serverless-ircd 0.3.0 → 0.4.0

package/apps/cf-tcp-container/tests/tls-e2e.test.ts

@@ -0,0 +1,275 @@
+import { execFileSync } from 'node:child_process';
+import { EventEmitter } from 'node:events';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { type Socket, createConnection } from 'node:net';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import {
+  type Server,
+  type TLSSocket,
+  connect as tlsConnect,
+  createServer as tlsCreateServer,
+} from 'node:tls';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { type ContainerServer, startContainerServer } from '../src/container-server.js';
+
+/**
+ * Generates a self-signed TLS certificate for the test proxy using the
+ * system `openssl` binary. This mirrors what Cloudflare Spectrum does in
+ * production: terminate TLS at the edge with a certificate, then forward
+ * plaintext TCP to the origin.
+ *
+ * If `openssl` is not available, the calling test is skipped — the TLS
+ * e2e requires it to synthesise a trust anchor.
+ */
+async function generateSelfSignedCert(dir: string): Promise<{ key: string; cert: string }> {
+  const keyPath = join(dir, 'key.pem');
+  const certPath = join(dir, 'cert.pem');
+  try {
+    execFileSync(
+      'openssl',
+      [
+        'req',
+        '-x509',
+        '-newkey',
+        'rsa:2048',
+        '-keyout',
+        keyPath,
+        '-out',
+        certPath,
+        '-days',
+        '1',
+        '-nodes',
+        '-subj',
+        '/CN=localhost',
+      ],
+      { stdio: 'pipe' },
+    );
+  } catch {
+    throw new Error('openssl not available — required to generate test TLS cert');
+  }
+  const key = await readFile(keyPath, 'utf8');
+  const cert = await readFile(certPath, 'utf8');
+  return { key, cert };
+}
+
+/**
+ * IRC test client that speaks TLS (mirrors the Spectrum client path).
+ * Connects via `tls.connect`, sends lines with CRLF, parses inbound bytes.
+ */
+class TlsIrcClient extends EventEmitter {
+  readonly socket: TLSSocket;
+  readonly received: string[] = [];
+
+  constructor(host: string, port: number, opts: { key: string; cert: string }) {
+    super();
+    this.socket = tlsConnect({
+      host,
+      port,
+      rejectUnauthorized: false,
+      ca: opts.cert,
+    });
+    this.socket.setEncoding('utf8');
+    this.socket.on('data', (text: string) => {
+      for (const line of text.split(/\r?\n/u)) {
+        if (line.length > 0) {
+          this.received.push(line);
+          this.emit('line', line);
+        }
+      }
+    });
+  }
+
+  secured(): Promise<void> {
+    return new Promise((resolve, reject) => {
+      if (this.socket.authorized !== undefined) resolve();
+      else {
+        this.socket.once('secure', () => resolve());
+        this.socket.once('error', reject);
+      }
+    });
+  }
+
+  send(line: string): Promise<void> {
+    return new Promise((resolve, reject) => {
+      this.socket.write(`${line}\r\n`, (err) => (err ? reject(err) : resolve()));
+    });
+  }
+
+  waitFor(predicate: (line: string) => boolean, timeoutMs = 3000): Promise<string> {
+    return new Promise((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        reject(new Error(`timeout; received: ${JSON.stringify(this.received)}`));
+      }, timeoutMs);
+      const check = (line: string): void => {
+        if (predicate(line)) {
+          clearTimeout(timeout);
+          this.off('line', check);
+          resolve(line);
+        }
+      };
+      for (const line of this.received) {
+        if (predicate(line)) {
+          clearTimeout(timeout);
+          resolve(line);
+          return;
+        }
+      }
+      this.on('line', check);
+    });
+  }
+
+  close(): Promise<void> {
+    return new Promise((resolve) => {
+      this.socket.once('close', () => resolve());
+      this.socket.end();
+    });
+  }
+}
+
+/**
+ * Starts an in-process TLS-terminating proxy (the "stunnel" replacement).
+ * Each TLS connection from a client gets a plaintext TCP connection piped
+ * to the container origin. This is the local analogue of Cloudflare
+ * Spectrum: TLS at the edge, plaintext to the origin.
+ */
+function startTlsProxy(opts: {
+  key: string;
+  cert: string;
+  originHost: string;
+  originPort: number;
+}): Promise<{ server: Server; port: number; close: () => Promise<void> }> {
+  return new Promise((resolve, reject) => {
+    const originSockets = new Set<Socket>();
+    const server = tlsCreateServer({ key: opts.key, cert: opts.cert }, (tlsSocket) => {
+      const origin = createConnection({ host: opts.originHost, port: opts.originPort });
+      originSockets.add(origin);
+      tlsSocket.pipe(origin);
+      origin.pipe(tlsSocket);
+      const cleanup = (): void => {
+        origin.destroy();
+        tlsSocket.destroy();
+      };
+      tlsSocket.on('close', cleanup);
+      origin.on('close', () => {
+        originSockets.delete(origin);
+        tlsSocket.destroy();
+      });
+      tlsSocket.on('error', cleanup);
+      origin.on('error', cleanup);
+    });
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => {
+      server.removeListener('error', reject);
+      const addr = server.address();
+      // c8 ignore next 1
+      const port = typeof addr === 'object' && addr !== null ? addr.port : 0;
+      resolve({
+        server,
+        port,
+        close: () =>
+          new Promise<void>((res) => {
+            for (const s of originSockets) s.destroy();
+            originSockets.clear();
+            server.close(() => res());
+          }),
+      });
+    });
+  });
+}
+
+describe('container-server — TLS e2e via in-process proxy (Spectrum analogue)', () => {
+  let origin: ContainerServer;
+  let proxy: { server: Server; port: number; close: () => Promise<void> };
+  let dir: string;
+  let cert: { key: string; cert: string };
+
+  beforeAll(async () => {
+    dir = await mkdtemp(join(tmpdir(), 'sirc-tls-'));
+    try {
+      cert = await generateSelfSignedCert(dir);
+    } catch (err) {
+      // Skip the entire suite if openssl isn't available.
+      console.warn(String((err as Error).message));
+      return;
+    }
+    origin = await startContainerServer({
+      port: 0,
+      host: '127.0.0.1',
+      serverName: 'irc.tls.test',
+      networkName: 'TlsTestNet',
+    });
+    proxy = await startTlsProxy({
+      key: cert.key,
+      cert: cert.cert,
+      originHost: '127.0.0.1',
+      originPort: origin.port,
+    });
+  });
+
+  afterAll(async () => {
+    if (proxy !== undefined) await proxy.close();
+    if (origin !== undefined) await origin.close();
+    await rm(dir, { recursive: true, force: true });
+  });
+
+  it('a TLS client completes register → join → privmsg → quit through the proxy', async () => {
+    if (cert === undefined) return; // openssl not available
+
+    const alice = new TlsIrcClient('127.0.0.1', proxy.port, cert);
+    await alice.secured();
+    const bob = new TlsIrcClient('127.0.0.1', proxy.port, cert);
+    await bob.secured();
+
+    await alice.send('NICK alice');
+    await alice.send('USER alice 0 * :Alice');
+    await alice.waitFor((l) => l.startsWith(':irc.tls.test 001 '));
+
+    await bob.send('NICK bob');
+    await bob.send('USER bob 0 * :Bob');
+    await bob.waitFor((l) => l.startsWith(':irc.tls.test 001 '));
+
+    await alice.send('JOIN #tls-e2e');
+    await alice.waitFor((l) => l.includes('JOIN #tls-e2e'));
+    await bob.send('JOIN #tls-e2e');
+    await bob.waitFor((l) => l.includes('JOIN #tls-e2e'));
+
+    await alice.send('PRIVMSG #tls-e2e :over tls');
+    await bob.waitFor((l) => l.includes('PRIVMSG #tls-e2e :over tls'));
+
+    await alice.close();
+    await bob.close();
+  });
+
+  it('routes PING → PONG over TLS', async () => {
+    if (cert === undefined) return;
+
+    const client = new TlsIrcClient('127.0.0.1', proxy.port, cert);
+    await client.secured();
+    await client.send('NICK tlsPing');
+    await client.send('USER tlsPing 0 * :TlsPing');
+    await client.waitFor((l) => l.startsWith(':irc.tls.test 001 '));
+
+    await client.send('PING :tls-tok');
+    await client.waitFor((l) => l === 'PONG :tls-tok');
+    await client.close();
+  });
+
+  it('the origin only sees plaintext (no TLS handshake bytes reach the actor)', async () => {
+    if (cert === undefined) return;
+
+    // If the origin received TLS handshake bytes, the TcpByteStreamTransport
+    // would try to parse them as IRC lines and produce garbage 421 replies.
+    // A clean registration proves only plaintext IRC lines arrived.
+    const client = new TlsIrcClient('127.0.0.1', proxy.port, cert);
+    await client.secured();
+    await client.send('NICK plaintext');
+    await client.send('USER plaintext 0 * :Plaintext');
+    const welcome = await client.waitFor((l) => l.startsWith(':irc.tls.test 001 plaintext'));
+    expect(welcome).toBeDefined();
+    // No 421 (ERR_UNKNOWNCOMMAND) should appear — that would indicate
+    // non-IRC bytes (TLS handshake) leaking through to the parser.
+    expect(client.received.some((l) => l.includes(' 421 '))).toBe(false);
+    await client.close();
+  });
+});

package/apps/cf-tcp-container/tsconfig.build.json

@@ -0,0 +1,17 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": true,
+    "rootDir": "./src",
+    "outDir": "./dist",
+    "tsBuildInfoFile": "./.tsbuildinfo",
+    "types": ["node"]
+  },
+  "include": ["src/**/*.ts"],
+  "exclude": ["dist", "tests", "**/*.test.ts", "src/worker.ts", "src/container-do.ts"],
+  "references": [
+    { "path": "../../packages/irc-core/tsconfig.build.json" },
+    { "path": "../../packages/irc-server/tsconfig.build.json" },
+    { "path": "../../packages/in-memory-runtime/tsconfig.build.json" }
+  ]
+}

package/apps/cf-tcp-container/tsconfig.test.json

@@ -0,0 +1,15 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "types": ["node"],
+    "composite": false
+  },
+  "include": ["src/**/*.ts", "tests/**/*.ts"],
+  "exclude": ["dist", "src/worker.ts", "src/container-do.ts"],
+  "references": [
+    { "path": "../../packages/irc-core/tsconfig.build.json" },
+    { "path": "../../packages/irc-server/tsconfig.build.json" },
+    { "path": "../../packages/in-memory-runtime/tsconfig.build.json" }
+  ]
+}

package/apps/cf-tcp-container/vitest.config.ts

@@ -0,0 +1,26 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    environment: 'node',
+    testTimeout: 10_000,
+    include: ['tests/**/*.test.ts'],
+    coverage: {
+      provider: 'v8',
+      all: false,
+      include: ['src/**/*.ts'],
+      // `main.ts` is CLI glue (argv parsing, signal handlers); exercised
+      // manually by `pnpm start`. `worker.ts` + `container-do.ts` are
+      // wrangler-only deploy artifacts (depend on @cloudflare/containers,
+      // compiled by wrangler at deploy time). The rest targets ≥90%.
+      exclude: ['src/main.ts', 'src/worker.ts', 'src/container-do.ts'],
+      reporter: ['text', 'html', 'json-summary'],
+      thresholds: {
+        lines: 90,
+        functions: 90,
+        branches: 80,
+        statements: 90,
+      },
+    },
+  },
+});

package/apps/cf-tcp-container/wrangler.toml

@@ -0,0 +1,63 @@
+#:vim:set ft=toml:
+##
+## Cloudflare Containers config for the ServerlessIRCd TCP origin.
+##
+## Deploys the IRC TCP container (apps/cf-tcp-container) to the Cloudflare
+## Containers platform. The container listens on port 6667 (plaintext TCP);
+## Cloudflare Spectrum (configured separately in terraform/spectrum.tf)
+## terminates TLS on :6697 and forwards plaintext to this container.
+##
+## Prerequisites:
+##   - Cloudflare account with Containers beta access.
+##   - wrangler v4.112+ (`pnpm add -g wrangler`).
+##   - The container image is built from apps/cf-tcp-container/Dockerfile.
+##
+## Deploy:
+##   wrangler deploy --env staging
+##
+
+name = "sirc-tcp-origin"
+main = "src/worker.ts"
+compatibility_date = "2024-11-01"
+compatibility_flags = ["nodejs_compat"]
+
+[observability]
+enabled = true
+
+# --- Container definition ---
+# The IRC TCP origin container. Listens on port 6667; the Worker below is a
+# thin management/health-check wrapper (Spectrum routes TCP directly to the
+# container origin, not through the Worker).
+[[containers]]
+class_name = "IrcTcpOrigin"
+image = "./Dockerfile"
+instance_type = "standard-1"
+max_instances = 3
+sleep_after = "2h"
+
+# --- Durable Object binding for the container ---
+[[durable_objects.bindings]]
+name = "IRC_TCP_ORIGIN"
+class_name = "IrcTcpOrigin"
+
+# --- Migration ---
+[[migrations]]
+tag = "v1"
+new_sqlite_classes = ["IrcTcpOrigin"]
+
+# --- Environment ---
+[vars]
+SERVER_NAME = "irc.example.com"
+NETWORK_NAME = "ExampleNet"
+MOTD_LINES = "Welcome to the ServerlessIRCd TCP origin."
+TCP_PORT = "6667"
+PERSISTENCE_PATH = "/data/state.json"
+
+# --- Staging ---
+[env.staging]
+name = "sirc-tcp-origin-staging"
+
+[env.staging.vars]
+SERVER_NAME = "irc-staging.example.com"
+NETWORK_NAME = "StagingNet"
+MOTD_LINES = "Welcome to the staging ServerlessIRCd TCP origin."

package/apps/cf-worker/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/cf-worker",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "private": true,
   "description": "Cloudflare Worker deploy glue: WebSocket edge entry point + DO bindings + wrangler pipeline",
   "license": "BSD-3-Clause",

package/apps/cf-worker/wrangler.test.toml

@@ -32,6 +32,12 @@ class_name = "ChannelDO"
 name = "CHANNEL_REGISTRY_DO"
 class_name = "ChannelRegistryDO"
 
+# D1 backing for persistent SASL accounts
+[[d1_databases]]
+binding = "ACCOUNTS_DB"
+database_name = "cf-worker-test-accounts"
+database_id = "test-d1-worker-accounts"
+
 [[migrations]]
 tag = "v1"
 new_classes = ["ConnectionDO", "RegistryDO", "ChannelDO", "ChannelRegistryDO"]

package/apps/cf-worker/wrangler.toml

@@ -50,7 +50,10 @@ invocation_logs = true
 [vars]
 SERVER_NAME = "irc.example.com"
 NETWORK_NAME = "ServerlessIRCd"
-MOTD_LINES = "Welcome to ServerlessIRCd.\nThis is a deployed Cloudflare Worker."
+MOTD_LINES = """
+Welcome to ServerlessIRCd.
+This is a deployed Cloudflare Worker.
+"""
 
 ## ---------------------------------------------------------------------------
 ## Staging environment.
@@ -68,7 +71,30 @@ head_sampling_rate = 1
 [env.staging.vars]
 SERVER_NAME = "irc-staging.example.com"
 NETWORK_NAME = "ServerlessIRCd (staging)"
-MOTD_LINES = "Welcome to ServerlessIRCd staging.\nThis Worker was deployed by CI from the main branch."
+MOTD_LINES = """
+Welcome to ServerlessIRCd staging.
+This is a deployed Cloudflare Worker.
+This Worker was deployed by CI from the main branch.
+"""
+
+## ---------------------------------------------------------------------------
+## D1 database — SASL account persistence.
+## ---------------------------------------------------------------------------
+## The `accounts` table stores scrypt-hashed SASL PLAIN credentials (never
+## plaintext). Loaded at ConnectionDO construction; when empty or unreachable
+## the resolver falls back to the `SASL_ACCOUNTS` env-var seed. Provision with:
+##   wrangler d1 create serverless-ircd-accounts
+##   wrangler d1 execute serverless-ircd-accounts --command \
+##     "CREATE TABLE IF NOT EXISTS accounts (account TEXT PRIMARY KEY, algorithm TEXT NOT NULL, salt TEXT NOT NULL, hash TEXT NOT NULL)"
+## Seed accounts via `tools/seed-cf-accounts.ts`.
+[[d1_databases]]
+binding = "ACCOUNTS_DB"
+database_name = "serverless-ircd-accounts"
+# database_id is filled in by `wrangler d1 create` and is env-specific.
+
+[[env.staging.d1_databases]]
+binding = "ACCOUNTS_DB"
+database_name = "serverless-ircd-accounts-staging"
 
 ## ---------------------------------------------------------------------------
 ## Durable Object bindings.

package/apps/local-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/local-cli",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "private": true,
   "description": "Runnable WebSocket IRC server using the in-memory runtime; manual-test harness and e2e fixture target",
   "license": "BSD-3-Clause",

package/apps/local-cli/src/config-loader.ts

@@ -21,6 +21,16 @@ import { type ParsedServerConfig, parseServerConfig } from '@serverless-ircd/irc
 export interface CliConfigInput {
   serverName: string;
   networkName: string;
+  /**
+   * Server version surfaced in `002`/`004`/`351`/`371`. When omitted the
+   * schema default ({@link DEFAULT_SERVER_VERSION}) applies.
+   */
+  serverVersion?: string;
+  /**
+   * "Created" text for `003 RPL_CREATED`. A string is used verbatim; a
+   * number is treated as epoch-ms and formatted as a UTC timestamp.
+   */
+  createdAt?: string | number;
   motdLines?: string[];
   channelPrefixes?: string;
   maxClients?: number;

package/apps/local-cli/src/server.ts

@@ -35,9 +35,11 @@ import {
   ConsoleLogger,
   InMemoryAccountStore,
   InMemoryMessageStore,
+  InMemoryNickHistoryStore,
   LogLevel,
   type Logger,
   type MessageStore,
+  type NickHistoryStore,
   type RawLine,
   createConnection,
 } from '@serverless-ircd/irc-core';
@@ -162,6 +164,12 @@ export interface LocalServer {
    * one client is replayable by another. Exposed for test assertions.
    */
   readonly messages: MessageStore;
+  /**
+   * The per-process nick-history store backing `WHOWAS`. Shared across
+   * every connection so a nick signed off by one client is queryable by
+   * another. Exposed for test assertions.
+   */
+  readonly history: NickHistoryStore;
   close(): Promise<void>;
   /**
    * Test-only seam: live server-side WebSockets. Exposed so tests can
@@ -311,6 +319,12 @@ export function startLocalServer(opts: StartServerOptions): Promise<LocalServer>
   // is replayable when bob queries CHATHISTORY). The cap is config-driven.
   const messages = new InMemoryMessageStore(opts.historyMaxPerChannel);
 
+  // Per-process nick-history store: one TTL-buffer shared by every
+  // connection so cross-connection WHOWAS works (a nick alice quits is
+  // queryable by bob). Driven by the real-system clock so TTL eviction
+  // matches wall time.
+  const history = new InMemoryNickHistoryStore({ now: () => Date.now() });
+
   // SASL account store: seeded from config so `AUTHENTICATE PLAIN` works
   // end-to-end. `undefined` (no accounts configured) leaves the actor's
   // `ctx.accounts` unset, preserving the no-store behaviour.
@@ -336,7 +350,7 @@ export function startLocalServer(opts: StartServerOptions): Promise<LocalServer>
     const admissionRecordId = decision.recordId;
     runtime.commitAdmission(ip, undefined, admissionRecordId);
 
-    const { state, actor } = attachConnection(runtime, cfg, messages, accounts, {
+    const { state, actor } = attachConnection(runtime, cfg, messages, accounts, history, {
       sendText: (text) => {
         if (ws.readyState === WebSocket.OPEN) ws.send(text);
       },
@@ -413,7 +427,7 @@ export function startLocalServer(opts: StartServerOptions): Promise<LocalServer>
         const admissionRecordId = decision.recordId;
         runtime.commitAdmission(ip, undefined, admissionRecordId);
 
-        const { state, actor } = attachConnection(runtime, cfg, messages, accounts, {
+        const { state, actor } = attachConnection(runtime, cfg, messages, accounts, history, {
           sendText: (text) => {
             if (socket.writable) socket.write(text);
           },
@@ -478,6 +492,7 @@ export function startLocalServer(opts: StartServerOptions): Promise<LocalServer>
         hostname,
         runtime,
         messages,
+        history,
         testSockets: wss.clients,
         testTcpSockets: tcpSockets,
         close: () =>
@@ -506,6 +521,7 @@ function attachConnection(
   cfg: ResolvedServerConfig,
   messages: MessageStore,
   accounts: AccountStore | undefined,
+  history: NickHistoryStore,
   transport: {
     sendText: (text: string) => void;
     closeTransport: () => void;
@@ -549,6 +565,7 @@ function attachConnection(
     motd: { lines: () => cfg.motdLines },
     messages,
     ...(accounts !== undefined ? { accounts } : {}),
+    history,
     logger,
   });
 
@@ -641,4 +658,4 @@ function stringifyErr(err: unknown): unknown {
 }
 
 // Suppress "ChanName imported but unused" — kept for type re-export ergonomics.
-export type { ChanName, ConnectionState };
+export type { ChanName, ConnectionState, NickHistoryStore };

package/package.json

@@ -1,21 +1,23 @@
 {
   "name": "serverless-ircd",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "private": false,
   "description": "Serverless IRC daemon with a platform-agnostic core and Cloudflare Workers + AWS adapters",
   "license": "BSD-3-Clause",
   "engines": {
-    "node": ">=20"
+    "node": ">=24"
   },
   "devDependencies": {
-    "@biomejs/biome": "^1.9.0",
-    "@vitest/coverage-v8": "^4.1.0",
-    "fast-check": "^3.19.0",
-    "rimraf": "^6.0.0",
-    "turbo": "^2.0.0",
-    "typescript": "^5.6.0",
-    "vite": "^7.3.0",
-    "vitest": "^4.1.0"
+    "@biomejs/biome": "^1.9.4",
+    "@vitest/coverage-v8": "^4.1.10",
+    "fast-check": "^3.23.2",
+    "rimraf": "^6.1.3",
+    "tsx": "^4.19.0",
+    "turbo": "^2.10.7",
+    "typescript": "^5.9.3",
+    "vite": "^7.3.6",
+    "vitest": "^4.1.10",
+    "@serverless-ircd/aws-adapter": "0.4.0"
   },
   "scripts": {
     "build": "turbo run build",
@@ -33,6 +35,8 @@
     "deploy:cf:staging": "pnpm --filter @serverless-ircd/cf-worker deploy:staging",
     "deploy:cf:prod": "pnpm --filter @serverless-ircd/cf-worker deploy:prod",
     "smoke:cf:staging": "pnpm --filter @serverless-ircd/cf-worker smoke:staging",
+    "deploy:cf-tcp:staging": "pnpm build && pnpm --filter @serverless-ircd/cf-tcp-container deploy:staging",
+    "deploy:cf-tcp:prod": "pnpm build && pnpm --filter @serverless-ircd/cf-tcp-container deploy:prod",
     "deploy:aws:staging": "pnpm build && pnpm --filter @serverless-ircd/aws-stack deploy:staging",
     "deploy:aws:prod": "pnpm build && pnpm --filter @serverless-ircd/aws-stack deploy:prod",
     "smoke:aws:staging": "pnpm --filter @serverless-ircd/aws-stack smoke:staging"

package/packages/aws-adapter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/aws-adapter",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "private": true,
   "description": "AWS Lambda + DynamoDB adapter: AwsRuntime implementing IrcRuntime + $connect/$disconnect/$default handlers",
   "license": "BSD-3-Clause",
@@ -38,7 +38,7 @@
     "@serverless-ircd/irc-test-support": "workspace:*",
     "@types/node": "^26.1.1",
     "@vitest/coverage-v8": "^4.1.0",
-    "aws-cdk-lib": "^2.160.0",
+    "aws-cdk-lib": "^2.262.0",
     "aws-sdk-client-mock": "^4.1.0",
     "constructs": "^10.4.0",
     "rimraf": "^6.0.0",
@@ -47,6 +47,6 @@
     "vitest": "^4.1.0"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=24"
   }
 }

package/packages/aws-adapter/src/account-store.ts

@@ -28,8 +28,8 @@ import {
   type ParsedServerConfig,
 } from '@serverless-ircd/irc-core';
 import {
-  type HashedAccountCredential,
   DynamoAccountStore,
+  type HashedAccountCredential,
   hashAccountCredential,
   loadDynamoAccountStore,
 } from './dynamo-account-store.js';