feat: add session idle timeout cleanup goroutine

- Periodic cleanup loop deletes stale clients based on SESSION_IDLE_TIMEOUT - Orphaned sessions (no clients) are cleaned up automatically - last_seen already updated on each authenticated request via GetSessionByToken
feat: add SESSION_IDLE_TIMEOUT config
2026-02-27 05:06:56 -08:00 · 2026-02-27 05:06:56 -08:00 · 2026-02-27 05:06:56 -08:00
68 changed files with 1039 additions and 3001 deletions
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,8 +1,8 @@
 .git
 *.md
 !README.md
-neoircd
-neoirc-cli
+chatd
+chat-cli
 data.db
 data.db-wal
 data.db-shm
--- a/.gitignore
+++ b/.gitignore
@@ -21,7 +21,7 @@ node_modules/
 *.key

 # Build artifacts
-/neoircd
+/chatd
 /bin/
 *.exe
 *.dll
@@ -34,5 +34,5 @@ vendor/
 # Project
 data.db
 debug.log
-/neoirc-cli
+/chat-cli
 web/node_modules/
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -5,7 +5,7 @@
 1. **Format**: `gofmt -s -w .` and `goimports -w .`
 2. **Lint**: `golangci-lint run --config .golangci.yml ./...` — zero issues
 3. **Test**: `go test -race ./...` — all passing
-4. **Build**: `go build ./cmd/neoircd` — compiles clean
+4. **Build**: `go build ./cmd/chatd` — compiles clean

 No commit lands on main with lint errors, test failures, or formatting issues.

--- a/33
+++ b/33
@@ -1,45 +1,32 @@
-# Lint stage — fast feedback on formatting and lint issues
-# golangci/golangci-lint:v2.1.6, 2026-03-02
-FROM golangci/golangci-lint@sha256:568ee1c1c53493575fa9494e280e579ac9ca865787bafe4df3023ae59ecf299b AS lint
-WORKDIR /src
-COPY go.mod go.sum ./
-RUN go mod download
-COPY . .
-RUN make fmt-check
-RUN make lint
-
-# Build stage
 # golang:1.24-alpine, 2026-02-26
 FROM golang@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e09064ed54cfd245b7191 AS builder
 WORKDIR /src
 RUN apk add --no-cache git build-base make

-# Force BuildKit to run the lint stage before proceeding
-COPY --from=lint /src/go.sum /dev/null
+# golangci-lint v2.1.6 (eabc2638a66d), 2026-02-26
+RUN CGO_ENABLED=0 go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@eabc2638a66daf5bb6c6fb052a32fa3ef7b6600d

 COPY go.mod go.sum ./
 RUN go mod download

 COPY . .

-RUN make test
+# Run all checks — build fails if branch is not green
+RUN make check

 # Build static binaries (no cgo needed at runtime — modernc.org/sqlite is pure Go)
 ARG VERSION=dev
-RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -X main.Version=${VERSION}" -o /neoircd ./cmd/neoircd/
-RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /neoirc-cli ./cmd/neoirc-cli/
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w -X main.Version=${VERSION}" -o /chatd ./cmd/chatd/
+RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /chat-cli ./cmd/chat-cli/

-# Runtime stage
 # alpine:3.21, 2026-02-26
 FROM alpine@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
 RUN apk add --no-cache ca-certificates \
-    && addgroup -S neoirc && adduser -S neoirc -G neoirc \
-    && mkdir -p /var/lib/neoirc \
-    && chown neoirc:neoirc /var/lib/neoirc
-COPY --from=builder /neoircd /usr/local/bin/neoircd
+    && addgroup -S chat && adduser -S chat -G chat
+COPY --from=builder /chatd /usr/local/bin/chatd

-USER neoirc
+USER chat
 EXPOSE 8080
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
    CMD wget -qO- http://localhost:8080/.well-known/healthcheck.json || exit 1
-ENTRYPOINT ["neoircd"]
+ENTRYPOINT ["chatd"]
--- a/10
+++ b/10
@@ -1,6 +1,6 @@
 .PHONY: all build lint fmt fmt-check test check clean run debug docker hooks

-BINARY := neoircd
+BINARY := chatd
 VERSION := $(shell git describe --tags --always --dirty 2>/dev/null || echo "dev")
 BUILDARCH := $(shell go env GOARCH)
 LDFLAGS := -X main.Version=$(VERSION) -X main.Buildarch=$(BUILDARCH)
@@ -8,7 +8,7 @@ LDFLAGS := -X main.Version=$(VERSION) -X main.Buildarch=$(BUILDARCH)
 all: check build

 build:
-	go build -ldflags "$(LDFLAGS)" -o bin/$(BINARY) ./cmd/neoircd
+	go build -ldflags "$(LDFLAGS)" -o bin/$(BINARY) ./cmd/chatd

 lint:
 	golangci-lint run --config .golangci.yml ./...
@@ -27,7 +27,7 @@ test:
 # Used by CI and Docker build — fails if anything is wrong
 check: test lint fmt-check
 	@echo "==> Building..."
-	go build -ldflags "$(LDFLAGS)" -o /dev/null ./cmd/neoircd
+	go build -ldflags "$(LDFLAGS)" -o /dev/null ./cmd/chatd
 	@echo "==> All checks passed!"

 run: build
@@ -37,10 +37,10 @@ debug: build
 	DEBUG=1 GOTRACEBACK=all ./bin/$(BINARY)

 clean:
-	rm -rf bin/ neoircd
+	rm -rf bin/ chatd data.db

 docker:
-	docker build -t neoirc .
+	docker build -t chat .

 hooks:
 	@printf '#!/bin/sh\nset -e\n' > .git/hooks/pre-commit
--- a/README.md
+++ b/README.md
@@ -1,9 +1,9 @@
-# neoirc
+# chat

 **IRC semantics, structured message metadata, cryptographic signing, and
 server-held session state with per-client delivery queues. All over HTTP+JSON.**

-An IRC-inspired server written in Go that decouples session state from transport
+A chat server written in Go that decouples session state from transport
 connections, enabling mobile-friendly persistent sessions over plain HTTP.

 The **HTTP API is the primary interface**. It's designed to be simple enough
@@ -44,7 +44,7 @@ IRC is in decline because session state is tied to the TCP connection. In a
 mobile-first world, that's a nonstarter. Not everyone wants to run a bouncer
 or pay for IRCCloud.

-This project builds a server that:
+This project builds a chat server that:

 - Holds session state server-side (message queues, presence, channel membership)
 - Exposes a minimal, clean HTTP+JSON API — easy to build clients against
@@ -132,7 +132,7 @@ makes signing consistent — you sign the same structure you send.

 ### Why not XMPP or Matrix?

-XMPP is XML-based, overengineered for messaging, and the ecosystem is fragmented
+XMPP is XML-based, overengineered for chat, and the ecosystem is fragmented
 across incompatible extensions (XEPs). Matrix is a federated append-only event
 graph with a spec that runs to hundreds of pages. Both are fine protocols, but
 they're solving different problems at different scales.
@@ -828,16 +828,16 @@ the server to the client (never C2S) and use 3-digit string codes in the
 | Code | Name                 | When Sent | Example |
 |------|----------------------|-----------|---------|
 | `001` | RPL_WELCOME         | After session creation | `{"command":"001","to":"alice","body":["Welcome to the network, alice"]}` |
-| `002` | RPL_YOURHOST        | After session creation | `{"command":"002","to":"alice","body":["Your host is neoirc-server, running version 0.1"]}` |
+| `002` | RPL_YOURHOST        | After session creation | `{"command":"002","to":"alice","body":["Your host is chatserver, running version 0.1"]}` |
 | `003` | RPL_CREATED         | After session creation | `{"command":"003","to":"alice","body":["This server was created 2026-02-10"]}` |
-| `004` | RPL_MYINFO          | After session creation | `{"command":"004","to":"alice","params":["neoirc-server","0.1","","imnst"]}` |
-| `322` | RPL_LIST            | In response to LIST | `{"command":"322","to":"alice","params":["#general","5"],"body":["General discussion"]}` |
+| `004` | RPL_MYINFO          | After session creation | `{"command":"004","to":"alice","params":["chatserver","0.1","","imnst"]}` |
+| `322` | RPL_LIST            | In response to LIST | `{"command":"322","to":"alice","params":["#general","5"],"body":["General chat"]}` |
 | `323` | RPL_LISTEND         | End of LIST response | `{"command":"323","to":"alice","body":["End of /LIST"]}` |
 | `332` | RPL_TOPIC           | On JOIN or TOPIC query | `{"command":"332","to":"alice","params":["#general"],"body":["Welcome!"]}` |
 | `353` | RPL_NAMREPLY        | On JOIN or NAMES query | `{"command":"353","to":"alice","params":["=","#general"],"body":["@op1 alice bob +voiced1"]}` |
 | `366` | RPL_ENDOFNAMES      | End of NAMES response | `{"command":"366","to":"alice","params":["#general"],"body":["End of /NAMES list"]}` |
 | `372` | RPL_MOTD            | MOTD line | `{"command":"372","to":"alice","body":["Welcome to the server"]}` |
-| `375` | RPL_MOTDSTART       | Start of MOTD | `{"command":"375","to":"alice","body":["- neoirc-server Message of the Day -"]}` |
+| `375` | RPL_MOTDSTART       | Start of MOTD | `{"command":"375","to":"alice","body":["- chatserver Message of the Day -"]}` |
 | `376` | RPL_ENDOFMOTD       | End of MOTD | `{"command":"376","to":"alice","body":["End of /MOTD command"]}` |
 | `401` | ERR_NOSUCHNICK      | DM to nonexistent nick | `{"command":"401","to":"alice","params":["bob"],"body":["No such nick/channel"]}` |
 | `403` | ERR_NOSUCHCHANNEL   | Action on nonexistent channel | `{"command":"403","to":"alice","params":["#nope"],"body":["No such channel"]}` |
@@ -1158,55 +1158,6 @@ curl -s http://localhost:8080/api/v1/channels/general/members \
  -H "Authorization: Bearer $TOKEN" | jq .
 ```

-### POST /api/v1/logout — Logout
-
-Destroy the current client's auth token. If no other clients remain on the
-session, the user is fully cleaned up: parted from all channels (with QUIT
-broadcast to members), session deleted, nick released.
-
-**Request:** No body. Requires auth.
-
-**Response:** `200 OK`
-```json
-{"status": "ok"}
-```
-
-**Errors:**
-
-| Status | Error | When |
-|--------|-------|------|
-| 401    | `unauthorized` | Missing or invalid auth token |
-
-**curl example:**
-```bash
-curl -s -X POST http://localhost:8080/api/v1/logout \
-  -H "Authorization: Bearer $TOKEN" | jq .
-```
-
-### GET /api/v1/users/me — Current User Info
-
-Return the current user's session state. This is an alias for
-`GET /api/v1/state`.
-
-**Request:** No body. Requires auth.
-
-**Response:** `200 OK`
-```json
-{
-  "id": 1,
-  "nick": "alice",
-  "channels": [
-    {"id": 1, "name": "#general", "topic": "Welcome!"}
-  ]
-}
-```
-
-**curl example:**
-```bash
-curl -s http://localhost:8080/api/v1/users/me \
-  -H "Authorization: Bearer $TOKEN" | jq .
-```
-
 ### GET /api/v1/server — Server Info

 Return server metadata. No authentication required.
@@ -1214,18 +1165,11 @@ Return server metadata. No authentication required.
 **Response:** `200 OK`
 ```json
 {
-  "name": "My NeoIRC Server",
-  "motd": "Welcome! Be nice.",
-  "users": 42
+  "name": "My Chat Server",
+  "motd": "Welcome! Be nice."
 }
 ```

-| Field   | Type    | Description |
-|---------|---------|-------------|
-| `name`  | string  | Server display name |
-| `motd`  | string  | Message of the day |
-| `users` | integer | Number of currently active user sessions |
-
 ### GET /.well-known/healthcheck.json — Health Check

 Standard health check endpoint. No authentication required.
@@ -1468,7 +1412,7 @@ authenticity.

 ## Federation (Server-to-Server)

-Federation allows multiple neoirc servers to link together, forming a network
+Federation allows multiple chat servers to link together, forming a network
 where users on different servers can share channels — similar to IRC server
 linking.

@@ -1628,10 +1572,8 @@ skew issues) and simpler than UUIDs (integer comparison vs. string comparison).
 - **Queue entries**: Stored until pruned. Pruning by `QUEUE_MAX_AGE` is
  planned.
 - **Channels**: Deleted when the last member leaves (ephemeral).
- **Users/sessions**: Deleted on `QUIT` or `POST /api/v1/logout`. Idle
-  sessions are automatically expired after `SESSION_IDLE_TIMEOUT` (default
-  24h) — the server runs a background cleanup loop that parts idle users
-  from all channels, broadcasts QUIT, and releases their nicks.
+- **Users/sessions**: Deleted on `QUIT`. Session expiry by `SESSION_TIMEOUT`
+  is planned.

 ---

@@ -1645,10 +1587,10 @@ directory is also loaded automatically via
 | Variable           | Type    | Default                              | Description |
 |--------------------|---------|--------------------------------------|-------------|
 | `PORT`             | int     | `8080`                               | HTTP listen port |
-| `DBURL`            | string  | `file:///var/lib/neoirc/state.db?_journal_mode=WAL` | SQLite connection string. For file-based: `file:///path/to/db.db?_journal_mode=WAL`. For in-memory (testing): `file::memory:?cache=shared`. |
+| `DBURL`            | string  | `file:./data.db?_journal_mode=WAL`   | SQLite connection string. For file-based: `file:./path.db?_journal_mode=WAL`. For in-memory (testing): `file::memory:?cache=shared`. |
 | `DEBUG`            | bool    | `false`                              | Enable debug logging (verbose request/response logging) |
 | `MAX_HISTORY`      | int     | `10000`                              | Maximum messages retained per channel before rotation (planned) |
-| `SESSION_IDLE_TIMEOUT` | string | `24h`                            | Session idle timeout as a Go duration string (e.g. `24h`, `30m`). Sessions with no activity for this long are expired and the nick is released. |
+| `SESSION_TIMEOUT`  | int     | `86400`                              | Session idle timeout in seconds (planned). Sessions with no activity for this long are expired and the nick is released. |
 | `QUEUE_MAX_AGE`    | int     | `172800`                             | Maximum age of client queue entries in seconds (48h). Entries older than this are pruned (planned). |
 | `MAX_MESSAGE_SIZE` | int     | `4096`                               | Maximum message body size in bytes (planned enforcement) |
 | `LONG_POLL_TIMEOUT`| int     | `15`                                 | Default long-poll timeout in seconds (client can override via query param, server caps at 30) |
@@ -1664,11 +1606,11 @@ directory is also loaded automatically via

 ```bash
 PORT=8080
-SERVER_NAME=My NeoIRC Server
+SERVER_NAME=My Chat Server
 MOTD=Welcome! Be excellent to each other.
 DEBUG=false
-DBURL=file:///var/lib/neoirc/state.db?_journal_mode=WAL
-SESSION_IDLE_TIMEOUT=24h
+DBURL=file:./data.db?_journal_mode=WAL
+SESSION_TIMEOUT=86400
 ```

 ---
@@ -1677,24 +1619,25 @@ SESSION_IDLE_TIMEOUT=24h

 ### Docker (Recommended)

-The Docker image contains a single static binary (`neoircd`) and nothing else.
+The Docker image contains a single static binary (`chatd`) and nothing else.

 ```bash
 # Build
-docker build -t neoirc .
+docker build -t chat .

 # Run
 docker run -p 8080:8080 \
-  -v neoirc-data:/var/lib/neoirc \
+  -v chat-data:/data \
+  -e DBURL="file:/data/chat.db?_journal_mode=WAL" \
  -e SERVER_NAME="My Server" \
  -e MOTD="Welcome!" \
-  neoirc
+  chat
 ```

 The Dockerfile is a multi-stage build:
-1. **Build stage**: Compiles `neoircd` and `neoirc-cli` (CLI built to verify
+1. **Build stage**: Compiles `chatd` and `chat-cli` (CLI built to verify
   compilation, not included in final image)
-2. **Final stage**: Alpine Linux + `neoircd` binary only
+2. **Final stage**: Alpine Linux + `chatd` binary only

 ```dockerfile
 FROM golang:1.24-alpine AS builder
@@ -1703,13 +1646,13 @@ RUN apk add --no-cache make
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-RUN go build -o /neoircd ./cmd/neoircd/
-RUN go build -o /neoirc-cli ./cmd/neoirc-cli/
+RUN go build -o /chatd ./cmd/chatd/
+RUN go build -o /chat-cli ./cmd/chat-cli/

 FROM alpine:latest
-COPY --from=builder /neoircd /usr/local/bin/neoircd
+COPY --from=builder /chatd /usr/local/bin/chatd
 EXPOSE 8080
-CMD ["neoircd"]
+CMD ["chatd"]
 ```

 ### Binary
@@ -1717,11 +1660,11 @@ CMD ["neoircd"]
 ```bash
 # Build from source
 make build
-# Binary at ./bin/neoircd
+# Binary at ./bin/chatd

 # Run
-./bin/neoircd
-# Listens on :8080, writes to /var/lib/neoirc/state.db
+./bin/chatd
+# Listens on :8080, creates ./data.db
 ```

 ### Reverse Proxy (Production)
@@ -1730,7 +1673,7 @@ For production, run behind a TLS-terminating reverse proxy.

 **Caddy:**
 ```
-neoirc.example.com {
+chat.example.com {
    reverse_proxy localhost:8080
 }
 ```
@@ -1739,7 +1682,7 @@ neoirc.example.com {
 ```nginx
 server {
    listen 443 ssl;
-    server_name neoirc.example.com;
+    server_name chat.example.com;

    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
@@ -1762,15 +1705,15 @@ seconds to accommodate long-poll connections.
  string). This allows concurrent reads during writes.
 - **Single writer**: SQLite allows only one writer at a time. For high-traffic
  servers, Postgres support is planned.
- **Backup**: The database is a single file. Back it up with `sqlite3 /var/lib/neoirc/state.db ".backup backup.db"` or just copy the file (safe with WAL mode).
- **Location**: By default, `state.db` is created in `/var/lib/neoirc/`.
+- **Backup**: The database is a single file. Back it up with `sqlite3 data.db ".backup backup.db"` or just copy the file (safe with WAL mode).
+- **Location**: By default, `data.db` is created in the working directory.
  Use the `DBURL` env var to place it elsewhere.

 ---

 ## Client Development Guide

-This section explains how to write a client against the neoirc API. The API is
+This section explains how to write a client against the chat API. The API is
 designed to be simple enough that a basic client can be written in any language
 with an HTTP client library.

@@ -2060,19 +2003,16 @@ GET /api/v1/challenge
 - [x] NICK change with broadcast
 - [x] QUIT with broadcast and cleanup
 - [x] Embedded web SPA client
- [x] CLI client (neoirc-cli)
+- [x] CLI client (chat-cli)
 - [x] SQLite storage with WAL mode
 - [x] Docker deployment
 - [x] Prometheus metrics endpoint
 - [x] Health check endpoint
- [x] Session expiry — auto-expire idle sessions, release nicks
- [x] Logout endpoint (`POST /api/v1/logout`)
- [x] Current user endpoint (`GET /api/v1/users/me`)
- [x] User count in server info (`GET /api/v1/server`)

 ### Post-MVP (Planned)

 - [ ] **Hashcash proof-of-work** for session creation (abuse prevention)
+- [ ] **Session expiry** — auto-expire idle sessions, release nicks
 - [ ] **Queue pruning** — delete old queue entries per `QUEUE_MAX_AGE`
 - [ ] **Message rotation** — enforce `MAX_HISTORY` per channel
 - [ ] **Channel modes** — enforce `+i`, `+m`, `+s`, `+t`, `+n`
@@ -2113,11 +2053,11 @@ GET /api/v1/challenge
 Following [gohttpserver CONVENTIONS.md](https://git.eeqj.de/sneak/gohttpserver/src/branch/main/CONVENTIONS.md):

 ```
-neoirc/
+chat/
 ├── cmd/
-│   ├── neoircd/            # Server binary entry point
+│   ├── chatd/              # Server binary entry point
 │   │   └── main.go
-│   └── neoirc-cli/         # TUI client
+│   └── chat-cli/           # TUI client
 │       ├── main.go         # Command handling, poll loop
 │       ├── ui.go           # tview-based terminal UI
 │       └── api/
@@ -2248,7 +2188,7 @@ neoirc/
 - IRC message envelope format with per-client queue fan-out
 - Long-polling with in-memory broker
 - Embedded web SPA client
- TUI client (neoirc-cli)
+- TUI client (chat-cli)
 - Docker image
 - Prometheus metrics

--- a/cmd/neoirc-cli/api/client.go
+++ b/cmd/neoirc-cli/api/client.go
@@ -1,5 +1,5 @@
-// Package neoircapi provides a client for the neoirc server API.
-package neoircapi
+// Package chatapi provides a client for the chat server API.
+package chatapi

 import (
 	"bytes"
@@ -23,7 +23,7 @@ const (

 var errHTTP = errors.New("HTTP error")

-// Client wraps HTTP calls to the neoirc server API.
+// Client wraps HTTP calls to the chat server API.
 type Client struct {
 	BaseURL    string
 	Token      string
--- a/cmd/neoirc-cli/api/types.go
+++ b/cmd/neoirc-cli/api/types.go
@@ -1,4 +1,4 @@
-package neoircapi
+package chatapi

 import "time"

@@ -21,7 +21,7 @@ type StateResponse struct {
 	Channels []string `json:"channels"`
 }

-// Message represents a neoirc message envelope.
+// Message represents a chat message envelope.
 type Message struct {
 	Command string   `json:"command"`
 	From    string   `json:"from,omitempty"`
--- a/cmd/neoirc-cli/main.go
+++ b/cmd/neoirc-cli/main.go
@@ -1,4 +1,4 @@
-// Package main is the entry point for the neoirc-cli client.
+// Package main is the entry point for the chat-cli client.
 package main

 import (
@@ -8,7 +8,7 @@ import (
 	"sync"
 	"time"

-	api "git.eeqj.de/sneak/neoirc/cmd/neoirc-cli/api"
+	api "git.eeqj.de/sneak/chat/cmd/chat-cli/api"
 )

 const (
@@ -41,7 +41,7 @@ func main() {
 	app.ui.SetStatus(app.nick, "", "disconnected")

 	app.ui.AddStatus(
-		"Welcome to neoirc-cli — an IRC-style client",
+		"Welcome to chat-cli — an IRC-style client",
 	)
 	app.ui.AddStatus(
 		"Type [yellow]/connect <server-url>" +
@@ -564,7 +564,7 @@ func (a *App) cmdQuit() {

 func (a *App) cmdHelp() {
 	help := []string{
-		"[cyan]*** neoirc-cli commands:",
+		"[cyan]*** chat-cli commands:",
 		"  /connect <url>  — Connect to server",
 		"  /nick <name>    — Change nickname",
 		"  /join #channel  — Join channel",
--- a/cmd/neoirc-cli/ui.go
+++ b/cmd/neoirc-cli/ui.go
--- a/cmd/neoircd/main.go
+++ b/cmd/neoircd/main.go
@@ -1,21 +1,21 @@
-// Package main is the entry point for the neoircd server.
+// Package main is the entry point for the chatd server.
 package main

 import (
-	"git.eeqj.de/sneak/neoirc/internal/config"
-	"git.eeqj.de/sneak/neoirc/internal/db"
-	"git.eeqj.de/sneak/neoirc/internal/globals"
-	"git.eeqj.de/sneak/neoirc/internal/handlers"
-	"git.eeqj.de/sneak/neoirc/internal/healthcheck"
-	"git.eeqj.de/sneak/neoirc/internal/logger"
-	"git.eeqj.de/sneak/neoirc/internal/middleware"
-	"git.eeqj.de/sneak/neoirc/internal/server"
+	"git.eeqj.de/sneak/chat/internal/config"
+	"git.eeqj.de/sneak/chat/internal/db"
+	"git.eeqj.de/sneak/chat/internal/globals"
+	"git.eeqj.de/sneak/chat/internal/handlers"
+	"git.eeqj.de/sneak/chat/internal/healthcheck"
+	"git.eeqj.de/sneak/chat/internal/logger"
+	"git.eeqj.de/sneak/chat/internal/middleware"
+	"git.eeqj.de/sneak/chat/internal/server"
 	"go.uber.org/fx"
 )

 var (
 	// Appname is the application name, set at build time.
-	Appname = "neoirc" //nolint:gochecknoglobals
+	Appname = "chat" //nolint:gochecknoglobals

 	// Version is the application version, set at build time.
 	Version string //nolint:gochecknoglobals
--- a/go.mod
+++ b/go.mod
@@ -1,21 +1,17 @@
-module git.eeqj.de/sneak/neoirc
+module git.eeqj.de/sneak/chat

 go 1.24.0

 require (
 	github.com/99designs/basicauth-go v0.0.0-20230316000542-bf6f9cbbf0f8
-	github.com/gdamore/tcell/v2 v2.13.8
 	github.com/getsentry/sentry-go v0.42.0
 	github.com/go-chi/chi v1.5.5
 	github.com/go-chi/cors v1.2.2
-	github.com/google/uuid v1.6.0
 	github.com/joho/godotenv v1.5.1
 	github.com/prometheus/client_golang v1.23.2
-	github.com/rivo/tview v0.42.0
 	github.com/slok/go-http-metrics v0.13.0
 	github.com/spf13/viper v1.21.0
 	go.uber.org/fx v1.24.0
-	golang.org/x/crypto v0.48.0
 	modernc.org/sqlite v1.45.0
 )

@@ -25,7 +21,9 @@ require (
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/gdamore/encoding v1.0.1 // indirect
+	github.com/gdamore/tcell/v2 v2.13.8 // indirect
 	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/google/uuid v1.6.0 // indirect
 	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
@@ -35,6 +33,7 @@ require (
 	github.com/prometheus/common v0.66.1 // indirect
 	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	github.com/rivo/tview v0.42.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
 	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
@@ -48,9 +47,9 @@ require (
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 // indirect
-	golang.org/x/sys v0.41.0 // indirect
-	golang.org/x/term v0.40.0 // indirect
-	golang.org/x/text v0.34.0 // indirect
+	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/term v0.37.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
 	google.golang.org/protobuf v1.36.8 // indirect
 	modernc.org/libc v1.67.6 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
--- a/go.sum
+++ b/go.sum
@@ -113,14 +113,12 @@ go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
-golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
 golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 h1:mgKeJMpvi0yx/sU5GsxQ7p6s2wtOnGAHZWCHUM4KGzY=
 golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546/go.mod h1:j/pmGrbnkbPtQfxEe5D0VQhZC6qKbfKifgD0oM7sR70=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
-golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
+golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
+golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
@@ -128,8 +126,8 @@ golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -137,26 +135,30 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
-golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ=
+golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
-golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
-golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
+golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
-golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng=
+golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
-golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
+golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
 google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
--- a/internal/broker/broker_test.go
+++ b/internal/broker/broker_test.go
@@ -5,7 +5,7 @@ import (
 	"testing"
 	"time"

-	"git.eeqj.de/sneak/neoirc/internal/broker"
+	"git.eeqj.de/sneak/chat/internal/broker"
 )

 func TestNewBroker(t *testing.T) {
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -5,8 +5,8 @@ import (
 	"errors"
 	"log/slog"

-	"git.eeqj.de/sneak/neoirc/internal/globals"
-	"git.eeqj.de/sneak/neoirc/internal/logger"
+	"git.eeqj.de/sneak/chat/internal/globals"
+	"git.eeqj.de/sneak/chat/internal/logger"
 	"github.com/spf13/viper"
 	"go.uber.org/fx"

@@ -31,6 +31,7 @@ type Config struct {
 	Port               int
 	SentryDSN          string
 	MaxHistory         int
+	SessionTimeout     int
 	MaxMessageSize     int
 	MOTD               string
 	ServerName         string
@@ -56,11 +57,12 @@ func New(
 	viper.SetDefault("DEBUG", "false")
 	viper.SetDefault("MAINTENANCE_MODE", "false")
 	viper.SetDefault("PORT", "8080")
-	viper.SetDefault("DBURL", "file:///var/lib/neoirc/state.db?_journal_mode=WAL")
+	viper.SetDefault("DBURL", "file:./data.db?_journal_mode=WAL")
 	viper.SetDefault("SENTRY_DSN", "")
 	viper.SetDefault("METRICS_USERNAME", "")
 	viper.SetDefault("METRICS_PASSWORD", "")
 	viper.SetDefault("MAX_HISTORY", "10000")
+	viper.SetDefault("SESSION_TIMEOUT", "86400")
 	viper.SetDefault("MAX_MESSAGE_SIZE", "4096")
 	viper.SetDefault("MOTD", "")
 	viper.SetDefault("SERVER_NAME", "")
@@ -85,6 +87,7 @@ func New(
 		MetricsUsername:    viper.GetString("METRICS_USERNAME"),
 		MetricsPassword:    viper.GetString("METRICS_PASSWORD"),
 		MaxHistory:         viper.GetInt("MAX_HISTORY"),
+		SessionTimeout:     viper.GetInt("SESSION_TIMEOUT"),
 		MaxMessageSize:     viper.GetInt("MAX_MESSAGE_SIZE"),
 		MOTD:               viper.GetString("MOTD"),
 		ServerName:         viper.GetString("SERVER_NAME"),
--- a/internal/db/auth.go
+++ b/internal/db/auth.go
@@ -1,161 +0,0 @@
-package db
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/google/uuid"
-	"golang.org/x/crypto/bcrypt"
-)
-
-const bcryptCost = bcrypt.DefaultCost
-
-var errNoPassword = errors.New(
-	"account has no password set",
-)
-
-// RegisterUser creates a session with a hashed password
-// and returns session ID, client ID, and token.
-func (database *Database) RegisterUser(
-	ctx context.Context,
-	nick, password string,
-) (int64, int64, string, error) {
-	hash, err := bcrypt.GenerateFromPassword(
-		[]byte(password), bcryptCost,
-	)
-	if err != nil {
-		return 0, 0, "", fmt.Errorf(
-			"hash password: %w", err,
-		)
-	}
-
-	sessionUUID := uuid.New().String()
-	clientUUID := uuid.New().String()
-
-	token, err := generateToken()
-	if err != nil {
-		return 0, 0, "", err
-	}
-
-	now := time.Now()
-
-	transaction, err := database.conn.BeginTx(ctx, nil)
-	if err != nil {
-		return 0, 0, "", fmt.Errorf(
-			"begin tx: %w", err,
-		)
-	}
-
-	res, err := transaction.ExecContext(ctx,
-		`INSERT INTO sessions
-		 (uuid, nick, password_hash,
-		  created_at, last_seen)
-		 VALUES (?, ?, ?, ?, ?)`,
-		sessionUUID, nick, string(hash), now, now)
-	if err != nil {
-		_ = transaction.Rollback()
-
-		return 0, 0, "", fmt.Errorf(
-			"create session: %w", err,
-		)
-	}
-
-	sessionID, _ := res.LastInsertId()
-
-	clientRes, err := transaction.ExecContext(ctx,
-		`INSERT INTO clients
-		 (uuid, session_id, token,
-		  created_at, last_seen)
-		 VALUES (?, ?, ?, ?, ?)`,
-		clientUUID, sessionID, token, now, now)
-	if err != nil {
-		_ = transaction.Rollback()
-
-		return 0, 0, "", fmt.Errorf(
-			"create client: %w", err,
-		)
-	}
-
-	clientID, _ := clientRes.LastInsertId()
-
-	err = transaction.Commit()
-	if err != nil {
-		return 0, 0, "", fmt.Errorf(
-			"commit registration: %w", err,
-		)
-	}
-
-	return sessionID, clientID, token, nil
-}
-
-// LoginUser verifies a nick/password and creates a new
-// client token.
-func (database *Database) LoginUser(
-	ctx context.Context,
-	nick, password string,
-) (int64, int64, string, error) {
-	var (
-		sessionID    int64
-		passwordHash string
-	)
-
-	err := database.conn.QueryRowContext(
-		ctx,
-		`SELECT id, password_hash
-		 FROM sessions WHERE nick = ?`,
-		nick,
-	).Scan(&sessionID, &passwordHash)
-	if err != nil {
-		return 0, 0, "", fmt.Errorf(
-			"get session for login: %w", err,
-		)
-	}
-
-	if passwordHash == "" {
-		return 0, 0, "", fmt.Errorf(
-			"login: %w", errNoPassword,
-		)
-	}
-
-	err = bcrypt.CompareHashAndPassword(
-		[]byte(passwordHash), []byte(password),
-	)
-	if err != nil {
-		return 0, 0, "", fmt.Errorf(
-			"verify password: %w", err,
-		)
-	}
-
-	clientUUID := uuid.New().String()
-
-	token, err := generateToken()
-	if err != nil {
-		return 0, 0, "", err
-	}
-
-	now := time.Now()
-
-	res, err := database.conn.ExecContext(ctx,
-		`INSERT INTO clients
-		 (uuid, session_id, token,
-		  created_at, last_seen)
-		 VALUES (?, ?, ?, ?, ?)`,
-		clientUUID, sessionID, token, now, now)
-	if err != nil {
-		return 0, 0, "", fmt.Errorf(
-			"create login client: %w", err,
-		)
-	}
-
-	clientID, _ := res.LastInsertId()
-
-	_, _ = database.conn.ExecContext(
-		ctx,
-		"UPDATE sessions SET last_seen = ? WHERE id = ?",
-		now, sessionID,
-	)
-
-	return sessionID, clientID, token, nil
-}
--- a/internal/db/auth_test.go
+++ b/internal/db/auth_test.go
@@ -1,178 +0,0 @@
-package db_test
-
-import (
-	"testing"
-
-	_ "modernc.org/sqlite"
-)
-
-func TestRegisterUser(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-	ctx := t.Context()
-
-	sessionID, clientID, token, err :=
-		database.RegisterUser(ctx, "reguser", "password123")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if sessionID == 0 || clientID == 0 || token == "" {
-		t.Fatal("expected valid ids and token")
-	}
-
-	// Verify session works via token lookup.
-	sid, cid, nick, err :=
-		database.GetSessionByToken(ctx, token)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if sid != sessionID || cid != clientID {
-		t.Fatal("session/client id mismatch")
-	}
-
-	if nick != "reguser" {
-		t.Fatalf("expected reguser, got %s", nick)
-	}
-}
-
-func TestRegisterUserDuplicateNick(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-	ctx := t.Context()
-
-	regSID, regCID, regToken, err :=
-		database.RegisterUser(ctx, "dupnick", "password123")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	_ = regSID
-	_ = regCID
-	_ = regToken
-
-	dupSID, dupCID, dupToken, dupErr :=
-		database.RegisterUser(ctx, "dupnick", "other12345")
-	if dupErr == nil {
-		t.Fatal("expected error for duplicate nick")
-	}
-
-	_ = dupSID
-	_ = dupCID
-	_ = dupToken
-}
-
-func TestLoginUser(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-	ctx := t.Context()
-
-	regSID, regCID, regToken, err :=
-		database.RegisterUser(ctx, "loginuser", "mypassword")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	_ = regSID
-	_ = regCID
-	_ = regToken
-
-	sessionID, clientID, token, err :=
-		database.LoginUser(ctx, "loginuser", "mypassword")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if sessionID == 0 || clientID == 0 || token == "" {
-		t.Fatal("expected valid ids and token")
-	}
-
-	// Verify the new token works.
-	_, _, nick, err :=
-		database.GetSessionByToken(ctx, token)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if nick != "loginuser" {
-		t.Fatalf("expected loginuser, got %s", nick)
-	}
-}
-
-func TestLoginUserWrongPassword(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-	ctx := t.Context()
-
-	regSID, regCID, regToken, err :=
-		database.RegisterUser(ctx, "wrongpw", "correctpass")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	_ = regSID
-	_ = regCID
-	_ = regToken
-
-	loginSID, loginCID, loginToken, loginErr :=
-		database.LoginUser(ctx, "wrongpw", "wrongpass12")
-	if loginErr == nil {
-		t.Fatal("expected error for wrong password")
-	}
-
-	_ = loginSID
-	_ = loginCID
-	_ = loginToken
-}
-
-func TestLoginUserNoPassword(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-	ctx := t.Context()
-
-	// Create anonymous session (no password).
-	anonSID, anonCID, anonToken, err :=
-		database.CreateSession(ctx, "anon")
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	_ = anonSID
-	_ = anonCID
-	_ = anonToken
-
-	loginSID, loginCID, loginToken, loginErr :=
-		database.LoginUser(ctx, "anon", "anything1")
-	if loginErr == nil {
-		t.Fatal(
-			"expected error for login on passwordless account",
-		)
-	}
-
-	_ = loginSID
-	_ = loginCID
-	_ = loginToken
-}
-
-func TestLoginUserNonexistent(t *testing.T) {
-	t.Parallel()
-
-	database := setupTestDB(t)
-	ctx := t.Context()
-
-	loginSID, loginCID, loginToken, err :=
-		database.LoginUser(ctx, "ghost", "password123")
-	if err == nil {
-		t.Fatal("expected error for nonexistent user")
-	}
-
-	_ = loginSID
-	_ = loginCID
-	_ = loginToken
-}
--- a/internal/db/db.go
+++ b/internal/db/db.go
@@ -12,8 +12,8 @@ import (
 	"strconv"
 	"strings"

-	"git.eeqj.de/sneak/neoirc/internal/config"
-	"git.eeqj.de/sneak/neoirc/internal/logger"
+	"git.eeqj.de/sneak/chat/internal/config"
+	"git.eeqj.de/sneak/chat/internal/logger"
 	"go.uber.org/fx"

 	_ "github.com/joho/godotenv/autoload" // .env
@@ -87,7 +87,7 @@ func (database *Database) GetDB() *sql.DB {
 func (database *Database) connect(ctx context.Context) error {
 	dbURL := database.params.Config.DBURL
 	if dbURL == "" {
-		dbURL = "file:///var/lib/neoirc/state.db?_journal_mode=WAL&_busy_timeout=5000"
+		dbURL = "file:./data.db?_journal_mode=WAL&_busy_timeout=5000"
 	}

 	database.log.Info(
--- a/internal/db/queries.go
+++ b/internal/db/queries.go
@@ -796,8 +796,8 @@ func (database *Database) DeleteClient(
 	return nil
 }

-// GetUserCount returns the number of active users.
-func (database *Database) GetUserCount(
+// GetSessionCount returns the number of active sessions.
+func (database *Database) GetSessionCount(
 	ctx context.Context,
 ) (int64, error) {
 	var count int64
@@ -808,7 +808,7 @@ func (database *Database) GetUserCount(
 	).Scan(&count)
 	if err != nil {
 		return 0, fmt.Errorf(
-			"get user count: %w", err,
+			"get session count: %w", err,
 		)
 	}

@@ -838,9 +838,9 @@ func (database *Database) ClientCountForSession(
 	return count, nil
 }

-// DeleteStaleUsers removes clients not seen since the
-// cutoff and cleans up orphaned users (sessions).
-func (database *Database) DeleteStaleUsers(
+// DeleteStaleSessions removes clients not seen since the
+// cutoff and cleans up orphaned sessions.
+func (database *Database) DeleteStaleSessions(
 	ctx context.Context,
 	cutoff time.Time,
 ) (int64, error) {
@@ -869,60 +869,6 @@ func (database *Database) DeleteStaleUsers(
 	return deleted, nil
 }

-// StaleSession holds the id and nick of a session
-// whose clients are all stale.
-type StaleSession struct {
-	ID   int64
-	Nick string
-}
-
-// GetStaleOrphanSessions returns sessions where every
-// client has a last_seen before cutoff.
-func (database *Database) GetStaleOrphanSessions(
-	ctx context.Context,
-	cutoff time.Time,
-) ([]StaleSession, error) {
-	rows, err := database.conn.QueryContext(ctx,
-		`SELECT s.id, s.nick
-		 FROM sessions s
-		 WHERE s.id IN (
-		   SELECT DISTINCT session_id FROM clients
-		   WHERE last_seen < ?
-		 )
-		 AND s.id NOT IN (
-		   SELECT DISTINCT session_id FROM clients
-		   WHERE last_seen >= ?
-		 )`, cutoff, cutoff)
-	if err != nil {
-		return nil, fmt.Errorf(
-			"get stale orphan sessions: %w", err,
-		)
-	}
-
-	defer func() { _ = rows.Close() }()
-
-	var result []StaleSession
-
-	for rows.Next() {
-		var stale StaleSession
-		if err := rows.Scan(&stale.ID, &stale.Nick); err != nil {
-			return nil, fmt.Errorf(
-				"scan stale session: %w", err,
-			)
-		}
-
-		result = append(result, stale)
-	}
-
-	if err := rows.Err(); err != nil {
-		return nil, fmt.Errorf(
-			"iterate stale sessions: %w", err,
-		)
-	}
-
-	return result, nil
-}
-
 // GetSessionChannels returns channels a session
 // belongs to.
 func (database *Database) GetSessionChannels(
--- a/internal/db/queries_test.go
+++ b/internal/db/queries_test.go
@@ -4,7 +4,7 @@ import (
 	"encoding/json"
 	"testing"

-	"git.eeqj.de/sneak/neoirc/internal/db"
+	"git.eeqj.de/sneak/chat/internal/db"

 	_ "modernc.org/sqlite"
 )
--- a/internal/db/schema/001_initial.sql
+++ b/internal/db/schema/001_initial.sql
@@ -1,12 +1,11 @@
 -- Chat server schema (pre-1.0 consolidated)
 PRAGMA foreign_keys = ON;

-- Sessions: each session is a user identity (nick + optional password + signing key)
+-- Sessions: IRC-style sessions (no passwords, nick + optional signing key)
 CREATE TABLE IF NOT EXISTS sessions (
    id INTEGER PRIMARY KEY AUTOINCREMENT,
    uuid TEXT NOT NULL UNIQUE,
    nick TEXT NOT NULL UNIQUE,
-    password_hash TEXT NOT NULL DEFAULT '',
    signing_key TEXT NOT NULL DEFAULT '',
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    last_seen DATETIME DEFAULT CURRENT_TIMESTAMP
--- a/internal/handlers/api.go
+++ b/internal/handlers/api.go
@@ -28,18 +28,6 @@ const (
 	defaultHistLimit   = 50
 	maxHistLimit       = 500
 	cmdPrivmsg         = "PRIVMSG"
-
-	// IRC numeric reply codes per RFC 1459/2812.
-	ircErrNoSuchNick       = "401"
-	ircErrNoSuchChannel    = "403"
-	ircErrNoRecipient      = "411"
-	ircErrNoTextToSend     = "412"
-	ircErrUnknownCommand   = "421"
-	ircErrNoNicknameGiven  = "431"
-	ircErrErroneusNickname = "432"
-	ircErrNicknameInUse    = "433"
-	ircErrNotOnChannel     = "442"
-	ircErrNeedMoreParams   = "461"
 )

 func (hdlr *Handlers) maxBodySize() int64 {
@@ -75,43 +63,6 @@ func (hdlr *Handlers) authSession(
 	return sessionID, clientID, nick, nil
 }

-// serverName returns the configured server name or the
-// default "neoirc".
-func (hdlr *Handlers) serverName() string {
-	if hdlr.params.Config.ServerName != "" {
-		return hdlr.params.Config.ServerName
-	}
-
-	return "neoirc"
-}
-
-// respondIRCError sends an IRC numeric error reply as a
-// JSON response with HTTP 200 OK. This is used for errors
-// in IRC command processing (as opposed to HTTP transport
-// errors). The params slice contains IRC-style positional
-// parameters (e.g. the target nick or channel).
-func (hdlr *Handlers) respondIRCError(
-	writer http.ResponseWriter,
-	request *http.Request,
-	nick, numeric, msg string,
-	params ...string,
-) {
-	resp := map[string]any{
-		"command": numeric,
-		"from":    hdlr.serverName(),
-		"to":      nick,
-		"body":    []string{msg},
-	}
-
-	if len(params) > 0 {
-		resp["params"] = params
-	}
-
-	hdlr.respondJSON(
-		writer, request, resp, http.StatusOK,
-	)
-}
-
 func (hdlr *Handlers) requireAuth(
 	writer http.ResponseWriter,
 	request *http.Request,
@@ -275,7 +226,11 @@ func (hdlr *Handlers) deliverMOTD(
 	clientID, sessionID int64,
 ) {
 	motd := hdlr.params.Config.MOTD
-	serverName := hdlr.serverName()
+	serverName := hdlr.params.Config.ServerName
+
+	if serverName == "" {
+		serverName = "chat"
+	}

 	if motd == "" {
 		return
@@ -602,10 +557,10 @@ func (hdlr *Handlers) HandleSendCommand() http.HandlerFunc {
 		payload.To = strings.TrimSpace(payload.To)

 		if payload.Command == "" {
-			hdlr.respondIRCError(
+			hdlr.respondError(
 				writer, request,
-				nick, ircErrUnknownCommand,
-				"No command given",
+				"command required",
+				http.StatusBadRequest,
 			)

 			return
@@ -676,11 +631,10 @@ func (hdlr *Handlers) dispatchCommand(
 			},
 			http.StatusOK)
 	default:
-		hdlr.respondIRCError(
+		hdlr.respondError(
 			writer, request,
-			nick, ircErrUnknownCommand,
-			command+" :Unknown command",
-			command,
+			"unknown command: "+command,
+			http.StatusBadRequest,
 		)
 	}
 }
@@ -694,10 +648,10 @@ func (hdlr *Handlers) handlePrivmsg(
 	bodyLines func() []string,
 ) {
 	if target == "" {
-		hdlr.respondIRCError(
+		hdlr.respondError(
 			writer, request,
-			nick, ircErrNoRecipient,
-			"No recipient given ("+command+")",
+			"to field required",
+			http.StatusBadRequest,
 		)

 		return
@@ -705,10 +659,10 @@ func (hdlr *Handlers) handlePrivmsg(

 	lines := bodyLines()
 	if len(lines) == 0 {
-		hdlr.respondIRCError(
+		hdlr.respondError(
 			writer, request,
-			nick, ircErrNoTextToSend,
-			"No text to send",
+			"body required",
+			http.StatusBadRequest,
 		)

 		return
@@ -740,11 +694,10 @@ func (hdlr *Handlers) handleChannelMsg(
 		request.Context(), target,
 	)
 	if err != nil {
-		hdlr.respondIRCError(
+		hdlr.respondError(
 			writer, request,
-			nick, ircErrNoSuchChannel,
-			"No such channel",
-			target,
+			"channel not found",
+			http.StatusNotFound,
 		)

 		return
@@ -767,11 +720,10 @@ func (hdlr *Handlers) handleChannelMsg(
 	}

 	if !isMember {
-		hdlr.respondIRCError(
+		hdlr.respondError(
 			writer, request,
-			nick, ircErrNotOnChannel,
-			"You're not on that channel",
-			target,
+			"not a member of this channel",
+			http.StatusForbidden,
 		)

 		return
@@ -809,7 +761,7 @@ func (hdlr *Handlers) handleChannelMsg(

 	hdlr.respondJSON(writer, request,
 		map[string]string{"id": msgUUID, "status": "sent"},
-		http.StatusOK)
+		http.StatusCreated)
 }

 func (hdlr *Handlers) handleDirectMsg(
@@ -823,11 +775,10 @@ func (hdlr *Handlers) handleDirectMsg(
 		request.Context(), target,
 	)
 	if err != nil {
-		hdlr.respondIRCError(
+		hdlr.respondError(
 			writer, request,
-			nick, ircErrNoSuchNick,
-			"No such nick/channel",
-			target,
+			"user not found",
+			http.StatusNotFound,
 		)

 		return
@@ -854,7 +805,7 @@ func (hdlr *Handlers) handleDirectMsg(

 	hdlr.respondJSON(writer, request,
 		map[string]string{"id": msgUUID, "status": "sent"},
-		http.StatusOK)
+		http.StatusCreated)
 }

 func (hdlr *Handlers) handleJoin(
@@ -864,11 +815,10 @@ func (hdlr *Handlers) handleJoin(
 	nick, target string,
 ) {
 	if target == "" {
-		hdlr.respondIRCError(
+		hdlr.respondError(
 			writer, request,
-			nick, ircErrNeedMoreParams,
-			"Not enough parameters",
-			"JOIN",
+			"to field required",
+			http.StatusBadRequest,
 		)

 		return
@@ -880,11 +830,10 @@ func (hdlr *Handlers) handleJoin(
 	}

 	if !validChannelRe.MatchString(channel) {
-		hdlr.respondIRCError(
+		hdlr.respondError(
 			writer, request,
-			nick, ircErrNoSuchChannel,
-			"No such channel",
-			channel,
+			"invalid channel name",
+			http.StatusBadRequest,
 		)

 		return
@@ -946,11 +895,10 @@ func (hdlr *Handlers) handlePart(
 	body json.RawMessage,
 ) {
 	if target == "" {
-		hdlr.respondIRCError(
+		hdlr.respondError(
 			writer, request,
-			nick, ircErrNeedMoreParams,
-			"Not enough parameters",
-			"PART",
+			"to field required",
+			http.StatusBadRequest,
 		)

 		return
@@ -965,11 +913,10 @@ func (hdlr *Handlers) handlePart(
 		request.Context(), channel,
 	)
 	if err != nil {
-		hdlr.respondIRCError(
+		hdlr.respondError(
 			writer, request,
-			nick, ircErrNoSuchChannel,
-			"No such channel",
-			channel,
+			"channel not found",
+			http.StatusNotFound,
 		)

 		return
@@ -1020,10 +967,10 @@ func (hdlr *Handlers) handleNick(
 ) {
 	lines := bodyLines()
 	if len(lines) == 0 {
-		hdlr.respondIRCError(
+		hdlr.respondError(
 			writer, request,
-			nick, ircErrNoNicknameGiven,
-			"No nickname given",
+			"body required (new nick)",
+			http.StatusBadRequest,
 		)

 		return
@@ -1032,11 +979,10 @@ func (hdlr *Handlers) handleNick(
 	newNick := strings.TrimSpace(lines[0])

 	if !validNickRe.MatchString(newNick) {
-		hdlr.respondIRCError(
+		hdlr.respondError(
 			writer, request,
-			nick, ircErrErroneusNickname,
-			"Erroneous nickname",
-			newNick,
+			"invalid nick",
+			http.StatusBadRequest,
 		)

 		return
@@ -1057,11 +1003,10 @@ func (hdlr *Handlers) handleNick(
 	)
 	if err != nil {
 		if strings.Contains(err.Error(), "UNIQUE") {
-			hdlr.respondIRCError(
+			hdlr.respondError(
 				writer, request,
-				nick, ircErrNicknameInUse,
-				"Nickname is already in use",
-				newNick,
+				"nick already in use",
+				http.StatusConflict,
 			)

 			return
@@ -1148,11 +1093,10 @@ func (hdlr *Handlers) handleTopic(
 	bodyLines func() []string,
 ) {
 	if target == "" {
-		hdlr.respondIRCError(
+		hdlr.respondError(
 			writer, request,
-			nick, ircErrNeedMoreParams,
-			"Not enough parameters",
-			"TOPIC",
+			"to field required",
+			http.StatusBadRequest,
 		)

 		return
@@ -1160,11 +1104,10 @@ func (hdlr *Handlers) handleTopic(

 	lines := bodyLines()
 	if len(lines) == 0 {
-		hdlr.respondIRCError(
+		hdlr.respondError(
 			writer, request,
-			nick, ircErrNeedMoreParams,
-			"Not enough parameters",
-			"TOPIC",
+			"body required (topic text)",
+			http.StatusBadRequest,
 		)

 		return
@@ -1197,11 +1140,10 @@ func (hdlr *Handlers) handleTopic(
 		request.Context(), channel,
 	)
 	if err != nil {
-		hdlr.respondIRCError(
+		hdlr.respondError(
 			writer, request,
-			nick, ircErrNoSuchChannel,
-			"No such channel",
-			channel,
+			"channel not found",
+			http.StatusNotFound,
 		)

 		return
@@ -1419,23 +1361,20 @@ func (hdlr *Handlers) canAccessChannelHistory(
 	return true
 }

-// HandleLogout deletes the authenticated client's token
-// and cleans up the user (session) if no clients remain.
+// HandleLogout deletes the authenticated client's token.
 func (hdlr *Handlers) HandleLogout() http.HandlerFunc {
 	return func(
 		writer http.ResponseWriter,
 		request *http.Request,
 	) {
-		sessionID, clientID, nick, ok :=
+		_, clientID, _, ok :=
 			hdlr.requireAuth(writer, request)
 		if !ok {
 			return
 		}

-		ctx := request.Context()
-
 		err := hdlr.params.Database.DeleteClient(
-			ctx, clientID,
+			request.Context(), clientID,
 		)
 		if err != nil {
 			hdlr.log.Error(
@@ -1450,77 +1389,12 @@ func (hdlr *Handlers) HandleLogout() http.HandlerFunc {
 			return
 		}

-		// If no clients remain, clean up the user fully:
-		// part all channels (notifying members) and
-		// delete the session.
-		remaining, err := hdlr.params.Database.
-			ClientCountForSession(ctx, sessionID)
-		if err != nil {
-			hdlr.log.Error(
-				"client count check failed", "error", err,
-			)
-		}
-
-		if remaining == 0 {
-			hdlr.cleanupUser(
-				ctx, sessionID, nick,
-			)
-		}
-
 		hdlr.respondJSON(writer, request,
 			map[string]string{"status": "ok"},
 			http.StatusOK)
 	}
 }

-// cleanupUser parts the user from all channels (notifying
-// members) and deletes the session.
-func (hdlr *Handlers) cleanupUser(
-	ctx context.Context,
-	sessionID int64,
-	nick string,
-) {
-	channels, _ := hdlr.params.Database.
-		GetSessionChannels(ctx, sessionID)
-
-	notified := map[int64]bool{}
-
-	var quitDBID int64
-
-	if len(channels) > 0 {
-		quitDBID, _, _ = hdlr.params.Database.InsertMessage(
-			ctx, "QUIT", nick, "", nil, nil,
-		)
-	}
-
-	for _, chanInfo := range channels {
-		memberIDs, _ := hdlr.params.Database.
-			GetChannelMemberIDs(ctx, chanInfo.ID)
-
-		for _, mid := range memberIDs {
-			if mid != sessionID && !notified[mid] {
-				notified[mid] = true
-
-				_ = hdlr.params.Database.EnqueueToSession(
-					ctx, mid, quitDBID,
-				)
-
-				hdlr.broker.Notify(mid)
-			}
-		}
-
-		_ = hdlr.params.Database.PartChannel(
-			ctx, chanInfo.ID, sessionID,
-		)
-
-		_ = hdlr.params.Database.DeleteChannelIfEmpty(
-			ctx, chanInfo.ID,
-		)
-	}
-
-	_ = hdlr.params.Database.DeleteSession(ctx, sessionID)
-}
-
 // HandleUsersMe returns the current user's session info.
 func (hdlr *Handlers) HandleUsersMe() http.HandlerFunc {
 	return hdlr.HandleState()
@@ -1532,12 +1406,12 @@ func (hdlr *Handlers) HandleServerInfo() http.HandlerFunc {
 		writer http.ResponseWriter,
 		request *http.Request,
 	) {
-		users, err := hdlr.params.Database.GetUserCount(
+		users, err := hdlr.params.Database.GetSessionCount(
 			request.Context(),
 		)
 		if err != nil {
 			hdlr.log.Error(
-				"get user count failed", "error", err,
+				"get session count failed", "error", err,
 			)
 			hdlr.respondError(
 				writer, request,
--- a/internal/handlers/api_test.go
+++ b/internal/handlers/api_test.go
@@ -17,14 +17,14 @@ import (
 	"testing"
 	"time"

-	"git.eeqj.de/sneak/neoirc/internal/config"
-	"git.eeqj.de/sneak/neoirc/internal/db"
-	"git.eeqj.de/sneak/neoirc/internal/globals"
-	"git.eeqj.de/sneak/neoirc/internal/handlers"
-	"git.eeqj.de/sneak/neoirc/internal/healthcheck"
-	"git.eeqj.de/sneak/neoirc/internal/logger"
-	"git.eeqj.de/sneak/neoirc/internal/middleware"
-	"git.eeqj.de/sneak/neoirc/internal/server"
+	"git.eeqj.de/sneak/chat/internal/config"
+	"git.eeqj.de/sneak/chat/internal/db"
+	"git.eeqj.de/sneak/chat/internal/globals"
+	"git.eeqj.de/sneak/chat/internal/handlers"
+	"git.eeqj.de/sneak/chat/internal/healthcheck"
+	"git.eeqj.de/sneak/chat/internal/logger"
+	"git.eeqj.de/sneak/chat/internal/middleware"
+	"git.eeqj.de/sneak/chat/internal/server"
 	"go.uber.org/fx"
 	"go.uber.org/fx/fxtest"
 )
@@ -115,7 +115,7 @@ func newTestServer(

 func newTestGlobals() *globals.Globals {
 	return &globals.Globals{
-		Appname: "neoirc-test",
+		Appname: "chat-test",
 		Version: "test",
 	}
 }
@@ -668,18 +668,11 @@ func TestJoinMissingTo(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("joiner3")

-	status, result := tserver.sendCommand(
+	status, _ := tserver.sendCommand(
 		token, map[string]any{commandKey: joinCmd},
 	)
-	if status != http.StatusOK {
-		t.Fatalf("expected 200, got %d", status)
-	}
-
-	if result[commandKey] != "461" {
-		t.Fatalf(
-			"expected IRC 461, got %v",
-			result[commandKey],
-		)
+	if status != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", status)
 	}
 }

@@ -689,10 +682,10 @@ func TestChannelMessage(t *testing.T) {
 	bobToken := tserver.createSession("bob_msg")

 	tserver.sendCommand(aliceToken, map[string]any{
-		commandKey: joinCmd, toKey: "#test",
+		commandKey: joinCmd, toKey: "#chat",
 	})
 	tserver.sendCommand(bobToken, map[string]any{
-		commandKey: joinCmd, toKey: "#test",
+		commandKey: joinCmd, toKey: "#chat",
 	})

 	_, _ = tserver.pollMessages(aliceToken, 0)
@@ -702,13 +695,13 @@ func TestChannelMessage(t *testing.T) {
 		aliceToken,
 		map[string]any{
 			commandKey: privmsgCmd,
-			toKey:      "#test",
+			toKey:      "#chat",
 			bodyKey:    []string{"hello world"},
 		},
 	)
-	if status != http.StatusOK {
+	if status != http.StatusCreated {
 		t.Fatalf(
-			"expected 200, got %d: %v", status, result,
+			"expected 201, got %d: %v", status, result,
 		)
 	}

@@ -732,21 +725,14 @@ func TestMessageMissingBody(t *testing.T) {
 	token := tserver.createSession("nobody")

 	tserver.sendCommand(token, map[string]any{
-		commandKey: joinCmd, toKey: "#test",
+		commandKey: joinCmd, toKey: "#chat",
 	})

-	status, result := tserver.sendCommand(token, map[string]any{
-		commandKey: privmsgCmd, toKey: "#test",
+	status, _ := tserver.sendCommand(token, map[string]any{
+		commandKey: privmsgCmd, toKey: "#chat",
 	})
-	if status != http.StatusOK {
-		t.Fatalf("expected 200, got %d", status)
-	}
-
-	if result[commandKey] != "412" {
-		t.Fatalf(
-			"expected IRC 412, got %v",
-			result[commandKey],
-		)
+	if status != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", status)
 	}
 }

@@ -754,19 +740,12 @@ func TestMessageMissingTo(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("noto")

-	status, result := tserver.sendCommand(token, map[string]any{
+	status, _ := tserver.sendCommand(token, map[string]any{
 		commandKey: privmsgCmd,
 		bodyKey:    []string{"hello"},
 	})
-	if status != http.StatusOK {
-		t.Fatalf("expected 200, got %d", status)
-	}
-
-	if result[commandKey] != "411" {
-		t.Fatalf(
-			"expected IRC 411, got %v",
-			result[commandKey],
-		)
+	if status != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", status)
 	}
 }

@@ -781,7 +760,7 @@ func TestNonMemberCannotSend(t *testing.T) {
 	})

 	// Alice tries to send without joining.
-	status, result := tserver.sendCommand(
+	status, _ := tserver.sendCommand(
 		aliceToken,
 		map[string]any{
 			commandKey: privmsgCmd,
@@ -789,15 +768,8 @@ func TestNonMemberCannotSend(t *testing.T) {
 			bodyKey:    []string{"sneaky"},
 		},
 	)
-	if status != http.StatusOK {
-		t.Fatalf("expected 200, got %d", status)
-	}
-
-	if result[commandKey] != "442" {
-		t.Fatalf(
-			"expected IRC 442, got %v",
-			result[commandKey],
-		)
+	if status != http.StatusForbidden {
+		t.Fatalf("expected 403, got %d", status)
 	}
 }

@@ -814,9 +786,9 @@ func TestDirectMessage(t *testing.T) {
 			bodyKey:    []string{"hey bob"},
 		},
 	)
-	if status != http.StatusOK {
+	if status != http.StatusCreated {
 		t.Fatalf(
-			"expected 200, got %d: %v", status, result,
+			"expected 201, got %d: %v", status, result,
 		)
 	}

@@ -846,20 +818,13 @@ func TestDMToNonexistentUser(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("dmsender")

-	status, result := tserver.sendCommand(token, map[string]any{
+	status, _ := tserver.sendCommand(token, map[string]any{
 		commandKey: privmsgCmd,
 		toKey:      "nobody",
 		bodyKey:    []string{"hello?"},
 	})
-	if status != http.StatusOK {
-		t.Fatalf("expected 200, got %d", status)
-	}
-
-	if result[commandKey] != "401" {
-		t.Fatalf(
-			"expected IRC 401, got %v",
-			result[commandKey],
-		)
+	if status != http.StatusNotFound {
+		t.Fatalf("expected 404, got %d", status)
 	}
 }

@@ -906,19 +871,12 @@ func TestNickCollision(t *testing.T) {

 	tserver.createSession("taken_nick")

-	status, result := tserver.sendCommand(token, map[string]any{
+	status, _ := tserver.sendCommand(token, map[string]any{
 		commandKey: "NICK",
 		bodyKey:    []string{"taken_nick"},
 	})
-	if status != http.StatusOK {
-		t.Fatalf("expected 200, got %d", status)
-	}
-
-	if result[commandKey] != "433" {
-		t.Fatalf(
-			"expected IRC 433, got %v",
-			result[commandKey],
-		)
+	if status != http.StatusConflict {
+		t.Fatalf("expected 409, got %d", status)
 	}
 }

@@ -926,19 +884,12 @@ func TestNickInvalid(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("nickval")

-	status, result := tserver.sendCommand(token, map[string]any{
+	status, _ := tserver.sendCommand(token, map[string]any{
 		commandKey: "NICK",
 		bodyKey:    []string{"bad nick!"},
 	})
-	if status != http.StatusOK {
-		t.Fatalf("expected 200, got %d", status)
-	}
-
-	if result[commandKey] != "432" {
-		t.Fatalf(
-			"expected IRC 432, got %v",
-			result[commandKey],
-		)
+	if status != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", status)
 	}
 }

@@ -946,18 +897,11 @@ func TestNickEmptyBody(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("nicknobody")

-	status, result := tserver.sendCommand(
+	status, _ := tserver.sendCommand(
 		token, map[string]any{commandKey: "NICK"},
 	)
-	if status != http.StatusOK {
-		t.Fatalf("expected 200, got %d", status)
-	}
-
-	if result[commandKey] != "431" {
-		t.Fatalf(
-			"expected IRC 431, got %v",
-			result[commandKey],
-		)
+	if status != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", status)
 	}
 }

@@ -994,19 +938,12 @@ func TestTopicMissingTo(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("topicnoto")

-	status, result := tserver.sendCommand(token, map[string]any{
+	status, _ := tserver.sendCommand(token, map[string]any{
 		commandKey: "TOPIC",
 		bodyKey:    []string{"topic"},
 	})
-	if status != http.StatusOK {
-		t.Fatalf("expected 200, got %d", status)
-	}
-
-	if result[commandKey] != "461" {
-		t.Fatalf(
-			"expected IRC 461, got %v",
-			result[commandKey],
-		)
+	if status != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", status)
 	}
 }

@@ -1018,18 +955,11 @@ func TestTopicMissingBody(t *testing.T) {
 		commandKey: joinCmd, toKey: "#topictest",
 	})

-	status, result := tserver.sendCommand(token, map[string]any{
+	status, _ := tserver.sendCommand(token, map[string]any{
 		commandKey: "TOPIC", toKey: "#topictest",
 	})
-	if status != http.StatusOK {
-		t.Fatalf("expected 200, got %d", status)
-	}
-
-	if result[commandKey] != "461" {
-		t.Fatalf(
-			"expected IRC 461, got %v",
-			result[commandKey],
-		)
+	if status != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", status)
 	}
 }

@@ -1097,18 +1027,11 @@ func TestUnknownCommand(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("cmdtest")

-	status, result := tserver.sendCommand(
+	status, _ := tserver.sendCommand(
 		token, map[string]any{commandKey: "BOGUS"},
 	)
-	if status != http.StatusOK {
-		t.Fatalf("expected 200, got %d", status)
-	}
-
-	if result[commandKey] != "421" {
-		t.Fatalf(
-			"expected IRC 421, got %v",
-			result[commandKey],
-		)
+	if status != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", status)
 	}
 }

@@ -1116,18 +1039,11 @@ func TestEmptyCommand(t *testing.T) {
 	tserver := newTestServer(t)
 	token := tserver.createSession("emptycmd")

-	status, result := tserver.sendCommand(
+	status, _ := tserver.sendCommand(
 		token, map[string]any{commandKey: ""},
 	)
-	if status != http.StatusOK {
-		t.Fatalf("expected 200, got %d", status)
-	}
-
-	if result[commandKey] != "421" {
-		t.Fatalf(
-			"expected IRC 421, got %v",
-			result[commandKey],
-		)
+	if status != http.StatusBadRequest {
+		t.Fatalf("expected 400, got %d", status)
 	}
 }

@@ -1553,310 +1469,6 @@ func TestHealthcheck(t *testing.T) {
 	}
 }

-func TestRegisterValid(t *testing.T) {
-	tserver := newTestServer(t)
-
-	body, err := json.Marshal(map[string]string{
-		"nick": "reguser", "password": "password123",
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	resp, err := doRequest(
-		t,
-		http.MethodPost,
-		tserver.url("/api/v1/register"),
-		bytes.NewReader(body),
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	defer func() { _ = resp.Body.Close() }()
-
-	if resp.StatusCode != http.StatusCreated {
-		respBody, _ := io.ReadAll(resp.Body)
-		t.Fatalf(
-			"expected 201, got %d: %s",
-			resp.StatusCode, respBody,
-		)
-	}
-
-	var result map[string]any
-
-	_ = json.NewDecoder(resp.Body).Decode(&result)
-
-	if result["token"] == nil || result["token"] == "" {
-		t.Fatal("expected token in response")
-	}
-
-	if result["nick"] != "reguser" {
-		t.Fatalf(
-			"expected reguser, got %v", result["nick"],
-		)
-	}
-}
-
-func TestRegisterDuplicate(t *testing.T) {
-	tserver := newTestServer(t)
-
-	body, err := json.Marshal(map[string]string{
-		"nick": "dupuser", "password": "password123",
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	resp, err := doRequest(
-		t,
-		http.MethodPost,
-		tserver.url("/api/v1/register"),
-		bytes.NewReader(body),
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	_ = resp.Body.Close()
-
-	resp2, err := doRequest(
-		t,
-		http.MethodPost,
-		tserver.url("/api/v1/register"),
-		bytes.NewReader(body),
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	defer func() { _ = resp2.Body.Close() }()
-
-	if resp2.StatusCode != http.StatusConflict {
-		t.Fatalf("expected 409, got %d", resp2.StatusCode)
-	}
-}
-
-func postJSONExpectStatus(
-	t *testing.T,
-	tserver *testServer,
-	path string,
-	payload map[string]string,
-	expectedStatus int,
-) {
-	t.Helper()
-
-	body, err := json.Marshal(payload)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	resp, err := doRequest(
-		t,
-		http.MethodPost,
-		tserver.url(path),
-		bytes.NewReader(body),
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	defer func() { _ = resp.Body.Close() }()
-
-	if resp.StatusCode != expectedStatus {
-		t.Fatalf(
-			"expected %d, got %d",
-			expectedStatus, resp.StatusCode,
-		)
-	}
-}
-
-func TestRegisterShortPassword(t *testing.T) {
-	tserver := newTestServer(t)
-
-	postJSONExpectStatus(
-		t, tserver, "/api/v1/register",
-		map[string]string{
-			"nick": "shortpw", "password": "short",
-		},
-		http.StatusBadRequest,
-	)
-}
-
-func TestRegisterInvalidNick(t *testing.T) {
-	tserver := newTestServer(t)
-
-	postJSONExpectStatus(
-		t, tserver, "/api/v1/register",
-		map[string]string{
-			"nick":     "bad nick!",
-			"password": "password123",
-		},
-		http.StatusBadRequest,
-	)
-}
-
-func TestLoginValid(t *testing.T) {
-	tserver := newTestServer(t)
-
-	// Register first.
-	regBody, err := json.Marshal(map[string]string{
-		"nick": "loginuser", "password": "password123",
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	resp, err := doRequest(
-		t,
-		http.MethodPost,
-		tserver.url("/api/v1/register"),
-		bytes.NewReader(regBody),
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	_ = resp.Body.Close()
-
-	// Login.
-	loginBody, err := json.Marshal(map[string]string{
-		"nick": "loginuser", "password": "password123",
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	resp2, err := doRequest(
-		t,
-		http.MethodPost,
-		tserver.url("/api/v1/login"),
-		bytes.NewReader(loginBody),
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	defer func() { _ = resp2.Body.Close() }()
-
-	if resp2.StatusCode != http.StatusOK {
-		respBody, _ := io.ReadAll(resp2.Body)
-		t.Fatalf(
-			"expected 200, got %d: %s",
-			resp2.StatusCode, respBody,
-		)
-	}
-
-	var result map[string]any
-
-	_ = json.NewDecoder(resp2.Body).Decode(&result)
-
-	if result["token"] == nil || result["token"] == "" {
-		t.Fatal("expected token in response")
-	}
-
-	// Verify token works.
-	token, ok := result["token"].(string)
-	if !ok {
-		t.Fatal("token not a string")
-	}
-
-	status, state := tserver.getState(token)
-	if status != http.StatusOK {
-		t.Fatalf("expected 200, got %d", status)
-	}
-
-	if state["nick"] != "loginuser" {
-		t.Fatalf(
-			"expected loginuser, got %v",
-			state["nick"],
-		)
-	}
-}
-
-func TestLoginWrongPassword(t *testing.T) {
-	tserver := newTestServer(t)
-
-	regBody, err := json.Marshal(map[string]string{
-		"nick": "wrongpwuser", "password": "correctpass1",
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	resp, err := doRequest(
-		t,
-		http.MethodPost,
-		tserver.url("/api/v1/register"),
-		bytes.NewReader(regBody),
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	_ = resp.Body.Close()
-
-	loginBody, err := json.Marshal(map[string]string{
-		"nick": "wrongpwuser", "password": "wrongpass12",
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	resp2, err := doRequest(
-		t,
-		http.MethodPost,
-		tserver.url("/api/v1/login"),
-		bytes.NewReader(loginBody),
-	)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	defer func() { _ = resp2.Body.Close() }()
-
-	if resp2.StatusCode != http.StatusUnauthorized {
-		t.Fatalf(
-			"expected 401, got %d", resp2.StatusCode,
-		)
-	}
-}
-
-func TestLoginNonexistentUser(t *testing.T) {
-	tserver := newTestServer(t)
-
-	postJSONExpectStatus(
-		t, tserver, "/api/v1/login",
-		map[string]string{
-			"nick":     "ghostuser",
-			"password": "password123",
-		},
-		http.StatusUnauthorized,
-	)
-}
-
-func TestSessionStillWorks(t *testing.T) {
-	tserver := newTestServer(t)
-
-	// Verify anonymous session creation still works.
-	token := tserver.createSession("anon_user")
-	if token == "" {
-		t.Fatal("expected token for anonymous session")
-	}
-
-	status, state := tserver.getState(token)
-	if status != http.StatusOK {
-		t.Fatalf("expected 200, got %d", status)
-	}
-
-	if state["nick"] != "anon_user" {
-		t.Fatalf(
-			"expected anon_user, got %v",
-			state["nick"],
-		)
-	}
-}
-
 func TestNickBroadcastToChannels(t *testing.T) {
 	tserver := newTestServer(t)
 	aliceToken := tserver.createSession("nick_a")
--- a/internal/handlers/auth.go
+++ b/internal/handlers/auth.go
@@ -1,186 +0,0 @@
-package handlers
-
-import (
-	"encoding/json"
-	"net/http"
-	"strings"
-)
-
-const minPasswordLength = 8
-
-// HandleRegister creates a new user with a password.
-func (hdlr *Handlers) HandleRegister() http.HandlerFunc {
-	return func(
-		writer http.ResponseWriter,
-		request *http.Request,
-	) {
-		request.Body = http.MaxBytesReader(
-			writer, request.Body, hdlr.maxBodySize(),
-		)
-
-		hdlr.handleRegister(writer, request)
-	}
-}
-
-func (hdlr *Handlers) handleRegister(
-	writer http.ResponseWriter,
-	request *http.Request,
-) {
-	type registerRequest struct {
-		Nick     string `json:"nick"`
-		Password string `json:"password"`
-	}
-
-	var payload registerRequest
-
-	err := json.NewDecoder(request.Body).Decode(&payload)
-	if err != nil {
-		hdlr.respondError(
-			writer, request,
-			"invalid request body",
-			http.StatusBadRequest,
-		)
-
-		return
-	}
-
-	payload.Nick = strings.TrimSpace(payload.Nick)
-
-	if !validNickRe.MatchString(payload.Nick) {
-		hdlr.respondError(
-			writer, request,
-			"invalid nick format",
-			http.StatusBadRequest,
-		)
-
-		return
-	}
-
-	if len(payload.Password) < minPasswordLength {
-		hdlr.respondError(
-			writer, request,
-			"password must be at least 8 characters",
-			http.StatusBadRequest,
-		)
-
-		return
-	}
-
-	sessionID, clientID, token, err :=
-		hdlr.params.Database.RegisterUser(
-			request.Context(),
-			payload.Nick,
-			payload.Password,
-		)
-	if err != nil {
-		hdlr.handleRegisterError(
-			writer, request, err,
-		)
-
-		return
-	}
-
-	hdlr.deliverMOTD(request, clientID, sessionID)
-
-	hdlr.respondJSON(writer, request, map[string]any{
-		"id":    sessionID,
-		"nick":  payload.Nick,
-		"token": token,
-	}, http.StatusCreated)
-}
-
-func (hdlr *Handlers) handleRegisterError(
-	writer http.ResponseWriter,
-	request *http.Request,
-	err error,
-) {
-	if strings.Contains(err.Error(), "UNIQUE") {
-		hdlr.respondError(
-			writer, request,
-			"nick already taken",
-			http.StatusConflict,
-		)
-
-		return
-	}
-
-	hdlr.log.Error(
-		"register user failed", "error", err,
-	)
-	hdlr.respondError(
-		writer, request,
-		"internal error",
-		http.StatusInternalServerError,
-	)
-}
-
-// HandleLogin authenticates a user with nick and password.
-func (hdlr *Handlers) HandleLogin() http.HandlerFunc {
-	return func(
-		writer http.ResponseWriter,
-		request *http.Request,
-	) {
-		request.Body = http.MaxBytesReader(
-			writer, request.Body, hdlr.maxBodySize(),
-		)
-
-		hdlr.handleLogin(writer, request)
-	}
-}
-
-func (hdlr *Handlers) handleLogin(
-	writer http.ResponseWriter,
-	request *http.Request,
-) {
-	type loginRequest struct {
-		Nick     string `json:"nick"`
-		Password string `json:"password"`
-	}
-
-	var payload loginRequest
-
-	err := json.NewDecoder(request.Body).Decode(&payload)
-	if err != nil {
-		hdlr.respondError(
-			writer, request,
-			"invalid request body",
-			http.StatusBadRequest,
-		)
-
-		return
-	}
-
-	payload.Nick = strings.TrimSpace(payload.Nick)
-
-	if payload.Nick == "" || payload.Password == "" {
-		hdlr.respondError(
-			writer, request,
-			"nick and password required",
-			http.StatusBadRequest,
-		)
-
-		return
-	}
-
-	sessionID, _, token, err :=
-		hdlr.params.Database.LoginUser(
-			request.Context(),
-			payload.Nick,
-			payload.Password,
-		)
-	if err != nil {
-		hdlr.respondError(
-			writer, request,
-			"invalid credentials",
-			http.StatusUnauthorized,
-		)
-
-		return
-	}
-
-	hdlr.respondJSON(writer, request, map[string]any{
-		"id":    sessionID,
-		"nick":  payload.Nick,
-		"token": token,
-	}, http.StatusOK)
-}
--- a/internal/handlers/handlers.go
+++ b/internal/handlers/handlers.go
@@ -1,4 +1,4 @@
-// Package handlers provides HTTP request handlers for the neoirc server.
+// Package handlers provides HTTP request handlers for the chat server.
 package handlers

 import (
@@ -9,12 +9,12 @@ import (
 	"net/http"
 	"time"

-	"git.eeqj.de/sneak/neoirc/internal/broker"
-	"git.eeqj.de/sneak/neoirc/internal/config"
-	"git.eeqj.de/sneak/neoirc/internal/db"
-	"git.eeqj.de/sneak/neoirc/internal/globals"
-	"git.eeqj.de/sneak/neoirc/internal/healthcheck"
-	"git.eeqj.de/sneak/neoirc/internal/logger"
+	"git.eeqj.de/sneak/chat/internal/broker"
+	"git.eeqj.de/sneak/chat/internal/config"
+	"git.eeqj.de/sneak/chat/internal/db"
+	"git.eeqj.de/sneak/chat/internal/globals"
+	"git.eeqj.de/sneak/chat/internal/healthcheck"
+	"git.eeqj.de/sneak/chat/internal/logger"
 	"go.uber.org/fx"
 )

@@ -124,16 +124,8 @@ func (hdlr *Handlers) idleTimeout() time.Duration {
 	return dur
 }

-// startCleanup launches the idle-user cleanup goroutine.
-// We use context.Background rather than the OnStart ctx
-// because the OnStart context is startup-scoped and would
-// cancel the goroutine once all start hooks complete.
-//
-//nolint:contextcheck // intentional Background ctx
-func (hdlr *Handlers) startCleanup(_ context.Context) {
-	cleanupCtx, cancel := context.WithCancel(
-		context.Background(),
-	)
+func (hdlr *Handlers) startCleanup(ctx context.Context) {
+	cleanupCtx, cancel := context.WithCancel(ctx)
 	hdlr.cancelCleanup = cancel

 	go hdlr.cleanupLoop(cleanupCtx)
@@ -169,26 +161,12 @@ func (hdlr *Handlers) runCleanup(
 ) {
 	cutoff := time.Now().Add(-timeout)

-	// Find sessions that will be orphaned so we can send
-	// QUIT notifications before deleting anything.
-	stale, err := hdlr.params.Database.
-		GetStaleOrphanSessions(ctx, cutoff)
-	if err != nil {
-		hdlr.log.Error(
-			"stale session lookup failed", "error", err,
-		)
-	}
-
-	for _, ss := range stale {
-		hdlr.cleanupUser(ctx, ss.ID, ss.Nick)
-	}
-
-	deleted, err := hdlr.params.Database.DeleteStaleUsers(
+	deleted, err := hdlr.params.Database.DeleteStaleSessions(
 		ctx, cutoff,
 	)
 	if err != nil {
 		hdlr.log.Error(
-			"user cleanup failed", "error", err,
+			"session cleanup failed", "error", err,
 		)

 		return
@@ -196,7 +174,7 @@ func (hdlr *Handlers) runCleanup(

 	if deleted > 0 {
 		hdlr.log.Info(
-			"cleaned up stale users",
+			"cleaned up stale clients",
 			"deleted", deleted,
 		)
 	}
--- a/internal/healthcheck/healthcheck.go
+++ b/internal/healthcheck/healthcheck.go
@@ -6,10 +6,10 @@ import (
 	"log/slog"
 	"time"

-	"git.eeqj.de/sneak/neoirc/internal/config"
-	"git.eeqj.de/sneak/neoirc/internal/db"
-	"git.eeqj.de/sneak/neoirc/internal/globals"
-	"git.eeqj.de/sneak/neoirc/internal/logger"
+	"git.eeqj.de/sneak/chat/internal/config"
+	"git.eeqj.de/sneak/chat/internal/db"
+	"git.eeqj.de/sneak/chat/internal/globals"
+	"git.eeqj.de/sneak/chat/internal/logger"
 	"go.uber.org/fx"
 )

--- a/internal/logger/logger.go
+++ b/internal/logger/logger.go
@@ -5,7 +5,7 @@ import (
 	"log/slog"
 	"os"

-	"git.eeqj.de/sneak/neoirc/internal/globals"
+	"git.eeqj.de/sneak/chat/internal/globals"
 	"go.uber.org/fx"
 )

--- a/internal/middleware/middleware.go
+++ b/internal/middleware/middleware.go
@@ -1,4 +1,4 @@
-// Package middleware provides HTTP middleware for the neoirc server.
+// Package middleware provides HTTP middleware for the chat server.
 package middleware

 import (
@@ -7,9 +7,9 @@ import (
 	"net/http"
 	"time"

-	"git.eeqj.de/sneak/neoirc/internal/config"
-	"git.eeqj.de/sneak/neoirc/internal/globals"
-	"git.eeqj.de/sneak/neoirc/internal/logger"
+	"git.eeqj.de/sneak/chat/internal/config"
+	"git.eeqj.de/sneak/chat/internal/globals"
+	"git.eeqj.de/sneak/chat/internal/logger"
 	basicauth "github.com/99designs/basicauth-go"
 	chimw "github.com/go-chi/chi/middleware"
 	"github.com/go-chi/cors"
--- a/internal/server/routes.go
+++ b/internal/server/routes.go
@@ -5,7 +5,7 @@ import (
 	"net/http"
 	"time"

-	"git.eeqj.de/sneak/neoirc/web"
+	"git.eeqj.de/sneak/chat/web"

 	sentryhttp "github.com/getsentry/sentry-go/http"
 	"github.com/go-chi/chi"
@@ -74,14 +74,6 @@ func (srv *Server) setupAPIv1(router chi.Router) {
 		"/session",
 		srv.handlers.HandleCreateSession(),
 	)
-	router.Post(
-		"/register",
-		srv.handlers.HandleRegister(),
-	)
-	router.Post(
-		"/login",
-		srv.handlers.HandleLogin(),
-	)
 	router.Get(
 		"/state",
 		srv.handlers.HandleState(),
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -1,4 +1,4 @@
-// Package server implements the main HTTP server for the neoirc application.
+// Package server implements the main HTTP server for the chat application.
 package server

 import (
@@ -12,11 +12,11 @@ import (
 	"syscall"
 	"time"

-	"git.eeqj.de/sneak/neoirc/internal/config"
-	"git.eeqj.de/sneak/neoirc/internal/globals"
-	"git.eeqj.de/sneak/neoirc/internal/handlers"
-	"git.eeqj.de/sneak/neoirc/internal/logger"
-	"git.eeqj.de/sneak/neoirc/internal/middleware"
+	"git.eeqj.de/sneak/chat/internal/config"
+	"git.eeqj.de/sneak/chat/internal/globals"
+	"git.eeqj.de/sneak/chat/internal/handlers"
+	"git.eeqj.de/sneak/chat/internal/logger"
+	"git.eeqj.de/sneak/chat/internal/middleware"
 	"go.uber.org/fx"

 	"github.com/getsentry/sentry-go"
--- a/schema/README.md
+++ b/schema/README.md
@@ -1,6 +1,6 @@
 # Message Schemas

-JSON Schema definitions (draft 2020-12) for the neoirc protocol. Messages use
+JSON Schema definitions (draft 2020-12) for the chat protocol. Messages use
 **IRC command names and numeric reply codes** (RFC 1459/2812) encoded as JSON
 over HTTP.

--- a/schema/commands/JOIN.json
+++ b/schema/commands/JOIN.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/JOIN.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/commands/JOIN.json",
  "title": "JOIN",
  "description": "Join a channel. C2S: request to join. S2C: notification that a user joined. RFC 1459 §4.2.1.",
  "$ref": "../message.json",
--- a/schema/commands/KICK.json
+++ b/schema/commands/KICK.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/KICK.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/commands/KICK.json",
  "title": "KICK",
  "description": "Kick a user from a channel. RFC 1459 §4.2.8.",
  "$ref": "../message.json",
--- a/schema/commands/MODE.json
+++ b/schema/commands/MODE.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/MODE.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/commands/MODE.json",
  "title": "MODE",
  "description": "Set or query channel/user modes. RFC 1459 §4.2.3.",
  "$ref": "../message.json",
--- a/schema/commands/NICK.json
+++ b/schema/commands/NICK.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/NICK.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/commands/NICK.json",
  "title": "NICK",
  "description": "Change nickname. C2S: request new nick. S2C: notification of nick change. RFC 1459 §4.1.2.",
  "$ref": "../message.json",
--- a/schema/commands/NOTICE.json
+++ b/schema/commands/NOTICE.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/NOTICE.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/commands/NOTICE.json",
  "title": "NOTICE",
  "description": "Send a notice. Like PRIVMSG but must not trigger automatic replies. RFC 1459 §4.4.2.",
  "$ref": "../message.json",
--- a/schema/commands/PART.json
+++ b/schema/commands/PART.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/PART.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/commands/PART.json",
  "title": "PART",
  "description": "Leave a channel. C2S: request to leave. S2C: notification that a user left. RFC 1459 §4.2.2.",
  "$ref": "../message.json",
--- a/schema/commands/PING.json
+++ b/schema/commands/PING.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/PING.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/commands/PING.json",
  "title": "PING",
  "description": "Keepalive. C2S or S2S. Server responds with PONG. RFC 1459 §4.6.2.",
  "$ref": "../message.json",
--- a/schema/commands/PONG.json
+++ b/schema/commands/PONG.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/PONG.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/commands/PONG.json",
  "title": "PONG",
  "description": "Keepalive response. S2C or S2S. RFC 1459 §4.6.3.",
  "$ref": "../message.json",
--- a/schema/commands/PRIVMSG.json
+++ b/schema/commands/PRIVMSG.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/PRIVMSG.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/commands/PRIVMSG.json",
  "title": "PRIVMSG",
  "description": "Send a message to a channel or user. C2S: client sends to server. S2C: server relays to recipients. RFC 1459 §4.4.1.",
  "$ref": "../message.json",
--- a/schema/commands/PUBKEY.json
+++ b/schema/commands/PUBKEY.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/PUBKEY.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/commands/PUBKEY.json",
  "title": "PUBKEY",
  "description": "Announce or relay a user's public signing key. C2S: client announces key to channel or server. S2C: server relays to channel members. Protocol extension (not in RFC 1459). Body is a structured object (not an array) containing the key material.",
  "$ref": "../message.json",
--- a/schema/commands/QUIT.json
+++ b/schema/commands/QUIT.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/QUIT.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/commands/QUIT.json",
  "title": "QUIT",
  "description": "User disconnected. S2C only. RFC 1459 §4.1.6.",
  "$ref": "../message.json",
--- a/schema/commands/TOPIC.json
+++ b/schema/commands/TOPIC.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/commands/TOPIC.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/commands/TOPIC.json",
  "title": "TOPIC",
  "description": "Get or set channel topic. C2S: set topic (body present) or query (body absent). S2C: topic change notification. RFC 1459 §4.2.4.",
  "$ref": "../message.json",
@@ -17,6 +17,6 @@
  },
  "required": ["command", "to"],
  "examples": [
-    { "command": "TOPIC", "from": "alice", "to": "#general", "body": ["Welcome to the channel"] }
+    { "command": "TOPIC", "from": "alice", "to": "#general", "body": ["Welcome to the chat"] }
  ]
 }
--- a/schema/message.json
+++ b/schema/message.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/message.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/message.json",
  "title": "IRC Message Envelope",
  "description": "Base envelope for all messages. Mirrors IRC wire format (RFC 1459/2812) encoded as JSON over HTTP. The 'command' field carries either an IRC command name (PRIVMSG, JOIN, etc.) or a three-digit numeric reply code (001, 353, 433, etc.).",
  "type": "object",
--- a/schema/numerics/001.json
+++ b/schema/numerics/001.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/001.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/numerics/001.json",
  "title": "001 RPL_WELCOME",
  "description": "Welcome message sent after successful session creation. RFC 2812 \u00a75.1.",
  "$ref": "../message.json",
--- a/schema/numerics/002.json
+++ b/schema/numerics/002.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/002.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/numerics/002.json",
  "title": "002 RPL_YOURHOST",
  "description": "Server host info sent after session creation. RFC 2812 \u00a75.1.",
  "$ref": "../message.json",
@@ -29,7 +29,7 @@
      "command": "002",
      "to": "alice",
      "body": [
-        "Your host is neoirc.example.com, running version 0.1.0"
+        "Your host is chat.example.com, running version 0.1.0"
      ]
    }
  ]
--- a/schema/numerics/003.json
+++ b/schema/numerics/003.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/003.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/numerics/003.json",
  "title": "003 RPL_CREATED",
  "description": "Server creation date. RFC 2812 \u00a75.1.",
  "$ref": "../message.json",
--- a/schema/numerics/004.json
+++ b/schema/numerics/004.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/004.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/numerics/004.json",
  "title": "004 RPL_MYINFO",
  "description": "Server info (name, version, available modes). RFC 2812 \u00a75.1.",
  "$ref": "../message.json",
@@ -29,7 +29,7 @@
      "command": "004",
      "to": "alice",
      "params": [
-        "neoirc.example.com",
+        "chat.example.com",
        "0.1.0",
        "o",
        "imnst+ov"
--- a/schema/numerics/322.json
+++ b/schema/numerics/322.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/322.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/numerics/322.json",
  "title": "322 RPL_LIST",
  "description": "Channel list entry. One per channel in response to LIST. RFC 1459 \u00a76.2.",
  "$ref": "../message.json",
--- a/schema/numerics/323.json
+++ b/schema/numerics/323.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/323.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/numerics/323.json",
  "title": "323 RPL_LISTEND",
  "description": "End of channel list. RFC 1459 \u00a76.2.",
  "$ref": "../message.json",
--- a/schema/numerics/332.json
+++ b/schema/numerics/332.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/332.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/numerics/332.json",
  "title": "332 RPL_TOPIC",
  "description": "Channel topic (sent on JOIN or TOPIC query). RFC 1459 \u00a76.2.",
  "$ref": "../message.json",
@@ -40,7 +40,7 @@
        "#general"
      ],
      "body": [
-        "Welcome to the channel"
+        "Welcome to the chat"
      ]
    }
  ]
--- a/schema/numerics/353.json
+++ b/schema/numerics/353.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/353.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/numerics/353.json",
  "title": "353 RPL_NAMREPLY",
  "description": "Channel member list. Sent on JOIN or NAMES query. RFC 1459 \u00a76.2.",
  "$ref": "../message.json",
--- a/schema/numerics/366.json
+++ b/schema/numerics/366.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/366.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/numerics/366.json",
  "title": "366 RPL_ENDOFNAMES",
  "description": "End of NAMES list. RFC 1459 \u00a76.2.",
  "$ref": "../message.json",
--- a/schema/numerics/372.json
+++ b/schema/numerics/372.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/372.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/numerics/372.json",
  "title": "372 RPL_MOTD",
  "description": "MOTD line. One message per line of the MOTD. RFC 2812 \u00a75.1.",
  "$ref": "../message.json",
--- a/schema/numerics/375.json
+++ b/schema/numerics/375.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/375.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/numerics/375.json",
  "title": "375 RPL_MOTDSTART",
  "description": "Start of MOTD. RFC 2812 \u00a75.1.",
  "$ref": "../message.json",
--- a/schema/numerics/376.json
+++ b/schema/numerics/376.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/376.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/numerics/376.json",
  "title": "376 RPL_ENDOFMOTD",
  "description": "End of MOTD. RFC 2812 \u00a75.1.",
  "$ref": "../message.json",
--- a/schema/numerics/401.json
+++ b/schema/numerics/401.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/401.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/numerics/401.json",
  "title": "401 ERR_NOSUCHNICK",
  "description": "No such nick/channel. RFC 1459 \u00a76.1.",
  "$ref": "../message.json",
--- a/schema/numerics/403.json
+++ b/schema/numerics/403.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/403.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/numerics/403.json",
  "title": "403 ERR_NOSUCHCHANNEL",
  "description": "No such channel. RFC 1459 \u00a76.1.",
  "$ref": "../message.json",
--- a/schema/numerics/433.json
+++ b/schema/numerics/433.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/433.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/numerics/433.json",
  "title": "433 ERR_NICKNAMEINUSE",
  "description": "Nickname is already in use. RFC 1459 \u00a76.1.",
  "$ref": "../message.json",
--- a/schema/numerics/442.json
+++ b/schema/numerics/442.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/442.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/numerics/442.json",
  "title": "442 ERR_NOTONCHANNEL",
  "description": "You're not on that channel. RFC 1459 \u00a76.1.",
  "$ref": "../message.json",
--- a/schema/numerics/482.json
+++ b/schema/numerics/482.json
@@ -1,6 +1,6 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.eeqj.de/sneak/neoirc/schema/numerics/482.json",
+  "$id": "https://git.eeqj.de/sneak/chat/schema/numerics/482.json",
  "title": "482 ERR_CHANOPRIVSNEEDED",
  "description": "You're not channel operator. RFC 1459 \u00a76.1.",
  "$ref": "../message.json",
--- a/web/build.sh
+++ b/web/build.sh
@@ -16,11 +16,19 @@ fi

 mkdir -p dist

-# Build JS bundle — preact must be bundled (no CDN/external loader)
+# Build JS bundle
+${NPX:+$NPX} esbuild src/app.jsx \
+  --bundle \
+  --minify \
+  --jsx-factory=h \
+  --jsx-fragment=Fragment \
+  --define:process.env.NODE_ENV=\"production\" \
+  --external:preact \
+  --outfile=dist/app.js \
+  2>/dev/null || \
 ${NPX:+$NPX} esbuild src/app.jsx \
  --bundle \
  --minify \
-  --format=esm \
  --jsx-factory=h \
  --jsx-fragment=Fragment \
  --define:process.env.NODE_ENV=\"production\" \
--- a/web/dist/app.js
+++ b/web/dist/app.js
--- a/web/dist/index.html
+++ b/web/dist/index.html
@@ -3,11 +3,11 @@
 <head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>NeoIRC</title>
+  <title>Chat</title>
  <link rel="stylesheet" href="/style.css">
 </head>
 <body>
  <div id="root"></div>
-  <script type="module" src="/app.js"></script>
+  <script src="/app.js"></script>
 </body>
 </html>
--- a/web/dist/style.css
+++ b/web/dist/style.css
@@ -1,466 +1,317 @@
-* {
-  margin: 0;
-  padding: 0;
-  box-sizing: border-box;
-}
+* { margin: 0; padding: 0; box-sizing: border-box; }

 :root {
-  --bg: #0a0e14;
-  --bg-panel: #0d1117;
-  --bg-input: #0d1117;
-  --bg-tab: #161b22;
-  --bg-tab-active: #0d1117;
-  --bg-topic: #0d1117;
-  --text: #c9d1d9;
-  --text-dim: #6e7681;
-  --text-bright: #e6edf3;
-  --accent: #58a6ff;
-  --accent-dim: #1f6feb;
-  --border: #21262d;
-  --system: #7d8590;
-  --action: #d2a8ff;
-  --warn: #d29922;
-  --error: #f85149;
-  --unread: #f0883e;
-  --nick-brackets: #6e7681;
-  --timestamp: #484f58;
-  --input-bg: #161b22;
-  --prompt: #3fb950;
-  --tab-indicator: #58a6ff;
-  --user-list-bg: #0d1117;
-  --user-list-header: #484f58;
+  --bg: #1a1a2e;
+  --bg-secondary: #16213e;
+  --bg-input: #0f3460;
+  --text: #e0e0e0;
+  --text-muted: #888;
+  --accent: #e94560;
+  --accent2: #0f3460;
+  --border: #2a2a4a;
+  --nick: #53a8b6;
+  --timestamp: #666;
+  --tab-active: #e94560;
+  --tab-bg: #16213e;
+  --tab-hover: #1a1a3e;
+  --topic-bg: #121a30;
+  --unread-bg: #e94560;
+  --warn: #f0ad4e;
 }

-html,
-body,
-#root {
+html, body, #root {
  height: 100%;
-  font-family: "JetBrains Mono", "Cascadia Code", "Fira Code", "SF Mono",
-    "Consolas", "Liberation Mono", "Courier New", monospace;
-  font-size: 13px;
+  font-family: 'Courier New', Courier, monospace;
+  font-size: 14px;
  background: var(--bg);
  color: var(--text);
-  overflow: hidden;
 }

-/* ============================================
-   Login Screen
-   ============================================ */
-
+/* Login screen */
 .login-screen {
  display: flex;
+  flex-direction: column;
  align-items: center;
  justify-content: center;
  height: 100%;
-  background: var(--bg);
+  gap: 16px;
 }

-.login-box {
-  text-align: center;
-  max-width: 360px;
-  width: 100%;
-  padding: 32px;
-}
-
-.login-box h1 {
+.login-screen h1 {
  color: var(--accent);
-  font-size: 1.8em;
-  margin-bottom: 16px;
-  font-weight: 400;
+  font-size: 2em;
 }

-.login-box .motd {
-  color: var(--text-dim);
-  font-size: 12px;
-  margin-bottom: 20px;
-  text-align: left;
-  white-space: pre-wrap;
+.login-screen input {
+  padding: 10px 16px;
+  font-size: 16px;
  font-family: inherit;
-  border-left: 2px solid var(--border);
-  padding-left: 12px;
-}
-
-.login-box form {
-  display: flex;
-  flex-direction: column;
-  gap: 8px;
-  align-items: stretch;
-}
-
-.login-box label {
-  color: var(--text-dim);
-  text-align: left;
-  font-size: 12px;
-}
-
-.login-box input {
-  padding: 8px 12px;
-  font-family: inherit;
-  font-size: 14px;
-  background: var(--input-bg);
+  background: var(--bg-input);
  border: 1px solid var(--border);
-  color: var(--text-bright);
-  border-radius: 3px;
-  outline: none;
+  color: var(--text);
+  border-radius: 4px;
+  width: 280px;
 }

-.login-box input:focus {
-  border-color: var(--accent-dim);
-}
-
-.login-box button {
-  padding: 8px 16px;
+.login-screen button {
+  padding: 10px 24px;
+  font-size: 16px;
  font-family: inherit;
-  font-size: 14px;
-  background: var(--accent-dim);
-  border: none;
-  color: var(--text-bright);
-  border-radius: 3px;
-  cursor: pointer;
-  margin-top: 4px;
-}
-
-.login-box button:hover {
  background: var(--accent);
+  border: none;
+  color: white;
+  border-radius: 4px;
+  cursor: pointer;
 }

-.login-box .error {
-  color: var(--error);
-  font-size: 12px;
-  margin-top: 8px;
+.login-screen .error {
+  color: var(--accent);
 }

-/* ============================================
-   IRC App Layout
-   ============================================ */
+.login-screen .motd {
+  color: var(--text-muted);
+  max-width: 400px;
+  text-align: center;
+  white-space: pre-wrap;
+}

-.irc-app {
+/* Main layout */
+.app {
  display: flex;
  flex-direction: column;
  height: 100%;
-  overflow: hidden;
 }

-/* ============================================
-   Tab Bar
-   ============================================ */
-
+/* Tab bar */
 .tab-bar {
  display: flex;
-  background: var(--bg-tab);
+  background: var(--bg-secondary);
  border-bottom: 1px solid var(--border);
-  flex-shrink: 0;
-  height: 32px;
-  align-items: stretch;
-}
-
-.tabs {
-  display: flex;
  overflow-x: auto;
-  flex: 1;
-  scrollbar-width: none;
-}
-
-.tabs::-webkit-scrollbar {
-  display: none;
+  flex-shrink: 0;
+  align-items: center;
 }

 .tab {
-  display: flex;
-  align-items: center;
-  padding: 0 12px;
+  padding: 8px 16px;
  cursor: pointer;
-  color: var(--text-dim);
+  border-bottom: 2px solid transparent;
  white-space: nowrap;
+  color: var(--text-muted);
  user-select: none;
-  border-right: 1px solid var(--border);
-  font-size: 12px;
-  gap: 4px;
  position: relative;
 }

 .tab:hover {
-  color: var(--text);
-  background: rgba(255, 255, 255, 0.03);
+  background: var(--tab-hover);
 }

 .tab.active {
-  color: var(--text-bright);
-  background: var(--bg-tab-active);
-  border-bottom: 2px solid var(--tab-indicator);
-  margin-bottom: -1px;
+  color: var(--text);
+  border-bottom-color: var(--tab-active);
 }

-.tab.has-unread .tab-label {
-  color: var(--unread);
-  font-weight: bold;
-}
-
-.tab .unread-count {
-  color: var(--unread);
-  font-size: 11px;
-  font-weight: bold;
-}
-
-.tab-close {
-  color: var(--text-dim);
-  font-size: 14px;
-  line-height: 1;
-  margin-left: 2px;
-}
-
-.tab-close:hover {
-  color: var(--error);
-}
-
-.status-area {
-  display: flex;
-  align-items: center;
-  gap: 10px;
-  padding: 0 12px;
-  flex-shrink: 0;
+.tab .close-btn {
+  margin-left: 8px;
+  color: var(--text-muted);
  font-size: 12px;
 }

-.status-nick {
+.tab .close-btn:hover {
  color: var(--accent);
+}
+
+.tab .unread-badge {
+  display: inline-block;
+  background: var(--unread-bg);
+  color: white;
+  font-size: 10px;
  font-weight: bold;
+  padding: 1px 5px;
+  border-radius: 8px;
+  margin-left: 6px;
+  min-width: 16px;
+  text-align: center;
 }

-.status-warn {
-  color: var(--warn);
-  animation: blink 1.5s ease-in-out infinite;
-}
-
-@keyframes blink {
-  0%,
-  100% {
-    opacity: 1;
-  }
-  50% {
-    opacity: 0.4;
-  }
-}
-
-/* ============================================
-   Topic Bar
-   ============================================ */
-
-.topic-bar {
+/* Connection status */
+.connection-status {
  padding: 4px 12px;
-  background: var(--bg-topic);
+  background: var(--warn);
+  color: #1a1a2e;
+  font-size: 12px;
+  font-weight: bold;
+  white-space: nowrap;
+  flex-shrink: 0;
+}
+
+/* Topic bar */
+.topic-bar {
+  padding: 6px 12px;
+  background: var(--topic-bg);
  border-bottom: 1px solid var(--border);
+  color: var(--text-muted);
  font-size: 12px;
  white-space: nowrap;
  overflow: hidden;
  text-overflow: ellipsis;
  flex-shrink: 0;
-  line-height: 1.5;
 }

-.topic-label {
-  color: var(--text-dim);
-}
-
-.topic-text {
-  color: var(--text);
-}
-
-/* ============================================
-   Main Content Area
-   ============================================ */
-
-.main-area {
+/* Content area */
+.content {
  display: flex;
  flex: 1;
  overflow: hidden;
-  min-height: 0;
 }

-/* ============================================
-   Messages Panel
-   ============================================ */
-
-.messages-panel {
+/* Messages */
+.messages-pane {
  flex: 1;
  display: flex;
  flex-direction: column;
  overflow: hidden;
-  min-width: 0;
 }

-.messages-scroll {
+.messages {
  flex: 1;
  overflow-y: auto;
-  padding: 4px 8px;
-  scrollbar-width: thin;
-  scrollbar-color: var(--border) transparent;
+  padding: 8px 12px;
 }

-.messages-scroll::-webkit-scrollbar {
-  width: 8px;
-}
-
-.messages-scroll::-webkit-scrollbar-track {
-  background: transparent;
-}
-
-.messages-scroll::-webkit-scrollbar-thumb {
-  background: var(--border);
-  border-radius: 4px;
-}
-
-/* ============================================
-   Message Lines
-   ============================================ */
-
 .message {
-  padding: 1px 0;
+  padding: 2px 0;
  line-height: 1.4;
-  white-space: pre-wrap;
  word-wrap: break-word;
-  font-size: 13px;
 }

 .message .timestamp {
  color: var(--timestamp);
  font-size: 12px;
+  margin-right: 8px;
 }

 .message .nick {
+  color: var(--nick);
  font-weight: bold;
+  margin-right: 8px;
 }

-.message .content {
-  color: var(--text);
-}
+.message .nick::before { content: '<'; }
+.message .nick::after { content: '>'; }

-/* System messages (joins, parts, quits, etc.) */
-.system-message {
-  color: var(--system);
-}
-
-.system-message .system-text {
-  color: var(--system);
-}
-
-/* /me action messages */
-.action-message .action-text {
-  color: var(--action);
-}
-
-/* ============================================
-   User List (Right Panel)
-   ============================================ */
-
-.user-list {
-  width: 160px;
-  background: var(--user-list-bg);
-  border-left: 1px solid var(--border);
-  display: flex;
-  flex-direction: column;
-  flex-shrink: 0;
-  overflow: hidden;
-}
-
-.user-list-header {
-  padding: 6px 10px;
-  color: var(--user-list-header);
-  font-size: 11px;
-  text-transform: uppercase;
-  letter-spacing: 0.5px;
-  border-bottom: 1px solid var(--border);
-  flex-shrink: 0;
-}
-
-.user-list-entries {
-  overflow-y: auto;
-  padding: 4px 0;
-  flex: 1;
-  scrollbar-width: thin;
-  scrollbar-color: var(--border) transparent;
-}
-
-.nick-entry {
-  padding: 2px 10px;
-  font-size: 12px;
-  cursor: pointer;
-  white-space: nowrap;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  line-height: 1.5;
-}
-
-.nick-entry:hover {
-  background: rgba(255, 255, 255, 0.04);
-}
-
-.nick-prefix {
-  color: var(--text-dim);
-  display: inline-block;
-  width: 1ch;
-  text-align: right;
-  margin-right: 1px;
-}
-
-.nick-name {
-  font-weight: normal;
-}
-
-/* ============================================
-   Input Line (Bottom)
-   ============================================ */
-
-.input-line {
-  display: flex;
-  align-items: center;
-  background: var(--input-bg);
-  border-top: 1px solid var(--border);
-  flex-shrink: 0;
-  height: 36px;
-  padding: 0 8px;
-  gap: 6px;
-}
-
-.input-prompt {
-  color: var(--prompt);
-  font-size: 13px;
-  flex-shrink: 0;
-  white-space: nowrap;
-}
-
-.input-line input {
-  flex: 1;
-  padding: 4px 0;
-  font-family: inherit;
-  font-size: 13px;
-  background: transparent;
-  border: none;
-  color: var(--text-bright);
-  outline: none;
-  caret-color: var(--accent);
-}
-
-.input-line input::placeholder {
-  color: var(--text-dim);
+.message.system {
+  color: var(--text-muted);
  font-style: italic;
 }

-/* ============================================
-   Responsive
-   ============================================ */
-
-@media (max-width: 600px) {
-  .user-list {
-    display: none;
-  }
-
-  .tab {
-    padding: 0 8px;
-    font-size: 11px;
-  }
-
-  .input-prompt {
-    font-size: 12px;
-  }
+.message.system .nick {
+  color: var(--text-muted);
+}
+
+.message.system .nick::before,
+.message.system .nick::after { content: ''; }
+
+/* Input */
+.input-bar {
+  display: flex;
+  border-top: 1px solid var(--border);
+  background: var(--bg-secondary);
+  flex-shrink: 0;
+}
+
+.input-bar input {
+  flex: 1;
+  padding: 10px 12px;
+  font-family: inherit;
+  font-size: 14px;
+  background: var(--bg-input);
+  border: none;
+  color: var(--text);
+  outline: none;
+}
+
+.input-bar button {
+  padding: 10px 16px;
+  font-family: inherit;
+  background: var(--accent);
+  border: none;
+  color: white;
+  cursor: pointer;
+}
+
+/* User list */
+.user-list {
+  width: 160px;
+  background: var(--bg-secondary);
+  border-left: 1px solid var(--border);
+  overflow-y: auto;
+  padding: 8px;
+  flex-shrink: 0;
+}
+
+.user-list h3 {
+  color: var(--text-muted);
+  font-size: 11px;
+  text-transform: uppercase;
+  margin-bottom: 8px;
+  letter-spacing: 1px;
+}
+
+.user-list .user {
+  padding: 3px 4px;
+  color: var(--nick);
+  font-size: 13px;
+  cursor: pointer;
+}
+
+.user-list .user:hover {
+  background: var(--tab-hover);
+}
+
+/* Server tab */
+.server-messages {
+  color: var(--text-muted);
+  padding: 12px;
+  white-space: pre-wrap;
+  overflow-y: auto;
+  flex: 1;
+}
+
+/* Channel join dialog */
+.join-dialog {
+  padding: 12px;
+  display: flex;
+  gap: 8px;
+  background: var(--bg-secondary);
+  border-bottom: 1px solid var(--border);
+  margin-left: auto;
+}
+
+.join-dialog input {
+  padding: 6px 10px;
+  font-family: inherit;
+  font-size: 13px;
+  background: var(--bg-input);
+  border: 1px solid var(--border);
+  color: var(--text);
+  border-radius: 3px;
+  width: 200px;
+}
+
+.join-dialog button {
+  padding: 6px 14px;
+  font-family: inherit;
+  font-size: 13px;
+  background: var(--accent2);
+  border: none;
+  color: var(--text);
+  border-radius: 3px;
+  cursor: pointer;
+}
+
+/* Responsive */
+@media (max-width: 600px) {
+  .user-list { display: none; }
+  .tab { padding: 6px 10px; font-size: 13px; }
 }
--- a/web/src/app.jsx
+++ b/web/src/app.jsx
--- a/web/src/index.html
+++ b/web/src/index.html
@@ -3,11 +3,11 @@
 <head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>NeoIRC</title>
+  <title>Chat</title>
  <link rel="stylesheet" href="/style.css">
 </head>
 <body>
  <div id="root"></div>
-  <script type="module" src="/app.js"></script>
+  <script src="/app.js"></script>
 </body>
 </html>
--- a/web/src/style.css
+++ b/web/src/style.css
@@ -1,466 +1,317 @@
-* {
-  margin: 0;
-  padding: 0;
-  box-sizing: border-box;
-}
+* { margin: 0; padding: 0; box-sizing: border-box; }

 :root {
-  --bg: #0a0e14;
-  --bg-panel: #0d1117;
-  --bg-input: #0d1117;
-  --bg-tab: #161b22;
-  --bg-tab-active: #0d1117;
-  --bg-topic: #0d1117;
-  --text: #c9d1d9;
-  --text-dim: #6e7681;
-  --text-bright: #e6edf3;
-  --accent: #58a6ff;
-  --accent-dim: #1f6feb;
-  --border: #21262d;
-  --system: #7d8590;
-  --action: #d2a8ff;
-  --warn: #d29922;
-  --error: #f85149;
-  --unread: #f0883e;
-  --nick-brackets: #6e7681;
-  --timestamp: #484f58;
-  --input-bg: #161b22;
-  --prompt: #3fb950;
-  --tab-indicator: #58a6ff;
-  --user-list-bg: #0d1117;
-  --user-list-header: #484f58;
+  --bg: #1a1a2e;
+  --bg-secondary: #16213e;
+  --bg-input: #0f3460;
+  --text: #e0e0e0;
+  --text-muted: #888;
+  --accent: #e94560;
+  --accent2: #0f3460;
+  --border: #2a2a4a;
+  --nick: #53a8b6;
+  --timestamp: #666;
+  --tab-active: #e94560;
+  --tab-bg: #16213e;
+  --tab-hover: #1a1a3e;
+  --topic-bg: #121a30;
+  --unread-bg: #e94560;
+  --warn: #f0ad4e;
 }

-html,
-body,
-#root {
+html, body, #root {
  height: 100%;
-  font-family: "JetBrains Mono", "Cascadia Code", "Fira Code", "SF Mono",
-    "Consolas", "Liberation Mono", "Courier New", monospace;
-  font-size: 13px;
+  font-family: 'Courier New', Courier, monospace;
+  font-size: 14px;
  background: var(--bg);
  color: var(--text);
-  overflow: hidden;
 }

-/* ============================================
-   Login Screen
-   ============================================ */
-
+/* Login screen */
 .login-screen {
  display: flex;
+  flex-direction: column;
  align-items: center;
  justify-content: center;
  height: 100%;
-  background: var(--bg);
+  gap: 16px;
 }

-.login-box {
-  text-align: center;
-  max-width: 360px;
-  width: 100%;
-  padding: 32px;
-}
-
-.login-box h1 {
+.login-screen h1 {
  color: var(--accent);
-  font-size: 1.8em;
-  margin-bottom: 16px;
-  font-weight: 400;
+  font-size: 2em;
 }

-.login-box .motd {
-  color: var(--text-dim);
-  font-size: 12px;
-  margin-bottom: 20px;
-  text-align: left;
-  white-space: pre-wrap;
+.login-screen input {
+  padding: 10px 16px;
+  font-size: 16px;
  font-family: inherit;
-  border-left: 2px solid var(--border);
-  padding-left: 12px;
-}
-
-.login-box form {
-  display: flex;
-  flex-direction: column;
-  gap: 8px;
-  align-items: stretch;
-}
-
-.login-box label {
-  color: var(--text-dim);
-  text-align: left;
-  font-size: 12px;
-}
-
-.login-box input {
-  padding: 8px 12px;
-  font-family: inherit;
-  font-size: 14px;
-  background: var(--input-bg);
+  background: var(--bg-input);
  border: 1px solid var(--border);
-  color: var(--text-bright);
-  border-radius: 3px;
-  outline: none;
+  color: var(--text);
+  border-radius: 4px;
+  width: 280px;
 }

-.login-box input:focus {
-  border-color: var(--accent-dim);
-}
-
-.login-box button {
-  padding: 8px 16px;
+.login-screen button {
+  padding: 10px 24px;
+  font-size: 16px;
  font-family: inherit;
-  font-size: 14px;
-  background: var(--accent-dim);
-  border: none;
-  color: var(--text-bright);
-  border-radius: 3px;
-  cursor: pointer;
-  margin-top: 4px;
-}
-
-.login-box button:hover {
  background: var(--accent);
+  border: none;
+  color: white;
+  border-radius: 4px;
+  cursor: pointer;
 }

-.login-box .error {
-  color: var(--error);
-  font-size: 12px;
-  margin-top: 8px;
+.login-screen .error {
+  color: var(--accent);
 }

-/* ============================================
-   IRC App Layout
-   ============================================ */
+.login-screen .motd {
+  color: var(--text-muted);
+  max-width: 400px;
+  text-align: center;
+  white-space: pre-wrap;
+}

-.irc-app {
+/* Main layout */
+.app {
  display: flex;
  flex-direction: column;
  height: 100%;
-  overflow: hidden;
 }

-/* ============================================
-   Tab Bar
-   ============================================ */
-
+/* Tab bar */
 .tab-bar {
  display: flex;
-  background: var(--bg-tab);
+  background: var(--bg-secondary);
  border-bottom: 1px solid var(--border);
-  flex-shrink: 0;
-  height: 32px;
-  align-items: stretch;
-}
-
-.tabs {
-  display: flex;
  overflow-x: auto;
-  flex: 1;
-  scrollbar-width: none;
-}
-
-.tabs::-webkit-scrollbar {
-  display: none;
+  flex-shrink: 0;
+  align-items: center;
 }

 .tab {
-  display: flex;
-  align-items: center;
-  padding: 0 12px;
+  padding: 8px 16px;
  cursor: pointer;
-  color: var(--text-dim);
+  border-bottom: 2px solid transparent;
  white-space: nowrap;
+  color: var(--text-muted);
  user-select: none;
-  border-right: 1px solid var(--border);
-  font-size: 12px;
-  gap: 4px;
  position: relative;
 }

 .tab:hover {
-  color: var(--text);
-  background: rgba(255, 255, 255, 0.03);
+  background: var(--tab-hover);
 }

 .tab.active {
-  color: var(--text-bright);
-  background: var(--bg-tab-active);
-  border-bottom: 2px solid var(--tab-indicator);
-  margin-bottom: -1px;
+  color: var(--text);
+  border-bottom-color: var(--tab-active);
 }

-.tab.has-unread .tab-label {
-  color: var(--unread);
-  font-weight: bold;
-}
-
-.tab .unread-count {
-  color: var(--unread);
-  font-size: 11px;
-  font-weight: bold;
-}
-
-.tab-close {
-  color: var(--text-dim);
-  font-size: 14px;
-  line-height: 1;
-  margin-left: 2px;
-}
-
-.tab-close:hover {
-  color: var(--error);
-}
-
-.status-area {
-  display: flex;
-  align-items: center;
-  gap: 10px;
-  padding: 0 12px;
-  flex-shrink: 0;
+.tab .close-btn {
+  margin-left: 8px;
+  color: var(--text-muted);
  font-size: 12px;
 }

-.status-nick {
+.tab .close-btn:hover {
  color: var(--accent);
+}
+
+.tab .unread-badge {
+  display: inline-block;
+  background: var(--unread-bg);
+  color: white;
+  font-size: 10px;
  font-weight: bold;
+  padding: 1px 5px;
+  border-radius: 8px;
+  margin-left: 6px;
+  min-width: 16px;
+  text-align: center;
 }

-.status-warn {
-  color: var(--warn);
-  animation: blink 1.5s ease-in-out infinite;
-}
-
-@keyframes blink {
-  0%,
-  100% {
-    opacity: 1;
-  }
-  50% {
-    opacity: 0.4;
-  }
-}
-
-/* ============================================
-   Topic Bar
-   ============================================ */
-
-.topic-bar {
+/* Connection status */
+.connection-status {
  padding: 4px 12px;
-  background: var(--bg-topic);
+  background: var(--warn);
+  color: #1a1a2e;
+  font-size: 12px;
+  font-weight: bold;
+  white-space: nowrap;
+  flex-shrink: 0;
+}
+
+/* Topic bar */
+.topic-bar {
+  padding: 6px 12px;
+  background: var(--topic-bg);
  border-bottom: 1px solid var(--border);
+  color: var(--text-muted);
  font-size: 12px;
  white-space: nowrap;
  overflow: hidden;
  text-overflow: ellipsis;
  flex-shrink: 0;
-  line-height: 1.5;
 }

-.topic-label {
-  color: var(--text-dim);
-}
-
-.topic-text {
-  color: var(--text);
-}
-
-/* ============================================
-   Main Content Area
-   ============================================ */
-
-.main-area {
+/* Content area */
+.content {
  display: flex;
  flex: 1;
  overflow: hidden;
-  min-height: 0;
 }

-/* ============================================
-   Messages Panel
-   ============================================ */
-
-.messages-panel {
+/* Messages */
+.messages-pane {
  flex: 1;
  display: flex;
  flex-direction: column;
  overflow: hidden;
-  min-width: 0;
 }

-.messages-scroll {
+.messages {
  flex: 1;
  overflow-y: auto;
-  padding: 4px 8px;
-  scrollbar-width: thin;
-  scrollbar-color: var(--border) transparent;
+  padding: 8px 12px;
 }

-.messages-scroll::-webkit-scrollbar {
-  width: 8px;
-}
-
-.messages-scroll::-webkit-scrollbar-track {
-  background: transparent;
-}
-
-.messages-scroll::-webkit-scrollbar-thumb {
-  background: var(--border);
-  border-radius: 4px;
-}
-
-/* ============================================
-   Message Lines
-   ============================================ */
-
 .message {
-  padding: 1px 0;
+  padding: 2px 0;
  line-height: 1.4;
-  white-space: pre-wrap;
  word-wrap: break-word;
-  font-size: 13px;
 }

 .message .timestamp {
  color: var(--timestamp);
  font-size: 12px;
+  margin-right: 8px;
 }

 .message .nick {
+  color: var(--nick);
  font-weight: bold;
+  margin-right: 8px;
 }

-.message .content {
-  color: var(--text);
-}
+.message .nick::before { content: '<'; }
+.message .nick::after { content: '>'; }

-/* System messages (joins, parts, quits, etc.) */
-.system-message {
-  color: var(--system);
-}
-
-.system-message .system-text {
-  color: var(--system);
-}
-
-/* /me action messages */
-.action-message .action-text {
-  color: var(--action);
-}
-
-/* ============================================
-   User List (Right Panel)
-   ============================================ */
-
-.user-list {
-  width: 160px;
-  background: var(--user-list-bg);
-  border-left: 1px solid var(--border);
-  display: flex;
-  flex-direction: column;
-  flex-shrink: 0;
-  overflow: hidden;
-}
-
-.user-list-header {
-  padding: 6px 10px;
-  color: var(--user-list-header);
-  font-size: 11px;
-  text-transform: uppercase;
-  letter-spacing: 0.5px;
-  border-bottom: 1px solid var(--border);
-  flex-shrink: 0;
-}
-
-.user-list-entries {
-  overflow-y: auto;
-  padding: 4px 0;
-  flex: 1;
-  scrollbar-width: thin;
-  scrollbar-color: var(--border) transparent;
-}
-
-.nick-entry {
-  padding: 2px 10px;
-  font-size: 12px;
-  cursor: pointer;
-  white-space: nowrap;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  line-height: 1.5;
-}
-
-.nick-entry:hover {
-  background: rgba(255, 255, 255, 0.04);
-}
-
-.nick-prefix {
-  color: var(--text-dim);
-  display: inline-block;
-  width: 1ch;
-  text-align: right;
-  margin-right: 1px;
-}
-
-.nick-name {
-  font-weight: normal;
-}
-
-/* ============================================
-   Input Line (Bottom)
-   ============================================ */
-
-.input-line {
-  display: flex;
-  align-items: center;
-  background: var(--input-bg);
-  border-top: 1px solid var(--border);
-  flex-shrink: 0;
-  height: 36px;
-  padding: 0 8px;
-  gap: 6px;
-}
-
-.input-prompt {
-  color: var(--prompt);
-  font-size: 13px;
-  flex-shrink: 0;
-  white-space: nowrap;
-}
-
-.input-line input {
-  flex: 1;
-  padding: 4px 0;
-  font-family: inherit;
-  font-size: 13px;
-  background: transparent;
-  border: none;
-  color: var(--text-bright);
-  outline: none;
-  caret-color: var(--accent);
-}
-
-.input-line input::placeholder {
-  color: var(--text-dim);
+.message.system {
+  color: var(--text-muted);
  font-style: italic;
 }

-/* ============================================
-   Responsive
-   ============================================ */
-
-@media (max-width: 600px) {
-  .user-list {
-    display: none;
-  }
-
-  .tab {
-    padding: 0 8px;
-    font-size: 11px;
-  }
-
-  .input-prompt {
-    font-size: 12px;
-  }
+.message.system .nick {
+  color: var(--text-muted);
+}
+
+.message.system .nick::before,
+.message.system .nick::after { content: ''; }
+
+/* Input */
+.input-bar {
+  display: flex;
+  border-top: 1px solid var(--border);
+  background: var(--bg-secondary);
+  flex-shrink: 0;
+}
+
+.input-bar input {
+  flex: 1;
+  padding: 10px 12px;
+  font-family: inherit;
+  font-size: 14px;
+  background: var(--bg-input);
+  border: none;
+  color: var(--text);
+  outline: none;
+}
+
+.input-bar button {
+  padding: 10px 16px;
+  font-family: inherit;
+  background: var(--accent);
+  border: none;
+  color: white;
+  cursor: pointer;
+}
+
+/* User list */
+.user-list {
+  width: 160px;
+  background: var(--bg-secondary);
+  border-left: 1px solid var(--border);
+  overflow-y: auto;
+  padding: 8px;
+  flex-shrink: 0;
+}
+
+.user-list h3 {
+  color: var(--text-muted);
+  font-size: 11px;
+  text-transform: uppercase;
+  margin-bottom: 8px;
+  letter-spacing: 1px;
+}
+
+.user-list .user {
+  padding: 3px 4px;
+  color: var(--nick);
+  font-size: 13px;
+  cursor: pointer;
+}
+
+.user-list .user:hover {
+  background: var(--tab-hover);
+}
+
+/* Server tab */
+.server-messages {
+  color: var(--text-muted);
+  padding: 12px;
+  white-space: pre-wrap;
+  overflow-y: auto;
+  flex: 1;
+}
+
+/* Channel join dialog */
+.join-dialog {
+  padding: 12px;
+  display: flex;
+  gap: 8px;
+  background: var(--bg-secondary);
+  border-bottom: 1px solid var(--border);
+  margin-left: auto;
+}
+
+.join-dialog input {
+  padding: 6px 10px;
+  font-family: inherit;
+  font-size: 13px;
+  background: var(--bg-input);
+  border: 1px solid var(--border);
+  color: var(--text);
+  border-radius: 3px;
+  width: 200px;
+}
+
+.join-dialog button {
+  padding: 6px 14px;
+  font-family: inherit;
+  font-size: 13px;
+  background: var(--accent2);
+  border: none;
+  color: var(--text);
+  border-radius: 3px;
+  cursor: pointer;
+}
+
+/* Responsive */
+@media (max-width: 600px) {
+  .user-list { display: none; }
+  .tab { padding: 6px 10px; font-size: 13px; }
 }