serverless-ircd 0.7.0 → 0.8.0

package/packages/irc-core/tests/commands/chanserv.test.ts

@@ -0,0 +1,1668 @@
+import { describe, expect, it } from 'vitest';
+import {
+  CHANSERV_NICK,
+  DEFAULT_CHANNEL_LEVELS,
+  SHORTHAND_LEVELS,
+  chanservReducer,
+  positiveMlockLetters,
+} from '../../src/commands/chanserv';
+import type { Effect as EffectType } from '../../src/effects';
+import type { ServicesStore } from '../../src/ports';
+import {
+  EmptyMotdProvider,
+  FakeClock,
+  InMemoryServicesStore,
+  SequentialIdFactory,
+} from '../../src/ports';
+import type { IrcMessage } from '../../src/protocol/messages';
+import { type ConnectionState, createConnection } from '../../src/state/connection';
+import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
+
+const NOW = 1_700_000_000_000;
+
+const serverConfig: ServerConfig = {
+  serverName: 'irc.example.com',
+  networkName: 'ExampleNet',
+  maxChannelsPerUser: 30,
+  maxTargetsPerCommand: 10,
+  maxListEntries: 50,
+  nickLen: 30,
+  channelLen: 50,
+  topicLen: 390,
+  quitMessage: 'Client Quit',
+};
+
+function makeConn(id = 'c1', nick = 'alice'): ConnectionState {
+  const s = createConnection({ id, connectedSince: 0 });
+  s.nick = nick;
+  s.user = nick;
+  s.host = 'example.com';
+  s.realname = nick;
+  s.registration = 'registered';
+  return s;
+}
+
+function makeCtx(
+  state: ConnectionState,
+  services?: ServicesStore,
+  clock = new FakeClock(NOW),
+): Ctx {
+  return buildCtx({
+    serverConfig,
+    clock,
+    ids: new SequentialIdFactory(),
+    motd: EmptyMotdProvider,
+    connection: state,
+    ...(services !== undefined ? { services } : {}),
+  });
+}
+
+function privmsg(body: string): IrcMessage {
+  return { command: 'PRIVMSG', params: [CHANSERV_NICK, body], tags: {} };
+}
+
+/** Extracts the text of every Send line emitted by the reducer. */
+function sentTexts(effects: EffectType[]): string[] {
+  return effects.flatMap((e) => (e.tag === 'Send' ? e.lines.map((l) => l.text) : []));
+}
+
+describe('chanservReducer — REGISTER', () => {
+  it('registers a fresh channel for an identified founder and sets +r', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('REGISTER #home'), ctx);
+
+    expect(services.getChannelFounder('#home')).toBe('alice');
+    const applyDeltas = out.effects.filter((e) => e.tag === 'ApplyChannelDelta');
+    expect(applyDeltas.length).toBeGreaterThan(0);
+    for (const e of applyDeltas) {
+      if (e.tag === 'ApplyChannelDelta') {
+        const changes = e.delta.modeChanges ?? [];
+        expect(changes).toContainEqual({ mode: 'registered', set: true });
+      }
+    }
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Channel #home is now registered.',
+    );
+  });
+
+  it('rejects REGISTER when the connection is not identified', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('REGISTER #home'), ctx);
+
+    expect(services.getChannelFounder('#home')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :You must identify before registering a channel.',
+    );
+  });
+
+  it('rejects REGISTER on an already-registered channel', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('REGISTER #home'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Channel #home is already registered.',
+    );
+  });
+
+  it('rejects REGISTER with missing channel parameter', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('REGISTER'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: REGISTER <#channel>',
+    );
+  });
+
+  it('rejects REGISTER with an invalid channel name', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('REGISTER bogus'), ctx);
+
+    expect(services.getChannelFounder('bogus')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: REGISTER <#channel>',
+    );
+  });
+
+  it('rejects REGISTER with a channel name longer than channelLen', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const longName = `#${'a'.repeat(60)}`;
+    const out = chanservReducer(conn, privmsg(`REGISTER ${longName}`), ctx);
+
+    expect(services.getChannelFounder(longName)).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: REGISTER <#channel>',
+    );
+  });
+
+  it('returns a help NOTICE when no body is supplied', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(
+      conn,
+      { command: 'PRIVMSG', params: [CHANSERV_NICK], tags: {} },
+      ctx,
+    );
+
+    expect(sentTexts(out.effects).some((t) => t.includes('Available commands'))).toBe(true);
+  });
+
+  it('returns a NOTICE when no services store is bound', () => {
+    const conn = makeConn();
+    const ctx = makeCtx(conn);
+
+    const out = chanservReducer(conn, privmsg('REGISTER #home'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Services are not available on this server.',
+    );
+  });
+
+  it('updates lastSeen to ctx.clock.now()', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services, new FakeClock(NOW + 500));
+
+    chanservReducer(conn, privmsg('INFO #home'), ctx);
+
+    expect(conn.lastSeen).toBe(NOW + 500);
+  });
+});
+
+// ============================================================================
+// DROP
+// ============================================================================
+
+describe('chanservReducer — DROP', () => {
+  it('drops a registered channel when invoked by the founder', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('DROP #home'), ctx);
+
+    expect(services.getChannelFounder('#home')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Channel #home has been dropped.',
+    );
+    // DROP clears the services-derived channel modes (r/R/M).
+    const applyDeltas = out.effects.filter((e) => e.tag === 'ApplyChannelDelta');
+    expect(applyDeltas.length).toBeGreaterThan(0);
+    for (const e of applyDeltas) {
+      if (e.tag === 'ApplyChannelDelta') {
+        const changes = e.delta.modeChanges ?? [];
+        expect(changes).toContainEqual({ mode: 'registered', set: false });
+        expect(changes).toContainEqual({ mode: 'blockUnidentified', set: false });
+        expect(changes).toContainEqual({ mode: 'moderatedIdent', set: false });
+      }
+    }
+  });
+
+  it('rejects DROP when the connection is not identified', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('DROP #home'), ctx);
+
+    expect(services.getChannelFounder('#home')).toBe('alice');
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :You must identify before dropping a channel.',
+    );
+  });
+
+  it('rejects DROP from a non-founder identified account', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'bob';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('DROP #home'), ctx);
+
+    expect(services.getChannelFounder('#home')).toBe('alice');
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Only the founder of #home may drop it.',
+    );
+  });
+
+  it('rejects DROP on an unregistered channel', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('DROP #home'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Channel #home is not registered.',
+    );
+  });
+
+  it('rejects DROP with missing channel parameter', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('DROP'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: DROP <#channel>',
+    );
+  });
+});
+
+// ============================================================================
+// INFO
+// ============================================================================
+
+describe('chanservReducer — INFO', () => {
+  it('reports info for a registered channel', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('INFO #home'), ctx);
+
+    const texts = sentTexts(out.effects);
+    expect(texts).toContain(':ChanServ!ChanServ@services NOTICE alice :Channel: #home');
+    expect(texts).toContain(':ChanServ!ChanServ@services NOTICE alice :Founder: alice');
+  });
+
+  it('reports not-registered for an unknown channel', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('INFO #home'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Channel #home is not registered.',
+    );
+  });
+
+  it('rejects INFO with missing channel parameter', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('INFO'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: INFO <#channel>',
+    );
+  });
+});
+
+// ============================================================================
+// SET FOUNDER
+// ============================================================================
+
+describe('chanservReducer — SET FOUNDER', () => {
+  it('transfers the founder to a registered nick account', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('SET FOUNDER #home bob'), ctx);
+
+    expect(services.getChannelFounder('#home')).toBe('bob');
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Founder for #home is now set to bob.',
+    );
+  });
+
+  it('rejects SET FOUNDER when target nick is not registered', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('SET FOUNDER #home ghost'), ctx);
+
+    expect(services.getChannelFounder('#home')).toBe('alice');
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Nick ghost is not registered.',
+    );
+  });
+
+  it('rejects SET FOUNDER with missing target account', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('SET FOUNDER #home'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: SET FOUNDER <#channel> <account>',
+    );
+  });
+
+  it('rejects SET FOUNDER from a non-founder', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'bob';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('SET FOUNDER #home bob'), ctx);
+
+    expect(services.getChannelFounder('#home')).toBe('alice');
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Only the founder of #home may change its settings.',
+    );
+  });
+});
+
+// ============================================================================
+// SET MLOCK
+// ============================================================================
+
+describe('chanservReducer — SET MLOCK', () => {
+  it('stores a valid modestring', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('SET MLOCK #home +nt'), ctx);
+
+    expect(services.getChannelMlock('#home')).toBe('+nt');
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Mode lock for #home is now set to +nt.',
+    );
+  });
+
+  it('stores a modestring with no explicit sign (treated as +)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('SET MLOCK #home nt'), ctx);
+
+    expect(services.getChannelMlock('#home')).toBe('nt');
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Mode lock for #home is now set to nt.',
+    );
+  });
+
+  it('stores a modestring with a leading - sign (used to lock out a mode)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    chanservReducer(conn, privmsg('SET MLOCK #home -n'), ctx);
+
+    expect(services.getChannelMlock('#home')).toBe('-n');
+  });
+
+  it('rejects an MLOCK that is only a sign (empty body)', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('SET MLOCK #home +'), ctx);
+
+    expect(services.getChannelMlock('#home')).toBe('');
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Invalid mode lock: +',
+    );
+  });
+
+  it('clears MLOCK with the * sentinel', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelMlock('#home', '+nt');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('SET MLOCK #home *'), ctx);
+
+    expect(services.getChannelMlock('#home')).toBe('');
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Mode lock for #home has been cleared.',
+    );
+  });
+
+  it('rejects an MLOCK with disallowed letters', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('SET MLOCK #home +z'), ctx);
+
+    expect(services.getChannelMlock('#home')).toBe('');
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Invalid mode lock: +z',
+    );
+  });
+});
+
+// ============================================================================
+// SET RESTRICTED
+// ============================================================================
+
+describe('chanservReducer — SET RESTRICTED', () => {
+  it('enables RESTRICTED and sets +R channel mode', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('SET RESTRICTED #home ON'), ctx);
+
+    expect(services.getChannel('#home')?.restricted).toBe(true);
+    const applyDeltas = out.effects.filter((e) => e.tag === 'ApplyChannelDelta');
+    expect(applyDeltas.length).toBeGreaterThan(0);
+    for (const e of applyDeltas) {
+      if (e.tag === 'ApplyChannelDelta') {
+        expect(e.delta.modeChanges).toContainEqual({ mode: 'blockUnidentified', set: true });
+      }
+    }
+  });
+
+  it('disables RESTRICTED and clears +R channel mode', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelRestricted('#home', true);
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('SET RESTRICTED #home OFF'), ctx);
+
+    expect(services.getChannel('#home')?.restricted).toBe(false);
+    for (const e of out.effects) {
+      if (e.tag === 'ApplyChannelDelta') {
+        expect(e.delta.modeChanges).toContainEqual({ mode: 'blockUnidentified', set: false });
+      }
+    }
+  });
+
+  it('rejects SET RESTRICTED with a missing or invalid value', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('SET RESTRICTED #home MAYBE'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: SET RESTRICTED <#channel> ON|OFF',
+    );
+  });
+});
+
+// ============================================================================
+// SET KEEPTOPIC
+// ============================================================================
+
+describe('chanservReducer — SET KEEPTOPIC', () => {
+  it('enables KEEPTOPIC', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('SET KEEPTOPIC #home ON'), ctx);
+
+    expect(services.getChannel('#home')?.keepTopic).toBe(true);
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Keep-topic for #home is now ON.',
+    );
+  });
+
+  it('disables KEEPTOPIC and drops the persisted topic snapshot', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelKeepTopic('#home', true);
+    services.setChannelTopic('#home', { text: 'old', setter: 's', setAt: 0 });
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    chanservReducer(conn, privmsg('SET KEEPTOPIC #home OFF'), ctx);
+
+    expect(services.getChannel('#home')?.keepTopic).toBe(false);
+    expect(services.getChannelTopic('#home')).toBeUndefined();
+  });
+
+  it('rejects SET KEEPTOPIC with an invalid value', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('SET KEEPTOPIC #home YEP'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: SET KEEPTOPIC <#channel> ON|OFF',
+    );
+  });
+});
+
+// ============================================================================
+// SET misc
+// ============================================================================
+
+describe('chanservReducer — SET misc', () => {
+  it('rejects SET on an unregistered channel', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('SET KEEPTOPIC #home ON'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Channel #home is not registered.',
+    );
+  });
+
+  it('rejects SET when the caller is not identified', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('SET KEEPTOPIC #home ON'), ctx);
+
+    expect(services.getChannel('#home')?.keepTopic).toBe(false);
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :You must identify before changing channel settings.',
+    );
+  });
+
+  it('returns the SET help notice for an unknown subkey', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('SET BOGUS #home ON'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Available SET subcommands: FOUNDER, MLOCK, RESTRICTED, KEEPTOPIC',
+    );
+  });
+
+  it('returns the FOUNDER syntax notice when channel name is missing', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('SET FOUNDER'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: SET FOUNDER <#channel> <account>',
+    );
+  });
+
+  it('returns the MLOCK syntax notice when channel name is missing', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('SET MLOCK'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: SET MLOCK <#channel> <modestring>',
+    );
+  });
+
+  it('returns the RESTRICTED syntax notice when channel name is missing', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('SET RESTRICTED'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: SET RESTRICTED <#channel> ON|OFF',
+    );
+  });
+
+  it('returns the KEEPTOPIC syntax notice when channel name is missing', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('SET KEEPTOPIC'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: SET KEEPTOPIC <#channel> ON|OFF',
+    );
+  });
+
+  it('is case-insensitive on the subcommand', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    chanservReducer(conn, privmsg('register #home2'), ctx);
+
+    expect(services.getChannelFounder('#home2')).toBe('alice');
+  });
+
+  it('returns an unknown-command notice for an unknown subcommand', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('FROBNICATE'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Unknown command. Available: REGISTER, DROP, INFO, SET, ACCESS, LEVELS, SOP, AOP, HOP, VOP',
+    );
+  });
+
+  it('returns a help NOTICE when the body has only whitespace', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('   '), ctx);
+
+    expect(sentTexts(out.effects).some((t) => t.includes('Available commands'))).toBe(true);
+  });
+
+  it('handles a connection without a nick in the NOTICE addressing', () => {
+    const conn = makeConn();
+    // biome-ignore lint/performance/noDelete: exactOptionalPropertyTypes forbids `= undefined`.
+    delete conn.nick;
+    const ctx = makeCtx(conn);
+
+    const out = chanservReducer(conn, privmsg('REGISTER #home'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE * :Services are not available on this server.',
+    );
+  });
+});
+
+// ============================================================================
+// CHANSERV_NICK constant
+// ============================================================================
+
+describe('CHANSERV_NICK constant', () => {
+  it('is the canonical ChanServ pseudo-client nick', () => {
+    expect(CHANSERV_NICK).toBe('ChanServ');
+  });
+});
+
+// ============================================================================
+// positiveMlockLetters helper
+// ============================================================================
+
+describe('positiveMlockLetters', () => {
+  it('returns the unsigned letters as positive', () => {
+    expect(positiveMlockLetters('nt')).toEqual(new Set(['n', 't']));
+  });
+
+  it('returns the + letters as positive', () => {
+    expect(positiveMlockLetters('+nt')).toEqual(new Set(['n', 't']));
+  });
+
+  it('excludes letters after a - sign', () => {
+    expect(positiveMlockLetters('+nt-l')).toEqual(new Set(['n', 't']));
+  });
+
+  it('re-includes letters after a -+ flip-flop', () => {
+    expect(positiveMlockLetters('+n-t+m')).toEqual(new Set(['n', 'm']));
+  });
+
+  it('returns an empty set for an empty modestring', () => {
+    expect(positiveMlockLetters('')).toEqual(new Set<string>());
+  });
+
+  it('returns an empty set for a modestring with only signs', () => {
+    expect(positiveMlockLetters('+-')).toEqual(new Set<string>());
+  });
+});
+
+// ============================================================================
+// ACCESS ADD
+// ============================================================================
+
+describe('chanservReducer — ACCESS ADD', () => {
+  it('stores an explicit numeric level for an account', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('ACCESS #home ADD bob 5'), ctx);
+
+    expect(services.getChannelAccess('#home', 'bob')).toBe(5);
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Bob added to the access list for #home at level 5.',
+    );
+  });
+
+  it('replaces an existing access level on a second ADD', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelAccess('#home', 'bob', 3);
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    chanservReducer(conn, privmsg('ACCESS #home ADD bob 10'), ctx);
+
+    expect(services.getChannelAccess('#home', 'bob')).toBe(10);
+  });
+
+  it('rejects ACCESS ADD with a non-numeric level', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('ACCESS #home ADD bob foo'), ctx);
+
+    expect(services.getChannelAccess('#home', 'bob')).toBe(0);
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: ACCESS <#channel> ADD <account> <level>.',
+    );
+  });
+
+  it('rejects ACCESS ADD with a missing target account', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('ACCESS #home ADD'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: ACCESS <#channel> ADD <account> <level>.',
+    );
+  });
+
+  it('rejects ACCESS ADD when the target account is not registered', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('ACCESS #home ADD ghost 5'), ctx);
+
+    expect(services.getChannelAccess('#home', 'ghost')).toBe(0);
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Nick ghost is not registered.',
+    );
+  });
+
+  it('rejects ACCESS ADD on an unregistered channel', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('ACCESS #home ADD bob 5'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Channel #home is not registered.',
+    );
+  });
+
+  it('rejects ACCESS ADD when the caller is not identified', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('ACCESS #home ADD bob 5'), ctx);
+
+    expect(services.getChannelAccess('#home', 'bob')).toBe(0);
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :You must identify before changing channel settings.',
+    );
+  });
+
+  it('rejects ACCESS ADD from a non-founder account', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'bob';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('ACCESS #home ADD bob 5'), ctx);
+
+    expect(services.getChannelAccess('#home', 'bob')).toBe(0);
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Only the founder of #home may change its settings.',
+    );
+  });
+
+  it('rejects ACCESS ADD with a missing channel parameter', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('ACCESS ADD bob 5'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: ACCESS <#channel> ADD|DEL|LIST [args].',
+    );
+  });
+
+  it('rejects ACCESS ADD with an invalid channel name', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('ACCESS bogus ADD bob 5'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: ACCESS <#channel> ADD|DEL|LIST [args].',
+    );
+  });
+});
+
+// ============================================================================
+// ACCESS DEL
+// ============================================================================
+
+describe('chanservReducer — ACCESS DEL', () => {
+  it('removes the access entry for an account', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelAccess('#home', 'bob', 5);
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('ACCESS #home DEL bob'), ctx);
+
+    expect(services.getChannelAccess('#home', 'bob')).toBe(0);
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Bob removed from the access list for #home.',
+    );
+  });
+
+  it('succeeds even when the account had no access entry', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('ACCESS #home DEL bob'), ctx);
+
+    expect(services.getChannelAccess('#home', 'bob')).toBe(0);
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Bob removed from the access list for #home.',
+    );
+  });
+
+  it('rejects ACCESS DEL with a missing target account', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('ACCESS #home DEL'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: ACCESS <#channel> DEL <account>.',
+    );
+  });
+});
+
+// ============================================================================
+// ACCESS LIST
+// ============================================================================
+
+describe('chanservReducer — ACCESS LIST', () => {
+  it('lists every access entry with its level', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    services.registerNick('carol', 'pw', 'c@e');
+    services.registerChannel('#home', 'alice');
+    services.setChannelAccess('#home', 'bob', 5);
+    services.setChannelAccess('#home', 'carol', 3);
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('ACCESS #home LIST'), ctx);
+
+    const texts = sentTexts(out.effects);
+    expect(texts).toContain(':ChanServ!ChanServ@services NOTICE alice :Channel: #home');
+    expect(texts).toContain(':ChanServ!ChanServ@services NOTICE alice :Founder: alice');
+    expect(texts.some((t) => t.includes('Nick bob') && t.includes('level 5'))).toBe(true);
+    expect(texts.some((t) => t.includes('Nick carol') && t.includes('level 3'))).toBe(true);
+    expect(texts).toContain(':ChanServ!ChanServ@services NOTICE alice :End of access list.');
+  });
+
+  it('lists only the founder for an empty access list', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('ACCESS #home LIST'), ctx);
+
+    const texts = sentTexts(out.effects);
+    expect(texts).toContain(':ChanServ!ChanServ@services NOTICE alice :End of access list.');
+  });
+
+  it('rejects ACCESS LIST on an unregistered channel', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('ACCESS #home LIST'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Channel #home is not registered.',
+    );
+  });
+
+  it('returns the syntax notice for an unknown ACCESS action', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('ACCESS #home FROB bob 5'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: ACCESS <#channel> ADD|DEL|LIST [args].',
+    );
+  });
+});
+
+// ============================================================================
+// SOP / AOP / HOP / VOP shorthand
+// ============================================================================
+
+describe('chanservReducer — SOP/AOP/HOP/VOP shorthand', () => {
+  it('AOP <chan> ADD <nick> stores the AOP default level', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    chanservReducer(conn, privmsg('AOP #home ADD bob'), ctx);
+
+    expect(services.getChannelAccess('#home', 'bob')).toBe(SHORTHAND_LEVELS.AOP);
+  });
+
+  it('VOP <chan> ADD <nick> stores the VOP default level', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    chanservReducer(conn, privmsg('VOP #home ADD bob'), ctx);
+
+    expect(services.getChannelAccess('#home', 'bob')).toBe(SHORTHAND_LEVELS.VOP);
+  });
+
+  it('HOP <chan> ADD <nick> stores the HOP default level', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    chanservReducer(conn, privmsg('HOP #home ADD bob'), ctx);
+
+    expect(services.getChannelAccess('#home', 'bob')).toBe(SHORTHAND_LEVELS.HOP);
+  });
+
+  it('SOP <chan> ADD <nick> stores the SOP default level', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    chanservReducer(conn, privmsg('SOP #home ADD bob'), ctx);
+
+    expect(services.getChannelAccess('#home', 'bob')).toBe(SHORTHAND_LEVELS.SOP);
+  });
+
+  it('AOP <chan> DEL <nick> removes the access entry', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelAccess('#home', 'bob', SHORTHAND_LEVELS.AOP);
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    chanservReducer(conn, privmsg('AOP #home DEL bob'), ctx);
+
+    expect(services.getChannelAccess('#home', 'bob')).toBe(0);
+  });
+
+  it('AOP <chan> LIST delegates to ACCESS LIST', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelAccess('#home', 'bob', SHORTHAND_LEVELS.AOP);
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('AOP #home LIST'), ctx);
+
+    const texts = sentTexts(out.effects);
+    expect(texts).toContain(':ChanServ!ChanServ@services NOTICE alice :End of access list.');
+  });
+
+  it('rejects AOP shorthand with a missing channel parameter', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('AOP ADD bob'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: AOP <#channel> ADD|DEL|LIST [account].',
+    );
+  });
+
+  it('rejects AOP shorthand with an unknown action', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('AOP #home FROB bob'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: AOP <#channel> ADD|DEL|LIST [account].',
+    );
+  });
+
+  it('rejects AOP ADD with a missing target account', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('AOP #home ADD'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: AOP <#channel> ADD|DEL|LIST [account].',
+    );
+  });
+
+  it('rejects AOP DEL with a missing target account', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('AOP #home DEL'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: AOP <#channel> ADD|DEL|LIST [account].',
+    );
+  });
+
+  it('is case-insensitive on the shorthand verb', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    chanservReducer(conn, privmsg('aop #home add bob'), ctx);
+
+    expect(services.getChannelAccess('#home', 'bob')).toBe(SHORTHAND_LEVELS.AOP);
+  });
+
+  it('rejects AOP ADD when the target nick is not registered', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('AOP #home ADD ghost'), ctx);
+
+    expect(services.getChannelAccess('#home', 'ghost')).toBe(0);
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Nick ghost is not registered.',
+    );
+  });
+
+  it('rejects AOP ADD when the caller is not the founder', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'bob';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('AOP #home ADD bob'), ctx);
+
+    expect(services.getChannelAccess('#home', 'bob')).toBe(0);
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Only the founder of #home may change its settings.',
+    );
+  });
+});
+
+// ============================================================================
+// LEVELS
+// ============================================================================
+
+describe('chanservReducer — LEVELS SET', () => {
+  it('persists a redefined threshold for AUTOOP', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('LEVELS #home SET AUTOOP 7'), ctx);
+
+    expect(services.getChannelLevel('#home', 'AUTOOP')).toBe(7);
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Level AUTOOP for #home is now 7.',
+    );
+  });
+
+  it('persists a redefined threshold for AUTOVOICE', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    chanservReducer(conn, privmsg('LEVELS #home SET AUTOVOICE 2'), ctx);
+
+    expect(services.getChannelLevel('#home', 'AUTOVOICE')).toBe(2);
+  });
+
+  it('rejects LEVELS SET on an unknown op name', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('LEVELS #home SET BOGUS 5'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Unknown level BOGUS. Available: AUTOOP, AUTOHALFOP, AUTOVOICE.',
+    );
+  });
+
+  it('rejects LEVELS SET with a non-numeric level', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('LEVELS #home SET AUTOOP high'), ctx);
+
+    expect(services.getChannelLevel('#home', 'AUTOOP')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: LEVELS <#channel> SET <op> <level>.',
+    );
+  });
+
+  it('rejects LEVELS SET with a missing op or level', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('LEVELS #home SET AUTOOP'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: LEVELS <#channel> SET <op> <level>.',
+    );
+  });
+
+  it('rejects LEVELS SET on an unregistered channel', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('LEVELS #home SET AUTOOP 7'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Channel #home is not registered.',
+    );
+  });
+
+  it('rejects LEVELS SET with a missing channel parameter', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('LEVELS SET AUTOOP 7'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: LEVELS <#channel> SET|LIST|RESET [args].',
+    );
+  });
+});
+
+describe('chanservReducer — LEVELS LIST', () => {
+  it('lists every threshold, falling back to defaults for unset ops', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelLevel('#home', 'AUTOOP', 7);
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('LEVELS #home LIST'), ctx);
+
+    const texts = sentTexts(out.effects);
+    expect(texts.some((t) => t.includes('AUTOOP') && t.includes('7'))).toBe(true);
+    expect(
+      texts.some(
+        (t) => t.includes('AUTOVOICE') && t.includes(`${DEFAULT_CHANNEL_LEVELS.AUTOVOICE}`),
+      ),
+    ).toBe(true);
+    expect(texts).toContain(':ChanServ!ChanServ@services NOTICE alice :End of level list.');
+  });
+
+  it('lists the defaults when no overrides are set', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('LEVELS #home LIST'), ctx);
+
+    const texts = sentTexts(out.effects);
+    expect(texts).toContain(':ChanServ!ChanServ@services NOTICE alice :End of level list.');
+    expect(
+      texts.some((t) => t.includes('AUTOOP') && t.includes(`${DEFAULT_CHANNEL_LEVELS.AUTOOP}`)),
+    ).toBe(true);
+  });
+
+  it('rejects LEVELS LIST on an unregistered channel', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('LEVELS #home LIST'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Channel #home is not registered.',
+    );
+  });
+
+  it('reuses the existing levels map on a second SET for the same channel', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    chanservReducer(conn, privmsg('LEVELS #home SET AUTOOP 7'), ctx);
+    chanservReducer(conn, privmsg('LEVELS #home SET AUTOVOICE 2'), ctx);
+
+    expect(services.getChannelLevel('#home', 'AUTOOP')).toBe(7);
+    expect(services.getChannelLevel('#home', 'AUTOVOICE')).toBe(2);
+  });
+});
+
+describe('chanservReducer — LEVELS RESET', () => {
+  it('clears every override so defaults take effect again', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    services.setChannelLevel('#home', 'AUTOOP', 7);
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('LEVELS #home RESET'), ctx);
+
+    expect(services.getChannelLevel('#home', 'AUTOOP')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Levels for #home reset to defaults.',
+    );
+  });
+});
+
+describe('chanservReducer — LEVELS misc', () => {
+  it('returns the LEVELS syntax notice for an unknown action', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('LEVELS #home FROB'), ctx);
+
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Syntax: LEVELS <#channel> SET|LIST|RESET [args].',
+    );
+  });
+
+  it('rejects LEVELS when the caller is not the founder', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'pw', 'bob@example.com');
+    services.registerChannel('#home', 'alice');
+    const conn = makeConn();
+    conn.account = 'bob';
+    conn.userModes.registered = true;
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('LEVELS #home SET AUTOOP 7'), ctx);
+
+    expect(services.getChannelLevel('#home', 'AUTOOP')).toBeUndefined();
+    expect(sentTexts(out.effects)).toContain(
+      ':ChanServ!ChanServ@services NOTICE alice :Only the founder of #home may change its settings.',
+    );
+  });
+});
+
+// ============================================================================
+// HELP / unknown notices with new commands
+// ============================================================================
+
+describe('chanservReducer — help notice includes ACCESS/LEVELS', () => {
+  it('lists every available command on empty body', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg(''), ctx);
+
+    const texts = sentTexts(out.effects);
+    expect(texts.some((t) => t.includes('REGISTER'))).toBe(true);
+    expect(texts.some((t) => t.includes('ACCESS'))).toBe(true);
+    expect(texts.some((t) => t.includes('LEVELS'))).toBe(true);
+    expect(texts.some((t) => t.includes('SOP'))).toBe(true);
+  });
+
+  it('lists ACCESS/LEVELS in the unknown-command notice', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const conn = makeConn();
+    const ctx = makeCtx(conn, services);
+
+    const out = chanservReducer(conn, privmsg('FROBNICATE'), ctx);
+
+    const texts = sentTexts(out.effects);
+    expect(texts.some((t) => t.includes('ACCESS'))).toBe(true);
+    expect(texts.some((t) => t.includes('LEVELS'))).toBe(true);
+  });
+});
+
+// ============================================================================
+// Constants
+// ============================================================================
+
+describe('SHORTHAND_LEVELS / DEFAULT_CHANNEL_LEVELS constants', () => {
+  it('SOP sorts above AOP, AOP above HOP, HOP above VOP', () => {
+    expect(SHORTHAND_LEVELS.SOP).toBeGreaterThan(SHORTHAND_LEVELS.AOP);
+    expect(SHORTHAND_LEVELS.AOP).toBeGreaterThan(SHORTHAND_LEVELS.HOP);
+    expect(SHORTHAND_LEVELS.HOP).toBeGreaterThan(SHORTHAND_LEVELS.VOP);
+  });
+
+  it('DEFAULT_CHANNEL_LEVELS exposes the auto-* thresholds', () => {
+    expect(DEFAULT_CHANNEL_LEVELS.AUTOOP).toBe(SHORTHAND_LEVELS.AOP);
+    expect(DEFAULT_CHANNEL_LEVELS.AUTOHALFOP).toBe(SHORTHAND_LEVELS.HOP);
+    expect(DEFAULT_CHANNEL_LEVELS.AUTOVOICE).toBe(SHORTHAND_LEVELS.VOP);
+  });
+
+  it('every value in DEFAULT_CHANNEL_LEVELS is a positive integer', () => {
+    for (const v of Object.values(DEFAULT_CHANNEL_LEVELS)) {
+      expect(Number.isInteger(v)).toBe(true);
+      expect(v).toBeGreaterThan(0);
+    }
+  });
+});