serverName: 's',
+      networkName: 'n',
+      maxChannelsPerUser: 5,
+      nickLen: 12,
+      channelLen: 32,
+    });
+    expect(cfg.maxChannelsPerUser).toBe(5);
+    expect(cfg.nickLen).toBe(12);
+    expect(cfg.channelLen).toBe(32);
+  });
+
+  it('accepts channelPrefixes, maxClients and operCreds', () => {
+    const cfg = loadServerConfigFromCliArgs({
+      serverName: 's',
+      networkName: 'n',
+      channelPrefixes: '#&',
+      maxClients: 50,
+      operCreds: [{ user: 'op', password: 'p' }],
+    });
+    expect(cfg.channelPrefixes).toBe('#&');
+    expect(cfg.maxClients).toBe(50);
+    expect(cfg.operCreds).toEqual([{ user: 'op', password: 'p' }]);
+  });
+});
+
+describe('loadServerConfigFromCliArgs — failure modes', () => {
+  it('throws when serverName is missing', () => {
+    expect(() => loadServerConfigFromCliArgs({ serverName: '', networkName: 'n' })).toThrowError(
+      /serverName/u,
+    );
+  });
+
+  it('throws when networkName is empty', () => {
+    expect(() => loadServerConfigFromCliArgs({ serverName: 's', networkName: '' })).toThrowError(
+      /networkName/u,
+    );
+  });
+
+  it('throws when maxClients is non-positive', () => {
+    expect(() =>
+      loadServerConfigFromCliArgs({ serverName: 's', networkName: 'n', maxClients: 0 }),
+    ).toThrowError(/maxClients/u);
+  });
+
+  it('throws when operCreds entries lack password', () => {
+    expect(() =>
+      loadServerConfigFromCliArgs({
+        serverName: 's',
+        networkName: 'n',
+        operCreds: [{ user: 'op', password: '' }],
+      }),
+    ).toThrowError(/password/u);
+  });
+
+  it('aggregates multiple errors into a single readable Error', () => {
+    try {
+      loadServerConfigFromCliArgs({
+        serverName: '',
+        networkName: '',
+        maxClients: -1,
+      });
+      expect.fail('expected throw');
+    } catch (err) {
+      expect(err).toBeInstanceOf(Error);
+      const msg = (err as Error).message;
+      expect(msg).toMatch(/invalid server config/iu);
+      const hits = ['serverName', 'networkName', 'maxClients'].filter((f) =>
+        msg.includes(f),
+      ).length;
+      expect(hits).toBeGreaterThanOrEqual(2);
+    }
+  });
+});

package/apps/local-cli/tests/e2e.test.ts

@@ -178,6 +178,19 @@ describe('local-cli error paths', () => {
     await first.close();
   });
 
+  it('validates the supplied config through the shared ServerConfigSchema at boot', async () => {
+    // nickLen=0 is rejected by the schema (must be a positive integer).
+    await expect(
+      startLocalServer({
+        port: 0,
+        hostname: '127.0.0.1',
+        serverName: 'irc.local.example.com',
+        networkName: 'LocalNet',
+        nickLen: 0,
+      }),
+    ).rejects.toThrowError(/invalid server config/iu);
+  });
+
   it('logs and recovers from a per-socket error without crashing the server', async () => {
     const srv = await startLocalServer({ port: 0, hostname: '127.0.0.1' });
     const client = new TestClient(`ws://127.0.0.1:${srv.port}/`);
@@ -344,3 +357,64 @@ describe('local-cli error paths', () => {
     await srv.close();
   });
 });
+
+describe('local-cli chathistory end-to-end', () => {
+  const CHATHISTORY_CAPS = 'draft/chathistory server-time message-tags batch';
+
+  /** Registers a client that has negotiated the chathistory cap set. */
+  async function registerWithCaps(srv: LocalServer, nick: string): Promise<TestClient> {
+    const client = new TestClient(`ws://127.0.0.1:${srv.port}/`);
+    await client.opened();
+    client.send(`CAP REQ :${CHATHISTORY_CAPS}\r\n`);
+    await client.waitFor((l) => / CAP \S+ ACK :/.test(l));
+    client.send(`NICK ${nick}\r\n`);
+    client.send(`USER ${nick} 0 * :${nick}\r\n`);
+    client.send('CAP END\r\n');
+    await client.waitFor((l) => l.startsWith(':irc.example.com 001 '));
+    return client;
+  }
+
+  it('records a PRIVMSG and replays it via CHATHISTORY LATEST in a BATCH', async () => {
+    const srv = await startLocalServer({ port: 0, hostname: '127.0.0.1' });
+    const alice = await registerWithCaps(srv, 'ch-alice');
+
+    alice.send('JOIN #chathist-e2e\r\n');
+    await alice.waitFor((l) => l.includes(' 366 '));
+
+    alice.send('PRIVMSG #chathist-e2e :backlog hello\r\n');
+
+    alice.send('CHATHISTORY LATEST #chathist-e2e * 10\r\n');
+    const batchOpen = await alice.waitFor((l) => /^BATCH \+\S+ chathistory #chathist-e2e/.test(l));
+    expect(batchOpen).toMatch(/^BATCH \+\S+ chathistory #chathist-e2e/);
+
+    const replay = await alice.waitFor((l) => l.includes('PRIVMSG #chathist-e2e :backlog hello'));
+    expect(replay).toContain('PRIVMSG #chathist-e2e :backlog hello');
+
+    await alice.close();
+    await srv.close();
+  });
+
+  it('prepends a chathistory BATCH on rejoin after messages were sent', async () => {
+    const srv = await startLocalServer({ port: 0, hostname: '127.0.0.1' });
+
+    // Seed history as alice: join + send a message that bob has missed.
+    const alice = await registerWithCaps(srv, 'ch-seed');
+    alice.send('JOIN #rejoin-e2e\r\n');
+    await alice.waitFor((l) => l.includes(' 366 ') && l.includes('#rejoin-e2e'));
+    alice.send('PRIVMSG #rejoin-e2e :while you were away\r\n');
+    // Give the frame a moment to record before bob joins.
+    await new Promise((r) => setTimeout(r, 50));
+
+    // A second cap-enabled client joins the same channel and must receive
+    // the auto-playback BATCH before the normal JOIN/353/366 sequence.
+    const bob = await registerWithCaps(srv, 'ch-rejoin');
+    bob.send('JOIN #rejoin-e2e\r\n');
+    const playback = await bob.waitFor((l) => /^BATCH \+\S+ chathistory #rejoin-e2e/.test(l));
+    expect(playback).toMatch(/^BATCH \+\S+ chathistory #rejoin-e2e/);
+    await bob.waitFor((l) => l.includes('PRIVMSG #rejoin-e2e :while you were away'));
+
+    await alice.close();
+    await bob.close();
+    await srv.close();
+  });
+});