Fix PHPStan, improve coverage to ~100% on new DNS classes

- Drop $apiToken property promotion (only used in constructor body; PHPStan property.onlyWritten)
- Add curl_* namespace stubs in tests/Pest.php to exercise JsonHttpClient::send()
  without a real HTTP server — same pattern as existing sleep() overrides
- Add 8 send() tests covering curl_init failure, connection errors, HTTP 4xx,
  and all HTTP method branches (GET, POST+body, POST-no-body, DELETE)
- Add propagationDelay sleep-branch test and real pollForTxtRecord() test
  (uses .invalid TLD for instant NXDOMAIN; fails open in ~1 s)

Author: bashgeek

src/Challenge/Dns/CloudflareDns01Handler.php

@@ -30,7 +30,7 @@ class CloudflareDns01Handler extends AbstractDns01Handler
     private JsonHttpClient $httpClient;
 
     public function __construct(
-        private readonly string $apiToken,
+        string $apiToken,
         private readonly ?string $zoneId = null,
         ?JsonHttpClient $httpClient = null,
     ) {

tests/Pest.php

@@ -36,6 +36,85 @@ function sleep(int $seconds): void
     }
 }
 
+// ── Override curl_* in the Challenge\Dns\Internal namespace (unit tests only) ──
+// JsonHttpClient::send() calls curl_*() without a backslash, so PHP resolves
+// them in the current namespace first. Defining stubs here lets unit tests
+// exercise the full send() code path without a real HTTP server.
+//
+// Activate a fixture by setting $GLOBALS['__test_curl'] to an array:
+//   init   => bool       (false = curl_init() failure; default: true)
+//   body   => string|false (false = connection error body; default: '')
+//   status => int        (HTTP status code; default: 200)
+//   error  => string     (curl_error() output; default: '')
+// Unset $GLOBALS['__test_curl'] (or leave it unset) to use real curl.
+
+namespace CoyoteCert\Challenge\Dns\Internal {
+    function curl_init(string $url = ''): object|false
+    {
+        if (!isset($GLOBALS['__test_curl'])) {
+            return \curl_init($url);
+        }
+
+        if (!($GLOBALS['__test_curl']['init'] ?? true)) {
+            return false;
+        }
+
+        return new \stdClass();
+    }
+
+    function curl_setopt_array(object|false $handle, array $options): bool
+    {
+        if (isset($GLOBALS['__test_curl'])) {
+            return true;
+        }
+
+        return \curl_setopt_array($handle, $options);
+    }
+
+    function curl_setopt(object|false $handle, int $option, mixed $value): bool
+    {
+        if (isset($GLOBALS['__test_curl'])) {
+            return true;
+        }
+
+        return \curl_setopt($handle, $option, $value);
+    }
+
+    function curl_exec(object|false $handle): string|bool
+    {
+        if (isset($GLOBALS['__test_curl'])) {
+            return $GLOBALS['__test_curl']['body'] ?? '';
+        }
+
+        return \curl_exec($handle);
+    }
+
+    function curl_getinfo(object|false $handle, int $option = 0): mixed
+    {
+        if (isset($GLOBALS['__test_curl'])) {
+            return $GLOBALS['__test_curl']['status'] ?? 200;
+        }
+
+        return \curl_getinfo($handle, $option);
+    }
+
+    function curl_error(object|false $handle): string
+    {
+        if (isset($GLOBALS['__test_curl'])) {
+            return $GLOBALS['__test_curl']['error'] ?? '';
+        }
+
+        return \curl_error($handle);
+    }
+
+    function curl_close(object|false $handle): void
+    {
+        if (!isset($GLOBALS['__test_curl'])) {
+            \curl_close($handle);
+        }
+    }
+}
+
 // ── Global helpers ────────────────────────────────────────────────────────────
 
 namespace {

tests/Unit/Challenge/Dns/AbstractDns01HandlerTest.php

@@ -109,6 +109,32 @@ public function name(string $domain): string
     expect($prop->getValue((new TestDns01Handler())->propagationTimeout(30)))->toBe(30);
 });
 
+it('propagationDelay executes the sleep branch when the delay is positive', function () {
+    $handler = (new TestDns01Handler())->propagationDelay(5);
+    $handler->deploy('example.com', 'tok', 'keyauth');
+
+    // sleep() is a no-op in the test namespace — verifies the branch runs cleanly.
+    expect($handler->deployed)->toHaveCount(1);
+});
+
+it('real pollForTxtRecord fails open when the DNS lookup cannot be satisfied', function () {
+    $handler = new class extends AbstractDns01Handler {
+        public function deploy(string $domain, string $token, string $keyAuth): void
+        {
+            $this->awaitPropagation($domain, $keyAuth);
+        }
+
+        public function cleanup(string $domain, string $token): void {}
+    };
+
+    // Does not override pollForTxtRecord() — exercises the real implementation.
+    // DNS fails for .invalid; propagationTimeout(1) keeps the poll window short.
+    // Fails open: no exception is thrown when the timeout is reached.
+    expect(
+        fn() => $handler->propagationTimeout(1)->deploy('test.invalid', '', 'no-such-record'),
+    )->not->toThrow(\Throwable::class);
+});
+
 // ── DNS propagation check ─────────────────────────────────────────────────────
 
 it('pollForTxtRecord is called by default after deploy', function () {

tests/Unit/Challenge/Dns/Internal/JsonHttpClientTest.php

@@ -146,3 +146,72 @@ function httpError(int $status): array
     expect(fn() => $client->request('GET', '/zones'))
         ->toThrow(ChallengeException::class, 'HTTP 500');
 });
+
+// ── Real send() via curl namespace stubs ──────────────────────────────────────
+// The following tests exercise JsonHttpClient::send() directly (no TestableJsonHttpClient
+// override). The curl_* stubs in tests/Pest.php intercept all curl calls so no
+// real HTTP connection is made. $GLOBALS['__test_curl'] activates the stubs;
+// afterEach() clears it so fixture state never leaks across tests.
+
+afterEach(function () {
+    unset($GLOBALS['__test_curl']);
+});
+
+it('send() throws when curl fails to initialise', function () {
+    $GLOBALS['__test_curl'] = ['init' => false];
+    $client                 = new JsonHttpClient('https://api.example.com');
+
+    expect(fn() => $client->request('GET', '/zones'))
+        ->toThrow(ChallengeException::class, 'Failed to initialise cURL');
+});
+
+it('send() throws on connection error', function () {
+    $GLOBALS['__test_curl'] = ['body' => false, 'status' => 0, 'error' => 'Connection timed out'];
+    $client                 = new JsonHttpClient('https://api.example.com');
+
+    expect(fn() => $client->request('GET', '/zones'))
+        ->toThrow(ChallengeException::class, 'Connection timed out');
+});
+
+it('send() decodes a successful JSON response', function () {
+    $GLOBALS['__test_curl'] = ['body' => '{"id":"zone-1"}', 'status' => 200];
+    $client                 = new JsonHttpClient('https://api.example.com');
+
+    expect($client->request('GET', '/zones'))->toBe(['id' => 'zone-1']);
+});
+
+it('send() returns empty array for an empty body', function () {
+    $GLOBALS['__test_curl'] = ['body' => '', 'status' => 200];
+    $client                 = new JsonHttpClient('https://api.example.com');
+
+    expect($client->request('DELETE', '/records/1'))->toBe([]);
+});
+
+it('send() throws on HTTP 4xx from the real send path', function () {
+    $GLOBALS['__test_curl'] = ['body' => '{"error":"forbidden"}', 'status' => 403];
+    $client                 = new JsonHttpClient('https://api.example.com');
+
+    expect(fn() => $client->request('POST', '/zones'))
+        ->toThrow(ChallengeException::class, 'HTTP 403');
+});
+
+it('send() exercises the POST-with-body curl branch', function () {
+    $GLOBALS['__test_curl'] = ['body' => '{"created":true}', 'status' => 200];
+    $client                 = new JsonHttpClient('https://api.example.com');
+
+    expect($client->request('POST', '/records', ['type' => 'TXT']))->toBe(['created' => true]);
+});
+
+it('send() exercises the POST-without-body curl branch', function () {
+    $GLOBALS['__test_curl'] = ['body' => '{"ok":true}', 'status' => 200];
+    $client                 = new JsonHttpClient('https://api.example.com');
+
+    expect($client->request('POST', '/trigger'))->toBe(['ok' => true]);
+});
+
+it('send() exercises the DELETE curl branch', function () {
+    $GLOBALS['__test_curl'] = ['body' => '', 'status' => 200];
+    $client                 = new JsonHttpClient('https://api.example.com');
+
+    expect($client->request('DELETE', '/records/42'))->toBe([]);
+});