chore(release): v2.2.3 — artifact attestations, bugfixes, rate limit metrics

scripts/test-server-ops.mjs

@@ -77,9 +77,12 @@ assert.equal(adminHealth.avgPeersPerRoom, 2.5, 'admin metrics should include ave
 assert.equal(adminHealth.maxPeersInRoom, 3, 'admin metrics should include max room size');
 assert.deepEqual(adminHealth.memory, { rss: 10, heapUsed: 5, heapTotal: 8 }, 'admin metrics should expose process memory');
 assert.deepEqual(
-  adminHealth.rateLimitEntries,
-  { connections: 1, events: 2, health: 3, adminMetricsAuth: 4, authFailures: 5, roomList: 6 },
-  'admin metrics should expose aggregate rate-limit map sizes'
+  adminHealth.rateLimits,
+  {
+    trackedClients: { connections: 1, events: 2, health: 3, adminMetricsAuth: 4, authFailures: 5, roomList: 6 },
+    denied: { connections: 0, events: 0, health: 0, adminMetricsAuth: 0, roomList: 0 }
+  },
+  'admin metrics should expose rate-limit tracking and denial counts'
 );
 
 console.log('server ops tests passed');

scripts/test-server-routes.mjs

@@ -1,5 +1,8 @@
 import assert from 'node:assert/strict';
-import {
+
+// Must set env before dynamic import — ESM hoists static imports
+process.env.ADMIN_METRICS_TOKEN = process.env.ADMIN_METRICS_TOKEN || 'test-admin-token-with-more-than-32-chars';
+const {
   ADMIN_METRICS_AUTH_RATE_LIMIT_PER_MINUTE,
   HEALTH_RATE_LIMIT_PER_MINUTE,
   healthCounts,
@@ -9,9 +12,9 @@ import {
   rooms,
   startServer,
   stopServerForTests
-} from '../server/index.js';
+} = await import('../server/index.js');
 
-const adminToken = process.env.ADMIN_METRICS_TOKEN || 'test-admin-token-with-more-than-32-chars';
+const adminToken = process.env.ADMIN_METRICS_TOKEN;
 const baseHeaders = { 'x-forwarded-for': '203.0.113.10' };
 
 function url(path) {