serverless-ircd 0.9.0 → 0.11.0

package/packages/cf-adapter/tests/connection-do-counter.test.ts

@@ -0,0 +1,165 @@
+/**
+ * `ConnectionDO` × `CounterDO` — admission-slot teardown wiring.
+ *
+ * TDD outline:
+ *   "Red: the counter is not decremented on close; assert it is. Green:
+ *    decrement on close + error. Red: a crashed DO leaves the counter
+ *    sticky; assert the reconcile sweep reduces it (covered in
+ *    counter-do.test.ts — here we assert the live-side of that
+ *    contract: the PING alarm heartbeats the entry so the sweep spares
+ *    healthy connections)."
+ *
+ * The worker edge registers each upgrade in the global counter keyed by
+ * the ConnectionDO's hex id. These tests pre-register that key directly
+ * (simulating the worker), drive every ConnectionDO teardown path, and
+ * assert the slot is released.
+ */
+
+import { env, reset, runDurableObjectAlarm, runInDurableObject } from 'cloudflare:test';
+import { afterEach, describe, expect, it } from 'vitest';
+import { COUNTER_INSTANCE_NAME, DEFAULT_CONNECTION_TTL_MS } from '../src/counter-do';
+import type { CounterRpc } from '../src/env';
+
+declare global {
+  namespace Cloudflare {
+    interface Env {
+      CONNECTION_DO: DurableObjectNamespace;
+      COUNTER_DO: DurableObjectNamespace;
+    }
+  }
+}
+
+afterEach(async () => {
+  await reset();
+});
+
+/** RPC handle on the single global counter instance. */
+function counter(): CounterRpc {
+  const stub = env.COUNTER_DO.get(env.COUNTER_DO.idFromName(COUNTER_INSTANCE_NAME));
+  return stub as unknown as CounterRpc;
+}
+
+/** Stub for the ConnectionDO instance named `name`. */
+function connStub(name: string): DurableObjectStub {
+  return env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName(name));
+}
+
+/**
+ * The canonical conn id used by the admission counter: the ConnectionDO's
+ * hex id. This is exactly what the worker registers
+ * (`idFromName(uuid).toString()`) and what the DO computes from `ctx.id`,
+ * so both sides agree on the key without passing it explicitly.
+ */
+function hexId(name: string): string {
+  return env.CONNECTION_DO.idFromName(name).toString();
+}
+
+/** Opens a real WebSocket to the ConnectionDO named `name`. */
+async function openSocket(name: string): Promise<WebSocket> {
+  const response = await connStub(name).fetch('https://do/upgrade', {
+    headers: { Upgrade: 'websocket' },
+  });
+  const ws = response.webSocket;
+  if (ws === undefined || ws === null) {
+    throw new Error('ConnectionDO.fetch did not return a WebSocket');
+  }
+  ws.accept();
+  await new Promise<void>((resolve) => setTimeout(resolve, 0));
+  return ws as WebSocket;
+}
+
+/** Simulates the worker edge: registers the connection's slot. */
+async function registerSlot(name: string, now?: number): Promise<void> {
+  const result = await counter().admit(hexId(name), 10_000, now);
+  if (!result.admitted) throw new Error('test setup admit unexpectedly rejected');
+}
+
+describe('ConnectionDO — admission-slot release on teardown', () => {
+  it('a clean close releases the slot (webSocketClose → tearDown)', async () => {
+    await registerSlot('slot-close-1');
+    const ws = await openSocket('slot-close-1');
+    expect(await counter().liveCount()).toBe(1);
+
+    // Deterministic close-teardown (the platform's close event lags in
+    // the test runtime; __triggerClose runs the same code path).
+    await runInDurableObject(connStub('slot-close-1'), async (instance: unknown) => {
+      const doi = instance as { __triggerClose?: () => Promise<void> };
+      await doi.__triggerClose?.();
+    });
+
+    expect(await counter().liveCount()).toBe(0);
+    ws.close();
+  });
+
+  it('a transport error releases the slot (webSocketError → tearDown)', async () => {
+    await registerSlot('slot-error-1');
+    const ws = await openSocket('slot-error-1');
+    expect(await counter().liveCount()).toBe(1);
+
+    await runInDurableObject(connStub('slot-error-1'), async (instance: unknown) => {
+      const doi = instance as { __triggerWsError?: (error: unknown) => Promise<void> };
+      await doi.__triggerWsError?.(new Error('boom'));
+    });
+
+    expect(await counter().liveCount()).toBe(0);
+    ws.close();
+  });
+
+  it('a socketless teardown releases the slot (disconnect RPC → tearDownNoSocket)', async () => {
+    await registerSlot('slot-nosock-1');
+    expect(await counter().liveCount()).toBe(1);
+
+    await (
+      connStub('slot-nosock-1') as unknown as { disconnect: () => Promise<void> }
+    ).disconnect();
+
+    expect(await counter().liveCount()).toBe(0);
+  });
+
+  it('the PING alarm heartbeats the slot so the TTL reconcile spares live connections', async () => {
+    // Register with a timestamp that is ALREADY stale — only the alarm's
+    // heartbeat can rescue the entry from the next sweep. This is the
+    // live-side complement of the crashed-DO reap test: a ConnectionDO
+    // that keeps running must keep its slot alive.
+    await registerSlot('slot-beat-1', Date.now() - DEFAULT_CONNECTION_TTL_MS - 60_000);
+    const ws = await openSocket('slot-beat-1');
+
+    expect(await runDurableObjectAlarm(connStub('slot-beat-1'))).toBe(true);
+
+    const swept = await counter().sweep();
+    expect(swept.reaped).toBe(0);
+    expect(swept.live).toBe(1);
+    ws.close();
+  });
+
+  it('an idle-timeout alarm teardown releases the slot (alarm → tearDown)', async () => {
+    await registerSlot('slot-idle-1');
+    const ws = await openSocket('slot-idle-1');
+    expect(await counter().liveCount()).toBe(1);
+
+    // Backdate lastSeen past the PONG timeout so the alarm takes the
+    // idle-teardown branch.
+    await runInDurableObject(connStub('slot-idle-1'), async (instance: unknown) => {
+      const doi = instance as { __backdateLastSeen?: (ms: number) => Promise<void> };
+      await doi.__backdateLastSeen?.(48 * 60 * 60 * 1000);
+    });
+    expect(await runDurableObjectAlarm(connStub('slot-idle-1'))).toBe(true);
+
+    expect(await counter().liveCount()).toBe(0);
+    ws.close();
+  });
+
+  it('teardown of a never-registered connection is a harmless no-op', async () => {
+    // Direct-to-DO paths (integration harness, RPC callers) never
+    // registered a slot; teardown must not throw and the counter must
+    // stay untouched.
+    const ws = await openSocket('slot-unreg-1');
+    await runInDurableObject(connStub('slot-unreg-1'), async (instance: unknown) => {
+      const doi = instance as { __triggerClose?: () => Promise<void> };
+      await doi.__triggerClose?.();
+    });
+
+    expect(await counter().liveCount()).toBe(0);
+    ws.close();
+  });
+});

package/packages/cf-adapter/tests/connection-do-coverage.test.ts

@@ -0,0 +1,460 @@
+/**
+ * Coverage-focused tests for {@link ConnectionDO}.
+ *
+ * Each test pins a residual branch that the main `connection-do.test.ts`
+ * suite does not naturally drive:
+ *
+ *   - non-WebSocket `fetch` (426 response)
+ *   - mTLS cert-subject capture + actor wiring
+ *   - `webSocketError` event handler
+ *   - `deliver` over a non-OPEN socket (lazy prune signal)
+ *   - `sendOutbound` no-op on a non-OPEN socket
+ *   - `spec-binary` outbound path (UTF-8 binary frames)
+ *   - `__triggerClose` with a live socket (the `tearDown(ws)` branch)
+ *   - `disconnect()` RPC on a DO with no socket (the `tearDownNoSocket`
+ *     branch)
+ *
+ * Tests run inside real workerd via miniflare so DO hibernation, storage,
+ * and RPC behave as in production. Each test gets isolated storage.
+ */
+
+import { env, runInDurableObject } from 'cloudflare:test';
+import { describe, expect, it } from 'vitest';
+
+declare global {
+  namespace Cloudflare {
+    interface Env {
+      CONNECTION_DO: DurableObjectNamespace;
+    }
+  }
+}
+
+type WsMode = 'legacy' | 'spec-text' | 'spec-binary';
+
+/**
+ * Opens a WebSocket to the named ConnectionDO, accepts it, and returns a
+ * non-null `WebSocket`. Centralizes the upgrade + null-guard so type
+ * narrowing is preserved across awaits in the call sites below.
+ */
+async function openWs(connId: string, protocols?: string): Promise<WebSocket> {
+  const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName(connId));
+  const headers: Record<string, string> = { Upgrade: 'websocket' };
+  if (protocols !== undefined) {
+    headers['Sec-WebSocket-Protocol'] = protocols;
+  }
+  const response = await stub.fetch('https://do/upgrade', { headers });
+  const ws = response.webSocket;
+  if (ws === undefined || ws === null) {
+    throw new Error('upgrade did not return a WebSocket');
+  }
+  ws.accept();
+  return ws;
+}
+
+/** Minimal fake WebSocket whose readyState and sent bytes are controlled. */
+class FakeWs {
+  constructor(readonly readyState: number) {}
+  readonly sent: unknown[] = [];
+  closed = false;
+  send(data: unknown): void {
+    this.sent.push(data);
+  }
+  close(): void {
+    this.closed = true;
+  }
+}
+
+describe('ConnectionDO — fetch rejects non-WebSocket upgrades with 426', () => {
+  it('returns 426 Expected WebSocket when no Upgrade header is present', async () => {
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-426'));
+    const response = await stub.fetch('https://do/upgrade', {
+      headers: { 'Content-Type': 'text/plain' },
+    });
+    expect(response.status).toBe(426);
+    expect(await response.text()).toBe('Expected WebSocket');
+  });
+});
+
+describe('ConnectionDO — mTLS cert subject capture at upgrade', () => {
+  it('captures cf.tlsClientAuthCertSubject when present on the request', async () => {
+    // The workerd test runtime strips request.cf across the DO RPC
+    // boundary, so the inline fetch path can't be exercised directly.
+    // We drive the same captureMtlsSubject logic via the test seam.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-mtls-fetch'));
+    const fake = { cf: { tlsClientAuthCertSubject: 'CN=mtls-fetch-alice' } } as unknown as Request;
+    await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as { __captureMtlsSubjectForTest?: (request: Request) => void };
+      doi.__captureMtlsSubjectForTest?.(fake);
+    });
+    const captured = await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as { __peekMtlsCertSubject?: () => Promise<string | undefined> };
+      return doi.__peekMtlsCertSubject?.();
+    });
+    expect(captured).toBe('CN=mtls-fetch-alice');
+  });
+});
+
+describe('ConnectionDO — mTLS cert subject seeds InMemoryMtlsIdentityProvider in buildActor', () => {
+  it('constructs the actor with mtlsIdentity when __setMtlsCertSubject is set', async () => {
+    // The buildActor path builds an InMemoryMtlsIdentityProvider when
+    // mtlsCertSubject is non-undefined. Production captures the subject
+    // at upgrade time via request.cf; the workerd test runtime does not
+    // surface cf, so we set it via the __setMtlsCertSubject test hook
+    // and then drive a frame so buildActor runs.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-mtls-build'));
+    const ws = await openWs('conn-mtls-build');
+    await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as { __setMtlsCertSubject?: (s: string | undefined) => void };
+      doi.__setMtlsCertSubject?.('CN=mtls-alice');
+    });
+    // Drive a frame so buildActor runs with mtlsCertSubject set. The
+    // registration handshake completes; the actor's mtlsIdentity arm
+    // has now executed even though no AUTHENTICATE EXTERNAL follows.
+    ws.send('NICK mtls-build\r\n');
+    ws.send('USER mtls-build 0 * :mtls-build\r\n');
+    await new Promise<void>((r) => setTimeout(r, 80));
+    ws.close();
+  });
+});
+
+describe('ConnectionDO — webSocketError runs the standard teardown', () => {
+  it('invokes tearDown when webSocketError fires and the suppression hook is unset', async () => {
+    // The webSocketError handler mirrors webSocketClose: same tearDown
+    // path unless suppressed. The platform fires it asynchronously on
+    // transport errors; the __triggerWsError test hook calls it
+    // deterministically against the DO's own attached socket.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-wserror'));
+    const ws = await openWs('conn-wserror');
+    ws.send('NICK wserr-alice\r\n');
+    ws.send('USER wserr-alice 0 * :wserr-alice\r\n');
+    await new Promise<void>((r) => setTimeout(r, 50));
+
+    await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as { __triggerWsError?: (error: unknown) => Promise<void> };
+      await doi.__triggerWsError?.(new Error('synthetic'));
+    });
+    ws.close();
+  });
+
+  it('webSocketError is a no-op when __suppressCloseTeardown is set', async () => {
+    // The same suppression hook used by webSocketClose also gates
+    // webSocketError so a lost-error condition is owned by the alarm.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-wserror-suppressed'));
+    const ws = await openWs('conn-wserror-suppressed');
+    await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as {
+        __suppressCloseTeardownHook?: () => void;
+        __triggerWsError?: (error: unknown) => Promise<void>;
+      };
+      doi.__suppressCloseTeardownHook?.();
+      // Must not reject and must not run tearDown (no nick release side
+      // effects). The test asserts only that the handler returns
+      // cleanly — the coverage tracks that the suppression arm fired.
+      await doi.__triggerWsError?.(new Error('synthetic'));
+    });
+    ws.close();
+  });
+});
+
+describe('ConnectionDO — deliver skips non-OPEN sockets', () => {
+  it('returns delivered:0 when the socket is not in OPEN state', async () => {
+    // After the client closes, the DO's `ctx.getWebSockets()` may still
+    // return the socket transiently; its readyState is CLOSING/CLOSED.
+    // The readyState guard in `tryDeliver` skips it, returning false.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-deliver-closed'));
+    const ws = await openWs('conn-deliver-closed');
+    ws.close();
+    // Give the runtime a tick to propagate the close.
+    await new Promise<void>((r) => setTimeout(r, 50));
+    const deliverResult = await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as {
+        deliver?: (lines: Array<{ text: string }>) => Promise<{ delivered: number }>;
+      };
+      return doi.deliver?.([{ text: ':srv NOTICE * :probe' }]);
+    });
+    expect(deliverResult).toEqual({ delivered: 0 });
+  });
+});
+
+describe('ConnectionDO — IRCv3 binary.ircv3.net outbound path', () => {
+  it('delivers each outbound IRC line as a UTF-8 binary WS message', async () => {
+    // spec-binary mode uses TextEncoder + ws.send(Uint8Array) instead
+    // of the spec-text path's string send. Opening a binary.ircv3.net
+    // connection and completing registration causes the DO to emit
+    // several numerics; each is delivered as a binary frame.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-spec-binary-out'));
+    const response = await stub.fetch('https://do/upgrade', {
+      headers: { Upgrade: 'websocket', 'Sec-WebSocket-Protocol': 'binary.ircv3.net' },
+    });
+    expect(response.headers.get('Sec-WebSocket-Protocol')).toBe('binary.ircv3.net');
+    const ws = response.webSocket;
+    if (ws === undefined || ws === null) {
+      throw new Error('upgrade did not return a WebSocket');
+    }
+    ws.accept();
+    const received: ArrayBuffer[] = [];
+    ws.addEventListener('message', (ev: MessageEvent) => {
+      const d = ev.data;
+      if (d instanceof ArrayBuffer) received.push(d);
+    });
+    await new Promise<void>((r) => setTimeout(r, 10));
+    ws.send('NICK bin-alice\r\n');
+    ws.send('USER bin-alice 0 * :bin-alice\r\n');
+    // Wait for the 001 welcome (delivered as a binary frame).
+    const start = Date.now();
+    while (Date.now() - start < 1500) {
+      const lines = received.map((b) => new TextDecoder().decode(b));
+      if (lines.some((l) => l.includes(' 001 '))) break;
+      await new Promise<void>((r) => setTimeout(r, 30));
+    }
+    expect(received.length).toBeGreaterThan(0);
+    const decoded = received.map((b) => new TextDecoder().decode(b));
+    expect(decoded.some((l) => l.includes(' 001 '))).toBe(true);
+    ws.close();
+  });
+});
+
+describe('ConnectionDO — __triggerClose with a live socket', () => {
+  it('runs tearDown(ws) when a WebSocket is still attached', async () => {
+    // The existing connection-do suite exercises __triggerClose only
+    // after client.close(), when the socket has already dropped. This
+    // case drives the else arm: __triggerClose with a still-live socket
+    // invokes tearDown(ws) directly.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-trigger-live'));
+    const ws = await openWs('conn-trigger-live');
+    ws.send('NICK trigger-alice\r\n');
+    ws.send('USER trigger-alice 0 * :trigger-alice\r\n');
+    await new Promise<void>((r) => setTimeout(r, 50));
+
+    await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as { __triggerClose?: () => Promise<void> };
+      await doi.__triggerClose?.();
+    });
+
+    // The tearDown path closes the server-side WS; poll readyState
+    // rather than relying on the close event reaching the client.
+    const start = Date.now();
+    while (Date.now() - start < 3000) {
+      if (ws.readyState === WebSocket.CLOSING || ws.readyState === WebSocket.CLOSED) break;
+      await new Promise<void>((r) => setTimeout(r, 50));
+    }
+    expect([WebSocket.CLOSING, WebSocket.CLOSED]).toContain(ws.readyState);
+  });
+});
+
+describe('ConnectionDO — disconnect() RPC with no live socket', () => {
+  it('runs tearDownNoSocket when the DO has no attached WebSocket', async () => {
+    // ConnectionDO.disconnect is the cross-connection RPC entry point
+    // (KICK, operator-driven kill). When the target socket has already
+    // dropped (lost close event in production), the no-socket teardown
+    // path still releases the nick and fans the QUIT out.
+    //
+    // We seed a tiny bit of state first (so loadState returns a real
+    // record rather than a fresh default), then invoke disconnect with
+    // no live socket.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-disc-no-socket'));
+    // Open + close a socket quickly so the DO persists a state record.
+    const ws = await openWs('conn-disc-no-socket');
+    ws.send('NICK disc-alice\r\n');
+    ws.send('USER disc-alice 0 * :disc-alice\r\n');
+    await new Promise<void>((r) => setTimeout(r, 50));
+    ws.close();
+    // Wait for the close to propagate so getWebSockets() returns empty.
+    await new Promise<void>((r) => setTimeout(r, 100));
+
+    // Invoke disconnect via RPC; with no live socket the no-socket
+    // path runs.
+    const rpc = stub as unknown as { disconnect(reason?: string): Promise<void> };
+    await expect(rpc.disconnect('Kicked')).resolves.toBeUndefined();
+  });
+
+  it('tearDownNoSocket initializes channelAccess when no prior frame ran', async () => {
+    // The `if (this.channelAccess === undefined)` arm in
+    // tearDownNoSocket: a never-messaged DO has not run buildActor yet,
+    // so channelAccess is undefined and the no-socket teardown seeds
+    // it before constructing the actor.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-disc-fresh-do'));
+    const rpc = stub as unknown as { disconnect(reason?: string): Promise<void> };
+    await expect(rpc.disconnect('Kicked')).resolves.toBeUndefined();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Direct seam tests — exercised with a fake non-OPEN WebSocket so the
+// readyState guards (unreachable via real RPC) are covered.
+// ---------------------------------------------------------------------------
+
+describe('ConnectionDO — readyState guards (direct seam)', () => {
+  it('deliverToSockets counts only OPEN sockets (mixed list)', async () => {
+    // Drives the false arm of the tryDeliver ternary inside the loop:
+    // a fake CLOSING socket returns false and the count skips it.
+    // The real `ctx.getWebSockets()` only returns OPEN sockets in the
+    // test runtime, so this seam is the only way to exercise the
+    // mixed case. Both fakes here are non-OPEN so the loop body
+    // avoids wsFrameMode (which requires a real hibernated WS).
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-deliver-mixed'));
+    const ws = await openWs('conn-deliver-mixed');
+
+    const result = await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as {
+        deliverToSockets?: (
+          sockets: WebSocket[],
+          lines: Array<{ text: string }>,
+        ) => { delivered: number };
+      };
+      const a = new FakeWs(WebSocket.CLOSING) as unknown as WebSocket;
+      const b = new FakeWs(WebSocket.CLOSED) as unknown as WebSocket;
+      return doi.deliverToSockets?.([a, b], [{ text: 'x' }]);
+    });
+    expect(result).toEqual({ delivered: 0 });
+    ws.close();
+  });
+
+  it('tryDeliver returns false and does not write when the socket is not OPEN', async () => {
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-trydeliver-closed'));
+    const ws = await openWs('conn-trydeliver-closed');
+
+    const result = await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as {
+        tryDeliver?: (ws: WebSocket, lines: Array<{ text: string }>) => boolean;
+      };
+      const fake = new FakeWs(WebSocket.CLOSING) as unknown as WebSocket;
+      return doi.tryDeliver?.(fake, [{ text: ':srv NOTICE * :probe' }]);
+    });
+    expect(result).toBe(false);
+    ws.close();
+  });
+
+  it('tryDeliver writes and returns true when the socket is OPEN', async () => {
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-trydeliver-open'));
+    const ws = await openWs('conn-trydeliver-open');
+
+    // The real OPEN WS goes through tryDeliver via the deliver RPC.
+    // We exercise the OPEN arm directly via the seam: pass the live WS
+    // back into the DO context through runInDurableObject isn't possible
+    // (different DO context). Instead, run deliver() against the live
+    // socket — that already exercises the OPEN arm of tryDeliver.
+    const deliver = stub as unknown as {
+      deliver(lines: Array<{ text: string }>): Promise<{ delivered: number }>;
+    };
+    const deliverResult = await deliver.deliver([{ text: ':srv NOTICE conn-trydeliver-open :hi' }]);
+    expect(deliverResult.delivered).toBe(1);
+    ws.close();
+  });
+
+  it('sendOutbound early-returns without writing when the socket is not OPEN', async () => {
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-sendoutbound-closed'));
+    const ws = await openWs('conn-sendoutbound-closed');
+
+    const fake = new FakeWs(WebSocket.CLOSED);
+    await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as {
+        __sendOutboundForTest?: (
+          ws: WebSocket,
+          lines: Array<{ text: string }>,
+          mode: WsMode,
+        ) => void;
+      };
+      doi.__sendOutboundForTest?.(
+        fake as unknown as WebSocket,
+        [{ text: ':srv NOTICE * :probe' }],
+        'legacy',
+      );
+    });
+    // Nothing was written (the guard returned before ws.send).
+    expect(fake.sent.length).toBe(0);
+    ws.close();
+  });
+
+  it('writeDisconnect with a reason writes the ERROR Closing link line', async () => {
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-writedisc-reason'));
+    const ws = await openWs('conn-writedisc-reason');
+
+    // Use a fake OPEN socket so sendOutbound writes through; the
+    // __writeDisconnectForTest seam then calls ws.close on the fake.
+    const fake = new FakeWs(WebSocket.OPEN);
+    await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as {
+        __writeDisconnectForTest?: (ws: WebSocket, mode: WsMode, reason?: string) => void;
+      };
+      doi.__writeDisconnectForTest?.(fake as unknown as WebSocket, 'legacy', 'Kicked');
+    });
+    expect(fake.sent.length).toBe(1);
+    expect(String(fake.sent[0])).toContain('ERROR :Closing link: (Kicked)');
+    expect(fake.closed).toBe(true);
+    ws.close();
+  });
+
+  it('writeDisconnect without a reason skips the ERROR line and still closes', async () => {
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-writedisc-noreason'));
+    const ws = await openWs('conn-writedisc-noreason');
+
+    const fake = new FakeWs(WebSocket.OPEN);
+    await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as {
+        __writeDisconnectForTest?: (ws: WebSocket, mode: WsMode, reason?: string) => void;
+      };
+      doi.__writeDisconnectForTest?.(fake as unknown as WebSocket, 'legacy');
+    });
+    expect(fake.sent.length).toBe(0);
+    expect(fake.closed).toBe(true);
+    ws.close();
+  });
+
+  it('closeIfStillOpen closes an OPEN socket', async () => {
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-closeifopen-open'));
+    const ws = await openWs('conn-closeifopen-open');
+
+    const fake = new FakeWs(WebSocket.OPEN);
+    await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as { __closeIfStillOpenForTest?: (ws: WebSocket) => void };
+      doi.__closeIfStillOpenForTest?.(fake as unknown as WebSocket);
+    });
+    expect(fake.closed).toBe(true);
+    ws.close();
+  });
+
+  it('closeIfStillOpen is a no-op on a CLOSED socket', async () => {
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-closeifopen-closed'));
+    const ws = await openWs('conn-closeifopen-closed');
+
+    const fake = new FakeWs(WebSocket.CLOSED);
+    await runInDurableObject(stub, async (instance: unknown) => {
+      const doi = instance as { __closeIfStillOpenForTest?: (ws: WebSocket) => void };
+      doi.__closeIfStillOpenForTest?.(fake as unknown as WebSocket);
+    });
+    expect(fake.closed).toBe(false);
+    ws.close();
+  });
+});
+
+describe('ConnectionDO — __triggerWsError with no socket', () => {
+  it('is a no-op when no WebSocket is attached', async () => {
+    // The "no socket attached" branch of __triggerWsError: a never-opened
+    // DO has no live WebSocket, so the hook returns without invoking
+    // webSocketError. Covers the `if (ws === undefined) return;` guard.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-wserror-nosocket'));
+    await expect(
+      runInDurableObject(stub, async (instance: unknown) => {
+        const doi = instance as { __triggerWsError?: (error: unknown) => Promise<void> };
+        await doi.__triggerWsError?.(new Error('nothing to close'));
+      }),
+    ).resolves.toBeUndefined();
+  });
+});
+
+describe('ConnectionDO — flushServices no-op when services are unbound', () => {
+  it('does not reject when services is undefined (e.g. binding absent)', async () => {
+    // flushServices guards `if (this.services === undefined) return;`.
+    // The D1 binding is present in the test env, so the loader resolves
+    // a store on the first frame; to exercise the undefined arm we
+    // invoke flushServices on a never-touched DO before any frame runs.
+    const stub = env.CONNECTION_DO.get(env.CONNECTION_DO.idFromName('conn-flush-empty'));
+    await expect(
+      runInDurableObject(stub, async (instance: unknown) => {
+        const doi = instance as { __flushServicesForTest?: () => Promise<void> };
+        await doi.__flushServicesForTest?.();
+      }),
+    ).resolves.toBeUndefined();
+  });
+});