serverless-ircd 0.7.0 → 0.9.0

package/packages/irc-core/tests/commands/sasl.test.ts

@@ -8,15 +8,15 @@ import type {
   AccountStore,
   AwayStore,
   MtlsIdentityProvider,
-  ReadMarkerStore,
   SaslPayload,
   SaslResult,
+  ServicesStore,
 } from '../../src/ports';
 import {
   EmptyMotdProvider,
   FakeClock,
   InMemoryAwayStore,
-  InMemoryReadMarkerStore,
+  InMemoryServicesStore,
   SequentialIdFactory,
 } from '../../src/ports';
 import { encodeBase64 } from '../../src/protocol/base64';
@@ -57,7 +57,7 @@ function makeCtx(
   state: ConnectionState,
   accounts?: AccountStore,
   mtlsIdentity?: MtlsIdentityProvider,
-  readMarkers?: ReadMarkerStore,
+  services?: ServicesStore,
   away?: AwayStore,
 ): Ctx {
   return buildCtx({
@@ -68,7 +68,7 @@ function makeCtx(
     connection: state,
     ...(accounts !== undefined ? { accounts } : {}),
     ...(mtlsIdentity !== undefined ? { mtlsIdentity } : {}),
-    ...(readMarkers !== undefined ? { readMarkers } : {}),
+    ...(services !== undefined ? { services } : {}),
     ...(away !== undefined ? { away } : {}),
   });
 }
@@ -161,13 +161,13 @@ describe('authenticateReducer — PLAIN success', () => {
     expect(state.account).toBe('alice');
   });
 
-  it('seeds lastReadMarkers from the ReadMarkerStore at identify', () => {
+  it('seeds lastReadMarkers from the ServicesStore at identify', () => {
     const state = saslReadyState();
     const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const readMarkers = new InMemoryReadMarkerStore();
-    readMarkers.set('alice', '#foo', 'm1');
-    readMarkers.set('alice', '#bar', 'm2');
-    const ctx = makeCtx(state, accounts, undefined, readMarkers);
+    const services = new InMemoryServicesStore();
+    services.setLastReadMarker('alice', '#foo', 'm1');
+    services.setLastReadMarker('alice', '#bar', 'm2');
+    const ctx = makeCtx(state, accounts, undefined, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -179,9 +179,9 @@ describe('authenticateReducer — PLAIN success', () => {
   it('does not seed markers for a different account', () => {
     const state = saslReadyState();
     const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
-    const readMarkers = new InMemoryReadMarkerStore();
-    readMarkers.set('bob', '#foo', 'm9');
-    const ctx = makeCtx(state, accounts, undefined, readMarkers);
+    const services = new InMemoryServicesStore();
+    services.setLastReadMarker('bob', '#foo', 'm9');
+    const ctx = makeCtx(state, accounts, undefined, services);
 
     authenticateReducer(state, authenticate('PLAIN'), ctx);
     authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
@@ -258,6 +258,135 @@ describe('authenticateReducer — PLAIN success', () => {
     expect(state.away).toBe('brb');
   });
 
+  it('delivers queued unread memos on a successful SASL login', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = new InMemoryServicesStore();
+    services.recordMemo({ from: 'bob', to: 'alice', body: 'Hi alice!', sentAt: 1_000 });
+    const ctx = makeCtx(state, accounts, undefined, services);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
+
+    const texts = out.effects.flatMap((e) => (e.tag === 'Send' ? e.lines : []));
+    expect(texts.map((l) => l.text)).toContain(
+      ':MemoServ!MemoServ@services NOTICE alice :[Memo #1 from bob] Hi alice!',
+    );
+  });
+
+  it('marks delivered memos as read after a successful SASL login', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = new InMemoryServicesStore();
+    services.recordMemo({ from: 'bob', to: 'alice', body: 'Hi alice!', sentAt: 1_000 });
+    const ctx = makeCtx(state, accounts, undefined, services);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
+
+    expect(services.listMemos('alice')[0]?.read).toBe(true);
+  });
+
+  it('does not deliver already-read memos on a SASL login', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = new InMemoryServicesStore();
+    services.recordMemo({ from: 'bob', to: 'alice', body: 'old', sentAt: 1_000 });
+    services.markMemoRead('alice', 1);
+    const ctx = makeCtx(state, accounts, undefined, services);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
+
+    const texts = out.effects.flatMap((e) => (e.tag === 'Send' ? e.lines : []));
+    expect(texts.some((l) => l.text.includes('[Memo #1'))).toBe(false);
+  });
+
+  it('applies the assigned HostServ vhost on SASL PLAIN success', () => {
+    const state = saslReadyState();
+    state.host = 'real.example.net';
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = new InMemoryServicesStore();
+    services.setVhost('alice', 'cool.example.net');
+    const ctx = makeCtx(state, accounts, undefined, services);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
+
+    expect(state.vhostActive).toBe(true);
+    expect(state.host).toBe('cool.example.net');
+    expect(state.preVhostHost).toBe('real.example.net');
+  });
+
+  it('does not emit a CHGHOST broadcast on SASL success (pre-registration, no peers)', () => {
+    const state = saslReadyState();
+    state.host = 'real.example.net';
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = new InMemoryServicesStore();
+    services.setVhost('alice', 'cool.example.net');
+    const ctx = makeCtx(state, accounts, undefined, services);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
+
+    expect(out.effects.filter((e) => e.tag === 'Broadcast')).toEqual<EffectType[]>([]);
+  });
+
+  it('leaves host unchanged on SASL success when no vhost is assigned', () => {
+    const state = saslReadyState();
+    state.host = 'real.example.net';
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = new InMemoryServicesStore();
+    const ctx = makeCtx(state, accounts, undefined, services);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
+
+    expect(state.vhostActive).toBeUndefined();
+    expect(state.host).toBe('real.example.net');
+  });
+
+  it('delivers nothing on a SASL login when the account has no memos', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = new InMemoryServicesStore();
+    const ctx = makeCtx(state, accounts, undefined, services);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
+
+    const texts = out.effects.flatMap((e) => (e.tag === 'Send' ? e.lines : []));
+    expect(texts.some((l) => l.text.includes('MemoServ'))).toBe(false);
+  });
+
+  it('looks up queued memos case-insensitively on a SASL login', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const services = new InMemoryServicesStore();
+    services.recordMemo({ from: 'bob', to: 'ALICE', body: 'folded', sentAt: 1_000 });
+    const ctx = makeCtx(state, accounts, undefined, services);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
+
+    const texts = out.effects.flatMap((e) => (e.tag === 'Send' ? e.lines : []));
+    expect(texts.map((l) => l.text)).toContain(
+      ':MemoServ!MemoServ@services NOTICE alice :[Memo #1 from bob] folded',
+    );
+  });
+
+  it('does not deliver memos when no ServicesStore is bound', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const ctx = makeCtx(state, accounts);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    const out = authenticateReducer(state, authenticate(plainPayload('alice', 'secret')), ctx);
+
+    const texts = out.effects.flatMap((e) => (e.tag === 'Send' ? e.lines : []));
+    expect(texts.some((l) => l.text.includes('MemoServ'))).toBe(false);
+  });
+
   it('clears the in-progress mechanism after a successful authentication', () => {
     const state = saslReadyState();
     const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
@@ -432,6 +561,24 @@ describe('authenticateReducer — EXTERNAL with mTLS', () => {
     expect(state.saslBuffer).toBeUndefined();
   });
 
+  it('delivers queued memos on a successful EXTERNAL login', () => {
+    const state = saslReadyState();
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const provider = new FakeMtlsIdentityProvider('c1', 'CN=alice');
+    const services = new InMemoryServicesStore();
+    services.recordMemo({ from: 'bob', to: 'alice', body: 'via mTLS', sentAt: 1_000 });
+    const ctx = makeCtx(state, accounts, provider, services);
+
+    authenticateReducer(state, authenticate('EXTERNAL'), ctx);
+    const out = authenticateReducer(state, authenticate('+'), ctx);
+
+    const texts = out.effects.flatMap((e) => (e.tag === 'Send' ? e.lines : []));
+    expect(texts.map((l) => l.text)).toContain(
+      ':MemoServ!MemoServ@services NOTICE alice :[Memo #1 from bob] via mTLS',
+    );
+    expect(services.listMemos('alice')[0]?.read).toBe(true);
+  });
+
   it('fails with 904 when the provider has no identity for the connection', () => {
     const state = saslReadyState();
     const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
@@ -756,3 +903,73 @@ describe('authenticateReducer — CAP REQ sasl integration', () => {
     expect(advertised).not.toContain('sasl=PLAIN,EXTERNAL');
   });
 });
+
+// ============================================================================
+// SASL PLAIN — NickServ-registered accounts (ServicesStore fallback)
+// ============================================================================
+
+describe('authenticateReducer — NickServ-registered nick via ServicesStore', () => {
+  it('succeeds with credentials registered via NickServ when no AccountStore is bound', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const state = saslReadyState();
+    const ctx = makeCtx(state, undefined, undefined, services);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    const out = authenticateReducer(state, authenticate(plainPayload('alice', 'hunter2')), ctx);
+
+    expect(state.account).toBe('alice');
+    const lines = sendLinesOf(out.effects[0]);
+    expect(lines.map((l) => l.text)).toContain(
+      `:${SV} 900 alice alice!alice@example.com alice :You are now logged in as alice`,
+    );
+  });
+
+  it('succeeds with NickServ credentials even when a static AccountStore is also bound', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('bob', 'bobpass', 'bob@example.com');
+    // Static AccountStore does not know about bob; the services store does.
+    const accounts = new FakeAccountStore({ ok: false, reason: 'invalid credentials' });
+    const state = saslReadyState();
+    state.nick = 'bob';
+    state.user = 'bob';
+    state.host = 'example.com';
+    const ctx = makeCtx(state, accounts, undefined, services);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    const out = authenticateReducer(state, authenticate(plainPayload('bob', 'bobpass')), ctx);
+
+    expect(state.account).toBe('bob');
+    expect(sendLinesOf(out.effects[0]).map((l) => l.text)).toContain(
+      `:${SV} 903 bob :SASL authentication successful`,
+    );
+  });
+
+  it('prefers the static AccountStore over the services store on a match', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'servicespw', 'alice@example.com');
+    const accounts = new FakeAccountStore({ ok: true, account: 'alice' });
+    const state = saslReadyState();
+    const ctx = makeCtx(state, accounts, undefined, services);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    authenticateReducer(state, authenticate(plainPayload('alice', 'staticpw')), ctx);
+
+    // The static store vouched for the account; it is used.
+    expect(accounts.calls).toHaveLength(1);
+    expect(state.account).toBe('alice');
+  });
+
+  it('fails when neither the AccountStore nor the ServicesStore verifies the credential', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const state = saslReadyState();
+    const ctx = makeCtx(state, undefined, undefined, services);
+
+    authenticateReducer(state, authenticate('PLAIN'), ctx);
+    const out = authenticateReducer(state, authenticate(plainPayload('alice', 'wrong')), ctx);
+
+    expect(state.account).toBeUndefined();
+    expect(firstLineText(out.effects[0])).toBe(`:${SV} 904 alice :SASL authentication failed`);
+  });
+});

package/packages/irc-core/tests/commands/server-info.test.ts

@@ -5,16 +5,20 @@ import {
   timeReducer,
   versionReducer,
 } from '../../src/commands/server-info';
-import { DEFAULT_SERVER_VERSION } from '../../src/config';
 import { Effect } from '../../src/effects';
 import type { Effect as EffectType, RawLine } from '../../src/effects';
 import { EmptyMotdProvider, FakeClock, SequentialIdFactory } from '../../src/ports';
 import { type ConnectionState, createConnection } from '../../src/state/connection';
 import { type Ctx, type ServerConfig, buildCtx } from '../../src/types';
 
+// Explicit version pinned in the fixture so the assertions below verify that
+// the configured version is what reaches the wire — not a specific default.
+const FIXTURE_VERSION = '9.9.9';
+
 const baseServerConfig: ServerConfig = {
   serverName: 'irc.example.com',
   networkName: 'ExampleNet',
+  serverVersion: FIXTURE_VERSION,
   maxChannelsPerUser: 30,
   maxTargetsPerCommand: 10,
   maxListEntries: 50,
@@ -71,7 +75,7 @@ describe('versionReducer', () => {
 
     expect(out.effects).toEqual<EffectType[]>([
       Effect.send('c1', [
-        L(`:irc.example.com 351 alice ${DEFAULT_SERVER_VERSION} irc.example.com :ExampleNet`),
+        L(`:irc.example.com 351 alice ${FIXTURE_VERSION} irc.example.com :ExampleNet`),
       ]),
     ]);
   });
@@ -93,7 +97,7 @@ describe('versionReducer', () => {
 
     expect(out.effects[0]).toEqual<EffectType>(
       Effect.send('c1', [
-        L(`:irc.example.com 351 * ${DEFAULT_SERVER_VERSION} irc.example.com :ExampleNet`),
+        L(`:irc.example.com 351 * ${FIXTURE_VERSION} irc.example.com :ExampleNet`),
       ]),
     );
   });
@@ -106,7 +110,7 @@ describe('versionReducer', () => {
 
     expect(out.effects[0]).toEqual<EffectType>(
       Effect.send('c1', [
-        L(`:irc.example.com 351 alice ${DEFAULT_SERVER_VERSION} irc.example.com :ExampleNet`),
+        L(`:irc.example.com 351 alice ${FIXTURE_VERSION} irc.example.com :ExampleNet`),
       ]),
     );
   });
@@ -234,7 +238,7 @@ describe('infoReducer', () => {
 
     const lines = (out.effects[0] as { lines: RawLine[] }).lines;
     expect(lines[0]).toEqual(
-      L(`:irc.example.com 371 alice :ServerlessIRCd - version ${DEFAULT_SERVER_VERSION}`),
+      L(`:irc.example.com 371 alice :ServerlessIRCd - version ${FIXTURE_VERSION}`),
     );
     expect(lines[1]).toEqual(L(':irc.example.com 371 alice :Running on network ExampleNet'));
     expect(lines[lines.length - 1]).toEqual(L(':irc.example.com 374 alice :End of INFO list'));

package/packages/irc-core/tests/commands/service-aliases.test.ts

@@ -0,0 +1,52 @@
+import { describe, expect, it } from 'vitest';
+import { CHANSERV_NICK } from '../../src/commands/chanserv';
+import { HOSTSERV_NICK } from '../../src/commands/hostserv';
+import { MEMOSERV_NICK } from '../../src/commands/memoserv';
+import { NICKSERV_NICK } from '../../src/commands/nickserv';
+import { OPERSERV_NICK } from '../../src/commands/operserv';
+import { SERVICE_NICKS, SHORTCUT_TO_SERVICE } from '../../src/commands/service-aliases';
+
+describe('service-aliases — single source of truth for shortcut verbs', () => {
+  it('maps every Atheme/Anope shortcut verb to its canonical service nick', () => {
+    const expected: ReadonlyArray<[string, string]> = [
+      ['NICKSERV', NICKSERV_NICK],
+      ['NS', NICKSERV_NICK],
+      ['CHANSERV', CHANSERV_NICK],
+      ['CS', CHANSERV_NICK],
+      ['HOSTSERV', HOSTSERV_NICK],
+      ['HS', HOSTSERV_NICK],
+      ['MEMOSERV', MEMOSERV_NICK],
+      ['MS', MEMOSERV_NICK],
+      ['OPERSERV', OPERSERV_NICK],
+      ['OS', OPERSERV_NICK],
+    ];
+    expect(SHORTCUT_TO_SERVICE.size).toBe(10);
+    for (const [alias, nick] of expected) {
+      expect(SHORTCUT_TO_SERVICE.get(alias)).toBe(nick);
+    }
+  });
+
+  it('keys every alias uppercased so the dispatcher can do a case-insensitive lookup', () => {
+    for (const alias of SHORTCUT_TO_SERVICE.keys()) {
+      expect(alias).toBe(alias.toUpperCase());
+    }
+  });
+
+  it('SERVICE_NICKS is the de-duplicated set of service nicks from the map values', () => {
+    const expected = Array.from(new Set(SHORTCUT_TO_SERVICE.values())).sort();
+    expect([...SERVICE_NICKS].sort()).toEqual(expected);
+  });
+
+  it('every value in SHORTCUT_TO_SERVICE is one of the canonical *_NICK constants', () => {
+    const canonical = new Set<string>([
+      NICKSERV_NICK,
+      CHANSERV_NICK,
+      HOSTSERV_NICK,
+      MEMOSERV_NICK,
+      OPERSERV_NICK,
+    ]);
+    for (const nick of SHORTCUT_TO_SERVICE.values()) {
+      expect(canonical.has(nick)).toBe(true);
+    }
+  });
+});

package/packages/irc-core/tests/commands/tagmsg.test.ts

@@ -6,10 +6,10 @@ import {
   EmptyMotdProvider,
   FakeClock,
   InMemoryMessageStore,
-  InMemoryReadMarkerStore,
+  InMemoryServicesStore,
   type MessageStore,
-  type ReadMarkerStore,
   SequentialIdFactory,
+  type ServicesStore,
   type StoredMessage,
 } from '../../src/ports';
 import { type ChannelState, createChannel } from '../../src/state/channel';
@@ -32,7 +32,7 @@ function makeCtx(
   conn: ConnectionState,
   clock = new FakeClock(1_000),
   messages?: MessageStore,
-  readMarkers?: ReadMarkerStore,
+  services?: ServicesStore,
 ): Ctx {
   return buildCtx({
     serverConfig,
@@ -41,7 +41,7 @@ function makeCtx(
     motd: EmptyMotdProvider,
     connection: conn,
     ...(messages !== undefined ? { messages } : {}),
-    ...(readMarkers !== undefined ? { readMarkers } : {}),
+    ...(services !== undefined ? { services } : {}),
   });
 }
 
@@ -551,18 +551,19 @@ describe('tagmsgChannelReducer — draft/typing broadcast', () => {
 // IRCv3 draft/read-marker: a TAGMSG carrying `+draft/read-marker=<msgid>`
 // marks `<msgid>` as the last read message for the sender's account in the
 // target channel. The reducer (1) persists the marker via the bound
-// ReadMarkerStore keyed by (account, channel), (2) advances the connection's
+// ServicesStore keyed by (account, channel), (2) advances the connection's
 // in-memory lastReadMarkers, and (3) fans the TAGMSG out — carrying the
 // `+draft/read-marker` tag — to members that negotiated `draft/read-marker`
 // OR `message-tags` (OR-semantics, matching the draft/typing precedent).
 // ============================================================================
 
 describe('tagmsgChannelReducer — draft/read-marker broadcast + persistence', () => {
-  it('emits a Broadcast with caps=[message-tags, draft/read-marker] carrying the tag', () => {
+  it('emits an account-scoped Broadcast (caps + account) for an identified originator', () => {
     const chan = makeChan('#foo');
     addMember(chan, 'c1', 'alice');
     addMember(chan, 'c2', 'bob');
     const conn = makeConn();
+    conn.account = 'alice';
     const ctx = makeCtx(conn);
 
     const out = tagmsgChannelReducer(
@@ -578,17 +579,54 @@ describe('tagmsgChannelReducer — draft/read-marker broadcast + persistence', (
         lines: [L('@+draft/read-marker=m42 :alice!alice@example.com TAGMSG #foo')],
         except: 'c1',
         caps: ['message-tags', 'draft/read-marker'],
+        account: 'alice',
       },
     ]);
   });
 
-  it('persists the marker to the ReadMarkerStore keyed by (account, channel)', () => {
+  it('does NOT fan out a read-marker mark when the originator is unidentified (spec privacy)', () => {
+    const chan = makeChan('#foo');
+    addMember(chan, 'c1', 'alice');
+    addMember(chan, 'c2', 'bob');
+    const conn = makeConn(); // no account
+    const ctx = makeCtx(conn);
+
+    const out = tagmsgChannelReducer(
+      chan,
+      { command: 'TAGMSG', params: ['#foo'], tags: { '+draft/read-marker': 'm42' } },
+      ctx,
+    );
+
+    // Unidentified: the mark is session-local. No Broadcast reaches anyone.
+    expect(out.effects).toEqual([]);
+  });
+
+  it('still self-echoes for an unidentified originator when echo-message is negotiated', () => {
+    const chan = makeChan('#foo');
+    addMember(chan, 'c1', 'alice');
+    const conn = makeConn(); // no account
+    conn.caps.add('echo-message');
+    const ctx = makeCtx(conn);
+
+    const out = tagmsgChannelReducer(
+      chan,
+      { command: 'TAGMSG', params: ['#foo'], tags: { '+draft/read-marker': 'm3' } },
+      ctx,
+    );
+
+    // No Broadcast (unidentified), but the originator's own client still
+    // sees its mark reflected back via echo-message.
+    const line = L('@+draft/read-marker=m3 :alice!alice@example.com TAGMSG #foo');
+    expect(out.effects).toEqual<EffectType[]>([Effect.send('c1', [line])]);
+  });
+
+  it('persists the marker to the ServicesStore keyed by (account, channel)', () => {
     const chan = makeChan('#foo');
     addMember(chan, 'c1', 'alice');
     const conn = makeConn();
     conn.account = 'alice';
-    const store = new InMemoryReadMarkerStore();
-    const ctx = makeCtx(conn, undefined, undefined, store);
+    const services = new InMemoryServicesStore();
+    const ctx = makeCtx(conn, undefined, undefined, services);
 
     tagmsgChannelReducer(
       chan,
@@ -596,7 +634,7 @@ describe('tagmsgChannelReducer — draft/read-marker broadcast + persistence', (
       ctx,
     );
 
-    expect(store.get('alice', '#foo')).toBe('m7');
+    expect(services.getLastReadMarker('alice', '#foo')).toBe('m7');
   });
 
   it('advances the connection in-memory lastReadMarkers', () => {
@@ -604,7 +642,7 @@ describe('tagmsgChannelReducer — draft/read-marker broadcast + persistence', (
     addMember(chan, 'c1', 'alice');
     const conn = makeConn();
     conn.account = 'alice';
-    const ctx = makeCtx(conn, undefined, undefined, new InMemoryReadMarkerStore());
+    const ctx = makeCtx(conn, undefined, undefined, new InMemoryServicesStore());
 
     tagmsgChannelReducer(
       chan,
@@ -620,8 +658,8 @@ describe('tagmsgChannelReducer — draft/read-marker broadcast + persistence', (
     addMember(chan, 'c1', 'alice');
     const conn = makeConn();
     conn.account = 'alice';
-    const store = new InMemoryReadMarkerStore();
-    const ctx = makeCtx(conn, undefined, undefined, store);
+    const services = new InMemoryServicesStore();
+    const ctx = makeCtx(conn, undefined, undefined, services);
 
     tagmsgChannelReducer(
       chan,
@@ -634,15 +672,15 @@ describe('tagmsgChannelReducer — draft/read-marker broadcast + persistence', (
       ctx,
     );
 
-    expect(store.get('alice', '#foo')).toBe('m2');
+    expect(services.getLastReadMarker('alice', '#foo')).toBe('m2');
   });
 
   it('does NOT persist to the store when the connection has no account', () => {
     const chan = makeChan('#foo');
     addMember(chan, 'c1', 'alice');
     const conn = makeConn(); // no account
-    const store = new InMemoryReadMarkerStore();
-    const ctx = makeCtx(conn, undefined, undefined, store);
+    const services = new InMemoryServicesStore();
+    const ctx = makeCtx(conn, undefined, undefined, services);
 
     tagmsgChannelReducer(
       chan,
@@ -650,12 +688,12 @@ describe('tagmsgChannelReducer — draft/read-marker broadcast + persistence', (
       ctx,
     );
 
-    expect(store.forAccount('alice')).toEqual([]);
+    expect(services.listReadMarkers('alice')).toEqual([]);
     // The in-memory marker still advances for the session.
     expect(conn.lastReadMarkers?.get('#foo')).toBe('m1');
   });
 
-  it('does NOT persist when no ReadMarkerStore is bound but still fans out', () => {
+  it('does NOT persist when no ServicesStore is bound but still fans out (identified)', () => {
     const chan = makeChan('#foo');
     addMember(chan, 'c1', 'alice');
     const conn = makeConn();
@@ -669,17 +707,17 @@ describe('tagmsgChannelReducer — draft/read-marker broadcast + persistence', (
     );
 
     expect(out.effects).toHaveLength(1);
-    expect((out.effects[0] as Extract<EffectType, { tag: 'Broadcast' }>).caps).toEqual([
-      'message-tags',
-      'draft/read-marker',
-    ]);
+    const broadcast = out.effects[0] as Extract<EffectType, { tag: 'Broadcast' }>;
+    expect(broadcast.caps).toEqual(['message-tags', 'draft/read-marker']);
+    expect(broadcast.account).toBe('alice');
     expect(conn.lastReadMarkers?.get('#foo')).toBe('m1');
   });
 
-  it('excludes the sender unless echo-message is negotiated', () => {
+  it('excludes the sender unless echo-message is negotiated (identified)', () => {
     const chan = makeChan('#foo');
     addMember(chan, 'c1', 'alice');
     const conn = makeConn();
+    conn.account = 'alice';
     const ctx = makeCtx(conn);
 
     const out = tagmsgChannelReducer(
@@ -692,10 +730,11 @@ describe('tagmsgChannelReducer — draft/read-marker broadcast + persistence', (
     expect((out.effects[0] as Extract<EffectType, { tag: 'Broadcast' }>).except).toBe('c1');
   });
 
-  it('echoes the read-marker TAGMSG back to the sender when echo-message is negotiated', () => {
+  it('echoes the read-marker TAGMSG back to the sender when echo-message is negotiated (identified)', () => {
     const chan = makeChan('#foo');
     addMember(chan, 'c1', 'alice');
     const conn = makeConn();
+    conn.account = 'alice';
     conn.caps.add('echo-message');
     const ctx = makeCtx(conn);
 
@@ -713,18 +752,19 @@ describe('tagmsgChannelReducer — draft/read-marker broadcast + persistence', (
         lines: [line],
         except: 'c1',
         caps: ['message-tags', 'draft/read-marker'],
+        account: 'alice',
       },
       Effect.send('c1', [line]),
     ]);
   });
 
-  it('fans out a valueless +draft/read-marker tag but persists no msgid', () => {
+  it('fans out a valueless +draft/read-marker tag (identified) but persists no msgid', () => {
     const chan = makeChan('#foo');
     addMember(chan, 'c1', 'alice');
     const conn = makeConn();
     conn.account = 'alice';
-    const store = new InMemoryReadMarkerStore();
-    const ctx = makeCtx(conn, undefined, undefined, store);
+    const services = new InMemoryServicesStore();
+    const ctx = makeCtx(conn, undefined, undefined, services);
 
     const out = tagmsgChannelReducer(
       chan,
@@ -732,13 +772,13 @@ describe('tagmsgChannelReducer — draft/read-marker broadcast + persistence', (
       ctx,
     );
 
-    // Broadcast still widens to draft/read-marker peers (tag is present)...
-    expect((out.effects[0] as Extract<EffectType, { tag: 'Broadcast' }>).caps).toEqual([
-      'message-tags',
-      'draft/read-marker',
-    ]);
+    // Broadcast still widens to draft/read-marker peers (tag is present) and
+    // is account-scoped for the identified originator...
+    const broadcast = out.effects[0] as Extract<EffectType, { tag: 'Broadcast' }>;
+    expect(broadcast.caps).toEqual(['message-tags', 'draft/read-marker']);
+    expect(broadcast.account).toBe('alice');
     // ...but nothing is persisted (no msgid to store).
-    expect(store.forAccount('alice')).toEqual([]);
+    expect(services.listReadMarkers('alice')).toEqual([]);
     expect(conn.lastReadMarkers?.get('#foo')).toBeUndefined();
   });
 });