serverless-ircd 0.9.0 → 0.10.0

package/scripts/deploy-web-aws.mjs

@@ -0,0 +1,290 @@
+#!/usr/bin/env node
+/**
+ * `scripts/deploy-web-aws.mjs` — the AWS web-client deploy pipeline helper.
+ *
+ * Two-phase deploy that runs AFTER `cdk deploy` applies the `IrcAwsStack`
+ * CloudFormation stack:
+ *
+ *   1. `aws cloudformation describe-stacks --stack-name IrcAwsStack` reads
+ *      the stack's outputs (`ConnectUrl`, `WebsiteBucketName`,
+ *      `WebsiteDistributionId`).
+ *   2. `pnpm --filter @serverless-ircd/web run build:prod-aws -- --api-url <url>`
+ *      bakes the SPA with the real API Gateway WebSocket URL (read from
+ *      `ConnectUrl` in step 1). The build script overrides the templated
+ *      `{{API_ID}}`/`{{REGION}}`/`{{STAGE}}` `server` value in
+ *      `apps/web/static/config.prod-aws.json` and rejects any leftover
+ *      `{{...}}` placeholders, so no hardcoded URLs ship.
+ *   3. `aws s3 sync apps/web/dist s3://<bucket> --delete` uploads the
+ *      build. The CLI's `sync` compares etags and SKIPS unchanged objects,
+ *      so a re-deploy with no SPA changes uploads nothing (the
+ *      invalidation in step 4 still fires — CloudFront has no
+ *      unchanged-skip equivalent).
+ *   4. `aws cloudfront create-invalidation --distribution-id <id> --paths /*`
+ *      busts the edge cache so the new build is served immediately.
+ *
+ * Why a script instead of CDK `BucketDeployment`: `BucketDeployment`
+ * re-synths on every deploy (slower), cannot bake the post-deploy API URL
+ * into the baked config (it runs before the stack outputs exist), and
+ * pulls in a custom-resource Lambda for a one-shot copy. A stand-alone
+ * script reads the deployed outputs directly.
+ *
+ * Why the AWS CLI instead of `@aws-sdk/client-*`: `aws s3 sync`'s etag
+ * comparison and unchanged-skip are non-trivial to reimplement on top of
+ * the SDK; the CLI is already a deploy-time dependency (the workflow uses
+ * it for `describe-stacks`). One-off SDK calls would multiply surface
+ * area without buying anything.
+ *
+ * @see docs/AWS-Deployment.md for the full deploy runbook.
+ */
+
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+
+/**
+ * Fixed CloudFormation stack name (post-staging/prod-collapse: a single
+ * target per platform, no env suffix). Mirrors the value the deploy
+ * workflow's `describe-stacks` query already uses.
+ */
+export const STACK_NAME = 'IrcAwsStack';
+
+/**
+ * Outputs the script consumes. Each MUST be present on the deployed
+ * stack — a missing output aborts the deploy with a clear message so
+ * the operator knows to `cdk deploy` (or check the `webSite` prop) before
+ * re-running.
+ */
+export const REQUIRED_OUTPUTS = ['ConnectUrl', 'WebsiteBucketName', 'WebsiteDistributionId'];
+
+/**
+ * Pattern matching the `{{...}}` placeholders baked into
+ * `apps/web/static/config.prod-aws.json`. The stack output's `ConnectUrl`
+ * should be a fully-resolved wss URL; if it isn't, the build script would
+ * bake a broken SPA. This guard fails the deploy at the script layer
+ * (defence in depth) instead of relying on `build.mjs` alone.
+ */
+const PLACEHOLDER_PATTERN = /\{\{[^}]+\}\}/u;
+
+/**
+ * Builds the default runner that shells out to the `aws` CLI and `pnpm`
+ * via `spawnSync`. IO is captured (pipe) on the AWS path so the script can
+ * surface stderr in its own error messages; stdio for the `pnpm build`
+ * call is inherited so the (verbose) Kiwi build log streams live to the
+ * operator.
+ *
+ * @param {{ cwd?: string }} [opts]
+ * @returns {{ aws: (args: string[]) => CliResult; pnpm: (args: string[]) => CliResult }}
+ */
+export function makeDefaultRunner({ cwd = process.cwd() } = {}) {
+  return {
+    /* v8 ignore next -- 1-line wrapper over the tested runCli(); the literal binary name is the only thing that differs and it cannot be exercised without `aws` on the test PATH. */
+    aws(args) {
+      return runCli('aws', args, { cwd, stdio: ['ignore', 'pipe', 'pipe'] });
+    },
+    /* v8 ignore next -- 1-line wrapper over the tested runCli(); same reason as aws() above. */
+    pnpm(args) {
+      // Inherit stdio for pnpm so the build log streams live.
+      return runCli('pnpm', args, { cwd, stdio: 'inherit' });
+    },
+  };
+}
+
+/**
+ * Spawns a child process and returns the captured IO + exit status. Pure
+ * plumbing — no throwing on non-zero exits (the caller decides whether a
+ * non-zero status is an error). Exported so the test-suite can exercise
+ * the spawnSync shape with `node` as the binary instead of `aws`/`pnpm`
+ * (neither of which is guaranteed to be on PATH in the test environment).
+ *
+ * @param {string} command
+ * @param {string[]} args
+ * @param {{ cwd: string; stdio: 'inherit' | Array<'ignore' | 'pipe' | 'inherit'> }} opts
+ * @returns {CliResult}
+ */
+export function runCli(command, args, opts) {
+  const result = spawnSync(command, args, {
+    cwd: opts.cwd,
+    stdio: opts.stdio,
+    encoding: 'utf8',
+  });
+  const status = result.status ?? -1;
+  const stdout = typeof result.stdout === 'string' ? result.stdout : '';
+  const stderr = typeof result.stderr === 'string' ? result.stderr : '';
+  return { status, stdout, stderr };
+}
+
+/**
+ * Parses the JSON body returned by
+ * `aws cloudformation describe-stacks --query 'Stacks[0].Outputs' --output json`
+ * into a plain `OutputKey → OutputValue` lookup. Empty / malformed bodies
+ * surface as thrown Errors so the caller (the deploy function) can fail
+ * loudly with context.
+ *
+ * @param {string} jsonBody
+ * @returns {Record<string, string>}
+ */
+export function parseStackOutputs(jsonBody) {
+  const parsed = JSON.parse(jsonBody);
+  if (!Array.isArray(parsed)) {
+    return {};
+  }
+  const map = {};
+  for (const entry of parsed) {
+    if (
+      typeof entry === 'object' &&
+      entry !== null &&
+      typeof entry.OutputKey === 'string' &&
+      typeof entry.OutputValue === 'string'
+    ) {
+      map[entry.OutputKey] = entry.OutputValue;
+    }
+  }
+  return map;
+}
+
+/**
+ * Runs the two-phase AWS web deploy. Throws on any failure (missing
+ * output, CLI non-zero exit, leftover placeholder) — the CLI entrypoint
+ * catches and exits non-zero.
+ *
+ * Implemented as an `async` function so the entrypoint and tests can
+ * consume it uniformly via `.catch()` / `rejects.toThrowError`; the
+ * underlying `spawnSync` calls are themselves synchronous, but wrapping
+ * the orchestration in a Promise keeps the contract stable if a future
+ * revision swaps in the AWS SDK or a streaming upload.
+ *
+ * @param {Object} [opts]
+ * @param {{ aws: (args: string[]) => CliResult; pnpm: (args: string[]) => CliResult }} [opts.runner]
+ * @param {string} [opts.stackName]
+ * @param {string} [opts.distDir]
+ * @param {(message: string) => void} [opts.log]
+ * @returns {Promise<{ connectUrl: string; bucket: string; distributionId: string }>}
+ */
+export async function deployWebAws({
+  runner = makeDefaultRunner(),
+  stackName = STACK_NAME,
+  distDir = path.join('apps', 'web', 'dist'),
+  log = (m) => console.log(m),
+} = {}) {
+  // 1. Read the deployed stack's outputs.
+  const describeResult = runner.aws([
+    'cloudformation',
+    'describe-stacks',
+    '--stack-name',
+    stackName,
+    '--query',
+    'Stacks[0].Outputs',
+    '--output',
+    'json',
+  ]);
+  if (describeResult.status !== 0) {
+    throw new Error(
+      `aws cloudformation describe-stacks --stack-name ${stackName} exited with ${describeResult.status}: ${describeResult.stderr}`,
+    );
+  }
+  const outputs = parseStackOutputs(describeResult.stdout);
+
+  // 2. Guard: every required output MUST be present. A missing output means
+  //    the stack hasn't been deployed (or the `webSite` prop was omitted on
+  //    the last synth), and proceeding would either bake a broken config
+  //    or sync to the wrong bucket.
+  const connectUrl = outputs.ConnectUrl;
+  const bucket = outputs.WebsiteBucketName;
+  const distributionId = outputs.WebsiteDistributionId;
+  for (const key of REQUIRED_OUTPUTS) {
+    const value = outputs[key];
+    if (value === undefined || value.length === 0) {
+      throw new Error(
+        `Missing required CloudFormation output '${key}' on stack '${stackName}'. ` +
+          `Has the stack been deployed (cdk deploy --all)? The web deploy pipeline requires: ${REQUIRED_OUTPUTS.join(', ')}.`,
+      );
+    }
+  }
+
+  // Defence in depth: the stack output itself should never carry an
+  // unsubstituted placeholder, but if it did the build would bake a
+  // broken SPA. Fail loudly here so the operator sees the script's
+  // diagnostic before the build's.
+  if (PLACEHOLDER_PATTERN.test(connectUrl)) {
+    throw new Error(
+      `Stack output ConnectUrl carries an unsubstituted placeholder: '${connectUrl}'. The deployed stage URL must be a fully-resolved wss:// URL, not a template.`,
+    );
+  }
+
+  // 3. Bake the SPA with the real API URL. The build script overrides the
+  //    templated `server` field in config.prod-aws.json with this value
+  //    and rejects any remaining `{{...}}` placeholders.
+  log(`Baking SPA with API URL ${connectUrl}`);
+  const buildResult = runner.pnpm([
+    '--filter',
+    '@serverless-ircd/web',
+    'run',
+    'build:prod-aws',
+    '--',
+    '--env',
+    'prod-aws',
+    '--api-url',
+    connectUrl,
+  ]);
+  if (buildResult.status !== 0) {
+    throw new Error(
+      `pnpm build:prod-aws exited with ${buildResult.status}. The web SPA build failed; see the build log above.`,
+    );
+  }
+
+  // 4. s3 sync. The CLI's `sync` skips unchanged objects via etag
+  //    comparison, so a re-deploy with no SPA changes uploads nothing.
+  //    `--delete` removes objects that no longer exist in the dist tree
+  //    (e.g. hashed assets from the previous build) so the bucket does
+  //    not accumulate stale entries.
+  log(`Syncing ${distDir} → s3://${bucket}`);
+  const syncResult = runner.aws(['s3', 'sync', distDir, `s3://${bucket}`, '--delete']);
+  if (syncResult.status !== 0) {
+    throw new Error(`aws s3 sync exited with ${syncResult.status}: ${syncResult.stderr}`);
+  }
+
+  // 5. CloudFront invalidation. Always fires — CloudFront has no
+  //    unchanged-skip equivalent, so even a no-op sync requires this to
+  //    guarantee the edge serves the latest origin state.
+  log(`Invalidating CloudFront distribution ${distributionId}`);
+  const invalidationResult = runner.aws([
+    'cloudfront',
+    'create-invalidation',
+    '--distribution-id',
+    distributionId,
+    '--paths',
+    '/*',
+  ]);
+  if (invalidationResult.status !== 0) {
+    throw new Error(
+      `aws cloudfront create-invalidation exited with ${invalidationResult.status}: ${invalidationResult.stderr}`,
+    );
+  }
+
+  log(`Deployed web client → s3://${bucket} (CloudFront ${distributionId}, invalidated /*)`);
+  return { connectUrl, bucket, distributionId };
+}
+
+// --- CLI entrypoint --------------------------------------------------------
+//
+// Excluded from coverage: the entrypoint is exercised by the deploy
+// pipeline / a human operator, not by the unit tests (which call
+// `deployWebAws` directly with an injected runner). The branch under test
+// is the `if (invokedDirectly)` body, which only fires when this file is
+// the process entry point — exactly the case vitest's import does NOT
+// produce. v8's ignore markers keep the coverage threshold meaningful
+// for the testable surface.
+
+/* v8 ignore start */
+const invokedDirectly =
+  process.argv[1] !== undefined &&
+  path.resolve(process.argv[1]) ===
+    path.resolve(new URL('./deploy-web-aws.mjs', import.meta.url).pathname);
+
+if (invokedDirectly) {
+  deployWebAws().catch((err) => {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`deploy-web-aws: ${message}`);
+    process.exit(1);
+  });
+}
+/* v8 ignore stop */

package/scripts/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "@serverless-ircd/deploy-scripts",
+  "version": "0.10.0",
+  "private": true,
+  "description": "Repo-level deploy helpers (AWS web client s3 sync + CloudFront invalidation pipeline).",
+  "license": "BSD-3-Clause",
+  "type": "module",
+  "scripts": {
+    "deploy:web-aws": "node ./deploy-web-aws.mjs",
+    "typecheck": "tsc -p tsconfig.test.json --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "coverage": "vitest run --coverage",
+    "clean": "rimraf coverage .turbo"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.1",
+    "@vitest/coverage-v8": "^4.1.0",
+    "rimraf": "^6.0.0",
+    "typescript": "^5.6.0",
+    "vitest": "^4.1.0"
+  }
+}

package/scripts/tsconfig.test.json

@@ -0,0 +1,12 @@
+{
+  "extends": "../tsconfig.base.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "composite": false,
+    "types": ["node"],
+    "allowJs": true,
+    "checkJs": false
+  },
+  "include": ["**/*.ts", "**/*.mjs", "**/*.d.mts"],
+  "exclude": ["node_modules", "coverage"]
+}

package/scripts/vitest.config.ts

@@ -0,0 +1,19 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    environment: 'node',
+    include: ['__tests__/**/*.test.ts'],
+    coverage: {
+      provider: 'v8',
+      include: ['deploy-web-aws.mjs'],
+      reporter: ['text', 'html', 'json-summary'],
+      thresholds: {
+        lines: 90,
+        functions: 90,
+        branches: 90,
+        statements: 90,
+      },
+    },
+  },
+});

package/tools/ci-hardening/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/ci-hardening",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "private": true,
   "description": "CI hardening helpers: coverage-gate config validator + mutation-testing driver for irc-core",
   "license": "BSD-3-Clause",

package/tools/ci-hardening/src/index.ts

@@ -1,6 +1,8 @@
 export {
   MUTATION_SCORE_THRESHOLD,
+  findAwsCredentialSteps,
   readCoverageThresholds,
   readStrykerConfig,
   readWorkflowJob,
+  readWorkflowPermissions,
 } from './validate.js';

package/tools/ci-hardening/src/validate.ts

@@ -37,9 +37,66 @@ interface WorkflowJob {
 }
 
 interface ParsedWorkflow {
+  permissions?: Record<string, string> | string;
   jobs?: Record<string, WorkflowJob>;
 }
 
+/**
+ * Parse a GitHub Actions YAML file and return the top-level
+ * `permissions:` block as a `Record<string, string>` (e.g.
+ * `{ 'id-token': 'write', contents: 'read' }`).
+ *
+ * Throws if the workflow has no top-level `permissions:` block.
+ * The literal `'read-all'` / `'write-all'` shapes are returned
+ * verbatim as a single key so callers can flag them.
+ *
+ * @param yamlText raw YAML source of a workflow file.
+ */
+export function readWorkflowPermissions(yamlText: string): Record<string, string> {
+  const parsed = load(yamlText) as ParsedWorkflow;
+  if (parsed.permissions === undefined || parsed.permissions === null) {
+    throw new Error('Workflow has no top-level permissions: block');
+  }
+  if (typeof parsed.permissions === 'string') {
+    return { [parsed.permissions]: parsed.permissions };
+  }
+  return parsed.permissions;
+}
+
+/**
+ * Return every step in the workflow that uses `configure-aws-credentials`,
+ * keyed by `"<job>.<index>"`. Each value is the step's `with:` mapping
+ * (an empty object if the step has no `with:`).
+ *
+ * Used by the OIDC-only lint to assert no static-key inputs survive.
+ *
+ * @param yamlText raw YAML source of a workflow file.
+ */
+export function findAwsCredentialSteps(
+  yamlText: string,
+): Array<{ job: string; index: number; with: Record<string, unknown> }> {
+  const parsed = load(yamlText) as ParsedWorkflow;
+  const out: Array<{ job: string; index: number; with: Record<string, unknown> }> = [];
+  for (const [jobName, job] of Object.entries(parsed.jobs ?? {})) {
+    const steps = job?.steps ?? [];
+    steps.forEach((step, index) => {
+      const uses = step.uses;
+      if (typeof uses === 'string' && uses.includes('configure-aws-credentials')) {
+        const withBlock = step.with;
+        out.push({
+          job: jobName,
+          index,
+          with:
+            withBlock && typeof withBlock === 'object'
+              ? (withBlock as Record<string, unknown>)
+              : {},
+        });
+      }
+    });
+  }
+  return out;
+}
+
 /**
  * Extract the `coverage.thresholds` block from a vitest config file.
  *

package/tools/ci-hardening/tests/deploy-aws-oidc.test.ts

@@ -0,0 +1,96 @@
+/**
+ * OIDC-only AWS deploy enforcement.
+ *
+ * The deploy workflow (`.github/workflows/deploy-aws.yml`) must NOT
+ * accept long-lived access keys. It must require an OIDC web-identity
+ * role (`AWS_DEPLOY_ROLE_ARN`), grant `id-token: write`, fail fast when
+ * the role ARN is missing, and assert that `aws sts get-caller-identity`
+ * returns the configured role before any `cdk deploy` / `cdk synth` —
+ * so a silent fallback to ambient static credentials cannot ship a
+ * deploy.
+ *
+ * These assertions run as part of the CI-hardening suite on every PR,
+ * the same way the coverage-gate and mutation-testing contracts do.
+ */
+
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { describe, expect, it } from 'vitest';
+import {
+  findAwsCredentialSteps,
+  readWorkflowJob,
+  readWorkflowPermissions,
+} from '../src/validate.js';
+
+const REPO_ROOT = resolve(import.meta.dirname, '..', '..', '..');
+const WORKFLOW_PATH = resolve(REPO_ROOT, '.github/workflows/deploy-aws.yml');
+const WORKFLOW = readFileSync(WORKFLOW_PATH, 'utf8');
+
+describe('deploy-aws.yml: OIDC is the only accepted AWS credential source', () => {
+  it('does NOT pass aws-access-key-id / aws-secret-access-key to configure-aws-credentials', () => {
+    const steps = findAwsCredentialSteps(WORKFLOW);
+    expect(steps.length).toBeGreaterThan(0);
+    for (const step of steps) {
+      expect(step.with).not.toHaveProperty('aws-access-key-id');
+      expect(step.with).not.toHaveProperty('aws-secret-access-key');
+    }
+  });
+
+  it('configures a role-to-assume on every configure-aws-credentials step', () => {
+    const steps = findAwsCredentialSteps(WORKFLOW);
+    expect(steps.length).toBeGreaterThan(0);
+    for (const step of steps) {
+      expect(step.with['role-to-assume']).toBeDefined();
+    }
+  });
+
+  it('grants id-token: write at the top level (OIDC minting requires it)', () => {
+    const permissions = readWorkflowPermissions(WORKFLOW);
+    expect(permissions['id-token']).toBe('write');
+  });
+
+  it('keeps the permissions block least-privilege (only id-token + contents)', () => {
+    const permissions = readWorkflowPermissions(WORKFLOW);
+    expect(permissions.contents).toBe('read');
+    const keys = Object.keys(permissions).sort();
+    expect(keys).toEqual(['contents', 'id-token']);
+  });
+
+  it('fails fast when AWS_DEPLOY_ROLE_ARN is empty (guard step exists in every AWS-touching job)', () => {
+    // The "deploy" job runs `pnpm deploy:aws` (cdk deploy) and the
+    // "deploy-web" job runs `node scripts/deploy-web-aws.mjs`. Both
+    // must abort before any AWS call if the role ARN secret is unset.
+    for (const jobName of ['deploy', 'deploy-web']) {
+      const job = readWorkflowJob(WORKFLOW, jobName);
+      const hasGuard = job.steps.some((step) => {
+        const ifExpr = typeof step.if === 'string' ? step.if : '';
+        const env = step.env as Record<string, string> | undefined;
+        return (
+          ifExpr.includes('AWS_DEPLOY_ROLE_ARN') &&
+          ifExpr.includes("== ''") &&
+          env !== undefined &&
+          typeof env.AWS_DEPLOY_ROLE_ARN === 'string' &&
+          typeof step.run === 'string' &&
+          step.run.includes('exit 1')
+        );
+      });
+      expect(hasGuard).toBe(true);
+    }
+  });
+
+  it('asserts the sts get-caller-identity ARN matches the configured role before any CDK call', () => {
+    // The "deploy" job gates `cdk deploy`. It must, after
+    // configure-aws-credentials and before `pnpm deploy:aws`, run
+    // `aws sts get-caller-identity` and reject anything that is not
+    // the configured role ARN. This catches silent fallbacks to
+    // ambient static credentials.
+    const job = readWorkflowJob(WORKFLOW, 'deploy');
+    const runSteps = job.steps
+      .filter((s) => typeof s.run === 'string')
+      .map((s) => (s.run as string).trim());
+    const hasStsGuard = runSteps.some(
+      (r) => r.includes('aws sts get-caller-identity') && r.includes('AWS_DEPLOY_ROLE_ARN'),
+    );
+    expect(hasStsGuard).toBe(true);
+  });
+});

package/tools/ci-hardening/tests/validate.test.ts

@@ -3,9 +3,11 @@ import { resolve } from 'node:path';
 import { describe, expect, it } from 'vitest';
 import {
   MUTATION_SCORE_THRESHOLD,
+  findAwsCredentialSteps,
   readCoverageThresholds,
   readStrykerConfig,
   readWorkflowJob,
+  readWorkflowPermissions,
 } from '../src/validate.js';
 
 const REPO_ROOT = resolve(import.meta.dirname, '..', '..', '..');
@@ -174,4 +176,44 @@ describe('validate.ts error paths', () => {
       /no job named "verify"/,
     );
   });
+
+  it('readWorkflowPermissions throws when no top-level permissions block exists', () => {
+    expect(() => readWorkflowPermissions('on: push\njobs:\n  build: {}\n')).toThrow(
+      /no top-level permissions/,
+    );
+  });
+
+  it('readWorkflowPermissions returns the literal string form as a single key', () => {
+    // `permissions: read-all` is a valid GitHub Actions shorthand.
+    const result = readWorkflowPermissions('on: push\npermissions: read-all\njobs:\n  b: {}\n');
+    expect(result).toEqual({ 'read-all': 'read-all' });
+  });
+
+  it('findAwsCredentialSteps returns [] when the workflow has no jobs', () => {
+    expect(findAwsCredentialSteps('on: push\n')).toEqual([]);
+  });
+
+  it('findAwsCredentialSteps returns an empty with-block when the step has no with:', () => {
+    // Job has a `configure-aws-credentials` step with no `with:` and a
+    // sibling `run:` step (which has a non-string `uses` and must be
+    // skipped silently).
+    const yaml = [
+      'on: push',
+      'jobs:',
+      '  build:',
+      '    steps:',
+      '      - run: echo hi',
+      '      - uses: aws-actions/configure-aws-credentials@v4',
+      '',
+    ].join('\n');
+    const result = findAwsCredentialSteps(yaml);
+    expect(result).toEqual([{ job: 'build', index: 1, with: {} }]);
+  });
+
+  it('findAwsCredentialSteps tolerates a job with no steps key', () => {
+    // A job literal `{}` (no `steps:`) must not throw — it just yields
+    // no credential steps.
+    const yaml = 'on: push\njobs:\n  empty: {}\n';
+    expect(findAwsCredentialSteps(yaml)).toEqual([]);
+  });
 });

package/tools/load-test/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/load-test",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "private": true,
   "description": "Synthetic WebSocket IRC client farm for load testing ServerlessIRCd (concurrency, latency p50/p95/p99, drop rate)",
   "license": "BSD-3-Clause",