fix: rename 000_bootstrap.sql to 000.sql per issue spec

feat: move schema_migrations table creation into 000_bootstrap.sql
Move the inline CREATE TABLE IF NOT EXISTS schema_migrations from Go code into a dedicated 000_bootstrap.sql file, following the sneak/pixa pattern. The bootstrap SQL is executed directly before the migration loop, which now starts from 001+. The bootstrap file also handles its own INSERT OR IGNORE so the Go code does zero inserts for version 0. closes #91 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-25 14:46:24 -07:00 · 2026-03-25 14:41:46 -07:00 · 2026-03-25 22:38:46 +01:00 · 2026-03-25 20:11:34 +01:00 · 2026-03-25 02:08:28 +01:00 · 2026-03-22 00:39:38 +01:00
43 changed files with 12309 additions and 2060 deletions
--- a/21
+++ b/21
@@ -1,4 +1,4 @@
-.PHONY: all build lint fmt fmt-check test check clean run debug docker hooks
+.PHONY: all build lint fmt fmt-check test check clean run debug docker hooks ensure-web-dist
 BINARY := neoircd
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
@@ -7,10 +7,21 @@ LDFLAGS := -X main.Version=$(VERSION) -X main.Buildarch=$(BUILDARCH)
 all: check build
-build:
+# ensure-web-dist creates placeholder files so //go:embed dist/* in
 # web/embed.go resolves without a full Node.js build.  The real SPA is
 # built by the web-builder Docker stage; these placeholders let
 # "make test" and "make build" work outside Docker.
 ensure-web-dist:
 	@if [ ! -d web/dist ]; then \
 		mkdir -p web/dist && \
 		touch web/dist/index.html web/dist/style.css web/dist/app.js && \
 		echo "==> Created placeholder web/dist/ for go:embed"; \
 	fi
 build: ensure-web-dist
 	go build -ldflags "$(LDFLAGS)" -o bin/$(BINARY) ./cmd/neoircd
-lint:
+lint: ensure-web-dist
 	golangci-lint run --config .golangci.yml ./...
 fmt:
@@ -20,8 +31,8 @@ fmt:
 fmt-check:
 	@test -z "$$(gofmt -l .)" || (echo "Files not formatted:" && gofmt -l . && exit 1)
-test:
+test: ensure-web-dist
-	go test -timeout 30s -v -race -cover ./...
+	go test -timeout 30s -race -cover ./... || go test -timeout 30s -race -v ./...
 # check runs all validation without making changes
 # Used by CI and Docker build — fails if anything is wrong
--- a/README.md
+++ b/README.md
--- a/cmd/neoirc-cli/main.go
+++ b/cmd/neoirc-cli/main.go
@@ -1,911 +1,8 @@
 // Package main is the entry point for the neoirc-cli client.
 package main
-import (
+import "git.eeqj.de/sneak/neoirc/internal/cli"
 	"fmt"
 	"os"
 	"strings"
 	"sync"
 	"time"
 	api "git.eeqj.de/sneak/neoirc/cmd/neoirc-cli/api"
 	"git.eeqj.de/sneak/neoirc/internal/irc"
 )
 const (
 	splitParts  = 2
 	pollTimeout = 15
 	pollRetry   = 2 * time.Second
 	timeFormat  = "15:04"
 )
 // App holds the application state.
 type App struct {
 	ui     *UI
 	client *api.Client
 	mu        sync.Mutex
 	nick      string
 	target    string
 	connected bool
 	lastQID   int64
 	stopPoll  chan struct{}
 }
 func main() {
-	app := &App{ //nolint:exhaustruct
+	cli.Run()
 		ui:   NewUI(),
 		nick: "guest",
 	}
 	app.ui.OnInput(app.handleInput)
 	app.ui.SetStatus(app.nick, "", "disconnected")
 	app.ui.AddStatus(
 		"Welcome to neoirc-cli — an IRC-style client",
 	)
 	app.ui.AddStatus(
 		"Type [yellow]/connect <server-url>" +
 			"[white] to begin, " +
 			"or [yellow]/help[white] for commands",
 	)
 	err := app.ui.Run()
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
 		os.Exit(1)
 	}
 }
 func (a *App) handleInput(text string) {
 	if strings.HasPrefix(text, "/") {
 		a.handleCommand(text)
 		return
 	}
 	a.mu.Lock()
 	target := a.target
 	connected := a.connected
 	a.mu.Unlock()
 	if !connected {
 		a.ui.AddStatus(
 			"[red]Not connected. Use /connect <url>",
 		)
 		return
 	}
 	if target == "" {
 		a.ui.AddStatus(
 			"[red]No target. " +
 				"Use /join #channel or /query nick",
 		)
 		return
 	}
 	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
 		Command: irc.CmdPrivmsg,
 		To:      target,
 		Body:    []string{text},
 	})
 	if err != nil {
 		a.ui.AddStatus(
 			"[red]Send error: " + err.Error(),
 		)
 		return
 	}
 	timestamp := time.Now().Format(timeFormat)
 	a.mu.Lock()
 	nick := a.nick
 	a.mu.Unlock()
 	a.ui.AddLine(target, fmt.Sprintf(
 		"[gray]%s [green]<%s>[white] %s",
 		timestamp, nick, text,
 	))
 }
 func (a *App) handleCommand(text string) {
 	parts := strings.SplitN(text, " ", splitParts)
 	cmd := strings.ToLower(parts[0])
 	args := ""
 	if len(parts) > 1 {
 		args = parts[1]
 	}
 	a.dispatchCommand(cmd, args)
 }
 func (a *App) dispatchCommand(cmd, args string) {
 	switch cmd {
 	case "/connect":
 		a.cmdConnect(args)
 	case "/nick":
 		a.cmdNick(args)
 	case "/join":
 		a.cmdJoin(args)
 	case "/part":
 		a.cmdPart(args)
 	case "/msg":
 		a.cmdMsg(args)
 	case "/query":
 		a.cmdQuery(args)
 	case "/topic":
 		a.cmdTopic(args)
 	case "/window", "/w":
 		a.cmdWindow(args)
 	case "/quit":
 		a.cmdQuit()
 	case "/help":
 		a.cmdHelp()
 	default:
 		a.dispatchInfoCommand(cmd, args)
 	}
 }
 func (a *App) dispatchInfoCommand(cmd, args string) {
 	switch cmd {
 	case "/names":
 		a.cmdNames()
 	case "/list":
 		a.cmdList()
 	case "/motd":
 		a.cmdMotd()
 	case "/who":
 		a.cmdWho(args)
 	case "/whois":
 		a.cmdWhois(args)
 	default:
 		a.ui.AddStatus(
 			"[red]Unknown command: " + cmd,
 		)
 	}
 }
 func (a *App) cmdConnect(serverURL string) {
 	if serverURL == "" {
 		a.ui.AddStatus(
 			"[red]Usage: /connect <server-url>",
 		)
 		return
 	}
 	serverURL = strings.TrimRight(serverURL, "/")
 	a.ui.AddStatus("Connecting to " + serverURL + "...")
 	a.mu.Lock()
 	nick := a.nick
 	a.mu.Unlock()
 	client := api.NewClient(serverURL)
 	resp, err := client.CreateSession(nick)
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]Connection failed: %v", err,
 		))
 		return
 	}
 	a.mu.Lock()
 	a.client = client
 	a.nick = resp.Nick
 	a.connected = true
 	a.lastQID = 0
 	a.mu.Unlock()
 	a.ui.AddStatus(fmt.Sprintf(
 		"[green]Connected! Nick: %s, Session: %d",
 		resp.Nick, resp.ID,
 	))
 	a.ui.SetStatus(resp.Nick, "", "connected")
 	a.stopPoll = make(chan struct{})
 	go a.pollLoop()
 }
 func (a *App) cmdNick(nick string) {
 	if nick == "" {
 		a.ui.AddStatus(
 			"[red]Usage: /nick <name>",
 		)
 		return
 	}
 	a.mu.Lock()
 	connected := a.connected
 	a.mu.Unlock()
 	if !connected {
 		a.mu.Lock()
 		a.nick = nick
 		a.mu.Unlock()
 		a.ui.AddStatus(
 			"Nick set to " + nick +
 				" (will be used on connect)",
 		)
 		return
 	}
 	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
 		Command: irc.CmdNick,
 		Body:    []string{nick},
 	})
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]Nick change failed: %v", err,
 		))
 		return
 	}
 	a.mu.Lock()
 	a.nick = nick
 	target := a.target
 	a.mu.Unlock()
 	a.ui.SetStatus(nick, target, "connected")
 	a.ui.AddStatus("Nick changed to " + nick)
 }
 func (a *App) cmdJoin(channel string) {
 	if channel == "" {
 		a.ui.AddStatus(
 			"[red]Usage: /join #channel",
 		)
 		return
 	}
 	if !strings.HasPrefix(channel, "#") {
 		channel = "#" + channel
 	}
 	a.mu.Lock()
 	connected := a.connected
 	a.mu.Unlock()
 	if !connected {
 		a.ui.AddStatus("[red]Not connected")
 		return
 	}
 	err := a.client.JoinChannel(channel)
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]Join failed: %v", err,
 		))
 		return
 	}
 	a.mu.Lock()
 	a.target = channel
 	nick := a.nick
 	a.mu.Unlock()
 	a.ui.SwitchToBuffer(channel)
 	a.ui.AddLine(channel,
 		"[yellow]*** Joined "+channel,
 	)
 	a.ui.SetStatus(nick, channel, "connected")
 }
 func (a *App) cmdPart(channel string) {
 	a.mu.Lock()
 	if channel == "" {
 		channel = a.target
 	}
 	connected := a.connected
 	a.mu.Unlock()
 	if channel == "" ||
 		!strings.HasPrefix(channel, "#") {
 		a.ui.AddStatus("[red]No channel to part")
 		return
 	}
 	if !connected {
 		a.ui.AddStatus("[red]Not connected")
 		return
 	}
 	err := a.client.PartChannel(channel)
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]Part failed: %v", err,
 		))
 		return
 	}
 	a.ui.AddLine(channel,
 		"[yellow]*** Left "+channel,
 	)
 	a.mu.Lock()
 	if a.target == channel {
 		a.target = ""
 	}
 	nick := a.nick
 	a.mu.Unlock()
 	a.ui.SwitchBuffer(0)
 	a.ui.SetStatus(nick, "", "connected")
 }
 func (a *App) cmdMsg(args string) {
 	parts := strings.SplitN(args, " ", splitParts)
 	if len(parts) < splitParts {
 		a.ui.AddStatus(
 			"[red]Usage: /msg <nick> <text>",
 		)
 		return
 	}
 	target, text := parts[0], parts[1]
 	a.mu.Lock()
 	connected := a.connected
 	nick := a.nick
 	a.mu.Unlock()
 	if !connected {
 		a.ui.AddStatus("[red]Not connected")
 		return
 	}
 	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
 		Command: irc.CmdPrivmsg,
 		To:      target,
 		Body:    []string{text},
 	})
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]Send failed: %v", err,
 		))
 		return
 	}
 	timestamp := time.Now().Format(timeFormat)
 	a.ui.AddLine(target, fmt.Sprintf(
 		"[gray]%s [green]<%s>[white] %s",
 		timestamp, nick, text,
 	))
 }
 func (a *App) cmdQuery(nick string) {
 	if nick == "" {
 		a.ui.AddStatus(
 			"[red]Usage: /query <nick>",
 		)
 		return
 	}
 	a.mu.Lock()
 	a.target = nick
 	myNick := a.nick
 	a.mu.Unlock()
 	a.ui.SwitchToBuffer(nick)
 	a.ui.SetStatus(myNick, nick, "connected")
 }
 func (a *App) cmdTopic(args string) {
 	a.mu.Lock()
 	target := a.target
 	connected := a.connected
 	a.mu.Unlock()
 	if !connected {
 		a.ui.AddStatus("[red]Not connected")
 		return
 	}
 	if !strings.HasPrefix(target, "#") {
 		a.ui.AddStatus("[red]Not in a channel")
 		return
 	}
 	if args == "" {
 		err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
 			Command: irc.CmdTopic,
 			To:      target,
 		})
 		if err != nil {
 			a.ui.AddStatus(fmt.Sprintf(
 				"[red]Topic query failed: %v", err,
 			))
 		}
 		return
 	}
 	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
 		Command: irc.CmdTopic,
 		To:      target,
 		Body:    []string{args},
 	})
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]Topic set failed: %v", err,
 		))
 	}
 }
 func (a *App) cmdNames() {
 	a.mu.Lock()
 	target := a.target
 	connected := a.connected
 	a.mu.Unlock()
 	if !connected {
 		a.ui.AddStatus("[red]Not connected")
 		return
 	}
 	if !strings.HasPrefix(target, "#") {
 		a.ui.AddStatus("[red]Not in a channel")
 		return
 	}
 	members, err := a.client.GetMembers(target)
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]Names failed: %v", err,
 		))
 		return
 	}
 	a.ui.AddLine(target, fmt.Sprintf(
 		"[cyan]*** Members of %s: %s",
 		target, strings.Join(members, " "),
 	))
 }
 func (a *App) cmdList() {
 	a.mu.Lock()
 	connected := a.connected
 	a.mu.Unlock()
 	if !connected {
 		a.ui.AddStatus("[red]Not connected")
 		return
 	}
 	channels, err := a.client.ListChannels()
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]List failed: %v", err,
 		))
 		return
 	}
 	a.ui.AddStatus("[cyan]*** Channel list:")
 	for _, ch := range channels {
 		a.ui.AddStatus(fmt.Sprintf(
 			"  %s (%d members) %s",
 			ch.Name, ch.Members, ch.Topic,
 		))
 	}
 	a.ui.AddStatus("[cyan]*** End of channel list")
 }
 func (a *App) cmdMotd() {
 	a.mu.Lock()
 	connected := a.connected
 	a.mu.Unlock()
 	if !connected {
 		a.ui.AddStatus("[red]Not connected")
 		return
 	}
 	err := a.client.SendMessage(
 		&api.Message{Command: irc.CmdMotd}, //nolint:exhaustruct
 	)
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]MOTD failed: %v", err,
 		))
 	}
 }
 func (a *App) cmdWho(args string) {
 	a.mu.Lock()
 	connected := a.connected
 	target := a.target
 	a.mu.Unlock()
 	if !connected {
 		a.ui.AddStatus("[red]Not connected")
 		return
 	}
 	channel := args
 	if channel == "" {
 		channel = target
 	}
 	if channel == "" ||
 		!strings.HasPrefix(channel, "#") {
 		a.ui.AddStatus(
 			"[red]Usage: /who #channel",
 		)
 		return
 	}
 	err := a.client.SendMessage(
 		&api.Message{ //nolint:exhaustruct
 			Command: irc.CmdWho, To: channel,
 		},
 	)
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]WHO failed: %v", err,
 		))
 	}
 }
 func (a *App) cmdWhois(args string) {
 	a.mu.Lock()
 	connected := a.connected
 	a.mu.Unlock()
 	if !connected {
 		a.ui.AddStatus("[red]Not connected")
 		return
 	}
 	if args == "" {
 		a.ui.AddStatus(
 			"[red]Usage: /whois <nick>",
 		)
 		return
 	}
 	err := a.client.SendMessage(
 		&api.Message{ //nolint:exhaustruct
 			Command: irc.CmdWhois, To: args,
 		},
 	)
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]WHOIS failed: %v", err,
 		))
 	}
 }
 func (a *App) cmdWindow(args string) {
 	if args == "" {
 		a.ui.AddStatus(
 			"[red]Usage: /window <number>",
 		)
 		return
 	}
 	var bufIndex int
 	_, _ = fmt.Sscanf(args, "%d", &bufIndex)
 	a.ui.SwitchBuffer(bufIndex)
 	a.mu.Lock()
 	nick := a.nick
 	a.mu.Unlock()
 	if bufIndex >= 0 && bufIndex < a.ui.BufferCount() {
 		buf := a.ui.buffers[bufIndex]
 		if buf.Name != "(status)" {
 			a.mu.Lock()
 			a.target = buf.Name
 			a.mu.Unlock()
 			a.ui.SetStatus(
 				nick, buf.Name, "connected",
 			)
 		} else {
 			a.ui.SetStatus(nick, "", "connected")
 		}
 	}
 }
 func (a *App) cmdQuit() {
 	a.mu.Lock()
 	if a.connected && a.client != nil {
 		_ = a.client.SendMessage(
 			&api.Message{Command: irc.CmdQuit}, //nolint:exhaustruct
 		)
 	}
 	if a.stopPoll != nil {
 		close(a.stopPoll)
 	}
 	a.mu.Unlock()
 	a.ui.Stop()
 }
 func (a *App) cmdHelp() {
 	help := []string{
 		"[cyan]*** neoirc-cli commands:",
 		"  /connect <url>  — Connect to server",
 		"  /nick <name>    — Change nickname",
 		"  /join #channel  — Join channel",
 		"  /part [#chan]    — Leave channel",
 		"  /msg <nick> <text> — Send DM",
 		"  /query <nick>   — Open DM window",
 		"  /topic [text]   — View/set topic",
 		"  /names          — List channel members",
 		"  /list           — List channels",
 		"  /who [#channel] — List users in channel",
 		"  /whois <nick>   — Show user info",
 		"  /motd           — Show message of the day",
 		"  /window <n>     — Switch buffer",
 		"  /quit           — Disconnect and exit",
 		"  /help           — This help",
 		"  Plain text sends to current target.",
 	}
 	for _, line := range help {
 		a.ui.AddStatus(line)
 	}
 }
 // pollLoop long-polls for messages in the background.
 func (a *App) pollLoop() {
 	for {
 		select {
 		case <-a.stopPoll:
 			return
 		default:
 		}
 		a.mu.Lock()
 		client := a.client
 		lastQID := a.lastQID
 		a.mu.Unlock()
 		if client == nil {
 			return
 		}
 		result, err := client.PollMessages(
 			lastQID, pollTimeout,
 		)
 		if err != nil {
 			time.Sleep(pollRetry)
 			continue
 		}
 		if result.LastID > 0 {
 			a.mu.Lock()
 			a.lastQID = result.LastID
 			a.mu.Unlock()
 		}
 		for i := range result.Messages {
 			a.handleServerMessage(&result.Messages[i])
 		}
 	}
 }
 func (a *App) handleServerMessage(msg *api.Message) {
 	timestamp := a.formatTS(msg)
 	a.mu.Lock()
 	myNick := a.nick
 	a.mu.Unlock()
 	switch msg.Command {
 	case irc.CmdPrivmsg:
 		a.handlePrivmsgEvent(msg, timestamp, myNick)
 	case irc.CmdJoin:
 		a.handleJoinEvent(msg, timestamp)
 	case irc.CmdPart:
 		a.handlePartEvent(msg, timestamp)
 	case irc.CmdQuit:
 		a.handleQuitEvent(msg, timestamp)
 	case irc.CmdNick:
 		a.handleNickEvent(msg, timestamp, myNick)
 	case irc.CmdNotice:
 		a.handleNoticeEvent(msg, timestamp)
 	case irc.CmdTopic:
 		a.handleTopicEvent(msg, timestamp)
 	default:
 		a.handleDefaultEvent(msg, timestamp)
 	}
 }
 func (a *App) formatTS(msg *api.Message) string {
 	if msg.TS != "" {
 		return msg.ParseTS().UTC().Format(timeFormat)
 	}
 	return time.Now().Format(timeFormat)
 }
 func (a *App) handlePrivmsgEvent(
 	msg *api.Message, timestamp, myNick string,
 ) {
 	lines := msg.BodyLines()
 	text := strings.Join(lines, " ")
 	if msg.From == myNick {
 		return
 	}
 	target := msg.To
 	if !strings.HasPrefix(target, "#") {
 		target = msg.From
 	}
 	a.ui.AddLine(target, fmt.Sprintf(
 		"[gray]%s [green]<%s>[white] %s",
 		timestamp, msg.From, text,
 	))
 }
 func (a *App) handleJoinEvent(
 	msg *api.Message, timestamp string,
 ) {
 	if msg.To == "" {
 		return
 	}
 	a.ui.AddLine(msg.To, fmt.Sprintf(
 		"[gray]%s [yellow]*** %s has joined %s",
 		timestamp, msg.From, msg.To,
 	))
 }
 func (a *App) handlePartEvent(
 	msg *api.Message, timestamp string,
 ) {
 	if msg.To == "" {
 		return
 	}
 	lines := msg.BodyLines()
 	reason := strings.Join(lines, " ")
 	if reason != "" {
 		a.ui.AddLine(msg.To, fmt.Sprintf(
 			"[gray]%s [yellow]*** %s has left %s (%s)",
 			timestamp, msg.From, msg.To, reason,
 		))
 	} else {
 		a.ui.AddLine(msg.To, fmt.Sprintf(
 			"[gray]%s [yellow]*** %s has left %s",
 			timestamp, msg.From, msg.To,
 		))
 	}
 }
 func (a *App) handleQuitEvent(
 	msg *api.Message, timestamp string,
 ) {
 	lines := msg.BodyLines()
 	reason := strings.Join(lines, " ")
 	if reason != "" {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[gray]%s [yellow]*** %s has quit (%s)",
 			timestamp, msg.From, reason,
 		))
 	} else {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[gray]%s [yellow]*** %s has quit",
 			timestamp, msg.From,
 		))
 	}
 }
 func (a *App) handleNickEvent(
 	msg *api.Message, timestamp, myNick string,
 ) {
 	lines := msg.BodyLines()
 	newNick := ""
 	if len(lines) > 0 {
 		newNick = lines[0]
 	}
 	if msg.From == myNick && newNick != "" {
 		a.mu.Lock()
 		a.nick = newNick
 		target := a.target
 		a.mu.Unlock()
 		a.ui.SetStatus(newNick, target, "connected")
 	}
 	a.ui.AddStatus(fmt.Sprintf(
 		"[gray]%s [yellow]*** %s is now known as %s",
 		timestamp, msg.From, newNick,
 	))
 }
 func (a *App) handleNoticeEvent(
 	msg *api.Message, timestamp string,
 ) {
 	lines := msg.BodyLines()
 	text := strings.Join(lines, " ")
 	a.ui.AddStatus(fmt.Sprintf(
 		"[gray]%s [magenta]--%s-- %s",
 		timestamp, msg.From, text,
 	))
 }
 func (a *App) handleTopicEvent(
 	msg *api.Message, timestamp string,
 ) {
 	if msg.To == "" {
 		return
 	}
 	lines := msg.BodyLines()
 	text := strings.Join(lines, " ")
 	a.ui.AddLine(msg.To, fmt.Sprintf(
 		"[gray]%s [cyan]*** %s set topic: %s",
 		timestamp, msg.From, text,
 	))
 }
 func (a *App) handleDefaultEvent(
 	msg *api.Message, timestamp string,
 ) {
 	lines := msg.BodyLines()
 	text := strings.Join(lines, " ")
 	if text != "" {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[gray]%s [white][%s] %s",
 			timestamp, msg.Command, text,
 		))
 	}
 }
--- a/cmd/neoircd/main.go
+++ b/cmd/neoircd/main.go
@@ -10,6 +10,7 @@ import (
 	"git.eeqj.de/sneak/neoirc/internal/logger"
 	"git.eeqj.de/sneak/neoirc/internal/middleware"
 	"git.eeqj.de/sneak/neoirc/internal/server"
 	"git.eeqj.de/sneak/neoirc/internal/stats"
 	"go.uber.org/fx"
 )
@@ -35,6 +36,7 @@ func main() {
 			server.New,
 			middleware.New,
 			healthcheck.New,
 			stats.New,
 		),
 		fx.Invoke(func(*server.Server) {}),
 	).Run()
--- a/go.mod
+++ b/go.mod
@@ -6,7 +6,7 @@ require (
 	github.com/99designs/basicauth-go v0.0.0-20230316000542-bf6f9cbbf0f8
 	github.com/gdamore/tcell/v2 v2.13.8
 	github.com/getsentry/sentry-go v0.42.0
-	github.com/go-chi/chi v1.5.5
+	github.com/go-chi/chi/v5 v5.2.1
 	github.com/go-chi/cors v1.2.2
 	github.com/google/uuid v1.6.0
 	github.com/joho/godotenv v1.5.1
@@ -16,6 +16,7 @@ require (
 	github.com/spf13/viper v1.21.0
 	go.uber.org/fx v1.24.0
 	golang.org/x/crypto v0.48.0
 	golang.org/x/time v0.6.0
 	modernc.org/sqlite v1.45.0
 )
--- a/go.sum
+++ b/go.sum
@@ -18,8 +18,8 @@ github.com/gdamore/tcell/v2 v2.13.8 h1:Mys/Kl5wfC/GcC5Cx4C2BIQH9dbnhnkPgS9/wF3Rl
 github.com/gdamore/tcell/v2 v2.13.8/go.mod h1:+Wfe208WDdB7INEtCsNrAN6O2m+wsTPk1RAovjaILlo=
 github.com/getsentry/sentry-go v0.42.0 h1:eeFMACuZTbUQf90RE8dE4tXeSe4CZyfvR1MBL7RLEt8=
 github.com/getsentry/sentry-go v0.42.0/go.mod h1:eRXCoh3uvmjQLY6qu63BjUZnaBu5L5WhMV1RwYO8W5s=
-github.com/go-chi/chi v1.5.5 h1:vOB/HbEMt9QqBqErz07QehcOKHaWFtuj87tTDVz2qXE=
+github.com/go-chi/chi/v5 v5.2.1 h1:KOIHODQj58PmL80G2Eak4WdvUzjSJSm0vG72crDCqb8=
-github.com/go-chi/chi v1.5.5/go.mod h1:C9JqLr3tIYjDOZpzn+BCuxY8z8vmca43EeMgyZt7irw=
+github.com/go-chi/chi/v5 v5.2.1/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
 github.com/go-chi/cors v1.2.2 h1:Jmey33TE+b+rB7fT8MUy1u0I4L+NARQlK6LhzKPSyQE=
 github.com/go-chi/cors v1.2.2/go.mod h1:sSbTewc+6wYHBBCW7ytsFSn836hqM7JxpglAy2Vzc58=
 github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
@@ -151,6 +151,8 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
 golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
 golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U=
 golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
--- a/cmd/neoirc-cli/api/client.go
+++ b/cmd/neoirc-cli/api/client.go
@@ -9,12 +9,13 @@ import (
 	"fmt"
 	"io"
 	"net/http"
 	"net/http/cookiejar"
 	"net/url"
 	"strconv"
 	"strings"
 	"time"
-	"git.eeqj.de/sneak/neoirc/internal/irc"
+	"git.eeqj.de/sneak/neoirc/pkg/irc"
 )
 const (
@@ -28,28 +29,48 @@ var errHTTP = errors.New("HTTP error")
 // Client wraps HTTP calls to the neoirc server API.
 type Client struct {
 	BaseURL    string
 	Token      string
 	HTTPClient *http.Client
 }
-// NewClient creates a new API client.
+// NewClient creates a new API client with a cookie jar
 // for automatic auth cookie management.
 func NewClient(baseURL string) *Client {
-	return &Client{ //nolint:exhaustruct // Token set after CreateSession
+	jar, _ := cookiejar.New(nil)
 	return &Client{
 		BaseURL: baseURL,
 		HTTPClient: &http.Client{ //nolint:exhaustruct // defaults fine
 			Timeout: httpTimeout,
 			Jar:     jar,
 		},
 	}
 }
 // CreateSession creates a new session on the server.
 // If the server requires hashcash proof-of-work, it
 // automatically fetches the difficulty and computes a
 // valid stamp.
 func (client *Client) CreateSession(
 	nick string,
 ) (*SessionResponse, error) {
 	// Fetch server info to check for hashcash requirement.
 	info, err := client.GetServerInfo()
 	var hashcashStamp string
 	if err == nil && info.HashcashBits > 0 {
 		resource := info.Name
 		if resource == "" {
 			resource = "neoirc"
 		}
 		hashcashStamp = MintHashcash(info.HashcashBits, resource)
 	}
 	data, err := client.do(
 		http.MethodPost,
 		"/api/v1/session",
-		&SessionRequest{Nick: nick},
+		&SessionRequest{Nick: nick, Hashcash: hashcashStamp},
 	)
 	if err != nil {
 		return nil, err
@@ -62,8 +83,6 @@ func (client *Client) CreateSession(
 		return nil, fmt.Errorf("decode session: %w", err)
 	}
 	client.Token = resp.Token
 	return &resp, nil
 }
@@ -104,6 +123,7 @@ func (client *Client) PollMessages(
 		Timeout: time.Duration(
 			timeout+pollExtraTime,
 		) * time.Second,
 		Jar: client.HTTPClient.Jar,
 	}
 	params := url.Values{}
@@ -128,10 +148,6 @@ func (client *Client) PollMessages(
 		return nil, fmt.Errorf("new request: %w", err)
 	}
 	request.Header.Set(
 		"Authorization", "Bearer "+client.Token,
 	)
 	resp, err := pollClient.Do(request)
 	if err != nil {
 		return nil, fmt.Errorf("poll request: %w", err)
@@ -287,12 +303,6 @@ func (client *Client) do(
 		"Content-Type", "application/json",
 	)
 	if client.Token != "" {
 		request.Header.Set(
 			"Authorization", "Bearer "+client.Token,
 		)
 	}
 	resp, err := client.HTTPClient.Do(request)
 	if err != nil {
 		return nil, fmt.Errorf("http: %w", err)
--- a/internal/cli/api/hashcash.go
+++ b/internal/cli/api/hashcash.go
@@ -0,0 +1,98 @@
 package neoircapi
 import (
 	"crypto/rand"
 	"crypto/sha256"
 	"encoding/hex"
 	"fmt"
 	"math/big"
 	"time"
 	"git.eeqj.de/sneak/neoirc/internal/hashcash"
 )
 const (
 	// bitsPerByte is the number of bits in a byte.
 	bitsPerByte = 8
 	// fullByteMask is 0xFF, a mask for all bits in a byte.
 	fullByteMask = 0xFF
 	// counterSpace is the range for random counter seeds.
 	counterSpace = 1 << 48
 )
 // MintHashcash computes a hashcash stamp with the given
 // difficulty (leading zero bits) and resource string.
 func MintHashcash(bits int, resource string) string {
 	date := time.Now().UTC().Format("060102")
 	prefix := fmt.Sprintf(
 		"1:%d:%s:%s::", bits, date, resource,
 	)
 	for {
 		counter := randomCounter()
 		stamp := prefix + counter
 		hash := sha256.Sum256([]byte(stamp))
 		if hasLeadingZeroBits(hash[:], bits) {
 			return stamp
 		}
 	}
 }
 // MintChannelHashcash computes a hashcash stamp bound to
 // a specific channel and message body. The stamp format
 // is 1:bits:YYMMDD:channel:bodyhash:counter where
 // bodyhash is the hex-encoded SHA-256 of the message
 // body bytes. Delegates to the internal/hashcash package.
 func MintChannelHashcash(
 	bits int,
 	channel string,
 	body []byte,
 ) string {
 	bodyHash := hashcash.BodyHash(body)
 	return hashcash.MintChannelStamp(
 		bits, channel, bodyHash,
 	)
 }
 // hasLeadingZeroBits checks if hash has at least numBits
 // leading zero bits.
 func hasLeadingZeroBits(
 	hash []byte,
 	numBits int,
 ) bool {
 	fullBytes := numBits / bitsPerByte
 	remainBits := numBits % bitsPerByte
 	for idx := range fullBytes {
 		if hash[idx] != 0 {
 			return false
 		}
 	}
 	if remainBits > 0 && fullBytes < len(hash) {
 		mask := byte(
 			fullByteMask << (bitsPerByte - remainBits),
 		)
 		if hash[fullBytes]&mask != 0 {
 			return false
 		}
 	}
 	return true
 }
 // randomCounter generates a random hex counter string.
 func randomCounter() string {
 	counterVal, err := rand.Int(
 		rand.Reader, big.NewInt(counterSpace),
 	)
 	if err != nil {
 		// Fallback to timestamp-based counter on error.
 		return fmt.Sprintf("%x", time.Now().UnixNano())
 	}
 	return hex.EncodeToString(counterVal.Bytes())
 }
--- a/cmd/neoirc-cli/api/types.go
+++ b/cmd/neoirc-cli/api/types.go
@@ -5,13 +5,13 @@ import "time"
 // SessionRequest is the body for POST /api/v1/session.
 type SessionRequest struct {
 	Nick     string `json:"nick"`
 	Hashcash string `json:"pow_token,omitempty"` //nolint:tagliatelle
 }
 // SessionResponse is the response from session creation.
 type SessionResponse struct {
 	ID   int64  `json:"id"`
 	Nick string `json:"nick"`
 	Token string `json:"token"`
 }
 // StateResponse is the response from GET /api/v1/state.
@@ -66,6 +66,7 @@ type ServerInfo struct {
 	Name         string `json:"name"`
 	MOTD         string `json:"motd"`
 	Version      string `json:"version"`
 	HashcashBits int    `json:"hashcash_bits"` //nolint:tagliatelle
 }
 // MessagesResponse wraps polling results.
--- a/internal/cli/app.go
+++ b/internal/cli/app.go
@@ -0,0 +1,912 @@
 // Package cli implements the neoirc-cli terminal client.
 package cli
 import (
 	"fmt"
 	"os"
 	"strings"
 	"sync"
 	"time"
 	api "git.eeqj.de/sneak/neoirc/internal/cli/api"
 	"git.eeqj.de/sneak/neoirc/pkg/irc"
 )
 const (
 	splitParts  = 2
 	pollTimeout = 15
 	pollRetry   = 2 * time.Second
 	timeFormat  = "15:04"
 )
 // App holds the application state.
 type App struct {
 	ui     *UI
 	client *api.Client
 	mu        sync.Mutex
 	nick      string
 	target    string
 	connected bool
 	lastQID   int64
 	stopPoll  chan struct{}
 }
 // Run creates and runs the CLI application.
 func Run() {
 	app := &App{ //nolint:exhaustruct
 		ui:   NewUI(),
 		nick: "guest",
 	}
 	app.ui.OnInput(app.handleInput)
 	app.ui.SetStatus(app.nick, "", "disconnected")
 	app.ui.AddStatus(
 		"Welcome to neoirc-cli — an IRC-style client",
 	)
 	app.ui.AddStatus(
 		"Type [yellow]/connect <server-url>" +
 			"[white] to begin, " +
 			"or [yellow]/help[white] for commands",
 	)
 	err := app.ui.Run()
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "Error: %v\n", err)
 		os.Exit(1)
 	}
 }
 func (a *App) handleInput(text string) {
 	if strings.HasPrefix(text, "/") {
 		a.handleCommand(text)
 		return
 	}
 	a.mu.Lock()
 	target := a.target
 	connected := a.connected
 	a.mu.Unlock()
 	if !connected {
 		a.ui.AddStatus(
 			"[red]Not connected. Use /connect <url>",
 		)
 		return
 	}
 	if target == "" {
 		a.ui.AddStatus(
 			"[red]No target. " +
 				"Use /join #channel or /query nick",
 		)
 		return
 	}
 	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
 		Command: irc.CmdPrivmsg,
 		To:      target,
 		Body:    []string{text},
 	})
 	if err != nil {
 		a.ui.AddStatus(
 			"[red]Send error: " + err.Error(),
 		)
 		return
 	}
 	timestamp := time.Now().Format(timeFormat)
 	a.mu.Lock()
 	nick := a.nick
 	a.mu.Unlock()
 	a.ui.AddLine(target, fmt.Sprintf(
 		"[gray]%s [green]<%s>[white] %s",
 		timestamp, nick, text,
 	))
 }
 func (a *App) handleCommand(text string) {
 	parts := strings.SplitN(text, " ", splitParts)
 	cmd := strings.ToLower(parts[0])
 	args := ""
 	if len(parts) > 1 {
 		args = parts[1]
 	}
 	a.dispatchCommand(cmd, args)
 }
 func (a *App) dispatchCommand(cmd, args string) {
 	switch cmd {
 	case "/connect":
 		a.cmdConnect(args)
 	case "/nick":
 		a.cmdNick(args)
 	case "/join":
 		a.cmdJoin(args)
 	case "/part":
 		a.cmdPart(args)
 	case "/msg":
 		a.cmdMsg(args)
 	case "/query":
 		a.cmdQuery(args)
 	case "/topic":
 		a.cmdTopic(args)
 	case "/window", "/w":
 		a.cmdWindow(args)
 	case "/quit":
 		a.cmdQuit()
 	case "/help":
 		a.cmdHelp()
 	default:
 		a.dispatchInfoCommand(cmd, args)
 	}
 }
 func (a *App) dispatchInfoCommand(cmd, args string) {
 	switch cmd {
 	case "/names":
 		a.cmdNames()
 	case "/list":
 		a.cmdList()
 	case "/motd":
 		a.cmdMotd()
 	case "/who":
 		a.cmdWho(args)
 	case "/whois":
 		a.cmdWhois(args)
 	default:
 		a.ui.AddStatus(
 			"[red]Unknown command: " + cmd,
 		)
 	}
 }
 func (a *App) cmdConnect(serverURL string) {
 	if serverURL == "" {
 		a.ui.AddStatus(
 			"[red]Usage: /connect <server-url>",
 		)
 		return
 	}
 	serverURL = strings.TrimRight(serverURL, "/")
 	a.ui.AddStatus("Connecting to " + serverURL + "...")
 	a.mu.Lock()
 	nick := a.nick
 	a.mu.Unlock()
 	client := api.NewClient(serverURL)
 	resp, err := client.CreateSession(nick)
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]Connection failed: %v", err,
 		))
 		return
 	}
 	a.mu.Lock()
 	a.client = client
 	a.nick = resp.Nick
 	a.connected = true
 	a.lastQID = 0
 	a.mu.Unlock()
 	a.ui.AddStatus(fmt.Sprintf(
 		"[green]Connected! Nick: %s, Session: %d",
 		resp.Nick, resp.ID,
 	))
 	a.ui.SetStatus(resp.Nick, "", "connected")
 	a.stopPoll = make(chan struct{})
 	go a.pollLoop()
 }
 func (a *App) cmdNick(nick string) {
 	if nick == "" {
 		a.ui.AddStatus(
 			"[red]Usage: /nick <name>",
 		)
 		return
 	}
 	a.mu.Lock()
 	connected := a.connected
 	a.mu.Unlock()
 	if !connected {
 		a.mu.Lock()
 		a.nick = nick
 		a.mu.Unlock()
 		a.ui.AddStatus(
 			"Nick set to " + nick +
 				" (will be used on connect)",
 		)
 		return
 	}
 	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
 		Command: irc.CmdNick,
 		Body:    []string{nick},
 	})
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]Nick change failed: %v", err,
 		))
 		return
 	}
 	a.mu.Lock()
 	a.nick = nick
 	target := a.target
 	a.mu.Unlock()
 	a.ui.SetStatus(nick, target, "connected")
 	a.ui.AddStatus("Nick changed to " + nick)
 }
 func (a *App) cmdJoin(channel string) {
 	if channel == "" {
 		a.ui.AddStatus(
 			"[red]Usage: /join #channel",
 		)
 		return
 	}
 	if !strings.HasPrefix(channel, "#") {
 		channel = "#" + channel
 	}
 	a.mu.Lock()
 	connected := a.connected
 	a.mu.Unlock()
 	if !connected {
 		a.ui.AddStatus("[red]Not connected")
 		return
 	}
 	err := a.client.JoinChannel(channel)
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]Join failed: %v", err,
 		))
 		return
 	}
 	a.mu.Lock()
 	a.target = channel
 	nick := a.nick
 	a.mu.Unlock()
 	a.ui.SwitchToBuffer(channel)
 	a.ui.AddLine(channel,
 		"[yellow]*** Joined "+channel,
 	)
 	a.ui.SetStatus(nick, channel, "connected")
 }
 func (a *App) cmdPart(channel string) {
 	a.mu.Lock()
 	if channel == "" {
 		channel = a.target
 	}
 	connected := a.connected
 	a.mu.Unlock()
 	if channel == "" ||
 		!strings.HasPrefix(channel, "#") {
 		a.ui.AddStatus("[red]No channel to part")
 		return
 	}
 	if !connected {
 		a.ui.AddStatus("[red]Not connected")
 		return
 	}
 	err := a.client.PartChannel(channel)
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]Part failed: %v", err,
 		))
 		return
 	}
 	a.ui.AddLine(channel,
 		"[yellow]*** Left "+channel,
 	)
 	a.mu.Lock()
 	if a.target == channel {
 		a.target = ""
 	}
 	nick := a.nick
 	a.mu.Unlock()
 	a.ui.SwitchBuffer(0)
 	a.ui.SetStatus(nick, "", "connected")
 }
 func (a *App) cmdMsg(args string) {
 	parts := strings.SplitN(args, " ", splitParts)
 	if len(parts) < splitParts {
 		a.ui.AddStatus(
 			"[red]Usage: /msg <nick> <text>",
 		)
 		return
 	}
 	target, text := parts[0], parts[1]
 	a.mu.Lock()
 	connected := a.connected
 	nick := a.nick
 	a.mu.Unlock()
 	if !connected {
 		a.ui.AddStatus("[red]Not connected")
 		return
 	}
 	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
 		Command: irc.CmdPrivmsg,
 		To:      target,
 		Body:    []string{text},
 	})
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]Send failed: %v", err,
 		))
 		return
 	}
 	timestamp := time.Now().Format(timeFormat)
 	a.ui.AddLine(target, fmt.Sprintf(
 		"[gray]%s [green]<%s>[white] %s",
 		timestamp, nick, text,
 	))
 }
 func (a *App) cmdQuery(nick string) {
 	if nick == "" {
 		a.ui.AddStatus(
 			"[red]Usage: /query <nick>",
 		)
 		return
 	}
 	a.mu.Lock()
 	a.target = nick
 	myNick := a.nick
 	a.mu.Unlock()
 	a.ui.SwitchToBuffer(nick)
 	a.ui.SetStatus(myNick, nick, "connected")
 }
 func (a *App) cmdTopic(args string) {
 	a.mu.Lock()
 	target := a.target
 	connected := a.connected
 	a.mu.Unlock()
 	if !connected {
 		a.ui.AddStatus("[red]Not connected")
 		return
 	}
 	if !strings.HasPrefix(target, "#") {
 		a.ui.AddStatus("[red]Not in a channel")
 		return
 	}
 	if args == "" {
 		err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
 			Command: irc.CmdTopic,
 			To:      target,
 		})
 		if err != nil {
 			a.ui.AddStatus(fmt.Sprintf(
 				"[red]Topic query failed: %v", err,
 			))
 		}
 		return
 	}
 	err := a.client.SendMessage(&api.Message{ //nolint:exhaustruct
 		Command: irc.CmdTopic,
 		To:      target,
 		Body:    []string{args},
 	})
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]Topic set failed: %v", err,
 		))
 	}
 }
 func (a *App) cmdNames() {
 	a.mu.Lock()
 	target := a.target
 	connected := a.connected
 	a.mu.Unlock()
 	if !connected {
 		a.ui.AddStatus("[red]Not connected")
 		return
 	}
 	if !strings.HasPrefix(target, "#") {
 		a.ui.AddStatus("[red]Not in a channel")
 		return
 	}
 	members, err := a.client.GetMembers(target)
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]Names failed: %v", err,
 		))
 		return
 	}
 	a.ui.AddLine(target, fmt.Sprintf(
 		"[cyan]*** Members of %s: %s",
 		target, strings.Join(members, " "),
 	))
 }
 func (a *App) cmdList() {
 	a.mu.Lock()
 	connected := a.connected
 	a.mu.Unlock()
 	if !connected {
 		a.ui.AddStatus("[red]Not connected")
 		return
 	}
 	channels, err := a.client.ListChannels()
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]List failed: %v", err,
 		))
 		return
 	}
 	a.ui.AddStatus("[cyan]*** Channel list:")
 	for _, ch := range channels {
 		a.ui.AddStatus(fmt.Sprintf(
 			"  %s (%d members) %s",
 			ch.Name, ch.Members, ch.Topic,
 		))
 	}
 	a.ui.AddStatus("[cyan]*** End of channel list")
 }
 func (a *App) cmdMotd() {
 	a.mu.Lock()
 	connected := a.connected
 	a.mu.Unlock()
 	if !connected {
 		a.ui.AddStatus("[red]Not connected")
 		return
 	}
 	err := a.client.SendMessage(
 		&api.Message{Command: irc.CmdMotd}, //nolint:exhaustruct
 	)
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]MOTD failed: %v", err,
 		))
 	}
 }
 func (a *App) cmdWho(args string) {
 	a.mu.Lock()
 	connected := a.connected
 	target := a.target
 	a.mu.Unlock()
 	if !connected {
 		a.ui.AddStatus("[red]Not connected")
 		return
 	}
 	channel := args
 	if channel == "" {
 		channel = target
 	}
 	if channel == "" ||
 		!strings.HasPrefix(channel, "#") {
 		a.ui.AddStatus(
 			"[red]Usage: /who #channel",
 		)
 		return
 	}
 	err := a.client.SendMessage(
 		&api.Message{ //nolint:exhaustruct
 			Command: irc.CmdWho, To: channel,
 		},
 	)
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]WHO failed: %v", err,
 		))
 	}
 }
 func (a *App) cmdWhois(args string) {
 	a.mu.Lock()
 	connected := a.connected
 	a.mu.Unlock()
 	if !connected {
 		a.ui.AddStatus("[red]Not connected")
 		return
 	}
 	if args == "" {
 		a.ui.AddStatus(
 			"[red]Usage: /whois <nick>",
 		)
 		return
 	}
 	err := a.client.SendMessage(
 		&api.Message{ //nolint:exhaustruct
 			Command: irc.CmdWhois, To: args,
 		},
 	)
 	if err != nil {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[red]WHOIS failed: %v", err,
 		))
 	}
 }
 func (a *App) cmdWindow(args string) {
 	if args == "" {
 		a.ui.AddStatus(
 			"[red]Usage: /window <number>",
 		)
 		return
 	}
 	var bufIndex int
 	_, _ = fmt.Sscanf(args, "%d", &bufIndex)
 	a.ui.SwitchBuffer(bufIndex)
 	a.mu.Lock()
 	nick := a.nick
 	a.mu.Unlock()
 	if bufIndex >= 0 && bufIndex < a.ui.BufferCount() {
 		buf := a.ui.buffers[bufIndex]
 		if buf.Name != "(status)" {
 			a.mu.Lock()
 			a.target = buf.Name
 			a.mu.Unlock()
 			a.ui.SetStatus(
 				nick, buf.Name, "connected",
 			)
 		} else {
 			a.ui.SetStatus(nick, "", "connected")
 		}
 	}
 }
 func (a *App) cmdQuit() {
 	a.mu.Lock()
 	if a.connected && a.client != nil {
 		_ = a.client.SendMessage(
 			&api.Message{Command: irc.CmdQuit}, //nolint:exhaustruct
 		)
 	}
 	if a.stopPoll != nil {
 		close(a.stopPoll)
 	}
 	a.mu.Unlock()
 	a.ui.Stop()
 }
 func (a *App) cmdHelp() {
 	help := []string{
 		"[cyan]*** neoirc-cli commands:",
 		"  /connect <url>  — Connect to server",
 		"  /nick <name>    — Change nickname",
 		"  /join #channel  — Join channel",
 		"  /part [#chan]    — Leave channel",
 		"  /msg <nick> <text> — Send DM",
 		"  /query <nick>   — Open DM window",
 		"  /topic [text]   — View/set topic",
 		"  /names          — List channel members",
 		"  /list           — List channels",
 		"  /who [#channel] — List users in channel",
 		"  /whois <nick>   — Show user info",
 		"  /motd           — Show message of the day",
 		"  /window <n>     — Switch buffer",
 		"  /quit           — Disconnect and exit",
 		"  /help           — This help",
 		"  Plain text sends to current target.",
 	}
 	for _, line := range help {
 		a.ui.AddStatus(line)
 	}
 }
 // pollLoop long-polls for messages in the background.
 func (a *App) pollLoop() {
 	for {
 		select {
 		case <-a.stopPoll:
 			return
 		default:
 		}
 		a.mu.Lock()
 		client := a.client
 		lastQID := a.lastQID
 		a.mu.Unlock()
 		if client == nil {
 			return
 		}
 		result, err := client.PollMessages(
 			lastQID, pollTimeout,
 		)
 		if err != nil {
 			time.Sleep(pollRetry)
 			continue
 		}
 		if result.LastID > 0 {
 			a.mu.Lock()
 			a.lastQID = result.LastID
 			a.mu.Unlock()
 		}
 		for i := range result.Messages {
 			a.handleServerMessage(&result.Messages[i])
 		}
 	}
 }
 func (a *App) handleServerMessage(msg *api.Message) {
 	timestamp := a.formatTS(msg)
 	a.mu.Lock()
 	myNick := a.nick
 	a.mu.Unlock()
 	switch msg.Command {
 	case irc.CmdPrivmsg:
 		a.handlePrivmsgEvent(msg, timestamp, myNick)
 	case irc.CmdJoin:
 		a.handleJoinEvent(msg, timestamp)
 	case irc.CmdPart:
 		a.handlePartEvent(msg, timestamp)
 	case irc.CmdQuit:
 		a.handleQuitEvent(msg, timestamp)
 	case irc.CmdNick:
 		a.handleNickEvent(msg, timestamp, myNick)
 	case irc.CmdNotice:
 		a.handleNoticeEvent(msg, timestamp)
 	case irc.CmdTopic:
 		a.handleTopicEvent(msg, timestamp)
 	default:
 		a.handleDefaultEvent(msg, timestamp)
 	}
 }
 func (a *App) formatTS(msg *api.Message) string {
 	if msg.TS != "" {
 		return msg.ParseTS().UTC().Format(timeFormat)
 	}
 	return time.Now().Format(timeFormat)
 }
 func (a *App) handlePrivmsgEvent(
 	msg *api.Message, timestamp, myNick string,
 ) {
 	lines := msg.BodyLines()
 	text := strings.Join(lines, " ")
 	if msg.From == myNick {
 		return
 	}
 	target := msg.To
 	if !strings.HasPrefix(target, "#") {
 		target = msg.From
 	}
 	a.ui.AddLine(target, fmt.Sprintf(
 		"[gray]%s [green]<%s>[white] %s",
 		timestamp, msg.From, text,
 	))
 }
 func (a *App) handleJoinEvent(
 	msg *api.Message, timestamp string,
 ) {
 	if msg.To == "" {
 		return
 	}
 	a.ui.AddLine(msg.To, fmt.Sprintf(
 		"[gray]%s [yellow]*** %s has joined %s",
 		timestamp, msg.From, msg.To,
 	))
 }
 func (a *App) handlePartEvent(
 	msg *api.Message, timestamp string,
 ) {
 	if msg.To == "" {
 		return
 	}
 	lines := msg.BodyLines()
 	reason := strings.Join(lines, " ")
 	if reason != "" {
 		a.ui.AddLine(msg.To, fmt.Sprintf(
 			"[gray]%s [yellow]*** %s has left %s (%s)",
 			timestamp, msg.From, msg.To, reason,
 		))
 	} else {
 		a.ui.AddLine(msg.To, fmt.Sprintf(
 			"[gray]%s [yellow]*** %s has left %s",
 			timestamp, msg.From, msg.To,
 		))
 	}
 }
 func (a *App) handleQuitEvent(
 	msg *api.Message, timestamp string,
 ) {
 	lines := msg.BodyLines()
 	reason := strings.Join(lines, " ")
 	if reason != "" {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[gray]%s [yellow]*** %s has quit (%s)",
 			timestamp, msg.From, reason,
 		))
 	} else {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[gray]%s [yellow]*** %s has quit",
 			timestamp, msg.From,
 		))
 	}
 }
 func (a *App) handleNickEvent(
 	msg *api.Message, timestamp, myNick string,
 ) {
 	lines := msg.BodyLines()
 	newNick := ""
 	if len(lines) > 0 {
 		newNick = lines[0]
 	}
 	if msg.From == myNick && newNick != "" {
 		a.mu.Lock()
 		a.nick = newNick
 		target := a.target
 		a.mu.Unlock()
 		a.ui.SetStatus(newNick, target, "connected")
 	}
 	a.ui.AddStatus(fmt.Sprintf(
 		"[gray]%s [yellow]*** %s is now known as %s",
 		timestamp, msg.From, newNick,
 	))
 }
 func (a *App) handleNoticeEvent(
 	msg *api.Message, timestamp string,
 ) {
 	lines := msg.BodyLines()
 	text := strings.Join(lines, " ")
 	a.ui.AddStatus(fmt.Sprintf(
 		"[gray]%s [magenta]--%s-- %s",
 		timestamp, msg.From, text,
 	))
 }
 func (a *App) handleTopicEvent(
 	msg *api.Message, timestamp string,
 ) {
 	if msg.To == "" {
 		return
 	}
 	lines := msg.BodyLines()
 	text := strings.Join(lines, " ")
 	a.ui.AddLine(msg.To, fmt.Sprintf(
 		"[gray]%s [cyan]*** %s set topic: %s",
 		timestamp, msg.From, text,
 	))
 }
 func (a *App) handleDefaultEvent(
 	msg *api.Message, timestamp string,
 ) {
 	lines := msg.BodyLines()
 	text := strings.Join(lines, " ")
 	if text != "" {
 		a.ui.AddStatus(fmt.Sprintf(
 			"[gray]%s [white][%s] %s",
 			timestamp, msg.Command, text,
 		))
 	}
 }
--- a/cmd/neoirc-cli/ui.go
+++ b/cmd/neoirc-cli/ui.go
@@ -1,4 +1,4 @@
-package main
+package cli
 import (
 	"fmt"
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -38,12 +38,18 @@ type Config struct {
 	MetricsUsername    string
 	Port               int
 	SentryDSN          string
-	MaxHistory         int
+	MessageMaxAge      string
 	MaxMessageSize     int
 	QueueMaxAge        string
 	MOTD               string
 	ServerName         string
 	FederationKey      string
 	SessionIdleTimeout string
 	HashcashBits       int
 	OperName           string
 	OperPassword       string
 	LoginRateLimit     float64
 	LoginRateBurst     int
 	params             *Params
 	log                *slog.Logger
 }
@@ -68,12 +74,18 @@ func New(
 	viper.SetDefault("SENTRY_DSN", "")
 	viper.SetDefault("METRICS_USERNAME", "")
 	viper.SetDefault("METRICS_PASSWORD", "")
-	viper.SetDefault("MAX_HISTORY", "10000")
+	viper.SetDefault("MESSAGE_MAX_AGE", "720h")
 	viper.SetDefault("MAX_MESSAGE_SIZE", "4096")
 	viper.SetDefault("QUEUE_MAX_AGE", "720h")
 	viper.SetDefault("MOTD", defaultMOTD)
 	viper.SetDefault("SERVER_NAME", "")
 	viper.SetDefault("FEDERATION_KEY", "")
-	viper.SetDefault("SESSION_IDLE_TIMEOUT", "24h")
+	viper.SetDefault("SESSION_IDLE_TIMEOUT", "720h")
 	viper.SetDefault("NEOIRC_HASHCASH_BITS", "20")
 	viper.SetDefault("NEOIRC_OPER_NAME", "")
 	viper.SetDefault("NEOIRC_OPER_PASSWORD", "")
 	viper.SetDefault("LOGIN_RATE_LIMIT", "1")
 	viper.SetDefault("LOGIN_RATE_BURST", "5")
 	err := viper.ReadInConfig()
 	if err != nil {
@@ -92,12 +104,18 @@ func New(
 		MaintenanceMode:    viper.GetBool("MAINTENANCE_MODE"),
 		MetricsUsername:    viper.GetString("METRICS_USERNAME"),
 		MetricsPassword:    viper.GetString("METRICS_PASSWORD"),
-		MaxHistory:         viper.GetInt("MAX_HISTORY"),
+		MessageMaxAge:      viper.GetString("MESSAGE_MAX_AGE"),
 		MaxMessageSize:     viper.GetInt("MAX_MESSAGE_SIZE"),
 		QueueMaxAge:        viper.GetString("QUEUE_MAX_AGE"),
 		MOTD:               viper.GetString("MOTD"),
 		ServerName:         viper.GetString("SERVER_NAME"),
 		FederationKey:      viper.GetString("FEDERATION_KEY"),
 		SessionIdleTimeout: viper.GetString("SESSION_IDLE_TIMEOUT"),
 		HashcashBits:       viper.GetInt("NEOIRC_HASHCASH_BITS"),
 		OperName:           viper.GetString("NEOIRC_OPER_NAME"),
 		OperPassword:       viper.GetString("NEOIRC_OPER_PASSWORD"),
 		LoginRateLimit:     viper.GetFloat64("LOGIN_RATE_LIMIT"),
 		LoginRateBurst:     viper.GetInt("LOGIN_RATE_BURST"),
 		log:                log,
 		params:             &params,
 	}
--- a/internal/db/auth.go
+++ b/internal/db/auth.go
@@ -10,91 +10,46 @@ import (
 	"golang.org/x/crypto/bcrypt"
 )
-const bcryptCost = bcrypt.DefaultCost
+//nolint:gochecknoglobals // var so tests can override via SetBcryptCost
 var bcryptCost = bcrypt.DefaultCost
 // SetBcryptCost overrides the bcrypt cost.
 // Use bcrypt.MinCost in tests to avoid slow hashing.
 func SetBcryptCost(cost int) { bcryptCost = cost }
 var errNoPassword = errors.New(
 	"account has no password set",
 )
-// RegisterUser creates a session with a hashed password
+// SetPassword sets a bcrypt-hashed password on a session,
-// and returns session ID, client ID, and token.
+// enabling multi-client login via POST /api/v1/login.
-func (database *Database) RegisterUser(
+func (database *Database) SetPassword(
 	ctx context.Context,
-	nick, password string,
+	sessionID int64,
-) (int64, int64, string, error) {
+	password string,
 ) error {
 	hash, err := bcrypt.GenerateFromPassword(
 		[]byte(password), bcryptCost,
 	)
 	if err != nil {
-		return 0, 0, "", fmt.Errorf(
+		return fmt.Errorf("hash password: %w", err)
 			"hash password: %w", err,
 		)
 	}
-	sessionUUID := uuid.New().String()
+	_, err = database.conn.ExecContext(ctx,
-	clientUUID := uuid.New().String()
+		"UPDATE sessions SET password_hash = ? WHERE id = ?",
-
+		string(hash), sessionID)
 	token, err := generateToken()
 	if err != nil {
-		return 0, 0, "", err
+		return fmt.Errorf("set password: %w", err)
 	}
-	now := time.Now()
+	return nil
 	transaction, err := database.conn.BeginTx(ctx, nil)
 	if err != nil {
 		return 0, 0, "", fmt.Errorf(
 			"begin tx: %w", err,
 		)
 	}
 	res, err := transaction.ExecContext(ctx,
 		`INSERT INTO sessions
 		 (uuid, nick, password_hash,
 		  created_at, last_seen)
 		 VALUES (?, ?, ?, ?, ?)`,
 		sessionUUID, nick, string(hash), now, now)
 	if err != nil {
 		_ = transaction.Rollback()
 		return 0, 0, "", fmt.Errorf(
 			"create session: %w", err,
 		)
 	}
 	sessionID, _ := res.LastInsertId()
 	clientRes, err := transaction.ExecContext(ctx,
 		`INSERT INTO clients
 		 (uuid, session_id, token,
 		  created_at, last_seen)
 		 VALUES (?, ?, ?, ?, ?)`,
 		clientUUID, sessionID, token, now, now)
 	if err != nil {
 		_ = transaction.Rollback()
 		return 0, 0, "", fmt.Errorf(
 			"create client: %w", err,
 		)
 	}
 	clientID, _ := clientRes.LastInsertId()
 	err = transaction.Commit()
 	if err != nil {
 		return 0, 0, "", fmt.Errorf(
 			"commit registration: %w", err,
 		)
 	}
 	return sessionID, clientID, token, nil
 }
 // LoginUser verifies a nick/password and creates a new
 // client token.
 func (database *Database) LoginUser(
 	ctx context.Context,
-	nick, password string,
+	nick, password, remoteIP, hostname string,
 ) (int64, int64, string, error) {
 	var (
 		sessionID    int64
@@ -137,12 +92,15 @@ func (database *Database) LoginUser(
 	now := time.Now()
 	tokenHash := hashToken(token)
 	res, err := database.conn.ExecContext(ctx,
 		`INSERT INTO clients
-		 (uuid, session_id, token,
+		 (uuid, session_id, token, ip, hostname,
 		  created_at, last_seen)
-		 VALUES (?, ?, ?, ?, ?)`,
+		 VALUES (?, ?, ?, ?, ?, ?, ?)`,
-		clientUUID, sessionID, token, now, now)
+		clientUUID, sessionID, tokenHash,
 		remoteIP, hostname, now, now)
 	if err != nil {
 		return 0, 0, "", fmt.Errorf(
 			"create login client: %w", err,
--- a/internal/db/auth_test.go
+++ b/internal/db/auth_test.go
@@ -6,63 +6,65 @@ import (
 	_ "modernc.org/sqlite"
 )
-func TestRegisterUser(t *testing.T) {
+func TestSetPassword(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	ctx := t.Context()
-	sessionID, clientID, token, err :=
+	sessionID, _, _, err :=
-		database.RegisterUser(ctx, "reguser", "password123")
+		database.CreateSession(ctx, "passuser", "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
-	if sessionID == 0 || clientID == 0 || token == "" {
+	err = database.SetPassword(
 		ctx, sessionID, "password123",
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	// Verify we can now log in with the password.
 	loginSID, loginCID, loginToken, err :=
 		database.LoginUser(ctx, "passuser", "password123", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
 	if loginSID == 0 || loginCID == 0 || loginToken == "" {
 		t.Fatal("expected valid ids and token")
 	}
 	// Verify session works via token lookup.
 	sid, cid, nick, err :=
 		database.GetSessionByToken(ctx, token)
 	if err != nil {
 		t.Fatal(err)
 }
-	if sid != sessionID || cid != clientID {
+func TestSetPasswordThenWrongLogin(t *testing.T) {
 		t.Fatal("session/client id mismatch")
 	}
 	if nick != "reguser" {
 		t.Fatalf("expected reguser, got %s", nick)
 	}
 }
 func TestRegisterUserDuplicateNick(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	ctx := t.Context()
-	regSID, regCID, regToken, err :=
+	sessionID, _, _, err :=
-		database.RegisterUser(ctx, "dupnick", "password123")
+		database.CreateSession(ctx, "wrongpw", "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
-	_ = regSID
+	err = database.SetPassword(
-	_ = regCID
+		ctx, sessionID, "correctpass",
-	_ = regToken
+	)
-
+	if err != nil {
-	dupSID, dupCID, dupToken, dupErr :=
+		t.Fatal(err)
 		database.RegisterUser(ctx, "dupnick", "other12345")
 	if dupErr == nil {
 		t.Fatal("expected error for duplicate nick")
 	}
-	_ = dupSID
+	loginSID, loginCID, loginToken, loginErr :=
-	_ = dupCID
+		database.LoginUser(ctx, "wrongpw", "wrongpass12", "", "")
-	_ = dupToken
+	if loginErr == nil {
 		t.Fatal("expected error for wrong password")
 	}
 	_ = loginSID
 	_ = loginCID
 	_ = loginToken
 }
 func TestLoginUser(t *testing.T) {
@@ -71,23 +73,26 @@ func TestLoginUser(t *testing.T) {
 	database := setupTestDB(t)
 	ctx := t.Context()
-	regSID, regCID, regToken, err :=
+	sessionID, _, _, err :=
-		database.RegisterUser(ctx, "loginuser", "mypassword")
+		database.CreateSession(ctx, "loginuser", "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
-	_ = regSID
+	err = database.SetPassword(
-	_ = regCID
+		ctx, sessionID, "mypassword",
-	_ = regToken
+	)
 	sessionID, clientID, token, err :=
 		database.LoginUser(ctx, "loginuser", "mypassword")
 	if err != nil {
 		t.Fatal(err)
 	}
-	if sessionID == 0 || clientID == 0 || token == "" {
+	loginSID, loginCID, token, err :=
 		database.LoginUser(ctx, "loginuser", "mypassword", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
 	if loginSID == 0 || loginCID == 0 || token == "" {
 		t.Fatal("expected valid ids and token")
 	}
@@ -103,33 +108,6 @@ func TestLoginUser(t *testing.T) {
 	}
 }
 func TestLoginUserWrongPassword(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	ctx := t.Context()
 	regSID, regCID, regToken, err :=
 		database.RegisterUser(ctx, "wrongpw", "correctpass")
 	if err != nil {
 		t.Fatal(err)
 	}
 	_ = regSID
 	_ = regCID
 	_ = regToken
 	loginSID, loginCID, loginToken, loginErr :=
 		database.LoginUser(ctx, "wrongpw", "wrongpass12")
 	if loginErr == nil {
 		t.Fatal("expected error for wrong password")
 	}
 	_ = loginSID
 	_ = loginCID
 	_ = loginToken
 }
 func TestLoginUserNoPassword(t *testing.T) {
 	t.Parallel()
@@ -138,7 +116,7 @@ func TestLoginUserNoPassword(t *testing.T) {
 	// Create anonymous session (no password).
 	anonSID, anonCID, anonToken, err :=
-		database.CreateSession(ctx, "anon")
+		database.CreateSession(ctx, "anon", "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -148,7 +126,7 @@ func TestLoginUserNoPassword(t *testing.T) {
 	_ = anonToken
 	loginSID, loginCID, loginToken, loginErr :=
-		database.LoginUser(ctx, "anon", "anything1")
+		database.LoginUser(ctx, "anon", "anything1", "", "")
 	if loginErr == nil {
 		t.Fatal(
 			"expected error for login on passwordless account",
@@ -167,7 +145,7 @@ func TestLoginUserNonexistent(t *testing.T) {
 	ctx := t.Context()
 	loginSID, loginCID, loginToken, err :=
-		database.LoginUser(ctx, "ghost", "password123")
+		database.LoginUser(ctx, "ghost", "password123", "", "")
 	if err == nil {
 		t.Fatal("expected error for nonexistent user")
 	}
--- a/internal/db/db.go
+++ b/internal/db/db.go
@@ -135,13 +135,21 @@ type migration struct {
 func (database *Database) runMigrations(
 	ctx context.Context,
 ) error {
-	_, err := database.conn.ExecContext(ctx,
+	bootstrap, err := SchemaFiles.ReadFile(
-		`CREATE TABLE IF NOT EXISTS schema_migrations (
+		"schema/000.sql",
-		 version INTEGER PRIMARY KEY,
+	)
 		 applied_at DATETIME DEFAULT CURRENT_TIMESTAMP)`)
 	if err != nil {
 		return fmt.Errorf(
-			"create schema_migrations: %w", err,
+			"read bootstrap migration: %w", err,
 		)
 	}
 	_, err = database.conn.ExecContext(
 		ctx, string(bootstrap),
 	)
 	if err != nil {
 		return fmt.Errorf(
 			"execute bootstrap migration: %w", err,
 		)
 	}
@@ -270,6 +278,11 @@ func (database *Database) loadMigrations() (
 			continue
 		}
 		// Skip bootstrap migration; it is executed separately.
 		if version == 0 {
 			continue
 		}
 		content, readErr := SchemaFiles.ReadFile(
 			"schema/" + entry.Name(),
 		)
--- a/internal/db/errors.go
+++ b/internal/db/errors.go
@@ -0,0 +1,20 @@
 // Package db provides database access and migration management.
 package db
 import (
 	"errors"
 	"modernc.org/sqlite"
 	sqlite3 "modernc.org/sqlite/lib"
 )
 // IsUniqueConstraintError reports whether err is a SQLite
 // unique-constraint violation.
 func IsUniqueConstraintError(err error) bool {
 	var sqliteErr *sqlite.Error
 	if !errors.As(err, &sqliteErr) {
 		return false
 	}
 	return sqliteErr.Code() == sqlite3.SQLITE_CONSTRAINT_UNIQUE
 }
--- a/internal/db/main_test.go
+++ b/internal/db/main_test.go
@@ -0,0 +1,14 @@
 package db_test
 import (
 	"os"
 	"testing"
 	"git.eeqj.de/sneak/neoirc/internal/db"
 	"golang.org/x/crypto/bcrypt"
 )
 func TestMain(m *testing.M) {
 	db.SetBcryptCost(bcrypt.MinCost)
 	os.Exit(m.Run())
 }
--- a/internal/db/queries.go
+++ b/internal/db/queries.go
--- a/internal/db/queries_test.go
+++ b/internal/db/queries_test.go
@@ -34,7 +34,7 @@ func TestCreateSession(t *testing.T) {
 	ctx := t.Context()
 	sessionID, _, token, err := database.CreateSession(
-		ctx, "alice",
+		ctx, "alice", "", "", "",
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -45,7 +45,7 @@ func TestCreateSession(t *testing.T) {
 	}
 	_, _, dupToken, dupErr := database.CreateSession(
-		ctx, "alice",
+		ctx, "alice", "", "", "",
 	)
 	if dupErr == nil {
 		t.Fatal("expected error for duplicate nick")
@@ -54,13 +54,249 @@ func TestCreateSession(t *testing.T) {
 	_ = dupToken
 }
 // assertSessionHostInfo creates a session and verifies
 // the stored username and hostname match expectations.
 func assertSessionHostInfo(
 	t *testing.T,
 	database *db.Database,
 	nick, inputUser, inputHost,
 	expectUser, expectHost string,
 ) {
 	t.Helper()
 	sessionID, _, _, err := database.CreateSession(
 		t.Context(), nick, inputUser, inputHost, "",
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	info, err := database.GetSessionHostInfo(
 		t.Context(), sessionID,
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if info.Username != expectUser {
 		t.Fatalf(
 			"expected username %s, got %s",
 			expectUser, info.Username,
 		)
 	}
 	if info.Hostname != expectHost {
 		t.Fatalf(
 			"expected hostname %s, got %s",
 			expectHost, info.Hostname,
 		)
 	}
 }
 func TestCreateSessionWithUserHost(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	assertSessionHostInfo(
 		t, database,
 		"hostuser", "myident", "example.com",
 		"myident", "example.com",
 	)
 }
 func TestCreateSessionDefaultUsername(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	// Empty username defaults to nick.
 	assertSessionHostInfo(
 		t, database,
 		"defaultu", "", "host.local",
 		"defaultu", "host.local",
 	)
 }
 func TestCreateSessionStoresIP(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	ctx := t.Context()
 	sessionID, clientID, _, err := database.CreateSession(
 		ctx, "ipuser", "ident", "host.example.com",
 		"192.168.1.42",
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	info, err := database.GetSessionHostInfo(
 		ctx, sessionID,
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if info.IP != "192.168.1.42" {
 		t.Fatalf(
 			"expected session IP 192.168.1.42, got %s",
 			info.IP,
 		)
 	}
 	clientInfo, err := database.GetClientHostInfo(
 		ctx, clientID,
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if clientInfo.IP != "192.168.1.42" {
 		t.Fatalf(
 			"expected client IP 192.168.1.42, got %s",
 			clientInfo.IP,
 		)
 	}
 	if clientInfo.Hostname != "host.example.com" {
 		t.Fatalf(
 			"expected client hostname host.example.com, got %s",
 			clientInfo.Hostname,
 		)
 	}
 }
 func TestGetClientHostInfoNotFound(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	_, err := database.GetClientHostInfo(
 		t.Context(), 99999,
 	)
 	if err == nil {
 		t.Fatal("expected error for nonexistent client")
 	}
 }
 func TestGetSessionHostInfoNotFound(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	_, err := database.GetSessionHostInfo(
 		t.Context(), 99999,
 	)
 	if err == nil {
 		t.Fatal("expected error for nonexistent session")
 	}
 }
 func TestFormatHostmask(t *testing.T) {
 	t.Parallel()
 	result := db.FormatHostmask(
 		"nick", "user", "host.com",
 	)
 	if result != "nick!user@host.com" {
 		t.Fatalf(
 			"expected nick!user@host.com, got %s",
 			result,
 		)
 	}
 }
 func TestFormatHostmaskDefaults(t *testing.T) {
 	t.Parallel()
 	result := db.FormatHostmask("nick", "", "")
 	if result != "nick!nick@*" {
 		t.Fatalf(
 			"expected nick!nick@*, got %s",
 			result,
 		)
 	}
 }
 func TestMemberInfoHostmask(t *testing.T) {
 	t.Parallel()
 	member := &db.MemberInfo{ //nolint:exhaustruct // test only uses hostmask fields
 		Nick:     "alice",
 		Username: "aliceident",
 		Hostname: "alice.example.com",
 	}
 	hostmask := member.Hostmask()
 	expected := "alice!aliceident@alice.example.com"
 	if hostmask != expected {
 		t.Fatalf(
 			"expected %s, got %s", expected, hostmask,
 		)
 	}
 }
 func TestChannelMembersIncludeUserHost(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	ctx := t.Context()
 	sid, _, _, err := database.CreateSession(
 		ctx, "memuser", "myuser", "myhost.net", "",
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	chID, err := database.GetOrCreateChannel(
 		ctx, "#hostchan",
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	err = database.JoinChannel(ctx, chID, sid)
 	if err != nil {
 		t.Fatal(err)
 	}
 	members, err := database.ChannelMembers(ctx, chID)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(members) != 1 {
 		t.Fatalf(
 			"expected 1 member, got %d", len(members),
 		)
 	}
 	if members[0].Username != "myuser" {
 		t.Fatalf(
 			"expected username myuser, got %s",
 			members[0].Username,
 		)
 	}
 	if members[0].Hostname != "myhost.net" {
 		t.Fatalf(
 			"expected hostname myhost.net, got %s",
 			members[0].Hostname,
 		)
 	}
 }
 func TestGetSessionByToken(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	ctx := t.Context()
-	_, _, token, err := database.CreateSession(ctx, "bob")
+	_, _, token, err := database.CreateSession(ctx, "bob", "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -93,7 +329,7 @@ func TestGetSessionByNick(t *testing.T) {
 	ctx := t.Context()
 	charlieID, charlieClientID, charlieToken, err :=
-		database.CreateSession(ctx, "charlie")
+		database.CreateSession(ctx, "charlie", "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -150,7 +386,7 @@ func TestJoinAndPart(t *testing.T) {
 	database := setupTestDB(t)
 	ctx := t.Context()
-	sid, _, _, err := database.CreateSession(ctx, "user1")
+	sid, _, _, err := database.CreateSession(ctx, "user1", "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -199,7 +435,7 @@ func TestDeleteChannelIfEmpty(t *testing.T) {
 		t.Fatal(err)
 	}
-	sid, _, _, err := database.CreateSession(ctx, "temp")
+	sid, _, _, err := database.CreateSession(ctx, "temp", "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -234,7 +470,7 @@ func createSessionWithChannels(
 	ctx := t.Context()
-	sid, _, _, err := database.CreateSession(ctx, nick)
+	sid, _, _, err := database.CreateSession(ctx, nick, "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -317,7 +553,7 @@ func TestChangeNick(t *testing.T) {
 	ctx := t.Context()
 	sid, _, token, err := database.CreateSession(
-		ctx, "old",
+		ctx, "old", "", "", "",
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -401,7 +637,7 @@ func TestPollMessages(t *testing.T) {
 	ctx := t.Context()
 	sid, _, token, err := database.CreateSession(
-		ctx, "poller",
+		ctx, "poller", "", "", "",
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -508,7 +744,7 @@ func TestDeleteSession(t *testing.T) {
 	ctx := t.Context()
 	sid, _, _, err := database.CreateSession(
-		ctx, "deleteme",
+		ctx, "deleteme", "", "", "",
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -548,12 +784,12 @@ func TestChannelMembers(t *testing.T) {
 	database := setupTestDB(t)
 	ctx := t.Context()
-	sid1, _, _, err := database.CreateSession(ctx, "m1")
+	sid1, _, _, err := database.CreateSession(ctx, "m1", "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
-	sid2, _, _, err := database.CreateSession(ctx, "m2")
+	sid2, _, _, err := database.CreateSession(ctx, "m2", "", "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -611,7 +847,7 @@ func TestEnqueueToClient(t *testing.T) {
 	ctx := t.Context()
 	_, _, token, err := database.CreateSession(
-		ctx, "enqclient",
+		ctx, "enqclient", "", "", "",
 	)
 	if err != nil {
 		t.Fatal(err)
@@ -651,3 +887,604 @@ func TestEnqueueToClient(t *testing.T) {
 		t.Fatalf("expected 1, got %d", len(msgs))
 	}
 }
 func TestSetAndCheckSessionOper(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	ctx := t.Context()
 	sessionID, _, _, err := database.CreateSession(
 		ctx, "opernick", "", "", "",
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	// Initially not oper.
 	isOper, err := database.IsSessionOper(ctx, sessionID)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if isOper {
 		t.Fatal("expected session not to be oper")
 	}
 	// Set oper.
 	err = database.SetSessionOper(ctx, sessionID, true)
 	if err != nil {
 		t.Fatal(err)
 	}
 	isOper, err = database.IsSessionOper(ctx, sessionID)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if !isOper {
 		t.Fatal("expected session to be oper")
 	}
 	// Unset oper.
 	err = database.SetSessionOper(ctx, sessionID, false)
 	if err != nil {
 		t.Fatal(err)
 	}
 	isOper, err = database.IsSessionOper(ctx, sessionID)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if isOper {
 		t.Fatal("expected session not to be oper")
 	}
 }
 func TestGetLatestClientForSession(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	ctx := t.Context()
 	sessionID, _, _, err := database.CreateSession(
 		ctx, "clientnick", "", "", "10.0.0.1",
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	clientInfo, err := database.GetLatestClientForSession(
 		ctx, sessionID,
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if clientInfo.IP != "10.0.0.1" {
 		t.Fatalf(
 			"expected IP 10.0.0.1, got %s",
 			clientInfo.IP,
 		)
 	}
 }
 func TestGetOperCount(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	ctx := t.Context()
 	// Create two sessions.
 	sid1, _, _, err := database.CreateSession(
 		ctx, "user1", "", "", "",
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	sid2, _, _, err := database.CreateSession(
 		ctx, "user2", "", "", "",
 	)
 	_ = sid2
 	if err != nil {
 		t.Fatal(err)
 	}
 	// Initially zero opers.
 	count, err := database.GetOperCount(ctx)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if count != 0 {
 		t.Fatalf("expected 0 opers, got %d", count)
 	}
 	// Set one as oper.
 	err = database.SetSessionOper(ctx, sid1, true)
 	if err != nil {
 		t.Fatal(err)
 	}
 	count, err = database.GetOperCount(ctx)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if count != 1 {
 		t.Fatalf("expected 1 oper, got %d", count)
 	}
 }
 // --- Tier 2 Tests ---
 func TestWildcardMatch(t *testing.T) {
 	t.Parallel()
 	tests := []struct {
 		pattern string
 		input   string
 		match   bool
 	}{
 		{"*!*@*", "nick!user@host", true},
 		{"*!*@*.example.com", "nick!user@foo.example.com", true},
 		{"*!*@*.example.com", "nick!user@other.net", false},
 		{"badnick!*@*", "badnick!user@host", true},
 		{"badnick!*@*", "goodnick!user@host", false},
 		{"nick!user@host", "nick!user@host", true},
 		{"nick!user@host", "nick!user@other", false},
 		{"*", "anything", true},
 		{"?ick!*@*", "nick!user@host", true},
 		{"?ick!*@*", "nn!user@host", false},
 		// Case-insensitive.
 		{"Nick!*@*", "nick!user@host", true},
 	}
 	for _, tc := range tests {
 		result := db.MatchBanMask(tc.pattern, tc.input)
 		if result != tc.match {
 			t.Errorf(
 				"MatchBanMask(%q, %q) = %v, want %v",
 				tc.pattern, tc.input, result, tc.match,
 			)
 		}
 	}
 }
 func TestChannelBanCRUD(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	ctx := t.Context()
 	chID, err := database.GetOrCreateChannel(ctx, "#test")
 	if err != nil {
 		t.Fatal(err)
 	}
 	// No bans initially.
 	bans, err := database.ListChannelBans(ctx, chID)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(bans) != 0 {
 		t.Fatalf("expected 0 bans, got %d", len(bans))
 	}
 	// Add a ban.
 	err = database.AddChannelBan(
 		ctx, chID, "*!*@evil.com", "op",
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	bans, err = database.ListChannelBans(ctx, chID)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(bans) != 1 {
 		t.Fatalf("expected 1 ban, got %d", len(bans))
 	}
 	if bans[0].Mask != "*!*@evil.com" {
 		t.Fatalf("wrong mask: %s", bans[0].Mask)
 	}
 	// Duplicate add is ignored (OR IGNORE).
 	err = database.AddChannelBan(
 		ctx, chID, "*!*@evil.com", "op2",
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	bans, _ = database.ListChannelBans(ctx, chID)
 	if len(bans) != 1 {
 		t.Fatalf("expected 1 ban after dup, got %d", len(bans))
 	}
 	// Remove ban.
 	err = database.RemoveChannelBan(
 		ctx, chID, "*!*@evil.com",
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	bans, _ = database.ListChannelBans(ctx, chID)
 	if len(bans) != 0 {
 		t.Fatalf("expected 0 bans after remove, got %d", len(bans))
 	}
 }
 func TestIsSessionBanned(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	ctx := t.Context()
 	sid, _, _, err := database.CreateSession(
 		ctx, "victim", "victim", "evil.com", "",
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	chID, err := database.GetOrCreateChannel(ctx, "#bantest")
 	if err != nil {
 		t.Fatal(err)
 	}
 	// Not banned initially.
 	banned, err := database.IsSessionBanned(ctx, chID, sid)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if banned {
 		t.Fatal("should not be banned initially")
 	}
 	// Add ban matching the hostmask.
 	err = database.AddChannelBan(
 		ctx, chID, "*!*@evil.com", "op",
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	banned, err = database.IsSessionBanned(ctx, chID, sid)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if !banned {
 		t.Fatal("should be banned")
 	}
 }
 func TestChannelInviteOnly(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	ctx := t.Context()
 	chID, err := database.GetOrCreateChannel(ctx, "#invite")
 	if err != nil {
 		t.Fatal(err)
 	}
 	// Default: not invite-only.
 	isIO, err := database.IsChannelInviteOnly(ctx, chID)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if isIO {
 		t.Fatal("should not be invite-only by default")
 	}
 	// Set invite-only.
 	err = database.SetChannelInviteOnly(ctx, chID, true)
 	if err != nil {
 		t.Fatal(err)
 	}
 	isIO, _ = database.IsChannelInviteOnly(ctx, chID)
 	if !isIO {
 		t.Fatal("should be invite-only")
 	}
 	// Unset.
 	err = database.SetChannelInviteOnly(ctx, chID, false)
 	if err != nil {
 		t.Fatal(err)
 	}
 	isIO, _ = database.IsChannelInviteOnly(ctx, chID)
 	if isIO {
 		t.Fatal("should not be invite-only")
 	}
 }
 func TestChannelInviteCRUD(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	ctx := t.Context()
 	sid, _, _, err := database.CreateSession(
 		ctx, "invited", "", "", "",
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	chID, err := database.GetOrCreateChannel(ctx, "#inv")
 	if err != nil {
 		t.Fatal(err)
 	}
 	// No invite initially.
 	has, err := database.HasChannelInvite(ctx, chID, sid)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if has {
 		t.Fatal("should not have invite")
 	}
 	// Add invite.
 	err = database.AddChannelInvite(ctx, chID, sid, "op")
 	if err != nil {
 		t.Fatal(err)
 	}
 	has, _ = database.HasChannelInvite(ctx, chID, sid)
 	if !has {
 		t.Fatal("should have invite")
 	}
 	// Clear invite.
 	err = database.ClearChannelInvite(ctx, chID, sid)
 	if err != nil {
 		t.Fatal(err)
 	}
 	has, _ = database.HasChannelInvite(ctx, chID, sid)
 	if has {
 		t.Fatal("invite should be cleared")
 	}
 }
 func TestChannelSecret(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	ctx := t.Context()
 	chID, err := database.GetOrCreateChannel(ctx, "#secret")
 	if err != nil {
 		t.Fatal(err)
 	}
 	// Default: not secret.
 	isSec, err := database.IsChannelSecret(ctx, chID)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if isSec {
 		t.Fatal("should not be secret by default")
 	}
 	err = database.SetChannelSecret(ctx, chID, true)
 	if err != nil {
 		t.Fatal(err)
 	}
 	isSec, _ = database.IsChannelSecret(ctx, chID)
 	if !isSec {
 		t.Fatal("should be secret")
 	}
 }
 // createTestSession is a helper to create a session and
 // return only the session ID.
 func createTestSession(
 	t *testing.T,
 	database *db.Database,
 	nick string,
 ) int64 {
 	t.Helper()
 	sid, _, _, err := database.CreateSession(
 		t.Context(), nick, "", "", "",
 	)
 	if err != nil {
 		t.Fatalf("create session %s: %v", nick, err)
 	}
 	return sid
 }
 func TestSecretChannelFiltering(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	ctx := t.Context()
 	// Create two sessions.
 	sid1 := createTestSession(t, database, "member")
 	sid2 := createTestSession(t, database, "outsider")
 	// Create a secret channel.
 	chID, _ := database.GetOrCreateChannel(ctx, "#secret")
 	_ = database.SetChannelSecret(ctx, chID, true)
 	_ = database.JoinChannel(ctx, chID, sid1)
 	// Create a non-secret channel.
 	chID2, _ := database.GetOrCreateChannel(ctx, "#public")
 	_ = database.JoinChannel(ctx, chID2, sid1)
 	// Member should see both.
 	list, err := database.ListAllChannelsWithCountsFiltered(
 		ctx, sid1,
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(list) != 2 {
 		t.Fatalf("member should see 2 channels, got %d", len(list))
 	}
 	// Outsider should only see public.
 	list, _ = database.ListAllChannelsWithCountsFiltered(
 		ctx, sid2,
 	)
 	if len(list) != 1 {
 		t.Fatalf("outsider should see 1 channel, got %d", len(list))
 	}
 	if list[0].Name != "#public" {
 		t.Fatalf("outsider should see #public, got %s", list[0].Name)
 	}
 }
 func TestWhoisChannelFiltering(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	ctx := t.Context()
 	sid1 := createTestSession(t, database, "target")
 	sid2 := createTestSession(t, database, "querier")
 	// Create secret channel, target joins it.
 	chID, _ := database.GetOrCreateChannel(ctx, "#hidden")
 	_ = database.SetChannelSecret(ctx, chID, true)
 	_ = database.JoinChannel(ctx, chID, sid1)
 	// Querier (non-member) should not see the channel.
 	channels, err := database.GetSessionChannelsFiltered(
 		ctx, sid1, sid2,
 	)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if len(channels) != 0 {
 		t.Fatalf(
 			"querier should see 0 channels, got %d",
 			len(channels),
 		)
 	}
 	// Target querying self should see it.
 	channels, _ = database.GetSessionChannelsFiltered(
 		ctx, sid1, sid1,
 	)
 	if len(channels) != 1 {
 		t.Fatalf(
 			"self-query should see 1 channel, got %d",
 			len(channels),
 		)
 	}
 }
 //nolint:dupl // structurally similar to TestChannelUserLimit
 func TestChannelKey(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	ctx := t.Context()
 	chID, err := database.GetOrCreateChannel(ctx, "#keyed")
 	if err != nil {
 		t.Fatal(err)
 	}
 	// Default: no key.
 	key, err := database.GetChannelKey(ctx, chID)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if key != "" {
 		t.Fatalf("expected empty key, got %q", key)
 	}
 	// Set key.
 	err = database.SetChannelKey(ctx, chID, "secret123")
 	if err != nil {
 		t.Fatal(err)
 	}
 	key, _ = database.GetChannelKey(ctx, chID)
 	if key != "secret123" {
 		t.Fatalf("expected secret123, got %q", key)
 	}
 	// Clear key.
 	err = database.SetChannelKey(ctx, chID, "")
 	if err != nil {
 		t.Fatal(err)
 	}
 	key, _ = database.GetChannelKey(ctx, chID)
 	if key != "" {
 		t.Fatalf("expected empty key, got %q", key)
 	}
 }
 //nolint:dupl // structurally similar to TestChannelKey
 func TestChannelUserLimit(t *testing.T) {
 	t.Parallel()
 	database := setupTestDB(t)
 	ctx := t.Context()
 	chID, err := database.GetOrCreateChannel(ctx, "#limited")
 	if err != nil {
 		t.Fatal(err)
 	}
 	// Default: no limit.
 	limit, err := database.GetChannelUserLimit(ctx, chID)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if limit != 0 {
 		t.Fatalf("expected 0 limit, got %d", limit)
 	}
 	// Set limit.
 	err = database.SetChannelUserLimit(ctx, chID, 50)
 	if err != nil {
 		t.Fatal(err)
 	}
 	limit, _ = database.GetChannelUserLimit(ctx, chID)
 	if limit != 50 {
 		t.Fatalf("expected 50, got %d", limit)
 	}
 	// Clear limit.
 	err = database.SetChannelUserLimit(ctx, chID, 0)
 	if err != nil {
 		t.Fatal(err)
 	}
 	limit, _ = database.GetChannelUserLimit(ctx, chID)
 	if limit != 0 {
 		t.Fatalf("expected 0, got %d", limit)
 	}
 }
--- a/internal/db/schema/000.sql
+++ b/internal/db/schema/000.sql
@@ -0,0 +1,6 @@
 -- Bootstrap: create the schema_migrations table itself.
 CREATE TABLE IF NOT EXISTS schema_migrations (
    version INTEGER PRIMARY KEY,
    applied_at DATETIME DEFAULT CURRENT_TIMESTAMP
 );
 INSERT OR IGNORE INTO schema_migrations (version) VALUES (0);
--- a/internal/db/schema/001_initial.sql
+++ b/internal/db/schema/001_initial.sql
@@ -6,8 +6,13 @@ CREATE TABLE IF NOT EXISTS sessions (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    uuid TEXT NOT NULL UNIQUE,
    nick TEXT NOT NULL UNIQUE,
    username TEXT NOT NULL DEFAULT '',
    hostname TEXT NOT NULL DEFAULT '',
    ip TEXT NOT NULL DEFAULT '',
    is_oper INTEGER NOT NULL DEFAULT 0,
    password_hash TEXT NOT NULL DEFAULT '',
    signing_key TEXT NOT NULL DEFAULT '',
    away_message TEXT NOT NULL DEFAULT '',
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    last_seen DATETIME DEFAULT CURRENT_TIMESTAMP
 );
@@ -19,6 +24,8 @@ CREATE TABLE IF NOT EXISTS clients (
    uuid TEXT NOT NULL UNIQUE,
    session_id INTEGER NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
    token TEXT NOT NULL UNIQUE,
    ip TEXT NOT NULL DEFAULT '',
    hostname TEXT NOT NULL DEFAULT '',
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    last_seen DATETIME DEFAULT CURRENT_TIMESTAMP
 );
@@ -30,15 +37,48 @@ CREATE TABLE IF NOT EXISTS channels (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    name TEXT NOT NULL UNIQUE,
    topic TEXT NOT NULL DEFAULT '',
    topic_set_by TEXT NOT NULL DEFAULT '',
    topic_set_at DATETIME,
    hashcash_bits INTEGER NOT NULL DEFAULT 0,
    is_moderated INTEGER NOT NULL DEFAULT 0,
    is_topic_locked INTEGER NOT NULL DEFAULT 1,
    is_invite_only INTEGER NOT NULL DEFAULT 0,
    is_secret INTEGER NOT NULL DEFAULT 0,
    channel_key TEXT NOT NULL DEFAULT '',
    user_limit INTEGER NOT NULL DEFAULT 0,
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
 );
 -- Channel bans
 CREATE TABLE IF NOT EXISTS channel_bans (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    channel_id INTEGER NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
    mask TEXT NOT NULL,
    set_by TEXT NOT NULL,
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    UNIQUE(channel_id, mask)
 );
 CREATE INDEX IF NOT EXISTS idx_channel_bans_channel ON channel_bans(channel_id);
 -- Channel invites (in-memory would be simpler but DB survives restarts)
 CREATE TABLE IF NOT EXISTS channel_invites (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    channel_id INTEGER NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
    session_id INTEGER NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
    invited_by TEXT NOT NULL DEFAULT '',
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    UNIQUE(channel_id, session_id)
 );
 CREATE INDEX IF NOT EXISTS idx_channel_invites_channel ON channel_invites(channel_id);
 -- Channel members
 CREATE TABLE IF NOT EXISTS channel_members (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    channel_id INTEGER NOT NULL REFERENCES channels(id) ON DELETE CASCADE,
    session_id INTEGER NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
    is_operator INTEGER NOT NULL DEFAULT 0,
    is_voiced INTEGER NOT NULL DEFAULT 0,
    joined_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    UNIQUE(channel_id, session_id)
 );
@@ -58,6 +98,14 @@ CREATE TABLE IF NOT EXISTS messages (
 CREATE INDEX IF NOT EXISTS idx_messages_to_id ON messages(msg_to, id);
 CREATE INDEX IF NOT EXISTS idx_messages_created ON messages(created_at);
 -- Spent hashcash tokens for replay prevention (1-year TTL)
 CREATE TABLE IF NOT EXISTS spent_hashcash (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    stamp_hash TEXT NOT NULL UNIQUE,
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
 );
 CREATE INDEX IF NOT EXISTS idx_spent_hashcash_created ON spent_hashcash(created_at);
 -- Per-client message queues for fan-out delivery
 CREATE TABLE IF NOT EXISTS client_queues (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
--- a/internal/handlers/api.go
+++ b/internal/handlers/api.go
--- a/internal/handlers/api_test.go
+++ b/internal/handlers/api_test.go
--- a/internal/handlers/auth.go
+++ b/internal/handlers/auth.go
@@ -4,116 +4,12 @@ import (
 	"encoding/json"
 	"net/http"
 	"strings"
 	"git.eeqj.de/sneak/neoirc/pkg/irc"
 )
 const minPasswordLength = 8
 // HandleRegister creates a new user with a password.
 func (hdlr *Handlers) HandleRegister() http.HandlerFunc {
 	return func(
 		writer http.ResponseWriter,
 		request *http.Request,
 	) {
 		request.Body = http.MaxBytesReader(
 			writer, request.Body, hdlr.maxBodySize(),
 		)
 		hdlr.handleRegister(writer, request)
 	}
 }
 func (hdlr *Handlers) handleRegister(
 	writer http.ResponseWriter,
 	request *http.Request,
 ) {
 	type registerRequest struct {
 		Nick     string `json:"nick"`
 		Password string `json:"password"`
 	}
 	var payload registerRequest
 	err := json.NewDecoder(request.Body).Decode(&payload)
 	if err != nil {
 		hdlr.respondError(
 			writer, request,
 			"invalid request body",
 			http.StatusBadRequest,
 		)
 		return
 	}
 	payload.Nick = strings.TrimSpace(payload.Nick)
 	if !validNickRe.MatchString(payload.Nick) {
 		hdlr.respondError(
 			writer, request,
 			"invalid nick format",
 			http.StatusBadRequest,
 		)
 		return
 	}
 	if len(payload.Password) < minPasswordLength {
 		hdlr.respondError(
 			writer, request,
 			"password must be at least 8 characters",
 			http.StatusBadRequest,
 		)
 		return
 	}
 	sessionID, clientID, token, err :=
 		hdlr.params.Database.RegisterUser(
 			request.Context(),
 			payload.Nick,
 			payload.Password,
 		)
 	if err != nil {
 		hdlr.handleRegisterError(
 			writer, request, err,
 		)
 		return
 	}
 	hdlr.deliverMOTD(request, clientID, sessionID, payload.Nick)
 	hdlr.respondJSON(writer, request, map[string]any{
 		"id":    sessionID,
 		"nick":  payload.Nick,
 		"token": token,
 	}, http.StatusCreated)
 }
 func (hdlr *Handlers) handleRegisterError(
 	writer http.ResponseWriter,
 	request *http.Request,
 	err error,
 ) {
 	if strings.Contains(err.Error(), "UNIQUE") {
 		hdlr.respondError(
 			writer, request,
 			"nick already taken",
 			http.StatusConflict,
 		)
 		return
 	}
 	hdlr.log.Error(
 		"register user failed", "error", err,
 	)
 	hdlr.respondError(
 		writer, request,
 		"internal error",
 		http.StatusInternalServerError,
 	)
 }
 // HandleLogin authenticates a user with nick and password.
 func (hdlr *Handlers) HandleLogin() http.HandlerFunc {
 	return func(
@@ -132,6 +28,21 @@ func (hdlr *Handlers) handleLogin(
 	writer http.ResponseWriter,
 	request *http.Request,
 ) {
 	ip := clientIP(request)
 	if !hdlr.loginLimiter.Allow(ip) {
 		writer.Header().Set(
 			"Retry-After", "1",
 		)
 		hdlr.respondError(
 			writer, request,
 			"too many login attempts, try again later",
 			http.StatusTooManyRequests,
 		)
 		return
 	}
 	type loginRequest struct {
 		Nick     string `json:"nick"`
 		Password string `json:"password"`
@@ -162,11 +73,27 @@ func (hdlr *Handlers) handleLogin(
 		return
 	}
 	hdlr.executeLogin(
 		writer, request, payload.Nick, payload.Password,
 	)
 }
 func (hdlr *Handlers) executeLogin(
 	writer http.ResponseWriter,
 	request *http.Request,
 	nick, password string,
 ) {
 	remoteIP := clientIP(request)
 	hostname := resolveHostname(
 		request.Context(), remoteIP,
 	)
 	sessionID, clientID, token, err :=
 		hdlr.params.Database.LoginUser(
 			request.Context(),
-			payload.Nick,
+			nick, password,
-			payload.Password,
+			remoteIP, hostname,
 		)
 	if err != nil {
 		hdlr.respondError(
@@ -178,19 +105,78 @@ func (hdlr *Handlers) handleLogin(
 		return
 	}
 	hdlr.stats.IncrConnections()
 	hdlr.deliverMOTD(
-		request, clientID, sessionID, payload.Nick,
+		request, clientID, sessionID, nick,
 	)
 	// Initialize channel state so the new client knows
 	// which channels the session already belongs to.
 	hdlr.initChannelState(
-		request, clientID, sessionID, payload.Nick,
+		request, clientID, sessionID, nick,
 	)
 	hdlr.setAuthCookie(writer, request, token)
 	hdlr.respondJSON(writer, request, map[string]any{
 		"id":   sessionID,
-		"nick":  payload.Nick,
+		"nick": nick,
 		"token": token,
 	}, http.StatusOK)
 }
 // handlePass handles the IRC PASS command to set a
 // password on the authenticated session, enabling
 // multi-client login via POST /api/v1/login.
 func (hdlr *Handlers) handlePass(
 	writer http.ResponseWriter,
 	request *http.Request,
 	sessionID, clientID int64,
 	nick string,
 	bodyLines func() []string,
 ) {
 	lines := bodyLines()
 	if len(lines) == 0 || lines[0] == "" {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
 			irc.ErrNeedMoreParams, nick,
 			[]string{irc.CmdPass},
 			"Not enough parameters",
 		)
 		return
 	}
 	password := lines[0]
 	if len(password) < minPasswordLength {
 		hdlr.respondIRCError(
 			writer, request, clientID, sessionID,
 			irc.ErrNeedMoreParams, nick,
 			[]string{irc.CmdPass},
 			"Password must be at least 8 characters",
 		)
 		return
 	}
 	err := hdlr.params.Database.SetPassword(
 		request.Context(), sessionID, password,
 	)
 	if err != nil {
 		hdlr.log.Error(
 			"set password failed", "error", err,
 		)
 		hdlr.respondError(
 			writer, request,
 			"internal error",
 			http.StatusInternalServerError,
 		)
 		return
 	}
 	hdlr.respondJSON(writer, request,
 		map[string]string{"status": "ok"},
 		http.StatusOK)
 }
--- a/internal/handlers/handlers.go
+++ b/internal/handlers/handlers.go
@@ -13,8 +13,11 @@ import (
 	"git.eeqj.de/sneak/neoirc/internal/config"
 	"git.eeqj.de/sneak/neoirc/internal/db"
 	"git.eeqj.de/sneak/neoirc/internal/globals"
 	"git.eeqj.de/sneak/neoirc/internal/hashcash"
 	"git.eeqj.de/sneak/neoirc/internal/healthcheck"
 	"git.eeqj.de/sneak/neoirc/internal/logger"
 	"git.eeqj.de/sneak/neoirc/internal/ratelimit"
 	"git.eeqj.de/sneak/neoirc/internal/stats"
 	"go.uber.org/fx"
 )
@@ -29,9 +32,15 @@ type Params struct {
 	Config      *config.Config
 	Database    *db.Database
 	Healthcheck *healthcheck.Healthcheck
 	Stats       *stats.Tracker
 }
-const defaultIdleTimeout = 24 * time.Hour
+const defaultIdleTimeout = 30 * 24 * time.Hour
 // spentHashcashTTL is how long spent hashcash tokens are
 // retained for replay prevention. Per issue requirements,
 // this is 1 year.
 const spentHashcashTTL = 365 * 24 * time.Hour
 // Handlers manages HTTP request handling.
 type Handlers struct {
@@ -39,6 +48,10 @@ type Handlers struct {
 	log             *slog.Logger
 	hc              *healthcheck.Healthcheck
 	broker          *broker.Broker
 	hashcashVal     *hashcash.Validator
 	channelHashcash *hashcash.ChannelValidator
 	loginLimiter    *ratelimit.Limiter
 	stats           *stats.Tracker
 	cancelCleanup   context.CancelFunc
 }
@@ -47,11 +60,30 @@ func New(
 	lifecycle fx.Lifecycle,
 	params Params,
 ) (*Handlers, error) {
 	resource := params.Config.ServerName
 	if resource == "" {
 		resource = "neoirc"
 	}
 	loginRate := params.Config.LoginRateLimit
 	if loginRate <= 0 {
 		loginRate = ratelimit.DefaultRate
 	}
 	loginBurst := params.Config.LoginRateBurst
 	if loginBurst <= 0 {
 		loginBurst = ratelimit.DefaultBurst
 	}
 	hdlr := &Handlers{ //nolint:exhaustruct // cancelCleanup set in startCleanup
 		params:          &params,
 		log:             params.Logger.Get(),
 		hc:              params.Healthcheck,
 		broker:          broker.New(),
 		hashcashVal:     hashcash.NewValidator(resource),
 		channelHashcash: hashcash.NewChannelValidator(),
 		loginLimiter:    ratelimit.New(loginRate, loginBurst),
 		stats:           params.Stats,
 	}
 	lifecycle.Append(fx.Hook{
@@ -143,6 +175,10 @@ func (hdlr *Handlers) stopCleanup() {
 	if hdlr.cancelCleanup != nil {
 		hdlr.cancelCleanup()
 	}
 	if hdlr.loginLimiter != nil {
 		hdlr.loginLimiter.Stop()
 	}
 }
 func (hdlr *Handlers) cleanupLoop(ctx context.Context) {
@@ -200,4 +236,93 @@ func (hdlr *Handlers) runCleanup(
 			"deleted", deleted,
 		)
 	}
 	hdlr.pruneQueuesAndMessages(ctx)
 }
 // parseDurationConfig parses a Go duration string,
 // returning zero on empty input and logging on error.
 func (hdlr *Handlers) parseDurationConfig(
 	name, raw string,
 ) time.Duration {
 	if raw == "" {
 		return 0
 	}
 	dur, err := time.ParseDuration(raw)
 	if err != nil {
 		hdlr.log.Error(
 			"invalid duration config, skipping",
 			"name", name, "value", raw, "error", err,
 		)
 		return 0
 	}
 	return dur
 }
 // pruneQueuesAndMessages removes old client output queue
 // entries per QUEUE_MAX_AGE and old messages per
 // MESSAGE_MAX_AGE.
 func (hdlr *Handlers) pruneQueuesAndMessages(
 	ctx context.Context,
 ) {
 	queueMaxAge := hdlr.parseDurationConfig(
 		"QUEUE_MAX_AGE",
 		hdlr.params.Config.QueueMaxAge,
 	)
 	if queueMaxAge > 0 {
 		queueCutoff := time.Now().Add(-queueMaxAge)
 		pruned, err := hdlr.params.Database.
 			PruneOldQueueEntries(ctx, queueCutoff)
 		if err != nil {
 			hdlr.log.Error(
 				"client output queue pruning failed", "error", err,
 			)
 		} else if pruned > 0 {
 			hdlr.log.Info(
 				"pruned old client output queue entries",
 				"deleted", pruned,
 			)
 		}
 	}
 	messageMaxAge := hdlr.parseDurationConfig(
 		"MESSAGE_MAX_AGE",
 		hdlr.params.Config.MessageMaxAge,
 	)
 	if messageMaxAge > 0 {
 		msgCutoff := time.Now().Add(-messageMaxAge)
 		pruned, err := hdlr.params.Database.
 			PruneOldMessages(ctx, msgCutoff)
 		if err != nil {
 			hdlr.log.Error(
 				"message pruning failed", "error", err,
 			)
 		} else if pruned > 0 {
 			hdlr.log.Info(
 				"pruned old messages",
 				"deleted", pruned,
 			)
 		}
 	}
 	// Prune spent hashcash tokens older than 1 year.
 	hashcashCutoff := time.Now().Add(-spentHashcashTTL)
 	pruned, err := hdlr.params.Database.
 		PruneSpentHashcash(ctx, hashcashCutoff)
 	if err != nil {
 		hdlr.log.Error(
 			"spent hashcash pruning failed", "error", err,
 		)
 	} else if pruned > 0 {
 		hdlr.log.Info(
 			"pruned spent hashcash tokens",
 			"deleted", pruned,
 		)
 	}
 }
--- a/internal/handlers/healthcheck.go
+++ b/internal/handlers/healthcheck.go
@@ -12,7 +12,7 @@ func (hdlr *Handlers) HandleHealthCheck() http.HandlerFunc {
 		writer http.ResponseWriter,
 		request *http.Request,
 	) {
-		resp := hdlr.hc.Healthcheck()
+		resp := hdlr.hc.Healthcheck(request.Context())
 		hdlr.respondJSON(writer, request, resp, httpStatusOK)
 	}
 }
--- a/internal/hashcash/channel.go
+++ b/internal/hashcash/channel.go
@@ -0,0 +1,186 @@
 package hashcash
 import (
 	"crypto/sha256"
 	"encoding/hex"
 	"errors"
 	"fmt"
 	"strconv"
 	"strings"
 	"time"
 )
 var (
 	errBodyHashMismatch = errors.New(
 		"body hash mismatch",
 	)
 	errBodyHashMissing = errors.New(
 		"body hash missing",
 	)
 )
 // ChannelValidator checks hashcash stamps for
 // per-channel PRIVMSG validation. It verifies that
 // stamps are bound to a specific channel and message
 // body. Replay prevention is handled externally via
 // the database spent_hashcash table for persistence
 // across server restarts (1-year TTL).
 type ChannelValidator struct{}
 // NewChannelValidator creates a ChannelValidator.
 func NewChannelValidator() *ChannelValidator {
 	return &ChannelValidator{}
 }
 // BodyHash computes the hex-encoded SHA-256 hash of a
 // message body for use in hashcash stamp validation.
 func BodyHash(body []byte) string {
 	hash := sha256.Sum256(body)
 	return hex.EncodeToString(hash[:])
 }
 // ValidateStamp checks a channel hashcash stamp. It
 // verifies the stamp format, difficulty, date, channel
 // binding, body hash binding, and proof-of-work. Replay
 // detection is NOT performed here — callers must check
 // the spent_hashcash table separately.
 //
 // Stamp format: 1:bits:YYMMDD:channel:bodyhash:counter.
 func (cv *ChannelValidator) ValidateStamp(
 	stamp string,
 	requiredBits int,
 	channel string,
 	bodyHash string,
 ) error {
 	if requiredBits <= 0 {
 		return nil
 	}
 	parts := strings.Split(stamp, ":")
 	if len(parts) != stampFields {
 		return fmt.Errorf(
 			"%w: expected %d, got %d",
 			errInvalidFields, stampFields, len(parts),
 		)
 	}
 	version := parts[0]
 	bitsStr := parts[1]
 	dateStr := parts[2]
 	resource := parts[3]
 	stampBodyHash := parts[4]
 	headerErr := validateChannelHeader(
 		version, bitsStr, resource,
 		requiredBits, channel,
 	)
 	if headerErr != nil {
 		return headerErr
 	}
 	stampTime, parseErr := parseStampDate(dateStr)
 	if parseErr != nil {
 		return parseErr
 	}
 	timeErr := validateTime(stampTime)
 	if timeErr != nil {
 		return timeErr
 	}
 	bodyErr := validateBodyHash(
 		stampBodyHash, bodyHash,
 	)
 	if bodyErr != nil {
 		return bodyErr
 	}
 	return validateProof(stamp, requiredBits)
 }
 // StampHash returns a deterministic hash of a stamp
 // string for use as a spent-token key.
 func StampHash(stamp string) string {
 	hash := sha256.Sum256([]byte(stamp))
 	return hex.EncodeToString(hash[:])
 }
 func validateChannelHeader(
 	version, bitsStr, resource string,
 	requiredBits int,
 	channel string,
 ) error {
 	if version != stampVersion {
 		return fmt.Errorf(
 			"%w: %s", errBadVersion, version,
 		)
 	}
 	claimedBits, err := strconv.Atoi(bitsStr)
 	if err != nil || claimedBits < requiredBits {
 		return fmt.Errorf(
 			"%w: need %d bits",
 			errInsufficientBits, requiredBits,
 		)
 	}
 	if resource != channel {
 		return fmt.Errorf(
 			"%w: got %q, want %q",
 			errWrongResource, resource, channel,
 		)
 	}
 	return nil
 }
 func validateBodyHash(
 	stampBodyHash, expectedBodyHash string,
 ) error {
 	if stampBodyHash == "" {
 		return errBodyHashMissing
 	}
 	if stampBodyHash != expectedBodyHash {
 		return fmt.Errorf(
 			"%w: got %q, want %q",
 			errBodyHashMismatch,
 			stampBodyHash, expectedBodyHash,
 		)
 	}
 	return nil
 }
 // MintChannelStamp computes a channel hashcash stamp
 // with the given difficulty, channel name, and body hash.
 // This is intended for clients to generate stamps before
 // sending PRIVMSG to hashcash-protected channels.
 //
 // Stamp format: 1:bits:YYMMDD:channel:bodyhash:counter.
 func MintChannelStamp(
 	bits int,
 	channel string,
 	bodyHash string,
 ) string {
 	date := time.Now().UTC().Format(dateFormatShort)
 	prefix := fmt.Sprintf(
 		"1:%d:%s:%s:%s:",
 		bits, date, channel, bodyHash,
 	)
 	counter := uint64(0)
 	for {
 		stamp := prefix + strconv.FormatUint(counter, 16)
 		hash := sha256.Sum256([]byte(stamp))
 		if hasLeadingZeroBits(hash[:], bits) {
 			return stamp
 		}
 		counter++
 	}
 }
--- a/internal/hashcash/channel_test.go
+++ b/internal/hashcash/channel_test.go
@@ -0,0 +1,244 @@
 package hashcash_test
 import (
 	"crypto/sha256"
 	"encoding/hex"
 	"testing"
 	"git.eeqj.de/sneak/neoirc/internal/hashcash"
 )
 const (
 	testChannel  = "#general"
 	testBodyText = `["hello world"]`
 )
 func testBodyHash() string {
 	hash := sha256.Sum256([]byte(testBodyText))
 	return hex.EncodeToString(hash[:])
 }
 func TestChannelValidateHappyPath(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewChannelValidator()
 	bodyHash := testBodyHash()
 	stamp := hashcash.MintChannelStamp(
 		testBits, testChannel, bodyHash,
 	)
 	err := validator.ValidateStamp(
 		stamp, testBits, testChannel, bodyHash,
 	)
 	if err != nil {
 		t.Fatalf("valid channel stamp rejected: %v", err)
 	}
 }
 func TestChannelValidateWrongChannel(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewChannelValidator()
 	bodyHash := testBodyHash()
 	stamp := hashcash.MintChannelStamp(
 		testBits, testChannel, bodyHash,
 	)
 	err := validator.ValidateStamp(
 		stamp, testBits, "#other", bodyHash,
 	)
 	if err == nil {
 		t.Fatal("expected channel mismatch error")
 	}
 }
 func TestChannelValidateWrongBodyHash(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewChannelValidator()
 	bodyHash := testBodyHash()
 	stamp := hashcash.MintChannelStamp(
 		testBits, testChannel, bodyHash,
 	)
 	wrongHash := sha256.Sum256([]byte("different body"))
 	wrongBodyHash := hex.EncodeToString(wrongHash[:])
 	err := validator.ValidateStamp(
 		stamp, testBits, testChannel, wrongBodyHash,
 	)
 	if err == nil {
 		t.Fatal("expected body hash mismatch error")
 	}
 }
 func TestChannelValidateInsufficientBits(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewChannelValidator()
 	bodyHash := testBodyHash()
 	// Mint with 2 bits but require 4.
 	stamp := hashcash.MintChannelStamp(
 		testBits, testChannel, bodyHash,
 	)
 	err := validator.ValidateStamp(
 		stamp, 4, testChannel, bodyHash,
 	)
 	if err == nil {
 		t.Fatal("expected insufficient bits error")
 	}
 }
 func TestChannelValidateZeroBitsSkips(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewChannelValidator()
 	err := validator.ValidateStamp(
 		"garbage", 0, "#ch", "abc",
 	)
 	if err != nil {
 		t.Fatalf("zero bits should skip: %v", err)
 	}
 }
 func TestChannelValidateBadFormat(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewChannelValidator()
 	err := validator.ValidateStamp(
 		"not:valid", testBits, testChannel, "abc",
 	)
 	if err == nil {
 		t.Fatal("expected bad format error")
 	}
 }
 func TestChannelValidateBadVersion(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewChannelValidator()
 	bodyHash := testBodyHash()
 	stamp := "2:2:260317:#general:" + bodyHash + ":counter"
 	err := validator.ValidateStamp(
 		stamp, testBits, testChannel, bodyHash,
 	)
 	if err == nil {
 		t.Fatal("expected bad version error")
 	}
 }
 func TestChannelValidateExpiredStamp(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewChannelValidator()
 	bodyHash := testBodyHash()
 	// Mint with a very old date by manually constructing.
 	stamp := mintStampWithDate(
 		t, testBits, testChannel, "200101",
 	)
 	err := validator.ValidateStamp(
 		stamp, testBits, testChannel, bodyHash,
 	)
 	if err == nil {
 		t.Fatal("expected expired stamp error")
 	}
 }
 func TestChannelValidateMissingBodyHash(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewChannelValidator()
 	bodyHash := testBodyHash()
 	// Construct a stamp with empty body hash field.
 	stamp := mintStampWithDate(
 		t, testBits, testChannel, todayDate(),
 	)
 	// This uses the session-style stamp which has empty
 	// ext field — body hash is missing.
 	err := validator.ValidateStamp(
 		stamp, testBits, testChannel, bodyHash,
 	)
 	if err == nil {
 		t.Fatal("expected missing body hash error")
 	}
 }
 func TestBodyHash(t *testing.T) {
 	t.Parallel()
 	body := []byte(`["hello world"]`)
 	bodyHash := hashcash.BodyHash(body)
 	if len(bodyHash) != 64 {
 		t.Fatalf(
 			"expected 64-char hex hash, got %d",
 			len(bodyHash),
 		)
 	}
 	// Same input should produce same hash.
 	bodyHash2 := hashcash.BodyHash(body)
 	if bodyHash != bodyHash2 {
 		t.Fatal("body hash not deterministic")
 	}
 	// Different input should produce different hash.
 	bodyHash3 := hashcash.BodyHash([]byte("different"))
 	if bodyHash == bodyHash3 {
 		t.Fatal("different inputs produced same hash")
 	}
 }
 func TestStampHash(t *testing.T) {
 	t.Parallel()
 	hash1 := hashcash.StampHash("stamp1")
 	hash2 := hashcash.StampHash("stamp2")
 	if hash1 == hash2 {
 		t.Fatal("different stamps produced same hash")
 	}
 	// Same input should be deterministic.
 	hash1b := hashcash.StampHash("stamp1")
 	if hash1 != hash1b {
 		t.Fatal("stamp hash not deterministic")
 	}
 }
 func TestMintChannelStamp(t *testing.T) {
 	t.Parallel()
 	bodyHash := testBodyHash()
 	stamp := hashcash.MintChannelStamp(
 		testBits, testChannel, bodyHash,
 	)
 	if stamp == "" {
 		t.Fatal("expected non-empty stamp")
 	}
 	// Validate the minted stamp.
 	validator := hashcash.NewChannelValidator()
 	err := validator.ValidateStamp(
 		stamp, testBits, testChannel, bodyHash,
 	)
 	if err != nil {
 		t.Fatalf("minted stamp failed validation: %v", err)
 	}
 }
--- a/internal/hashcash/hashcash.go
+++ b/internal/hashcash/hashcash.go
@@ -0,0 +1,277 @@
 // Package hashcash implements SHA-256-based hashcash
 // proof-of-work validation for abuse prevention.
 //
 // Stamp format: 1:bits:YYMMDD:resource::counter.
 //
 // The SHA-256 hash of the entire stamp string must have
 // at least `bits` leading zero bits.
 package hashcash
 import (
 	"crypto/sha256"
 	"errors"
 	"fmt"
 	"strconv"
 	"strings"
 	"sync"
 	"time"
 )
 const (
 	// stampVersion is the only supported hashcash version.
 	stampVersion = "1"
 	// stampFields is the number of fields in a stamp.
 	stampFields = 6
 	// maxStampAge is how old a stamp can be before
 	// rejection.
 	maxStampAge = 48 * time.Hour
 	// maxFutureSkew allows stamps slightly in the future.
 	maxFutureSkew = 1 * time.Hour
 	// pruneInterval controls how often expired stamps are
 	// removed from the spent set.
 	pruneInterval = 10 * time.Minute
 	// dateFormatShort is the YYMMDD date layout.
 	dateFormatShort = "060102"
 	// dateFormatLong is the YYMMDDHHMMSS date layout.
 	dateFormatLong = "060102150405"
 	// dateShortLen is the length of YYMMDD.
 	dateShortLen = 6
 	// dateLongLen is the length of YYMMDDHHMMSS.
 	dateLongLen = 12
 	// bitsPerByte is the number of bits in a byte.
 	bitsPerByte = 8
 	// fullByteMask is 0xFF, a mask for all bits in a byte.
 	fullByteMask = 0xFF
 )
 var (
 	errInvalidFields    = errors.New("invalid stamp field count")
 	errBadVersion       = errors.New("unsupported stamp version")
 	errInsufficientBits = errors.New("insufficient difficulty")
 	errWrongResource    = errors.New("wrong resource")
 	errStampExpired     = errors.New("stamp expired")
 	errStampFuture      = errors.New("stamp date in future")
 	errProofFailed      = errors.New("proof-of-work failed")
 	errStampReused      = errors.New("stamp already used")
 	errBadDateFormat    = errors.New("unrecognized date format")
 )
 // Validator checks hashcash stamps for validity and
 // prevents replay attacks via an in-memory spent set.
 type Validator struct {
 	resource string
 	mu       sync.Mutex
 	spent    map[string]time.Time
 }
 // NewValidator creates a Validator for the given resource.
 func NewValidator(resource string) *Validator {
 	validator := &Validator{
 		resource: resource,
 		mu:       sync.Mutex{},
 		spent:    make(map[string]time.Time),
 	}
 	go validator.pruneLoop()
 	return validator
 }
 // Validate checks a hashcash stamp. It returns nil if the
 // stamp is valid and has not been seen before.
 func (v *Validator) Validate(
 	stamp string,
 	requiredBits int,
 ) error {
 	if requiredBits <= 0 {
 		return nil
 	}
 	parts := strings.Split(stamp, ":")
 	if len(parts) != stampFields {
 		return fmt.Errorf(
 			"%w: expected %d, got %d",
 			errInvalidFields, stampFields, len(parts),
 		)
 	}
 	version := parts[0]
 	bitsStr := parts[1]
 	dateStr := parts[2]
 	resource := parts[3]
 	if err := v.validateHeader(
 		version, bitsStr, resource, requiredBits,
 	); err != nil {
 		return err
 	}
 	stampTime, err := parseStampDate(dateStr)
 	if err != nil {
 		return err
 	}
 	if err := validateTime(stampTime); err != nil {
 		return err
 	}
 	if err := validateProof(
 		stamp, requiredBits,
 	); err != nil {
 		return err
 	}
 	return v.checkAndRecordStamp(stamp, stampTime)
 }
 func (v *Validator) validateHeader(
 	version, bitsStr, resource string,
 	requiredBits int,
 ) error {
 	if version != stampVersion {
 		return fmt.Errorf(
 			"%w: %s", errBadVersion, version,
 		)
 	}
 	claimedBits, err := strconv.Atoi(bitsStr)
 	if err != nil || claimedBits < requiredBits {
 		return fmt.Errorf(
 			"%w: need %d bits",
 			errInsufficientBits, requiredBits,
 		)
 	}
 	if resource != v.resource {
 		return fmt.Errorf(
 			"%w: got %q, want %q",
 			errWrongResource, resource, v.resource,
 		)
 	}
 	return nil
 }
 func validateTime(stampTime time.Time) error {
 	now := time.Now()
 	if now.Sub(stampTime) > maxStampAge {
 		return errStampExpired
 	}
 	if stampTime.Sub(now) > maxFutureSkew {
 		return errStampFuture
 	}
 	return nil
 }
 func validateProof(stamp string, requiredBits int) error {
 	hash := sha256.Sum256([]byte(stamp))
 	if !hasLeadingZeroBits(hash[:], requiredBits) {
 		return fmt.Errorf(
 			"%w: need %d leading zero bits",
 			errProofFailed, requiredBits,
 		)
 	}
 	return nil
 }
 func (v *Validator) checkAndRecordStamp(
 	stamp string,
 	stampTime time.Time,
 ) error {
 	v.mu.Lock()
 	defer v.mu.Unlock()
 	if _, ok := v.spent[stamp]; ok {
 		return errStampReused
 	}
 	v.spent[stamp] = stampTime
 	return nil
 }
 // hasLeadingZeroBits checks if the hash has at least n
 // leading zero bits.
 func hasLeadingZeroBits(hash []byte, numBits int) bool {
 	fullBytes := numBits / bitsPerByte
 	remainBits := numBits % bitsPerByte
 	for idx := range fullBytes {
 		if hash[idx] != 0 {
 			return false
 		}
 	}
 	if remainBits > 0 && fullBytes < len(hash) {
 		mask := byte(
 			fullByteMask << (bitsPerByte - remainBits),
 		)
 		if hash[fullBytes]&mask != 0 {
 			return false
 		}
 	}
 	return true
 }
 // parseStampDate parses a hashcash date stamp.
 // Supports YYMMDD and YYMMDDHHMMSS formats.
 func parseStampDate(dateStr string) (time.Time, error) {
 	switch len(dateStr) {
 	case dateShortLen:
 		parsed, err := time.Parse(
 			dateFormatShort, dateStr,
 		)
 		if err != nil {
 			return time.Time{}, fmt.Errorf(
 				"parse date: %w", err,
 			)
 		}
 		return parsed, nil
 	case dateLongLen:
 		parsed, err := time.Parse(
 			dateFormatLong, dateStr,
 		)
 		if err != nil {
 			return time.Time{}, fmt.Errorf(
 				"parse date: %w", err,
 			)
 		}
 		return parsed, nil
 	default:
 		return time.Time{}, fmt.Errorf(
 			"%w: %q", errBadDateFormat, dateStr,
 		)
 	}
 }
 // pruneLoop periodically removes expired stamps from the
 // spent set.
 func (v *Validator) pruneLoop() {
 	ticker := time.NewTicker(pruneInterval)
 	defer ticker.Stop()
 	for range ticker.C {
 		v.prune()
 	}
 }
 func (v *Validator) prune() {
 	cutoff := time.Now().Add(-maxStampAge)
 	v.mu.Lock()
 	defer v.mu.Unlock()
 	for stamp, stampTime := range v.spent {
 		if stampTime.Before(cutoff) {
 			delete(v.spent, stamp)
 		}
 	}
 }
--- a/internal/hashcash/hashcash_test.go
+++ b/internal/hashcash/hashcash_test.go
@@ -0,0 +1,261 @@
 package hashcash_test
 import (
 	"crypto/rand"
 	"crypto/sha256"
 	"encoding/hex"
 	"fmt"
 	"math/big"
 	"testing"
 	"time"
 	"git.eeqj.de/sneak/neoirc/internal/hashcash"
 )
 const testBits = 2
 // mintStampWithDate creates a valid hashcash stamp using
 // the given date string.
 func mintStampWithDate(
 	tb testing.TB,
 	bits int,
 	resource string,
 	date string,
 ) string {
 	tb.Helper()
 	prefix := fmt.Sprintf(
 		"1:%d:%s:%s::", bits, date, resource,
 	)
 	for {
 		counterVal, err := rand.Int(
 			rand.Reader, big.NewInt(1<<48),
 		)
 		if err != nil {
 			tb.Fatalf("random counter: %v", err)
 		}
 		stamp := prefix + hex.EncodeToString(
 			counterVal.Bytes(),
 		)
 		hash := sha256.Sum256([]byte(stamp))
 		if hasLeadingZeroBits(hash[:], bits) {
 			return stamp
 		}
 	}
 }
 // hasLeadingZeroBits checks if hash has at least numBits
 // leading zero bits. Duplicated here for test minting.
 func hasLeadingZeroBits(
 	hash []byte,
 	numBits int,
 ) bool {
 	fullBytes := numBits / 8
 	remainBits := numBits % 8
 	for idx := range fullBytes {
 		if hash[idx] != 0 {
 			return false
 		}
 	}
 	if remainBits > 0 && fullBytes < len(hash) {
 		mask := byte(0xFF << (8 - remainBits))
 		if hash[fullBytes]&mask != 0 {
 			return false
 		}
 	}
 	return true
 }
 func todayDate() string {
 	return time.Now().UTC().Format("060102")
 }
 func TestMintAndValidate(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewValidator("test-resource")
 	stamp := mintStampWithDate(
 		t, testBits, "test-resource", todayDate(),
 	)
 	err := validator.Validate(stamp, testBits)
 	if err != nil {
 		t.Fatalf("valid stamp rejected: %v", err)
 	}
 }
 func TestReplayDetection(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewValidator("test-resource")
 	stamp := mintStampWithDate(
 		t, testBits, "test-resource", todayDate(),
 	)
 	err := validator.Validate(stamp, testBits)
 	if err != nil {
 		t.Fatalf("first use failed: %v", err)
 	}
 	err = validator.Validate(stamp, testBits)
 	if err == nil {
 		t.Fatal("replay not detected")
 	}
 }
 func TestResourceMismatch(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewValidator("correct-resource")
 	stamp := mintStampWithDate(
 		t, testBits, "wrong-resource", todayDate(),
 	)
 	err := validator.Validate(stamp, testBits)
 	if err == nil {
 		t.Fatal("expected resource mismatch error")
 	}
 }
 func TestInvalidStampFormat(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewValidator("test-resource")
 	err := validator.Validate(
 		"not:a:valid:stamp", testBits,
 	)
 	if err == nil {
 		t.Fatal("expected error for bad format")
 	}
 }
 func TestBadVersion(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewValidator("test-resource")
 	stamp := fmt.Sprintf(
 		"2:%d:%s:%s::abc123",
 		testBits, todayDate(), "test-resource",
 	)
 	err := validator.Validate(stamp, testBits)
 	if err == nil {
 		t.Fatal("expected bad version error")
 	}
 }
 func TestInsufficientDifficulty(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewValidator("test-resource")
 	// Claimed bits=1, but we require testBits=2.
 	stamp := fmt.Sprintf(
 		"1:1:%s:%s::counter",
 		todayDate(), "test-resource",
 	)
 	err := validator.Validate(stamp, testBits)
 	if err == nil {
 		t.Fatal("expected insufficient bits error")
 	}
 }
 func TestExpiredStamp(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewValidator("test-resource")
 	oldDate := time.Now().Add(-72 * time.Hour).
 		UTC().Format("060102")
 	stamp := mintStampWithDate(
 		t, testBits, "test-resource", oldDate,
 	)
 	err := validator.Validate(stamp, testBits)
 	if err == nil {
 		t.Fatal("expected expired stamp error")
 	}
 }
 func TestZeroBitsSkipsValidation(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewValidator("test-resource")
 	err := validator.Validate("garbage", 0)
 	if err != nil {
 		t.Fatalf("zero bits should skip: %v", err)
 	}
 }
 func TestLongDateFormat(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewValidator("test-resource")
 	longDate := time.Now().UTC().Format("060102150405")
 	stamp := mintStampWithDate(
 		t, testBits, "test-resource", longDate,
 	)
 	err := validator.Validate(stamp, testBits)
 	if err != nil {
 		t.Fatalf("long date stamp rejected: %v", err)
 	}
 }
 func TestBadDateFormat(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewValidator("test-resource")
 	stamp := fmt.Sprintf(
 		"1:%d:BADDATE:%s::counter",
 		testBits, "test-resource",
 	)
 	err := validator.Validate(stamp, testBits)
 	if err == nil {
 		t.Fatal("expected bad date error")
 	}
 }
 func TestMultipleUniqueStamps(t *testing.T) {
 	t.Parallel()
 	validator := hashcash.NewValidator("test-resource")
 	for range 5 {
 		stamp := mintStampWithDate(
 			t, testBits, "test-resource", todayDate(),
 		)
 		err := validator.Validate(stamp, testBits)
 		if err != nil {
 			t.Fatalf("unique stamp rejected: %v", err)
 		}
 	}
 }
 func TestHigherBitsStillValid(t *testing.T) {
 	t.Parallel()
 	// Mint with bits=4 but validate requiring only 2.
 	validator := hashcash.NewValidator("test-resource")
 	stamp := mintStampWithDate(
 		t, 4, "test-resource", todayDate(),
 	)
 	err := validator.Validate(stamp, testBits)
 	if err != nil {
 		t.Fatalf(
 			"higher-difficulty stamp rejected: %v",
 			err,
 		)
 	}
 }
--- a/internal/healthcheck/healthcheck.go
+++ b/internal/healthcheck/healthcheck.go
@@ -10,6 +10,7 @@ import (
 	"git.eeqj.de/sneak/neoirc/internal/db"
 	"git.eeqj.de/sneak/neoirc/internal/globals"
 	"git.eeqj.de/sneak/neoirc/internal/logger"
 	"git.eeqj.de/sneak/neoirc/internal/stats"
 	"go.uber.org/fx"
 )
@@ -21,6 +22,7 @@ type Params struct {
 	Config   *config.Config
 	Logger   *logger.Logger
 	Database *db.Database
 	Stats    *stats.Tracker
 }
 // Healthcheck tracks server uptime and provides health status.
@@ -64,11 +66,22 @@ type Response struct {
 	Version       string `json:"version"`
 	Appname       string `json:"appname"`
 	Maintenance   bool   `json:"maintenanceMode"`
 	// Runtime statistics.
 	Sessions             int64 `json:"sessions"`
 	Clients              int64 `json:"clients"`
 	QueuedLines          int64 `json:"queuedLines"`
 	Channels             int64 `json:"channels"`
 	ConnectionsSinceBoot int64 `json:"connectionsSinceBoot"`
 	SessionsSinceBoot    int64 `json:"sessionsSinceBoot"`
 	MessagesSinceBoot    int64 `json:"messagesSinceBoot"`
 }
 // Healthcheck returns the current health status of the server.
-func (hcheck *Healthcheck) Healthcheck() *Response {
+func (hcheck *Healthcheck) Healthcheck(
-	return &Response{
+	ctx context.Context,
 ) *Response {
 	resp := &Response{
 		Status:        "ok",
 		Now:           time.Now().UTC().Format(time.RFC3339Nano),
 		UptimeSeconds: int64(hcheck.uptime().Seconds()),
@@ -76,6 +89,64 @@ func (hcheck *Healthcheck) Healthcheck() *Response {
 		Appname:       hcheck.params.Globals.Appname,
 		Version:       hcheck.params.Globals.Version,
 		Maintenance:   hcheck.params.Config.MaintenanceMode,
 		Sessions:             0,
 		Clients:              0,
 		QueuedLines:          0,
 		Channels:             0,
 		ConnectionsSinceBoot: hcheck.params.Stats.ConnectionsSinceBoot(),
 		SessionsSinceBoot:    hcheck.params.Stats.SessionsSinceBoot(),
 		MessagesSinceBoot:    hcheck.params.Stats.MessagesSinceBoot(),
 	}
 	hcheck.populateDBStats(ctx, resp)
 	return resp
 }
 // populateDBStats fills in database-derived counters.
 func (hcheck *Healthcheck) populateDBStats(
 	ctx context.Context,
 	resp *Response,
 ) {
 	sessions, err := hcheck.params.Database.GetUserCount(ctx)
 	if err != nil {
 		hcheck.log.Error(
 			"healthcheck: session count failed",
 			"error", err,
 		)
 	} else {
 		resp.Sessions = sessions
 	}
 	clients, err := hcheck.params.Database.GetClientCount(ctx)
 	if err != nil {
 		hcheck.log.Error(
 			"healthcheck: client count failed",
 			"error", err,
 		)
 	} else {
 		resp.Clients = clients
 	}
 	queued, err := hcheck.params.Database.GetQueueEntryCount(ctx)
 	if err != nil {
 		hcheck.log.Error(
 			"healthcheck: queue entry count failed",
 			"error", err,
 		)
 	} else {
 		resp.QueuedLines = queued
 	}
 	channels, err := hcheck.params.Database.GetChannelCount(ctx)
 	if err != nil {
 		hcheck.log.Error(
 			"healthcheck: channel count failed",
 			"error", err,
 		)
 	} else {
 		resp.Channels = channels
 	}
 }
--- a/internal/irc/numerics.go
+++ b/internal/irc/numerics.go
@@ -1,150 +0,0 @@
 // Package irc provides constants and utilities for the
 // IRC protocol, including numeric reply codes from
 // RFC 1459 and RFC 2812, and standard command names.
 package irc
 // Connection registration replies (001-005).
 const (
 	RplWelcome  = 1
 	RplYourHost = 2
 	RplCreated  = 3
 	RplMyInfo   = 4
 	RplIsupport = 5
 )
 // Command responses (200-399).
 const (
 	RplUmodeIs       = 221
 	RplLuserClient   = 251
 	RplLuserOp       = 252
 	RplLuserUnknown  = 253
 	RplLuserChannels = 254
 	RplLuserMe       = 255
 	RplAway          = 301
 	RplUserHost      = 302
 	RplIson          = 303
 	RplUnaway        = 305
 	RplNowAway       = 306
 	RplWhoisUser     = 311
 	RplWhoisServer   = 312
 	RplWhoisOperator = 313
 	RplEndOfWho      = 315
 	RplWhoisIdle     = 317
 	RplEndOfWhois    = 318
 	RplWhoisChannels = 319
 	RplList          = 322
 	RplListEnd       = 323
 	RplChannelModeIs = 324
 	RplCreationTime  = 329
 	RplNoTopic       = 331
 	RplTopic         = 332
 	RplTopicWhoTime  = 333
 	RplInviting      = 341
 	RplWhoReply      = 352
 	RplNamReply      = 353
 	RplEndOfNames    = 366
 	RplBanList       = 367
 	RplEndOfBanList  = 368
 	RplMotd          = 372
 	RplMotdStart     = 375
 	RplEndOfMotd     = 376
 )
 // Error replies (400-599).
 const (
 	ErrNoSuchNick        = 401
 	ErrNoSuchServer      = 402
 	ErrNoSuchChannel     = 403
 	ErrCannotSendToChan  = 404
 	ErrTooManyChannels   = 405
 	ErrNoRecipient       = 411
 	ErrNoTextToSend      = 412
 	ErrUnknownCommand    = 421
 	ErrNoNicknameGiven   = 431
 	ErrErroneusNickname  = 432
 	ErrNicknameInUse     = 433
 	ErrUserNotInChannel  = 441
 	ErrNotOnChannel      = 442
 	ErrNotRegistered     = 451
 	ErrNeedMoreParams    = 461
 	ErrAlreadyRegistered = 462
 	ErrChannelIsFull     = 471
 	ErrInviteOnlyChan    = 473
 	ErrBannedFromChan    = 474
 	ErrBadChannelKey     = 475
 	ErrChanOpPrivsNeeded = 482
 )
 // names maps numeric codes to their standard IRC names.
 //
 //nolint:gochecknoglobals
 var names = map[int]string{
 	RplWelcome:       "RPL_WELCOME",
 	RplYourHost:      "RPL_YOURHOST",
 	RplCreated:       "RPL_CREATED",
 	RplMyInfo:        "RPL_MYINFO",
 	RplIsupport:      "RPL_ISUPPORT",
 	RplUmodeIs:       "RPL_UMODEIS",
 	RplLuserClient:   "RPL_LUSERCLIENT",
 	RplLuserOp:       "RPL_LUSEROP",
 	RplLuserUnknown:  "RPL_LUSERUNKNOWN",
 	RplLuserChannels: "RPL_LUSERCHANNELS",
 	RplLuserMe:       "RPL_LUSERME",
 	RplAway:          "RPL_AWAY",
 	RplUserHost:      "RPL_USERHOST",
 	RplIson:          "RPL_ISON",
 	RplUnaway:        "RPL_UNAWAY",
 	RplNowAway:       "RPL_NOWAWAY",
 	RplWhoisUser:     "RPL_WHOISUSER",
 	RplWhoisServer:   "RPL_WHOISSERVER",
 	RplWhoisOperator: "RPL_WHOISOPERATOR",
 	RplEndOfWho:      "RPL_ENDOFWHO",
 	RplWhoisIdle:     "RPL_WHOISIDLE",
 	RplEndOfWhois:    "RPL_ENDOFWHOIS",
 	RplWhoisChannels: "RPL_WHOISCHANNELS",
 	RplList:          "RPL_LIST",
 	RplListEnd:       "RPL_LISTEND", //nolint:misspell
 	RplChannelModeIs: "RPL_CHANNELMODEIS",
 	RplCreationTime:  "RPL_CREATIONTIME",
 	RplNoTopic:       "RPL_NOTOPIC",
 	RplTopic:         "RPL_TOPIC",
 	RplTopicWhoTime:  "RPL_TOPICWHOTIME",
 	RplInviting:      "RPL_INVITING",
 	RplWhoReply:      "RPL_WHOREPLY",
 	RplNamReply:      "RPL_NAMREPLY",
 	RplEndOfNames:    "RPL_ENDOFNAMES",
 	RplBanList:       "RPL_BANLIST",
 	RplEndOfBanList:  "RPL_ENDOFBANLIST",
 	RplMotd:          "RPL_MOTD",
 	RplMotdStart:     "RPL_MOTDSTART",
 	RplEndOfMotd:     "RPL_ENDOFMOTD",
 	ErrNoSuchNick:        "ERR_NOSUCHNICK",
 	ErrNoSuchServer:      "ERR_NOSUCHSERVER",
 	ErrNoSuchChannel:     "ERR_NOSUCHCHANNEL",
 	ErrCannotSendToChan:  "ERR_CANNOTSENDTOCHAN",
 	ErrTooManyChannels:   "ERR_TOOMANYCHANNELS",
 	ErrNoRecipient:       "ERR_NORECIPIENT",
 	ErrNoTextToSend:      "ERR_NOTEXTTOSEND",
 	ErrUnknownCommand:    "ERR_UNKNOWNCOMMAND",
 	ErrNoNicknameGiven:   "ERR_NONICKNAMEGIVEN",
 	ErrErroneusNickname:  "ERR_ERRONEUSNICKNAME",
 	ErrNicknameInUse:     "ERR_NICKNAMEINUSE",
 	ErrUserNotInChannel:  "ERR_USERNOTINCHANNEL",
 	ErrNotOnChannel:      "ERR_NOTONCHANNEL",
 	ErrNotRegistered:     "ERR_NOTREGISTERED",
 	ErrNeedMoreParams:    "ERR_NEEDMOREPARAMS",
 	ErrAlreadyRegistered: "ERR_ALREADYREGISTERED",
 	ErrChannelIsFull:     "ERR_CHANNELISFULL",
 	ErrInviteOnlyChan:    "ERR_INVITEONLYCHAN",
 	ErrBannedFromChan:    "ERR_BANNEDFROMCHAN",
 	ErrBadChannelKey:     "ERR_BADCHANNELKEY",
 	ErrChanOpPrivsNeeded: "ERR_CHANOPRIVSNEEDED",
 }
 // Name returns the standard IRC name for a numeric code
 // (e.g., Name(2) returns "RPL_YOURHOST"). Returns an
 // empty string if the code is unknown.
 func Name(code int) string {
 	return names[code]
 }
--- a/internal/middleware/middleware.go
+++ b/internal/middleware/middleware.go
@@ -11,7 +11,7 @@ import (
 	"git.eeqj.de/sneak/neoirc/internal/globals"
 	"git.eeqj.de/sneak/neoirc/internal/logger"
 	basicauth "github.com/99designs/basicauth-go"
-	chimw "github.com/go-chi/chi/middleware"
+	chimw "github.com/go-chi/chi/v5/middleware"
 	"github.com/go-chi/cors"
 	metrics "github.com/slok/go-http-metrics/metrics/prometheus"
 	ghmm "github.com/slok/go-http-metrics/middleware"
@@ -126,36 +126,27 @@ func (mware *Middleware) Logging() func(http.Handler) http.Handler {
 }
 // CORS returns middleware that handles Cross-Origin Resource Sharing.
 // AllowCredentials is true so browsers include cookies in
 // cross-origin API requests.
 func (mware *Middleware) CORS() func(http.Handler) http.Handler {
 	return cors.Handler(cors.Options{ //nolint:exhaustruct // optional fields
-		AllowedOrigins: []string{"*"},
+		AllowOriginFunc: func(
 			_ *http.Request, _ string,
 		) bool {
 			return true
 		},
 		AllowedMethods: []string{
 			"GET", "POST", "PUT", "DELETE", "OPTIONS",
 		},
 		AllowedHeaders: []string{
-			"Accept", "Authorization",
+			"Accept", "Content-Type", "X-CSRF-Token",
 			"Content-Type", "X-CSRF-Token",
 		},
 		ExposedHeaders:   []string{"Link"},
-		AllowCredentials: false,
+		AllowCredentials: true,
 		MaxAge:           corsMaxAge,
 	})
 }
 // Auth returns middleware that performs authentication.
 func (mware *Middleware) Auth() func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(
 			func(
 				writer http.ResponseWriter,
 				request *http.Request,
 			) {
 				mware.log.Info("AUTH: before request")
 				next.ServeHTTP(writer, request)
 			})
 	}
 }
 // Metrics returns middleware that records HTTP metrics.
 func (mware *Middleware) Metrics() func(http.Handler) http.Handler {
 	metricsMiddleware := ghmm.New(ghmm.Config{ //nolint:exhaustruct // optional fields
@@ -180,3 +171,36 @@ func (mware *Middleware) MetricsAuth() func(http.Handler) http.Handler {
 		},
 	)
 }
 // cspPolicy is the Content-Security-Policy header value applied to all
 // responses.  The embedded SPA loads scripts and styles from same-origin
 // files only (no inline scripts or inline style attributes), so a strict
 // policy works without 'unsafe-inline'.
 const cspPolicy = "default-src 'self'; " +
 	"script-src 'self'; " +
 	"style-src 'self'; " +
 	"connect-src 'self'; " +
 	"img-src 'self'; " +
 	"font-src 'self'; " +
 	"object-src 'none'; " +
 	"frame-ancestors 'none'; " +
 	"base-uri 'self'; " +
 	"form-action 'self'"
 // CSP returns middleware that sets the Content-Security-Policy header on
 // every response for defense-in-depth against XSS.
 func (mware *Middleware) CSP() func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(
 			func(
 				writer http.ResponseWriter,
 				request *http.Request,
 			) {
 				writer.Header().Set(
 					"Content-Security-Policy",
 					cspPolicy,
 				)
 				next.ServeHTTP(writer, request)
 			})
 	}
 }
--- a/internal/ratelimit/ratelimit.go
+++ b/internal/ratelimit/ratelimit.go
@@ -0,0 +1,122 @@
 // Package ratelimit provides per-IP rate limiting for HTTP endpoints.
 package ratelimit
 import (
 	"sync"
 	"time"
 	"golang.org/x/time/rate"
 )
 const (
 	// DefaultRate is the default number of allowed requests per second.
 	DefaultRate = 1.0
 	// DefaultBurst is the default maximum burst size.
 	DefaultBurst = 5
 	// DefaultSweepInterval controls how often stale entries are pruned.
 	DefaultSweepInterval = 10 * time.Minute
 	// DefaultEntryTTL is how long an unused entry lives before eviction.
 	DefaultEntryTTL = 15 * time.Minute
 )
 // entry tracks a per-IP rate limiter and when it was last used.
 type entry struct {
 	limiter  *rate.Limiter
 	lastSeen time.Time
 }
 // Limiter manages per-key rate limiters with automatic cleanup
 // of stale entries.
 type Limiter struct {
 	mu       sync.Mutex
 	entries  map[string]*entry
 	rate     rate.Limit
 	burst    int
 	entryTTL time.Duration
 	stopCh   chan struct{}
 }
 // New creates a new per-key rate Limiter.
 // The ratePerSec parameter sets how many requests per second are
 // allowed per key.  The burst parameter sets the maximum number of
 // requests that can be made in a single burst.
 func New(ratePerSec float64, burst int) *Limiter {
 	limiter := &Limiter{
 		mu:       sync.Mutex{},
 		entries:  make(map[string]*entry),
 		rate:     rate.Limit(ratePerSec),
 		burst:    burst,
 		entryTTL: DefaultEntryTTL,
 		stopCh:   make(chan struct{}),
 	}
 	go limiter.sweepLoop()
 	return limiter
 }
 // Allow reports whether a request from the given key should be
 // allowed.  It consumes one token from the key's rate limiter.
 func (l *Limiter) Allow(key string) bool {
 	l.mu.Lock()
 	ent, exists := l.entries[key]
 	if !exists {
 		ent = &entry{
 			limiter:  rate.NewLimiter(l.rate, l.burst),
 			lastSeen: time.Now(),
 		}
 		l.entries[key] = ent
 	} else {
 		ent.lastSeen = time.Now()
 	}
 	l.mu.Unlock()
 	return ent.limiter.Allow()
 }
 // Stop terminates the background sweep goroutine.
 func (l *Limiter) Stop() {
 	close(l.stopCh)
 }
 // Len returns the number of tracked keys (for testing).
 func (l *Limiter) Len() int {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 	return len(l.entries)
 }
 // sweepLoop periodically removes entries that haven't been seen
 // within the TTL.
 func (l *Limiter) sweepLoop() {
 	ticker := time.NewTicker(DefaultSweepInterval)
 	defer ticker.Stop()
 	for {
 		select {
 		case <-ticker.C:
 			l.sweep()
 		case <-l.stopCh:
 			return
 		}
 	}
 }
 // sweep removes stale entries.
 func (l *Limiter) sweep() {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 	cutoff := time.Now().Add(-l.entryTTL)
 	for key, ent := range l.entries {
 		if ent.lastSeen.Before(cutoff) {
 			delete(l.entries, key)
 		}
 	}
 }
--- a/internal/ratelimit/ratelimit_test.go
+++ b/internal/ratelimit/ratelimit_test.go
@@ -0,0 +1,106 @@
 package ratelimit_test
 import (
 	"testing"
 	"git.eeqj.de/sneak/neoirc/internal/ratelimit"
 )
 func TestNewCreatesLimiter(t *testing.T) {
 	t.Parallel()
 	limiter := ratelimit.New(1.0, 5)
 	defer limiter.Stop()
 	if limiter == nil {
 		t.Fatal("expected non-nil limiter")
 	}
 }
 func TestAllowWithinBurst(t *testing.T) {
 	t.Parallel()
 	limiter := ratelimit.New(1.0, 3)
 	defer limiter.Stop()
 	for i := range 3 {
 		if !limiter.Allow("192.168.1.1") {
 			t.Fatalf(
 				"request %d should be allowed within burst",
 				i+1,
 			)
 		}
 	}
 }
 func TestAllowExceedsBurst(t *testing.T) {
 	t.Parallel()
 	// Rate of 0 means no token replenishment, only burst.
 	limiter := ratelimit.New(0, 3)
 	defer limiter.Stop()
 	for range 3 {
 		limiter.Allow("10.0.0.1")
 	}
 	if limiter.Allow("10.0.0.1") {
 		t.Fatal("fourth request should be denied after burst exhausted")
 	}
 }
 func TestAllowSeparateKeys(t *testing.T) {
 	t.Parallel()
 	// Rate of 0, burst of 1 — only one request per key.
 	limiter := ratelimit.New(0, 1)
 	defer limiter.Stop()
 	if !limiter.Allow("10.0.0.1") {
 		t.Fatal("first request for key A should be allowed")
 	}
 	if !limiter.Allow("10.0.0.2") {
 		t.Fatal("first request for key B should be allowed")
 	}
 	if limiter.Allow("10.0.0.1") {
 		t.Fatal("second request for key A should be denied")
 	}
 	if limiter.Allow("10.0.0.2") {
 		t.Fatal("second request for key B should be denied")
 	}
 }
 func TestLenTracksKeys(t *testing.T) {
 	t.Parallel()
 	limiter := ratelimit.New(1.0, 5)
 	defer limiter.Stop()
 	if limiter.Len() != 0 {
 		t.Fatalf("expected 0 entries, got %d", limiter.Len())
 	}
 	limiter.Allow("10.0.0.1")
 	limiter.Allow("10.0.0.2")
 	if limiter.Len() != 2 {
 		t.Fatalf("expected 2 entries, got %d", limiter.Len())
 	}
 	// Same key again should not increase count.
 	limiter.Allow("10.0.0.1")
 	if limiter.Len() != 2 {
 		t.Fatalf("expected 2 entries, got %d", limiter.Len())
 	}
 }
 func TestStopDoesNotPanic(t *testing.T) {
 	t.Parallel()
 	limiter := ratelimit.New(1.0, 5)
 	limiter.Stop()
 }
--- a/internal/server/routes.go
+++ b/internal/server/routes.go
@@ -8,19 +8,14 @@ import (
 	"git.eeqj.de/sneak/neoirc/web"
 	sentryhttp "github.com/getsentry/sentry-go/http"
-	"github.com/go-chi/chi"
+	"github.com/go-chi/chi/v5"
-	"github.com/go-chi/chi/middleware"
+	"github.com/go-chi/chi/v5/middleware"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"github.com/spf13/viper"
 )
 const routeTimeout = 60 * time.Second
 // cspHeader is the Content-Security-Policy applied to the embedded web SPA.
 // The SPA loads external scripts and stylesheets from the same origin only;
 // all API communication uses same-origin fetch (no WebSockets).
 const cspHeader = "default-src 'self'; script-src 'self'; style-src 'self'"
 // SetupRoutes configures the HTTP routes and middleware.
 func (srv *Server) SetupRoutes() {
 	srv.router = chi.NewRouter()
@@ -34,6 +29,7 @@ func (srv *Server) SetupRoutes() {
 	}
 	srv.router.Use(srv.mw.CORS())
 	srv.router.Use(srv.mw.CSP())
 	srv.router.Use(middleware.Timeout(routeTimeout))
 	if srv.sentryEnabled {
@@ -79,10 +75,6 @@ func (srv *Server) setupAPIv1(router chi.Router) {
 		"/session",
 		srv.handlers.HandleCreateSession(),
 	)
 	router.Post(
 		"/register",
 		srv.handlers.HandleRegister(),
 	)
 	router.Post(
 		"/login",
 		srv.handlers.HandleLogin(),
@@ -138,11 +130,6 @@ func (srv *Server) setupSPA() {
 		writer http.ResponseWriter,
 		request *http.Request,
 	) {
 		writer.Header().Set(
 			"Content-Security-Policy",
 			cspHeader,
 		)
 		readFS, ok := distFS.(fs.ReadFileFS)
 		if !ok {
 			fileServer.ServeHTTP(writer, request)
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -20,7 +20,7 @@ import (
 	"go.uber.org/fx"
 	"github.com/getsentry/sentry-go"
-	"github.com/go-chi/chi"
+	"github.com/go-chi/chi/v5"
 	_ "github.com/joho/godotenv/autoload" // loads .env file
 )
--- a/internal/stats/stats.go
+++ b/internal/stats/stats.go
@@ -0,0 +1,52 @@
 // Package stats tracks runtime statistics since server boot.
 package stats
 import (
 	"sync/atomic"
 )
 // Tracker holds atomic counters for runtime statistics
 // that accumulate since the server started.
 type Tracker struct {
 	connectionsSinceBoot atomic.Int64
 	sessionsSinceBoot    atomic.Int64
 	messagesSinceBoot    atomic.Int64
 }
 // New creates a new Tracker with all counters at zero.
 func New() *Tracker {
 	return &Tracker{} //nolint:exhaustruct // atomic fields have zero-value defaults
 }
 // IncrConnections increments the total connection count.
 func (t *Tracker) IncrConnections() {
 	t.connectionsSinceBoot.Add(1)
 }
 // IncrSessions increments the total session count.
 func (t *Tracker) IncrSessions() {
 	t.sessionsSinceBoot.Add(1)
 }
 // IncrMessages increments the total PRIVMSG/NOTICE count.
 func (t *Tracker) IncrMessages() {
 	t.messagesSinceBoot.Add(1)
 }
 // ConnectionsSinceBoot returns the total number of
 // client connections since boot.
 func (t *Tracker) ConnectionsSinceBoot() int64 {
 	return t.connectionsSinceBoot.Load()
 }
 // SessionsSinceBoot returns the total number of sessions
 // created since boot.
 func (t *Tracker) SessionsSinceBoot() int64 {
 	return t.sessionsSinceBoot.Load()
 }
 // MessagesSinceBoot returns the total number of
 // PRIVMSG/NOTICE messages sent since boot.
 func (t *Tracker) MessagesSinceBoot() int64 {
 	return t.messagesSinceBoot.Load()
 }
--- a/internal/stats/stats_test.go
+++ b/internal/stats/stats_test.go
@@ -0,0 +1,117 @@
 package stats_test
 import (
 	"testing"
 	"git.eeqj.de/sneak/neoirc/internal/stats"
 )
 func TestNew(t *testing.T) {
 	t.Parallel()
 	tracker := stats.New()
 	if tracker == nil {
 		t.Fatal("expected non-nil tracker")
 	}
 	if tracker.ConnectionsSinceBoot() != 0 {
 		t.Errorf(
 			"expected 0 connections, got %d",
 			tracker.ConnectionsSinceBoot(),
 		)
 	}
 	if tracker.SessionsSinceBoot() != 0 {
 		t.Errorf(
 			"expected 0 sessions, got %d",
 			tracker.SessionsSinceBoot(),
 		)
 	}
 	if tracker.MessagesSinceBoot() != 0 {
 		t.Errorf(
 			"expected 0 messages, got %d",
 			tracker.MessagesSinceBoot(),
 		)
 	}
 }
 func TestIncrConnections(t *testing.T) {
 	t.Parallel()
 	tracker := stats.New()
 	tracker.IncrConnections()
 	tracker.IncrConnections()
 	tracker.IncrConnections()
 	got := tracker.ConnectionsSinceBoot()
 	if got != 3 {
 		t.Errorf(
 			"expected 3 connections, got %d", got,
 		)
 	}
 }
 func TestIncrSessions(t *testing.T) {
 	t.Parallel()
 	tracker := stats.New()
 	tracker.IncrSessions()
 	tracker.IncrSessions()
 	got := tracker.SessionsSinceBoot()
 	if got != 2 {
 		t.Errorf(
 			"expected 2 sessions, got %d", got,
 		)
 	}
 }
 func TestIncrMessages(t *testing.T) {
 	t.Parallel()
 	tracker := stats.New()
 	tracker.IncrMessages()
 	got := tracker.MessagesSinceBoot()
 	if got != 1 {
 		t.Errorf(
 			"expected 1 message, got %d", got,
 		)
 	}
 }
 func TestCountersAreIndependent(t *testing.T) {
 	t.Parallel()
 	tracker := stats.New()
 	tracker.IncrConnections()
 	tracker.IncrSessions()
 	tracker.IncrMessages()
 	tracker.IncrMessages()
 	if tracker.ConnectionsSinceBoot() != 1 {
 		t.Errorf(
 			"expected 1 connection, got %d",
 			tracker.ConnectionsSinceBoot(),
 		)
 	}
 	if tracker.SessionsSinceBoot() != 1 {
 		t.Errorf(
 			"expected 1 session, got %d",
 			tracker.SessionsSinceBoot(),
 		)
 	}
 	if tracker.MessagesSinceBoot() != 2 {
 		t.Errorf(
 			"expected 2 messages, got %d",
 			tracker.MessagesSinceBoot(),
 		)
 	}
 }
--- a/internal/irc/commands.go
+++ b/internal/irc/commands.go
@@ -2,7 +2,10 @@ package irc
 // IRC command names (RFC 1459 / RFC 2812).
 const (
 	CmdAway    = "AWAY"
 	CmdInvite  = "INVITE"
 	CmdJoin    = "JOIN"
 	CmdKick    = "KICK"
 	CmdList    = "LIST"
 	CmdLusers  = "LUSERS"
 	CmdMode    = "MODE"
@@ -10,6 +13,8 @@ const (
 	CmdNames   = "NAMES"
 	CmdNick    = "NICK"
 	CmdNotice  = "NOTICE"
 	CmdOper    = "OPER"
 	CmdPass    = "PASS"
 	CmdPart    = "PART"
 	CmdPing    = "PING"
 	CmdPong    = "PONG"
--- a/pkg/irc/numerics.go
+++ b/pkg/irc/numerics.go
@@ -0,0 +1,393 @@
 // Package irc provides constants and utilities for the
 // IRC protocol, including numeric reply codes from
 // RFC 1459 and RFC 2812, and standard command names.
 package irc
 import (
 	"errors"
 	"fmt"
 )
 // IRCMessageType represents an IRC numeric reply or error code.
 type IRCMessageType int //nolint:revive // Name requested by project owner.
 // Name returns the standard IRC name for this numeric code
 // (e.g., IRCMessageType(252).Name() returns "RPL_LUSEROP").
 // Returns an empty string if the code is unknown.
 func (t IRCMessageType) Name() string {
 	return names[t]
 }
 // String returns the name and numeric code in angle brackets
 // (e.g., IRCMessageType(252).String() returns "RPL_LUSEROP <252>").
 // If the code is unknown, returns "UNKNOWN <NNN>".
 func (t IRCMessageType) String() string {
 	n := names[t]
 	if n == "" {
 		n = "UNKNOWN"
 	}
 	return fmt.Sprintf("%s <%03d>", n, int(t))
 }
 // Code returns the three-digit zero-padded string representation
 // of the numeric code (e.g., IRCMessageType(252).Code() returns "252").
 func (t IRCMessageType) Code() string {
 	return fmt.Sprintf("%03d", int(t))
 }
 // Int returns the bare integer value of the numeric code.
 func (t IRCMessageType) Int() int {
 	return int(t)
 }
 // ErrUnknownNumeric is returned by FromInt when the numeric code is not recognized.
 var ErrUnknownNumeric = errors.New("unknown IRC numeric code")
 // FromInt converts an integer to an IRCMessageType, returning an error
 // if the numeric code is not a known IRC reply or error code.
 func FromInt(n int) (IRCMessageType, error) {
 	t := IRCMessageType(n)
 	if _, ok := names[t]; !ok {
 		return 0, fmt.Errorf("%w: %d", ErrUnknownNumeric, n)
 	}
 	return t, nil
 }
 // Connection registration replies (001-005).
 const (
 	RplWelcome  IRCMessageType = 1
 	RplYourHost IRCMessageType = 2
 	RplCreated  IRCMessageType = 3
 	RplMyInfo   IRCMessageType = 4
 	RplBounce   IRCMessageType = 5 // RFC 2812; also known as RPL_ISUPPORT in practice
 	RplIsupport IRCMessageType = 5 // De-facto standard (same numeric as RplBounce)
 )
 // Command responses (200-399).
 const (
 	// RFC 2812 trace/stats/links replies (200-219).
 	RplTraceLink       IRCMessageType = 200
 	RplTraceConnecting IRCMessageType = 201
 	RplTraceHandshake  IRCMessageType = 202
 	RplTraceUnknown    IRCMessageType = 203
 	RplTraceOperator   IRCMessageType = 204
 	RplTraceUser       IRCMessageType = 205
 	RplTraceServer     IRCMessageType = 206
 	RplTraceService    IRCMessageType = 207
 	RplTraceNewType    IRCMessageType = 208
 	RplTraceClass      IRCMessageType = 209
 	RplStatsLinkInfo   IRCMessageType = 211
 	RplStatsCommands   IRCMessageType = 212
 	RplStatsCLine      IRCMessageType = 213
 	RplStatsNLine      IRCMessageType = 214
 	RplStatsILine      IRCMessageType = 215
 	RplStatsKLine      IRCMessageType = 216
 	RplStatsQLine      IRCMessageType = 217
 	RplStatsYLine      IRCMessageType = 218
 	RplEndOfStats      IRCMessageType = 219
 	RplUmodeIs      IRCMessageType = 221
 	RplServList     IRCMessageType = 234
 	RplServListEnd  IRCMessageType = 235
 	RplStatsLLine   IRCMessageType = 241
 	RplStatsUptime  IRCMessageType = 242
 	RplStatsOLine   IRCMessageType = 243
 	RplStatsHLine   IRCMessageType = 244
 	RplLuserClient  IRCMessageType = 251
 	RplLuserOp      IRCMessageType = 252
 	RplLuserUnknown IRCMessageType = 253
 	RplLuserChannels IRCMessageType = 254
 	RplLuserMe       IRCMessageType = 255
 	RplAdminMe       IRCMessageType = 256
 	RplAdminLoc1     IRCMessageType = 257
 	RplAdminLoc2     IRCMessageType = 258
 	RplAdminEmail    IRCMessageType = 259
 	RplTraceLog      IRCMessageType = 261
 	RplTraceEnd      IRCMessageType = 262
 	RplTryAgain      IRCMessageType = 263
 	RplAway          IRCMessageType = 301
 	RplUserHost      IRCMessageType = 302
 	RplIson          IRCMessageType = 303
 	RplUnaway        IRCMessageType = 305
 	RplNowAway       IRCMessageType = 306
 	RplWhoisUser     IRCMessageType = 311
 	RplWhoisServer   IRCMessageType = 312
 	RplWhoisOperator IRCMessageType = 313
 	RplWhoWasUser    IRCMessageType = 314
 	RplEndOfWho      IRCMessageType = 315
 	RplWhoisIdle     IRCMessageType = 317
 	RplEndOfWhois    IRCMessageType = 318
 	RplWhoisChannels IRCMessageType = 319
 	RplListStart     IRCMessageType = 321
 	RplList          IRCMessageType = 322
 	RplListEnd       IRCMessageType = 323
 	RplChannelModeIs IRCMessageType = 324
 	RplUniqOpIs        IRCMessageType = 325
 	RplCreationTime    IRCMessageType = 329
 	RplNoTopic         IRCMessageType = 331
 	RplTopic           IRCMessageType = 332
 	RplTopicWhoTime    IRCMessageType = 333
 	RplWhoisActually   IRCMessageType = 338
 	RplInviting        IRCMessageType = 341
 	RplSummoning       IRCMessageType = 342
 	RplInviteList      IRCMessageType = 346
 	RplEndOfInviteList IRCMessageType = 347
 	RplExceptList      IRCMessageType = 348
 	RplEndOfExceptList IRCMessageType = 349
 	RplVersion         IRCMessageType = 351
 	RplWhoReply        IRCMessageType = 352
 	RplNamReply        IRCMessageType = 353
 	RplLinks           IRCMessageType = 364
 	RplEndOfLinks      IRCMessageType = 365
 	RplEndOfNames      IRCMessageType = 366
 	RplBanList         IRCMessageType = 367
 	RplEndOfBanList    IRCMessageType = 368
 	RplEndOfWhowas     IRCMessageType = 369
 	RplInfo            IRCMessageType = 371
 	RplMotd            IRCMessageType = 372
 	RplEndOfInfo       IRCMessageType = 374
 	RplMotdStart       IRCMessageType = 375
 	RplEndOfMotd       IRCMessageType = 376
 	RplYoureOper       IRCMessageType = 381
 	RplRehashing       IRCMessageType = 382
 	RplYoureService    IRCMessageType = 383
 	RplTime            IRCMessageType = 391
 	RplUsersStart      IRCMessageType = 392
 	RplUsers           IRCMessageType = 393
 	RplEndOfUsers      IRCMessageType = 394
 	RplNoUsers         IRCMessageType = 395
 )
 // Error replies (400-599).
 const (
 	ErrNoSuchNick       IRCMessageType = 401
 	ErrNoSuchServer     IRCMessageType = 402
 	ErrNoSuchChannel    IRCMessageType = 403
 	ErrCannotSendToChan IRCMessageType = 404
 	ErrTooManyChannels  IRCMessageType = 405
 	ErrWasNoSuchNick    IRCMessageType = 406
 	ErrTooManyTargets   IRCMessageType = 407
 	ErrNoSuchService    IRCMessageType = 408
 	ErrNoOrigin         IRCMessageType = 409
 	ErrNoRecipient      IRCMessageType = 411
 	ErrNoTextToSend     IRCMessageType = 412
 	ErrNoTopLevel       IRCMessageType = 413
 	ErrWildTopLevel     IRCMessageType = 414
 	ErrBadMask          IRCMessageType = 415
 	ErrUnknownCommand   IRCMessageType = 421
 	ErrNoMotd           IRCMessageType = 422
 	ErrNoAdminInfo      IRCMessageType = 423
 	ErrFileError        IRCMessageType = 424
 	ErrNoNicknameGiven  IRCMessageType = 431
 	ErrErroneusNickname IRCMessageType = 432
 	ErrNicknameInUse    IRCMessageType = 433
 	ErrNickCollision    IRCMessageType = 436
 	ErrUnavailResource  IRCMessageType = 437
 	ErrUserNotInChannel  IRCMessageType = 441
 	ErrNotOnChannel      IRCMessageType = 442
 	ErrUserOnChannel     IRCMessageType = 443
 	ErrNoLogin           IRCMessageType = 444
 	ErrSummonDisabled    IRCMessageType = 445
 	ErrUsersDisabled     IRCMessageType = 446
 	ErrNotRegistered     IRCMessageType = 451
 	ErrNeedMoreParams    IRCMessageType = 461
 	ErrAlreadyRegistered IRCMessageType = 462
 	ErrNoPermForHost     IRCMessageType = 463
 	ErrPasswdMismatch    IRCMessageType = 464
 	ErrYoureBannedCreep  IRCMessageType = 465
 	ErrYouWillBeBanned   IRCMessageType = 466
 	ErrKeySet            IRCMessageType = 467
 	ErrChannelIsFull     IRCMessageType = 471
 	ErrUnknownMode       IRCMessageType = 472
 	ErrInviteOnlyChan    IRCMessageType = 473
 	ErrBannedFromChan    IRCMessageType = 474
 	ErrBadChannelKey     IRCMessageType = 475
 	ErrBadChanMask       IRCMessageType = 476
 	ErrNoChanModes       IRCMessageType = 477
 	ErrBanListFull       IRCMessageType = 478
 	ErrNoPrivileges      IRCMessageType = 481
 	ErrChanOpPrivsNeeded IRCMessageType = 482
 	ErrCantKillServer    IRCMessageType = 483
 	ErrRestricted        IRCMessageType = 484
 	ErrUniqOpPrivsNeeded IRCMessageType = 485
 	ErrNoOperHost        IRCMessageType = 491
 	ErrUmodeUnknownFlag IRCMessageType = 501
 	ErrUsersDoNotMatch  IRCMessageType = 502
 )
 // names maps numeric codes to their standard IRC names.
 //
 //nolint:gochecknoglobals
 var names = map[IRCMessageType]string{
 	RplWelcome:  "RPL_WELCOME",
 	RplYourHost: "RPL_YOURHOST",
 	RplCreated:  "RPL_CREATED",
 	RplMyInfo:   "RPL_MYINFO",
 	RplBounce:   "RPL_BOUNCE",
 	RplTraceLink:       "RPL_TRACELINK",
 	RplTraceConnecting: "RPL_TRACECONNECTING",
 	RplTraceHandshake:  "RPL_TRACEHANDSHAKE",
 	RplTraceUnknown:    "RPL_TRACEUNKNOWN",
 	RplTraceOperator:   "RPL_TRACEOPERATOR",
 	RplTraceUser:       "RPL_TRACEUSER",
 	RplTraceServer:     "RPL_TRACESERVER",
 	RplTraceService:    "RPL_TRACESERVICE",
 	RplTraceNewType:    "RPL_TRACENEWTYPE",
 	RplTraceClass:      "RPL_TRACECLASS",
 	RplStatsLinkInfo:   "RPL_STATSLINKINFO",
 	RplStatsCommands:   "RPL_STATSCOMMANDS",
 	RplStatsCLine:      "RPL_STATSCLINE",
 	RplStatsNLine:      "RPL_STATSNLINE",
 	RplStatsILine:      "RPL_STATSILINE",
 	RplStatsKLine:      "RPL_STATSKLINE",
 	RplStatsQLine:      "RPL_STATSQLINE",
 	RplStatsYLine:      "RPL_STATSYLINE",
 	RplEndOfStats:      "RPL_ENDOFSTATS",
 	RplUmodeIs:      "RPL_UMODEIS",
 	RplServList:     "RPL_SERVLIST",
 	RplServListEnd:  "RPL_SERVLISTEND",
 	RplStatsLLine:   "RPL_STATSLLINE",
 	RplStatsUptime:  "RPL_STATSUPTIME",
 	RplStatsOLine:   "RPL_STATSOLINE",
 	RplStatsHLine:   "RPL_STATSHLINE",
 	RplLuserClient:  "RPL_LUSERCLIENT",
 	RplLuserOp:      "RPL_LUSEROP",
 	RplLuserUnknown: "RPL_LUSERUNKNOWN",
 	RplLuserChannels: "RPL_LUSERCHANNELS",
 	RplLuserMe:       "RPL_LUSERME",
 	RplAdminMe:       "RPL_ADMINME",
 	RplAdminLoc1:     "RPL_ADMINLOC1",
 	RplAdminLoc2:     "RPL_ADMINLOC2",
 	RplAdminEmail:    "RPL_ADMINEMAIL",
 	RplTraceLog:      "RPL_TRACELOG",
 	RplTraceEnd:      "RPL_TRACEEND",
 	RplTryAgain:      "RPL_TRYAGAIN",
 	RplAway:          "RPL_AWAY",
 	RplUserHost:      "RPL_USERHOST",
 	RplIson:          "RPL_ISON",
 	RplUnaway:        "RPL_UNAWAY",
 	RplNowAway:       "RPL_NOWAWAY",
 	RplWhoisUser:     "RPL_WHOISUSER",
 	RplWhoisServer:   "RPL_WHOISSERVER",
 	RplWhoisOperator: "RPL_WHOISOPERATOR",
 	RplWhoWasUser:    "RPL_WHOWASUSER",
 	RplEndOfWho:      "RPL_ENDOFWHO",
 	RplWhoisIdle:     "RPL_WHOISIDLE",
 	RplEndOfWhois:    "RPL_ENDOFWHOIS",
 	RplWhoisChannels: "RPL_WHOISCHANNELS",
 	RplListStart:     "RPL_LISTSTART",
 	RplList:          "RPL_LIST",
 	RplListEnd:       "RPL_LISTEND", //nolint:misspell
 	RplChannelModeIs: "RPL_CHANNELMODEIS",
 	RplUniqOpIs:        "RPL_UNIQOPIS",
 	RplCreationTime:    "RPL_CREATIONTIME",
 	RplNoTopic:         "RPL_NOTOPIC",
 	RplTopic:           "RPL_TOPIC",
 	RplTopicWhoTime:    "RPL_TOPICWHOTIME",
 	RplWhoisActually:   "RPL_WHOISACTUALLY",
 	RplInviting:        "RPL_INVITING",
 	RplSummoning:       "RPL_SUMMONING",
 	RplInviteList:      "RPL_INVITELIST",
 	RplEndOfInviteList: "RPL_ENDOFINVITELIST",
 	RplExceptList:      "RPL_EXCEPTLIST",
 	RplEndOfExceptList: "RPL_ENDOFEXCEPTLIST",
 	RplVersion:         "RPL_VERSION",
 	RplWhoReply:        "RPL_WHOREPLY",
 	RplNamReply:        "RPL_NAMREPLY",
 	RplLinks:           "RPL_LINKS",
 	RplEndOfLinks:      "RPL_ENDOFLINKS",
 	RplEndOfNames:      "RPL_ENDOFNAMES",
 	RplBanList:         "RPL_BANLIST",
 	RplEndOfBanList:    "RPL_ENDOFBANLIST",
 	RplEndOfWhowas:     "RPL_ENDOFWHOWAS",
 	RplInfo:            "RPL_INFO",
 	RplMotd:            "RPL_MOTD",
 	RplEndOfInfo:       "RPL_ENDOFINFO",
 	RplMotdStart:       "RPL_MOTDSTART",
 	RplEndOfMotd:       "RPL_ENDOFMOTD",
 	RplYoureOper:       "RPL_YOUREOPER",
 	RplRehashing:       "RPL_REHASHING",
 	RplYoureService:    "RPL_YOURESERVICE",
 	RplTime:            "RPL_TIME",
 	RplUsersStart:      "RPL_USERSSTART",
 	RplUsers:           "RPL_USERS",
 	RplEndOfUsers:      "RPL_ENDOFUSERS",
 	RplNoUsers:         "RPL_NOUSERS",
 	ErrNoSuchNick:       "ERR_NOSUCHNICK",
 	ErrNoSuchServer:     "ERR_NOSUCHSERVER",
 	ErrNoSuchChannel:    "ERR_NOSUCHCHANNEL",
 	ErrCannotSendToChan: "ERR_CANNOTSENDTOCHAN",
 	ErrTooManyChannels:  "ERR_TOOMANYCHANNELS",
 	ErrWasNoSuchNick:    "ERR_WASNOSUCHNICK",
 	ErrTooManyTargets:   "ERR_TOOMANYTARGETS",
 	ErrNoSuchService:    "ERR_NOSUCHSERVICE",
 	ErrNoOrigin:         "ERR_NOORIGIN",
 	ErrNoRecipient:      "ERR_NORECIPIENT",
 	ErrNoTextToSend:     "ERR_NOTEXTTOSEND",
 	ErrNoTopLevel:       "ERR_NOTOPLEVEL",
 	ErrWildTopLevel:     "ERR_WILDTOPLEVEL",
 	ErrBadMask:          "ERR_BADMASK",
 	ErrUnknownCommand:   "ERR_UNKNOWNCOMMAND",
 	ErrNoMotd:           "ERR_NOMOTD",
 	ErrNoAdminInfo:      "ERR_NOADMININFO",
 	ErrFileError:        "ERR_FILEERROR",
 	ErrNoNicknameGiven:  "ERR_NONICKNAMEGIVEN",
 	ErrErroneusNickname: "ERR_ERRONEUSNICKNAME",
 	ErrNicknameInUse:    "ERR_NICKNAMEINUSE",
 	ErrNickCollision:    "ERR_NICKCOLLISION",
 	ErrUnavailResource:  "ERR_UNAVAILRESOURCE",
 	ErrUserNotInChannel:  "ERR_USERNOTINCHANNEL",
 	ErrNotOnChannel:      "ERR_NOTONCHANNEL",
 	ErrUserOnChannel:     "ERR_USERONCHANNEL",
 	ErrNoLogin:           "ERR_NOLOGIN",
 	ErrSummonDisabled:    "ERR_SUMMONDISABLED",
 	ErrUsersDisabled:     "ERR_USERSDISABLED",
 	ErrNotRegistered:     "ERR_NOTREGISTERED",
 	ErrNeedMoreParams:    "ERR_NEEDMOREPARAMS",
 	ErrAlreadyRegistered: "ERR_ALREADYREGISTERED",
 	ErrNoPermForHost:     "ERR_NOPERMFORHOST",
 	ErrPasswdMismatch:    "ERR_PASSWDMISMATCH",
 	ErrYoureBannedCreep:  "ERR_YOUREBANNEDCREEP",
 	ErrYouWillBeBanned:   "ERR_YOUWILLBEBANNED",
 	ErrKeySet:            "ERR_KEYSET",
 	ErrChannelIsFull:     "ERR_CHANNELISFULL",
 	ErrUnknownMode:       "ERR_UNKNOWNMODE",
 	ErrInviteOnlyChan:    "ERR_INVITEONLYCHAN",
 	ErrBannedFromChan:    "ERR_BANNEDFROMCHAN",
 	ErrBadChannelKey:     "ERR_BADCHANNELKEY",
 	ErrBadChanMask:       "ERR_BADCHANMASK",
 	ErrNoChanModes:       "ERR_NOCHANMODES",
 	ErrBanListFull:       "ERR_BANLISTFULL",
 	ErrNoPrivileges:      "ERR_NOPRIVILEGES",
 	ErrChanOpPrivsNeeded: "ERR_CHANOPRIVSNEEDED",
 	ErrCantKillServer:    "ERR_CANTKILLSERVER",
 	ErrRestricted:        "ERR_RESTRICTED",
 	ErrUniqOpPrivsNeeded: "ERR_UNIQOPPRIVSNEEDED",
 	ErrNoOperHost:        "ERR_NOOPERHOST",
 	ErrUmodeUnknownFlag: "ERR_UMODEUNKNOWNFLAG",
 	ErrUsersDoNotMatch:  "ERR_USERSDONTMATCH",
 }
 // Name returns the standard IRC name for a numeric code
 // (e.g., Name(2) returns "RPL_YOURHOST"). Returns an
 // empty string if the code is unknown.
 //
 // Deprecated: Use IRCMessageType.Name() instead.
 func Name(code IRCMessageType) string {
 	return names[code]
 }
--- a/pkg/irc/numerics_test.go
+++ b/pkg/irc/numerics_test.go
@@ -0,0 +1,163 @@
 package irc_test
 import (
 	"errors"
 	"testing"
 	"git.eeqj.de/sneak/neoirc/pkg/irc"
 )
 func TestName(t *testing.T) {
 	t.Parallel()
 	tests := []struct {
 		numeric irc.IRCMessageType
 		want    string
 	}{
 		{irc.RplWelcome, "RPL_WELCOME"},
 		{irc.RplBounce, "RPL_BOUNCE"},
 		{irc.RplLuserOp, "RPL_LUSEROP"},
 		{irc.ErrCannotSendToChan, "ERR_CANNOTSENDTOCHAN"},
 		{irc.ErrNicknameInUse, "ERR_NICKNAMEINUSE"},
 	}
 	for _, tc := range tests {
 		if got := tc.numeric.Name(); got != tc.want {
 			t.Errorf("IRCMessageType(%d).Name() = %q, want %q", tc.numeric.Int(), got, tc.want)
 		}
 	}
 }
 func TestString(t *testing.T) {
 	t.Parallel()
 	tests := []struct {
 		numeric irc.IRCMessageType
 		want    string
 	}{
 		{irc.RplWelcome, "RPL_WELCOME <001>"},
 		{irc.RplBounce, "RPL_BOUNCE <005>"},
 		{irc.RplLuserOp, "RPL_LUSEROP <252>"},
 		{irc.ErrCannotSendToChan, "ERR_CANNOTSENDTOCHAN <404>"},
 	}
 	for _, tc := range tests {
 		if got := tc.numeric.String(); got != tc.want {
 			t.Errorf("IRCMessageType(%d).String() = %q, want %q", tc.numeric.Int(), got, tc.want)
 		}
 	}
 }
 func TestCode(t *testing.T) {
 	t.Parallel()
 	tests := []struct {
 		numeric irc.IRCMessageType
 		want    string
 	}{
 		{irc.RplWelcome, "001"},
 		{irc.RplBounce, "005"},
 		{irc.RplLuserOp, "252"},
 		{irc.ErrCannotSendToChan, "404"},
 	}
 	for _, tc := range tests {
 		if got := tc.numeric.Code(); got != tc.want {
 			t.Errorf("IRCMessageType(%d).Code() = %q, want %q", tc.numeric.Int(), got, tc.want)
 		}
 	}
 }
 func TestInt(t *testing.T) {
 	t.Parallel()
 	tests := []struct {
 		numeric irc.IRCMessageType
 		want    int
 	}{
 		{irc.RplWelcome, 1},
 		{irc.RplBounce, 5},
 		{irc.RplLuserOp, 252},
 		{irc.ErrCannotSendToChan, 404},
 	}
 	for _, tc := range tests {
 		if got := tc.numeric.Int(); got != tc.want {
 			t.Errorf("IRCMessageType(%d).Int() = %d, want %d", tc.want, got, tc.want)
 		}
 	}
 }
 func TestFromInt_Known(t *testing.T) {
 	t.Parallel()
 	tests := []struct {
 		code int
 		want irc.IRCMessageType
 	}{
 		{1, irc.RplWelcome},
 		{5, irc.RplBounce},
 		{252, irc.RplLuserOp},
 		{404, irc.ErrCannotSendToChan},
 		{433, irc.ErrNicknameInUse},
 	}
 	for _, test := range tests {
 		got, err := irc.FromInt(test.code)
 		if err != nil {
 			t.Errorf("FromInt(%d) returned unexpected error: %v", test.code, err)
 			continue
 		}
 		if got != test.want {
 			t.Errorf("FromInt(%d) = %v, want %v", test.code, got, test.want)
 		}
 	}
 }
 func TestFromInt_Unknown(t *testing.T) {
 	t.Parallel()
 	unknowns := []int{0, 999, 600, -1}
 	for _, code := range unknowns {
 		_, err := irc.FromInt(code)
 		if err == nil {
 			t.Errorf("FromInt(%d) expected error, got nil", code)
 			continue
 		}
 		if !errors.Is(err, irc.ErrUnknownNumeric) {
 			t.Errorf("FromInt(%d) error = %v, want ErrUnknownNumeric", code, err)
 		}
 	}
 }
 func TestUnknownNumeric_Name(t *testing.T) {
 	t.Parallel()
 	unknown := irc.IRCMessageType(999)
 	if got := unknown.Name(); got != "" {
 		t.Errorf("IRCMessageType(999).Name() = %q, want empty string", got)
 	}
 }
 func TestUnknownNumeric_String(t *testing.T) {
 	t.Parallel()
 	unknown := irc.IRCMessageType(999)
 	want := "UNKNOWN <999>"
 	if got := unknown.String(); got != want {
 		t.Errorf("IRCMessageType(999).String() = %q, want %q", got, want)
 	}
 }
 func TestDeprecatedNameFunc(t *testing.T) {
 	t.Parallel()
 	if got := irc.Name(irc.RplYourHost); got != "RPL_YOURHOST" {
 		t.Errorf("Name(RplYourHost) = %q, want %q", got, "RPL_YOURHOST")
 	}
 }
--- a/web/src/app.jsx
+++ b/web/src/app.jsx
@@ -8,6 +8,56 @@ const MEMBER_REFRESH_INTERVAL = 10000;
 const ACTION_PREFIX = "\x01ACTION ";
 const ACTION_SUFFIX = "\x01";
 // Hashcash proof-of-work helpers using Web Crypto API.
 function checkLeadingZeros(hashBytes, bits) {
  let count = 0;
  for (let i = 0; i < hashBytes.length; i++) {
    if (hashBytes[i] === 0) {
      count += 8;
      continue;
    }
    let b = hashBytes[i];
    while ((b & 0x80) === 0) {
      count++;
      b <<= 1;
    }
    break;
  }
  return count >= bits;
 }
 async function mintHashcash(bits, resource) {
  const encoder = new TextEncoder();
  const now = new Date();
  const date =
    String(now.getUTCFullYear()).slice(2) +
    String(now.getUTCMonth() + 1).padStart(2, "0") +
    String(now.getUTCDate()).padStart(2, "0");
  const prefix = `1:${bits}:${date}:${resource}::`;
  let nonce = Math.floor(Math.random() * 0x100000);
  const batchSize = 1024;
  for (;;) {
    const stamps = [];
    const hashPromises = [];
    for (let i = 0; i < batchSize; i++) {
      const stamp = prefix + (nonce + i).toString(16);
      stamps.push(stamp);
      hashPromises.push(
        crypto.subtle.digest("SHA-256", encoder.encode(stamp)),
      );
    }
    const hashes = await Promise.all(hashPromises);
    for (let i = 0; i < hashes.length; i++) {
      if (checkLeadingZeros(new Uint8Array(hashes[i]), bits)) {
        return stamps[i];
      }
    }
    nonce += batchSize;
  }
 }
 function api(path, opts = {}) {
  const token = localStorage.getItem("neoirc_token");
  const headers = {
@@ -60,12 +110,16 @@ function LoginScreen({ onLogin }) {
  const [motd, setMotd] = useState("");
  const [serverName, setServerName] = useState("NeoIRC");
  const inputRef = useRef();
  const hashcashBitsRef = useRef(0);
  const hashcashResourceRef = useRef("neoirc");
  useEffect(() => {
    api("/server")
      .then((s) => {
        if (s.name) setServerName(s.name);
        if (s.motd) setMotd(s.motd);
        hashcashBitsRef.current = s.hashcash_bits || 0;
        if (s.name) hashcashResourceRef.current = s.name;
      })
      .catch(() => {});
    const saved = localStorage.getItem("neoirc_token");
@@ -81,9 +135,22 @@ function LoginScreen({ onLogin }) {
    e.preventDefault();
    setError("");
    try {
      let hashcashStamp = "";
      if (hashcashBitsRef.current > 0) {
        setError("Computing proof-of-work...");
        hashcashStamp = await mintHashcash(
          hashcashBitsRef.current,
          hashcashResourceRef.current,
        );
        setError("");
      }
      const reqBody = { nick: nick.trim() };
      if (hashcashStamp) {
        reqBody.pow_token = hashcashStamp;
      }
      const res = await api("/session", {
        method: "POST",
-        body: JSON.stringify({ nick: nick.trim() }),
+        body: JSON.stringify(reqBody),
      });
      localStorage.setItem("neoirc_token", res.token);
      onLogin(res.nick);