serverless-ircd 0.8.0 → 0.10.0

package/packages/irc-core/tests/commands/service-aliases.test.ts

@@ -0,0 +1,52 @@
+import { describe, expect, it } from 'vitest';
+import { CHANSERV_NICK } from '../../src/commands/chanserv';
+import { HOSTSERV_NICK } from '../../src/commands/hostserv';
+import { MEMOSERV_NICK } from '../../src/commands/memoserv';
+import { NICKSERV_NICK } from '../../src/commands/nickserv';
+import { OPERSERV_NICK } from '../../src/commands/operserv';
+import { SERVICE_NICKS, SHORTCUT_TO_SERVICE } from '../../src/commands/service-aliases';
+
+describe('service-aliases — single source of truth for shortcut verbs', () => {
+  it('maps every Atheme/Anope shortcut verb to its canonical service nick', () => {
+    const expected: ReadonlyArray<[string, string]> = [
+      ['NICKSERV', NICKSERV_NICK],
+      ['NS', NICKSERV_NICK],
+      ['CHANSERV', CHANSERV_NICK],
+      ['CS', CHANSERV_NICK],
+      ['HOSTSERV', HOSTSERV_NICK],
+      ['HS', HOSTSERV_NICK],
+      ['MEMOSERV', MEMOSERV_NICK],
+      ['MS', MEMOSERV_NICK],
+      ['OPERSERV', OPERSERV_NICK],
+      ['OS', OPERSERV_NICK],
+    ];
+    expect(SHORTCUT_TO_SERVICE.size).toBe(10);
+    for (const [alias, nick] of expected) {
+      expect(SHORTCUT_TO_SERVICE.get(alias)).toBe(nick);
+    }
+  });
+
+  it('keys every alias uppercased so the dispatcher can do a case-insensitive lookup', () => {
+    for (const alias of SHORTCUT_TO_SERVICE.keys()) {
+      expect(alias).toBe(alias.toUpperCase());
+    }
+  });
+
+  it('SERVICE_NICKS is the de-duplicated set of service nicks from the map values', () => {
+    const expected = Array.from(new Set(SHORTCUT_TO_SERVICE.values())).sort();
+    expect([...SERVICE_NICKS].sort()).toEqual(expected);
+  });
+
+  it('every value in SHORTCUT_TO_SERVICE is one of the canonical *_NICK constants', () => {
+    const canonical = new Set<string>([
+      NICKSERV_NICK,
+      CHANSERV_NICK,
+      HOSTSERV_NICK,
+      MEMOSERV_NICK,
+      OPERSERV_NICK,
+    ]);
+    for (const nick of SHORTCUT_TO_SERVICE.values()) {
+      expect(canonical.has(nick)).toBe(true);
+    }
+  });
+});

package/packages/irc-core/tests/commands/unified-account.test.ts

@@ -15,12 +15,15 @@
  */
 
 import { describe, expect, it } from 'vitest';
-import { applyAccountSuccess } from '../../src/commands/account-auth';
+import {
+  applyAccountSuccess,
+  attemptPassAccountAuth,
+  passBasedAccountAuth,
+} from '../../src/commands/account-auth';
 import { NICKSERV_NICK, nickservReducer } from '../../src/commands/nickserv';
+import { passReducer } from '../../src/commands/registration';
 import { authenticateReducer } from '../../src/commands/sasl';
-import { type HashedAccountCredential, hashAccountCredential } from '../../src/credential-hashing';
 import type { Effect as EffectType } from '../../src/effects';
-import type { AccountStore } from '../../src/ports';
 import {
   EmptyMotdProvider,
   FakeClock,
@@ -71,18 +74,13 @@ function saslReadyState(nick = 'alice'): ConnectionState {
   return s;
 }
 
-function makeCtx(
-  state: ConnectionState,
-  accounts?: AccountStore,
-  services?: InMemoryServicesStore,
-): Ctx {
+function makeCtx(state: ConnectionState, services?: InMemoryServicesStore): Ctx {
   return buildCtx({
     serverConfig,
     clock: new FakeClock(NOW),
     ids: new SequentialIdFactory(),
     motd: EmptyMotdProvider,
     connection: state,
-    ...(accounts !== undefined ? { accounts } : {}),
     ...(services !== undefined ? { services } : {}),
   });
 }
@@ -119,6 +117,80 @@ function emptySnapshot(): ServicesSnapshot {
   };
 }
 
+// ============================================================================
+// AC: NickServ REGISTER → PASS <nick>:<password> succeeds post-registration
+// (T178: PASS-auth consults ServicesStore.verifyNick — the bug fix)
+// ============================================================================
+
+describe('T178 unified account: NickServ REGISTER → PASS-auth (post-registration)', () => {
+  it('a freshly NickServ-registered nick authenticates via PASS <nick>:<password>', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const registrar = makeConn('c-reg', 'alice');
+    nickservReducer(
+      registrar,
+      privmsg('REGISTER hunter2 alice@example.com'),
+      makeCtx(registrar, services),
+    );
+
+    // A second connection sending PASS after registration (no AccountStore).
+    const conn = makeConn('c1', 'alice');
+    const ctx = makeCtx(conn, services);
+    const out = passReducer(conn, { command: 'PASS', params: ['alice:hunter2'], tags: {} }, ctx);
+
+    expect(conn.account).toBe('alice');
+    expect(conn.userModes.registered).toBe(true);
+    const texts = sentTexts(out.effects);
+    expect(texts).toContain(
+      `:${SV} 900 alice alice!alice@example.com alice :You are now logged in as alice`,
+    );
+    expect(texts).toContain(`:${SV} 903 alice :SASL authentication successful`);
+  });
+
+  it('PASS-auth with the wrong password after NickServ REGISTER is a silent no-op', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const registrar = makeConn('c-reg', 'alice');
+    nickservReducer(
+      registrar,
+      privmsg('REGISTER hunter2 alice@example.com'),
+      makeCtx(registrar, services),
+    );
+
+    const conn = makeConn('c1', 'alice');
+    const ctx = makeCtx(conn, services);
+    const out = passReducer(conn, { command: 'PASS', params: ['alice:wrong'], tags: {} }, ctx);
+
+    expect(conn.account).toBeUndefined();
+    expect(out.effects).toEqual<EffectType[]>([]);
+  });
+
+  it('passBasedAccountAuth identifies via services.verifyNick at registration completion', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    const registrar = makeConn('c-reg', 'alice');
+    nickservReducer(
+      registrar,
+      privmsg('REGISTER hunter2 alice@example.com'),
+      makeCtx(registrar, services),
+    );
+
+    const conn = makeConn('c1', 'alice');
+    conn.registration = 'registering';
+    conn.passAttempt = 'alice:hunter2';
+    const effects = passBasedAccountAuth(conn, makeCtx(conn, services));
+
+    expect(conn.account).toBe('alice');
+    expect(sentTexts(effects).some((t) => t.includes(' 900 '))).toBe(true);
+  });
+
+  it('attemptPassAccountAuth consults services.verifyNick directly', () => {
+    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
+    services.registerNick('alice', 'hunter2', 'alice@example.com');
+    const conn = makeConn('c1', 'alice');
+    const effects = attemptPassAccountAuth(conn, makeCtx(conn, services), 'alice:hunter2');
+    expect(conn.account).toBe('alice');
+    expect(sentTexts(effects).some((t) => t.includes(' 900 '))).toBe(true);
+  });
+});
+
 // ============================================================================
 // AC: NickServ REGISTER → SASL PLAIN succeeds with the same password
 // ============================================================================
@@ -127,12 +199,12 @@ describe('T156 unified account: NickServ REGISTER → SASL PLAIN', () => {
   it('a freshly NickServ-registered nick authenticates via SASL PLAIN with no second registration', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
     const registrar = makeConn('c-reg', 'alice');
-    const regCtx = makeCtx(registrar, undefined, services);
+    const regCtx = makeCtx(registrar, services);
     nickservReducer(registrar, privmsg('REGISTER hunter2 alice@example.com'), regCtx);
 
     // A second connection speaking SASL PLAIN with the same nick:password.
     const saslConn = saslReadyState('alice');
-    const saslCtx = makeCtx(saslConn, undefined, services);
+    const saslCtx = makeCtx(saslConn, services);
     authenticateReducer(saslConn, authenticate('PLAIN'), saslCtx);
     const out = authenticateReducer(
       saslConn,
@@ -155,11 +227,11 @@ describe('T156 unified account: NickServ REGISTER → SASL PLAIN', () => {
     nickservReducer(
       registrar,
       privmsg('REGISTER hunter2 alice@example.com'),
-      makeCtx(registrar, undefined, services),
+      makeCtx(registrar, services),
     );
 
     const saslConn = saslReadyState('alice');
-    const saslCtx = makeCtx(saslConn, undefined, services);
+    const saslCtx = makeCtx(saslConn, services);
     authenticateReducer(saslConn, authenticate('PLAIN'), saslCtx);
     const out = authenticateReducer(
       saslConn,
@@ -179,10 +251,10 @@ describe('T156 unified account: NickServ REGISTER → SASL PLAIN', () => {
 describe('T156 unified account: SASL account → NickServ INFO / SET ENFORCE', () => {
   it('NickServ INFO resolves an account seeded into the unified store', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    services.registerNick('alice', 'hunter2', '');
 
     const conn = makeConn('c1', 'bob');
-    const out = nickservReducer(conn, privmsg('INFO alice'), makeCtx(conn, undefined, services));
+    const out = nickservReducer(conn, privmsg('INFO alice'), makeCtx(conn, services));
 
     const texts = sentTexts(out.effects);
     expect(texts).toContain(':NickServ!NickServ@services NOTICE bob :Nick: alice');
@@ -191,22 +263,18 @@ describe('T156 unified account: SASL account → NickServ INFO / SET ENFORCE', (
 
   it('NickServ isRegisteredNick resolves a seeded SASL account', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    services.registerNick('alice', 'hunter2', '');
     expect(services.isRegisteredNick('alice')).toBe(true);
     expect(services.isRegisteredNick('ALICE')).toBe(true);
   });
 
   it('NickServ SET ENFORCE applies to a seeded SASL account once identified', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    services.registerNick('alice', 'hunter2', '');
     const conn = makeConn('c1', 'alice');
     conn.account = 'alice';
     conn.userModes.registered = true;
-    const out = nickservReducer(
-      conn,
-      privmsg('SET ENFORCE kill'),
-      makeCtx(conn, undefined, services),
-    );
+    const out = nickservReducer(conn, privmsg('SET ENFORCE kill'), makeCtx(conn, services));
 
     expect(services.getNickEnforce('alice')).toBe<NickEnforcePolicy>('kill');
     expect(sentTexts(out.effects)).toContain(
@@ -216,13 +284,9 @@ describe('T156 unified account: SASL account → NickServ INFO / SET ENFORCE', (
 
   it('NickServ IDENTIFY succeeds against a seeded SASL account', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    services.registerNick('alice', 'hunter2', '');
     const conn = makeConn('c1', 'alice');
-    const out = nickservReducer(
-      conn,
-      privmsg('IDENTIFY hunter2'),
-      makeCtx(conn, undefined, services),
-    );
+    const out = nickservReducer(conn, privmsg('IDENTIFY hunter2'), makeCtx(conn, services));
 
     expect(conn.account).toBe('alice');
     expect(conn.userModes.registered).toBe(true);
@@ -233,9 +297,9 @@ describe('T156 unified account: SASL account → NickServ INFO / SET ENFORCE', (
 
   it('NickServ IDENTIFY with the wrong password fails against a seeded SASL account', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    services.registerNick('alice', 'hunter2', '');
     const conn = makeConn('c1', 'alice');
-    const out = nickservReducer(conn, privmsg('IDENTIFY nope'), makeCtx(conn, undefined, services));
+    const out = nickservReducer(conn, privmsg('IDENTIFY nope'), makeCtx(conn, services));
 
     expect(conn.account).toBeUndefined();
     expect(sentTexts(out.effects)).toContain(
@@ -243,14 +307,14 @@ describe('T156 unified account: SASL account → NickServ INFO / SET ENFORCE', (
     );
   });
 
-  it('a NickServ REGISTER does not overwrite an ingested SASL credential', () => {
+  it('a NickServ REGISTER does not overwrite an existing credential', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    services.registerNick('alice', 'hunter2', '');
     const conn = makeConn('c1', 'alice');
     const out = nickservReducer(
       conn,
       privmsg('REGISTER otherpw alice@example.com'),
-      makeCtx(conn, undefined, services),
+      makeCtx(conn, services),
     );
 
     expect(sentTexts(out.effects)).toContain(
@@ -260,14 +324,6 @@ describe('T156 unified account: SASL account → NickServ INFO / SET ENFORCE', (
     expect(services.verifyNick('alice', 'hunter2')).toEqual({ ok: true, account: 'alice' });
     expect(services.verifyNick('alice', 'otherpw').ok).toBe(false);
   });
-
-  it('ingestAccountCredential returns false when the nick is already registered', () => {
-    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    services.registerNick('alice', 'hunter2', 'alice@example.com');
-    expect(services.ingestAccountCredential(hashAccountCredential('alice', 'otherpw'))).toBe(false);
-    // The original credential still verifies.
-    expect(services.verifyNick('alice', 'hunter2')).toEqual({ ok: true, account: 'alice' });
-  });
 });
 
 // ============================================================================
@@ -277,15 +333,11 @@ describe('T156 unified account: SASL account → NickServ INFO / SET ENFORCE', (
 describe('T156 unified account: IDENTIFY vs SASL downstream parity', () => {
   it('IDENTIFY delivers queued memos (parity with SASL success)', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    services.registerNick('alice', 'hunter2', '');
     services.recordMemo({ from: 'bob', to: 'alice', body: 'hello', sentAt: NOW });
 
     const conn = makeConn('c1', 'alice');
-    const out = nickservReducer(
-      conn,
-      privmsg('IDENTIFY hunter2'),
-      makeCtx(conn, undefined, services),
-    );
+    const out = nickservReducer(conn, privmsg('IDENTIFY hunter2'), makeCtx(conn, services));
 
     expect(sentTexts(out.effects)).toContain(
       ':MemoServ!MemoServ@services NOTICE alice :[Memo #1 from bob] hello',
@@ -294,9 +346,9 @@ describe('T156 unified account: IDENTIFY vs SASL downstream parity', () => {
 
   it('both paths share applyAccountSuccess for +r stamping', () => {
     const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    services.ingestAccountCredential(hashAccountCredential('alice', 'hunter2'));
+    services.registerNick('alice', 'hunter2', '');
     const conn = makeConn('c1', 'alice');
-    const ctx = makeCtx(conn, undefined, services);
+    const ctx = makeCtx(conn, services);
 
     const effects = applyAccountSuccess(conn, ctx, 'alice');
 
@@ -356,6 +408,7 @@ describe('T156 unified account: scrypt-hashed credentials at rest', () => {
           email: 'l@x',
           createdAt: NOW,
           enforce: 'none',
+          certSubjects: [],
           // Malformed credential — empty hash, rejected by verifyHashedPassword.
           credential: { account: 'legacy', algorithm: 'scrypt', salt: 's', hash: '' },
         },
@@ -379,38 +432,3 @@ describe('T156 unified account: scrypt-hashed credentials at rest', () => {
     expect(JSON.stringify(snap.nicks[0])).not.toContain('hunter2');
   });
 });
-
-// ============================================================================
-// Adapter ingestion contract: ingestAccountCredential accepts HashedAccountCredential
-// ============================================================================
-
-describe('T156 unified account: ingestAccountCredential', () => {
-  it('creates a registered nick with default email / enforce from a hashed credential', () => {
-    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    const cred = hashAccountCredential('alice', 'hunter2');
-    expect(services.ingestAccountCredential(cred)).toBe(true);
-    expect(services.isRegisteredNick('alice')).toBe(true);
-    const rec = services.getNick('alice');
-    expect(rec).toBeDefined();
-    if (rec !== undefined) {
-      expect(rec.account).toBe('alice');
-      expect(rec.enforce).toBe<NickEnforcePolicy>('none');
-    }
-    // verifyNick goes through the same scrypt path as registerNick.
-    expect(services.verifyNick('alice', 'hunter2')).toEqual({ ok: true, account: 'alice' });
-  });
-
-  it('preserves the original spelling of the account name', () => {
-    const services = new InMemoryServicesStore({ clock: new FakeClock(NOW) });
-    const cred: HashedAccountCredential = {
-      account: 'Alice',
-      algorithm: 'scrypt',
-      salt: 's',
-      hash: 'aGVsbG8=',
-    };
-    services.ingestAccountCredential(cred);
-    const rec = services.getNick('Alice');
-    expect(rec?.nick).toBe('Alice');
-    expect(rec?.account).toBe('Alice');
-  });
-});

package/packages/irc-core/tests/credential-hashing.test.ts

@@ -1,11 +1,9 @@
 import { describe, expect, it } from 'vitest';
 import {
   type HashedAccountCredential,
-  HashedAccountStore,
   hashAccountCredential,
   verifyHashedPassword,
 } from '../src/credential-hashing';
-import type { AccountStore, SaslPayload } from '../src/ports';
 
 describe('hashAccountCredential', () => {
   it('produces an entry keyed by the username with scrypt', () => {
@@ -92,79 +90,3 @@ describe('verifyHashedPassword', () => {
     expect(verifyHashedPassword('s3cret', entry)).toBe(false);
   });
 });
-
-describe('HashedAccountStore', () => {
-  function plain(username: string, password: string): SaslPayload {
-    return { kind: 'PLAIN', username, password };
-  }
-
-  it('implements the AccountStore port', () => {
-    const store: AccountStore = new HashedAccountStore([hashAccountCredential('alice', 's3cret')]);
-    expect(store).toBeDefined();
-  });
-
-  it('accepts valid PLAIN credentials and returns the account name', () => {
-    const store = new HashedAccountStore([hashAccountCredential('alice', 's3cret')]);
-    expect(store.verify('PLAIN', plain('alice', 's3cret'))).toEqual({
-      ok: true,
-      account: 'alice',
-    });
-  });
-
-  it('rejects a wrong password', () => {
-    const store = new HashedAccountStore([hashAccountCredential('alice', 's3cret')]);
-    expect(store.verify('PLAIN', plain('alice', 'wrong')).ok).toBe(false);
-  });
-
-  it('rejects an unknown username', () => {
-    const store = new HashedAccountStore([hashAccountCredential('alice', 's3cret')]);
-    expect(store.verify('PLAIN', plain('bob', 's3cret')).ok).toBe(false);
-  });
-
-  it('rejects a non-PLAIN mechanism', () => {
-    const store = new HashedAccountStore([hashAccountCredential('alice', 's3cret')]);
-    expect(store.verify('EXTERNAL', plain('alice', 's3cret')).ok).toBe(false);
-  });
-
-  it('rejects a RAW payload', () => {
-    const store = new HashedAccountStore([hashAccountCredential('alice', 's3cret')]);
-    expect(store.verify('PLAIN', { kind: 'RAW', data: 'whatever' }).ok).toBe(false);
-  });
-
-  it('handles multiple loaded accounts', () => {
-    const store = new HashedAccountStore([
-      hashAccountCredential('alice', 'a-secret'),
-      hashAccountCredential('bob', 'b-secret'),
-    ]);
-    expect(store.verify('PLAIN', plain('alice', 'a-secret'))).toEqual({
-      ok: true,
-      account: 'alice',
-    });
-    expect(store.verify('PLAIN', plain('bob', 'b-secret'))).toEqual({
-      ok: true,
-      account: 'bob',
-    });
-  });
-
-  it('fails every verify when constructed with no entries', () => {
-    const store = new HashedAccountStore([]);
-    expect(store.verify('PLAIN', plain('alice', 's3cret')).ok).toBe(false);
-  });
-
-  it('reports the number of loaded entries via size', () => {
-    const store = new HashedAccountStore([
-      hashAccountCredential('alice', 'a'),
-      hashAccountCredential('bob', 'b'),
-    ]);
-    expect(store.size).toBe(2);
-  });
-
-  it('round-trips an externally-constructed HashedAccountCredential', () => {
-    const row: HashedAccountCredential = hashAccountCredential('carol', 'p@ss');
-    const store = new HashedAccountStore([row]);
-    expect(store.verify('PLAIN', plain('carol', 'p@ss'))).toEqual({
-      ok: true,
-      account: 'carol',
-    });
-  });
-});

package/packages/irc-core/tests/message-store.test.ts

@@ -590,4 +590,9 @@ describe('InMemoryMessageStore — getMsg (msgid -> message)', () => {
     const store = seededStore();
     expect(store.getMsg('#FoO', 'm2')?.msgid).toBe('m2');
   });
+
+  it('returns undefined for a channel with no recorded messages', () => {
+    const store = seededStore();
+    expect(store.getMsg('#empty', 'm1')).toBeUndefined();
+  });
 });

package/packages/irc-core/tests/persistent-services-store.test.ts

@@ -10,7 +10,6 @@
  */
 
 import { describe, expect, it } from 'vitest';
-import { hashAccountCredential } from '../src/credential-hashing';
 import {
   FakeClock,
   InMemoryServicesStore,
@@ -265,25 +264,85 @@ describe('PersistentServicesStore — per-mutator ops', () => {
     expect(s.batches).toEqual([]);
   });
 
-  it('ingestAccountCredential enqueues upsertNick when a new credential is adopted', async () => {
+  it('setNickPassword → upsertNick with the re-hashed credential', async () => {
     const s = recordingStore();
-    const cred = hashAccountCredential('alice', 'hunter2');
-    s.ingestAccountCredential(cred);
+    s.registerNick('alice', 'hunter2', 'a@x');
+    s.setNickPassword('alice', 'newpassword');
     await s.flush();
-    expect(ops(s).some((w) => w.kind === 'upsertNick')).toBe(true);
-    const op = ops(s).find((w) => w.kind === 'upsertNick');
-    if (op?.kind === 'upsertNick') {
-      expect(op.row.account).toBe('alice');
-      expect(op.row.credential.algorithm).toBe('scrypt');
+    const upserts = ops(s).filter((w) => w.kind === 'upsertNick');
+    // registerNick enqueues one upsert; setNickPassword enqueues a second.
+    expect(upserts).toHaveLength(2);
+    const last = upserts[upserts.length - 1];
+    if (last?.kind === 'upsertNick') {
+      // The plaintext never lands on the queued row.
+      expect(JSON.stringify(last.row)).not.toContain('newpassword');
+      expect(last.row.credential.algorithm).toBe('scrypt');
+    }
+    // The in-memory credential now verifies the new password.
+    expect(s.verifyNick('alice', 'newpassword').ok).toBe(true);
+    expect(s.verifyNick('alice', 'hunter2').ok).toBe(false);
+  });
+
+  it('setNickPassword on an unregistered nick enqueues nothing', async () => {
+    const s = recordingStore();
+    s.setNickPassword('ghost', 'newpassword');
+    await s.flush();
+    expect(s.batches).toEqual([]);
+  });
+
+  it('addCertFP → upsertNick when a new subject is attached', async () => {
+    const s = recordingStore();
+    s.registerNick('alice', 'pw', 'a@x');
+    s.addCertFP('alice', 'CN=alice');
+    await s.flush();
+    const upserts = ops(s).filter((w) => w.kind === 'upsertNick');
+    // registerNick + addCertFP → two upserts.
+    expect(upserts).toHaveLength(2);
+    const certUpsert = upserts[1];
+    if (certUpsert?.kind === 'upsertNick') {
+      expect(certUpsert.row.certSubjects).toEqual(['CN=alice']);
+    }
+  });
+
+  it('addCertFP on an already-attached subject enqueues nothing (idempotent)', async () => {
+    const s = recordingStore();
+    s.registerNick('alice', 'pw', 'a@x');
+    s.addCertFP('alice', 'CN=alice');
+    s.addCertFP('alice', 'CN=alice');
+    await s.flush();
+    const upserts = ops(s).filter((w) => w.kind === 'upsertNick');
+    // registerNick + first addCertFP → two upserts. Second addCertFP is a no-op.
+    expect(upserts).toHaveLength(2);
+  });
+
+  it('addCertFP on an unregistered nick enqueues nothing', async () => {
+    const s = recordingStore();
+    s.addCertFP('ghost', 'CN=ghost');
+    await s.flush();
+    expect(s.batches).toEqual([]);
+  });
+
+  it('removeCertFP → upsertNick when a subject is detached', async () => {
+    const s = recordingStore();
+    s.registerNick('alice', 'pw', 'a@x');
+    s.addCertFP('alice', 'CN=alice');
+    s.removeCertFP('alice', 'CN=alice');
+    await s.flush();
+    const upserts = ops(s).filter((w) => w.kind === 'upsertNick');
+    // registerNick + addCertFP + removeCertFP → three upserts.
+    expect(upserts).toHaveLength(3);
+    const last = upserts[2];
+    if (last?.kind === 'upsertNick') {
+      expect(last.row.certSubjects).toEqual([]);
     }
   });
 
-  it('ingestAccountCredential enqueues nothing when the nick is already registered', async () => {
+  it('removeCertFP on a non-attached subject enqueues nothing', async () => {
     const s = recordingStore();
     s.registerNick('alice', 'pw', 'a@x');
-    const cred = hashAccountCredential('alice', 'otherpw');
-    s.ingestAccountCredential(cred);
+    s.removeCertFP('alice', 'CN=alice');
     await s.flush();
+    // Only the registerNick upsert.
     expect(ops(s).filter((w) => w.kind === 'upsertNick')).toHaveLength(1);
   });
 

package/packages/irc-core/tests/ports.test.ts

@@ -54,6 +54,11 @@ describe('FakeClock', () => {
   });
 });
 
+// RFC 4122 v4 layout: 8-4-4-4-12 hex chars with the version nibble (M) fixed
+// to 4 and the variant nibble (N) constrained to 8-b. Used by the shape and
+// CSPRNG-sourcing tests below.
+const UUID_V4_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+
 describe('UuidIdFactory', () => {
   it('implements the IdFactory port', () => {
     const f: IdFactory = new UuidIdFactory();
@@ -74,6 +79,72 @@ describe('UuidIdFactory', () => {
     const f = new UuidIdFactory();
     expect(f.sessionId()).not.toBe(f.sessionId());
   });
+
+  it('emits RFC 4122 v4-shaped strings from every method', () => {
+    const f = new UuidIdFactory();
+    expect(f.batchId()).toMatch(UUID_V4_RE);
+    expect(f.nonce()).toMatch(UUID_V4_RE);
+    expect(f.sessionId()).toMatch(UUID_V4_RE);
+    expect(f.traceId()).toMatch(UUID_V4_RE);
+  });
+
+  it('does not consult Math.random (randomness comes from the CSPRNG)', () => {
+    // Regression guard: if a future change reverts to Math.random, mocking it
+    // to a constant would make the output deterministic. A CSPRNG-backed
+    // factory must not touch Math.random at all.
+    const original = Math.random;
+    let calls = 0;
+    Math.random = () => {
+      calls++;
+      return 0.5;
+    };
+    try {
+      const f = new UuidIdFactory();
+      const a = f.nonce();
+      const b = f.sessionId();
+      expect(calls).toBe(0);
+      expect(a).toMatch(UUID_V4_RE);
+      expect(b).toMatch(UUID_V4_RE);
+      // With Math.random pinned, a Math.random-backed impl would emit the
+      // same value every call; the CSPRNG emits two distinct values.
+      expect(a).not.toBe(b);
+    } finally {
+      Math.random = original;
+    }
+  });
+
+  it('produces hex digits indistinguishable from uniform (chi-square, CSPRNG regression guard)', () => {
+    // Regression guard against a biased or constant RNG. Counts the trailing
+    // 12 hex chars of each id — those bytes are 100% random in a UUIDv4 (the
+    // version nibble at index 14 and variant nibble at index 19 are
+    // structural and excluded from the bucket count). Buckets the chars by
+    // nibble value (0-15) and chi-squares against the uniform expectation.
+    //
+    // Non-determinism guard: the chi-square statistic for genuinely uniform
+    // input follows chi2 with 15 degrees of freedom (mean 15, stddev ~5.5).
+    // The chosen threshold (70) sits ~10σ above the mean — P(chi2_15 > 70) ≈
+    // 2e-9, i.e. effectively zero false-positives across billions of CI
+    // runs. A catastrophic revert (Math.random pinned to a constant) drives
+    // chi into the hundreds of millions, so headroom is enormous.
+    const f = new UuidIdFactory();
+    const N = 10_000;
+    const buckets = new Array<number>(16).fill(0);
+    for (let i = 0; i < N; i++) {
+      // Slice(24) is the trailing 'xxxxxxxxxxxx' group of the UUID string —
+      // 12 hex chars, all sourced from getRandomValues.
+      const tail = f.nonce().slice(24);
+      for (const c of tail) {
+        const idx = Number.parseInt(c, 16);
+        buckets[idx] = (buckets[idx] ?? 0) + 1;
+      }
+    }
+    const expected = (N * 12) / 16;
+    let chi = 0;
+    for (const observed of buckets) {
+      chi += (observed - expected) ** 2 / expected;
+    }
+    expect(chi).toBeLessThan(70);
+  });
 });
 
 describe('SequentialIdFactory', () => {