Run on Node 24, drop the temporary CA workaround

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 Moved from AGENTS.md on 2026-10-08. Newest first.
 
+- **v0.18.2** no app change: the image runs on Node 24 (`node:24-alpine`), and the v0.16.3 CA workaround is gone now that nodejs/node#66871 shipped; `engines`, `@types/node` and the esbuild targets follow
 - **v0.18.1** no app change: the image is built by the shared `basmith7/workflows` build (`.github/workflows/build.yml`), so it carries its commit and version labels (`deploy-app status arcs` shows them), and it deploys with tower-deploy's `deploy-now` (`.tower-deploy`), which also syncs `docker-compose.prod.yml` to Tower. `scripts/deploy-now.sh` is gone
 - **v0.18.0** **End turn** sends itself after two minutes (the countdown is on the button) or when you leave the page, and its panel shows which of your moves Start over takes back and which are locked in behind a roll, draw or peek. A move that can't be undone (a card draw, a look at a hand) now asks **Go ahead** first; the battle window's Roll and Reroll say "Can't be undone" on the button instead of asking. The setting is now Settings > Board > Confirm moves (`confirmMoves`; a stored `confirmEndTurn` is ignored, so it reads On again)
 - **v0.17.0** online, the move that ends your turn waits on your device for **End turn**, with **Undo last move** and **Start over** (back through your own moves this turn, stopping at a dice roll, draw or peek, by the same `takeBackBlock` rule as Undo; Settings > Board > Confirm end of turn, on by default). Private per-seat **Notes** under the log, saved on the server (`seat_note`, `GET`/`POST /games/:id/note`) so a plan follows you between devices. On desktop the log is always a column (the pin toggle and `logPinned` setting are gone, and so is the desktop's turn feed over the map)

Dockerfile

@@ -1,5 +1,5 @@
 # Multi-stage: build the site and bundle the server, then ship only the runtime pieces.
-FROM node:22-alpine AS build
+FROM node:24-alpine AS build
 WORKDIR /app
 COPY package.json package-lock.json ./
 COPY packages/engine/package.json packages/engine/
@@ -11,11 +11,8 @@ COPY . .
 # build:site sets VITE_MULTIPLAYER_URL to "" = same origin (apps/web/src/multiplayer/config.ts).
 RUN npm run build:site && npm run build --workspace @arcs/server-node
 
-FROM node:22-alpine AS runner
+FROM node:24-alpine AS runner
 WORKDIR /app
-# TEMP: revert when nodejs/node#66871 ships (eMudhra CA: use the patched OS store, not Node's roots)
-RUN apk upgrade --no-cache ca-certificates-bundle
-ENV NODE_OPTIONS=--use-openssl-ca
 ENV NODE_ENV=production \
     PORT=3070 \
     DATABASE_PATH=/data/arcs.db \

package.json

@@ -39,6 +39,6 @@
     "vitest": "^2.1.0"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=24"
   }
 }

packages/server-node/package.json

@@ -7,7 +7,7 @@
   "scripts": {
     "typecheck": "tsc --noEmit",
     "dev": "tsx watch --no-warnings=ExperimentalWarning src/main.ts",
-    "build": "esbuild src/main.ts src/bot-worker.ts --bundle --platform=node --format=esm --target=node22 --external:ws --outdir=dist",
+    "build": "esbuild src/main.ts src/bot-worker.ts --bundle --platform=node --format=esm --target=node24 --external:ws --outdir=dist",
     "start": "node --no-warnings=ExperimentalWarning dist/main.js"
   },
   "dependencies": {
@@ -16,7 +16,7 @@
     "ws": "^8.18.0"
   },
   "devDependencies": {
-    "@types/node": "^22.10.0",
+    "@types/node": "^24",
     "@types/ws": "^8.5.13",
     "esbuild": "^0.24.0",
     "tsx": "^4.19.0"

packages/server-node/test/thinker.test.ts

@@ -34,7 +34,7 @@ beforeAll(async () => {
     bundle: true,
     platform: 'node',
     format: 'esm',
-    target: 'node22',
+    target: 'node24',
     outfile: join(dir, 'bot-worker.js'),
     logLevel: 'silent',
   })