serverless-ircd 0.7.0 → 0.9.0

package/packages/irc-core/src/commands/operserv.ts

@@ -0,0 +1,346 @@
+/**
+ * Pure reducer for the OperServ services pseudo-client.
+ *
+ * OperServ is invoked via `PRIVMSG OperServ :<command>`. The actor routes
+ * any `PRIVMSG` whose target matches {@link OPERSERV_NICK}
+ * (case-insensitive) to {@link operservReducer} instead of the normal
+ * user-target reducer.
+ *
+ * Every subcommand requires oper privileges (`state.userModes.oper`); a
+ * non-oper is rejected with a NOTICE and no state change.
+ *
+ * Supported subcommands:
+ *   - `AKILL ADD <mask> <reason…>` — records a network-wide ban against
+ *     the bound {@link ServicesStore}. The admission path consults
+ *     {@link checkAkillAdmission} on every new connection (and on every
+ *     PRIVMSG via the actor layer) and force-disconnects on match.
+ *   - `AKILL DEL <mask>` — removes the AKILL with the matching mask
+ *     (case-insensitive).
+ *   - `AKILL LIST` — enumerates every recorded AKILL.
+ *   - `JUPE <nick> [reason…]` — blocks a nick / server name locally. The
+ *     NICK reducer consults {@link enforceJupedNick} on every NICK change
+ *     and returns `432 ERR_ERRONEUSNICKNAME` for a jupe'd target.
+ *   - `UNJUPE <nick>` — clears the matching jupe.
+ *   - `RAW <line>` — oper-only; emits the raw IRC line as a Send effect
+ *     (interpreted by the actor as a raw injection) and confirms with a
+ *     NOTICE. Recovery use only.
+ *
+ * The reducer is a pure `Reducer<ConnectionState>`: all side effects are
+ * emitted as {@link Effect}s. AKILL / JUPE persistence lives in the
+ * synchronous {@link ServicesStore}.
+ */
+
+import { Effect } from '../effects.js';
+import type { Effect as EffectType, RawLine } from '../effects.js';
+import { Numerics } from '../protocol/numerics.js';
+import { hostmaskOf } from '../state/connection.js';
+import type { ConnectionState } from '../state/connection.js';
+import type { Ctx, Reducer } from '../types.js';
+
+/** Canonical OperServ pseudo-client nick. */
+export const OPERSERV_NICK = 'OperServ';
+
+/** Services hostmask fragment used by every services pseudo-client. */
+const SERVICES_HOST = 'services';
+
+/** Canonical disconnect reason applied by the AKILL admission hook. */
+export const AKILL_DISCONNECT_REASON = 'AKILL: network-wide ban';
+
+/**
+ * Reducer for `PRIVMSG OperServ :<subcommand> <args…>`.
+ * Authority: the invoking connection's {@link ConnectionState}.
+ */
+export const operservReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
+  state.lastSeen = ctx.clock.now();
+
+  const effects: EffectType[] = [];
+
+  if (ctx.services === undefined) {
+    effects.push(notice(state, 'Services are not available on this server.'));
+    return { state, effects };
+  }
+
+  const body = msg.params[1] ?? '';
+  const tokens = body.split(/\s+/u).filter((t) => t.length > 0);
+  if (tokens.length === 0) {
+    effects.push(helpNotice(state));
+    return { state, effects };
+  }
+
+  // Oper gate: every subcommand requires oper privileges. Reject without
+  // mutating services state so a non-oper cannot add AKILLs / JUPEs.
+  if (!state.userModes.oper) {
+    effects.push(notice(state, 'Permission denied — oper privileges required.'));
+    return { state, effects };
+  }
+
+  const sub = tokens[0]?.toUpperCase();
+  const args = tokens.slice(1);
+
+  switch (sub) {
+    case 'AKILL':
+      return handleAkill(state, args, ctx, effects);
+    case 'JUPE':
+      return handleJupe(state, args, ctx, effects);
+    case 'UNJUPE':
+      return handleUnjupe(state, args, ctx, effects);
+    case 'RAW':
+      return handleRaw(state, args, effects);
+    default:
+      effects.push(unknownNotice(state));
+      return { state, effects };
+  }
+};
+
+// ============================================================================
+// AKILL ADD / DEL / LIST
+// ============================================================================
+
+function handleAkill(
+  state: ConnectionState,
+  args: string[],
+  ctx: Ctx,
+  effects: EffectType[],
+): { state: ConnectionState; effects: EffectType[] } {
+  const services = ctx.services as NonNullable<Ctx['services']>;
+  const action = args[0]?.toUpperCase();
+  const rest = args.slice(1);
+
+  switch (action) {
+    case 'ADD':
+      return handleAkillAdd(state, rest, services, effects);
+    case 'DEL':
+      return handleAkillDel(state, rest, services, effects);
+    case 'LIST':
+      return handleAkillList(state, services, effects);
+    default:
+      effects.push(notice(state, 'Syntax: AKILL ADD|DEL|LIST [args]'));
+      return { state, effects };
+  }
+}
+
+function handleAkillAdd(
+  state: ConnectionState,
+  args: string[],
+  services: NonNullable<Ctx['services']>,
+  effects: EffectType[],
+): { state: ConnectionState; effects: EffectType[] } {
+  const mask = args[0];
+  const reasonTokens = args.slice(1);
+  if (mask === undefined || reasonTokens.length === 0) {
+    effects.push(notice(state, 'Syntax: AKILL ADD <mask> <reason>'));
+    return { state, effects };
+  }
+  const reason = reasonTokens.join(' ');
+  services.addAkill(mask, reason);
+  effects.push(notice(state, `AKILL ${mask} added (reason: ${reason}).`));
+  return { state, effects };
+}
+
+function handleAkillDel(
+  state: ConnectionState,
+  args: string[],
+  services: NonNullable<Ctx['services']>,
+  effects: EffectType[],
+): { state: ConnectionState; effects: EffectType[] } {
+  const mask = args[0];
+  if (mask === undefined) {
+    effects.push(notice(state, 'Syntax: AKILL DEL <mask>'));
+    return { state, effects };
+  }
+  if (services.removeAkill(mask)) {
+    effects.push(notice(state, `AKILL ${mask} removed.`));
+    return { state, effects };
+  }
+  effects.push(notice(state, `No AKILL matching ${mask}.`));
+  return { state, effects };
+}
+
+function handleAkillList(
+  state: ConnectionState,
+  services: NonNullable<Ctx['services']>,
+  effects: EffectType[],
+): { state: ConnectionState; effects: EffectType[] } {
+  const entries = services.listAkills();
+  if (entries.length === 0) {
+    effects.push(notice(state, 'No AKILLs are currently set.'));
+    return { state, effects };
+  }
+  for (const entry of entries) {
+    effects.push(notice(state, `${entry.mask} — ${entry.reason}`));
+  }
+  effects.push(notice(state, 'End of AKILL list.'));
+  return { state, effects };
+}
+
+// ============================================================================
+// JUPE / UNJUPE
+// ============================================================================
+
+function handleJupe(
+  state: ConnectionState,
+  args: string[],
+  ctx: Ctx,
+  effects: EffectType[],
+): { state: ConnectionState; effects: EffectType[] } {
+  const services = ctx.services as NonNullable<Ctx['services']>;
+  const name = args[0];
+  if (name === undefined) {
+    effects.push(notice(state, 'Syntax: JUPE <nick> [reason]'));
+    return { state, effects };
+  }
+  const reasonTokens = args.slice(1);
+  if (reasonTokens.length === 0) {
+    services.addJupe(name);
+    effects.push(notice(state, `JUPE ${name} added.`));
+    return { state, effects };
+  }
+  const reason = reasonTokens.join(' ');
+  services.addJupe(name, reason);
+  effects.push(notice(state, `JUPE ${name} added (reason: ${reason}).`));
+  return { state, effects };
+}
+
+function handleUnjupe(
+  state: ConnectionState,
+  args: string[],
+  ctx: Ctx,
+  effects: EffectType[],
+): { state: ConnectionState; effects: EffectType[] } {
+  const services = ctx.services as NonNullable<Ctx['services']>;
+  const name = args[0];
+  if (name === undefined) {
+    effects.push(notice(state, 'Syntax: UNJUPE <nick>'));
+    return { state, effects };
+  }
+  if (services.removeJupe(name)) {
+    effects.push(notice(state, `JUPE ${name} removed.`));
+    return { state, effects };
+  }
+  effects.push(notice(state, `No JUPE matching ${name}.`));
+  return { state, effects };
+}
+
+// ============================================================================
+// RAW
+// ============================================================================
+
+/**
+ * Handles `RAW <line>`. The line is emitted back to the oper via a Send
+ * effect (the actor layer interprets this as a raw injection; for the
+ * in-memory runtime it is observable verbatim), and a confirmation
+ * NOTICE follows. Logged at the dispatch layer via the standard
+ * observability surface.
+ */
+function handleRaw(
+  state: ConnectionState,
+  args: string[],
+  effects: EffectType[],
+): { state: ConnectionState; effects: EffectType[] } {
+  if (args.length === 0) {
+    effects.push(notice(state, 'Syntax: RAW <line>'));
+    return { state, effects };
+  }
+  const line = args.join(' ');
+  const raw: RawLine = { text: line };
+  effects.push(Effect.send(state.id, [raw]));
+  effects.push(notice(state, 'RAW line accepted and logged.'));
+  return { state, effects };
+}
+
+// ============================================================================
+// Admission hook — AKILL
+// ============================================================================
+
+/**
+ * Returns the effects to emit when a connection's hostmask is first
+ * computable (at the `$connect` / admission boundary). If the hostmask
+ * matches a recorded AKILL, the connection is force-disconnected via a
+ * {@link Effect.disconnect} (with a NOTICE explaining the ban). Returns
+ * `[]` when no services store is bound, the connection has no hostmask
+ * yet, or no AKILL matches.
+ *
+ * Called by the actor layer once the connection has a nick!user@host to
+ * check (post-registration / pre-welcome). Pure: the only input is the
+ * connection state + ctx; the only output is the effect list.
+ */
+export function checkAkillAdmission(state: ConnectionState, ctx: Ctx): EffectType[] {
+  const services = ctx.services;
+  if (services === undefined) return [];
+  const hostmask = hostmaskOf(state);
+  if (hostmask === undefined) return [];
+  const hit = services.matchAkill(hostmask);
+  if (hit === undefined) return [];
+  // `hostmaskOf` returns undefined when `nick` is undefined; we returned
+  // early above on the undefined-hostmask path, so `state.nick` is
+  // guaranteed defined here.
+  // biome-ignore lint/style/noNonNullAssertion: invariant — see above.
+  const nick = state.nick!;
+  const noticeLine: RawLine = {
+    text: `:${OPERSERV_NICK}!${OPERSERV_NICK}@${SERVICES_HOST} NOTICE ${nick} :You are banned from this network (AKILL: ${hit.reason}).`,
+  };
+  return [
+    Effect.send(state.id, [noticeLine]),
+    Effect.disconnect(state.id, AKILL_DISCONNECT_REASON),
+  ];
+}
+
+// ============================================================================
+// JUPE enforcement hook — NICK reducer
+// ============================================================================
+
+/**
+ * Returns the effects to emit when a client has just taken (or attempted
+ * to take) `nick`: if the nick is juped, returns a single
+ * `432 ERR_ERRONEUSNICKNAME` Send effect addressed to the connection.
+ * Returns `[]` when no services store is bound, the nick is undefined,
+ * or the nick is not juped.
+ *
+ * Called by the NICK reducer on every nick-change attempt so a jupe'd
+ * target surfaces the same numeric an invalid nick would.
+ */
+export function enforceJupedNick(
+  state: ConnectionState,
+  nick: string | undefined,
+  ctx: Ctx,
+): EffectType[] {
+  const services = ctx.services;
+  if (services === undefined) return [];
+  if (nick === undefined) return [];
+  if (!services.isJuped(nick)) return [];
+  const sender = state.nick ?? '*';
+  const code = Numerics.ERR_ERRONEUSNICKNAME.toString().padStart(3, '0');
+  const line: RawLine = {
+    text: `:${ctx.serverName} ${code} ${sender} ${nick} :Erroneous nickname`,
+  };
+  return [Effect.send(state.id, [line])];
+}
+
+// ============================================================================
+// Notice helpers
+// ============================================================================
+
+/** Builds a `:OperServ!OperServ@services NOTICE <nick> :<text>` line. */
+function notice(state: ConnectionState, text: string): EffectType {
+  return Effect.send(state.id, [servicesNotice(OPERSERV_NICK, state, text)]);
+}
+
+/** Builds a help `:OperServ!OperServ@services NOTICE <nick> :…` line. */
+function helpNotice(state: ConnectionState): EffectType {
+  return notice(state, 'Available commands: AKILL, JUPE, RAW');
+}
+
+function unknownNotice(state: ConnectionState): EffectType {
+  return notice(state, 'Unknown command. Available: AKILL, JUPE, RAW');
+}
+
+/**
+ * Formats a services NOTICE line. The source hostmask is
+ * `<svc>!<svc>@services` regardless of the deployment's serverName so the
+ * pseudo-clients are stable across deployments and easy to identify in
+ * client UIs.
+ */
+function servicesNotice(svc: string, state: ConnectionState, text: string): RawLine {
+  const nick = state.nick ?? '*';
+  return { text: `:${svc}!${svc}@${SERVICES_HOST} NOTICE ${nick} :${text}` };
+}

package/packages/irc-core/src/commands/pre-away.ts

@@ -14,7 +14,9 @@
  *     `306 RPL_NOWAWAY` is emitted as if the client had sent
  *     `AWAY :reason` themselves.
  *
- * Mirrors the {@link ReadMarkerStore} plumbing from the read-marker cap.
+ * Mirrors the read-marker plumbing on the services store: the away
+ * persistence is gated on a store being bound AND the connection being
+ * identified, the same shape `persistReadMarker` uses.
  */
 
 import { PRE_AWAY_CAP_NAME } from '../caps/capabilities.js';

package/packages/irc-core/src/commands/privmsg.ts

@@ -88,6 +88,20 @@ function maySpeakOnModerated(entry: { op: boolean; voice: boolean } | undefined)
   return entry.op || entry.voice;
 }
 
+/**
+ * Returns true iff the sender may speak under the ChanServ `+M`
+ * (moderated-ident) mode: ops and voiced members always pass, and any
+ * identified connection (account set) passes; unidentified non-op/non-voice
+ * members are blocked.
+ */
+function maySpeakOnModeratedIdent(
+  entry: { op: boolean; voice: boolean } | undefined,
+  account: string | undefined,
+): boolean {
+  if (entry !== undefined && (entry.op || entry.voice)) return true;
+  return account !== undefined;
+}
+
 /** Command flavor: PRIVMSG surfaces errors; NOTICE is silent. */
 type MessageCommand = 'PRIVMSG' | 'NOTICE';
 
@@ -152,6 +166,34 @@ function buildChannelReducer(command: MessageCommand): Reducer<ChannelState> {
       return { state, effects };
     }
 
+    // ChanServ +M (moderated-ident): ops/voiced/identified pass; everyone
+    // else is blocked with 404.
+    if (
+      state.modes.moderatedIdent &&
+      !maySpeakOnModeratedIdent(senderEntry, ctx.connection.account)
+    ) {
+      if (!silent) {
+        effects.push(
+          Effect.send(ctx.connId, [
+            numericErr(ctx, Numerics.ERR_CANNOTSENDTOCHAN, 'Cannot send to channel', state.name),
+          ]),
+        );
+      }
+      return { state, effects };
+    }
+
+    // ChanServ +R (block unidentified): sender must be identified.
+    if (state.modes.blockUnidentified && ctx.connection.account === undefined) {
+      if (!silent) {
+        effects.push(
+          Effect.send(ctx.connId, [
+            numericErr(ctx, Numerics.ERR_CANNOTSENDTOCHAN, 'Cannot send to channel', state.name),
+          ]),
+        );
+      }
+      return { state, effects };
+    }
+
     // +b (ban): sender's hostmask must not match any ban mask.
     if (state.banMasks.size > 0) {
       for (const mask of state.banMasks) {

package/packages/irc-core/src/commands/read-marker.ts

@@ -14,7 +14,7 @@
  *     `TAGMSG <target>` carrying `+draft/read-marker=<msgid>`. The
  *     {@link tagmsgChannelReducer} detects the tag, calls
  *     {@link persistReadMarker} to advance the per-`(account, channel)`
- *     record in the bound {@link ReadMarkerStore}, and fans the TAGMSG out
+ *     record in the bound {@link ServicesStore}, and fans the TAGMSG out
  *     (carrying the tag) so the user's other connections learn the new
  *     read position.
  *   - On SASL identify, the actor calls {@link seedReadMarkers} so a fresh
@@ -23,7 +23,7 @@
  */
 
 import { READ_MARKER_CAP_NAME } from '../caps/capabilities.js';
-import type { ReadMarkerStore } from '../ports.js';
+import type { ServicesStore } from '../ports.js';
 import type { ConnectionState } from '../state/connection.js';
 import type { Ctx } from '../types.js';
 
@@ -61,7 +61,7 @@ export function readMarkerMsgid(tags: Readonly<Record<string, string>>): string
  * Advances the per-`(account, channel)` last-read marker.
  *
  * Always advances the connection's in-memory {@link ConnectionState.lastReadMarkers}
- * so the current session tracks the read position. When a {@link ReadMarkerStore}
+ * so the current session tracks the read position. When a {@link ServicesStore}
  * is bound AND the connection is identified (has an `account`), the marker is
  * also persisted so it survives reconnects and is shared across the account's
  * connections.
@@ -75,10 +75,10 @@ export function persistReadMarker(ctx: Ctx, chanLower: string, msgid: string): v
   }
   ctx.connection.lastReadMarkers.set(chanLower, msgid);
 
-  const store = ctx.readMarkers;
+  const services = ctx.services;
   const account = ctx.connection.account;
-  if (store !== undefined && account !== undefined) {
-    store.set(account, chanLower, msgid);
+  if (services !== undefined && account !== undefined) {
+    services.setLastReadMarker(account, chanLower, msgid);
   }
 }
 
@@ -92,10 +92,10 @@ export function persistReadMarker(ctx: Ctx, chanLower: string, msgid: string): v
  */
 export function seedReadMarkers(
   conn: ConnectionState,
-  store: ReadMarkerStore,
+  store: ServicesStore,
   account: string,
 ): void {
-  const entries = store.forAccount(account);
+  const entries = store.listReadMarkers(account);
   if (entries.length === 0) return;
   if (conn.lastReadMarkers === undefined) {
     conn.lastReadMarkers = new Map<string, string>();

package/packages/irc-core/src/commands/registration.ts

@@ -18,11 +18,15 @@ import { formatCreatedAt, resolveServerVersion } from '../config.js';
 import { Effect } from '../effects.js';
 import type { Effect as EffectType, RawLine } from '../effects.js';
 import { Numerics } from '../protocol/numerics.js';
+import type { ChanName } from '../state/channel.js';
 import { hostmaskOf } from '../state/connection.js';
 import type { ConnectionState } from '../state/connection.js';
 import type { Ctx, Reducer } from '../types.js';
+import { attemptPassAccountAuth, passBasedAccountAuth } from './account-auth.js';
 import { generateIsupport } from './isupport.js';
 import { buildMotdNumerics } from './motd-lines.js';
+import { enforceRegisteredNick } from './nickserv.js';
+import { checkAkillAdmission, enforceJupedNick } from './operserv.js';
 
 /** User mode letters for `004 RPL_MYINFO` (invisible, oper, wallops, server-notices). */
 const USER_MODES_004 = 'iosw';
@@ -110,6 +114,14 @@ export function emitWelcomeIfReady(state: ConnectionState, ctx: Ctx): EffectType
   if (state.nick === undefined || state.user === undefined) return [];
   if (state.capNegotiating) return [];
 
+  // PASS-based account auth runs before the bare server-password gate. On
+  // success it identifies the connection (`state.account` set) and emits
+  // the account-login numerics (900/903 + downstream effects), satisfying
+  // the gate as a side effect. On every other outcome it returns `[]` and
+  // the gate below decides. No-op when already identified (SASL), when no
+  // `<nick>:<password>` form is present, or when no AccountStore is bound.
+  const authEffects = passBasedAccountAuth(state, ctx);
+
   const gateFailure = passwordGateFailure(state, ctx);
   if (gateFailure !== null) return gateFailure;
 
@@ -126,19 +138,39 @@ export function emitWelcomeIfReady(state: ConnectionState, ctx: Ctx): EffectType
   }
 
   state.registration = 'registered';
-  return [Effect.send(ctx.connId, buildWelcomeLines(state, ctx))];
+  // Fire NickServ nick-enforcement when an unidentified client just took a
+  // registered nick. Returns [] when no services store is bound or the nick
+  // is not registered / the client is identified as the owner. Appended
+  // after the welcome Send so the 001 block lands before the warning NOTICE.
+  const enforcement = enforceRegisteredNick(state, ctx);
+  // OperServ AKILL admission: once the hostmask is computable (post-cloak)
+  // check the bound services store for a network-wide ban. Returns [] when
+  // no services store is bound, no hostmask is available, or no mask
+  // matches. On match the hostmask IS rejected (Disconnect), matching the
+  // `$connect` admission contract.
+  const akill = checkAkillAdmission(state, ctx);
+  return [
+    ...authEffects,
+    Effect.send(ctx.connId, buildWelcomeLines(state, ctx)),
+    ...enforcement,
+    ...akill,
+  ];
 }
 
 /**
  * Replaces `state.host` with a deterministic cloak derived from the
  * deployment's cloaking secret + the current (real) host. No-op when
  * cloaking is disabled or no host is set yet (e.g. transport didn't supply
- * one, or the connection sets it later via CHGHOST).
+ * one, or the connection sets it later via CHGHOST). Also a no-op when a
+ * HostServ vhost is already active (`vhostActive`) — the vhost was re-applied
+ * by {@link applyAccountSuccess} during SASL / PASS-auth and must win over the
+ * cloak so it remains visible in the `001` welcome.
  */
 function applyCloakIfEnabled(state: ConnectionState, ctx: Ctx): void {
   const cloaking = ctx.serverConfig.cloaking;
   if (cloaking === undefined || !cloaking.enabled) return;
   if (state.host === undefined) return;
+  if (state.vhostActive === true) return;
   state.host = cloakHost(state.host, cloaking, ctx.networkName);
 }
 
@@ -209,6 +241,16 @@ export const nickReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
     return { state, effects };
   }
 
+  // OperServ JUPE: a jupe'd nick is rejected with the same 432 numeric a
+  // grammar-invalid nick would surface, for both pre- and post-registration
+  // attempts. Returns [] when no services store is bound or the nick is not
+  // juped, so the normal flow is undisturbed.
+  const jupe = enforceJupedNick(state, nick, ctx);
+  if (jupe.length > 0) {
+    effects.push(...jupe);
+    return { state, effects };
+  }
+
   if (state.registration === 'registered') {
     const oldNick = state.nick;
     if (oldNick === undefined) {
@@ -230,7 +272,19 @@ export const nickReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
     }
     state.nick = nick;
     effects.push(Effect.changeNick(ctx.connId, oldNick, nick));
-    effects.push(Effect.send(ctx.connId, [{ text: `:${source} NICK ${nick}` }]));
+    // The `:oldhostmask NICK newnick` line goes to the originator AND every
+    // peer sharing a channel with them (RFC 2812 §3.1.2). Each channel
+    // broadcast excludes the originator, who already received the echo via
+    // the Send above — matching the QUIT/CHGHOST fanout convention.
+    const nickLine: RawLine = { text: `:${source} NICK ${nick}` };
+    effects.push(Effect.send(ctx.connId, [nickLine]));
+    for (const chan of state.joinedChannels) {
+      effects.push(Effect.broadcast(chan as ChanName, [nickLine], ctx.connId));
+    }
+    // Fire NickServ nick-enforcement when a registered client changes onto a
+    // registered nick they are not identified as. Returns [] when no
+    // services store is bound or the new nick is not registered.
+    effects.push(...enforceRegisteredNick(state, ctx));
     return { state, effects };
   }
 
@@ -290,28 +344,40 @@ export const userReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
 /**
  * Reducer for `PASS <password>`.
  *
- * Only stashes the attempt as `state.passAttempt`. Actual server-password
- * enforcement lives in the actor layer / security hardening
- * since it requires comparing against the deployment's configured
- * password, which the pure reducer does not see.
+ * Pre-registration: stashes the attempt as `state.passAttempt` for the
+ * server-password gate ({@link passwordGateFailure}) and the at-completion
+ * PASS-auth ({@link passBasedAccountAuth}). A second `PASS` before
+ * registration completes is rejected with `462 ERR_ALREADYREGISTRED`.
+ *
+ * Post-registration: a bare server password is meaningless, so only the
+ * `<nick>:<password>` form is honoured — as a late account login via
+ * {@link attemptPassAccountAuth} against the bound `ctx.accounts`. Every
+ * other outcome (bare value, no store, already identified, verify failure)
+ * is a silent no-op: no `462`, no disconnect. This lets a client that
+ * completed `NICK`+`USER` before sending `PASS` identify after the fact.
  */
 export const passReducer: Reducer<ConnectionState> = (state, msg, ctx) => {
   const effects: EffectType[] = [];
 
-  if (state.registration === 'registered') {
+  const password = msg.params[0];
+  if (password === undefined) {
     effects.push(
       Effect.send(ctx.connId, [
-        numericErr(ctx, Numerics.ERR_ALREADYREGISTRED, 'You may not reregister'),
+        numericErr(ctx, Numerics.ERR_NEEDMOREPARAMS, 'Not enough parameters', 'PASS'),
       ]),
     );
     return { state, effects };
   }
 
-  const password = msg.params[0];
-  if (password === undefined) {
+  if (state.registration === 'registered') {
+    effects.push(...attemptPassAccountAuth(state, ctx, password));
+    return { state, effects };
+  }
+
+  if (state.passAttempt !== undefined) {
     effects.push(
       Effect.send(ctx.connId, [
-        numericErr(ctx, Numerics.ERR_NEEDMOREPARAMS, 'Not enough parameters', 'PASS'),
+        numericErr(ctx, Numerics.ERR_ALREADYREGISTRED, 'You may not reregister'),
       ]),
     );
     return { state, effects };