serverless-ircd 0.7.0 → 0.9.0

package/packages/irc-server/tests/dispatch.test.ts

@@ -1,7 +1,7 @@
 import { Effect } from '@serverless-ircd/irc-core';
 import { CapturingLogger, LogLevel } from '@serverless-ircd/irc-core';
 import type { ChannelDelta, ConnId, RawLine } from '@serverless-ircd/irc-core';
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 import { dispatch } from '../src/dispatch';
 import type { IrcRuntime } from '../src/runtime';
 
@@ -251,6 +251,12 @@ describe('dispatch', () => {
 
 interface MemberInfo {
   caps: ReadonlySet<string>;
+  /**
+   * Optional SASL/NickServ account the member is identified as. When set,
+   * the fake runtime's `getConnectionInfo` surfaces it so account-scoped
+   * broadcast filtering (draft/read-marker privacy) can be exercised.
+   */
+  account?: string;
 }
 
 /**
@@ -300,9 +306,11 @@ function capAwareRuntime(members: ReadonlyMap<ConnId, MemberInfo>): {
           wallops: false,
           serverNotices: false,
           tls: false,
+          registered: false,
         },
         lastSeen: 0,
         connectedSince: 0,
+        ...(info.account !== undefined ? { account: info.account } : {}),
       };
     },
     async getConnection() {
@@ -323,6 +331,9 @@ function capAwareRuntime(members: ReadonlyMap<ConnId, MemberInfo>): {
           moderated: false,
           secret: false,
           private: false,
+          registered: false,
+          blockUnidentified: false,
+          moderatedIdent: false,
         },
         banMasks: new Set<string>(),
         members: roster,
@@ -491,6 +502,7 @@ describe('dispatch — Broadcast cap / capLines', () => {
               wallops: false,
               serverNotices: false,
               tls: false,
+              registered: false,
             },
             lastSeen: 0,
             connectedSince: 0,
@@ -516,6 +528,9 @@ describe('dispatch — Broadcast cap / capLines', () => {
             moderated: false,
             secret: false,
             private: false,
+            registered: false,
+            blockUnidentified: false,
+            moderatedIdent: false,
           },
           banMasks: new Set<string>(),
           members: roster,
@@ -690,7 +705,183 @@ describe('dispatch — Broadcast caps (OR semantics)', () => {
 });
 
 // ===========================================================================
-// dispatch — Broadcast client-tag gating (message-tags)
+// dispatch — Broadcast account-scoped recipient filter (draft/read-marker)
+//
+// IRCv3 `draft/read-marker` privacy: a read marker is private to the
+// originator's account and MUST NOT be disclosed to other users. The reducer
+// annotates the mark TAGMSG Broadcast with `account`; dispatch restricts the
+// recipient set to channel members authenticated as that account (case-
+// insensitive), still honouring `except` and the OR-semantics `caps` filter.
+// Unidentified peers (no account) never receive a mark bound to an account.
+// ===========================================================================
+
+describe('dispatch — Broadcast account-scoped filter (draft/read-marker)', () => {
+  it('delivers ONLY to same-account members; cross-account members are excluded', async () => {
+    const members = memberMap([
+      ['c1', { caps: new Set(['message-tags']), account: 'alice' }], // originator (except)
+      ['c2', { caps: new Set(['message-tags']), account: 'alice' }], // same account
+      ['c3', { caps: new Set(['message-tags']), account: 'bob' }], // different account
+    ]);
+    const { runtime, sends, broadcasts } = capAwareRuntime(members);
+
+    await dispatch(
+      [
+        Effect.broadcast(
+          '#foo',
+          [L('@+draft/read-marker=m1 :a!u@h TAGMSG #foo')],
+          'c1',
+          undefined,
+          undefined,
+          ['message-tags', 'draft/read-marker'],
+          'alice',
+        ),
+      ],
+      runtime,
+    );
+
+    // No fast-path bulk broadcast: dispatch routes per-recipient.
+    expect(broadcasts).toHaveLength(0);
+    // Only c2 (same account) receives; c3 (different account) is excluded.
+    expect(sends.map((s) => s.to).sort()).toEqual(['c2']);
+  });
+
+  it('excludes unidentified members (no account) from an account-scoped mark', async () => {
+    const members = memberMap([
+      ['c1', { caps: new Set(['message-tags']), account: 'alice' }], // originator (except)
+      ['c2', { caps: new Set(['message-tags']) }], // unidentified
+    ]);
+    const { runtime, sends } = capAwareRuntime(members);
+
+    await dispatch(
+      [
+        Effect.broadcast(
+          '#foo',
+          [L('@+draft/read-marker=m1 :a!u@h TAGMSG #foo')],
+          'c1',
+          undefined,
+          undefined,
+          ['message-tags', 'draft/read-marker'],
+          'alice',
+        ),
+      ],
+      runtime,
+    );
+
+    expect(sends).toHaveLength(0);
+  });
+
+  it('matches the account case-insensitively (Alice vs alice)', async () => {
+    const members = memberMap([
+      ['c1', { caps: new Set(['message-tags']), account: 'alice' }], // originator (except)
+      ['c2', { caps: new Set(['message-tags']), account: 'ALICE' }], // same account, diff case
+    ]);
+    const { runtime, sends } = capAwareRuntime(members);
+
+    await dispatch(
+      [
+        Effect.broadcast(
+          '#foo',
+          [L('@+draft/read-marker=m1 :a!u@h TAGMSG #foo')],
+          'c1',
+          undefined,
+          undefined,
+          ['message-tags', 'draft/read-marker'],
+          'alice',
+        ),
+      ],
+      runtime,
+    );
+
+    expect(sends.map((s) => s.to)).toEqual(['c2']);
+  });
+
+  it('still applies the OR-caps filter alongside the account filter', async () => {
+    const members = memberMap([
+      ['c1', { caps: new Set(['message-tags']), account: 'alice' }], // originator (except)
+      // same account but no relevant cap — excluded by caps filter:
+      ['c2', { caps: new Set<string>(), account: 'alice' }],
+      // same account, draft/read-marker cap — delivered:
+      ['c3', { caps: new Set(['draft/read-marker']), account: 'alice' }],
+    ]);
+    const { runtime, sends } = capAwareRuntime(members);
+
+    await dispatch(
+      [
+        Effect.broadcast(
+          '#foo',
+          [L('@+draft/read-marker=m1 :a!u@h TAGMSG #foo')],
+          'c1',
+          undefined,
+          undefined,
+          ['message-tags', 'draft/read-marker'],
+          'alice',
+        ),
+      ],
+      runtime,
+    );
+
+    expect(sends.map((s) => s.to)).toEqual(['c3']);
+  });
+
+  it('ignores the account filter when account is unset (channel-wide broadcast)', async () => {
+    const members = memberMap([
+      ['c1', { caps: new Set(['message-tags']), account: 'alice' }],
+      ['c2', { caps: new Set(['message-tags']), account: 'bob' }],
+      ['c3', { caps: new Set(['message-tags']), account: 'carol' }],
+    ]);
+    const { runtime, sends } = capAwareRuntime(members);
+
+    await dispatch(
+      [
+        Effect.broadcast(
+          '#foo',
+          [L('@+draft/typing=active :a!u@h TAGMSG #foo')],
+          'c1',
+          undefined,
+          undefined,
+          ['message-tags', 'draft/typing'],
+        ),
+      ],
+      runtime,
+    );
+
+    // No account filter → every other member receives regardless of account.
+    expect(sends.map((s) => s.to).sort()).toEqual(['c2', 'c3']);
+  });
+
+  it('delivers to every same-account member regardless of caps when only account is set', async () => {
+    // account-only broadcast (no cap / caps): the recipient set is purely
+    // account-scoped, so caps play no role — every same-account member
+    // receives the line, even with an empty cap set.
+    const members = memberMap([
+      ['c1', { caps: new Set<string>(), account: 'alice' }], // originator (except)
+      ['c2', { caps: new Set<string>(), account: 'alice' }], // same account, no caps
+      ['c3', { caps: new Set<string>(), account: 'bob' }], // different account
+    ]);
+    const { runtime, sends, broadcasts } = capAwareRuntime(members);
+
+    await dispatch(
+      [
+        Effect.broadcast(
+          '#foo',
+          [L(':a!u@h TAGMSG #foo')],
+          'c1',
+          undefined,
+          undefined,
+          undefined,
+          'alice',
+        ),
+      ],
+      runtime,
+    );
+
+    // No fast-path bulk broadcast: dispatch routes per-recipient.
+    expect(broadcasts).toHaveLength(0);
+    // c2 (same account, no caps) receives; c3 (different account) is excluded.
+    expect(sends.map((s) => s.to)).toEqual(['c2']);
+  });
+});
+
 //
 // Recipients that did NOT negotiate `message-tags` must never receive a line
 // beginning with `@+<client-tag>`. The dispatch broadcast per-recipient path
@@ -875,3 +1066,80 @@ describe('dispatch — observability', () => {
     expect(errs[0]?.fields?.err).toBe('string-error');
   });
 });
+
+describe('dispatch — EnforceNick', () => {
+  it('disconnects immediately for the kill policy', async () => {
+    const calls: RecordedCall[] = [];
+    await dispatch([Effect.enforceNick('c2', 'alice', 'kill', 0)], fakeRuntime(calls));
+    expect(calls).toEqual([{ method: 'disconnect', args: ['c2', 'Nick enforced by NickServ'] }]);
+  });
+
+  it('is a no-op for the none policy (no runtime calls)', async () => {
+    const calls: RecordedCall[] = [];
+    await dispatch([Effect.enforceNick('c2', 'alice', 'none', 0)], fakeRuntime(calls));
+    expect(calls).toEqual([]);
+  });
+
+  it('schedules the disconnect after graceMs for ghost via the injected scheduler', async () => {
+    const calls: RecordedCall[] = [];
+    const scheduled: { ms: number }[] = [];
+    let scheduledCallback: (() => void) | undefined;
+    const scheduler = (cb: () => void, ms: number): void => {
+      scheduled.push({ ms });
+      scheduledCallback = cb;
+    };
+
+    await dispatch([Effect.enforceNick('c2', 'alice', 'ghost', 30_000)], fakeRuntime(calls), {
+      scheduler,
+    });
+
+    // Disconnect must NOT have fired yet (still within the grace window).
+    expect(calls).toEqual([]);
+    expect(scheduled).toEqual([{ ms: 30_000 }]);
+    expect(scheduledCallback).toBeTypeOf('function');
+
+    // Flush the grace timer → disconnect fires with the canonical reason.
+    scheduledCallback?.();
+    await Promise.resolve();
+
+    expect(calls).toEqual([{ method: 'disconnect', args: ['c2', 'Nick enforced by NickServ'] }]);
+  });
+
+  it('disconnects immediately for ghost when graceMs is 0', async () => {
+    const calls: RecordedCall[] = [];
+    const scheduler = (): void => {
+      // Should never be called when graceMs is 0.
+      throw new Error('scheduler must not be invoked for graceMs=0');
+    };
+
+    await dispatch([Effect.enforceNick('c2', 'alice', 'ghost', 0)], fakeRuntime(calls), {
+      scheduler,
+    });
+
+    expect(calls).toEqual([{ method: 'disconnect', args: ['c2', 'Nick enforced by NickServ'] }]);
+  });
+
+  it('still disconnects for ghost when no scheduler is supplied (setTimeout fallback)', async () => {
+    // graceMs=0 takes the immediate path, so the missing scheduler is fine.
+    const calls: RecordedCall[] = [];
+    await dispatch([Effect.enforceNick('c2', 'alice', 'ghost', 0)], fakeRuntime(calls));
+    expect(calls).toEqual([{ method: 'disconnect', args: ['c2', 'Nick enforced by NickServ'] }]);
+  });
+
+  it('uses the default setTimeout scheduler when no scheduler is injected (ghost with grace)', async () => {
+    vi.useFakeTimers();
+    try {
+      const calls: RecordedCall[] = [];
+      // dispatch resolves once the timer is scheduled; the disconnect is deferred.
+      await dispatch([Effect.enforceNick('c2', 'alice', 'ghost', 30_000)], fakeRuntime(calls));
+      expect(calls).toEqual([]);
+
+      // Flushing the fake timer fires the scheduled disconnect.
+      await vi.advanceTimersByTimeAsync(30_000);
+
+      expect(calls).toEqual([{ method: 'disconnect', args: ['c2', 'Nick enforced by NickServ'] }]);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+});

package/packages/irc-server/tests/routing.test.ts

@@ -114,16 +114,22 @@ describe('buildRoutedReducers', () => {
         'away',
         'cap',
         'channelMode',
+        'chanserv',
+        'hostserv',
         'info',
         'invite',
         'join',
         'kick',
+        'markreadChannel',
         'motd',
         'names',
         'nick',
+        'nickserv',
+        'memoserv',
         'noticeChannel',
         'noticeUser',
         'oper',
+        'operserv',
         'part',
         'pass',
         'ping',

package/packages/irc-test-support/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/irc-test-support",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "private": true,
   "description": "Shared IRC scenario runner + harness seam used by every adapter's integration suite",
   "license": "BSD-3-Clause",

package/packages/irc-test-support/src/in-memory-harness.ts

@@ -21,6 +21,7 @@ import {
   FakeClock,
   type RawLine,
   SequentialIdFactory,
+  type ServerConfig,
   StaticMotdProvider,
   createConnection,
 } from '@serverless-ircd/irc-core';
@@ -44,7 +45,14 @@ const POLL_MS = 10;
 /** Default timeout for waitFor* implementations (ms). */
 const DEFAULT_TIMEOUT_MS = 1000;
 
-/** Shared server config used by the harness. Hard-coded — tests assert on it. */
+/**
+ * Shared server config used by the harness. Hard-coded — tests assert on it.
+ *
+ * `serverPassword` is intentionally NOT set here so the default harness
+ * leaves the registration gate disabled and every existing scenario
+ * registers without `PASS`. Construct the harness with
+ * `{ serverPassword: '...' }` to opt a scenario into the gated path.
+ */
 export const HARNESS_SERVER_CONFIG = {
   serverName: 'irc.example.com',
   networkName: 'ExampleNet',
@@ -57,6 +65,17 @@ export const HARNESS_SERVER_CONFIG = {
   quitMessage: 'Client Quit',
 } as const;
 
+/**
+ * Optional harness configuration. `serverPassword` opts a scenario into
+ * the server-password gate: when set, every spawned client must supply
+ * the matching `PASS <value>` (or SASL-identify) before `001
+ * RPL_WELCOME`. Default unset → gate disabled (existing scenarios
+ * unchanged).
+ */
+export interface InMemoryHarnessOptions {
+  serverPassword?: string;
+}
+
 /**
  * Default MOTD lines exposed to every spawned client. The registration
  * welcome block renders these lines as `375`/`372`×N/`376` numerics, and
@@ -120,6 +139,7 @@ export class InMemoryHarness implements IrcHarness {
   private readonly motd = new StaticMotdProvider(HARNESS_MOTD_LINES);
   private readonly clients = new Map<ConnId, TrackedClient>();
   private readonly transportKind: TransportKind;
+  private readonly serverConfig: ServerConfig;
   private nextId = 0;
   private closed = false;
 
@@ -130,9 +150,15 @@ export class InMemoryHarness implements IrcHarness {
    *   {@link TcpByteStreamTransport} so chunk-boundary scenarios exercise
    *   real byte-stream framing. One transport instance per client (TCP
    *   transports own a per-connection partial-line buffer).
+   * @param opts Optional harness-wide config. `serverPassword` opts a
+   *   scenario into the registration gate (default off).
    */
-  constructor(transportKind: TransportKind = 'ws') {
+  constructor(transportKind: TransportKind = 'ws', opts: InMemoryHarnessOptions = {}) {
     this.transportKind = transportKind;
+    this.serverConfig =
+      opts.serverPassword === undefined
+        ? HARNESS_SERVER_CONFIG
+        : { ...HARNESS_SERVER_CONFIG, serverPassword: opts.serverPassword };
   }
 
   async spawnClient(opts?: SpawnClientOptions): Promise<ClientHarness> {
@@ -162,7 +188,7 @@ export class InMemoryHarness implements IrcHarness {
       state,
       runtime: this.runtime,
       channels: this.runtime,
-      serverConfig: HARNESS_SERVER_CONFIG,
+      serverConfig: this.serverConfig,
       clock: this.clock,
       ids: this.ids,
       motd: this.motd,
@@ -237,12 +263,13 @@ class InMemoryClientHarness implements ClientHarness {
   }
 
   async feed(chunk: string): Promise<void> {
-    /* istanbul ignore next -- defensive: bindActor is called by the
+    /* istanbul ignore start -- defensive: bindActor is called by the
        harness before the client is returned, so the unbound-actor branch
        is unreachable through the public API. */
     if (this.actor === undefined) {
       throw new Error(`client ${this.id} has no bound actor`);
     }
+    /* istanbul ignore stop */
     await this.actor.receive(chunk);
   }
 
@@ -279,16 +306,18 @@ class InMemoryClientHarness implements ClientHarness {
     this.closed = true;
     // Best-effort QUIT so peers see the part broadcast; the runtime's
     // disconnect handler is wired by the harness to unregister.
+    /* istanbul ignore start -- defensive: spawnClient binds the actor
+       before returning the client, so `this.actor` is never undefined
+       here. The guard exists purely as a teardown safety net. */
     if (this.actor !== undefined) {
       try {
         await this.actor.receive('QUIT :client closed\r\n');
-        /* istanbul ignore next -- defensive: receive swallows
-           every error internally; the catch is purely a teardown safety
-           net for catastrophic runtime failures. */
       } catch {
-        // no-op
+        // no-op -- receive swallows every error internally; this catch is
+        // purely a teardown safety net for catastrophic runtime failures.
       }
     }
+    /* istanbul ignore stop */
   }
 }
 

package/packages/irc-test-support/src/index.ts

@@ -20,6 +20,7 @@ export {
   HARNESS_MOTD_LINES,
   HARNESS_SERVER_CONFIG,
   InMemoryHarness,
+  type InMemoryHarnessOptions,
   inMemoryHarnessFactory,
   inMemoryTcpHarnessFactory,
   inMemoryWsHarnessFactory,

package/packages/irc-test-support/src/scenarios.ts

@@ -182,7 +182,10 @@ export function runIrcScenarios(factories: readonly IrcHarnessFactory[]): void {
         await alice.waitForNumeric('366');
         const namesLine = alice.received.find((l) => numericOf(l) === '353');
         expect(namesLine).toBeDefined();
-        expect(namesLine ?? '').toContain('@alice');
+        // namesLine is still `string | undefined` to TS (expect() does not
+        // narrow), so we route it back through expect() rather than a
+        // non-null assertion — toContain fails loudly if it were undefined.
+        expect(namesLine).toContain('@alice');
         await harness.close();
       });
 
@@ -246,7 +249,10 @@ export function runIrcScenarios(factories: readonly IrcHarnessFactory[]): void {
         await alice.send('JOIN #room');
         await bob.send('JOIN #room');
         await untilAliceSeesBobJoin(alice, '#room');
-        alice.received.length = 0;
+        // NOTE: alice.received is intentionally NOT cleared here. Keeping
+        // the registration + JOIN burst makes the no-self-echo assertion
+        // below non-vacuous: it scans real traffic and confirms the
+        // sender never receives her own PRIVMSG among any of it.
         bob.received.length = 0;
         await alice.send('PRIVMSG #room :hello team');
         await bob.waitForLine((l) => l.includes('PRIVMSG #room :hello team'));
@@ -453,7 +459,10 @@ export function runIrcScenarios(factories: readonly IrcHarnessFactory[]): void {
         await alice.send('JOIN #notice');
         await bob.send('JOIN #notice');
         await untilAliceSeesBobJoin(alice, '#notice');
-        alice.received.length = 0;
+        // NOTE: alice.received is intentionally NOT cleared here. Keeping
+        // the registration + JOIN burst makes the NOTICE-no-error filter
+        // below non-vacuous: it scans real numeric traffic (353/366/…)
+        // and confirms none of it is a NOTICE error code.
         bob.received.length = 0;
         await alice.send('NOTICE #notice :quiet note');
         await bob.waitForLine((l) => l.includes('NOTICE #notice :quiet note'));
@@ -469,13 +478,19 @@ export function runIrcScenarios(factories: readonly IrcHarnessFactory[]): void {
         await harness.close();
       });
 
-      it('scenario 27: PASS after registration is rejected with 462', async () => {
+      it('scenario 27: bare PASS after registration is a silent no-op (no 462)', async () => {
         harness = await factory.create();
         const c = await harness.spawnClient({ nick: 'alice' });
         await c.waitForNumeric('001');
         c.received.length = 0;
-        await c.send('PASS hunter2');
-        await c.waitForNumeric('462');
+        // A bare server-password PASS is meaningless once registration has
+        // completed: it must be ignored (no 462, no disconnect). Send a
+        // PING in the same frame so ordering is guaranteed — by the time
+        // the PONG arrives, any 462 from the PASS would already be queued.
+        await c.send('PASS hunter2\r\nPING :post-pass');
+        await c.waitForLine((l) => l === 'PONG :post-pass');
+        const errAlreadyRegistered = c.received.filter((l) => numericOf(l) === '462');
+        expect(errAlreadyRegistered).toEqual([]);
         await harness.close();
       });
 

package/packages/irc-test-support/tests/in-memory-harness.test.ts

@@ -191,6 +191,25 @@ describe('InMemoryClientHarness.waitForNumeric', () => {
     expect(result).toContain('004');
     await h.close();
   });
+
+  it('ignores received lines that carry no :server prefix when scanning', async () => {
+    // A PONG reply is emitted without a `:server` prefix (`PONG :tok`, not
+    // `:srv PONG :tok`). waitForNumeric must scan such a line without
+    // false-matching: numericEquals takes its no-prefix branch (start=0),
+    // rejects the line, and keeps scanning until the real numeric lands.
+    const h = new InMemoryHarness();
+    const c = await h.spawnClient({ nick: 'alice' });
+    await c.waitForNumeric('001');
+    // Isolate a bare (no-prefix) line first, then drive a prefixed numeric
+    // after it, so the scan MUST walk past the PONG to reach 375.
+    c.received.length = 0;
+    await c.send('PING :bare');
+    await c.waitForLine((l) => l === 'PONG :bare');
+    await c.send('MOTD');
+    const result = await c.waitForNumeric('375');
+    expect(result).toContain('375');
+    await h.close();
+  });
 });
 
 describe('InMemoryClientHarness.close', () => {
@@ -228,3 +247,35 @@ describe('InMemoryClientHarness.close', () => {
     await h.close();
   });
 });
+
+describe('InMemoryHarness — server-password gate opt-in', () => {
+  it('rejects registration with 464 + disconnect when serverPassword is set and no PASS is sent', async () => {
+    const h = new InMemoryHarness('ws', { serverPassword: 's3cret' });
+    const c = await h.spawnClient();
+    await c.send('NICK alice');
+    await c.send('USER alice 0 * :alice');
+    // No PASS → gate fires: 464 then the connection is torn down.
+    const line464 = await c.waitForNumeric('464');
+    expect(line464).toMatch(/464 alice :Password mismatch/u);
+    await h.close();
+  });
+
+  it('completes registration when PASS matches the configured serverPassword', async () => {
+    const h = new InMemoryHarness('ws', { serverPassword: 's3cret' });
+    const c = await h.spawnClient();
+    await c.send('PASS s3cret');
+    await c.send('NICK bob');
+    await c.send('USER bob 0 * :bob');
+    await c.waitForNumeric('001');
+    await h.close();
+  });
+
+  it('leaves the gate disabled by default (no serverPassword option)', async () => {
+    const h = new InMemoryHarness();
+    const c = await h.spawnClient();
+    await c.send('NICK carol');
+    await c.send('USER carol 0 * :carol');
+    await c.waitForNumeric('001');
+    await h.close();
+  });
+});

package/packages/irc-test-support/vitest.config.ts

@@ -7,7 +7,12 @@ export default defineConfig({
       provider: 'v8',
       all: false,
       include: ['src/**/*.ts'],
-      exclude: ['src/**/index.ts'],
+      // harness.ts exports types/interfaces only — it compiles to a bare
+      // `export {}` with zero runtime statements, so v8 reports it as a
+      // 0/0 (0%-statements) file that drags the file list down. Excluding
+      // it keeps the report honest: only modules with runtime code are
+      // scored. index.ts is excluded as the pure re-export barrel.
+      exclude: ['src/**/index.ts', 'src/harness.ts'],
       reporter: ['text', 'html', 'json-summary'],
       thresholds: {
         lines: 90,

package/tools/ci-hardening/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/ci-hardening",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "private": true,
   "description": "CI hardening helpers: coverage-gate config validator + mutation-testing driver for irc-core",
   "license": "BSD-3-Clause",

package/tools/load-test/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/load-test",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "private": true,
   "description": "Synthetic WebSocket IRC client farm for load testing ServerlessIRCd (concurrency, latency p50/p95/p99, drop rate)",
   "license": "BSD-3-Clause",