serverless-ircd 0.7.0 → 0.9.0

package/packages/irc-server/tests/actor.test.ts

@@ -16,7 +16,7 @@ import {
   InMemoryMessageStore,
   InMemoryMonitorStore,
   InMemoryNickHistoryStore,
-  InMemoryReadMarkerStore,
+  InMemoryServicesStore,
   LogLevel,
   type Logger,
   type MessageStore,
@@ -26,18 +26,19 @@ import {
   type NickHistoryStore,
   Numerics,
   type RawLine,
-  type ReadMarkerStore,
   type SaslPayload,
   type SaslResult,
   SequentialIdFactory,
   type ServerConfig,
   type ServerStats,
   type ServerStatsSnapshot,
+  type ServicesStore,
   type StoredMessage,
   applyChannelDelta as applyDelta,
   createChannel,
   createConnection,
   encodeBase64,
+  formatServerTime,
   isChannelTarget,
   toChannelSnapshot,
   toSnapshot,
@@ -228,7 +229,7 @@ function makeActor(opts: {
   secure?: boolean;
   monitor?: MonitorStore;
   away?: AwayStore;
-  readMarkers?: ReadMarkerStore;
+  services?: ServicesStore;
 }): { actor: ConnectionActor; runtime: FakeRuntime; conn: ConnectionState } {
   const clock = opts.clock ?? new FakeClock(1_000);
   const conn = createConnection({ id: 'c1', connectedSince: 0 });
@@ -306,8 +307,8 @@ function makeActor(opts: {
   if (opts.away !== undefined) {
     finalOpts.away = opts.away;
   }
-  if (opts.readMarkers !== undefined) {
-    finalOpts.readMarkers = opts.readMarkers;
+  if (opts.services !== undefined) {
+    finalOpts.services = opts.services;
   }
   const actor = new ConnectionActor(finalOpts);
   return { actor, runtime, conn };
@@ -907,12 +908,13 @@ describe('ConnectionActor — additional routing', () => {
     expect(lines[0]?.text).toContain('462');
   });
 
-  it('routes PASS to passReducer (stashes the attempt)', async () => {
+  it('routes PASS to passReducer (bare post-registration PASS is a no-op)', async () => {
     const { actor, runtime } = makeActor({});
     await actor.receiveTextFrame('PASS sekrat\r\n');
-    // passReducer on an already-registered conn emits a 462 Send.
+    // passReducer on a registered conn with no AccountStore treats a bare
+    // server-password PASS as a silent no-op (no 462, no disconnect).
     const sends = runtime.calls.filter((c) => c.method === 'send');
-    expect(sends).toHaveLength(1);
+    expect(sends).toHaveLength(0);
   });
 
   it('routes PONG to pongReducer (no effects, lastSeen refreshed)', async () => {
@@ -1229,9 +1231,13 @@ describe('ConnectionActor — additional routing', () => {
     await actor.receiveTextFrame('OPER alice secret\r\n');
 
     const sends = runtime.calls.filter((c) => c.method === 'send');
-    expect(sends).toHaveLength(1);
-    const lines = sends[0]?.args[1] as RawLine[];
-    expect(lines[0]?.text).toBe(':irc.example.com 381 alice :You are now an IRC operator');
+    // OPER success emits two Send effects: the 381 numeric, then a
+    // `:<hostmask> MODE <nick> +o` echo (mirrors the user MODE echo).
+    expect(sends).toHaveLength(2);
+    const firstLines = sends[0]?.args[1] as RawLine[];
+    expect(firstLines[0]?.text).toBe(':irc.example.com 381 alice :You are now an IRC operator');
+    const secondLines = sends[1]?.args[1] as RawLine[];
+    expect(secondLines[0]?.text).toBe(':alice!alice@example.com MODE alice +o');
     expect(conn.userModes.oper).toBe(true);
     // Critical: never 421 for OPER.
     for (const s of sends) {
@@ -1307,6 +1313,7 @@ describe('ConnectionActor — additional routing', () => {
           wallops: false,
           serverNotices: false,
           tls: false,
+          registered: false,
         },
       },
     });
@@ -1359,6 +1366,7 @@ describe('ConnectionActor — additional routing', () => {
           wallops: false,
           serverNotices: false,
           tls: false,
+          registered: false,
         },
       },
     });
@@ -1387,6 +1395,7 @@ describe('ConnectionActor — additional routing', () => {
           wallops: false,
           serverNotices: false,
           tls: false,
+          registered: false,
         },
       },
       configSource: 'KV',
@@ -1456,6 +1465,7 @@ describe('ConnectionActor — additional routing', () => {
           wallops: false,
           serverNotices: false,
           tls: false,
+          registered: false,
         },
       },
       configSource: 'KV',
@@ -1495,6 +1505,7 @@ describe('ConnectionActor — additional routing', () => {
           wallops: false,
           serverNotices: false,
           tls: false,
+          registered: false,
         },
       },
       configSource: 'KV',
@@ -1528,6 +1539,7 @@ describe('ConnectionActor — additional routing', () => {
           wallops: false,
           serverNotices: false,
           tls: false,
+          registered: false,
         },
       },
       configSource: 'KV',
@@ -4020,9 +4032,9 @@ describe('ConnectionActor — ctx store plumbing (draft/pre-away, draft/read-mar
     expect(away.get('alice')).toBeUndefined();
   });
 
-  it('persists a +draft/read-marker TAGMSG to the bound ReadMarkerStore for an identified member', async () => {
-    const readMarkers = new InMemoryReadMarkerStore();
-    const { actor, runtime, conn } = makeActor({ readMarkers });
+  it('persists a +draft/read-marker TAGMSG to the bound ServicesStore for an identified member', async () => {
+    const services = new InMemoryServicesStore();
+    const { actor, runtime, conn } = makeActor({ services });
     conn.account = 'alice';
     conn.caps = new Set<string>(['message-tags', 'draft/read-marker']);
     await setupMultilineChannel(runtime, [{ conn: 'c1', nick: 'alice' }]);
@@ -4030,7 +4042,258 @@ describe('ConnectionActor — ctx store plumbing (draft/pre-away, draft/read-mar
 
     await actor.receiveTextFrame('@+draft/read-marker=msg-42 TAGMSG #foo\r\n');
 
-    expect(readMarkers.get('alice', '#foo')).toBe('msg-42');
+    expect(services.getLastReadMarker('alice', '#foo')).toBe('msg-42');
+  });
+});
+
+// ---------------------------------------------------------------------------
+// draft/read-marker — account-scoped fanout (spec compliance)
+//
+// The ircv3 draft/read-marker spec mandates that a read marker is private to
+// the originator's account: the mark TAGMSG is delivered only to the
+// originator's own connections, never to other accounts in the channel. The
+// reducer annotates the Broadcast with the originator account; dispatch
+// restricts the recipient set accordingly. These end-to-end tests drive the
+// full actor → reducer → dispatch → FakeRuntime path.
+// ---------------------------------------------------------------------------
+
+describe('ConnectionActor — draft/read-marker account-scoped fanout', () => {
+  function addIdentifiedMember(
+    runtime: FakeRuntime,
+    connId: ConnId,
+    nick: string,
+    account: string | undefined,
+    caps: ReadonlyArray<string>,
+  ): ConnectionState {
+    const state = createConnection({ id: connId, connectedSince: 0 });
+    state.nick = nick;
+    state.user = nick;
+    state.host = `${nick}.example`;
+    state.realname = nick;
+    state.registration = 'registered';
+    state.caps = new Set<string>(caps);
+    if (account !== undefined) state.account = account;
+    runtime.addConnection(state);
+    return state;
+  }
+
+  async function seedChannel(
+    runtime: FakeRuntime,
+    members: ReadonlyArray<{ conn: ConnId; nick: string }>,
+  ): Promise<void> {
+    await runtime.applyChannelDelta('#foo', {
+      memberships: members.map((m) => ({ type: 'add' as const, conn: m.conn, nick: m.nick })),
+    });
+  }
+
+  it('delivers the mark ONLY to same-account members; other accounts never receive it', async () => {
+    const { actor, runtime, conn } = makeActor({});
+    conn.caps = new Set<string>(['message-tags', 'draft/read-marker']);
+    conn.account = 'alice';
+    // c2 = alice's other session (same account); c3 = bob (different account).
+    addIdentifiedMember(runtime, 'c2', 'alice2', 'alice', ['message-tags', 'draft/read-marker']);
+    addIdentifiedMember(runtime, 'c3', 'bob', 'bob', ['message-tags', 'draft/read-marker']);
+    await seedChannel(runtime, [
+      { conn: 'c1', nick: 'alice' },
+      { conn: 'c2', nick: 'alice2' },
+      { conn: 'c3', nick: 'bob' },
+    ]);
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('@+draft/read-marker=msg-42 TAGMSG #foo\r\n');
+
+    // alice's other session (c2) receives the mark...
+    expect(sentTo(runtime, 'c2').some((l) => l.text.includes('+draft/read-marker=msg-42'))).toBe(
+      true,
+    );
+    // ...bob (c3, different account) never does.
+    expect(sentTo(runtime, 'c3')).toEqual([]);
+  });
+
+  it("delivers the mark to the originator's other session on the same account (multi-device sync)", async () => {
+    const { actor, runtime, conn } = makeActor({});
+    conn.caps = new Set<string>(['message-tags', 'draft/read-marker']);
+    conn.account = 'alice';
+    addIdentifiedMember(runtime, 'c2', 'alice-laptop', 'alice', [
+      'message-tags',
+      'draft/read-marker',
+    ]);
+    await seedChannel(runtime, [
+      { conn: 'c1', nick: 'alice' },
+      { conn: 'c2', nick: 'alice-laptop' },
+    ]);
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('@+draft/read-marker=msg-99 TAGMSG #foo\r\n');
+
+    expect(sentTo(runtime, 'c2').some((l) => l.text.includes('+draft/read-marker=msg-99'))).toBe(
+      true,
+    );
+  });
+
+  it('does NOT fan out a mark from an unidentified originator to anyone', async () => {
+    const { actor, runtime, conn } = makeActor({});
+    conn.caps = new Set<string>(['message-tags', 'draft/read-marker']);
+    // originator unidentified (no account).
+    addIdentifiedMember(runtime, 'c2', 'bob', 'bob', ['message-tags', 'draft/read-marker']);
+    addIdentifiedMember(runtime, 'c3', 'carol', undefined, ['message-tags', 'draft/read-marker']);
+    await seedChannel(runtime, [
+      { conn: 'c1', nick: 'alice' },
+      { conn: 'c2', nick: 'bob' },
+      { conn: 'c3', nick: 'carol' },
+    ]);
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('@+draft/read-marker=msg-1 TAGMSG #foo\r\n');
+
+    // No recipient receives the mark (session-local only).
+    expect(sentTo(runtime, 'c2')).toEqual([]);
+    expect(sentTo(runtime, 'c3')).toEqual([]);
+  });
+
+  it('self-echoes the mark to an unidentified originator only when echo-message is negotiated', async () => {
+    const { actor, runtime, conn } = makeActor({});
+    conn.caps = new Set<string>(['message-tags', 'draft/read-marker', 'echo-message']);
+    // originator unidentified (no account).
+    addIdentifiedMember(runtime, 'c2', 'bob', 'bob', ['message-tags', 'draft/read-marker']);
+    await seedChannel(runtime, [
+      { conn: 'c1', nick: 'alice' },
+      { conn: 'c2', nick: 'bob' },
+    ]);
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('@+draft/read-marker=msg-1 TAGMSG #foo\r\n');
+
+    // No fanout to bob...
+    expect(sentTo(runtime, 'c2')).toEqual([]);
+    // ...but the originator sees its own mark reflected back via echo-message.
+    expect(sentTo(runtime, 'c1').some((l) => l.text.includes('+draft/read-marker=msg-1'))).toBe(
+      true,
+    );
+  });
+
+  it('keeps the +draft/read-marker tag for a draft/read-marker-only same-account peer via the filterClientTags whitelist', async () => {
+    const { actor, runtime, conn } = makeActor({});
+    conn.caps = new Set<string>(['message-tags', 'draft/read-marker']);
+    conn.account = 'alice';
+    // c2 announced ONLY draft/read-marker (not message-tags). The whitelist
+    // in filterClientTags keeps the +draft/read-marker client tag for it.
+    addIdentifiedMember(runtime, 'c2', 'alice-min', 'alice', ['draft/read-marker']);
+    await seedChannel(runtime, [
+      { conn: 'c1', nick: 'alice' },
+      { conn: 'c2', nick: 'alice-min' },
+    ]);
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('@+draft/read-marker=msg-5 TAGMSG #foo\r\n');
+
+    const lines = sentTo(runtime, 'c2');
+    expect(lines).toHaveLength(1);
+    // The tag survives the whitelist for a draft/read-marker-only peer.
+    expect(lines[0]?.text).toBe('@+draft/read-marker=msg-5 :alice!alice@example.com TAGMSG #foo');
+  });
+});
+
+// ---------------------------------------------------------------------------
+// draft/read-marker — MARKREAD verb (draft-spec client compatibility)
+//
+// The deployment stores read markers by msgid but accepts the draft's
+// timestamped MARKREAD verb from cap-enabled clients, translating the
+// timestamp to the most recent retained message at or before it. These
+// end-to-end tests drive the full actor -> reducer path and assert the verb
+// is routed (never 421 for a cap-enabled client).
+// ---------------------------------------------------------------------------
+
+describe('ConnectionActor — draft/read-marker MARKREAD verb', () => {
+  const TS = (ms: number): string => `timestamp=${formatServerTime(ms)}`;
+
+  /** Records `count` chronological PRIVMSG messages into `store` for `chan`. */
+  function seedMessages(store: MessageStore, chan: string, count: number): void {
+    for (let i = 1; i <= count; i++) {
+      const m: StoredMessage = {
+        msgid: `m${i}`,
+        time: i * 1_000,
+        chan: chan.toLowerCase(),
+        command: 'PRIVMSG',
+        nick: 'bob',
+        user: 'bob',
+        host: 'ex.org',
+        text: `msg ${i}`,
+      };
+      store.record(m);
+    }
+  }
+
+  it('routes MARKREAD to the reducer (never 421) and echoes the resolved timestamp', async () => {
+    const store = new InMemoryMessageStore();
+    const { actor, runtime, conn } = makeActor({ messages: store });
+    conn.caps = new Set<string>(['draft/read-marker']);
+    await runtime.applyChannelDelta('#foo', {
+      memberships: [{ type: 'add', conn: 'c1', nick: 'alice' }],
+    });
+    seedMessages(store, '#foo', 3); // m1=1s, m2=2s, m3=3s
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame(`MARKREAD #foo ${TS(2_000)}\r\n`);
+
+    const sends = runtime.calls.filter((c) => c.method === 'send');
+    expect(sends).toHaveLength(1);
+    const lines = sends[0]?.args[1] as RawLine[];
+    expect(lines[0]?.text).toBe(`:irc.example.com MARKREAD #foo ${TS(2_000)}`);
+    // Critical: never 421 for a cap-enabled MARKREAD.
+    expect(lines[0]?.text).not.toContain(' 421 ');
+    expect(conn.lastReadMarkers?.get('#foo')).toBe('m2');
+  });
+
+  it('still emits 421 for MARKREAD when the cap is not negotiated (reducer cap-gating)', async () => {
+    const store = new InMemoryMessageStore();
+    const { actor, runtime } = makeActor({ messages: store });
+    // No draft/read-marker cap.
+    await runtime.applyChannelDelta('#foo', {
+      memberships: [{ type: 'add', conn: 'c1', nick: 'alice' }],
+    });
+    seedMessages(store, '#foo', 3);
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame(`MARKREAD #foo ${TS(2_000)}\r\n`);
+
+    const sends = runtime.calls.filter((c) => c.method === 'send');
+    expect(sends).toHaveLength(1);
+    const lines = sends[0]?.args[1] as RawLine[];
+    expect(lines[0]?.text).toBe(':irc.example.com 421 alice MARKREAD :Unknown command');
+  });
+
+  it('silently ignores a nick-target MARKREAD (read markers are channel-scoped)', async () => {
+    const store = new InMemoryMessageStore();
+    const { actor, runtime, conn } = makeActor({ messages: store });
+    conn.caps = new Set<string>(['draft/read-marker']);
+    runtime.calls.length = 0;
+
+    // A nick (non-channel) target falls through to the `return []` arm — the
+    // deployment has no nick-scoped read markers, so the verb is a no-op
+    // rather than a 421 or a FAIL.
+    await actor.receiveTextFrame(`MARKREAD alice ${TS(2_000)}\r\n`);
+
+    expect(runtime.calls).toHaveLength(0);
+  });
+
+  it('routes a parameterless MARKREAD through the reducer (NEED_MORE_PARAMS, never 421 fallthrough)', async () => {
+    const store = new InMemoryMessageStore();
+    const { actor, runtime, conn } = makeActor({ messages: store });
+    conn.caps = new Set<string>(['draft/read-marker']);
+    runtime.calls.length = 0;
+
+    // No params at all → `msg.params[0] ?? ''` falls back to the empty
+    // string, which is routed into the reducer so it can FAIL
+    // NEED_MORE_PARAMS rather than hitting the generic 421 fallthrough.
+    await actor.receiveTextFrame('MARKREAD\r\n');
+
+    const sends = runtime.calls.filter((c) => c.method === 'send');
+    expect(sends).toHaveLength(1);
+    const lines = sends[0]?.args[1] as RawLine[];
+    expect(lines[0]?.text).toContain('NEED_MORE_PARAMS');
+    // Critical: never the generic 421 fallthrough for a cap-enabled client.
+    expect(lines[0]?.text).not.toContain(' 421 ');
   });
 });
 
@@ -4367,3 +4630,713 @@ describe('ConnectionActor — draft/multiline chathistory recording', () => {
     expect(runtime.calls.some((c) => c.method === 'getChannelSnapshot')).toBe(true);
   });
 });
+
+// ============================================================================
+// NickServ routing — PRIVMSG NickServ :<command>
+// ============================================================================
+
+describe('ConnectionActor — NickServ routing', () => {
+  it('routes PRIVMSG NickServ :IDENTIFY to the NickServ reducer and sets +r', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const { actor, runtime, conn } = makeActor({ services });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG NickServ :IDENTIFY hunter2\r\n');
+
+    expect(conn.account).toBe('alice');
+    expect(conn.userModes.registered).toBe(true);
+    const sends = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const allText = sends.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(allText).toContain(
+      ':NickServ!NickServ@services NOTICE alice :You are now identified for nick alice.',
+    );
+  });
+
+  it('routes PRIVMSG NickServ :REGISTER and confirms via NOTICE', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const { actor, runtime } = makeActor({ services });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG NickServ :REGISTER hunter2 alice@example.com\r\n');
+
+    expect(services.isRegisteredNick('alice')).toBe(true);
+    const sends = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const allText = sends.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(allText).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Nickname alice is now registered.',
+    );
+  });
+
+  it('does NOT route NOTICE NickServ to the NickServ reducer (RFC: NOTICE is silent)', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const { actor, runtime, conn } = makeActor({ services });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('NOTICE NickServ :IDENTIFY hunter2\r\n');
+
+    // NOTICE to NickServ falls through to the normal user-target path (no
+    // NickServ NOTICE emitted, no state change).
+    expect(conn.account).toBeUndefined();
+    const nickservNotices = runtime.calls.filter(
+      (c) =>
+        c.method === 'send' &&
+        (c.args[1] as RawLine[]).some((l) => l.text.includes('NickServ!NickServ@services')),
+    );
+    expect(nickservNotices).toHaveLength(0);
+  });
+
+  it('treats PRIVMSG NickServ as a normal nick-target when no services store is bound', async () => {
+    const { actor, runtime, conn } = makeActor({});
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG NickServ :IDENTIFY hunter2\r\n');
+
+    // Without a services store, NickServ is just a nick target → the normal
+    // user-target reducer emits a SendToNick with a 401 fallback.
+    expect(conn.account).toBeUndefined();
+    const toNick = runtime.calls.filter((c) => c.method === 'sendToNick');
+    expect(toNick).toHaveLength(1);
+    const notFound = toNick[0]?.args[3] as RawLine[] | undefined;
+    expect(notFound?.[0]?.text).toContain('401');
+  });
+
+  it('routes a case-insensitive PRIVMSG nickserv :… to the NickServ reducer', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const { actor, conn } = makeActor({ services });
+
+    await actor.receiveTextFrame('PRIVMSG nickserv :IDENTIFY hunter2\r\n');
+
+    expect(conn.account).toBe('alice');
+  });
+});
+
+// ============================================================================
+// ChanServ routing — PRIVMSG ChanServ :<command>
+// ============================================================================
+
+describe('ConnectionActor — ChanServ routing', () => {
+  it('routes PRIVMSG ChanServ :REGISTER and applies the +r ApplyChannelDelta', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const { actor, runtime, conn } = makeActor({ services });
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG ChanServ :REGISTER #home\r\n');
+
+    expect(services.getChannelFounder('#home')).toBe('alice');
+    const applyDeltas = runtime.calls.filter((c) => c.method === 'applyChannelDelta');
+    expect(applyDeltas.length).toBeGreaterThan(0);
+  });
+
+  it('routes PRIVMSG ChanServ :SET KEEPTOPIC #home ON and persists', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerChannel('#home', 'alice');
+    const { actor, conn } = makeActor({ services });
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+
+    await actor.receiveTextFrame('PRIVMSG ChanServ :SET KEEPTOPIC #home ON\r\n');
+
+    expect(services.getChannel('#home')?.keepTopic).toBe(true);
+  });
+
+  it('does NOT route NOTICE ChanServ to the ChanServ reducer', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const { actor, runtime } = makeActor({ services });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('NOTICE ChanServ :REGISTER #home\r\n');
+
+    const chanservNotices = runtime.calls.filter(
+      (c) =>
+        c.method === 'send' &&
+        (c.args[1] as RawLine[]).some((l) => l.text.includes('ChanServ!ChanServ@services')),
+    );
+    expect(chanservNotices).toHaveLength(0);
+  });
+
+  it('treats PRIVMSG ChanServ as a normal nick-target when no services store is bound', async () => {
+    const { actor, runtime } = makeActor({});
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG ChanServ :REGISTER #home\r\n');
+
+    const toNick = runtime.calls.filter((c) => c.method === 'sendToNick');
+    expect(toNick).toHaveLength(1);
+    const notFound = toNick[0]?.args[3] as RawLine[] | undefined;
+    expect(notFound?.[0]?.text).toContain('401');
+  });
+
+  it('routes a case-insensitive PRIVMSG chanserv :… to the ChanServ reducer', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const { actor, conn } = makeActor({ services });
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+
+    await actor.receiveTextFrame('PRIVMSG chanserv :REGISTER #home\r\n');
+
+    expect(services.getChannelFounder('#home')).toBe('alice');
+  });
+});
+
+// ============================================================================
+// MemoServ routing — PRIVMSG MemoServ :<command>
+// ============================================================================
+
+describe('ConnectionActor — MemoServ routing', () => {
+  it('routes PRIVMSG MemoServ :SEND and records the memo against the recipient', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'hunter2', 'bob@example.com');
+    const { actor, conn } = makeActor({ services });
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+
+    await actor.receiveTextFrame('PRIVMSG MemoServ :SEND bob Hi from actor\r\n');
+
+    const memos = services.listMemos('bob');
+    expect(memos).toHaveLength(1);
+    expect(memos[0]?.body).toBe('Hi from actor');
+  });
+
+  it('delivers a queued memo via MemoServ NOTICE on NickServ IDENTIFY', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.recordMemo({ from: 'bob', to: 'alice', body: 'queued', sentAt: 1_000 });
+    const { actor, runtime } = makeActor({ services });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG NickServ :IDENTIFY hunter2\r\n');
+
+    const memoNotices = runtime.calls.filter(
+      (c) =>
+        c.method === 'send' &&
+        (c.args[1] as RawLine[]).some((l) =>
+          l.text.includes('MemoServ!MemoServ@services NOTICE alice :[Memo #1 from bob] queued'),
+        ),
+    );
+    expect(memoNotices).toHaveLength(1);
+  });
+
+  it('does NOT route NOTICE MemoServ to the MemoServ reducer', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const { actor, runtime } = makeActor({ services });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('NOTICE MemoServ :SEND bob Hi\r\n');
+
+    const memoservNotices = runtime.calls.filter(
+      (c) =>
+        c.method === 'send' &&
+        (c.args[1] as RawLine[]).some((l) => l.text.includes('MemoServ!MemoServ@services')),
+    );
+    expect(memoservNotices).toHaveLength(0);
+  });
+
+  it('treats PRIVMSG MemoServ as a normal nick-target when no services store is bound', async () => {
+    const { actor, runtime } = makeActor({});
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG MemoServ :SEND bob Hi\r\n');
+
+    const toNick = runtime.calls.filter((c) => c.method === 'sendToNick');
+    expect(toNick).toHaveLength(1);
+    const notFound = toNick[0]?.args[3] as RawLine[] | undefined;
+    expect(notFound?.[0]?.text).toContain('401');
+  });
+
+  it('routes a case-insensitive PRIVMSG memoserv :… to the MemoServ reducer', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    services.registerNick('bob', 'hunter2', 'bob@example.com');
+    const { actor, conn } = makeActor({ services });
+    conn.account = 'alice';
+    conn.userModes.registered = true;
+
+    await actor.receiveTextFrame('PRIVMSG memoserv :SEND bob lower-case\r\n');
+
+    expect(services.listMemos('bob')[0]?.body).toBe('lower-case');
+  });
+});
+
+// ============================================================================
+// OperServ routing — PRIVMSG OperServ :<command> (oper-gated management)
+// ============================================================================
+
+describe('ConnectionActor — OperServ routing', () => {
+  it('routes PRIVMSG OperServ :AKILL LIST from an oper to the OperServ reducer (not 401)', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const { actor, runtime, conn } = makeActor({ services });
+    conn.userModes.oper = true;
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG OperServ :AKILL LIST\r\n');
+
+    const sends = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const allText = sends.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(allText).toContain(
+      ':OperServ!OperServ@services NOTICE alice :No AKILLs are currently set.',
+    );
+    // Critical: never 401 for a routed OperServ PRIVMSG.
+    for (const t of allText) {
+      expect(t).not.toContain(' 401 ');
+    }
+  });
+
+  it('round-trips oper AKILL ADD / DEL via PRIVMSG OperServ', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const { actor, runtime, conn } = makeActor({ services });
+    conn.userModes.oper = true;
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG OperServ :AKILL ADD *bad@host flooding\r\n');
+    expect(services.listAkills()).toHaveLength(1);
+    const addSends = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const addText = addSends.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(addText).toContain(
+      ':OperServ!OperServ@services NOTICE alice :AKILL *bad@host added (reason: flooding).',
+    );
+
+    runtime.calls.length = 0;
+    await actor.receiveTextFrame('PRIVMSG OperServ :AKILL DEL *bad@host\r\n');
+    expect(services.listAkills()).toHaveLength(0);
+    const delSends = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const delText = delSends.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(delText).toContain(':OperServ!OperServ@services NOTICE alice :AKILL *bad@host removed.');
+  });
+
+  it('round-trips oper JUPE / UNJUPE via PRIVMSG OperServ', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const { actor, runtime, conn } = makeActor({ services });
+    conn.userModes.oper = true;
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG OperServ :JUPE malkovich\r\n');
+    expect(services.isJuped('malkovich')).toBe(true);
+    const jupeSends = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const jupeText = jupeSends.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(jupeText).toContain(':OperServ!OperServ@services NOTICE alice :JUPE malkovich added.');
+
+    runtime.calls.length = 0;
+    await actor.receiveTextFrame('PRIVMSG OperServ :UNJUPE malkovich\r\n');
+    expect(services.isJuped('malkovich')).toBe(false);
+    const unjupeSends = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const unjupeText = unjupeSends.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(unjupeText).toContain(
+      ':OperServ!OperServ@services NOTICE alice :JUPE malkovich removed.',
+    );
+  });
+
+  it('round-trips oper RAW via PRIVMSG OperServ', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const { actor, runtime, conn } = makeActor({ services });
+    conn.userModes.oper = true;
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG OperServ :RAW :srv.example.com STATS u\r\n');
+
+    const sends = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const allText = sends.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(allText).toContain(
+      ':OperServ!OperServ@services NOTICE alice :RAW line accepted and logged.',
+    );
+  });
+
+  it('rejects a non-oper PRIVMSG OperServ :AKILL ADD with permission-denied NOTICE (not 401, no state change)', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const { actor, runtime } = makeActor({ services });
+    // conn.userModes.oper left false
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG OperServ :AKILL ADD *bad@host flooding\r\n');
+
+    expect(services.listAkills()).toHaveLength(0);
+    const sends = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const allText = sends.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(allText).toContain(
+      ':OperServ!OperServ@services NOTICE alice :Permission denied — oper privileges required.',
+    );
+    for (const t of allText) {
+      expect(t).not.toContain(' 401 ');
+    }
+  });
+
+  it('does NOT route NOTICE OperServ to the OperServ reducer (PRIVMSG-only interception)', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const { actor, runtime, conn } = makeActor({ services });
+    conn.userModes.oper = true;
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('NOTICE OperServ :AKILL LIST\r\n');
+
+    // NOTICE to OperServ falls through to the normal user-target path (no
+    // OperServ NOTICE emitted, no state change).
+    const operservNotices = runtime.calls.filter(
+      (c) =>
+        c.method === 'send' &&
+        (c.args[1] as RawLine[]).some((l) => l.text.includes('OperServ!OperServ@services')),
+    );
+    expect(operservNotices).toHaveLength(0);
+  });
+
+  it('treats PRIVMSG OperServ as a normal nick-target when no services store is bound', async () => {
+    const { actor, runtime } = makeActor({});
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG OperServ :AKILL LIST\r\n');
+
+    const toNick = runtime.calls.filter((c) => c.method === 'sendToNick');
+    expect(toNick).toHaveLength(1);
+    const notFound = toNick[0]?.args[3] as RawLine[] | undefined;
+    expect(notFound?.[0]?.text).toContain('401');
+  });
+
+  it('routes a case-insensitive PRIVMSG operserv :… to the OperServ reducer', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const { actor, runtime, conn } = makeActor({ services });
+    conn.userModes.oper = true;
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG operserv :AKILL LIST\r\n');
+
+    const sends = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const allText = sends.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(allText).toContain(
+      ':OperServ!OperServ@services NOTICE alice :No AKILLs are currently set.',
+    );
+  });
+});
+
+// ============================================================================
+// echo-message — services PRIVMSG echo (IRCv3)
+//
+// When a client that negotiated `echo-message` sends `PRIVMSG <ServiceNick>`
+// the server must echo the sender's own PRIVMSG line back, BEFORE the service
+// reducer's NOTICE reply — matching how every other PRIVMSG renders (your
+// outgoing line first, then any reply). Without this echo,
+// modern IRCv3 clients optimistically show the outgoing message as "sending"
+// and flip it to "failed" when no delivery confirmation arrives.
+// ============================================================================
+
+describe('ConnectionActor — echo-message on service PRIVMSG', () => {
+  function makeOnlineConn(id: string, nick: string): ConnectionState {
+    const c = createConnection({ id, connectedSince: 0 });
+    c.nick = nick;
+    c.user = nick;
+    c.host = `${nick}.org`;
+    c.realname = nick;
+    c.registration = 'registered';
+    return c;
+  }
+
+  it('echoes the sender PRIVMSG back when echo-message is negotiated (NickServ)', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const { actor, runtime } = makeActor({
+      services,
+      conn: { caps: new Set<string>(['echo-message']) },
+    });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG NickServ :IDENTIFY hunter2\r\n');
+
+    const toAlice = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const allText = toAlice.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(allText).toContain(':alice!alice@example.com PRIVMSG NickServ :IDENTIFY hunter2');
+  });
+
+  it('does NOT echo when echo-message is not negotiated', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const { actor, runtime } = makeActor({ services });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG NickServ :IDENTIFY hunter2\r\n');
+
+    const toAlice = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const allText = toAlice.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    for (const t of allText) {
+      expect(t).not.toMatch(/PRIVMSG NickServ :IDENTIFY hunter2$/);
+    }
+  });
+
+  it('emits the echo BEFORE the NickServ NOTICE reply (ordering)', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const { actor, runtime } = makeActor({
+      services,
+      conn: { caps: new Set<string>(['echo-message']) },
+    });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG NickServ :IDENTIFY hunter2\r\n');
+
+    const sendCalls = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const findIdx = (needle: string): number =>
+      sendCalls.findIndex((c) => (c.args[1] as RawLine[]).some((l) => l.text.includes(needle)));
+    const noticeIdx = findIdx('NickServ!NickServ@services NOTICE');
+    const echoIdx = findIdx('PRIVMSG NickServ :IDENTIFY hunter2');
+    expect(noticeIdx).toBeGreaterThanOrEqual(0);
+    expect(echoIdx).toBeGreaterThanOrEqual(0);
+    expect(echoIdx).toBeLessThan(noticeIdx);
+  });
+
+  it('echoes the sender PRIVMSG back for ChanServ (shared fix, not NickServ-specific)', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const { actor, runtime } = makeActor({
+      services,
+      conn: { caps: new Set<string>(['echo-message']) },
+    });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG ChanServ :HELP\r\n');
+
+    const toAlice = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const allText = toAlice.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(allText).toContain(':alice!alice@example.com PRIVMSG ChanServ :HELP');
+  });
+
+  it('preserves the sender target casing in the echo', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const { actor, runtime } = makeActor({
+      services,
+      conn: { caps: new Set<string>(['echo-message']) },
+    });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG nickserv :IDENTIFY hunter2\r\n');
+
+    const toAlice = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const allText = toAlice.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(allText).toContain(':alice!alice@example.com PRIVMSG nickserv :IDENTIFY hunter2');
+  });
+
+  it('does NOT intercept PRIVMSG to a non-service nick when services are bound', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const { actor, runtime } = makeActor({ services });
+    runtime.addConnection(makeOnlineConn('c2', 'bob'));
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG bob :hi\r\n');
+
+    // With services bound, a non-service nick still routes through the normal
+    // user-target path (sendToNick), never the service reducer or echo path.
+    const toNick = runtime.calls.filter((c) => c.method === 'sendToNick');
+    expect(toNick).toHaveLength(1);
+  });
+
+  it('echoes with empty text when the PRIVMSG carries no trailing parameter', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const { actor, runtime } = makeActor({
+      services,
+      conn: { caps: new Set<string>(['echo-message']) },
+    });
+    runtime.calls.length = 0;
+
+    // No `:text` argument → `singleParamMsg.params[1] ?? ''` falls back to an
+    // empty string in the echo line.
+    await actor.receiveTextFrame('PRIVMSG NickServ\r\n');
+
+    const toAlice = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const echo = toAlice
+      .flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text))
+      .find((t) => t.endsWith('PRIVMSG NickServ :'));
+    expect(echo).toBe(':alice!alice@example.com PRIVMSG NickServ :');
+  });
+
+  it('falls back to "?" hostmask in the echo when the sender has no nick', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const { actor, runtime, conn } = makeActor({
+      services,
+      conn: { caps: new Set<string>(['echo-message']) },
+    });
+    // A connection that negotiated echo-message but has no NICK/USER/HOST —
+    // exercises the `hostmaskOf(state) ?? state.nick ?? '?'` fallback chain
+    // in the service-PRIVMSG echo. `delete` is required because
+    // exactOptionalPropertyTypes forbids `= undefined`.
+    // biome-ignore lint/performance/noDelete: exactOptionalPropertyTypes requires delete
+    delete conn.nick;
+    // biome-ignore lint/performance/noDelete: exactOptionalPropertyTypes requires delete
+    delete conn.user;
+    // biome-ignore lint/performance/noDelete: exactOptionalPropertyTypes requires delete
+    delete conn.host;
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('PRIVMSG NickServ :IDENTIFY hunter2\r\n');
+
+    const toSender = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const echo = toSender
+      .flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text))
+      .find((t) => t.includes('PRIVMSG NickServ :IDENTIFY hunter2'));
+    // Both `??` arms fire: hostmaskOf returns undefined (no nick), then
+    // state.nick is undefined, so the final '?' fallback is used.
+    expect(echo).toBe(':? PRIVMSG NickServ :IDENTIFY hunter2');
+  });
+});
+
+// ============================================================================
+// Service shortcut commands — NICKSERV/NS/CHANSERV/CS/HOSTSERV/HS/MEMOSERV/MS/
+// OPERSERV/OS (Atheme/Anope-convention aliases rewritten to
+// PRIVMSG <ServiceNick> :<joined args> by the dispatcher).
+// ============================================================================
+
+describe('ConnectionActor — service shortcut commands', () => {
+  it('NICKSERV IDENTIFY behaves identically to PRIVMSG NickServ :IDENTIFY (never 421)', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const { actor, runtime, conn } = makeActor({ services });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('NICKSERV IDENTIFY hunter2\r\n');
+
+    expect(conn.account).toBe('alice');
+    expect(conn.userModes.registered).toBe(true);
+    const sends = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const allText = sends.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(allText).toContain(
+      ':NickServ!NickServ@services NOTICE alice :You are now identified for nick alice.',
+    );
+    // Critical: the shortcut must reach the reducer, never the 421 fallthrough.
+    for (const t of allText) {
+      expect(t).not.toContain(' 421 ');
+    }
+  });
+
+  // Each alias must resolve to its service. Sending the bare alias (no args)
+  // reaches the reducer, which emits a help NOTICE sourced from the matching
+  // pseudo-client — so the NOTICE source nick identifies the routed service.
+  const aliasToService: ReadonlyArray<[string, string]> = [
+    ['NICKSERV', 'NickServ'],
+    ['NS', 'NickServ'],
+    ['CHANSERV', 'ChanServ'],
+    ['CS', 'ChanServ'],
+    ['HOSTSERV', 'HostServ'],
+    ['HS', 'HostServ'],
+    ['MEMOSERV', 'MemoServ'],
+    ['MS', 'MemoServ'],
+    ['OPERSERV', 'OperServ'],
+    ['OS', 'OperServ'],
+  ];
+
+  for (const [alias, service] of aliasToService) {
+    it(`${alias} (no args) routes to ${service} via the help NOTICE`, async () => {
+      const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+      const { actor, runtime } = makeActor({ services });
+      runtime.calls.length = 0;
+
+      await actor.receiveTextFrame(`${alias}\r\n`);
+
+      const sends = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+      const allText = sends.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+      // The help NOTICE source hostmask identifies which service was routed.
+      expect(
+        allText.some((t) => t.startsWith(`:${service}!${service}@services NOTICE alice :`)),
+      ).toBe(true);
+      // And it never produces a 421.
+      for (const t of allText) {
+        expect(t).not.toContain(' 421 ');
+      }
+    });
+  }
+
+  it('aliases are case-insensitive (ns lower-case maps to NickServ)', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const { actor, runtime } = makeActor({ services });
+    runtime.calls.length = 0;
+
+    await actor.receiveTextFrame('ns\r\n');
+
+    const sends = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const allText = sends.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(allText.some((t) => t.startsWith(':NickServ!NickServ@services NOTICE alice :'))).toBe(
+      true,
+    );
+  });
+
+  it('joins multi-word args into the PRIVMSG trailing body (NICKSERV REGISTER pw email)', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const { actor, runtime } = makeActor({ services });
+    runtime.calls.length = 0;
+
+    // Three trailing tokens must be joined and delivered as the body, exactly
+    // mirroring `PRIVMSG NickServ :REGISTER hunter2 alice@example.com`.
+    await actor.receiveTextFrame('NICKSERV REGISTER hunter2 alice@example.com\r\n');
+
+    expect(services.isRegisteredNick('alice')).toBe(true);
+    const sends = runtime.calls.filter((c) => c.method === 'send' && c.args[0] === 'c1');
+    const allText = sends.flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    expect(allText).toContain(
+      ':NickServ!NickServ@services NOTICE alice :Nickname alice is now registered.',
+    );
+  });
+
+  it('joins a colon-trailing arg shape into the PRIVMSG body (NS :IDENTIFY hunter2)', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const { actor, conn } = makeActor({ services });
+
+    // `NS :IDENTIFY hunter2` parses to params=['IDENTIFY hunter2']; joining
+    // reproduces the body `IDENTIFY hunter2` so the identify succeeds.
+    await actor.receiveTextFrame('NS :IDENTIFY hunter2\r\n');
+
+    expect(conn.account).toBe('alice');
+  });
+
+  it('shortcut with no args is equivalent to PRIVMSG <ServiceNick> (help NOTICE)', async () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(1_000) });
+    const { actor: a1, runtime: r1 } = makeActor({ services });
+    r1.calls.length = 0;
+    await a1.receiveTextFrame('CS\r\n');
+    const shortcutText = r1.calls
+      .filter((c) => c.method === 'send' && c.args[0] === 'c1')
+      .flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+
+    const { actor: a2, runtime: r2 } = makeActor({ services });
+    r2.calls.length = 0;
+    await a2.receiveTextFrame('PRIVMSG ChanServ :\r\n');
+    const privmsgText = r2.calls
+      .filter((c) => c.method === 'send' && c.args[0] === 'c1')
+      .flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+
+    expect(shortcutText).toEqual(privmsgText);
+  });
+
+  it('when services are unavailable, the shortcut matches a direct PRIVMSG to the service (401, never 421)', async () => {
+    // No services store bound → the rewritten PRIVMSG NickServ falls through
+    // to the normal user-target path (sendToNick + 401), exactly like a
+    // direct PRIVMSG NickServ. The shortcut must NOT produce a bare 421.
+    const { actor: shortcutActor, runtime: shortcutRuntime } = makeActor({});
+    shortcutRuntime.calls.length = 0;
+    await shortcutActor.receiveTextFrame('NICKSERV IDENTIFY hunter2\r\n');
+
+    const shortcutToNick = shortcutRuntime.calls.filter((c) => c.method === 'sendToNick');
+    expect(shortcutToNick).toHaveLength(1);
+    const shortcutNotFound = shortcutToNick[0]?.args[3] as RawLine[] | undefined;
+    expect(shortcutNotFound?.[0]?.text).toContain('401');
+
+    // Equivalence: a direct PRIVMSG NickServ with no store produces the same
+    // 401 path, confirming the shortcut delegates identically.
+    const { actor: directActor, runtime: directRuntime } = makeActor({});
+    directRuntime.calls.length = 0;
+    await directActor.receiveTextFrame('PRIVMSG NickServ :IDENTIFY hunter2\r\n');
+    const directToNick = directRuntime.calls.filter((c) => c.method === 'sendToNick');
+    expect(directToNick).toHaveLength(1);
+
+    // Critical: neither path emits a bare 421 for the shortcut verb.
+    const allShortcutText = shortcutRuntime.calls
+      .filter((c) => c.method === 'send' && c.args[0] === 'c1')
+      .flatMap((c) => (c.args[1] as RawLine[]).map((l) => l.text));
+    for (const t of allShortcutText) {
+      expect(t).not.toContain(' 421 ');
+    }
+  });
+});