serverless-ircd 0.7.0 → 0.9.0

package/packages/aws-adapter/src/handlers/connect.ts

@@ -13,15 +13,17 @@
  */
 
 import type { DynamoDBDocumentClient } from '@aws-sdk/lib-dynamodb';
-import { PutCommand, ScanCommand } from '@aws-sdk/lib-dynamodb';
+import { PutCommand } from '@aws-sdk/lib-dynamodb';
 import {
   type ParsedServerConfig,
+  WS_SUBPROTO_BINARY,
   type WsSubprotocol,
   parseSecWsProtocolOffers,
   selectSubprotocol,
   wsFrameModeFor,
 } from '@serverless-ircd/irc-core';
 import { type AdmissionOutcome, decideConnectAdmission } from '../admission.js';
+import { decrementConnectionCount, incrementConnectionCount } from '../connection-counter.js';
 import { marshalConnection } from '../serialize.js';
 import type { TablesConfig } from '../tables.js';
 import { createInitialConnectionState } from './state.js';
@@ -58,74 +60,76 @@ export type ConnectOutcome =
  * Enforces the `maxClients` admission cap, then inserts the Connections
  * row for a fresh WebSocket upgrade.
  *
+ * Admission is O(1): instead of a full-table `Scan COUNT` (which made
+ * `$connect` latency scale with the live connection count), the live count
+ * is kept in a single meta row and atomically incremented here. The
+ * reservation is rolled back if admission rejects or the row write fails,
+ * so the counter stays in sync with the real connection set across
+ * `$connect` / `$disconnect` / the gone-connection sweeper.
+ *
  * Idempotent on success: APIGW retries `$connect` on transient failures,
  * so the write uses `PutCommand` (overwrites) rather than a conditional
- * insert.
- *
- * TOCTOU note: DynamoDB cannot conditionally write based on a row count,
- * so the count-then-put sequence has a race window. This is an accepted
- * trade-off for an admission cap — it bounds growth under steady load
- * rather than enforcing a hard invariant. Two concurrent upgrades that
- * both observe `count == cap - 1` will both be admitted.
+ * insert. A retry re-runs the increment; the matching decrement fires when
+ * the connection eventually tears down, so the long-run counter stays
+ * correct (each live connection contributes exactly one reserved slot).
  *
- * Per-IP admission (`maxConnectionsPerIp`) is intentionally NOT enforced
- * here. irc-core's in-memory `AdmissionStats` is unsuitable for Lambda
- * (each invocation is a fresh process with no shared counters), and a
- * filtered full-table `Scan` per `$connect` would double the DynamoDB
- * cost on every connect (and `maxConnectionsPerIp` is on by default).
- * The correct fix is to persist `sourceIp` on the Connections row and
- * add a DynamoDB GSI keyed by `sourceIp`, then feed the GSI's count
- * into {@link decideConnectAdmission}'s `perIp` branch. That schema
- * change is tracked as a follow-up; the pure policy already supports it.
+ * TOCTOU note: two concurrent `$connect` invocations can both reserve a
+ * slot before either decrements; the cap is therefore best-effort (it
+ * bounds growth under steady load rather than enforcing a hard invariant).
+ * This is no worse than the prior count-then-put sequence, and the
+ * per-connection cost dropped from O(connections) to O(1).
  */
 export async function handleConnect(params: ConnectParams): Promise<ConnectOutcome> {
   const now = params.now ?? Date.now();
-  const total = await countConnections(params.dynamo, params.tables.Connections);
-  const outcome = decideConnectAdmission({ total }, { maxClients: params.serverConfig.maxClients });
-  if (!outcome.admitted) return outcome;
+  const maxClients = params.serverConfig.maxClients;
+
+  // Reserve a slot atomically. The returned value includes this reservation,
+  // so the pre-existing count (`total`, as expected by the policy) is one
+  // less than the post-increment value.
+  const reservedCount = await incrementConnectionCount(params.dynamo, params.tables.Connections);
+  const outcome = decideConnectAdmission({ total: reservedCount - 1 }, { maxClients });
+  if (!outcome.admitted) {
+    // Over capacity — release the reservation so the counter does not drift
+    // upward on every rejected connect.
+    await decrementConnectionCount(params.dynamo, params.tables.Connections);
+    return outcome;
+  }
   // IRCv3 WebSocket subprotocol negotiation: parse the offered
   // `Sec-WebSocket-Protocol` list, select the first supported entry, and
   // persist the resulting frame mode so every subsequent `$default`
   // invocation recovers it (a Lambda `$connect` has no live socket to
   // tag, unlike the CF adapter's hibernation tags). `null` means no
   // supported subprotocol was offered → legacy framing, no mode column.
-  const chosen = selectSubprotocol(parseSecWsProtocolOffers(params.secWebSocketProtocol));
+  //
+  // API Gateway carries TEXT WebSocket frames only — binary frames are
+  // unsupported, and agreeing to `binary.ircv3.net` makes APIGW close the
+  // connection with code 1003 ("Binary is not supported") the instant it
+  // is negotiated. The IRCv3 relay (tcp-ws-forwarder) offers binary first
+  // by preference, so the generic core selector would agree to binary and
+  // the connection is torn down immediately. Strip binary from the offer
+  // list before selecting so only `text.ircv3.net` (or legacy fallback
+  // when only binary was offered) is ever negotiated on this transport.
+  const chosen = selectSubprotocol(
+    parseSecWsProtocolOffers(params.secWebSocketProtocol).filter((o) => o !== WS_SUBPROTO_BINARY),
+  );
   const mode = wsFrameModeFor(chosen ?? undefined);
   const state = createInitialConnectionState(params.connectionId, now);
   const row = marshalConnection(state, now);
   if (mode !== 'legacy') {
     row.wsMode = mode;
   }
-  await params.dynamo.send(
-    new PutCommand({
-      TableName: params.tables.Connections,
-      Item: row,
-    }),
-  );
-  return { admitted: true, subprotocol: chosen };
-}
-
-/**
- * Paginated `Scan` with `Select: COUNT` over the `Connections` table.
- * A single Scan page caps at 1MB, so the loop follows
- * `LastEvaluatedKey` until every page has been summed.
- */
-async function countConnections(
-  dynamo: DynamoDBDocumentClient,
-  tableName: string,
-): Promise<number> {
-  let total = 0;
-  let lastKey: unknown = undefined;
-  do {
-    const res = await dynamo.send(
-      new ScanCommand({
-        TableName: tableName,
-        Select: 'COUNT',
-        ...(lastKey !== undefined ? { ExclusiveStartKey: lastKey as never } : {}),
+  try {
+    await params.dynamo.send(
+      new PutCommand({
+        TableName: params.tables.Connections,
+        Item: row,
       }),
     );
-    total += res.Count ?? 0;
-    lastKey = res.LastEvaluatedKey;
-  } while (lastKey !== undefined);
-  return total;
+  } catch (err) {
+    // Row write failed — release the reservation so a failed `Put` does not
+    // leave an inflated counter that tightens the cap on every retry.
+    await decrementConnectionCount(params.dynamo, params.tables.Connections);
+    throw err;
+  }
+  return { admitted: true, subprotocol: chosen };
 }

package/packages/aws-adapter/src/handlers/default.ts

@@ -31,6 +31,7 @@ import {
 } from '@serverless-ircd/irc-core';
 import { type ActorChannelAccess, ConnectionActor } from '@serverless-ircd/irc-server';
 import { AwsRuntime, type AwsRuntimeHandlers, type PostToConnection } from '../aws-runtime.js';
+import type { DynamoServicesStore } from '../dynamo-services-store.js';
 import {
   CONNECTION_VERSION,
   type MarshalledConnection,
@@ -68,6 +69,15 @@ export interface DefaultParams {
    * — preserves the behaviour of callers that have not opted in.
    */
   accounts?: AccountStore;
+  /**
+   * Persistent services store (NickServ / ChanServ / HostServ / MemoServ /
+   * OperServ + read-marker). When omitted the actor runs with
+   * `ctx.services` undefined so `PRIVMSG NickServ` / ChanServ routing is
+   * disabled — preserves the behaviour of callers that have not opted in.
+   * On success the handler flushes pending write-behind ops after the
+   * actor run.
+   */
+  services?: DynamoServicesStore;
   /**
    * mTLS client-cert identity source for SASL EXTERNAL. When omitted the
    * actor runs with `ctx.mtlsIdentity` undefined so `AUTHENTICATE EXTERNAL`
@@ -118,14 +128,25 @@ export interface DefaultParams {
 export async function handleDefault(params: DefaultParams): Promise<{ statusCode: number }> {
   const clock = params.clock ?? SystemClock;
   const ids = params.ids ?? new UuidIdFactory();
-  // Load persisted state.
+  // Load persisted state. Strongly consistent: $connect writes this row and
+  // $default reads it on the very next frame — an eventually-consistent Get
+  // can miss the just-written row (DynamoDB replication lag) and silently
+  // drop the client's first frame as a 410. Strong consistency closes that
+  // read-after-write window.
   const result = await params.dynamo.send(
     new GetCommand({
       TableName: params.tables.Connections,
       Key: { connectionId: params.connectionId },
+      ConsistentRead: true,
     }),
   );
   if (result.Item === undefined) {
+    // Previously this branch returned silently, making a missing-row
+    // $default invisible to operators (client sees nothing, logs show
+    // nothing). Warn so the 410 path is diagnosable.
+    console.warn(
+      `[irc-handler] $default connId=${params.connectionId} wsMode=? row=missing -> 410`,
+    );
     return { statusCode: 410 };
   }
   const persisted = result.Item as unknown as MarshalledConnection;
@@ -192,6 +213,7 @@ export async function handleDefault(params: DefaultParams): Promise<{ statusCode
     }),
     ...(params.messages !== undefined ? { messages: params.messages } : {}),
     ...(params.accounts !== undefined ? { accounts: params.accounts } : {}),
+    ...(params.services !== undefined ? { services: params.services } : {}),
     ...(params.mtlsIdentity !== undefined ? { mtlsIdentity: params.mtlsIdentity } : {}),
     ...(params.history !== undefined ? { history: params.history } : {}),
     // API Gateway terminates TLS before the Lambda is invoked, so every
@@ -205,11 +227,15 @@ export async function handleDefault(params: DefaultParams): Promise<{ statusCode
     console.error('[irc-handler] actor.receiveTextFrame failed', err);
     // Still persist the state — partial mutations are valuable for debug.
     await persistState(params.dynamo, params.tables, params.connectionId, state, clock.now());
+    await params.services?.flush();
     return { statusCode: 500 };
   }
 
   // Persist the mutated state and flush outbound bytes.
   await persistState(params.dynamo, params.tables, params.connectionId, state, clock.now());
+  // Drain any services write-behind ops (NickServ/ChanServ/...) so a
+  // Lambda freeze / evict does not lose state.
+  await params.services?.flush();
 
   // In production, deliver outbound bytes back to the caller via APIGW.
   // Spec-mode connections (text/binary.ircv3.net) receive exactly one IRC
@@ -218,9 +244,12 @@ export async function handleDefault(params: DefaultParams): Promise<{ statusCode
   if (params.managementApi !== null && outbound.length > 0) {
     try {
       await postOutbound(params.managementApi, params.connectionId, outbound, wsMode);
-    } catch {
-      // The handler still returns 200 — the actor's mutations are
-      // persisted; the caller just didn't see the reply this frame.
+    } catch (err) {
+      // Surface the failure (gone connection, stale MANAGEMENT_URL, …)
+      // so it shows in CloudWatch instead of vanishing. The handler still
+      // returns 200 — the actor's mutations are persisted; the caller just
+      // didn't see the reply this frame.
+      console.error('[irc-handler] postToConnection failed', err);
     }
   }
   return { statusCode: 200 };
@@ -382,6 +411,9 @@ class LambdaChannelAccess implements ActorChannelAccess {
         moderated: false,
         secret: false,
         private: false,
+        registered: false,
+        blockUnidentified: false,
+        moderatedIdent: false,
       },
       banMasks: new Set<string>(),
       members: new Map(),

package/packages/aws-adapter/src/handlers/index.ts

@@ -27,6 +27,7 @@ import {
 } from '@serverless-ircd/irc-core';
 import { resolveAccountStore } from '../account-store.js';
 import { type LambdaConfigEnv, loadServerConfigFromLambdaEnv } from '../config-loader.js';
+import { type DynamoServicesStore, loadDynamoServicesStore } from '../dynamo-services-store.js';
 import { createDynamoDocumentClient } from '../dynamo.js';
 import { bindMessageStore } from '../message-store.js';
 import { TABLE_KEYS, type TablesConfig } from '../tables.js';
@@ -111,6 +112,15 @@ export interface HandlerDeps {
    * configured (the default) so `ctx.accounts` stays unset.
    */
   accounts?: AccountStore;
+  /**
+   * Persistent services store (NickServ / ChanServ / HostServ / MemoServ /
+   * OperServ + read-marker), hydrated once per cold start from the
+   * `Services` DynamoDB table into a write-behind cache. `undefined` when
+   * `SERVICES_TABLE` is unset (services unbound → no NickServ/ChanServ
+   * routing). The handler flushes pending writes after each `$default` /
+   * NLB frame so a Lambda freeze / evict does not lose services state.
+   */
+  services?: DynamoServicesStore;
   /**
    * Nick-history source bound to every actor. Constructed once per cold
    * start (memoised via {@link cachedDeps}) as an in-memory store so it
@@ -224,6 +234,7 @@ export async function dispatch(event: WebSocketEvent, deps: HandlerDeps): Promis
           motd: deps.motd,
           messages: deps.messages,
           ...(deps.accounts !== undefined ? { accounts: deps.accounts } : {}),
+          ...(deps.services !== undefined ? { services: deps.services } : {}),
           ...(deps.history !== undefined ? { history: deps.history } : {}),
           ...(deps.configLoader !== undefined ? { configLoader: deps.configLoader } : {}),
           managementApi: deps.managementApi,
@@ -331,6 +342,7 @@ export async function nlbStreamHandler(event: NlbStreamEvent): Promise<NlbStream
     messages: deps.messages,
     managementApi: deps.managementApi,
     ...(deps.accounts !== undefined ? { accounts: deps.accounts } : {}),
+    ...(deps.services !== undefined ? { services: deps.services } : {}),
     ...(deps.history !== undefined ? { history: deps.history } : {}),
   });
 }
@@ -367,6 +379,8 @@ export async function buildDepsFromEnv(env: NodeJS.ProcessEnv = process.env): Pr
   const messages = bindMessageStore(cfg);
   const history = new InMemoryNickHistoryStore(SystemClock);
   const accounts = await resolveAccountStore(dynamo, tables.Accounts, cfg);
+  const servicesTable = typeof env.SERVICES_TABLE === 'string' ? env.SERVICES_TABLE : undefined;
+  const services = await loadDynamoServicesStore(dynamo, servicesTable, SystemClock);
   // REHASH reload source: re-read the live env so a rotated oper password
   // or MOTD takes effect on the next REHASH without a redeploy.
   const configLoader = async (): Promise<ServerConfig> =>
@@ -381,6 +395,7 @@ export async function buildDepsFromEnv(env: NodeJS.ProcessEnv = process.env): Pr
     history,
     configLoader,
     ...(accounts !== undefined ? { accounts } : {}),
+    ...(services !== undefined ? { services } : {}),
   };
 }
 

package/packages/aws-adapter/src/handlers/nlb-stream.ts

@@ -64,6 +64,7 @@ import {
 } from '@serverless-ircd/irc-server';
 import { TcpByteStreamTransport } from '@serverless-ircd/irc-server';
 import { AwsRuntime, type AwsRuntimeHandlers, type PostToConnection } from '../aws-runtime.js';
+import type { DynamoServicesStore } from '../dynamo-services-store.js';
 import type { MarshalledConnection } from '../serialize.js';
 import { CONNECTION_VERSION } from '../serialize.js';
 import type { TablesConfig } from '../tables.js';
@@ -138,6 +139,12 @@ export interface NlbStreamParams {
   messages?: MessageStore;
   /** SASL account verification source. */
   accounts?: AccountStore;
+  /**
+   * Persistent services store (NickServ / ChanServ / HostServ / MemoServ /
+   * OperServ + read-marker). Flushed after each frame so a Lambda freeze
+   * does not lose services state.
+   */
+  services?: DynamoServicesStore;
   /** mTLS identity source for SASL EXTERNAL. */
   mtlsIdentity?: import('@serverless-ircd/irc-core').MtlsIdentityProvider;
   /** Nick-history source for WHOWAS. */
@@ -258,6 +265,7 @@ export async function handleNlbStream(
     transport: new WsTextFrameTransport(),
     ...(params.messages !== undefined ? { messages: params.messages } : {}),
     ...(params.accounts !== undefined ? { accounts: params.accounts } : {}),
+    ...(params.services !== undefined ? { services: params.services } : {}),
     ...(params.mtlsIdentity !== undefined ? { mtlsIdentity: params.mtlsIdentity } : {}),
     ...(params.history !== undefined ? { history: params.history } : {}),
     // Surface TLS fact when the NLB listener terminates TLS (irc+tls port).
@@ -282,6 +290,10 @@ export async function handleNlbStream(
     newBuffer,
   );
 
+  // Drain any services write-behind ops so a Lambda freeze / evict does
+  // not lose NickServ/ChanServ/... state.
+  await params.services?.flush();
+
   // 7. Return outbound bytes as the NLB response body.
   const responseBody = outbound.length > 0 ? `${outbound.join('\r\n')}\r\n` : '';
   return {
@@ -309,14 +321,22 @@ function readHeader(event: NlbStreamEvent, name: string): string | undefined {
   return undefined;
 }
 
-/** Loads a raw Connections row (includes transportBuffer if present). */
+/**
+ * Loads a raw Connections row (includes transportBuffer if present).
+ *
+ * Strongly consistent: the NLB handler has no `$connect` event — it writes
+ * the row itself on the first chunk and reads it back on the very next
+ * invocation. An eventually-consistent Get can miss that just-written row
+ * under DynamoDB replication lag and drop the first frame(s) of a
+ * raw-IRC-over-`:6697` connection.
+ */
 async function loadRow(
   dynamo: DynamoDBDocumentClient,
   tableName: string,
   connId: string,
 ): Promise<RawConnectionRow | null> {
   const result = await dynamo.send(
-    new GetCommand({ TableName: tableName, Key: { connectionId: connId } }),
+    new GetCommand({ TableName: tableName, Key: { connectionId: connId }, ConsistentRead: true }),
   );
   if (result.Item === undefined) return null;
   return result.Item as unknown as RawConnectionRow;
@@ -460,6 +480,9 @@ class NlbChannelAccess implements ActorChannelAccess {
         moderated: false,
         secret: false,
         private: false,
+        registered: false,
+        blockUnidentified: false,
+        moderatedIdent: false,
       },
       banMasks: new Set<string>(),
       members: new Map(),

package/packages/aws-adapter/src/handlers/sweeper.ts

@@ -19,6 +19,7 @@
 import type { DynamoDBDocumentClient } from '@aws-sdk/lib-dynamodb';
 import { ScanCommand } from '@aws-sdk/lib-dynamodb';
 import { cleanupConnection } from '../aws-runtime.js';
+import { CONNECTION_COUNT_META_ID } from '../connection-counter.js';
 import type { TablesConfig } from '../tables.js';
 
 /**
@@ -69,8 +70,11 @@ export async function handleSweep(params: SweepParams): Promise<SweepResult> {
     );
     lastKey = res.LastEvaluatedKey;
     for (const item of res.Items ?? []) {
-      scanned++;
       const row = item as { connectionId?: string; idleSince?: number };
+      // Skip the admission-counter meta row (it carries no idleSince and is
+      // never a real connection to tear down).
+      if (row.connectionId === CONNECTION_COUNT_META_ID) continue;
+      scanned++;
       const idleSince = row.idleSince;
       if (typeof idleSince !== 'number' || idleSince >= cutoff) continue;
       const connId = row.connectionId;

package/packages/aws-adapter/src/index.ts

@@ -23,6 +23,10 @@ export {
   loadDynamoAccountStore,
 } from './dynamo-account-store.js';
 export { bindAccountStore, putAccountCredential, resolveAccountStore } from './account-store.js';
+export {
+  DynamoServicesStore,
+  loadDynamoServicesStore,
+} from './dynamo-services-store.js';
 export { AwsStats } from './stats.js';
 export type { AwsStatsOptions } from './stats.js';
 export {

package/packages/aws-adapter/src/stats.ts

@@ -17,6 +17,7 @@
 import type { DynamoDBDocumentClient } from '@aws-sdk/lib-dynamodb';
 import { ScanCommand } from '@aws-sdk/lib-dynamodb';
 import { type ServerStatsSnapshot, computeStatsSnapshot } from '@serverless-ircd/irc-core';
+import { CONNECTION_COUNT_META_ID } from './connection-counter.js';
 import type { MarshalledConnection } from './serialize.js';
 import { unmarshalConnection } from './serialize.js';
 import type { TablesConfig } from './tables.js';
@@ -63,7 +64,11 @@ export class AwsStats {
       new ScanCommand({ TableName: this.tables.Connections }),
     );
     const connItems = (connResult.Items ?? []) as unknown as MarshalledConnection[];
-    const connections = connItems.map(unmarshalConnection);
+    // The admission counter meta row lives in this table (keyed by the
+    // sentinel id); exclude it so LUSERS/STATS report real connections only.
+    const connections = connItems
+      .filter((item) => item.connectionId !== CONNECTION_COUNT_META_ID)
+      .map(unmarshalConnection);
 
     // Channel count: one row per channel in `ChannelMeta`, again in a
     // single page (channel counts are small).

package/packages/aws-adapter/src/tables.ts

@@ -14,7 +14,13 @@
  */
 
 /** Logical table names — also used as CDK construct ids. */
-export type TableName = 'Connections' | 'ChannelMeta' | 'ChannelMembers' | 'Nicks' | 'Accounts';
+export type TableName =
+  | 'Connections'
+  | 'ChannelMeta'
+  | 'ChannelMembers'
+  | 'Nicks'
+  | 'Accounts'
+  | 'Services';
 
 /** Logical table names in stable order. */
 export const TABLE_NAMES: readonly TableName[] = [
@@ -23,9 +29,19 @@ export const TABLE_NAMES: readonly TableName[] = [
   'ChannelMembers',
   'Nicks',
   'Accounts',
+  'Services',
 ];
 
-/** Key column names used throughout the runtime (avoids stringly-typed typos). */
+/**
+ * Key column names used throughout the runtime (avoids stringly-typed typos).
+ *
+ * `Services` is intentionally absent: the services table is provisioned +
+ * env-injected alongside the others (via {@link TABLE_DEFS} in
+ * `cdk-table-defs.ts`) but the runtime reads `SERVICES_TABLE` directly in
+ * `buildDepsFromEnv` — services persistence is optional, so it must not be
+ * part of the required `tablesConfigFromEnv` loop (a legacy deploy without
+ * the table still boots, just with services unbound).
+ */
 export const TABLE_KEYS = {
   Connections: { pk: 'connectionId' },
   ChannelMeta: { pk: 'channelName' },
@@ -38,8 +54,20 @@ export const TABLE_KEYS = {
  * Maps logical names to physical table names. Production uses the bare
  * names; tests override with a unique prefix per harness to isolate
  * parallel runs against a shared DynamoDB Local instance.
+ *
+ * `Services` is optional: the services-persistence table is provisioned by
+ * {@link TABLE_DEFS} but the runtime reads `SERVICES_TABLE` directly and
+ * tolerates an unset var (services unbound). A `TablesConfig` built from
+ * the required-five env vars still type-checks.
  */
-export type TablesConfig = Record<TableName, string>;
+export type TablesConfig = {
+  Connections: string;
+  ChannelMeta: string;
+  ChannelMembers: string;
+  Nicks: string;
+  Accounts: string;
+  Services?: string;
+};
 
 /** Builds a {@link TablesConfig} from the supplied physical table names. */
 export function tablesConfigFromNames(names: {
@@ -48,6 +76,8 @@ export function tablesConfigFromNames(names: {
   ChannelMembers: string;
   Nicks: string;
   Accounts: string;
+  Services?: string;
 }): TablesConfig {
-  return { ...names };
+  const out: TablesConfig = { ...names };
+  return out;
 }

package/packages/aws-adapter/tests/aws-harness.ts

@@ -277,6 +277,9 @@ class AwsChannelAccess implements ActorChannelAccess {
         moderated: false,
         secret: false,
         private: false,
+        registered: false,
+        blockUnidentified: false,
+        moderatedIdent: false,
       },
       banMasks: new Set<string>(),
       members: new Map(),

package/packages/aws-adapter/tests/aws-runtime.test.ts

@@ -7,6 +7,7 @@
  */
 
 import { CreateTableCommand, DeleteTableCommand } from '@aws-sdk/client-dynamodb';
+import { GetCommand } from '@aws-sdk/lib-dynamodb';
 import {
   type ChannelDelta,
   type Clock,
@@ -15,7 +16,7 @@ import {
   type ServerConfig,
   createConnection,
 } from '@serverless-ircd/irc-core';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { AwsRuntime } from '../src/aws-runtime.js';
 import type { AwsRuntimeHandlers, PostToConnection } from '../src/aws-runtime.js';
 import { TABLE_DEFS } from '../src/cdk-table-defs.js';
@@ -235,6 +236,27 @@ describe.skipIf(!available)('AwsRuntime', () => {
       const got = await rt.getConnection('self');
       expect(got).toBe(state);
     });
+
+    it('getConnectionInfo reads a peer Connections row strongly consistently', async () => {
+      // Peer lookups (WHOIS, roster hydration via readConnectionRow) read
+      // another connection's row. Strong consistency avoids presenting a
+      // stale peer snapshot under DynamoDB replication lag.
+      const rt = makeRuntime('self', noopHandlers());
+      const state = createConnection({ id: 'c1', connectedSince: 0 });
+      state.nick = 'Alice';
+      await rt.persistConnectionState(state);
+      const sendSpy = vi.spyOn(fx.client, 'send');
+      await rt.getConnectionInfo('c1');
+      const conGets = sendSpy.mock.calls
+        .map((call) => call[0] as unknown)
+        .filter(
+          (cmd): cmd is GetCommand =>
+            cmd instanceof GetCommand && (cmd.input.TableName?.endsWith('Connections') ?? false),
+        );
+      expect(conGets.length).toBeGreaterThan(0);
+      expect((conGets[0]?.input as { ConsistentRead?: boolean }).ConsistentRead).toBe(true);
+      sendSpy.mockRestore();
+    });
   });
 
   // -------------------------------------------------------------------------

package/packages/aws-adapter/tests/config-loader.test.ts

@@ -51,6 +51,14 @@ describe('buildLambdaConfigInput', () => {
     expect(out.operCreds).toEqual([{ user: '', password: 'pw' }]);
   });
 
+  it('threads SERVER_PASSWORD through to serverPassword', () => {
+    expect(buildLambdaConfigInput({ SERVER_PASSWORD: 'hunter2' }).serverPassword).toBe('hunter2');
+  });
+
+  it('omits serverPassword when SERVER_PASSWORD is undefined', () => {
+    expect('serverPassword' in buildLambdaConfigInput({})).toBe(false);
+  });
+
   it('omits operCreds when neither OPER_* is set', () => {
     expect('operCreds' in buildLambdaConfigInput({})).toBe(false);
   });