serverless-ircd 0.8.0 → 0.10.0

package/packages/cf-adapter/tests/connection-do-pure.test.ts

@@ -6,86 +6,257 @@
  */
 
 import { describe, expect, it } from 'vitest';
-import { parseSaslAccountsEnv, wsFrameModeFromTags } from '../src/connection-do';
+import {
+  NO_OP_DISCONNECT,
+  NO_OP_SEND,
+  buildOptionalActorFields,
+  chooseMotdProvider,
+  extractMtlsSubject,
+  wsFrameModeFromTags,
+} from '../src/connection-do';
 
-describe('parseSaslAccountsEnv', () => {
-  it('returns an empty array for undefined input', () => {
-    expect(parseSaslAccountsEnv(undefined)).toEqual([]);
+describe('wsFrameModeFromTags', () => {
+  it("returns 'legacy' when no tags are present", () => {
+    expect(wsFrameModeFromTags([])).toBe('legacy');
+  });
+
+  it("returns 'legacy' when no recognized tag matches", () => {
+    // Unknown tags (e.g. from an older deployment's tag scheme) fall
+    // back to the legacy-tolerant mode.
+    expect(wsFrameModeFromTags(['unknown:tag', 'another'])).toBe('legacy');
+  });
+
+  it("returns 'spec-text' when the spec-text tag is present", () => {
+    expect(wsFrameModeFromTags(['ws:spec-text'])).toBe('spec-text');
+  });
+
+  it("returns 'spec-binary' when the spec-binary tag is present", () => {
+    expect(wsFrameModeFromTags(['ws:spec-binary'])).toBe('spec-binary');
+  });
+
+  it("returns 'legacy' when the legacy tag is present", () => {
+    expect(wsFrameModeFromTags(['ws:legacy'])).toBe('legacy');
+  });
+
+  it('picks the first recognized tag when multiple are present', () => {
+    // The scan is order-sensitive; the first matching tag wins.
+    expect(wsFrameModeFromTags(['ws:spec-text', 'ws:legacy'])).toBe('spec-text');
+  });
+});
+
+// ============================================================================
+// PassthroughChannelAccess.refreshChannel
+// ============================================================================
+//
+// refreshChannel pulls the authoritative snapshot from the ChannelDO and
+// rebuilds (or updates) the local cache entry. The zero-members branch is
+// the post-deploy state: the ChannelDO persisted a topic across the
+// deploy but its roster is empty, so the local cache must still absorb
+// the topic/modes/banMasks or the JOIN reducer runs against a topic-less
+// state and never emits 332/333.
+// ============================================================================
+
+import { PassthroughChannelAccess } from '../src/connection-do';
+import type { Env } from '../src/env';
+
+const EMPTY_MODES = {
+  inviteOnly: false,
+  topicLock: false,
+  noExternal: false,
+  moderated: false,
+  secret: false,
+  private: false,
+  registered: false,
+  blockUnidentified: false,
+  moderatedIdent: false,
+};
+
+/** Builds a fake Env whose CHANNEL_DO returns `snapshot` from getChannelSnapshot. */
+function makeEnvWithSnapshot(snapshot: unknown): Env {
+  const fakeChannelDo = {
+    idFromName: (key: string) => `id-${key}`,
+    get: () => ({ getChannelSnapshot: async () => snapshot }),
+  };
+  return { CHANNEL_DO: fakeChannelDo } as unknown as Env;
+}
+
+describe('PassthroughChannelAccess.refreshChannel', () => {
+  it('propagates topic/modes/banMasks onto the cached entry when the snapshot reports zero members', async () => {
+    const snap = {
+      modes: { ...EMPTY_MODES, topicLock: true },
+      banMasks: ['bad!*@*'],
+      topic: { text: 'survived deploy', setter: 'alice!alice@example.com', setAt: 1234 },
+      members: [],
+      pendingInvites: [],
+      createdAt: 0,
+    };
+    const env = makeEnvWithSnapshot(snap);
+    const access = new PassthroughChannelAccess(0, env);
+    const chan = access.getOrCreateChannel('#foo');
+    expect(chan.topic).toBeUndefined();
+
+    await access.refreshChannel('#foo');
+
+    expect(chan.topic?.text).toBe('survived deploy');
+    expect(chan.topic?.setter).toBe('alice!alice@example.com');
+    expect(chan.topic?.setAt).toBe(1234);
+    expect(chan.modes.topicLock).toBe(true);
+    expect(chan.banMasks.has('bad!*@*')).toBe(true);
   });
 
-  it('returns an empty array for an empty string', () => {
-    expect(parseSaslAccountsEnv('')).toEqual([]);
+  it('leaves the cached topic unset when a zero-members snapshot carries no topic', async () => {
+    const snap = {
+      modes: { ...EMPTY_MODES },
+      banMasks: [],
+      members: [],
+      pendingInvites: [],
+      createdAt: 0,
+    };
+    const env = makeEnvWithSnapshot(snap);
+    const access = new PassthroughChannelAccess(0, env);
+    const chan = access.getOrCreateChannel('#foo');
+
+    await access.refreshChannel('#foo');
+
+    expect(chan.topic).toBeUndefined();
+  });
+
+  it('does not seed a cache entry when the snapshot reports zero members and none exists', async () => {
+    const snap = {
+      modes: { ...EMPTY_MODES },
+      banMasks: [],
+      topic: { text: 'x', setter: 's', setAt: 0 },
+      members: [],
+      pendingInvites: [],
+      createdAt: 0,
+    };
+    const env = makeEnvWithSnapshot(snap);
+    const access = new PassthroughChannelAccess(0, env);
+
+    await access.refreshChannel('#never');
+
+    // No cache entry was created: getOrCreateChannel now seeds a fresh one
+    // with no topic (the zero-members refresh must not seed a new entry).
+    const chan = access.getOrCreateChannel('#never');
+    expect(chan.topic).toBeUndefined();
+  });
+
+  it('rebuilds the cached entry from a snapshot with members', async () => {
+    const snap = {
+      modes: { ...EMPTY_MODES, secret: true },
+      banMasks: [],
+      topic: { text: 'hi', setter: 's', setAt: 9 },
+      members: [{ conn: 'c0', nick: 'alice', op: true, voice: false }],
+      pendingInvites: [],
+      createdAt: 7,
+    };
+    const env = makeEnvWithSnapshot(snap);
+    const access = new PassthroughChannelAccess(0, env);
+
+    await access.refreshChannel('#foo');
+
+    const chan = access.getOrCreateChannel('#foo');
+    expect(chan.topic?.text).toBe('hi');
+    expect(chan.modes.secret).toBe(true);
+    expect(chan.members.size).toBe(1);
+    expect(chan.members.get('c0')?.nick).toBe('alice');
   });
 
-  it('parses a single well-formed entry', () => {
-    expect(parseSaslAccountsEnv('alice:secret')).toEqual([
-      { username: 'alice', password: 'secret' },
-    ]);
+  it('is a no-op when the ChannelDO snapshot is null', async () => {
+    const env = makeEnvWithSnapshot(null);
+    const access = new PassthroughChannelAccess(0, env);
+    const chan = access.getOrCreateChannel('#foo');
+    chan.topic = { text: 'keep', setter: 's', setAt: 1 };
+
+    await access.refreshChannel('#foo');
+
+    expect(chan.topic?.text).toBe('keep');
   });
+});
+
+// ============================================================================
+// chooseMotdProvider — default vs. populated MOTD_LINES branch
+// ============================================================================
 
-  it('parses multiple newline-delimited entries', () => {
-    expect(parseSaslAccountsEnv('alice:secret\nbob:pw')).toEqual([
-      { username: 'alice', password: 'secret' },
-      { username: 'bob', password: 'pw' },
-    ]);
+describe('chooseMotdProvider', () => {
+  it('returns the default MOTD when the env value is undefined', () => {
+    const provider = chooseMotdProvider(undefined);
+    expect(provider.lines()).toEqual(['Welcome to the ServerlessIRCd Cloudflare adapter.']);
   });
 
-  it('skips blank lines', () => {
-    expect(parseSaslAccountsEnv('alice:secret\n\nbob:pw\n   \n')).toEqual([
-      { username: 'alice', password: 'secret' },
-      { username: 'bob', password: 'pw' },
-    ]);
+  it('returns the default MOTD when the env value is an empty string', () => {
+    const provider = chooseMotdProvider('');
+    expect(provider.lines()).toEqual(['Welcome to the ServerlessIRCd Cloudflare adapter.']);
   });
 
-  it('skips lines with no colon separator', () => {
-    expect(parseSaslAccountsEnv('alice:secret\nnocolonhere\nbob:pw')).toEqual([
-      { username: 'alice', password: 'secret' },
-      { username: 'bob', password: 'pw' },
-    ]);
+  it('splits a populated MOTD_LINES on newlines', () => {
+    const provider = chooseMotdProvider('Line one\nLine two\nLine three');
+    expect(provider.lines()).toEqual(['Line one', 'Line two', 'Line three']);
   });
+});
+
+// ============================================================================
+// buildOptionalActorFields — conditional spread branches
+// ============================================================================
 
-  it('skips lines where the colon is at position 0 (empty username)', () => {
-    expect(parseSaslAccountsEnv(':secret\nalice:valid')).toEqual([
-      { username: 'alice', password: 'valid' },
-    ]);
+describe('buildOptionalActorFields', () => {
+  it('returns an empty object when every optional is undefined', () => {
+    expect(buildOptionalActorFields(undefined, undefined)).toEqual({});
   });
 
-  it('skips lines with an empty password after the colon', () => {
-    expect(parseSaslAccountsEnv('alice:\nbob:valid')).toEqual([
-      { username: 'bob', password: 'valid' },
-    ]);
+  it('includes `services` when defined', () => {
+    const fake = {} as unknown as Parameters<typeof buildOptionalActorFields>[0];
+    expect(buildOptionalActorFields(fake, undefined).services).toBe(fake);
   });
 
-  it('returns an empty array when every line is malformed', () => {
-    expect(parseSaslAccountsEnv('\n   \n:no-user\nuser:')).toEqual([]);
+  it('includes `mtlsIdentity` when defined', () => {
+    const fake = {} as unknown as Parameters<typeof buildOptionalActorFields>[1];
+    expect(buildOptionalActorFields(undefined, fake).mtlsIdentity).toBe(fake);
   });
 });
 
-describe('wsFrameModeFromTags', () => {
-  it("returns 'legacy' when no tags are present", () => {
-    expect(wsFrameModeFromTags([])).toBe('legacy');
+// ============================================================================
+// NO_OP_SEND / NO_OP_DISCONNECT — invoked once to cover the function bodies
+// (the no-socket teardown path constructs these handlers but the actor never
+// invokes send/disconnect during QUIT processing — there is no peer to
+// deliver to and the socket is already gone).
+// ============================================================================
+
+describe('NO_OP_SEND / NO_OP_DISCONNECT', () => {
+  it('NO_OP_SEND runs without throwing and returns undefined', () => {
+    expect(NO_OP_SEND([{ text: 'ignored' }])).toBeUndefined();
   });
 
-  it("returns 'legacy' when no recognized tag matches", () => {
-    // Unknown tags (e.g. from an older deployment's tag scheme) fall
-    // back to the legacy-tolerant mode.
-    expect(wsFrameModeFromTags(['unknown:tag', 'another'])).toBe('legacy');
+  it('NO_OP_DISCONNECT runs without throwing and returns undefined', () => {
+    expect(NO_OP_DISCONNECT('any reason')).toBeUndefined();
   });
+});
 
-  it("returns 'spec-text' when the spec-text tag is present", () => {
-    expect(wsFrameModeFromTags(['ws:spec-text'])).toBe('spec-text');
+// ============================================================================
+// extractMtlsSubject — request.cf.tlsClientAuthCertSubject capture
+// ============================================================================
+
+describe('extractMtlsSubject', () => {
+  it('returns the subject when cf.tlsClientAuthCertSubject is a string', () => {
+    // The CF edge injects request.cf on every proxied request. We can't
+    // mutate Request.cf in workerd tests (it's read-only), so the
+    // upgrade-time capture is exercised via this pure seam.
+    const fake = { cf: { tlsClientAuthCertSubject: 'CN=alice' } } as unknown as Request;
+    expect(extractMtlsSubject(fake)).toBe('CN=alice');
   });
 
-  it("returns 'spec-binary' when the spec-binary tag is present", () => {
-    expect(wsFrameModeFromTags(['ws:spec-binary'])).toBe('spec-binary');
+  it('returns undefined when cf is absent', () => {
+    const fake = { cf: undefined } as unknown as Request;
+    expect(extractMtlsSubject(fake)).toBeUndefined();
   });
 
-  it("returns 'legacy' when the legacy tag is present", () => {
-    expect(wsFrameModeFromTags(['ws:legacy'])).toBe('legacy');
+  it('returns undefined when cf is present but lacks tlsClientAuthCertSubject', () => {
+    const fake = { cf: { country: 'US' } } as unknown as Request;
+    expect(extractMtlsSubject(fake)).toBeUndefined();
   });
 
-  it('picks the first recognized tag when multiple are present', () => {
-    // The scan is order-sensitive; the first matching tag wins.
-    expect(wsFrameModeFromTags(['ws:spec-text', 'ws:legacy'])).toBe('spec-text');
+  it('returns undefined when tlsClientAuthCertSubject is not a string', () => {
+    const fake = { cf: { tlsClientAuthCertSubject: 42 } } as unknown as Request;
+    expect(extractMtlsSubject(fake)).toBeUndefined();
   });
 });

package/packages/cf-adapter/tests/connection-do-sasl-d1.test.ts

@@ -1,10 +1,9 @@
 /**
- * End-to-end SASL PLAIN through ConnectionDO with D1-backed accounts.
+ * End-to-end SASL PLAIN through ConnectionDO with D1-backed services.
  *
- * Verifies the full precedence matrix:
- *   - D1 has rows → table is authoritative (900/903 for seeded account,
- *     904 for the env-seed account which the table shadows).
- *   - D1 empty → the `SASL_ACCOUNTS` env-var seed still works (fallback).
+ * Verifies the services-store credential path: an account seeded into the
+ * `nickserv_accounts` table (via `ServicesStore.registerNick`) verifies
+ * end-to-end through `AUTHENTICATE PLAIN`.
  *
  * Each test file gets its own isolated D1 database from miniflare, so the
  * table state set up here does not leak into `connection-do.test.ts`.
@@ -12,7 +11,7 @@
 
 import { env } from 'cloudflare:test';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { CREATE_ACCOUNTS_TABLE_SQL, putAccountCredential } from '../src/d1-account-store';
+import { CREATE_SERVICES_TABLES_SQL } from '../src/d1-services-store';
 
 declare global {
   namespace Cloudflare {
@@ -107,16 +106,56 @@ async function authenticatePlain(
   client.send(`AUTHENTICATE ${plainB64(authcid, password)}\r\n`);
 }
 
-describe('ConnectionDO — SASL PLAIN with D1-backed accounts', () => {
+/**
+ * Seeds a NickServ registration directly into the D1 services table by
+ * driving a first connection through `PRIVMSG NickServ :REGISTER`. Returns
+ * once the registration NOTICE is observed.
+ */
+async function seedViaNickservRegister(
+  connId: string,
+  nick: string,
+  password: string,
+  email: string,
+): Promise<IrcWsClient> {
+  const client = await connect(connId);
+  client.send(`NICK ${nick}\r\n`);
+  client.send(`USER ${nick} 0 * :${nick}\r\n`);
+  await client.waitForMessage((l) => l.includes(' 001 '));
+  client.send(`PRIVMSG NickServ :REGISTER ${password} ${email}\r\n`);
+  await client.waitForMessage((l) => l.includes('NickServ') && l.includes('registered'));
+  return client;
+}
+
+describe('ConnectionDO — SASL PLAIN with D1-backed services', () => {
   beforeEach(async () => {
-    await env.ACCOUNTS_DB.exec(CREATE_ACCOUNTS_TABLE_SQL);
+    for (const sql of CREATE_SERVICES_TABLES_SQL) {
+      await env.ACCOUNTS_DB.exec(sql);
+    }
   });
   afterEach(async () => {
-    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS accounts');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS nickserv_accounts');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS chanserv_channels');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS chanserv_access');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS chanserv_levels');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS hostserv_vhosts');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS hostserv_pending_vhosts');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS memoserv_memos');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS read_markers');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS operserv_akills');
+    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS operserv_jupes');
   });
 
-  it('completes SASL PLAIN with 900/903 for a D1-seeded account', async () => {
-    await putAccountCredential(env.ACCOUNTS_DB, 'd1-alice', 'd1-s3cret');
+  it('completes SASL PLAIN with 900/903 for a NickServ-registered account', async () => {
+    // Seed alice via NickServ REGISTER on a first connection.
+    const seeder = await seedViaNickservRegister(
+      'conn-d1-sasl-seed',
+      'd1-alice',
+      'd1-s3cret',
+      'd1@example.com',
+    );
+    await seeder.close();
+
+    // A second connection speaking SASL PLAIN against the registered nick.
     const client = await connect('conn-d1-sasl-1');
     await authenticatePlain(client, 'd1-alice', 'd1-s3cret');
     await client.waitForMessage((l) => l.includes(' 900 '));
@@ -125,42 +164,27 @@ describe('ConnectionDO — SASL PLAIN with D1-backed accounts', () => {
     await client.close();
   });
 
-  it('rejects SASL PLAIN with 904 for a wrong password (D1 account)', async () => {
-    await putAccountCredential(env.ACCOUNTS_DB, 'd1-alice', 'd1-s3cret');
+  it('rejects SASL PLAIN with 904 for a wrong password', async () => {
+    const seeder = await seedViaNickservRegister(
+      'conn-d1-sasl-seed2',
+      'd1-bob',
+      'd1-s3cret',
+      'd1@example.com',
+    );
+    await seeder.close();
+
     const client = await connect('conn-d1-sasl-2');
-    await authenticatePlain(client, 'd1-alice', 'wrong');
+    await authenticatePlain(client, 'd1-bob', 'wrong');
     const fail = await client.waitForMessage((l) => l.includes(' 904 '));
     expect(fail).toContain(' 904 ');
     await client.close();
   });
 
-  it('table shadows the env-seed account (table wins)', async () => {
-    // SASL_ACCOUNTS env seeds "cf-sasl:s3cret" but D1 has no such row.
-    await putAccountCredential(env.ACCOUNTS_DB, 'd1-alice', 'd1-s3cret');
+  it('rejects SASL PLAIN with 904 for an unknown nick', async () => {
     const client = await connect('conn-d1-sasl-3');
-    // env-seed account does NOT verify (table is authoritative).
-    await authenticatePlain(client, 'cf-sasl', 's3cret');
+    await authenticatePlain(client, 'nobody', 'whatever');
     const fail = await client.waitForMessage((l) => l.includes(' 904 '));
     expect(fail).toContain(' 904 ');
     await client.close();
   });
 });
-
-describe('ConnectionDO — SASL PLAIN in-memory fallback (D1 empty)', () => {
-  // The table exists but has zero rows → resolver falls back to SASL_ACCOUNTS.
-  beforeEach(async () => {
-    await env.ACCOUNTS_DB.exec(CREATE_ACCOUNTS_TABLE_SQL);
-  });
-  afterEach(async () => {
-    await env.ACCOUNTS_DB.exec('DROP TABLE IF EXISTS accounts');
-  });
-
-  it('falls back to SASL_ACCOUNTS seed when D1 is empty', async () => {
-    const client = await connect('conn-d1-sasl-fallback');
-    await authenticatePlain(client, 'cf-sasl', 's3cret');
-    await client.waitForMessage((l) => l.includes(' 900 '));
-    const success = await client.waitForMessage((l) => l.includes(' 903 '));
-    expect(success).toContain(' 903 ');
-    await client.close();
-  });
-});

package/packages/cf-adapter/tests/d1-services-store.test.ts

@@ -15,6 +15,7 @@ import {
   CREATE_SERVICES_TABLES_SQL,
   D1ServicesStore,
   loadD1ServicesStore,
+  safeSelect,
 } from '../src/d1-services-store';
 
 declare global {
@@ -194,6 +195,18 @@ describe('D1ServicesStore — NickServ round-trip across reload', () => {
     expect(reloaded?.getNickEnforce('alice')).toBe('kill');
   });
 
+  it('persists SET PASSWORD and round-trips the new credential', async () => {
+    const store = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    store?.registerNick('alice', 'hunter2', 'a@x');
+    store?.setNickPassword('alice', 'newpassword');
+    await store?.flush();
+
+    const reloaded = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
+    // The new password verifies against the reloaded store; the old one no longer does.
+    expect(reloaded?.verifyNick('alice', 'newpassword')).toEqual({ ok: true, account: 'alice' });
+    expect(reloaded?.verifyNick('alice', 'hunter2').ok).toBe(false);
+  });
+
   it('drops a NickServ registration after flush + reload', async () => {
     const store = await loadD1ServicesStore(env.ACCOUNTS_DB, new FakeClock(NOW));
     store?.registerNick('alice', 'pw', 'a@x');
@@ -524,14 +537,18 @@ describe('D1ServicesStore — tolerance', () => {
     expect(snap.jupes).toEqual([]);
   });
 
-  it('skips rows with NULL fields in the all-TEXT tables (vhosts / read_markers)', async () => {
-    // Recreate the two all-TEXT tables without NOT NULL so a NULL field can
+  it('skips rows with NULL fields in the all-TEXT tables (vhosts / pending_vhosts / read_markers)', async () => {
+    // Recreate the all-TEXT tables without NOT NULL so a NULL field can
     // survive — exercises the typeof-string defensive skip for the loaders
     // whose INTEGER-corruption path is unreachable under SQLite affinity.
     await env.ACCOUNTS_DB.exec('DROP TABLE hostserv_vhosts');
     await env.ACCOUNTS_DB.exec(
       'CREATE TABLE hostserv_vhosts (account_key TEXT PRIMARY KEY, account TEXT, vhost TEXT)',
     );
+    await env.ACCOUNTS_DB.exec('DROP TABLE hostserv_pending_vhosts');
+    await env.ACCOUNTS_DB.exec(
+      'CREATE TABLE hostserv_pending_vhosts (account_key TEXT PRIMARY KEY, account TEXT, vhost TEXT)',
+    );
     await env.ACCOUNTS_DB.exec('DROP TABLE read_markers');
     await env.ACCOUNTS_DB.exec(
       'CREATE TABLE read_markers (account_key TEXT NOT NULL, channel_key TEXT NOT NULL, account TEXT, channel TEXT, msgid TEXT)',
@@ -541,6 +558,11 @@ describe('D1ServicesStore — tolerance', () => {
     )
       .bind('bad#v', null, 'cloak')
       .run();
+    await env.ACCOUNTS_DB.prepare(
+      'INSERT INTO hostserv_pending_vhosts (account_key, account, vhost) VALUES (?, ?, ?)',
+    )
+      .bind('bad#pv', 'someone', null)
+      .run();
     await env.ACCOUNTS_DB.prepare(
       'INSERT INTO read_markers (account_key, channel_key, account, channel, msgid) VALUES (?, ?, ?, ?, ?)',
     )
@@ -552,6 +574,7 @@ describe('D1ServicesStore — tolerance', () => {
     if (!store) throw new Error('services store failed to load');
     const snap = store.snapshot();
     expect(snap.vhosts).toEqual([]);
+    expect(snap.pendingVhosts).toEqual([]);
     expect(snap.readMarkers).toEqual([]);
   });
 
@@ -566,6 +589,34 @@ describe('D1ServicesStore — tolerance', () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// safeSelect — defensive catch block (real D1 bindings don't throw on
+// existing-table queries; the catch arm is unreachable through integration).
+// ---------------------------------------------------------------------------
+
+describe('safeSelect — defensive catch block', () => {
+  it('returns [] and logs when the underlying D1 query rejects', async () => {
+    // A misbehaving binding (transient unavailability, schema drift) would
+    // otherwise brick NickServ for the whole connection (the snapshot is
+    // cached for life). The catch arm logs to wrangler tail and degrades
+    // to an empty result.
+    const stub = {
+      prepare(): { all(): Promise<never> } {
+        return {
+          all: async () => {
+            throw new Error('simulated D1 outage');
+          },
+        };
+      },
+    };
+    const result = await safeSelect<{ x: unknown }>(
+      stub as unknown as Parameters<typeof safeSelect>[0],
+      'SELECT * FROM nicks',
+    );
+    expect(result).toEqual([]);
+  });
+});
+
 function emptySnapshot(): ServicesSnapshot {
   return {
     nicks: [],

package/packages/cf-adapter/tests/serialize.test.ts

@@ -306,4 +306,29 @@ describe('deserialize — migrate integration', () => {
     expect(state.userModes.wallops).toBe(true);
     expect(state.caps).toEqual(new Set(['server-time']));
   });
+
+  it('coalesces an explicit `secure: null` to false via the ?? fallback', () => {
+    // `migrate` only backfills `secure` when the key is absent (=== undefined);
+    // an explicit null survives and the `?? false` arm in `deserialize` must
+    // catch it. Mirrors a hand-edited storage row where someone wrote null.
+    const rec = {
+      version: 1,
+      id: 'c',
+      registration: 'registered' as const,
+      capNegotiating: false,
+      secure: null,
+      caps: [],
+      joinedChannels: [],
+      userModes: {
+        invisible: false,
+        oper: false,
+        wallops: false,
+        serverNotices: false,
+        tls: false,
+      },
+      lastSeen: 0,
+      connectedSince: 0,
+    };
+    expect(deserialize(rec).secure).toBe(false);
+  });
 });

package/packages/in-memory-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/in-memory-runtime",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "private": true,
   "description": "Single-process reference implementation of the IrcRuntime port, backed by Maps",
   "license": "BSD-3-Clause",

package/packages/irc-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/irc-core",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "private": true,
   "description": "Platform-agnostic IRC protocol core: parser, serializer, command reducers, state shapes",
   "license": "BSD-3-Clause",