serverless-ircd 0.1.0 → 0.3.0

package/packages/irc-core/src/commands/motd-lines.ts

@@ -0,0 +1,127 @@
+/**
+ * Shared MOTD-lines → IRC numerics builder.
+ *
+ * Both the registration welcome block ({@link buildWelcomeLines}) and the
+ * standalone `MOTD` command ({@link motdReducer}) render the same
+ * `375`/`372`×N/`376` sequence (or `422 ERR_NOMOTD` when no MOTD is
+ * configured) from the lines supplied by a {@link MotdProvider}. This module
+ * owns that rendering so the two call sites cannot drift.
+ *
+ * Wire format (RFC 2812 §5):
+ *   - `375 RPL_MOTDSTART`  — `:<server> 375 <nick> :- <server> Message of the day -`
+ *   - `372 RPL_MOTD`        — `:<server> 372 <nick> :- <line>`  (one per MOTD line)
+ *   - `376 RPL_ENDOFMOTD`  — `:<server> 376 <nick> :End of MOTD command`
+ *   - `422 ERR_NOMOTD`     — `:<server> 422 <nick> :MOTD File is missing`
+ *
+ * Per RFC 1459 §2.3 the maximum wire line length is 512 bytes including the
+ * trailing CR-LF. Over-long MOTD content lines are hard-wrapped at the
+ * 372-line content budget so every emitted line fits within the 512-byte
+ * limit (also leaving headroom for message-tags).
+ */
+
+import type { RawLine } from '../effects.js';
+import { Numerics } from '../protocol/numerics.js';
+
+/** RFC 1459 §2.3: maximum IRC line length in bytes, including the trailing CR-LF. */
+const MAX_LINE_BYTES = 512;
+
+/** Length of the trailing CR-LF that the wire layer appends to each line. */
+const TRAILING_CRLF_LEN = 2;
+
+/** Fixed text emitted for `375 RPL_MOTDSTART` (after `:- `). */
+const MOTDSTART_TRAILING_TEXT = '- $server Message of the day -';
+
+/** Fixed text emitted for `376 RPL_ENDOFMOTD`. */
+const ENDOFMOTD_TRAILING_TEXT = 'End of MOTD command';
+
+/** Fixed text emitted for `422 ERR_NOMOTD`. */
+const NOMOTD_TRAILING_TEXT = 'MOTD File is missing';
+
+/**
+ * Renders the MOTD numerics addressed to `nick` from the supplied `lines`.
+ *
+ * Returns `[422 ERR_NOMOTD]` when `lines` is empty (mirroring the standalone
+ * `MOTD` command), otherwise the `375`/`372`×N/`376` block with over-long
+ * lines hard-wrapped to fit the 512-byte wire limit.
+ *
+ * `nick` is taken verbatim from the caller — the welcome path passes the
+ * (guaranteed-defined) registering nick, the standalone command passes
+ * `connection.nick ?? '*'`.
+ */
+export function buildMotdNumerics(serverName: string, nick: string, lines: string[]): RawLine[] {
+  if (lines.length === 0) {
+    return [numericLine(serverName, nick, Numerics.ERR_NOMOTD, NOMOTD_TRAILING_TEXT)];
+  }
+
+  const out: RawLine[] = [
+    numericLine(
+      serverName,
+      nick,
+      Numerics.RPL_MOTDSTART,
+      MOTDSTART_TRAILING_TEXT.replace('$server', serverName),
+    ),
+  ];
+
+  const maxContent = maxMotdContentLen(serverName, nick);
+  for (const raw of lines) {
+    for (const chunk of splitForMotd(raw, maxContent)) {
+      out.push(numericLine(serverName, nick, Numerics.RPL_MOTD, `- ${chunk}`));
+    }
+  }
+
+  out.push(numericLine(serverName, nick, Numerics.RPL_ENDOFMOTD, ENDOFMOTD_TRAILING_TEXT));
+  return out;
+}
+
+/**
+ * Builds a `:<server> <code> <nick> :<trailing>` line.
+ */
+function numericLine(serverName: string, nick: string, code: number, trailing: string): RawLine {
+  const codeStr = code.toString().padStart(3, '0');
+  return { text: `:${serverName} ${codeStr} ${nick} :${trailing}` };
+}
+
+/**
+ * Returns the maximum content-byte length that fits in a single `372 RPL_MOTD`
+ * line for this connection, given the server name and nick.
+ *
+ * The 372 wire format is `:<server> 372 <nick> :- <chunk>\r\n`, so the
+ * per-chunk budget is:
+ *
+ *   512
+ *   - 2                              (trailing CR-LF)
+ *   - 1                              (leading `:`)
+ *   - <server>.length
+ *   - 5                              (` 372 `)
+ *   - <nick>.length
+ *   - 4                              (` :- `)
+ *
+ * The result is clamped at 0 so a pathologically long server/nick combo
+ * cannot drive the budget negative.
+ */
+function maxMotdContentLen(serverName: string, nick: string): number {
+  const overhead = TRAILING_CRLF_LEN + 1 + serverName.length + 5 + nick.length + 4;
+  return Math.max(0, MAX_LINE_BYTES - overhead);
+}
+
+/**
+ * Splits a single MOTD content line into chunks that each fit the per-372
+ * content budget.
+ *
+ * Hard-wraps at the byte budget (no word-boundary awareness) — matching the
+ * behavior of mainstream IRC daemons and keeping the rendering deterministic.
+ *
+ * Edge cases:
+ *   - Empty string → `['']` (one empty 372 line, still RFC-conformant).
+ *   - Zero/negative budget (impossible in practice but defensive) → `['']`
+ *     so the builder always emits at least one 372 per input line.
+ */
+function splitForMotd(text: string, maxLen: number): string[] {
+  if (maxLen <= 0) return [''];
+  if (text.length === 0) return [''];
+  const chunks: string[] = [];
+  for (let i = 0; i < text.length; i += maxLen) {
+    chunks.push(text.slice(i, i + maxLen));
+  }
+  return chunks;
+}

package/packages/irc-core/src/commands/motd.ts

@@ -11,38 +11,16 @@
  * D1, or Secrets Manager) so the reducer itself stays pure and
  * deterministic — no IO in the handler.
  *
- * Wire format (RFC 2812 §5):
- *   - `375 RPL_MOTDSTART`  — `:<server> 375 <nick> :- <server> Message of the day -`
- *   - `372 RPL_MOTD`        — `:<server> 372 <nick> :- <line>`  (one per MOTD line)
- *   - `376 RPL_ENDOFMOTD`  — `:<server> 376 <nick> :End of MOTD command`
- *   - `422 ERR_NOMOTD`     — `:<server> 422 <nick> :MOTD File is missing`
- *
- * Per RFC 1459 §2.3 the maximum wire line length is 512 bytes including the
- * trailing CR-LF. Over-long MOTD content lines are hard-wrapped at the
- * 372-line content budget so every emitted line fits within the 512-byte
- * limit (also leaving headroom for message-tags).
+ * The numeric rendering (`375`/`372`×N/`376`, or `422 ERR_NOMOTD`) is shared
+ * with the registration welcome block via {@link buildMotdNumerics} so the
+ * two paths cannot drift.
  */
 
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
-import { Numerics } from '../protocol/numerics.js';
 import type { ConnectionState } from '../state/connection.js';
 import type { Ctx, Reducer } from '../types.js';
-
-/** RFC 1459 §2.3: maximum IRC line length in bytes, including the trailing CR-LF. */
-const MAX_LINE_BYTES = 512;
-
-/** Length of the trailing CR-LF that the wire layer appends to each line. */
-const TRAILING_CRLF_LEN = 2;
-
-/** Fixed text emitted for `375 RPL_MOTDSTART` (after `:- `). */
-const MOTDSTART_TRAILING_TEXT = '- $server Message of the day -';
-
-/** Fixed text emitted for `376 RPL_ENDOFMOTD`. */
-const ENDOFMOTD_TRAILING_TEXT = 'End of MOTD command';
-
-/** Fixed text emitted for `422 ERR_NOMOTD`. */
-const NOMOTD_TRAILING_TEXT = 'MOTD File is missing';
+import { buildMotdNumerics } from './motd-lines.js';
 
 /**
  * Handles `MOTD [server]`.
@@ -56,91 +34,9 @@ const NOMOTD_TRAILING_TEXT = 'MOTD File is missing';
 export const motdReducer: Reducer<ConnectionState> = (state, _msg, ctx) => {
   state.lastSeen = ctx.clock.now();
 
-  const lines = ctx.motd.lines();
-
-  if (lines.length === 0) {
-    return {
-      state,
-      effects: [
-        Effect.send(ctx.connId, [numericLine(ctx, Numerics.ERR_NOMOTD, NOMOTD_TRAILING_TEXT)]),
-      ],
-    };
-  }
-
-  const out: RawLine[] = [
-    numericLine(
-      ctx,
-      Numerics.RPL_MOTDSTART,
-      MOTDSTART_TRAILING_TEXT.replace('$server', ctx.serverName),
-    ),
-  ];
-
-  const maxContent = maxMotdContentLen(ctx);
-  for (const raw of lines) {
-    for (const chunk of splitForMotd(raw, maxContent)) {
-      out.push(numericLine(ctx, Numerics.RPL_MOTD, `- ${chunk}`));
-    }
-  }
-
-  out.push(numericLine(ctx, Numerics.RPL_ENDOFMOTD, ENDOFMOTD_TRAILING_TEXT));
+  const nick = ctx.connection.nick ?? '*';
+  const out: RawLine[] = buildMotdNumerics(ctx.serverName, nick, ctx.motd.lines());
 
   const effects: EffectType[] = [Effect.send(ctx.connId, out)];
   return { state, effects };
 };
-
-/**
- * Builds a `:<server> <code> <nick> :<trailing>` line. The nick falls back
- * to `*` when the connection has not yet registered one, matching the rest
- * of the codebase's numeric-error formatting.
- */
-function numericLine(ctx: Ctx, code: number, trailing: string): RawLine {
-  const nick = ctx.connection.nick ?? '*';
-  const codeStr = code.toString().padStart(3, '0');
-  return { text: `:${ctx.serverName} ${codeStr} ${nick} :${trailing}` };
-}
-
-/**
- * Returns the maximum content-byte length that fits in a single `372 RPL_MOTD`
- * line for this connection, given the server name and the connection's nick.
- *
- * The 372 wire format is `:<server> 372 <nick> :- <chunk>\r\n`, so the
- * per-chunk budget is:
- *
- *   512
- *   - 2                              (trailing CR-LF)
- *   - 1                              (leading `:`)
- *   - <server>.length
- *   - 5                              (` 372 `)
- *   - <nick>.length
- *   - 4                              (` :- `)
- *
- * The result is clamped at 0 so a pathologically long server/nick combo
- * cannot drive the budget negative.
- */
-function maxMotdContentLen(ctx: Ctx): number {
-  const nick = ctx.connection.nick ?? '*';
-  const overhead = TRAILING_CRLF_LEN + 1 + ctx.serverName.length + 5 + nick.length + 4;
-  return Math.max(0, MAX_LINE_BYTES - overhead);
-}
-
-/**
- * Splits a single MOTD content line into chunks that each fit the per-372
- * content budget.
- *
- * Hard-wraps at the byte budget (no word-boundary awareness) — matching the
- * behavior of mainstream IRC daemons and keeping the reducer deterministic.
- *
- * Edge cases:
- *   - Empty string → `['']` (one empty 372 line, still RFC-conformant).
- *   - Zero/negative budget (impossible in practice but defensive) → `['']`
- *     so the reducer always emits at least one 372 per input line.
- */
-function splitForMotd(text: string, maxLen: number): string[] {
-  if (maxLen <= 0) return [''];
-  if (text.length === 0) return [''];
-  const chunks: string[] = [];
-  for (let i = 0; i < text.length; i += maxLen) {
-    chunks.push(text.slice(i, i + maxLen));
-  }
-  return chunks;
-}

package/packages/irc-core/src/commands/oper.ts

@@ -0,0 +1,151 @@
+/**
+ * Pure reducer for the IRC `OPER` command.
+ *
+ * PLAN §2.1 location-of-authority: OPER runs in the Connection entity — it
+ * authenticates the caller against the deployment's configured operator
+ * credentials and, on success, grants the `o` user mode by setting
+ * `state.userModes.oper = true`. The reducer's `state` argument is the
+ * caller's authoritative {@link ConnectionState}.
+ *
+ * Oper is the *only* path that sets `userModes.oper`: a user `MODE +o` is
+ * hard-rejected with `481 ERR_NOPRIVILEGES` (see `mode.ts`). Once oper is
+ * granted here, the `RPL_WHOISOPERATOR` (313) branch of WHOIS and the `*`
+ * oper flag of WHO become reachable.
+ *
+ * Wire format (RFC 2812 §5.4.1, §4.1):
+ *   - `OPER <name> <password>` — authenticates and (on success) grants oper.
+ *   - `381 RPL_YOUREOPER`:
+ *     `:<server> 381 <nick> :You are now an IRC operator`
+ *   - `461 ERR_NEEDMOREPARAMS`:
+ *     `:<server> 461 <nick> OPER :Not enough parameters`
+ *   - `464 ERR_PASSWDMISMATCH`:
+ *     `:<server> 464 <nick> :Password Incorrect`
+ *   - `491 ERR_NOOPERHOST`:
+ *     `:<server> 491 <nick> :No O-lines for your host`
+ *
+ * Behaviour:
+ *   - Missing `<name>` or `<password>` → `461 ERR_NEEDMOREPARAMS`.
+ *   - Already an operator → graceful idempotent no-op that re-confirms with
+ *     `381` (no re-authentication required; the connection is already privy).
+ *   - No operator credentials configured (absent or empty) →
+ *     `491 ERR_NOOPERHOST`.
+ *   - Matching credential pair → grant oper, emit `381`.
+ *   - Wrong password / unknown name → `464 ERR_PASSWDMISMATCH`.
+ */
+
+import { Effect } from '../effects.js';
+import type { RawLine } from '../effects.js';
+import { Numerics } from '../protocol/numerics.js';
+import type { ConnectionState } from '../state/connection.js';
+import type { OperCred } from '../types.js';
+import type { Ctx, Reducer } from '../types.js';
+
+/** Fixed text emitted for `381 RPL_YOUREOPER`. */
+const YOUREOPER_TRAILING_TEXT = 'You are now an IRC operator';
+
+/** Fixed text emitted for `464 ERR_PASSWDMISMATCH`. */
+const PASSWDMISMATCH_TRAILING_TEXT = 'Password Incorrect';
+
+/** Fixed text emitted for `491 ERR_NOOPERHOST`. */
+const NOOPERHOST_TRAILING_TEXT = 'No O-lines for your host';
+
+/** Fixed text emitted for `461 ERR_NEEDMOREPARAMS`. */
+const NEEDMOREPARAMS_TRAILING_TEXT = 'Not enough parameters';
+
+/**
+ * Returns true iff a credential pair in `creds` matches `name` / `password`
+ * exactly. Extracted as a pure helper so the match logic is testable in
+ * isolation and independent of connection state. Comparison is case
+ * sensitive and byte-exact (case-mapping is owned elsewhere).
+ */
+export function matchOperCred(
+  creds: ReadonlyArray<OperCred>,
+  name: string,
+  password: string,
+): boolean {
+  return creds.some((c) => c.user === name && c.password === password);
+}
+
+/**
+ * Handles `OPER <name> <password>`.
+ *
+ * Verifies the supplied pair against `serverConfig.operCreds` and, on
+ * success, grants the oper user mode. Emits the appropriate numeric reply
+ * in every branch. See the file header for the full decision table.
+ */
+export const operReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
+  state.lastSeen = ctx.clock.now();
+
+  const name = msg.params[0];
+  const password = msg.params[1];
+
+  if (name === undefined || password === undefined) {
+    return {
+      state,
+      effects: [
+        Effect.send(ctx.connId, [
+          numericLine(ctx, Numerics.ERR_NEEDMOREPARAMS, NEEDMOREPARAMS_TRAILING_TEXT, 'OPER'),
+        ]),
+      ],
+    };
+  }
+
+  // Already an operator: graceful idempotent re-confirm, no re-auth needed.
+  if (state.userModes.oper) {
+    return {
+      state,
+      effects: [
+        Effect.send(ctx.connId, [
+          numericLine(ctx, Numerics.RPL_YOUREOPER, YOUREOPER_TRAILING_TEXT),
+        ]),
+      ],
+    };
+  }
+
+  const creds = ctx.serverConfig.operCreds;
+  if (creds === undefined || creds.length === 0) {
+    return {
+      state,
+      effects: [
+        Effect.send(ctx.connId, [
+          numericLine(ctx, Numerics.ERR_NOOPERHOST, NOOPERHOST_TRAILING_TEXT),
+        ]),
+      ],
+    };
+  }
+
+  if (matchOperCred(creds, name, password)) {
+    state.userModes.oper = true;
+    return {
+      state,
+      effects: [
+        Effect.send(ctx.connId, [
+          numericLine(ctx, Numerics.RPL_YOUREOPER, YOUREOPER_TRAILING_TEXT),
+        ]),
+      ],
+    };
+  }
+
+  return {
+    state,
+    effects: [
+      Effect.send(ctx.connId, [
+        numericLine(ctx, Numerics.ERR_PASSWDMISMATCH, PASSWDMISMATCH_TRAILING_TEXT),
+      ]),
+    ],
+  };
+};
+
+/**
+ * Builds a `:<server> <code> <nick> [<middle>] :<trailing>` line. The nick
+ * falls back to `*` when the connection has not yet registered one, matching
+ * the rest of the codebase's numeric formatting.
+ */
+function numericLine(ctx: Ctx, code: number, trailing: string, middle?: string): RawLine {
+  const nick = ctx.connection.nick ?? '*';
+  const codeStr = code.toString().padStart(3, '0');
+  const parts = [`:${ctx.serverName}`, codeStr, nick];
+  if (middle !== undefined) parts.push(middle);
+  parts.push(`:${trailing}`);
+  return { text: parts.join(' ') };
+}

package/packages/irc-core/src/commands/privmsg.ts

@@ -173,6 +173,30 @@ function buildChannelReducer(command: MessageCommand): Reducer<ChannelState> {
       }
     }
 
+    // All checks passed: persist the message for chathistory playback when a
+    // MessageStore is bound. The msgid/time are generated once here and travel
+    // on the StoredMessage; the live broadcast line stays bare (per-recipient
+    // server-time/msgid decoration is the dispatch layer's job). Recording is
+    // gated on ctx.messages so deployments with chathistory disabled see no
+    // change whatsoever.
+    //
+    // By this point the sender's hostmask has already been computed and used
+    // in the `+b` ban check above, so the connection's nick/user/host are all
+    // defined for any registered PRIVMSG (registration sets all three); the
+    // fallbacks mirror `senderHostmask` purely for the type-checker.
+    if (ctx.messages !== undefined) {
+      ctx.messages.record({
+        msgid: ctx.ids.nonce(),
+        time: ctx.clock.now(),
+        chan: state.nameLower,
+        command,
+        nick: ctx.connection.nick as string,
+        user: ctx.connection.user as string,
+        host: ctx.connection.host as string,
+        text,
+      });
+    }
+
     // All checks passed: broadcast to the channel, excluding the sender.
     const line: RawLine = { text: `:${hostmask} ${command} ${state.name} :${text}` };
     effects.push(Effect.broadcast(state.name, [line], ctx.connId));

package/packages/irc-core/src/commands/registration.ts

@@ -13,6 +13,7 @@
  * numeric on `{ ok: false }`.
  */
 
+import { cloakHost } from '../cloak.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
 import { Numerics } from '../protocol/numerics.js';
@@ -20,12 +21,13 @@ import { hostmaskOf } from '../state/connection.js';
 import type { ConnectionState } from '../state/connection.js';
 import type { Ctx, Reducer } from '../types.js';
 import { generateIsupport } from './isupport.js';
+import { buildMotdNumerics } from './motd-lines.js';
 
 /**
  * Server version reported in `002` / `004`. Placeholder until a config-driven
  * version lands.
  */
-const SERVER_VERSION = '0.1.0';
+const SERVER_VERSION = '0.2.0';
 
 /** "Created" text for `003 RPL_CREATED`. Placeholder. */
 const CREATED_TEXT = 'Phase 1';
@@ -54,9 +56,9 @@ export function isValidNick(nick: string, maxLen: number): boolean {
 
 /**
  * Builds the welcome numeric block emitted once registration completes:
- * `001`–`005` (with `005` as a placeholder) followed by
- * the `375`/`372`/`376` MOTD placeholders (real MOTD content via the
- * `MotdProvider` port).
+ * `001`–`005` (with `005` generated from the server config) followed by
+ * the MOTD numerics rendered from {@link Ctx.motd} — `375`/`372`×N/`376`
+ * for a configured MOTD, or `422 ERR_NOMOTD` when none is configured.
  *
  * Caller guarantees `state.nick` and `state.user` are set.
  */
@@ -80,29 +82,87 @@ export function buildWelcomeLines(state: ConnectionState, ctx: Ctx): RawLine[] {
     },
     // 005 RPL_ISUPPORT — real tokens generated from serverConfig.
     ...generateIsupport(ctx.serverConfig, state.caps, nick),
-    // MOTD placeholders — filled via MotdProvider elsewhere.
-    { text: `${prefix} 375 ${nick} :- ${ctx.serverName} Message of the day -` },
-    { text: `${prefix} 372 ${nick} :- MOTD placeholder` },
-    { text: `${prefix} 376 ${nick} :End of MOTD command` },
+    // MOTD — rendered from the configured MotdProvider (375/372/376, or
+    // 422 ERR_NOMOTD when no MOTD is configured). Shares the exact rendering
+    // path with the standalone MOTD command.
+    ...buildMotdNumerics(ctx.serverName, nick, ctx.motd.lines()),
   ];
 }
 
 /**
- * Attempts to finalize registration: if both `nick` and `user` are present
- * and the connection is not yet registered, transitions `state.registration`
- * to `'registered'` and returns a `Send` effect carrying the welcome block.
- * Otherwise returns `null` and leaves state untouched.
+ * Attempts to finalize registration: if both `nick` and `user` are present,
+ * the connection is not yet registered, and CAP negotiation is not in
+ * flight, transitions `state.registration` to `'registered'` and returns
+ * a `Send` effect carrying the welcome block.
+ *
+ * Side effects are returned as an array so the caller can `push(...)` them
+ * onto its own effect list. An empty array means "not ready / no work".
+ *
+ * Enforces the deployment's server-password gate (configured via
+ * `serverConfig.serverPassword`) before completing registration:
+ *   - No password configured (undefined or empty) → gate skipped.
+ *   - SASL already authenticated (`state.account` set) → gate satisfied.
+ *   - Otherwise `state.passAttempt` must equal the configured password.
+ *
+ * On gate failure the connection is NOT registered; the returned effects
+ * are `[Send(464 ERR_PASSWDMISMATCH), Disconnect("Bad Password")]` per
+ * RFC 2812 §5.1 (numerics 464 + the canonical close reason used by
+ * mainstream IRC daemons).
  *
  * Reused by the CAP `END` handler.
  */
-export function emitWelcomeIfReady(state: ConnectionState, ctx: Ctx): EffectType | null {
-  if (state.registration === 'registered') return null;
-  if (state.nick === undefined || state.user === undefined) return null;
-  if (state.capNegotiating) return null;
+export function emitWelcomeIfReady(state: ConnectionState, ctx: Ctx): EffectType[] {
+  if (state.registration === 'registered') return [];
+  if (state.nick === undefined || state.user === undefined) return [];
+  if (state.capNegotiating) return [];
+
+  const gateFailure = passwordGateFailure(state, ctx);
+  if (gateFailure !== null) return gateFailure;
+
+  // Apply hostmask cloaking (if enabled) before emitting the welcome block
+  // so the `001` hostmask and every downstream message uses the cloak.
+  applyCloakIfEnabled(state, ctx);
+
   state.registration = 'registered';
-  return Effect.send(ctx.connId, buildWelcomeLines(state, ctx));
+  return [Effect.send(ctx.connId, buildWelcomeLines(state, ctx))];
+}
+
+/**
+ * Replaces `state.host` with a deterministic cloak derived from the
+ * deployment's cloaking secret + the current (real) host. No-op when
+ * cloaking is disabled or no host is set yet (e.g. transport didn't supply
+ * one, or the connection sets it later via CHGHOST).
+ */
+function applyCloakIfEnabled(state: ConnectionState, ctx: Ctx): void {
+  const cloaking = ctx.serverConfig.cloaking;
+  if (cloaking === undefined || !cloaking.enabled) return;
+  if (state.host === undefined) return;
+  state.host = cloakHost(state.host, cloaking, ctx.networkName);
 }
 
+/**
+ * Returns the password-gate failure effects (`[Send 464, Disconnect]`) when
+ * the connection has not satisfied the deployment's server-password, or
+ * `null` when the gate is satisfied / disabled.
+ *
+ * Pulling this out as a named helper keeps {@link emitWelcomeIfReady}
+ * readable and gives tests a direct handle on the gate logic.
+ */
+function passwordGateFailure(state: ConnectionState, ctx: Ctx): EffectType[] | null {
+  const configured = ctx.serverConfig.serverPassword;
+  if (configured === undefined || configured === '') return null;
+  // SASL success satisfies the password gate.
+  if (state.account !== undefined) return null;
+  if (state.passAttempt === configured) return null;
+  return [
+    Effect.send(ctx.connId, [numericErr(ctx, Numerics.ERR_PASSWDMISMATCH, 'Password mismatch')]),
+    Effect.disconnect(ctx.connId, PASSWORD_MISMATCH_REASON),
+  ];
+}
+
+/** Canonical disconnect reason paired with the 464 numeric. */
+const PASSWORD_MISMATCH_REASON = 'Bad Password';
+
 /**
  * Formats a single numeric error line addressed to the connection's current
  * nick (or `*` when unregistered). Optional `middle` param is emitted before
@@ -166,8 +226,7 @@ export const nickReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
   }
   effects.push(Effect.reserveNick(nick, ctx.connId));
 
-  const welcome = emitWelcomeIfReady(state, ctx);
-  if (welcome !== null) effects.push(welcome);
+  effects.push(...emitWelcomeIfReady(state, ctx));
 
   return { state, effects };
 };
@@ -209,8 +268,7 @@ export const userReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
     state.registration = 'registering';
   }
 
-  const welcome = emitWelcomeIfReady(state, ctx);
-  if (welcome !== null) effects.push(welcome);
+  effects.push(...emitWelcomeIfReady(state, ctx));
 
   return { state, effects };
 };