Merge pull request #7 from HueByte/dev_e2e_encrypt

feat: Implement message encryption and decryption support

.github/workflows/ci.yml

@@ -1,8 +1,11 @@
-name: PR Check
+name: CI
 
 on:
-  pull_request:
+  push:
     branches: [master]
+  pull_request:
+    branches: [master, dev]
+  workflow_dispatch:
 
 jobs:
   lint-markdown:
@@ -28,25 +31,30 @@ jobs:
       - name: Check formatting
         run: dotnet format src/EchoHub.slnx --verify-no-changes --verbosity diagnostic
 
-  test:
+  build-and-test:
     name: Build & Test
-    needs: [lint-markdown, format-check]
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Check for src/ changes
         id: changes
         env:
+          EVENT: ${{ github.event_name }}
+          BEFORE: ${{ github.event.before }}
           BASE_REF: ${{ github.base_ref }}
         run: |
-          git fetch origin "$BASE_REF" --depth=1
-          CHANGED=$(git diff --name-only "origin/$BASE_REF"...HEAD -- 'src/' | wc -l)
-          if [ "$CHANGED" -gt 0 ]; then
-            echo "src_changed=true" >> "$GITHUB_OUTPUT"
+          if [ "$EVENT" = "pull_request" ]; then
+            git fetch origin "$BASE_REF" --depth=1
+            CHANGED=$(git diff --name-only "origin/$BASE_REF"...HEAD -- 'src/' | wc -l)
+          elif [ -z "$BEFORE" ] || [ "$BEFORE" = "0000000000000000000000000000000000000000" ]; then
+            CHANGED=1
           else
-            echo "src_changed=false" >> "$GITHUB_OUTPUT"
+            CHANGED=$(git diff --name-only "$BEFORE" HEAD -- 'src/' | wc -l)
           fi
+          [ "$CHANGED" -gt 0 ] && echo "src_changed=true" >> "$GITHUB_OUTPUT" || echo "src_changed=false" >> "$GITHUB_OUTPUT"
 
       - name: Setup .NET 10
         if: steps.changes.outputs.src_changed == 'true'

.github/workflows/release.yml

@@ -1,4 +1,4 @@
-name: CI / Release
+name: Release
 
 on:
   push:
@@ -9,96 +9,28 @@ permissions:
   contents: write
 
 jobs:
-  lint-markdown:
-    name: Markdown Lint
+  release:
+    name: Create Release
     runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Run markdownlint
-        run: bash scripts/lint-markdown.sh
-
-  format-check:
-    name: Format Check
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup .NET 10
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: '10.0.x'
-
-      - name: Check formatting
-        run: dotnet format src/EchoHub.slnx --verify-no-changes --verbosity diagnostic
-
-  detect-changes:
-    name: Detect Changes
-    runs-on: ubuntu-latest
-    outputs:
-      src_changed: ${{ steps.check.outputs.src_changed }}
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - name: Check for changes
-        id: check
+      - name: Check for src/ changes
+        id: changes
         env:
           BEFORE: ${{ github.event.before }}
         run: |
-          if [ "$BEFORE" = "0000000000000000000000000000000000000000" ]; then
-            # Initial push — treat everything as changed
+          if [ -z "$BEFORE" ] || [ "$BEFORE" = "0000000000000000000000000000000000000000" ]; then
             echo "src_changed=true" >> "$GITHUB_OUTPUT"
           else
-            SRC_CHANGED=$(git diff --name-only "$BEFORE" HEAD -- 'src/' | wc -l)
-
-            [ "$SRC_CHANGED" -gt 0 ] && echo "src_changed=true" >> "$GITHUB_OUTPUT" || echo "src_changed=false" >> "$GITHUB_OUTPUT"
+            CHANGED=$(git diff --name-only "$BEFORE" HEAD -- 'src/' | wc -l)
+            [ "$CHANGED" -gt 0 ] && echo "src_changed=true" >> "$GITHUB_OUTPUT" || echo "src_changed=false" >> "$GITHUB_OUTPUT"
           fi
 
-  test:
-    name: Build & Test
-    needs: [lint-markdown, format-check, detect-changes]
-    if: needs.detect-changes.outputs.src_changed == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup .NET 10
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: '10.0.x'
-
-      - name: Cache NuGet packages
-        uses: actions/cache@v4
-        with:
-          path: ~/.nuget/packages
-          key: nuget-${{ runner.os }}-${{ hashFiles('src/**/*.csproj') }}
-          restore-keys: nuget-${{ runner.os }}-
-
-      - name: Restore dependencies
-        run: dotnet restore src/EchoHub.slnx
-
-      - name: Build
-        run: dotnet build src/EchoHub.slnx --no-restore --configuration Release
-
-      - name: Test
-        run: dotnet test src/EchoHub.slnx --no-build --configuration Release --verbosity normal
-
-  release:
-    name: Create Release
-    needs: [lint-markdown, format-check, detect-changes, test]
-    if: needs.detect-changes.outputs.src_changed == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup .NET 10
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: '10.0.x'
-
       - name: Read version
+        if: steps.changes.outputs.src_changed == 'true'
         id: version
         run: |
           VERSION=$(grep -oP '(?<=<Version>)[^<]+' src/Directory.Build.props)
@@ -106,6 +38,7 @@ jobs:
           echo "tag=v$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Check if release exists
+        if: steps.changes.outputs.src_changed == 'true'
         id: check_release
         run: |
           if gh release view "${{ steps.version.outputs.tag }}" &>/dev/null; then
@@ -116,40 +49,46 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Setup .NET 10
+        if: steps.changes.outputs.src_changed == 'true' && steps.check_release.outputs.exists == 'false'
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+
       - name: Publish Server win-x64
-        if: steps.check_release.outputs.exists == 'false'
+        if: steps.changes.outputs.src_changed == 'true' && steps.check_release.outputs.exists == 'false'
         run: dotnet publish src/EchoHub.Server/EchoHub.Server.csproj -c Release -r win-x64 --self-contained true -o publish/server-win-x64
 
       - name: Publish Server linux-x64
-        if: steps.check_release.outputs.exists == 'false'
+        if: steps.changes.outputs.src_changed == 'true' && steps.check_release.outputs.exists == 'false'
         run: dotnet publish src/EchoHub.Server/EchoHub.Server.csproj -c Release -r linux-x64 --self-contained true -o publish/server-linux-x64
 
       - name: Publish Server osx-x64
-        if: steps.check_release.outputs.exists == 'false'
+        if: steps.changes.outputs.src_changed == 'true' && steps.check_release.outputs.exists == 'false'
         run: dotnet publish src/EchoHub.Server/EchoHub.Server.csproj -c Release -r osx-x64 --self-contained true -o publish/server-osx-x64
 
       - name: Publish Server osx-arm64
-        if: steps.check_release.outputs.exists == 'false'
+        if: steps.changes.outputs.src_changed == 'true' && steps.check_release.outputs.exists == 'false'
         run: dotnet publish src/EchoHub.Server/EchoHub.Server.csproj -c Release -r osx-arm64 --self-contained true -o publish/server-osx-arm64
 
       - name: Publish Client win-x64
-        if: steps.check_release.outputs.exists == 'false'
+        if: steps.changes.outputs.src_changed == 'true' && steps.check_release.outputs.exists == 'false'
         run: dotnet publish src/EchoHub.Client/EchoHub.Client.csproj -c Release -r win-x64 --self-contained true -o publish/client-win-x64
 
       - name: Publish Client linux-x64
-        if: steps.check_release.outputs.exists == 'false'
+        if: steps.changes.outputs.src_changed == 'true' && steps.check_release.outputs.exists == 'false'
         run: dotnet publish src/EchoHub.Client/EchoHub.Client.csproj -c Release -r linux-x64 --self-contained true -o publish/client-linux-x64
 
       - name: Publish Client osx-x64
-        if: steps.check_release.outputs.exists == 'false'
+        if: steps.changes.outputs.src_changed == 'true' && steps.check_release.outputs.exists == 'false'
         run: dotnet publish src/EchoHub.Client/EchoHub.Client.csproj -c Release -r osx-x64 --self-contained true -o publish/client-osx-x64
 
       - name: Publish Client osx-arm64
-        if: steps.check_release.outputs.exists == 'false'
+        if: steps.changes.outputs.src_changed == 'true' && steps.check_release.outputs.exists == 'false'
         run: dotnet publish src/EchoHub.Client/EchoHub.Client.csproj -c Release -r osx-arm64 --self-contained true -o publish/client-osx-arm64
 
       - name: Zip artifacts
-        if: steps.check_release.outputs.exists == 'false'
+        if: steps.changes.outputs.src_changed == 'true' && steps.check_release.outputs.exists == 'false'
         run: |
           cd publish
           zip -r ../EchoHub-Server-win-x64.zip server-win-x64/
@@ -161,12 +100,44 @@ jobs:
           zip -r ../EchoHub-Client-osx-x64.zip client-osx-x64/
           zip -r ../EchoHub-Client-osx-arm64.zip client-osx-arm64/
 
+      - name: Build release notes
+        if: steps.changes.outputs.src_changed == 'true' && steps.check_release.outputs.exists == 'false'
+        id: notes
+        run: |
+          TAG="${{ steps.version.outputs.tag }}"
+          CHANGELOG_URL="https://huebyte.github.io/EchoHub/changelog/${TAG}.html"
+          REPO="https://github.com/${{ github.repository }}"
+          PREV_TAG=$(git tag --sort=-v:refname | grep -v "^${TAG}$" | head -n 1)
+
+          {
+            echo "body<<RELEASE_EOF"
+            echo "📋 **[Full Changelog](${CHANGELOG_URL})**"
+            echo ""
+            echo "---"
+            echo ""
+            echo "### Commits"
+            echo ""
+            if [ -n "$PREV_TAG" ]; then
+              git log "${PREV_TAG}..HEAD" --pretty=format:"- %s (%h)" --no-merges
+            else
+              git log HEAD --pretty=format:"- %s (%h)" --no-merges
+            fi
+            echo ""
+            echo ""
+            if [ -n "$PREV_TAG" ]; then
+              echo "*Version diff: [${PREV_TAG}...${TAG}](${REPO}/compare/${PREV_TAG}...${TAG})*"
+            else
+              echo "*Version diff: [${TAG}](${REPO}/commits/${TAG})*"
+            fi
+            echo "RELEASE_EOF"
+          } >> "$GITHUB_OUTPUT"
+
       - name: Create GitHub Release
-        if: steps.check_release.outputs.exists == 'false'
+        if: steps.changes.outputs.src_changed == 'true' && steps.check_release.outputs.exists == 'false'
         run: |
           gh release create "${{ steps.version.outputs.tag }}" \
             --title "EchoHub ${{ steps.version.outputs.tag }}" \
-            --generate-notes \
+            --notes "${{ steps.notes.outputs.body }}" \
             EchoHub-Server-win-x64.zip \
             EchoHub-Server-linux-x64.zip \
             EchoHub-Server-osx-x64.zip \

README.md

@@ -13,11 +13,19 @@
 <p align="center">
   <a href="#what-is-this">What</a> •
   <a href="#getting-started">Setup</a> •
+  <a href="#irc-gateway">IRC</a> •
+  <a href="#deployment-with-nginx">Deploy</a> •
   <a href="#client-commands">Commands</a> •
   <a href="#configuration">Config</a> •
   <a href="#license">License</a>
 </p>
 
+<p align="center">
+  <a href="https://echohub.voidcube.cloud/">Website</a> •
+  <a href="https://echohub.voidcube.cloud/servers">Public Servers</a> •
+  <a href="https://huebyte.github.io/EchoHub/">Documentation</a>
+</p>
+
 <p align="center">
   <img alt=".NET 10" src="https://img.shields.io/badge/.NET-10-512BD4?style=flat-square&logo=dotnet&logoColor=white" />
   <img alt="SignalR" src="https://img.shields.io/badge/SignalR-Real--time-0078D4?style=flat-square" />
@@ -40,21 +48,25 @@ Each server is fully independent — no central authority, no account federation
 ```mermaid
 graph TD
     subgraph Server["Server"]
+        ChatSvc["ChatService"]
         Hub["SignalR ChatHub"]
+        IRC["IRC Gateway :6667"]
         Auth["JWT Auth"]
         DB["SQLite DB (EF Core)"]
         Files["File Storage"]
     end
 
-    subgraph Client["Client"]
+    subgraph Clients["Clients"]
         TUI["Terminal GUI (TUI)"]
-        Theme["Theme Engine"]
-        API["API Client (auto-refresh)"]
+        IRCClient["IRC Client (irssi, WeeChat, ...)"]
     end
 
-    API -- "WebSocket" --> Hub
-    API -- "REST" --> Auth
-    Hub --> DB
+    TUI -- "WebSocket" --> Hub
+    TUI -- "REST" --> Auth
+    IRCClient -- "TCP" --> IRC
+    Hub --> ChatSvc
+    IRC --> ChatSvc
+    ChatSvc --> DB
     Auth --> DB
     Files --> DB
 ```
@@ -65,6 +77,7 @@ graph TD
 
 - **Self-hostable** — your server, your rules, your data
 - **Real-time messaging** via SignalR WebSockets
+- **IRC gateway** — native IRC clients connect alongside TUI users, full cross-protocol messaging
 - **JWT auth** with short-lived access tokens and 30-day refresh tokens
 - **Channels** — create, set topics, delete (no 47-step permission wizard required)
 - **File & image uploads** with actual validation (magic bytes, not just trusting the extension)
@@ -122,6 +135,66 @@ Connect, register, chat. That's the whole onboarding flow.
 dotnet build src/EchoHub.slnx
 ```
 
+## IRC Gateway
+
+EchoHub includes a built-in IRC protocol gateway. Any standard IRC client can connect to the same server and chat alongside TUI users — messages flow both ways in real time.
+
+### Enable It
+
+In the server's `appsettings.json`:
+
+```json
+{
+  "Irc": {
+    "Enabled": true,
+    "Port": 6667,
+    "ServerName": "echohub",
+    "Motd": "Welcome to EchoHub IRC Gateway!"
+  }
+}
+```
+
+### Connect
+
+```bash
+# irssi
+irssi -c your-server.com -p 6667 -w <password> -n <username>
+
+# WeeChat
+/server add echohub your-server.com/6667 -password=<password> -nicks=<username>
+/connect echohub
+```
+
+IRC users must have an existing EchoHub account (no registration via IRC). Auth works via `PASS`/`NICK`/`USER` or SASL PLAIN.
+
+### What Works
+
+| Feature | How it maps to IRC |
+| ------- | ------------------ |
+| Text messages | Standard `PRIVMSG` (long messages split at ~400 byte chunks) |
+| Images | `[Image: filename]` + download URL + ASCII art line-by-line |
+| File uploads | `[File: filename] /api/files/{id}` |
+| Channels | `JOIN`, `PART`, `NAMES`, `TOPIC`, `LIST` |
+| Presence | `AWAY`, `WHO`, `WHOIS` |
+| Status | Maps to IRC away/here |
+
+### TLS
+
+If running behind **nginx** (recommended), let nginx handle TLS -- see [Deployment with nginx](#deployment-with-nginx) below.
+
+For direct TLS without a reverse proxy, the IRC gateway can terminate TLS itself:
+
+```json
+{
+  "Irc": {
+    "TlsEnabled": true,
+    "TlsPort": 6697,
+    "TlsCertPath": "/path/to/cert.pfx",
+    "TlsCertPassword": "your-password"
+  }
+}
+```
+
 ## Client Commands
 
 | Command | Description |
@@ -172,35 +245,107 @@ dotnet build src/EchoHub.slnx
 | `Jwt:Secret` | *(auto-generated)* | JWT signing key |
 | `Server:Name` | `My EchoHub Server` | Server display name |
 | `Server:Description` | `A self-hosted EchoHub chat server` | Server description |
+| `Server:PublicServer` | `false` | List on the [public directory](https://echohub.voidcube.cloud/servers) |
+| `Server:PublicHost` | *(empty)* | Public hostname for directory listing |
+| `Irc:Enabled` | `false` | Enable the IRC gateway |
+| `Irc:Port` | `6667` | IRC listen port |
+| `Irc:TlsEnabled` | `false` | Enable TLS for IRC |
+| `Irc:TlsPort` | `6697` | IRC TLS port |
+| `Irc:ServerName` | `echohub` | IRC server name in protocol messages |
+| `Irc:Motd` | `Welcome to EchoHub IRC Gateway!` | Message of the day |
 | `Cors:AllowedOrigins` | *(all origins)* | CORS whitelist |
 
-Logging uses Serilog — console + daily rolling files with 14-day retention. Configure it in the `Serilog` section of appsettings.
+Logging uses Serilog — console + daily rolling files with 14-day retention. Configure in the `Serilog` section.
+
+## Deployment with nginx
+
+Most production deployments run behind nginx. Here's a config that handles both the HTTP/WebSocket server and the IRC gateway:
+
+```nginx
+# HTTP + WebSocket (EchoHub Server API + SignalR)
+server {
+    listen 443 ssl;
+    server_name echohub.example.com;
+
+    ssl_certificate     /etc/letsencrypt/live/echohub.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/echohub.example.com/privkey.pem;
+
+    location / {
+        proxy_pass http://127.0.0.1:5000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Required for SignalR WebSocket
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $http_connection;
+
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+    }
+
+    # Increase max upload size for file sharing
+    client_max_body_size 10m;
+}
+
+# HTTP → HTTPS redirect
+server {
+    listen 80;
+    server_name echohub.example.com;
+    return 301 https://$host$request_uri;
+}
+
+# IRC TLS (port 6697 → plain IRC on 6667)
+stream {
+    upstream irc_backend {
+        server 127.0.0.1:6667;
+    }
+
+    server {
+        listen 6697 ssl;
+        proxy_pass irc_backend;
+
+        ssl_certificate     /etc/letsencrypt/live/echohub.example.com/fullchain.pem;
+        ssl_certificate_key /etc/letsencrypt/live/echohub.example.com/privkey.pem;
+    }
+}
+```
+
+With this setup, keep the EchoHub IRC gateway's `TlsEnabled` set to `false` — nginx terminates TLS. See the full example at [`examples/nginx.conf`](examples/nginx.conf).
 
 ## Project Structure
 
 ```text
 src/
-├── EchoHub.Core/          # Shared models, DTOs, contracts, validation
-│   ├── Constants/         # ValidationConstants, HubConstants
-│   ├── Contracts/         # IEchoHubClient (SignalR interface)
-│   ├── DTOs/              # Record DTOs
-│   └── Models/            # Entity models
+├── EchoHub.Core/            # Shared models, DTOs, contracts, validation
+│   ├── Constants/           # ValidationConstants, HubConstants
+│   ├── Contracts/           # IChatService, IChatBroadcaster, IEchoHubClient
+│   ├── DTOs/                # Record DTOs
+│   └── Models/              # Entity models
 │
-├── EchoHub.Server/        # ASP.NET Core server
-│   ├── Auth/              # JWT token service
-│   ├── Controllers/       # REST API endpoints
-│   ├── Data/              # EF Core DbContext + migrations
-│   ├── Hubs/              # SignalR ChatHub
-│   ├── Services/          # Presence, file storage, image processing
-│   └── Setup/             # First-run setup, DB initialization
+├── EchoHub.Server/          # ASP.NET Core server
+│   ├── Auth/                # JWT token service
+│   ├── Controllers/         # REST API endpoints
+│   ├── Data/                # EF Core DbContext + migrations
+│   ├── Hubs/                # SignalR ChatHub
+│   ├── Services/            # ChatService, presence, file storage, image processing
+│   └── Setup/               # First-run setup, DB initialization
 │
-├── EchoHub.Client/        # Terminal.Gui TUI client
-│   ├── Config/            # Client configuration
-│   ├── Services/          # API client, SignalR connection
-│   ├── Themes/            # 6 built-in themes
-│   └── UI/                # MainWindow, dialogs, chat renderer
+├── EchoHub.Server.Irc/      # IRC protocol gateway
+│   ├── IrcGatewayService    # TCP listener (BackgroundService)
+│   ├── IrcCommandHandler    # IRC command dispatch (JOIN, PRIVMSG, etc.)
+│   ├── IrcBroadcaster       # Fans chat events to IRC connections
+│   └── IrcMessageFormatter  # MessageDto → IRC PRIVMSG lines
 │
-└── EchoHub.slnx           # Solution file
+├── EchoHub.Client/          # Terminal.Gui TUI client
+│   ├── Config/              # Client configuration
+│   ├── Services/            # API client, SignalR connection
+│   ├── Themes/              # 13 built-in themes
+│   └── UI/                  # MainWindow, dialogs, chat renderer
+│
+└── EchoHub.slnx             # Solution file
 ```
 
 ## License

docs/api/client-articles/index.md

@@ -8,3 +8,4 @@ Articles related to the EchoHub TUI client built with Terminal.Gui v2.
 - Theme system and customization
 - Command system reference
 - Configuration management
+- [Notification sounds](../../articles/notification-sounds.md)

docs/api/core-articles/index.md

@@ -5,5 +5,5 @@ Articles related to the EchoHub.Core shared library.
 ## Topics
 
 - Data models and DTOs
-- SignalR contract interface
+- Contract interfaces (IChatService, IChatBroadcaster, IEchoHubClient)
 - Validation constants and shared rules

docs/api/index.md

@@ -10,8 +10,12 @@ Terminal.Gui v2 TUI application -- UI components, services, themes, and configur
 
 ### Core
 
-Shared library -- DTOs, models, constants, and the SignalR client contract.
+Shared library -- DTOs, models, constants, and contracts (`IChatService`, `IChatBroadcaster`, `IEchoHubClient`).
 
 ### Server
 
-ASP.NET Core server -- controllers, hubs, authentication, and data access.
+ASP.NET Core server -- controllers, hubs, ChatService, SignalRBroadcaster, authentication, and data access.
+
+### Server.Irc
+
+IRC protocol gateway -- TCP listener, command handler, IrcBroadcaster, and message formatter.

docs/api/server-articles/index.md

@@ -6,6 +6,8 @@ Articles related to the EchoHub server built with ASP.NET Core.
 
 - Authentication and JWT tokens
 - SignalR hub and real-time messaging
+- IRC gateway and protocol bridging
+- ChatService and broadcaster pattern
 - File upload and validation
 - Rate limiting configuration
 - Database schema and migrations

docs/api/toc.yml

@@ -3,16 +3,20 @@
     - name: API Reference
       href: ../_api_meta/client/toc.yml
     - name: Articles
-      href: client-articles/
+      href: client-articles/toc.yml
 - name: Core
   items:
     - name: API Reference
       href: ../_api_meta/core/toc.yml
     - name: Articles
-      href: core-articles/
+      href: core-articles/toc.yml
 - name: Server
   items:
     - name: API Reference
       href: ../_api_meta/server/toc.yml
     - name: Articles
-      href: server-articles/
+      href: server-articles/toc.yml
+- name: Server.Irc
+  items:
+    - name: API Reference
+      href: ../_api_meta/server-irc/toc.yml

docs/articles/architecture.md

@@ -4,6 +4,16 @@
 
 EchoHub follows a decentralized model where each server is fully independent. There is no central authority or account federation. Users create one account per server.
 
+The server exposes two protocol interfaces to the same chat backend:
+
+```text
+IRC Client ──► TCP :6667 ──► IrcGateway ──┐
+                                           ├──► ChatService ──► DB + PresenceTracker
+TUI Client ──► WebSocket ──► ChatHub ─────┘
+```
+
+Both protocols call into a shared `IChatService` for business logic. Events fan out to all registered `IChatBroadcaster` implementations (SignalR and IRC).
+
 ## Components
 
 ### EchoHub.Core
@@ -12,7 +22,7 @@ Shared library containing:
 
 - **Models**: `User`, `Channel`, `Message`, `RefreshToken`
 - **DTOs**: Record types for API requests/responses
-- **Contracts**: `IEchoHubClient` -- the strongly-typed SignalR client interface
+- **Contracts**: `IChatService` (protocol-agnostic chat operations), `IChatBroadcaster` (event fan-out interface), `IEchoHubClient` (SignalR client interface)
 - **Constants**: `ValidationConstants` (shared regex patterns), `HubConstants`
 
 ### EchoHub.Server
@@ -20,10 +30,21 @@ Shared library containing:
 ASP.NET Core web application:
 
 - **Controllers**: REST API endpoints for auth, channels, users, files, server info
-- **Hubs**: SignalR `ChatHub` for real-time messaging
+- **Hubs**: SignalR `ChatHub` -- thin adapter delegating to `IChatService`
 - **Auth**: JWT token service (15-min access tokens, 30-day refresh tokens)
 - **Data**: EF Core with SQLite
-- **Services**: Presence tracking, file storage, image-to-ASCII conversion
+- **Services**: `ChatService` (core business logic), `SignalRBroadcaster`, presence tracking, file storage, image-to-ASCII conversion
+
+### EchoHub.Server.Irc
+
+IRC protocol gateway (separate project for clean separation of concerns):
+
+- **IrcGatewayService**: `BackgroundService` with TCP listener on configured port(s), optional TLS
+- **IrcCommandHandler**: Per-client IRC command dispatch -- handles `CAP`/`SASL`, `NICK`/`USER`/`PASS`, `JOIN`/`PART`/`PRIVMSG`/`QUIT`, `NAMES`/`TOPIC`/`WHO`/`WHOIS`/`AWAY`/`LIST`/`MODE`/`MOTD`
+- **IrcBroadcaster**: `IChatBroadcaster` implementation that formats chat events as IRC protocol lines, with echo suppression (IRC convention)
+- **IrcMessageFormatter**: Converts `MessageDto` to IRC `PRIVMSG` lines -- splits long text at word boundaries (~400 byte chunks), sends images as ASCII art line-by-line
+
+IRC users authenticate with existing EchoHub accounts via `PASS`/`NICK`/`USER` or SASL PLAIN (BCrypt verification against the database).
 
 ### EchoHub.Client
 
@@ -31,11 +52,22 @@ Terminal.Gui v2 TUI application:
 
 - **UI**: Main window, dialogs, chat renderer with ANSI color support
 - **Services**: API client with automatic token refresh, SignalR connection wrapper
-- **Themes**: 6 built-in color themes
+- **Themes**: 13 built-in color themes
 - **Config**: Client configuration management
 
 ## Communication
 
-- REST API for authentication, profile management, channel CRUD, file uploads
-- SignalR WebSocket for real-time messaging and presence updates
+- **REST API** for authentication, profile management, channel CRUD, file uploads
+- **SignalR WebSocket** for real-time messaging and presence updates (TUI client)
+- **IRC TCP** for real-time messaging via standard IRC protocol (IRC clients)
 - JWT tokens passed via query string for SignalR authentication
+- IRC authentication via PASS/SASL PLAIN against BCrypt password hashes
+
+## Broadcaster Pattern
+
+The `IChatBroadcaster` interface allows multiple protocols to receive chat events:
+
+- **SignalRBroadcaster**: Wraps `IHubContext<ChatHub>`, filters out IRC connections
+- **IrcBroadcaster**: Iterates live IRC connections in a channel, formats events as IRC protocol lines
+
+Both are registered in DI and called by `ChatService` when events occur. This means a message sent from an IRC client appears in the TUI client, and vice versa.

docs/articles/encryption.md

@@ -0,0 +1,141 @@
+# Message Encryption
+
+EchoHub uses application-layer AES-256-GCM encryption to protect message content in transit between clients and the server. This is an additional layer on top of TLS, protecting against ISPs, proxies, and any middleman that can inspect HTTPS traffic (e.g. corporate proxies with trusted root CA certificates).
+
+## How It Works
+
+```mermaid
+sequenceDiagram
+    participant Sender as TUI Client (Sender)
+    participant Server
+    participant Receiver as TUI Client (Receiver)
+    participant IRC as IRC Client
+
+    Sender->>Sender: encrypt(plaintext)
+    Sender->>Server: $ENC$v1$... (SignalR)
+    Server->>Server: decrypt → validate/sanitize
+    Server->>Server: fetch embeds on plaintext
+    Server->>Server: (optional) encrypt for DB storage
+    Server->>Server: encrypt(plaintext) with fresh nonce
+    Server->>Receiver: $ENC$v1$... (SignalR broadcast)
+    Receiver->>Receiver: decrypt → display
+    Server->>Server: decrypt for IRC
+    Server->>IRC: plaintext (IRC PRIVMSG)
+```
+
+1. **Client encrypts** the message before sending it over SignalR
+2. **Server decrypts** to validate content, sanitize newlines, and fetch link embeds
+3. **Server re-encrypts** with a fresh nonce and broadcasts to all connected SignalR clients
+4. **Clients decrypt** the broadcast and display the plaintext
+5. **IRC clients** receive plaintext automatically (the IRC broadcaster decrypts before forwarding)
+
+Each encryption uses a random 12-byte nonce, so the same message produces different ciphertext every time.
+
+## Encryption Key
+
+A 256-bit AES key is auto-generated on first server startup and saved to `appsettings.json`:
+
+```json
+{
+  "Encryption": {
+    "Key": "base64-encoded-32-byte-key",
+    "EncryptDatabase": false
+  }
+}
+```
+
+The key is generated by `FirstRunSetup` using `RandomNumberGenerator.GetBytes(32)`. If the key is missing or empty when the server starts, a new one is created automatically.
+
+Clients fetch the key after login via an authenticated endpoint (`GET /api/server/encryption-key`). No manual configuration is needed on the client side.
+
+## Encrypted Content Format
+
+Encrypted content uses a self-describing format:
+
+```text
+$ENC$v1${nonce_base64}${ciphertext+tag_base64}
+```
+
+- **`$ENC$v1$`** — version prefix (allows future algorithm changes)
+- **Nonce** — 12 bytes, Base64-encoded, randomly generated per message
+- **Ciphertext + Tag** — AES-256-GCM output with 16-byte authentication tag appended
+
+The authentication tag ensures both confidentiality and integrity — any tampering with the ciphertext is detected during decryption.
+
+## Database Encryption (Optional)
+
+By default, messages are stored as **plaintext** in the database. Transport encryption still protects everything on the wire, but the SQLite file itself contains readable messages.
+
+To encrypt messages at rest, enable the setting:
+
+```json
+{
+  "Encryption": {
+    "Key": "...",
+    "EncryptDatabase": true
+  }
+}
+```
+
+### Behavior by Setting
+
+| Setting           | DB Storage | Transport | Key Rotation Risk                              |
+| ----------------- | ---------- | --------- | ---------------------------------------------- |
+| `false` (default) | Plaintext  | Encrypted | None - stored data is unaffected               |
+| `true`            | Encrypted  | Encrypted | Changing the key makes old messages unreadable |
+
+### Mixed Content
+
+The server handles mixed encrypted/plaintext content in the database gracefully. When reading messages:
+
+- Content starting with `$ENC$v1$` is decrypted
+- Everything else is treated as plaintext
+
+This means you can safely toggle `EncryptDatabase` at any time. Old messages remain readable regardless of the current setting.
+
+### Enabling Encryption at Rest
+
+When you set `EncryptDatabase: true`, only **new messages** are encrypted going forward. Existing plaintext messages in the database are not retroactively encrypted. This is intentional — it keeps key rotation safe and avoids irreversible bulk changes.
+
+### Key Rotation
+
+Changing the encryption key is safe:
+
+- **Plaintext messages** — always readable regardless of key
+- **Messages encrypted with the old key** — will show `[encrypted message — decryption failed]`
+- **New messages** — encrypted with the new key going forward
+
+If you need to recover old encrypted messages, restore the original key from a backup of `appsettings.json`. Since plaintext messages are never retroactively encrypted, you'll never lose access to your entire history from a key change.
+
+## Security Considerations
+
+### What This Protects Against
+
+- **Passive network sniffing** — messages are encrypted even if captured off the wire
+- **ISP/proxy inspection** — content is encrypted at the application layer, independent of TLS
+- **Database theft** (when `EncryptDatabase: true`) — SQLite file contains only ciphertext
+
+### Limitations
+
+- **TLS-inspecting proxies** — if a corporate proxy terminates TLS with a trusted root CA, it can intercept the key exchange (`GET /api/server/encryption-key`) and read all traffic. A future upgrade to ECDH key exchange would address this.
+- **Server has full access** — the server decrypts all messages for processing. This is not end-to-end encryption between users; it's transport encryption between client and server.
+- **IRC clients receive plaintext** — IRC is an open protocol and third-party clients cannot participate in the encryption scheme.
+
+## Troubleshooting
+
+### Messages show `[encrypted message — decryption failed, try re-logging to fetch the latest key]`
+
+The client's encryption key doesn't match the server's. This happens when:
+
+- The server's encryption key was rotated while the client was connected
+- The client cached a stale key
+
+**Fix**: Disconnect and reconnect (re-login). The client fetches the current key on each login.
+
+### Messages show `[encrypted message — decryption failed]` in channel history
+
+The server cannot decrypt messages stored in the database. This happens when:
+
+- `EncryptDatabase` was enabled, and the key was changed afterwards
+
+**Fix**: Restore the original key from a backup. There is no way to recover messages encrypted with a lost key.

docs/articles/getting-started.md

@@ -4,6 +4,8 @@
 
 - [.NET 10 SDK](https://dotnet.microsoft.com/download)
 
+Or grab a self-contained binary from [Releases](https://github.com/HueByte/EchoHub/releases) -- no runtime needed.
+
 ## Run the Server
 
 ```bash
@@ -24,6 +26,37 @@ dotnet run --project src/EchoHub.Client
 
 Connect to a server, register an account, and start chatting.
 
+## Connect via IRC
+
+Enable the IRC gateway in the server's `appsettings.json`:
+
+```json
+{
+  "Irc": {
+    "Enabled": true,
+    "Port": 6667
+  }
+}
+```
+
+Then connect with any standard IRC client:
+
+```bash
+irssi -c localhost -p 6667 -w <password> -n <username>
+```
+
+IRC users must have an existing EchoHub account. Authentication works via `PASS`/`NICK`/`USER` or SASL PLAIN. Messages flow bidirectionally between IRC and TUI clients.
+
+For TLS, set `TlsEnabled: true`, `TlsPort: 6697`, and provide a PKCS#12 certificate path.
+
+See the [Architecture](architecture.md) page for details on how the IRC gateway integrates with the chat service.
+
+## Configuration
+
+Server configuration is in `appsettings.json` (auto-generated on first run). See the [example config](https://github.com/HueByte/EchoHub/blob/master/src/EchoHub.Server/appsettings.example.json) for all available options.
+
+To list your server on the [public directory](https://echohub.voidcube.cloud/servers), set `Server:PublicServer` to `true` and `Server:PublicHost` to your server's public address.
+
 ## Build from Source
 
 ```bash

docs/articles/notification-sounds.md

@@ -0,0 +1,43 @@
+# Notification Sounds
+
+EchoHub can play a notification sound when someone @mentions you. This is **disabled by default** and must be enabled in your profile settings.
+
+## Enabling Notifications
+
+Open your profile (`/profile`) and check the **"Notification sound on @mention"** checkbox, then save. You can also adjust the **Volume** (0-100, default 30). All settings are persisted in `~/.echohub/config.json`.
+
+## Customizing the Sound
+
+The client ships with a default `Notification.mp3` in the `Assets` folder. To use your own notification sound, replace the file at:
+
+```text
+<app-directory>/Assets/Notification.mp3
+```
+
+The file must be a valid `.mp3` or `.wav` audio file. The replacement takes effect on the next app launch.
+
+Alternatively, set a custom path in `~/.echohub/config.json`:
+
+```json
+{
+  "notifications": {
+    "enabled": true,
+    "volume": 30,
+    "soundFile": "/path/to/your/sound.mp3"
+  }
+}
+```
+
+When `soundFile` is set, EchoHub uses that file instead of the bundled default.
+
+## Disabling Notifications
+
+Uncheck the option in your profile, or edit the config directly:
+
+```json
+{
+  "notifications": {
+    "enabled": false
+  }
+}
+```

docs/articles/toc.yml

@@ -2,3 +2,7 @@
   href: getting-started.md
 - name: Architecture
   href: architecture.md
+- name: Encryption
+  href: encryption.md
+- name: Notification Sounds
+  href: notification-sounds.md

docs/changelog/index.md

@@ -4,4 +4,9 @@ Release history for EchoHub.
 
 ## Releases
 
+- [v0.2.3](v0.2.3.md) - Moderation, Embeds & UI Overhaul
+- [v0.2.2](v0.2.2.md) - Startup & Shutdown Fixes
+- [v0.2.1](v0.2.1.md) - Shutdown & CI Fixes
+- [v0.2.0](v0.2.0.md) - IRC Gateway
+- [v0.1.1](v0.1.1.md) - Directory Connection Self-Healing
 - [v0.1.0](v0.1.0.md) - Initial Release

docs/changelog/toc.yml

@@ -1,4 +1,16 @@
 - name: Overview
   href: index.md
+- name: v0.2.4
+  href: v0.2.4.md
+- name: v0.2.3
+  href: v0.2.3.md
+- name: v0.2.2
+  href: v0.2.2.md
+- name: v0.2.1
+  href: v0.2.1.md
+- name: v0.2.0
+  href: v0.2.0.md
+- name: v0.1.1
+  href: v0.1.1.md
 - name: v0.1.0
   href: v0.1.0.md

docs/changelog/v0.1.1.md

@@ -0,0 +1,7 @@
+# v0.1.1 - Directory Connection Self-Healing
+
+## Fixes
+
+- Server now reconnects to the EchoHubSpace directory indefinitely when the API goes down, using exponential backoff (2s → 30s cap)
+- If automatic reconnect is exhausted, the connection is rebuilt from scratch automatically
+- Initial connection attempts also use exponential backoff instead of a fixed 30s delay

docs/changelog/v0.2.0.md

@@ -0,0 +1,21 @@
+# v0.2.0 - IRC Gateway
+
+## Features
+
+- **IRC protocol gateway** -- native IRC clients (irssi, WeeChat, HexChat, etc.) can connect to EchoHub servers
+- **Cross-protocol messaging** -- messages flow bidirectionally between IRC and TUI clients in real time
+- **SASL PLAIN authentication** -- IRC clients can authenticate via SASL or traditional PASS/NICK/USER
+- **Full IRC command support** -- JOIN, PART, PRIVMSG, QUIT, NAMES, TOPIC, WHO, WHOIS, AWAY, LIST, MODE, MOTD
+- **TLS support** -- optional encrypted IRC connections on port 6697
+- **Image-to-IRC formatting** -- images appear as ASCII art line-by-line with download URLs
+- **Message splitting** -- long messages automatically split at word boundaries (~400 byte chunks)
+- **Configurable MOTD** -- server message of the day for IRC clients
+
+## Architecture Changes
+
+- Extracted shared business logic from `ChatHub` into protocol-agnostic `IChatService`
+- Introduced `IChatBroadcaster` pattern for multi-protocol event fan-out
+- `ChatHub` refactored to thin adapter delegating to `IChatService`
+- `ChannelsController` updated to use `IChatService` for broadcasts
+- New `EchoHub.Server.Irc` project for clean separation of concerns
+- `IChatService` and `IChatBroadcaster` interfaces live in `EchoHub.Core/Contracts`

docs/changelog/v0.2.1.md

@@ -0,0 +1,13 @@
+# v0.2.1 - Shutdown & CI Fixes
+
+## Fixes
+
+- Fixed server hanging on Ctrl+C when the directory server is unreachable — `StopAsync` now cancels background services before disposing connections
+- Fixed IRC gateway shutdown blocking indefinitely on unresponsive clients — send operations are now bounded to 2 seconds
+- Fixed CI release workflow not having full git history for building release notes (`fetch-depth: 0`)
+- Fixed `workflow_dispatch` trigger breaking change detection when `github.event.before` is empty
+
+## Improvements
+
+- GitHub releases now include a commit list and version diff link instead of generic auto-generated notes
+- GitHub releases link to the full changelog on the docs site

docs/changelog/v0.2.2.md

@@ -0,0 +1,14 @@
+# v0.2.2 - Startup & Shutdown Fixes
+
+## Fixes
+
+- Fixed server hanging on startup when IRC gateway is enabled — circular DI dependency between `IrcGatewayService` → `IChatService` → `IChatBroadcaster` → `IrcBroadcaster` caused the DI container to deadlock
+- Fixed `SignalRBroadcaster` eagerly resolving `IHubContext<ChatHub>` during DI construction, which could deadlock on some platforms — now lazy-resolves via `IServiceProvider` on first use
+- Simplified IRC service registration to use standard `AddSingleton<IChatBroadcaster, IrcBroadcaster>` instead of manual factory, breaking the circular resolution chain
+- Fixed server hanging on Ctrl+C — replaced `await using` with explicit dispose bounded to 3 seconds, so a stuck `HubConnection` can no longer block shutdown
+- Reduced host shutdown timeout from 30s (default) to 5s
+- Caught `OperationCanceledException` in the directory service reconnect loop so cancellation exits immediately instead of propagating through dispose
+
+## Refactoring
+
+- Replaced primary constructors with standard constructor injection across all server classes for consistency

docs/changelog/v0.2.3.md

@@ -0,0 +1,95 @@
+# v0.2.3 - Moderation, Embeds & UI Overhaul
+
+## Features
+
+### Moderation System
+
+- Added server roles: Owner, Admin, Mod, Member — first registered user is automatically Owner
+- New `/kick`, `/ban`, `/unban`, `/mute`, `/unmute`, `/role`, `/nuke` commands for moderators and admins
+- `ModerationController` with full REST API for role assignment, kicks, bans, mutes, message deletion, and channel nuking
+- Mutes support optional duration (auto-expire) and blocked users cannot log in
+- Role claim included in JWT tokens; role badges shown in the online users panel
+- Kicked and banned users are forcibly disconnected in real time — server cleans up presence, broadcasts departures, and signals client disconnect
+- Works for both SignalR and IRC connections; client shows an error dialog with the reason
+
+### Private Channels
+
+- Channels can be created as public or private via a checkbox in the Create Channel dialog
+- Public channels are visible to all users; private channels only appear for members who joined them
+- Persistent channel membership tracked in the database (`ChannelMembership` table)
+- `GET /api/channels` returns the combined list: public channels + user's joined private channels
+- Channel creators are automatically added as members
+
+### OpenGraph Link Embeds
+
+- Messages containing URLs now show a rich preview below the message text
+- Multiple URLs per message supported (up to 3) — each gets its own embed
+- Server-side fetching: detects URLs in a message, fetches each page, and parses OpenGraph meta tags (`og:title`, `og:description`, `og:site_name`)
+- Embeds are persisted in the database as a JSON array and included in channel history
+- TUI client renders embeds with a `▏` left border bar — site name and border in blue, title in white, description in gray; text word-wraps at actual viewport width
+- IRC gateway receives a text-only embed preview (site name, title, description)
+- Falls back to `<title>` tag when no OG tags are present; gracefully skips if no useful metadata is found
+- 5-second fetch timeout ensures message delivery is never significantly delayed
+- SSRF protection rejects private/loopback IP addresses before fetching
+
+### Notification Sounds
+
+- Incoming messages play a notification sound when the terminal is not focused
+- Embedded MP3 asset with cross-platform playback support
+
+### Online Users Panel
+
+- Collapsible right-side panel showing online users in the current channel (toggle with F2)
+- Users displayed with status indicators, role badges, and their custom nickname colors
+- Panel updates on join, leave, and status change events
+
+### @mention Highlighting
+
+- `@username` text rendered in orange accent color in all messages
+- Messages mentioning the current user get a full-line amber background highlight
+- Works across multi-line messages and continuation lines
+
+### ASCII Art Improvements
+
+- Half-block character rendering (`▀`/`█`) with separate foreground + background colors for 2x vertical resolution
+- Switched from ANSI escape codes to printable color tags (`{F:RRGGBB}`, `{B:RRGGBB}`, `{X}`) — no control bytes in stored content
+- Optional size parameter for `/send` command: `-s` (40x40), `-m` (80x80, default), `-l` (120x120)
+- IRC gateway converts color tags back to ANSI for IRC client compatibility
+
+### Client UI
+
+- Version number shown in the status bar
+- Custom colored rendering for channel list (active indicator, unread count badges)
+- Avatar upload field added to the profile edit dialog (file path or URL)
+- Profile avatar now renders with full color tag support in the profile view dialog
+- Update check notification on connect — shows a system message if a newer GitHub release exists
+- Chat messages no longer show selection/focus highlight
+- Exit shortcut changed from Ctrl+C to Alt+Q — frees Ctrl+C for copy
+- Default history increased from 50 to 100 messages on channel join
+
+## Fixes
+
+- Fixed `#general` channel not visible after adding the `IsPublic` column — migration default changed to `true` and startup service ensures it
+- Fixed channels disappearing when creating a new channel — replaced full re-fetch with incremental updates
+- Wired `OnChannelUpdated` SignalR event so new public channels appear for all connected users in real time
+- Fixed color tag parser using wrong regex group numbers (6,7,8 instead of 1,2,3) — new ASCII art was rendering without colors
+- Full Unicode/emoji support — renderers use Terminal.Gui v2 grapheme cluster API (`GraphemeHelper`, `AddStr`) for proper wide character handling
+- Emoji-to-text shortcode conversion for consistent cross-platform rendering
+- Fixed `/send` and `/avatar` commands not handling file paths with spaces correctly, even when quoted
+- Server-side newline spam protection — consecutive blank/whitespace-only lines collapsed to 1 and total lines capped at 30
+- Fixed OG tag regex truncating descriptions containing apostrophes (e.g. `"HueByte's portfolio"` was cut to `"HueByte"`) — switched to backreference-based quote pairing
+
+## Infrastructure
+
+- New `LinkEmbedService` on the server — URL detection, HTML fetching (first 64KB), OG tag parsing via compiled regex
+- `EmbedDto` record added to shared Core DTOs; `MessageDto.Embeds` list for multiple embeds per message
+- `EmbedJson` nullable column on the `Message` table stores serialized embed data as JSON array (max 8KB); `DataMigrationService` auto-migrates old single-object format
+- Dedicated `"OgFetch"` named HttpClient with bot User-Agent header and 5-second timeout
+- `PresenceTracker.ForceRemoveUser()` for atomic user cleanup on kick/ban
+- `IChatBroadcaster.ForceDisconnectUserAsync()` and `IEchoHubClient.ForceDisconnect` for force-disconnect signaling
+- `NotificationSoundService` for cross-platform audio playback of embedded notification sounds
+- Startup `DataMigrationService` automatically converts old ANSI-format messages to the new color tag format on server boot, logging the count of migrated records
+- `EmojiHelper` utility for emoji-to-shortcode conversion
+- Heartbeat handling in `ServerDirectoryService` for connection health checks
+- Four new EF Core migrations: `AddModerationRoles`, `AddChannelIsPublic`, `AddChannelMembership`, `AddMessageEmbed`
+- `ChannelMembership` table with cascade delete on both channel and user removal

docs/changelog/v0.2.4.md

@@ -0,0 +1,32 @@
+# v0.2.4 - E2E Message Encryption
+
+## Features
+
+### E2E Message Encryption
+
+- Application-layer AES-256-GCM encryption for all message content between client and server
+- Protects against ISPs, proxies, and any middleman reading chat messages — even if TLS is compromised
+- 256-bit encryption key auto-generated on first server startup and saved to `appsettings.json`
+- Client fetches the encryption key automatically after login via `GET /api/server/encryption-key`
+- Client encrypts messages before sending via SignalR; server decrypts for validation and processing
+- Server broadcasts encrypted content to SignalR clients; client decrypts transparently — no user action required
+- Optional database encryption at rest via `Encryption:EncryptDatabase` setting (disabled by default)
+  - When enabled: new messages encrypted before DB storage (existing plaintext messages are not retroactively encrypted)
+  - When disabled: messages stored as plaintext, no risk of data loss from key rotation
+  - Reads handle mixed content (encrypted + plaintext) regardless of setting — safe to toggle at any time
+  - Key rotation is safe: old plaintext stays readable, new messages use the new key
+- IRC gateway automatically decrypts messages before forwarding to IRC clients (plaintext over IRC)
+- Encrypted content format: `$ENC$v1${nonce}${ciphertext+tag}` (Base64, 12-byte nonce, 16-byte auth tag)
+- Server strips `$ENC$` prefix from user-typed messages to prevent format spoofing
+- Graceful fallback: if decryption fails, shows `[encrypted message — decryption failed, try re-logging to fetch the latest key]`
+
+## Infrastructure
+
+- `IMessageEncryptionService` interface in Core; `MessageEncryptionService` server implementation and `ClientEncryptionService` client implementation
+- `EncryptionKeyResponse` DTO and `GET /api/server/encryption-key` endpoint (authenticated, rate-limited)
+- `FirstRunSetup.EnsureEncryptionKey()` auto-generates AES-256 key on first server run
+- `Encryption:EncryptDatabase` server setting (default `false`) controls whether messages are encrypted at rest
+- DB column max lengths increased for encrypted content: `Message.Content` 2000 → 16000, `Message.EmbedJson` 8000 → 32000
+- EF Core migration: `AddEncryptionSupport`
+- Encryption test suite: server-side, client-side, and cross-compatibility tests (87 total)
+- Documentation article: `docs/articles/encryption.md`

docs/docfx.json

@@ -30,6 +30,16 @@
       ],
       "dest": "_api_meta/client",
       "filter": "filterConfig.yml"
+    },
+    {
+      "src": [
+        {
+          "src": "../src/EchoHub.Server.Irc/bin/Release/net10.0",
+          "files": ["EchoHub.Server.Irc.dll"]
+        }
+      ],
+      "dest": "_api_meta/server-irc",
+      "filter": "filterConfig.yml"
     }
   ],
   "build": {
@@ -55,6 +65,12 @@
         "dest": "api/client",
         "files": ["*.yml"],
         "exclude": ["toc.yml"]
+      },
+      {
+        "src": "_api_meta/server-irc",
+        "dest": "api/server-irc",
+        "files": ["*.yml"],
+        "exclude": ["toc.yml"]
       }
     ],
     "resource": [

docs/index.md

@@ -4,11 +4,13 @@ _layout: landing
 
 # EchoHub Documentation
 
-Welcome to the EchoHub documentation. EchoHub is a decentralized, IRC-like chat application built with .NET 10 and SignalR.
+Welcome to the EchoHub documentation. EchoHub is a decentralized, IRC-style chat platform. Self-hosted, terminal-first, with a built-in IRC gateway so native IRC clients can connect alongside the TUI client.
+
+**Website:** [echohub.voidcube.cloud](https://echohub.voidcube.cloud/) | **Public Servers:** [Server Directory](https://echohub.voidcube.cloud/servers)
 
 ## Quick Links
 
 - [Getting Started](articles/getting-started.md) - Set up and run EchoHub
-- [Architecture](articles/architecture.md) - Understand the system design
+- [Architecture](articles/architecture.md) - System design and IRC gateway
 - [API Reference](api/index.md) - Generated C# API documentation
 - [Changelog](changelog/index.md) - Release history

examples/nginx.conf

@@ -0,0 +1,94 @@
+# EchoHub nginx configuration example
+#
+# This config handles:
+# - HTTPS reverse proxy for the HTTP API + SignalR WebSocket
+# - TLS termination for IRC on port 6697
+# - HTTP → HTTPS redirect
+#
+# Prerequisites:
+# - EchoHub Server running on 127.0.0.1:5000
+# - IRC gateway enabled on port 6667 (Irc:Enabled = true, Irc:TlsEnabled = false)
+# - TLS certificate (e.g. from Let's Encrypt)
+#
+# Usage:
+# 1. Copy this file to /etc/nginx/sites-available/echohub
+# 2. Replace "echohub.example.com" with your domain
+# 3. Update certificate paths
+# 4. ln -s /etc/nginx/sites-available/echohub /etc/nginx/sites-enabled/
+# 5. nginx -t && systemctl reload nginx
+#
+# Note: The "stream" block for IRC TLS must go in the main nginx.conf
+# (outside the http block), not in sites-available. See the bottom of
+# this file for the stream config.
+
+# --- Place this in /etc/nginx/sites-available/echohub ---
+
+# HTTP → HTTPS redirect
+server {
+    listen 80;
+    listen [::]:80;
+    server_name echohub.example.com;
+
+    return 301 https://$host$request_uri;
+}
+
+# HTTPS — API + SignalR WebSocket
+server {
+    listen 443 ssl;
+    listen [::]:443 ssl;
+    server_name echohub.example.com;
+
+    ssl_certificate     /etc/letsencrypt/live/echohub.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/echohub.example.com/privkey.pem;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_ciphers         HIGH:!aNULL:!MD5;
+
+    # File upload limit (match EchoHub's MaxFileSizeBytes)
+    client_max_body_size 10m;
+
+    location / {
+        proxy_pass http://127.0.0.1:5000;
+        proxy_http_version 1.1;
+
+        # Standard proxy headers
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Required for SignalR WebSocket upgrade
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $http_connection;
+
+        # Long timeout for WebSocket connections
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+
+        # Disable buffering for real-time
+        proxy_buffering off;
+    }
+}
+
+# --- Place this in /etc/nginx/nginx.conf (outside the http block) ---
+
+# IRC TLS termination (port 6697 → plain IRC on 6667)
+# The stream module handles raw TCP, not HTTP.
+#
+# stream {
+#     upstream irc_backend {
+#         server 127.0.0.1:6667;
+#     }
+#
+#     server {
+#         listen 6697 ssl;
+#         listen [::]:6697 ssl;
+#         proxy_pass irc_backend;
+#
+#         ssl_certificate     /etc/letsencrypt/live/echohub.example.com/fullchain.pem;
+#         ssl_certificate_key /etc/letsencrypt/live/echohub.example.com/privkey.pem;
+#         ssl_protocols       TLSv1.2 TLSv1.3;
+#
+#         # Timeout for idle IRC connections (24 hours)
+#         proxy_timeout 86400s;
+#     }
+# }

src/Directory.Build.props

@@ -1,6 +1,6 @@
 <Project>
   <PropertyGroup>
-    <Version>0.1.0</Version>
+    <Version>0.2.4</Version>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
     <NoWarn>$(NoWarn);CS1591</NoWarn>
   </PropertyGroup>

src/EchoHub.Client/AppOrchestrator.cs

@@ -21,9 +21,11 @@ public sealed class AppOrchestrator : IDisposable
     private readonly IApplication _app;
     private readonly MainWindow _mainWindow;
     private readonly CommandHandler _commandHandler;
+    private readonly NotificationSoundService _notificationSound;
 
     private EchoHubConnection? _connection;
     private ApiClient? _apiClient;
+    private readonly ClientEncryptionService _encryption = new();
     private ClientConfig _config;
     private UserStatus _currentStatus = UserStatus.Online;
     private string? _currentStatusMessage;
@@ -41,6 +43,7 @@ public sealed class AppOrchestrator : IDisposable
         _config = config;
         _mainWindow = new MainWindow(app);
         _commandHandler = new CommandHandler();
+        _notificationSound = new NotificationSoundService(config.Notifications);
 
         WireMainWindowEvents();
         WireCommandHandlerEvents();
@@ -76,6 +79,7 @@ public sealed class AppOrchestrator : IDisposable
         _mainWindow.OnThemeSelected += HandleThemeSelected;
         _mainWindow.OnSavedServersRequested += HandleSavedServersRequested;
         _mainWindow.OnCreateChannelRequested += HandleCreateChannelRequested;
+        _mainWindow.OnDeleteChannelRequested += HandleDeleteChannelRequested;
     }
 
     // ── Command Handler Wiring ─────────────────────────────────────────────
@@ -116,7 +120,7 @@ public sealed class AppOrchestrator : IDisposable
             return Task.CompletedTask;
         };
 
-        _commandHandler.OnSendFile += async (target) =>
+        _commandHandler.OnSendFile += async (target, size) =>
         {
             if (!IsAuthenticated || !IsConnected) return;
 
@@ -128,13 +132,13 @@ public sealed class AppOrchestrator : IDisposable
                 if (Uri.TryCreate(target, UriKind.Absolute, out var uri)
                     && (uri.Scheme == "http" || uri.Scheme == "https"))
                 {
-                    await _apiClient!.SendUrlAsync(channel, target);
+                    await _apiClient!.SendUrlAsync(channel, target, size);
                 }
                 else
                 {
                     await using var stream = File.OpenRead(target);
                     var fileName = Path.GetFileName(target);
-                    await _apiClient!.UploadFileAsync(channel, stream, fileName);
+                    await _apiClient!.UploadFileAsync(channel, stream, fileName, size);
                 }
             }
             catch (Exception ex)
@@ -211,6 +215,8 @@ public sealed class AppOrchestrator : IDisposable
                 var history = await _connection!.JoinChannelAsync(channelName);
                 InvokeUI(() =>
                 {
+                    // Add to channel list if not already there (e.g. private channels)
+                    _mainWindow.EnsureChannelInList(channelName);
                     _mainWindow.SwitchToChannel(channelName);
                     if (history.Count > 0)
                         _mainWindow.LoadHistory(channelName, history);
@@ -292,6 +298,61 @@ public sealed class AppOrchestrator : IDisposable
             }
         };
 
+        _commandHandler.OnKickUser += async (username, reason) =>
+        {
+            if (!IsAuthenticated) return;
+            await _apiClient!.KickUserAsync(username, reason);
+        };
+
+        _commandHandler.OnBanUser += async (username, reason) =>
+        {
+            if (!IsAuthenticated) return;
+            await _apiClient!.BanUserAsync(username, reason);
+        };
+
+        _commandHandler.OnUnbanUser += async (username) =>
+        {
+            if (!IsAuthenticated) return;
+            await _apiClient!.UnbanUserAsync(username);
+        };
+
+        _commandHandler.OnMuteUser += async (username, duration) =>
+        {
+            if (!IsAuthenticated) return;
+            await _apiClient!.MuteUserAsync(username, duration);
+        };
+
+        _commandHandler.OnUnmuteUser += async (username) =>
+        {
+            if (!IsAuthenticated) return;
+            await _apiClient!.UnmuteUserAsync(username);
+        };
+
+        _commandHandler.OnAssignRole += async (username, roleStr) =>
+        {
+            if (!IsAuthenticated) return;
+            var role = roleStr switch
+            {
+                "admin" => ServerRole.Admin,
+                "mod" => ServerRole.Mod,
+                _ => ServerRole.Member,
+            };
+            await _apiClient!.AssignRoleAsync(username, role);
+        };
+
+        _commandHandler.OnNukeChannel += async () =>
+        {
+            if (!IsAuthenticated) return;
+            var channel = _mainWindow.CurrentChannel;
+            if (string.IsNullOrEmpty(channel)) return;
+            await _apiClient!.NukeChannelAsync(channel);
+        };
+
+        _commandHandler.OnTestSound += async () =>
+        {
+            await _notificationSound.PlayTestAsync();
+        };
+
         _commandHandler.OnQuit += () =>
         {
             InvokeUI(() => _app.RequestStop());
@@ -322,6 +383,19 @@ public sealed class AppOrchestrator : IDisposable
 
             _currentUsername = loginResponse.Username;
 
+            // Fetch encryption key for E2E message encryption
+            InvokeUI(() => _mainWindow.UpdateStatusBar("Fetching encryption key..."));
+            try
+            {
+                var encryptionKey = await _apiClient.GetEncryptionKeyAsync();
+                _encryption.SetKey(encryptionKey);
+                Log.Information("E2E encryption key established");
+            }
+            catch (Exception ex)
+            {
+                Log.Warning(ex, "Failed to fetch encryption key — messages will not be encrypted");
+            }
+
             InvokeUI(() =>
             {
                 _mainWindow.SetCurrentUser(loginResponse.DisplayName ?? loginResponse.Username);
@@ -331,7 +405,7 @@ public sealed class AppOrchestrator : IDisposable
             if (_connection is not null)
                 await _connection.DisposeAsync();
 
-            _connection = new EchoHubConnection(result.ServerUrl, _apiClient);
+            _connection = new EchoHubConnection(result.ServerUrl, _apiClient, _encryption);
             WireConnectionEvents(_connection);
             await _connection.ConnectAsync();
 
@@ -361,7 +435,20 @@ public sealed class AppOrchestrator : IDisposable
                 // History might not be available
             }
 
+            FetchAndUpdateOnlineUsers();
             SaveServerToConfig(result);
+
+            // Check for newer version in the background
+            _ = Task.Run(async () =>
+            {
+                var newVersion = await UpdateChecker.CheckForUpdateAsync();
+                if (newVersion is not null)
+                {
+                    InvokeUI(() => _mainWindow.AddSystemMessage(
+                        HubConstants.DefaultChannel,
+                        $"A new version of EchoHub is available: v{newVersion} (current: v{MainWindow.AppVersion}). Visit https://github.com/HueByte/EchoHub/releases"));
+                }
+            });
         }, "Connection failed", "Connect");
     }
 
@@ -440,6 +527,8 @@ public sealed class AppOrchestrator : IDisposable
             {
                 // History might not be available
             }
+
+            FetchAndUpdateOnlineUsers();
         }, "Failed to join channel");
     }
 
@@ -504,7 +593,9 @@ public sealed class AppOrchestrator : IDisposable
         var editResult = ProfileEditDialog.Show(_app,
             currentProfile?.DisplayName,
             currentProfile?.Bio,
-            currentProfile?.NicknameColor);
+            currentProfile?.NicknameColor,
+            _config.Notifications.Enabled,
+            _config.Notifications.Volume);
 
         if (editResult is null) return;
 
@@ -526,6 +617,57 @@ public sealed class AppOrchestrator : IDisposable
                 });
             }
 
+            // Upload avatar if specified
+            if (editResult.AvatarPath is not null)
+            {
+                try
+                {
+                    Stream stream;
+                    string fileName;
+
+                    if (Uri.TryCreate(editResult.AvatarPath, UriKind.Absolute, out var uri)
+                        && (uri.Scheme == "http" || uri.Scheme == "https"))
+                    {
+                        using var http = new HttpClient();
+                        var bytes = await http.GetByteArrayAsync(uri);
+                        stream = new MemoryStream(bytes);
+                        fileName = Path.GetFileName(uri.LocalPath);
+                        if (string.IsNullOrWhiteSpace(fileName) || !fileName.Contains('.'))
+                            fileName = "avatar.png";
+                    }
+                    else
+                    {
+                        stream = File.OpenRead(editResult.AvatarPath);
+                        fileName = Path.GetFileName(editResult.AvatarPath);
+                    }
+
+                    await using (stream)
+                    {
+                        await _apiClient!.UploadAvatarAsync(stream, fileName);
+                        var channel = _mainWindow.CurrentChannel;
+                        if (!string.IsNullOrEmpty(channel))
+                            InvokeUI(() => _mainWindow.AddSystemMessage(channel, "Avatar updated."));
+                    }
+                }
+                catch (Exception ex)
+                {
+                    Log.Error(ex, "Avatar upload failed for {Target}", editResult.AvatarPath);
+                    InvokeUI(() => _mainWindow.ShowError($"Avatar upload failed: {ex.Message}"));
+                }
+            }
+
+            if (editResult.NotificationSoundEnabled.HasValue)
+            {
+                _config.Notifications.Enabled = editResult.NotificationSoundEnabled.Value;
+                _notificationSound.SetEnabled(editResult.NotificationSoundEnabled.Value);
+            }
+
+            if (editResult.NotificationVolume.HasValue)
+            {
+                _config.Notifications.Volume = editResult.NotificationVolume.Value;
+                _notificationSound.SetVolume(editResult.NotificationVolume.Value);
+            }
+
             _config.DefaultPreset = new AccountPreset
             {
                 DisplayName = editResult.DisplayName,
@@ -599,17 +741,16 @@ public sealed class AppOrchestrator : IDisposable
 
         RunAsync(async () =>
         {
-            var channel = await _apiClient!.CreateChannelAsync(result.Name, result.Topic);
+            var channel = await _apiClient!.CreateChannelAsync(result.Name, result.Topic, result.IsPublic);
             if (channel is null) return;
 
             _joinedChannels.Add(channel.Name);
             var history = await _connection!.JoinChannelAsync(channel.Name);
 
-            // Refresh the channel list
-            var channels = await _apiClient.GetChannelsAsync();
             InvokeUI(() =>
             {
-                _mainWindow.SetChannels(channels);
+                _mainWindow.EnsureChannelInList(channel.Name);
+                _mainWindow.SetChannelTopic(channel.Name, channel.Topic);
                 _mainWindow.SwitchToChannel(channel.Name);
                 if (history.Count > 0)
                     _mainWindow.LoadHistory(channel.Name, history);
@@ -617,18 +758,74 @@ public sealed class AppOrchestrator : IDisposable
         }, "Failed to create channel");
     }
 
+    private void HandleDeleteChannelRequested()
+    {
+        if (!IsAuthenticated || !IsConnected)
+        {
+            _mainWindow.ShowError("Not connected to a server.");
+            return;
+        }
+
+        var channel = _mainWindow.CurrentChannel;
+        if (string.IsNullOrEmpty(channel))
+        {
+            _mainWindow.ShowError("No channel selected.");
+            return;
+        }
+
+        if (channel == HubConstants.DefaultChannel)
+        {
+            _mainWindow.ShowError($"The #{HubConstants.DefaultChannel} channel cannot be deleted.");
+            return;
+        }
+
+        var confirm = MessageBox.Query(_app, "Delete Channel",
+            $"Are you sure you want to delete #{channel}?\nThis will remove all messages permanently.", "Delete", "Cancel");
+
+        if (confirm != 0) return;
+
+        RunAsync(async () =>
+        {
+            await _apiClient!.DeleteChannelAsync(channel);
+            _joinedChannels.Remove(channel);
+
+            InvokeUI(() =>
+            {
+                _mainWindow.RemoveChannel(channel);
+                _mainWindow.SwitchToChannel(HubConstants.DefaultChannel);
+                _mainWindow.AddSystemMessage(HubConstants.DefaultChannel, $"Channel #{channel} has been deleted.");
+            });
+        }, "Failed to delete channel");
+    }
+
     // ── Connection Event Wiring ────────────────────────────────────────────
 
     private void WireConnectionEvents(EchoHubConnection connection)
     {
         connection.OnMessageReceived += message =>
+        {
             InvokeUI(() => _mainWindow.AddMessage(message));
 
+            if (!string.IsNullOrEmpty(_currentUsername)
+                && message.Content.Contains($"@{_currentUsername}", StringComparison.OrdinalIgnoreCase))
+            {
+                _ = _notificationSound.PlayAsync();
+            }
+        };
+
         connection.OnUserJoined += (channelName, username) =>
+        {
             InvokeUI(() => _mainWindow.AddSystemMessage(channelName, $"{username} joined the channel"));
+            if (channelName == _mainWindow.CurrentChannel)
+                FetchAndUpdateOnlineUsers();
+        };
 
         connection.OnUserLeft += (channelName, username) =>
+        {
             InvokeUI(() => _mainWindow.AddSystemMessage(channelName, $"{username} left the channel"));
+            if (channelName == _mainWindow.CurrentChannel)
+                FetchAndUpdateOnlineUsers();
+        };
 
         connection.OnUserStatusChanged += presence =>
         {
@@ -642,6 +839,67 @@ public sealed class AppOrchestrator : IDisposable
                 foreach (var channelName in _mainWindow.GetChannelNames())
                     _mainWindow.AddStatusMessage(channelName, displayName, statusText);
             });
+            FetchAndUpdateOnlineUsers();
+        };
+
+        connection.OnUserKicked += (channelName, username, reason) =>
+        {
+            var reasonText = reason is not null ? $" ({reason})" : "";
+            InvokeUI(() =>
+            {
+                _mainWindow.AddSystemMessage(channelName, $"{username} was kicked{reasonText}");
+            });
+        };
+
+        connection.OnUserBanned += (username, reason) =>
+        {
+            var reasonText = reason is not null ? $" ({reason})" : "";
+            InvokeUI(() =>
+            {
+                // Show ban notification for other users in the channel
+                if (!username.Equals(_currentUsername, StringComparison.OrdinalIgnoreCase))
+                {
+                    var channel = _mainWindow.CurrentChannel;
+                    if (!string.IsNullOrEmpty(channel))
+                        _mainWindow.AddSystemMessage(channel, $"{username} was banned{reasonText}");
+                }
+            });
+        };
+
+        connection.OnForceDisconnect += reason =>
+        {
+            InvokeUI(() =>
+            {
+                _mainWindow.ShowError(reason);
+                HandleDisconnect();
+            });
+        };
+
+        connection.OnMessageDeleted += (channelName, messageId) =>
+        {
+            InvokeUI(() =>
+            {
+                _mainWindow.RemoveMessage(channelName, messageId);
+            });
+        };
+
+        connection.OnChannelNuked += channelName =>
+        {
+            InvokeUI(() =>
+            {
+                _mainWindow.ClearChannelMessages(channelName);
+                _mainWindow.AddSystemMessage(channelName, "Channel history has been cleared by a moderator.");
+            });
+        };
+
+        connection.OnChannelUpdated += channel =>
+        {
+            InvokeUI(() =>
+            {
+                if (channel.IsPublic)
+                    _mainWindow.EnsureChannelInList(channel.Name);
+                _mainWindow.SetChannelTopic(channel.Name, channel.Topic);
+            });
         };
 
         connection.OnError += errorMessage =>
@@ -673,6 +931,25 @@ public sealed class AppOrchestrator : IDisposable
 
     // ── Private Helpers ────────────────────────────────────────────────────
 
+    private void FetchAndUpdateOnlineUsers()
+    {
+        var channel = _mainWindow.CurrentChannel;
+        if (string.IsNullOrEmpty(channel) || !IsConnected) return;
+
+        Task.Run(async () =>
+        {
+            try
+            {
+                var users = await _connection!.GetOnlineUsersAsync(channel);
+                InvokeUI(() => _mainWindow.UpdateOnlineUsers(users));
+            }
+            catch (Exception ex)
+            {
+                Log.Debug(ex, "Failed to fetch online users for {Channel}", channel);
+            }
+        });
+    }
+
     private void SaveServerToConfig(ConnectDialogResult result)
     {
         var savedServer = new SavedServer

src/EchoHub.Client/Commands/CommandHandler.cs

@@ -10,7 +10,7 @@ public class CommandHandler
     public event Func<string, Task>? OnSetNick;
     public event Func<string, Task>? OnSetColor;
     public event Func<string, Task>? OnSetTheme;
-    public event Func<string, Task>? OnSendFile;
+    public event Func<string, string?, Task>? OnSendFile;
     public event Func<string?, Task>? OnOpenProfile;
     public event Func<Task>? OnOpenServers;
     public event Func<string, Task>? OnJoinChannel;
@@ -18,6 +18,14 @@ public class CommandHandler
     public event Func<string, Task>? OnSetTopic;
     public event Func<Task>? OnListUsers;
     public event Func<string, Task>? OnSetAvatar;
+    public event Func<string, string?, Task>? OnKickUser;
+    public event Func<string, string?, Task>? OnBanUser;
+    public event Func<string, Task>? OnUnbanUser;
+    public event Func<string, int?, Task>? OnMuteUser;
+    public event Func<string, Task>? OnUnmuteUser;
+    public event Func<string, string, Task>? OnAssignRole;
+    public event Func<Task>? OnNukeChannel;
+    public event Func<Task>? OnTestSound;
     public event Func<Task>? OnQuit;
     public event Func<Task>? OnHelp;
 
@@ -46,6 +54,14 @@ public class CommandHandler
             "leave" => await HandleLeave(),
             "topic" => await HandleTopic(args),
             "users" => await HandleUsers(),
+            "kick" => await HandleKick(args),
+            "ban" => await HandleBan(args),
+            "unban" => await HandleUnban(args),
+            "mute" => await HandleMute(args),
+            "unmute" => await HandleUnmute(args),
+            "role" => await HandleRole(args),
+            "nuke" => await HandleNuke(),
+            "test-sound" => await HandleTestSound(),
             "quit" or "exit" => await HandleQuit(),
             "help" or "?" => await HandleHelp(),
             _ => new CommandResult(true, $"Unknown command: /{command}. Type /help for available commands.", IsError: true),
@@ -120,15 +136,19 @@ public class CommandHandler
     private async Task<CommandResult> HandleSend(string args)
     {
         if (string.IsNullOrWhiteSpace(args))
-            return new CommandResult(true, "Usage: /send <filepath or URL>", IsError: true);
+            return new CommandResult(true, "Usage: /send <filepath or URL> [-s|-m|-l]", IsError: true);
 
-        var target = args.Trim().Trim('"');
+        // Extract optional size flag from end or start, respecting quoted paths
+        var (target, size) = ParsePathAndSizeFlag(args);
+
+        if (string.IsNullOrWhiteSpace(target))
+            return new CommandResult(true, "Usage: /send <filepath or URL> [-s|-m|-l]", IsError: true);
 
         if (Uri.TryCreate(target, UriKind.Absolute, out var uri)
             && (uri.Scheme == "http" || uri.Scheme == "https"))
         {
             if (OnSendFile is not null)
-                await OnSendFile(target);
+                await OnSendFile(target, size);
             var fileName = Path.GetFileName(uri.LocalPath);
             if (string.IsNullOrWhiteSpace(fileName))
                 fileName = "image";
@@ -139,7 +159,7 @@ public class CommandHandler
             return new CommandResult(true, $"File not found: {target}", IsError: true);
 
         if (OnSendFile is not null)
-            await OnSendFile(target);
+            await OnSendFile(target, size);
         return new CommandResult(true, $"Uploading: {Path.GetFileName(target)}...");
     }
 
@@ -156,7 +176,7 @@ public class CommandHandler
         if (string.IsNullOrWhiteSpace(args))
             return new CommandResult(true, "Usage: /avatar <URL or filepath>", IsError: true);
 
-        var target = args.Trim().Trim('"');
+        var target = StripQuotes(args.Trim());
 
         if (OnSetAvatar is not null)
             await OnSetAvatar(target);
@@ -212,6 +232,102 @@ public class CommandHandler
         return new CommandResult(true);
     }
 
+    private async Task<CommandResult> HandleKick(string args)
+    {
+        if (string.IsNullOrWhiteSpace(args))
+            return new CommandResult(true, "Usage: /kick <username> [reason]", IsError: true);
+
+        var parts = args.Split(' ', 2, StringSplitOptions.TrimEntries);
+        var username = parts[0];
+        var reason = parts.Length > 1 ? parts[1] : null;
+
+        if (OnKickUser is not null)
+            await OnKickUser(username, reason);
+        return new CommandResult(true, $"Kicking {username}...");
+    }
+
+    private async Task<CommandResult> HandleBan(string args)
+    {
+        if (string.IsNullOrWhiteSpace(args))
+            return new CommandResult(true, "Usage: /ban <username> [reason]", IsError: true);
+
+        var parts = args.Split(' ', 2, StringSplitOptions.TrimEntries);
+        var username = parts[0];
+        var reason = parts.Length > 1 ? parts[1] : null;
+
+        if (OnBanUser is not null)
+            await OnBanUser(username, reason);
+        return new CommandResult(true, $"Banning {username}...");
+    }
+
+    private async Task<CommandResult> HandleUnban(string args)
+    {
+        if (string.IsNullOrWhiteSpace(args))
+            return new CommandResult(true, "Usage: /unban <username>", IsError: true);
+
+        if (OnUnbanUser is not null)
+            await OnUnbanUser(args.Trim());
+        return new CommandResult(true, $"Unbanning {args.Trim()}...");
+    }
+
+    private async Task<CommandResult> HandleMute(string args)
+    {
+        if (string.IsNullOrWhiteSpace(args))
+            return new CommandResult(true, "Usage: /mute <username> [duration_minutes]", IsError: true);
+
+        var parts = args.Split(' ', 2, StringSplitOptions.TrimEntries);
+        var username = parts[0];
+        int? duration = parts.Length > 1 && int.TryParse(parts[1], out var d) ? d : null;
+
+        if (OnMuteUser is not null)
+            await OnMuteUser(username, duration);
+        return new CommandResult(true, $"Muting {username}...");
+    }
+
+    private async Task<CommandResult> HandleUnmute(string args)
+    {
+        if (string.IsNullOrWhiteSpace(args))
+            return new CommandResult(true, "Usage: /unmute <username>", IsError: true);
+
+        if (OnUnmuteUser is not null)
+            await OnUnmuteUser(args.Trim());
+        return new CommandResult(true, $"Unmuting {args.Trim()}...");
+    }
+
+    private async Task<CommandResult> HandleRole(string args)
+    {
+        if (string.IsNullOrWhiteSpace(args))
+            return new CommandResult(true, "Usage: /role <username> <admin|mod|member>", IsError: true);
+
+        var parts = args.Split(' ', 2, StringSplitOptions.TrimEntries);
+        if (parts.Length < 2)
+            return new CommandResult(true, "Usage: /role <username> <admin|mod|member>", IsError: true);
+
+        var username = parts[0];
+        var role = parts[1].ToLowerInvariant();
+
+        if (role is not ("admin" or "mod" or "member"))
+            return new CommandResult(true, "Invalid role. Use: admin, mod, or member", IsError: true);
+
+        if (OnAssignRole is not null)
+            await OnAssignRole(username, role);
+        return new CommandResult(true, $"Setting {username} to {role}...");
+    }
+
+    private async Task<CommandResult> HandleNuke()
+    {
+        if (OnNukeChannel is not null)
+            await OnNukeChannel();
+        return new CommandResult(true, "Nuking channel history...");
+    }
+
+    private async Task<CommandResult> HandleTestSound()
+    {
+        if (OnTestSound is not null)
+            await OnTestSound();
+        return new CommandResult(true, "Playing notification sound...");
+    }
+
     private async Task<CommandResult> HandleHelp()
     {
         if (OnHelp is not null)
@@ -223,18 +339,72 @@ public class CommandHandler
               /nick <name>                         - Set display name
               /color <#hex>                        - Set nickname color
               /theme <name>                        - Switch theme
-              /send <filepath or URL>               - Send a file or image
+              /send <filepath or URL> [-s|-m|-l]      - Send a file or image (size: small/medium/large)
               /avatar <URL or filepath>             - Set your avatar
-              /profile [username]                   - View a profile (yours if no name given)
+              /profile [username]                   - View a profile
               /servers                             - Open saved servers
               /join <channel>                      - Join a channel
               /leave                               - Leave current channel
               /topic <text>                        - Set channel topic
               /users                               - List online users
+            Moderation:
+              /kick <user> [reason]                - Kick a user (Mod+)
+              /ban <user> [reason]                 - Ban a user (Admin+)
+              /unban <user>                        - Unban a user (Admin+)
+              /mute <user> [minutes]               - Mute a user (Mod+)
+              /unmute <user>                       - Unmute a user (Mod+)
+              /role <user> <admin|mod|member>      - Assign role (Admin+)
+              /nuke                                - Clear channel history (Mod+)
+              /test-sound                          - Play notification sound
               /quit                                - Exit the app
             """);
     }
 
+    /// <summary>
+    /// Extract a file path (possibly quoted) and an optional size flag (-s, -m, -l).
+    /// The flag can appear before or after the path.
+    /// </summary>
+    private static (string Path, string? Size) ParsePathAndSizeFlag(string args)
+    {
+        var trimmed = args.Trim();
+        string? size = null;
+
+        // Check for flag at the end: "path" -m  or  path -m
+        if (trimmed.Length > 3)
+        {
+            var suffix = trimmed[^2..];
+            if (suffix is "-s" or "-m" or "-l" && trimmed[^3] == ' ')
+            {
+                size = suffix[1..];
+                trimmed = trimmed[..^3].TrimEnd();
+            }
+        }
+
+        // Check for flag at the start: -m "path"  or  -m path
+        if (size is null && trimmed.Length > 3)
+        {
+            var prefix = trimmed[..2];
+            if (prefix is "-s" or "-m" or "-l" && trimmed[2] == ' ')
+            {
+                size = prefix[1..];
+                trimmed = trimmed[3..].TrimStart();
+            }
+        }
+
+        return (StripQuotes(trimmed), size);
+    }
+
+    /// <summary>
+    /// Remove matching surrounding quotes (double or single) from a string.
+    /// </summary>
+    private static string StripQuotes(string s)
+    {
+        if (s.Length >= 2 &&
+            ((s[0] == '"' && s[^1] == '"') || (s[0] == '\'' && s[^1] == '\'')))
+            return s[1..^1];
+        return s;
+    }
+
     private static bool IsValidHex(string s) =>
         s.All(c => char.IsAsciiHexDigit(c));
 }

src/EchoHub.Client/Config/ClientConfig.cs

@@ -5,6 +5,14 @@ public class ClientConfig
     public List<SavedServer> SavedServers { get; set; } = [];
     public AccountPreset DefaultPreset { get; set; } = new();
     public string ActiveTheme { get; set; } = "Default";
+    public NotificationConfig Notifications { get; set; } = new();
+}
+
+public class NotificationConfig
+{
+    public bool Enabled { get; set; } = true;
+    public byte Volume { get; set; } = 30;
+    public string? SoundFile { get; set; }
 }
 
 public class SavedServer

src/EchoHub.Client/EchoHub.Client.csproj

@@ -7,6 +7,7 @@
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.3" />
     <PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="10.0.3" />
+    <PackageReference Include="NetCoreAudio" Version="2.0.1" />
     <PackageReference Include="Serilog" Version="4.3.1" />
     <PackageReference Include="Serilog.Settings.Configuration" Version="10.0.0" />
     <PackageReference Include="Serilog.Sinks.File" Version="7.0.0" />
@@ -17,6 +18,9 @@
     <Content Include="appsettings.json" Condition="Exists('appsettings.json')">
       <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
     </Content>
+    <Content Include="Assets\**">
+      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+    </Content>
     <EmbeddedResource Include="appsettings.example.json">
       <LogicalName>EchoHub.Client.appsettings.example.json</LogicalName>
     </EmbeddedResource>

src/EchoHub.Client/Program.cs

@@ -4,6 +4,8 @@ using EchoHub.Client.Themes;
 using Microsoft.Extensions.Configuration;
 using Serilog;
 using Terminal.Gui.App;
+using Terminal.Gui.Drawing;
+
 
 var appSettingsPath = Path.Combine(AppContext.BaseDirectory, "appsettings.json");
 if (!File.Exists(appSettingsPath))

src/EchoHub.Client/Services/ApiClient.cs

@@ -3,6 +3,7 @@ using System.Net.Http.Headers;
 using System.Net.Http.Json;
 using System.Text.Json;
 using EchoHub.Core.DTOs;
+using EchoHub.Core.Models;
 
 namespace EchoHub.Client.Services;
 
@@ -127,6 +128,16 @@ public sealed class ApiClient : IDisposable
         return info;
     }
 
+    public async Task<string> GetEncryptionKeyAsync()
+    {
+        EnsureAuthenticated();
+        var response = await AuthenticatedGetAsync("/api/server/encryption-key");
+        await EnsureSuccessAsync(response);
+        var result = await response.Content.ReadFromJsonAsync<EncryptionKeyResponse>()
+            ?? throw new InvalidOperationException("Server returned empty encryption key response.");
+        return result.Key;
+    }
+
     public async Task<UserProfileDto?> GetUserProfileAsync(string username)
     {
         EnsureAuthenticated();
@@ -159,7 +170,7 @@ public sealed class ApiClient : IDisposable
         return result?.AvatarAscii;
     }
 
-    public async Task<MessageDto?> UploadFileAsync(string channelName, Stream fileStream, string fileName)
+    public async Task<MessageDto?> UploadFileAsync(string channelName, Stream fileStream, string fileName, string? size = null)
     {
         EnsureAuthenticated();
         using var content = new MultipartFormDataContent();
@@ -167,26 +178,28 @@ public sealed class ApiClient : IDisposable
         streamContent.Headers.ContentType = new MediaTypeHeaderValue(GetContentType(fileName));
         content.Add(streamContent, "file", fileName);
 
+        var sizeQuery = size is not null ? $"?size={size}" : "";
         var response = await AuthenticatedRequestAsync(() =>
-            _http.PostAsync($"/api/channels/{Uri.EscapeDataString(channelName)}/upload", content));
+            _http.PostAsync($"/api/channels/{Uri.EscapeDataString(channelName)}/upload{sizeQuery}", content));
         await EnsureSuccessAsync(response);
         return await response.Content.ReadFromJsonAsync<MessageDto>();
     }
 
-    public async Task<MessageDto?> SendUrlAsync(string channelName, string url)
+    public async Task<MessageDto?> SendUrlAsync(string channelName, string url, string? size = null)
     {
         EnsureAuthenticated();
         var request = new SendUrlRequest(url);
+        var sizeQuery = size is not null ? $"?size={size}" : "";
         var response = await AuthenticatedRequestAsync(() =>
-            _http.PostAsJsonAsync($"/api/channels/{Uri.EscapeDataString(channelName)}/send-url", request));
+            _http.PostAsJsonAsync($"/api/channels/{Uri.EscapeDataString(channelName)}/send-url{sizeQuery}", request));
         await EnsureSuccessAsync(response);
         return await response.Content.ReadFromJsonAsync<MessageDto>();
     }
 
-    public async Task<ChannelDto?> CreateChannelAsync(string name, string? topic = null)
+    public async Task<ChannelDto?> CreateChannelAsync(string name, string? topic = null, bool isPublic = true)
     {
         EnsureAuthenticated();
-        var request = new CreateChannelRequest(name, topic);
+        var request = new CreateChannelRequest(name, topic, isPublic);
         var response = await AuthenticatedRequestAsync(() =>
             _http.PostAsJsonAsync("/api/channels", request));
         await EnsureSuccessAsync(response);
@@ -211,6 +224,72 @@ public sealed class ApiClient : IDisposable
         await EnsureSuccessAsync(response);
     }
 
+    // ── Moderation ────────────────────────────────────────────────────────
+
+    public async Task AssignRoleAsync(string username, ServerRole role)
+    {
+        EnsureAuthenticated();
+        var response = await AuthenticatedRequestAsync(() =>
+            _http.PostAsJsonAsync("/api/moderation/role", new AssignRoleRequest(username, role)));
+        await EnsureSuccessAsync(response);
+    }
+
+    public async Task KickUserAsync(string username, string? reason = null)
+    {
+        EnsureAuthenticated();
+        var response = await AuthenticatedRequestAsync(() =>
+            _http.PostAsJsonAsync($"/api/moderation/kick/{Uri.EscapeDataString(username)}", new KickRequest(reason)));
+        await EnsureSuccessAsync(response);
+    }
+
+    public async Task BanUserAsync(string username, string? reason = null)
+    {
+        EnsureAuthenticated();
+        var response = await AuthenticatedRequestAsync(() =>
+            _http.PostAsJsonAsync($"/api/moderation/ban/{Uri.EscapeDataString(username)}", new BanRequest(reason)));
+        await EnsureSuccessAsync(response);
+    }
+
+    public async Task UnbanUserAsync(string username)
+    {
+        EnsureAuthenticated();
+        var response = await AuthenticatedRequestAsync(() =>
+            _http.PostAsJsonAsync($"/api/moderation/unban/{Uri.EscapeDataString(username)}", new { }));
+        await EnsureSuccessAsync(response);
+    }
+
+    public async Task MuteUserAsync(string username, int? durationMinutes = null, string? reason = null)
+    {
+        EnsureAuthenticated();
+        var response = await AuthenticatedRequestAsync(() =>
+            _http.PostAsJsonAsync($"/api/moderation/mute/{Uri.EscapeDataString(username)}", new MuteRequest(reason, durationMinutes)));
+        await EnsureSuccessAsync(response);
+    }
+
+    public async Task UnmuteUserAsync(string username)
+    {
+        EnsureAuthenticated();
+        var response = await AuthenticatedRequestAsync(() =>
+            _http.PostAsJsonAsync($"/api/moderation/unmute/{Uri.EscapeDataString(username)}", new { }));
+        await EnsureSuccessAsync(response);
+    }
+
+    public async Task DeleteMessageAsync(Guid messageId)
+    {
+        EnsureAuthenticated();
+        var response = await AuthenticatedRequestAsync(() =>
+            _http.DeleteAsync($"/api/moderation/messages/{messageId}"));
+        await EnsureSuccessAsync(response);
+    }
+
+    public async Task NukeChannelAsync(string channelName)
+    {
+        EnsureAuthenticated();
+        var response = await AuthenticatedRequestAsync(() =>
+            _http.DeleteAsync($"/api/moderation/channels/{Uri.EscapeDataString(channelName)}/nuke"));
+        await EnsureSuccessAsync(response);
+    }
+
     private void SetTokens(LoginResponse result)
     {
         _accessToken = result.Token;

src/EchoHub.Client/Services/ClientEncryptionService.cs

@@ -0,0 +1,95 @@
+using System.Security.Cryptography;
+using System.Text;
+using EchoHub.Core.Contracts;
+
+namespace EchoHub.Client.Services;
+
+/// <summary>
+/// Client-side encryption service. Uses the same AES-256-GCM format as the server
+/// so messages are encrypted end-to-end between client and server.
+/// </summary>
+public sealed class ClientEncryptionService : IMessageEncryptionService
+{
+    private const string EncryptionPrefix = "$ENC$v1$";
+    private const int NonceSizeBytes = 12;
+    private const int TagSizeBytes = 16;
+
+    private byte[]? _key;
+
+    public bool IsInitialized => _key is not null;
+    public bool EncryptDatabaseEnabled => false; // Not relevant for client
+
+    /// <summary>
+    /// Initialize with the server's encryption key (fetched after login).
+    /// </summary>
+    public void SetKey(string base64Key)
+    {
+        _key = Convert.FromBase64String(base64Key);
+
+        if (_key.Length != 32)
+            throw new InvalidOperationException($"Encryption key must be exactly 32 bytes (256-bit). Got {_key.Length} bytes.");
+    }
+
+    public string Encrypt(string plaintext)
+    {
+        if (_key is null)
+            return plaintext; // Not initialized — pass through
+
+        var plaintextBytes = Encoding.UTF8.GetBytes(plaintext);
+        var nonce = RandomNumberGenerator.GetBytes(NonceSizeBytes);
+        var ciphertext = new byte[plaintextBytes.Length];
+        var tag = new byte[TagSizeBytes];
+
+        using var aes = new AesGcm(_key, TagSizeBytes);
+        aes.Encrypt(nonce, plaintextBytes, ciphertext, tag);
+
+        var combined = new byte[ciphertext.Length + tag.Length];
+        Buffer.BlockCopy(ciphertext, 0, combined, 0, ciphertext.Length);
+        Buffer.BlockCopy(tag, 0, combined, ciphertext.Length, tag.Length);
+
+        return $"{EncryptionPrefix}{Convert.ToBase64String(nonce)}${Convert.ToBase64String(combined)}";
+    }
+
+    public string Decrypt(string content)
+    {
+        if (_key is null || !content.StartsWith(EncryptionPrefix))
+            return content; // Not initialized or legacy plaintext
+
+        try
+        {
+            var payload = content[EncryptionPrefix.Length..];
+            var separatorIndex = payload.IndexOf('$');
+            if (separatorIndex < 0)
+                return content;
+
+            var nonceBase64 = payload[..separatorIndex];
+            var combinedBase64 = payload[(separatorIndex + 1)..];
+
+            var nonce = Convert.FromBase64String(nonceBase64);
+            var combined = Convert.FromBase64String(combinedBase64);
+
+            if (combined.Length < TagSizeBytes)
+                return content;
+
+            var ciphertextLength = combined.Length - TagSizeBytes;
+            var ciphertext = combined.AsSpan(0, ciphertextLength);
+            var tag = combined.AsSpan(ciphertextLength, TagSizeBytes);
+            var plaintext = new byte[ciphertextLength];
+
+            using var aes = new AesGcm(_key, TagSizeBytes);
+            aes.Decrypt(nonce, ciphertext, tag, plaintext);
+
+            return Encoding.UTF8.GetString(plaintext);
+        }
+        catch
+        {
+            return "[encrypted message — decryption failed, try re-logging to fetch the latest key]";
+        }
+    }
+
+    public string? EncryptNullable(string? value)
+        => value is null ? null : Encrypt(value);
+
+    public string? DecryptNullable(string? value)
+        => value is null ? null : Decrypt(value);
+}

src/EchoHub.Client/Services/EchoHubConnection.cs

@@ -8,20 +8,27 @@ namespace EchoHub.Client.Services;
 public sealed class EchoHubConnection : IAsyncDisposable
 {
     private readonly HubConnection _connection;
+    private readonly ClientEncryptionService _encryption;
 
     public event Action<MessageDto>? OnMessageReceived;
     public event Action<string, string>? OnUserJoined;
     public event Action<string, string>? OnUserLeft;
     public event Action<ChannelDto>? OnChannelUpdated;
     public event Action<UserPresenceDto>? OnUserStatusChanged;
+    public event Action<string, string, string?>? OnUserKicked;
+    public event Action<string, string?>? OnUserBanned;
+    public event Action<string, Guid>? OnMessageDeleted;
+    public event Action<string>? OnChannelNuked;
+    public event Action<string>? OnForceDisconnect;
     public event Action<string>? OnError;
     public event Action<string>? OnConnectionStateChanged;
     public event Action? OnReconnected;
 
     public bool IsConnected => _connection.State == HubConnectionState.Connected;
 
-    public EchoHubConnection(string serverUrl, ApiClient apiClient)
+    public EchoHubConnection(string serverUrl, ApiClient apiClient, ClientEncryptionService encryption)
     {
+        _encryption = encryption;
         var hubUrl = serverUrl.TrimEnd('/') + HubConstants.ChatHubPath;
 
         _connection = new HubConnectionBuilder()
@@ -58,7 +65,9 @@ public sealed class EchoHubConnection : IAsyncDisposable
     {
         _connection.On<MessageDto>(nameof(Core.Contracts.IEchoHubClient.ReceiveMessage), message =>
         {
-            OnMessageReceived?.Invoke(message);
+            // Decrypt message content received from server
+            var decrypted = message with { Content = _encryption.Decrypt(message.Content) };
+            OnMessageReceived?.Invoke(decrypted);
         });
 
         _connection.On<string, string>(nameof(Core.Contracts.IEchoHubClient.UserJoined), (channelName, username) =>
@@ -81,6 +90,31 @@ public sealed class EchoHubConnection : IAsyncDisposable
             OnUserStatusChanged?.Invoke(presence);
         });
 
+        _connection.On<string, string, string?>(nameof(Core.Contracts.IEchoHubClient.UserKicked), (channelName, username, reason) =>
+        {
+            OnUserKicked?.Invoke(channelName, username, reason);
+        });
+
+        _connection.On<string, string?>(nameof(Core.Contracts.IEchoHubClient.UserBanned), (username, reason) =>
+        {
+            OnUserBanned?.Invoke(username, reason);
+        });
+
+        _connection.On<string, Guid>(nameof(Core.Contracts.IEchoHubClient.MessageDeleted), (channelName, messageId) =>
+        {
+            OnMessageDeleted?.Invoke(channelName, messageId);
+        });
+
+        _connection.On<string>(nameof(Core.Contracts.IEchoHubClient.ChannelNuked), channelName =>
+        {
+            OnChannelNuked?.Invoke(channelName);
+        });
+
+        _connection.On<string>(nameof(Core.Contracts.IEchoHubClient.ForceDisconnect), reason =>
+        {
+            OnForceDisconnect?.Invoke(reason);
+        });
+
         _connection.On<string>(nameof(Core.Contracts.IEchoHubClient.Error), message =>
         {
             OnError?.Invoke(message);
@@ -102,7 +136,8 @@ public sealed class EchoHubConnection : IAsyncDisposable
 
     public async Task<List<MessageDto>> JoinChannelAsync(string channelName)
     {
-        return await _connection.InvokeAsync<List<MessageDto>>("JoinChannel", channelName);
+        var messages = await _connection.InvokeAsync<List<MessageDto>>("JoinChannel", channelName);
+        return DecryptMessages(messages);
     }
 
     public async Task LeaveChannelAsync(string channelName)
@@ -112,12 +147,15 @@ public sealed class EchoHubConnection : IAsyncDisposable
 
     public async Task SendMessageAsync(string channelName, string content)
     {
-        await _connection.InvokeAsync("SendMessage", channelName, content);
+        // Encrypt content before sending to server
+        var encrypted = _encryption.Encrypt(content);
+        await _connection.InvokeAsync("SendMessage", channelName, encrypted);
     }
 
     public async Task<List<MessageDto>> GetHistoryAsync(string channelName, int count = HubConstants.DefaultHistoryCount)
     {
-        return await _connection.InvokeAsync<List<MessageDto>>("GetChannelHistory", channelName, count);
+        var messages = await _connection.InvokeAsync<List<MessageDto>>("GetChannelHistory", channelName, count);
+        return DecryptMessages(messages);
     }
 
     public async Task UpdateStatusAsync(UserStatus status, string? statusMessage = null)
@@ -130,6 +168,11 @@ public sealed class EchoHubConnection : IAsyncDisposable
         return await _connection.InvokeAsync<List<UserPresenceDto>>("GetOnlineUsers", channelName);
     }
 
+    private List<MessageDto> DecryptMessages(List<MessageDto> messages)
+    {
+        return messages.Select(m => m with { Content = _encryption.Decrypt(m.Content) }).ToList();
+    }
+
     public async ValueTask DisposeAsync()
     {
         await _connection.DisposeAsync();

src/EchoHub.Client/Services/NotificationSoundService.cs

@@ -0,0 +1,85 @@
+using EchoHub.Client.Config;
+using NetCoreAudio;
+using Serilog;
+
+namespace EchoHub.Client.Services;
+
+public class NotificationSoundService
+{
+    private readonly Player _player = new();
+    private readonly NotificationConfig _config;
+    private string? _resolvedSoundPath;
+
+    public NotificationSoundService(NotificationConfig config)
+    {
+        _config = config;
+        ResolveSoundPath();
+    }
+
+    public void SetEnabled(bool enabled) => _config.Enabled = enabled;
+
+    public void SetVolume(byte volume) => _config.Volume = Math.Min(volume, (byte)100);
+
+    public async Task PlayAsync()
+    {
+        if (!_config.Enabled || _resolvedSoundPath is null)
+            return;
+
+        await PlayInternal();
+    }
+
+    /// <summary>
+    /// Plays the notification sound regardless of the Enabled setting (for /test-sound).
+    /// </summary>
+    public async Task PlayTestAsync()
+    {
+        if (_resolvedSoundPath is null)
+            return;
+
+        await PlayInternal();
+    }
+
+    private async Task PlayInternal()
+    {
+        try
+        {
+            if (_player.Playing)
+                await _player.Stop();
+
+            await _player.SetVolume(_config.Volume);
+            await _player.Play(_resolvedSoundPath!);
+        }
+        catch (Exception ex)
+        {
+            Log.Warning(ex, "Failed to play notification sound");
+        }
+    }
+
+    private void ResolveSoundPath()
+    {
+        // 1. Explicit path from config (~/.echohub/config.json)
+        if (!string.IsNullOrWhiteSpace(_config.SoundFile))
+        {
+            if (File.Exists(_config.SoundFile))
+            {
+                _resolvedSoundPath = Path.GetFullPath(_config.SoundFile);
+                Log.Debug("Notification sound: {Path} (from config)", _resolvedSoundPath);
+                return;
+            }
+
+            Log.Warning("Configured sound file not found: {Path}", _config.SoundFile);
+        }
+
+        // 2. Default: Notification.mp3 bundled next to the executable
+        var defaultPath = Path.Combine(AppContext.BaseDirectory, "Assets", "Notification.mp3");
+
+        if (File.Exists(defaultPath))
+        {
+            _resolvedSoundPath = defaultPath;
+            Log.Debug("Notification sound: {Path} (default)", _resolvedSoundPath);
+            return;
+        }
+
+        Log.Information("No notification sound file found — notifications will be silent");
+    }
+}

src/EchoHub.Client/Services/UpdateChecker.cs

@@ -0,0 +1,47 @@
+using System.Net.Http.Json;
+using System.Text.Json.Serialization;
+
+namespace EchoHub.Client.Services;
+
+public static class UpdateChecker
+{
+    private static readonly Uri ReleaseUrl =
+        new("https://api.github.com/repos/HueByte/EchoHub/releases/latest");
+
+    /// <summary>
+    /// Checks GitHub for a newer release. Returns the new version string if one exists, or null.
+    /// Never throws — all errors are silently swallowed.
+    /// </summary>
+    public static async Task<string?> CheckForUpdateAsync()
+    {
+        try
+        {
+            using var http = new HttpClient { Timeout = TimeSpan.FromSeconds(5) };
+            http.DefaultRequestHeaders.UserAgent.ParseAdd("EchoHub-Client");
+
+            var release = await http.GetFromJsonAsync<GitHubRelease>(ReleaseUrl);
+            if (release?.TagName is null)
+                return null;
+
+            var tag = release.TagName.TrimStart('v', 'V');
+            if (!Version.TryParse(tag, out var latest))
+                return null;
+
+            var currentStr = typeof(UpdateChecker).Assembly.GetName().Version?.ToString(3);
+            if (currentStr is null || !Version.TryParse(currentStr, out var current))
+                return null;
+
+            return latest > current ? tag : null;
+        }
+        catch
+        {
+            return null;
+        }
+    }
+
+    private sealed class GitHubRelease
+    {
+        [JsonPropertyName("tag_name")]
+        public string? TagName { get; set; }
+    }
+}

src/EchoHub.Client/UI/ChatRenderer.cs

@@ -1,8 +1,8 @@
 using System.Collections;
 using System.Collections.Specialized;
-using System.Text;
 using System.Text.RegularExpressions;
 using Terminal.Gui.Drawing;
+using Terminal.Gui.Text;
 using Terminal.Gui.Views;
 using Attribute = Terminal.Gui.Drawing.Attribute;
 
@@ -20,17 +20,19 @@ public partial class ChatLine
 {
     public List<ChatSegment> Segments { get; }
     public int TextLength { get; }
+    public Guid? MessageId { get; set; }
+    public bool IsMention { get; set; }
 
     public ChatLine(string plainText)
     {
         Segments = [new ChatSegment(plainText, null)];
-        TextLength = plainText.Length;
+        TextLength = plainText.GetColumns();
     }
 
     public ChatLine(List<ChatSegment> segments)
     {
         Segments = segments;
-        TextLength = segments.Sum(s => s.Text.Length);
+        TextLength = segments.Sum(s => s.Text.GetColumns());
     }
 
     public override string ToString() => string.Concat(Segments.Select(s => s.Text));
@@ -50,17 +52,22 @@ public partial class ChatLine
 
         foreach (var segment in Segments)
         {
-            int segPos = 0;
-            while (segPos < segment.Text.Length)
+            var text = segment.Text;
+            int chunkStart = 0;
+            int charPos = 0;
+
+            foreach (var grapheme in GraphemeHelper.GetGraphemes(text))
             {
-                int remaining = width - col;
-                if (remaining <= 0)
+                var graphemeCols = Math.Max(grapheme.GetColumns(), 1);
+
+                if (col + graphemeCols > width)
                 {
-                    // Emit current line and start a new one
+                    if (charPos > chunkStart)
+                        currentSegments.Add(new ChatSegment(text[chunkStart..charPos], segment.Color));
+
                     results.Add(new ChatLine(currentSegments));
                     currentSegments = [];
 
-                    // Add indent for continuation
                     if (continuationIndent > 0)
                     {
                         currentSegments.Add(new ChatSegment(new string(' ', continuationIndent), null));
@@ -71,14 +78,15 @@ public partial class ChatLine
                         col = 0;
                     }
 
-                    remaining = width - col;
+                    chunkStart = charPos;
                 }
 
-                int take = Math.Min(segment.Text.Length - segPos, remaining);
-                currentSegments.Add(new ChatSegment(segment.Text.Substring(segPos, take), segment.Color));
-                col += take;
-                segPos += take;
+                col += graphemeCols;
+                charPos += grapheme.Length;
             }
+
+            if (chunkStart < text.Length)
+                currentSegments.Add(new ChatSegment(text[chunkStart..], segment.Color));
         }
 
         if (currentSegments.Count > 0)
@@ -88,62 +96,83 @@ public partial class ChatLine
     }
 
     /// <summary>
-    /// Parse a string containing ANSI 24-bit color escape codes into colored segments.
-    /// Format: \x1b[38;2;R;G;Bm (foreground color), \x1b[0m (reset)
+    /// Returns true if a line contains printable color tags.
     /// </summary>
-    public static ChatLine FromAnsi(string ansiText, Attribute? defaultAttr = null)
+    public static bool HasColorTags(string text) =>
+        text.Contains("{F:") || text.Contains("{B:") || text.Contains("{X}");
+
+    /// <summary>
+    /// Remove all color tags from text, returning only the visible characters.
+    /// </summary>
+    public static string StripColorTags(string text) =>
+        ColorTagRegex().Replace(text, "");
+
+    /// <summary>
+    /// Parse a string containing printable color tags into colored segments.
+    /// Format: {F:RRGGBB} (foreground), {B:RRGGBB} (background), {X} (reset).
+    /// </summary>
+    public static ChatLine FromColoredText(string text, Attribute? defaultAttr = null)
     {
         var segments = new List<ChatSegment>();
-        var regex = AnsiColorRegex();
         int lastIndex = 0;
-        Attribute? currentColor = defaultAttr;
+        Color? currentFg = null;
+        Color? currentBg = null;
+        var defaultFg = defaultAttr?.Foreground;
+        var defaultBg = defaultAttr?.Background ?? Color.Black;
 
-        foreach (Match match in regex.Matches(ansiText))
+        Attribute? BuildAttr()
+        {
+            if (currentFg is null && currentBg is null) return defaultAttr;
+            var fg = currentFg ?? defaultFg ?? Color.White;
+            var bg = currentBg ?? defaultBg;
+            return new Attribute(fg, bg);
+        }
+
+        foreach (Match match in ColorTagRegex().Matches(text))
         {
-            // Add any text before this escape sequence
             if (match.Index > lastIndex)
             {
-                var text = ansiText[lastIndex..match.Index];
-                if (text.Length > 0)
-                    segments.Add(new ChatSegment(text, currentColor));
+                var t = text[lastIndex..match.Index];
+                if (t.Length > 0)
+                    segments.Add(new ChatSegment(t, BuildAttr()));
             }
 
-            // Parse the escape sequence
-            if (match.Groups[1].Value == "0")
+            if (match.Groups[1].Success)
             {
-                // Reset
-                currentColor = defaultAttr;
+                currentFg = null;
+                currentBg = null;
             }
             else if (match.Groups[2].Success)
             {
-                // 38;2;R;G;B — 24-bit foreground color
-                var r = int.Parse(match.Groups[3].Value);
-                var g = int.Parse(match.Groups[4].Value);
-                var b = int.Parse(match.Groups[5].Value);
-                currentColor = new Attribute(new Color(r, g, b), Color.Black);
+                var hex = match.Groups[3].Value;
+                var r = Convert.ToInt32(hex[..2], 16);
+                var g = Convert.ToInt32(hex[2..4], 16);
+                var b = Convert.ToInt32(hex[4..6], 16);
+                if (match.Groups[2].Value == "F")
+                    currentFg = new Color(r, g, b);
+                else
+                    currentBg = new Color(r, g, b);
             }
 
             lastIndex = match.Index + match.Length;
         }
 
-        // Add remaining text
-        if (lastIndex < ansiText.Length)
+        if (lastIndex < text.Length)
         {
-            var text = ansiText[lastIndex..];
-            if (text.Length > 0)
-                segments.Add(new ChatSegment(text, currentColor));
+            var t = text[lastIndex..];
+            if (t.Length > 0)
+                segments.Add(new ChatSegment(t, BuildAttr()));
         }
 
         return segments.Count > 0 ? new ChatLine(segments) : new ChatLine("");
     }
 
-    // Matches: \x1b[0m (reset) or \x1b[38;2;R;G;Bm (24-bit foreground)
-    [GeneratedRegex(@"\x1b\[(?:(0)|(?:(38;2);(\d{1,3});(\d{1,3});(\d{1,3})))m")]
-    private static partial Regex AnsiColorRegex();
+    [GeneratedRegex(@"\{(?:(X)|(?:(F|B):([0-9A-Fa-f]{6})))\}")]
+    private static partial Regex ColorTagRegex();
 }
 
 /// <summary>
-/// Custom list data source for chat messages with per-character coloring.
+/// Custom list data source for chat messages with per-segment coloring.
 /// </summary>
 public class ChatListSource : IListDataSource
 {
@@ -197,7 +226,8 @@ public class ChatListSource : IListDataSource
         listView.Move(Math.Max(col - viewportX, 0), row);
 
         var chatLine = _lines[item];
-        var normalAttr = listView.GetAttributeForRole(selected ? VisualRole.Focus : VisualRole.Normal);
+        var normalAttr = listView.GetAttributeForRole(VisualRole.Normal);
+        var mentionBg = chatLine.IsMention ? ChatColors.MentionHighlightAttr.Background : (Color?)null;
 
         int charPos = 0;
         int drawnChars = 0;
@@ -205,26 +235,26 @@ public class ChatListSource : IListDataSource
         foreach (var segment in chatLine.Segments)
         {
             var attr = segment.Color ?? normalAttr;
+            if (mentionBg.HasValue)
+                attr = new Attribute(attr.Foreground, mentionBg.Value);
             listView.SetAttribute(attr);
 
-            foreach (var ch in segment.Text)
+            foreach (var grapheme in GraphemeHelper.GetGraphemes(segment.Text))
             {
-                if (charPos >= viewportX && drawnChars < width)
+                var cols = Math.Max(grapheme.GetColumns(), 1);
+                if (charPos >= viewportX && drawnChars + cols <= width)
                 {
-                    listView.AddRune(new Rune(ch));
-                    drawnChars++;
+                    listView.AddStr(grapheme);
+                    drawnChars += cols;
                 }
-                charPos++;
+                charPos += cols;
             }
         }
 
-        // Fill remaining width with spaces using default colors
-        listView.SetAttribute(normalAttr);
-        while (drawnChars < width)
-        {
-            listView.AddRune(new Rune(' '));
-            drawnChars++;
-        }
+        var fillAttr = mentionBg.HasValue ? new Attribute(normalAttr.Foreground, mentionBg.Value) : normalAttr;
+        listView.SetAttribute(fillAttr);
+        for (int i = drawnChars; i < width; i++)
+            listView.AddStr(" ");
     }
 
     private void UpdateMaxLength(ChatLine line)
@@ -242,13 +272,226 @@ public class ChatListSource : IListDataSource
     public void Dispose() { }
 }
 
+/// <summary>
+/// Custom list data source for colored channel list rendering.
+/// Active channel gets a > indicator, unread channels are bright with a count badge.
+/// </summary>
+public class ChannelListSource : IListDataSource
+{
+    private readonly List<string> _channelNames = [];
+    private readonly Dictionary<string, int> _unreadCounts = [];
+    private string _activeChannel = string.Empty;
+
+    public event NotifyCollectionChangedEventHandler? CollectionChanged;
+    public int Count => _channelNames.Count;
+    public int MaxItemLength { get; private set; }
+    public bool SuspendCollectionChangedEvent { get; set; }
+
+    private static readonly Attribute ActiveAttr = new(Color.White, Color.Black);
+    private static readonly Attribute UnreadAttr = new(Color.BrightCyan, Color.Black);
+    private static readonly Attribute NormalAttr = new(Color.DarkGray, Color.Black);
+    private static readonly Attribute BadgeAttr = new(Color.BrightYellow, Color.Black);
+
+    public void Update(List<string> channels, Dictionary<string, int> unread, string activeChannel)
+    {
+        _channelNames.Clear();
+        _channelNames.AddRange(channels);
+        _unreadCounts.Clear();
+        foreach (var kv in unread)
+            _unreadCounts[kv.Key] = kv.Value;
+        _activeChannel = activeChannel;
+        MaxItemLength = channels.Count > 0 ? channels.Max(c => c.Length + 6) : 0;
+        if (!SuspendCollectionChangedEvent)
+            CollectionChanged?.Invoke(this, new NotifyCollectionChangedEventArgs(NotifyCollectionChangedAction.Reset));
+    }
+
+    public bool IsMarked(int item) => false;
+    public void SetMark(int item, bool value) { }
+    public IList ToList() => _channelNames.Select(n => $"#{n}").ToList();
+
+    public void Render(ListView listView, bool selected, int item, int col, int row, int width, int viewportX = 0)
+    {
+        listView.Move(Math.Max(col - viewportX, 0), row);
+
+        var name = _channelNames[item];
+        var isActive = name == _activeChannel;
+        _unreadCounts.TryGetValue(name, out var unread);
+        var hasUnread = unread > 0;
+
+        var focusAttr = listView.GetAttributeForRole(VisualRole.Focus);
+        var prefix = isActive ? "> " : "  ";
+        var channelText = $"#{name}";
+        var badge = hasUnread ? $" ({unread})" : "";
+
+        int drawnChars = 0;
+
+        if (selected)
+        {
+            listView.SetAttribute(focusAttr);
+            drawnChars = RenderHelpers.WriteText(listView, prefix + channelText + badge, drawnChars, width);
+        }
+        else
+        {
+            listView.SetAttribute(isActive ? ActiveAttr : NormalAttr);
+            drawnChars = RenderHelpers.WriteText(listView, prefix, drawnChars, width);
+
+            listView.SetAttribute(isActive ? ActiveAttr : hasUnread ? UnreadAttr : NormalAttr);
+            drawnChars = RenderHelpers.WriteText(listView, channelText, drawnChars, width);
+
+            if (hasUnread)
+            {
+                listView.SetAttribute(BadgeAttr);
+                drawnChars = RenderHelpers.WriteText(listView, badge, drawnChars, width);
+            }
+        }
+
+        var fillAttr = selected ? focusAttr : listView.GetAttributeForRole(VisualRole.Normal);
+        listView.SetAttribute(fillAttr);
+        for (int i = drawnChars; i < width; i++)
+            listView.AddStr(" ");
+    }
+
+    public void Dispose() { }
+}
+
+/// <summary>
+/// Custom list data source for the online users panel with per-user nickname colors.
+/// </summary>
+public class UserListSource : IListDataSource
+{
+    private readonly List<(string Text, Attribute? NameColor)> _users = [];
+
+    public event NotifyCollectionChangedEventHandler? CollectionChanged;
+    public int Count => _users.Count;
+    public int MaxItemLength { get; private set; }
+    public bool SuspendCollectionChangedEvent { get; set; }
+
+    public void Update(List<(string Text, Attribute? NameColor)> users)
+    {
+        _users.Clear();
+        _users.AddRange(users);
+        MaxItemLength = users.Count > 0 ? users.Max(u => u.Text.GetColumns()) : 0;
+        if (!SuspendCollectionChangedEvent)
+            CollectionChanged?.Invoke(this, new NotifyCollectionChangedEventArgs(NotifyCollectionChangedAction.Reset));
+    }
+
+    public bool IsMarked(int item) => false;
+    public void SetMark(int item, bool value) { }
+    public IList ToList() => _users.Select(u => u.Text).ToList();
+
+    public void Render(ListView listView, bool selected, int item, int col, int row, int width, int viewportX = 0)
+    {
+        listView.Move(Math.Max(col - viewportX, 0), row);
+
+        var (text, nameColor) = _users[item];
+        var normalAttr = listView.GetAttributeForRole(selected ? VisualRole.Focus : VisualRole.Normal);
+
+        // Find where the name starts (after status icon + space + optional role badge)
+        // Format: "● ★Username" or "● Username"
+        var graphemes = GraphemeHelper.GetGraphemes(text).ToList();
+        int nameStart = 0;
+        while (nameStart < graphemes.Count)
+        {
+            var g = graphemes[nameStart];
+            if (g.Length > 0 && (char.IsLetterOrDigit(g[0]) || g[0] == '_'))
+                break;
+            nameStart++;
+        }
+
+        int drawnChars = 0;
+
+        // Draw prefix (status icon + role badge) in normal color
+        listView.SetAttribute(normalAttr);
+        for (int i = 0; i < nameStart; i++)
+        {
+            var cols = Math.Max(graphemes[i].GetColumns(), 1);
+            if (drawnChars + cols > width) break;
+            listView.AddStr(graphemes[i]);
+            drawnChars += cols;
+        }
+
+        // Draw name in nickname color
+        var userAttr = selected ? normalAttr : nameColor ?? normalAttr;
+        listView.SetAttribute(userAttr);
+        for (int i = nameStart; i < graphemes.Count; i++)
+        {
+            var cols = Math.Max(graphemes[i].GetColumns(), 1);
+            if (drawnChars + cols > width) break;
+            listView.AddStr(graphemes[i]);
+            drawnChars += cols;
+        }
+
+        // Fill rest
+        listView.SetAttribute(normalAttr);
+        for (int i = drawnChars; i < width; i++)
+            listView.AddStr(" ");
+    }
+
+    public void Dispose() { }
+}
+
+/// <summary>
+/// Shared rendering helpers for IListDataSource implementations.
+/// </summary>
+static class RenderHelpers
+{
+    /// <summary>
+    /// Write text grapheme-by-grapheme to a ListView, respecting a width limit.
+    /// Returns the updated drawn-columns count.
+    /// </summary>
+    public static int WriteText(ListView lv, string text, int drawn, int maxWidth)
+    {
+        foreach (var grapheme in GraphemeHelper.GetGraphemes(text))
+        {
+            var cols = Math.Max(grapheme.GetColumns(), 1);
+            if (drawn + cols > maxWidth) break;
+            lv.AddStr(grapheme);
+            drawn += cols;
+        }
+        return drawn;
+    }
+}
+
 /// <summary>
 /// Shared color attributes for chat rendering (timestamps, system messages).
 /// </summary>
-public static class ChatColors
+public static partial class ChatColors
 {
     public static readonly Attribute TimestampAttr = new(Color.DarkGray, Color.Black);
     public static readonly Attribute SystemAttr = new(new Color(0, 180, 180), Color.Black);
+    public static readonly Attribute MentionHighlightAttr = new(Color.White, new Color(80, 40, 0));
+    public static readonly Attribute MentionTextAttr = new(new Color(255, 180, 50), Color.Black);
+    public static readonly Attribute EmbedBorderAttr = new(new Color(91, 155, 213), Color.Black);
+    public static readonly Attribute EmbedTitleAttr = new(Color.White, Color.Black);
+    public static readonly Attribute EmbedDescAttr = new(new Color(160, 160, 160), Color.Black);
+    public static readonly Attribute EmbedUrlAttr = new(new Color(100, 100, 100), Color.Black);
+
+    /// <summary>
+    /// Split text around @mentions, giving each @word the MentionTextAttr accent color.
+    /// Non-mention text uses the provided default color.
+    /// </summary>
+    public static List<ChatSegment> SplitMentions(string text, Attribute? defaultColor = null)
+    {
+        var segments = new List<ChatSegment>();
+        int lastIndex = 0;
+
+        foreach (Match match in MentionRegex().Matches(text))
+        {
+            if (match.Index > lastIndex)
+                segments.Add(new ChatSegment(text[lastIndex..match.Index], defaultColor));
+
+            segments.Add(new ChatSegment(match.Value, MentionTextAttr));
+            lastIndex = match.Index + match.Length;
+        }
+
+        if (lastIndex < text.Length)
+            segments.Add(new ChatSegment(text[lastIndex..], defaultColor));
+
+        return segments;
+    }
+
+    [GeneratedRegex(@"@[\w-]+")]
+    private static partial Regex MentionRegex();
 }
 
 /// <summary>

src/EchoHub.Client/UI/CreateChannelDialog.cs

@@ -4,7 +4,7 @@ using Terminal.Gui.ViewBase;
 
 namespace EchoHub.Client.UI;
 
-public record CreateChannelResult(string Name, string? Topic);
+public record CreateChannelResult(string Name, string? Topic, bool IsPublic);
 
 public sealed class CreateChannelDialog
 {
@@ -12,7 +12,7 @@ public sealed class CreateChannelDialog
     {
         CreateChannelResult? result = null;
 
-        var dialog = new Dialog { Title = "Create Channel", Width = 50, Height = 12 };
+        var dialog = new Dialog { Title = "Create Channel", Width = 50, Height = 14 };
 
         var nameLabel = new Label { Text = "Name:", X = 1, Y = 1 };
         var nameField = new TextField { X = 10, Y = 1, Width = Dim.Fill(2) };
@@ -20,11 +20,19 @@ public sealed class CreateChannelDialog
         var topicLabel = new Label { Text = "Topic:", X = 1, Y = 3 };
         var topicField = new TextField { X = 10, Y = 3, Width = Dim.Fill(2) };
 
+        var publicCheckbox = new CheckBox
+        {
+            Text = "Public (visible to all users)",
+            X = 1,
+            Y = 5,
+            Value = CheckState.Checked
+        };
+
         var hintLabel = new Label
         {
             Text = "Lowercase letters, digits, hyphens, underscores (2-100 chars)",
             X = 1,
-            Y = 5,
+            Y = 7,
         };
 
         var createButton = new Button
@@ -32,14 +40,14 @@ public sealed class CreateChannelDialog
             Text = "Create",
             IsDefault = true,
             X = Pos.Center() - 10,
-            Y = 7
+            Y = 9
         };
 
         var cancelButton = new Button
         {
             Text = "Cancel",
             X = Pos.Center() + 5,
-            Y = 7
+            Y = 9
         };
 
         createButton.Accepting += (s, e) =>
@@ -55,7 +63,8 @@ public sealed class CreateChannelDialog
             if (string.IsNullOrWhiteSpace(topic))
                 topic = null;
 
-            result = new CreateChannelResult(name, topic);
+            var isPublic = publicCheckbox.Value == CheckState.Checked;
+            result = new CreateChannelResult(name, topic, isPublic);
             e.Handled = true;
             app.RequestStop();
         };
@@ -67,7 +76,7 @@ public sealed class CreateChannelDialog
             app.RequestStop();
         };
 
-        dialog.Add(nameLabel, nameField, topicLabel, topicField, hintLabel, createButton, cancelButton);
+        dialog.Add(nameLabel, nameField, topicLabel, topicField, publicCheckbox, hintLabel, createButton, cancelButton);
 
         nameField.SetFocus();
         app.Run(dialog);

src/EchoHub.Client/UI/EmojiHelper.cs

@@ -0,0 +1,333 @@
+using System.Globalization;
+using System.Text;
+
+namespace EchoHub.Client.UI;
+
+/// <summary>
+/// Converts emoji grapheme clusters to text shortcodes for safe TUI rendering.
+/// Terminal width calculations for emoji are unreliable across different terminals,
+/// so we replace them with fixed-width ASCII shortcodes for display only.
+/// </summary>
+public static class EmojiHelper
+{
+    /// <summary>
+    /// Replace emoji graphemes in the text with :shortcode: equivalents.
+    /// Non-emoji text passes through unchanged.
+    /// </summary>
+    public static string ReplaceEmoji(string text)
+    {
+        if (string.IsNullOrEmpty(text))
+            return text;
+
+        // Quick check: if no characters above BMP or supplementary emoji ranges, skip processing
+        bool hasEmoji = false;
+        foreach (var rune in text.EnumerateRunes())
+        {
+            if (IsEmojiRune(rune))
+            {
+                hasEmoji = true;
+                break;
+            }
+        }
+
+        if (!hasEmoji)
+            return text;
+
+        var sb = new StringBuilder(text.Length);
+        var enumerator = StringInfo.GetTextElementEnumerator(text);
+
+        while (enumerator.MoveNext())
+        {
+            var grapheme = enumerator.GetTextElement();
+
+            // Check if this grapheme contains emoji runes
+            bool graphemeHasEmoji = false;
+            foreach (var rune in grapheme.EnumerateRunes())
+            {
+                if (IsEmojiRune(rune))
+                {
+                    graphemeHasEmoji = true;
+                    break;
+                }
+            }
+
+            if (graphemeHasEmoji)
+            {
+                // Try to find a shortcode for the whole grapheme first
+                if (EmojiShortcodes.TryGetValue(grapheme, out var shortcode))
+                {
+                    sb.Append(shortcode);
+                }
+                else
+                {
+                    // Try the base emoji (first rune only, stripping modifiers/ZWJ)
+                    var baseRune = GetBaseEmoji(grapheme);
+                    if (baseRune is not null && EmojiShortcodes.TryGetValue(baseRune, out shortcode))
+                    {
+                        sb.Append(shortcode);
+                    }
+                    else
+                    {
+                        // Unknown emoji — use generic placeholder
+                        sb.Append("[emoji]");
+                    }
+                }
+            }
+            else
+            {
+                sb.Append(grapheme);
+            }
+        }
+
+        return sb.ToString();
+    }
+
+    private static bool IsEmojiRune(Rune rune)
+    {
+        var value = rune.Value;
+
+        // Common emoji ranges
+        if (value >= 0x1F600 && value <= 0x1F64F) return true; // Emoticons
+        if (value >= 0x1F300 && value <= 0x1F5FF) return true; // Misc Symbols & Pictographs
+        if (value >= 0x1F680 && value <= 0x1F6FF) return true; // Transport & Map
+        if (value >= 0x1F900 && value <= 0x1F9FF) return true; // Supplemental Symbols
+        if (value >= 0x1FA00 && value <= 0x1FA6F) return true; // Chess Symbols
+        if (value >= 0x1FA70 && value <= 0x1FAFF) return true; // Symbols Extended-A
+        if (value >= 0x2600 && value <= 0x26FF) return true;   // Misc Symbols
+        if (value >= 0x2700 && value <= 0x27BF) return true;   // Dingbats
+        if (value >= 0xFE00 && value <= 0xFE0F) return true;   // Variation Selectors
+        if (value >= 0x200D && value <= 0x200D) return true;   // ZWJ
+        if (value >= 0x1F1E0 && value <= 0x1F1FF) return true; // Regional Indicators (flags)
+        if (value >= 0x231A && value <= 0x23F3) return true;   // Misc Technical (watch, hourglass)
+        if (value >= 0x2934 && value <= 0x2935) return true;   // Arrows
+        if (value >= 0x25AA && value <= 0x25FE) return true;   // Geometric Shapes
+        if (value >= 0x2B05 && value <= 0x2B55) return true;   // Misc Symbols & Arrows
+        if (value >= 0x3030 && value <= 0x303D) return true;   // CJK Symbols
+        if (value == 0x00A9 || value == 0x00AE) return true;   // © ®
+        if (value == 0x2122) return true;                       // ™
+        if (value >= 0x1F000 && value <= 0x1F02F) return true;  // Mahjong & Dominos
+
+        return false;
+    }
+
+    /// <summary>
+    /// Extract the base emoji string (first non-modifier, non-ZWJ rune) for lookup.
+    /// </summary>
+    private static string? GetBaseEmoji(string grapheme)
+    {
+        foreach (var rune in grapheme.EnumerateRunes())
+        {
+            // Skip ZWJ, variation selectors, skin tone modifiers
+            if (rune.Value == 0x200D) continue;
+            if (rune.Value >= 0xFE00 && rune.Value <= 0xFE0F) continue;
+            if (rune.Value >= 0x1F3FB && rune.Value <= 0x1F3FF) continue;
+
+            if (IsEmojiRune(rune))
+                return rune.ToString();
+        }
+
+        return null;
+    }
+
+    // Common emoji → shortcode mapping (display-only, covers most frequently used emoji)
+    private static readonly Dictionary<string, string> EmojiShortcodes = new()
+    {
+        // Smileys & Emotion
+        ["\U0001F600"] = ":grinning:",
+        ["\U0001F601"] = ":grin:",
+        ["\U0001F602"] = ":joy:",
+        ["\U0001F603"] = ":smiley:",
+        ["\U0001F604"] = ":smile:",
+        ["\U0001F605"] = ":sweat_smile:",
+        ["\U0001F606"] = ":laughing:",
+        ["\U0001F607"] = ":innocent:",
+        ["\U0001F608"] = ":smiling_imp:",
+        ["\U0001F609"] = ":wink:",
+        ["\U0001F60A"] = ":blush:",
+        ["\U0001F60B"] = ":yum:",
+        ["\U0001F60C"] = ":relieved:",
+        ["\U0001F60D"] = ":heart_eyes:",
+        ["\U0001F60E"] = ":sunglasses:",
+        ["\U0001F60F"] = ":smirk:",
+        ["\U0001F610"] = ":neutral_face:",
+        ["\U0001F611"] = ":expressionless:",
+        ["\U0001F612"] = ":unamused:",
+        ["\U0001F613"] = ":sweat:",
+        ["\U0001F614"] = ":pensive:",
+        ["\U0001F615"] = ":confused:",
+        ["\U0001F616"] = ":confounded:",
+        ["\U0001F617"] = ":kissing:",
+        ["\U0001F618"] = ":kissing_heart:",
+        ["\U0001F619"] = ":kissing_smiling_eyes:",
+        ["\U0001F61A"] = ":kissing_closed_eyes:",
+        ["\U0001F61B"] = ":stuck_out_tongue:",
+        ["\U0001F61C"] = ":stuck_out_tongue_winking_eye:",
+        ["\U0001F61D"] = ":stuck_out_tongue_closed_eyes:",
+        ["\U0001F61E"] = ":disappointed:",
+        ["\U0001F61F"] = ":worried:",
+        ["\U0001F620"] = ":angry:",
+        ["\U0001F621"] = ":rage:",
+        ["\U0001F622"] = ":cry:",
+        ["\U0001F623"] = ":persevere:",
+        ["\U0001F624"] = ":triumph:",
+        ["\U0001F625"] = ":disappointed_relieved:",
+        ["\U0001F626"] = ":frowning:",
+        ["\U0001F627"] = ":anguished:",
+        ["\U0001F628"] = ":fearful:",
+        ["\U0001F629"] = ":weary:",
+        ["\U0001F62A"] = ":sleepy:",
+        ["\U0001F62B"] = ":tired_face:",
+        ["\U0001F62C"] = ":grimacing:",
+        ["\U0001F62D"] = ":sob:",
+        ["\U0001F62E"] = ":open_mouth:",
+        ["\U0001F62F"] = ":hushed:",
+        ["\U0001F630"] = ":cold_sweat:",
+        ["\U0001F631"] = ":scream:",
+        ["\U0001F632"] = ":astonished:",
+        ["\U0001F633"] = ":flushed:",
+        ["\U0001F634"] = ":sleeping:",
+        ["\U0001F635"] = ":dizzy_face:",
+        ["\U0001F636"] = ":no_mouth:",
+        ["\U0001F637"] = ":mask:",
+        ["\U0001F641"] = ":slightly_frowning_face:",
+        ["\U0001F642"] = ":slightly_smiling_face:",
+        ["\U0001F643"] = ":upside_down_face:",
+        ["\U0001F644"] = ":roll_eyes:",
+        ["\U0001F910"] = ":zipper_mouth:",
+        ["\U0001F911"] = ":money_mouth:",
+        ["\U0001F912"] = ":thermometer_face:",
+        ["\U0001F913"] = ":nerd:",
+        ["\U0001F914"] = ":thinking:",
+        ["\U0001F915"] = ":head_bandage:",
+        ["\U0001F920"] = ":cowboy:",
+        ["\U0001F921"] = ":clown:",
+        ["\U0001F922"] = ":nauseated:",
+        ["\U0001F923"] = ":rofl:",
+        ["\U0001F924"] = ":drooling:",
+        ["\U0001F925"] = ":lying:",
+        ["\U0001F929"] = ":star_struck:",
+        ["\U0001F92A"] = ":zany:",
+        ["\U0001F92B"] = ":shushing:",
+        ["\U0001F92C"] = ":cursing:",
+        ["\U0001F92D"] = ":hand_over_mouth:",
+        ["\U0001F92E"] = ":vomiting:",
+        ["\U0001F92F"] = ":exploding_head:",
+        ["\U0001F970"] = ":smiling_face_with_hearts:",
+        ["\U0001F971"] = ":yawning:",
+        ["\U0001F972"] = ":smiling_with_tear:",
+        ["\U0001F973"] = ":partying:",
+        ["\U0001F974"] = ":woozy:",
+        ["\U0001F975"] = ":hot_face:",
+        ["\U0001F976"] = ":cold_face:",
+        ["\U0001F979"] = ":holding_back_tears:",
+        ["\U0001F97A"] = ":pleading:",
+        ["\U0001FAE0"] = ":melting:",
+        ["\U0001FAE1"] = ":saluting:",
+        ["\U0001FAE2"] = ":face_with_open_eyes_hand_over_mouth:",
+        ["\U0001FAE3"] = ":face_with_peeking_eye:",
+        ["\U0001FAE4"] = ":face_with_diagonal_mouth:",
+
+        // Gestures
+        ["\U0001F44D"] = ":+1:",
+        ["\U0001F44E"] = ":-1:",
+        ["\U0001F44B"] = ":wave:",
+        ["\U0001F44C"] = ":ok_hand:",
+        ["\U0001F44F"] = ":clap:",
+        ["\U0001F44A"] = ":fist:",
+        ["\U0001F91D"] = ":handshake:",
+        ["\U0001F91E"] = ":crossed_fingers:",
+        ["\U0001F91F"] = ":love_you:",
+        ["\U0001F918"] = ":metal:",
+        ["\U0001F919"] = ":call_me:",
+        ["\U0001F590"] = ":raised_hand:",
+        ["\U0001F4AA"] = ":muscle:",
+        ["\U0001F926"] = ":facepalm:",
+        ["\U0001F937"] = ":shrug:",
+        ["\U0001F64F"] = ":pray:",
+        ["\U0001F64C"] = ":raised_hands:",
+        ["\U0001F64B"] = ":raising_hand:",
+
+        // Hearts & Symbols
+        ["\u2764"] = "<3",
+        ["\U0001F494"] = "</3",
+        ["\U0001F495"] = ":two_hearts:",
+        ["\U0001F496"] = ":sparkling_heart:",
+        ["\U0001F497"] = ":heartpulse:",
+        ["\U0001F498"] = ":cupid:",
+        ["\U0001F499"] = ":blue_heart:",
+        ["\U0001F49A"] = ":green_heart:",
+        ["\U0001F49B"] = ":yellow_heart:",
+        ["\U0001F49C"] = ":purple_heart:",
+        ["\U0001F49D"] = ":gift_heart:",
+        ["\U0001F49E"] = ":revolving_hearts:",
+        ["\U0001F49F"] = ":heart_decoration:",
+        ["\U0001F90D"] = ":white_heart:",
+        ["\U0001F90E"] = ":brown_heart:",
+        ["\U0001F5A4"] = ":black_heart:",
+        ["\U0001F9E1"] = ":orange_heart:",
+
+        // Objects & Nature
+        ["\U0001F525"] = ":fire:",
+        ["\U0001F4A9"] = ":poop:",
+        ["\U0001F480"] = ":skull:",
+        ["\U0001F47B"] = ":ghost:",
+        ["\U0001F47D"] = ":alien:",
+        ["\U0001F916"] = ":robot:",
+        ["\U0001F4AF"] = ":100:",
+        ["\U0001F4A5"] = ":boom:",
+        ["\U0001F4A4"] = ":zzz:",
+        ["\U0001F4A2"] = ":anger:",
+        ["\U0001F4AC"] = ":speech_balloon:",
+        ["\U0001F440"] = ":eyes:",
+        ["\U0001F3B5"] = ":musical_note:",
+        ["\U0001F3B6"] = ":notes:",
+        ["\U0001F389"] = ":tada:",
+        ["\U0001F38A"] = ":confetti:",
+        ["\U0001F381"] = ":gift:",
+        ["\U0001F3C6"] = ":trophy:",
+        ["\U0001F4B0"] = ":money_bag:",
+        ["\U0001F4BB"] = ":computer:",
+        ["\U0001F4F1"] = ":phone:",
+        ["\U0001F4E7"] = ":email:",
+        ["\U0001F511"] = ":key:",
+        ["\U0001F512"] = ":lock:",
+        ["\U0001F513"] = ":unlock:",
+        ["\U0001F6A8"] = ":rotating_light:",
+        ["\U0001F6AB"] = ":no_entry:",
+
+        // Animals
+        ["\U0001F436"] = ":dog:",
+        ["\U0001F431"] = ":cat:",
+        ["\U0001F42D"] = ":mouse:",
+        ["\U0001F430"] = ":rabbit:",
+        ["\U0001F43B"] = ":bear:",
+        ["\U0001F427"] = ":penguin:",
+        ["\U0001F41D"] = ":bee:",
+        ["\U0001F40D"] = ":snake:",
+        ["\U0001F422"] = ":turtle:",
+
+        // Food & Drink
+        ["\U0001F355"] = ":pizza:",
+        ["\U0001F354"] = ":hamburger:",
+        ["\U0001F37A"] = ":beer:",
+        ["\U0001F377"] = ":wine:",
+        ["\U0001F370"] = ":cake:",
+        ["\u2615"] = ":coffee:",
+        ["\U0001F382"] = ":birthday:",
+
+        // Misc symbols (BMP)
+        ["\u2705"] = ":white_check_mark:",
+        ["\u274C"] = ":x:",
+        ["\u274E"] = ":negative_squared_cross_mark:",
+        ["\u2714"] = ":heavy_check_mark:",
+        ["\u2716"] = ":heavy_multiplication_x:",
+        ["\u26A0"] = ":warning:",
+        ["\u2B50"] = ":star:",
+        ["\u2728"] = ":sparkles:",
+        ["\u267B"] = ":recycle:",
+        ["\u2611"] = ":ballot_box_with_check:",
+        ["\u23F0"] = ":alarm_clock:",
+        ["\u231A"] = ":watch:",
+        ["\u231B"] = ":hourglass:",
+    };
+}

src/EchoHub.Client/UI/MainWindow.cs

@@ -1,10 +1,12 @@
-using System.Collections.ObjectModel;
+using System.Text.RegularExpressions;
 using EchoHub.Client.Themes;
 using EchoHub.Core.DTOs;
 using EchoHub.Core.Models;
 using Terminal.Gui.App;
 using Terminal.Gui.Configuration;
+using Terminal.Gui.Drawing;
 using Terminal.Gui.Input;
+using Terminal.Gui.Text;
 using Terminal.Gui.ViewBase;
 using Terminal.Gui.Views;
 using Attribute = Terminal.Gui.Drawing.Attribute;
@@ -21,14 +23,26 @@ public sealed class MainWindow : Runnable
     private readonly ListView _messageList;
     private readonly TextView _inputField;
     private readonly FrameView _chatFrame;
+    private readonly FrameView _inputFrame;
     private readonly Label _statusLabel;
     private readonly Label _topicLabel;
     private MenuBar _menuBar;
 
+    // Online users panel
+    private readonly FrameView _usersFrame;
+    private readonly ListView _usersList;
+    private readonly UserListSource _usersListSource;
+    private bool _usersPanelVisible = true;
+    private const int UsersPanelWidth = 22;
+    private static readonly Key F2Key = Key.F2;
+
+    internal static readonly string AppVersion =
+        typeof(MainWindow).Assembly.GetName().Version?.ToString(3) ?? "?";
+
     // Cached Key constants — compare via .KeyCode to avoid Key.Equals (which also checks Handled)
     private static readonly Key EnterKey = Key.Enter;
     private static readonly Key NewlineKey = Key.N.WithCtrl;
-    private static readonly Key CtrlCKey = Key.C.WithCtrl;
+    private static readonly Key AltQKey = Key.Q.WithAlt;
     private static readonly Key TabKey = Key.Tab;
 
     // Available slash commands for Tab autocomplete
@@ -36,13 +50,15 @@ public sealed class MainWindow : Runnable
     [
         "/status", "/nick", "/color", "/theme", "/send",
         "/avatar", "/profile", "/servers", "/join", "/leave",
-        "/topic", "/users", "/quit", "/help"
+        "/topic", "/users", "/kick", "/ban", "/unban",
+        "/mute", "/unmute", "/role", "/nuke", "/test-sound", "/quit", "/help"
     ];
 
     private readonly List<string> _channelNames = [];
     private readonly Dictionary<string, List<ChatLine>> _channelMessages = [];
     private readonly Dictionary<string, int> _channelUnread = [];
     private readonly Dictionary<string, string?> _channelTopics = [];
+    private readonly ChannelListSource _channelListSource;
     private string _currentChannel = string.Empty;
     private string _currentUser = string.Empty;
     private int _lastChatWidth;
@@ -92,6 +108,11 @@ public sealed class MainWindow : Runnable
     /// </summary>
     public event Action? OnCreateChannelRequested;
 
+    /// <summary>
+    /// Fired when the user requests to delete the current channel.
+    /// </summary>
+    public event Action? OnDeleteChannelRequested;
+
     public MainWindow(IApplication app)
     {
         _app = app;
@@ -107,7 +128,7 @@ public sealed class MainWindow : Runnable
             Title = "Channels",
             X = 0,
             Y = 1, // below menu bar
-            Width = 25,
+            Width = 22,
             Height = Dim.Fill(1) // leave room for status bar
         };
 
@@ -118,7 +139,8 @@ public sealed class MainWindow : Runnable
             Width = Dim.Fill(),
             Height = Dim.Fill()
         };
-        _channelList.SetSource(new ObservableCollection<string>(_channelNames));
+        _channelListSource = new ChannelListSource();
+        _channelList.Source = _channelListSource;
         _channelList.ValueChanged += OnChannelListSelectionChanged;
         channelsFrame.Add(_channelList);
         Add(channelsFrame);
@@ -127,9 +149,9 @@ public sealed class MainWindow : Runnable
         _topicLabel = new Label
         {
             Text = "",
-            X = 25,
+            X = 22,
             Y = 1,
-            Width = Dim.Fill(),
+            Width = Dim.Fill(UsersPanelWidth),
             Height = 1,
             Visible = false
         };
@@ -139,9 +161,9 @@ public sealed class MainWindow : Runnable
         _chatFrame = new FrameView
         {
             Title = "Chat",
-            X = 25,
+            X = 22,
             Y = 1, // below menu bar (shifts to 2 when topic is visible)
-            Width = Dim.Fill(),
+            Width = Dim.Fill(UsersPanelWidth),
             Height = Dim.Fill(6) // leave room for input area and status bar
         };
 
@@ -157,12 +179,12 @@ public sealed class MainWindow : Runnable
         Add(_chatFrame);
 
         // Bottom input area
-        var inputFrame = new FrameView
+        _inputFrame = new FrameView
         {
-            Title = "Message (Enter=send, Ctrl+N=newline, Tab=autocomplete)",
-            X = 25,
+            Title = "Message \u2502 Enter=send \u2502 Ctrl+N=newline \u2502 Tab=complete",
+            X = 22,
             Y = Pos.Bottom(_chatFrame),
-            Width = Dim.Fill(),
+            Width = Dim.Fill(UsersPanelWidth),
             Height = 5
         };
 
@@ -175,8 +197,31 @@ public sealed class MainWindow : Runnable
             WordWrap = true
         };
         _inputField.KeyDown += OnInputKeyDown;
-        inputFrame.Add(_inputField);
-        Add(inputFrame);
+        _inputField.ContentsChanged += OnInputContentsChanged;
+        _inputFrame.Add(_inputField);
+        Add(_inputFrame);
+
+        // Right panel - online users
+        _usersFrame = new FrameView
+        {
+            Title = "Users",
+            X = Pos.AnchorEnd(UsersPanelWidth),
+            Y = 1,
+            Width = UsersPanelWidth,
+            Height = Dim.Fill(1)
+        };
+
+        _usersList = new ListView
+        {
+            X = 0,
+            Y = 0,
+            Width = Dim.Fill(),
+            Height = Dim.Fill()
+        };
+        _usersListSource = new UserListSource();
+        _usersList.Source = _usersListSource;
+        _usersFrame.Add(_usersList);
+        Add(_usersFrame);
 
         // Status bar at the very bottom
         _statusLabel = new Label
@@ -198,7 +243,7 @@ public sealed class MainWindow : Runnable
         _messageList.ViewportChanged += (_, _) => OnChatViewportChanged();
         _chatFrame.ViewportChanged += (_, _) => OnChatViewportChanged();
 
-        // Window-level key handling for Ctrl+C (quit)
+        // Window-level key handling for Alt+Q (quit), F2 (toggle users panel)
         KeyDown += OnWindowKeyDown;
     }
 
@@ -265,7 +310,11 @@ public sealed class MainWindow : Runnable
                 new MenuItem("_Disconnect", "Disconnect from server", () => OnDisconnectRequested?.Invoke(), Key.Empty),
                 new Line(),
                 new MenuItem("New C_hannel...", "Create a new channel", () => OnCreateChannelRequested?.Invoke(), Key.Empty),
-                new MenuItem("_Saved Servers...", "View saved servers", () => OnSavedServersRequested?.Invoke(), Key.Empty)
+                new MenuItem("_Delete Channel", "Delete the current channel", () => OnDeleteChannelRequested?.Invoke(), Key.Empty),
+                new Line(),
+                new MenuItem("_Saved Servers...", "View saved servers", () => OnSavedServersRequested?.Invoke(), Key.Empty),
+                new Line(),
+                new MenuItem("Toggle _Users Panel", "Toggle online users (F2)", () => ToggleUsersPanel(), Key.Empty)
             }),
             new MenuBarItem("_User", allUserItems)
         ]);
@@ -333,13 +382,38 @@ public sealed class MainWindow : Runnable
             }
             e.Handled = true;
         }
-        else if (e.KeyCode == CtrlCKey.KeyCode)
+        else if (e.KeyCode == AltQKey.KeyCode)
         {
             _app.RequestStop();
             e.Handled = true;
         }
     }
 
+    private bool _suppressEmojiReplace;
+
+    private void OnInputContentsChanged(object? sender, ContentsChangedEventArgs e)
+    {
+        if (_suppressEmojiReplace)
+            return;
+
+        var text = _inputField.Text;
+        if (string.IsNullOrEmpty(text))
+            return;
+
+        var replaced = EmojiHelper.ReplaceEmoji(text);
+        if (replaced == text)
+            return;
+
+        // Calculate where cursor should land after replacement
+        var lengthDelta = replaced.Length - text.Length;
+        var newCol = Math.Max(0, _inputField.CurrentColumn + lengthDelta);
+
+        _suppressEmojiReplace = true;
+        _inputField.Text = replaced;
+        _inputField.InsertionPoint = new System.Drawing.Point(newCol, _inputField.CurrentRow);
+        _suppressEmojiReplace = false;
+    }
+
     /// <summary>
     /// Tab-complete slash commands in the input field.
     /// </summary>
@@ -386,12 +460,16 @@ public sealed class MainWindow : Runnable
 
     private void OnWindowKeyDown(object? sender, Key e)
     {
-        // Ctrl+C quits from anywhere
-        if (e.KeyCode == CtrlCKey.KeyCode)
+        if (e.KeyCode == AltQKey.KeyCode)
         {
             _app.RequestStop();
             e.Handled = true;
         }
+        else if (e.KeyCode == F2Key.KeyCode)
+        {
+            ToggleUsersPanel();
+            e.Handled = true;
+        }
     }
 
     /// <summary>
@@ -430,19 +508,33 @@ public sealed class MainWindow : Runnable
     /// </summary>
     public void AddSystemMessage(string channelName, string text)
     {
-        var time = DateTimeOffset.Now.ToString("HH:mm");
-        var segments = new List<ChatSegment>
-        {
-            new($"[{time}] ", ChatColors.TimestampAttr),
-            new($"** {text}", ChatColors.SystemAttr)
-        };
-
         if (!_channelMessages.TryGetValue(channelName, out var messages))
         {
             messages = [];
             _channelMessages[channelName] = messages;
         }
-        messages.Add(new ChatLine(segments));
+
+        var time = DateTimeOffset.Now.ToString("HH:mm");
+        var textLines = text.Split('\n');
+
+        // First line gets timestamp prefix
+        messages.Add(new ChatLine(
+        [
+            new($"[{time}] ", ChatColors.TimestampAttr),
+            new($"** {textLines[0].TrimEnd('\r')}", ChatColors.SystemAttr)
+        ]));
+
+        // Continuation lines are indented to align
+        var indent = new string(' ', $"[{time}] ** ".Length);
+        for (int i = 1; i < textLines.Length; i++)
+        {
+            var line = textLines[i].TrimEnd('\r');
+            if (string.IsNullOrWhiteSpace(line)) continue;
+            messages.Add(new ChatLine(
+            [
+                new($"{indent}{line}", ChatColors.SystemAttr)
+            ]));
+        }
 
         if (channelName == _currentChannel)
         {
@@ -475,6 +567,32 @@ public sealed class MainWindow : Runnable
         }
     }
 
+    /// <summary>
+    /// Remove all lines associated with a specific message ID.
+    /// </summary>
+    public void RemoveMessage(string channelName, Guid messageId)
+    {
+        if (_channelMessages.TryGetValue(channelName, out var messages))
+        {
+            messages.RemoveAll(l => l.MessageId == messageId);
+            if (channelName == _currentChannel)
+                RefreshMessages();
+        }
+    }
+
+    /// <summary>
+    /// Clear all messages from a specific channel.
+    /// </summary>
+    public void ClearChannelMessages(string channelName)
+    {
+        if (_channelMessages.TryGetValue(channelName, out var messages))
+        {
+            messages.Clear();
+            if (channelName == _currentChannel)
+                RefreshMessages();
+        }
+    }
+
     /// <summary>
     /// Set the list of available channels, storing topics, and refresh the channel list view.
     /// </summary>
@@ -492,6 +610,30 @@ public sealed class MainWindow : Runnable
         RefreshChannelList();
     }
 
+    /// <summary>
+    /// Ensure a channel exists in the left panel list (used for private channels joined via /join).
+    /// </summary>
+    public void EnsureChannelInList(string channelName)
+    {
+        if (_channelNames.Contains(channelName))
+            return;
+
+        _channelNames.Add(channelName);
+        if (!_channelMessages.ContainsKey(channelName))
+            _channelMessages[channelName] = [];
+        RefreshChannelList();
+    }
+
+    /// <summary>
+    /// Remove a channel from the left panel list.
+    /// </summary>
+    public void RemoveChannel(string channelName)
+    {
+        _channelNames.Remove(channelName);
+        _channelTopics.Remove(channelName);
+        RefreshChannelList();
+    }
+
     /// <summary>
     /// Update the topic for a specific channel.
     /// </summary>
@@ -515,9 +657,9 @@ public sealed class MainWindow : Runnable
     /// </summary>
     public void UpdateStatusBar(string status)
     {
-        var userPart = string.IsNullOrEmpty(_currentUser) ? "" : $" | User: {_currentUser}";
-        var channelPart = string.IsNullOrEmpty(_currentChannel) ? "" : $" | #{_currentChannel}";
-        _statusLabel.Text = $" {status}{userPart}{channelPart}";
+        var userPart = string.IsNullOrEmpty(_currentUser) ? "" : $" \u2502 User: {_currentUser}";
+        var channelPart = string.IsNullOrEmpty(_currentChannel) ? "" : $" \u2502 #{_currentChannel}";
+        _statusLabel.Text = $" v{AppVersion} \u2502 {status}{userPart}{channelPart}";
     }
 
     /// <summary>
@@ -585,10 +727,14 @@ public sealed class MainWindow : Runnable
         _channelTopics.Clear();
         _currentChannel = string.Empty;
         _currentUser = string.Empty;
-        _channelList.SetSource(new ObservableCollection<string>(_channelNames));
+        _channelListSource.Update([], [], string.Empty);
+        _channelList.Source = _channelListSource;
         _chatFrame.Title = "Chat";
         _topicLabel.Visible = false;
         _chatFrame.Y = 1;
+        _usersListSource.Update([]);
+        _usersList.Source = _usersListSource;
+        _usersFrame.Title = "Users";
         RefreshMessages();
     }
 
@@ -640,13 +786,8 @@ public sealed class MainWindow : Runnable
     /// </summary>
     private void RefreshChannelList()
     {
-        var displayNames = _channelNames.Select(name =>
-        {
-            _channelUnread.TryGetValue(name, out var unread);
-            return unread > 0 ? $"#{name} ({unread})" : $"#{name}";
-        }).ToList();
-
-        _channelList.SetSource(new ObservableCollection<string>(displayNames));
+        _channelListSource.Update(_channelNames, _channelUnread, _currentChannel);
+        _channelList.Source = _channelListSource;
 
         // Restore selection to current channel
         var idx = _channelNames.IndexOf(_currentChannel);
@@ -673,11 +814,66 @@ public sealed class MainWindow : Runnable
         }
     }
 
+    /// <summary>
+    /// Adjusts widths of chat, topic, and input frames based on users panel visibility.
+    /// </summary>
+    private void UpdateLayout()
+    {
+        var rightMargin = _usersPanelVisible ? UsersPanelWidth : 0;
+        _chatFrame.Width = Dim.Fill(rightMargin);
+        _topicLabel.Width = Dim.Fill(rightMargin);
+        _inputFrame.Width = Dim.Fill(rightMargin);
+        _usersFrame.Visible = _usersPanelVisible;
+        SetNeedsDraw();
+    }
+
+    /// <summary>
+    /// Toggle the online users panel visibility (F2).
+    /// </summary>
+    public void ToggleUsersPanel()
+    {
+        _usersPanelVisible = !_usersPanelVisible;
+        UpdateLayout();
+    }
+
+    /// <summary>
+    /// Update the online users list display.
+    /// </summary>
+    public void UpdateOnlineUsers(List<UserPresenceDto> users)
+    {
+        var displayItems = users.Select(u =>
+        {
+            var statusIcon = u.Status switch
+            {
+                UserStatus.Online => "\u25cf", // ●
+                UserStatus.Away => "\u25cb",   // ○
+                UserStatus.DoNotDisturb => "\u25d0", // ◐
+                UserStatus.Invisible => "\u25cc",    // ◌
+                _ => " "
+            };
+            var name = u.DisplayName ?? u.Username;
+            var roleTag = u.Role switch
+            {
+                ServerRole.Owner => "\u2605", // ★
+                ServerRole.Admin => "\u2666", // ♦
+                ServerRole.Mod => "\u2740",   // ❀
+                _ => ""
+            };
+            var text = $"{statusIcon} {roleTag}{name}";
+            var nameColor = ColorHelper.ParseHexColor(u.NicknameColor);
+            return (text, nameColor);
+        }).ToList();
+
+        _usersListSource.Update(displayItems);
+        _usersList.Source = _usersListSource;
+        _usersFrame.Title = $"Users ({users.Count})";
+    }
+
     /// <summary>
     /// Format a message DTO into one or more display lines based on its MessageType.
     /// Timestamps are dimmed and sender names are colored.
     /// </summary>
-    private static List<ChatLine> FormatMessage(MessageDto message)
+    private List<ChatLine> FormatMessage(MessageDto message)
     {
         var time = message.SentAt.ToLocalTime().ToString("HH:mm");
         var senderName = message.SenderUsername + ":";
@@ -694,10 +890,10 @@ public sealed class MainWindow : Runnable
                 {
                     foreach (var artLine in message.Content.Split('\n'))
                     {
-                        // Parse ANSI color codes from colored ASCII art
+                        // Parse color tags from colored ASCII art
                         var trimmed = artLine.TrimEnd('\r');
-                        if (trimmed.Contains('\x1b'))
-                            lines.Add(ChatLine.FromAnsi("       " + trimmed));
+                        if (ChatLine.HasColorTags(trimmed))
+                            lines.Add(ChatLine.FromColoredText("       " + trimmed));
                         else
                             lines.Add(new ChatLine($"       {trimmed}"));
                     }
@@ -712,18 +908,43 @@ public sealed class MainWindow : Runnable
 
             case MessageType.Text:
             default:
-                var contentLines = message.Content.Split('\n');
+                var displayContent = EmojiHelper.ReplaceEmoji(message.Content);
+                var contentLines = displayContent.Split('\n');
                 var firstLine = contentLines[0].TrimEnd('\r');
-                lines.Add(BuildChatLine(time, senderName, senderColor, $" {firstLine}"));
+                lines.Add(BuildChatLineWithMentions(time, senderName, senderColor, $" {firstLine}"));
                 // Continuation lines indented to align with first line's content
                 var indent = new string(' ', $"[{time}] {senderName} ".Length);
                 for (int i = 1; i < contentLines.Length; i++)
                 {
-                    lines.Add(new ChatLine($"{indent}{contentLines[i].TrimEnd('\r')}"));
+                    var contText = $"{indent}{contentLines[i].TrimEnd('\r')}";
+                    lines.Add(new ChatLine(ChatColors.SplitMentions(contText)));
+                }
+
+                // Render link embeds if present
+                if (message.Embeds is { Count: > 0 })
+                {
+                    var chatWidth = _lastChatWidth > 0 ? _lastChatWidth : 80;
+                    foreach (var embed in message.Embeds)
+                        lines.AddRange(FormatEmbed(embed, indent, chatWidth));
                 }
                 break;
         }
 
+        // Tag all lines with the message ID for deletion support
+        foreach (var line in lines)
+            line.MessageId = message.Id;
+
+        // Check for @mention of current user
+        if (!string.IsNullOrEmpty(_currentUser) && message.Type == MessageType.Text)
+        {
+            var pattern = $@"@{Regex.Escape(_currentUser)}\b";
+            if (Regex.IsMatch(message.Content, pattern, RegexOptions.IgnoreCase))
+            {
+                foreach (var line in lines)
+                    line.IsMention = true;
+            }
+        }
+
         return lines;
     }
 
@@ -740,4 +961,98 @@ public sealed class MainWindow : Runnable
         };
         return new ChatLine(segments);
     }
+
+    /// <summary>
+    /// Build a chat line with @mention highlighting in the suffix text.
+    /// </summary>
+    private static ChatLine BuildChatLineWithMentions(string time, string senderName, Attribute? senderColor, string suffix)
+    {
+        var segments = new List<ChatSegment>
+        {
+            new($"[{time}] ", ChatColors.TimestampAttr),
+            new(senderName, senderColor),
+        };
+        segments.AddRange(ChatColors.SplitMentions(suffix));
+        return new ChatLine(segments);
+    }
+
+    /// <summary>
+    /// Format a link embed as indented chat lines with a left border bar,
+    /// text at full width, and optional icon below (preview image).
+    /// Each line is pre-wrapped to fit chatWidth so ChatLine.Wrap won't break layout.
+    /// </summary>
+    private static List<ChatLine> FormatEmbed(EmbedDto embed, string indent, int chatWidth)
+    {
+        var lines = new List<ChatLine>();
+        const string border = "\u258f "; // ▏ + space
+        const int borderCols = 2;
+        int indentCols = indent.GetColumns();
+        int textWidth = chatWidth - indentCols - borderCols;
+        if (textWidth < 20) textWidth = 20;
+
+        // Helper: create a bordered text line
+        void AddTextLine(string text, Attribute? color)
+        {
+            lines.Add(new ChatLine(
+            [
+                new ChatSegment(indent, null),
+                new ChatSegment(border, ChatColors.EmbedBorderAttr),
+                new ChatSegment(text, color)
+            ]));
+        }
+
+        // Site name
+        if (!string.IsNullOrWhiteSpace(embed.SiteName))
+            AddTextLine(embed.SiteName, ChatColors.EmbedBorderAttr);
+
+        // Title
+        if (!string.IsNullOrWhiteSpace(embed.Title))
+        {
+            foreach (var wrapped in WordWrap(embed.Title, textWidth))
+                AddTextLine(wrapped, ChatColors.EmbedTitleAttr);
+        }
+
+        // Description (word-wrapped at full available width)
+        if (!string.IsNullOrWhiteSpace(embed.Description))
+        {
+            foreach (var wrapped in WordWrap(embed.Description, textWidth))
+                AddTextLine(wrapped, ChatColors.EmbedDescAttr);
+        }
+
+        return lines;
+    }
+
+    /// <summary>
+    /// Simple word-wrap: splits text into lines that fit within maxCols display columns.
+    /// </summary>
+    private static List<string> WordWrap(string text, int maxCols)
+    {
+        if (maxCols <= 0)
+            return [text];
+
+        var result = new List<string>();
+        var words = text.Split(' ', StringSplitOptions.RemoveEmptyEntries);
+        var currentLine = "";
+
+        foreach (var word in words)
+        {
+            var candidate = currentLine.Length == 0 ? word : currentLine + " " + word;
+            if (candidate.GetColumns() <= maxCols)
+            {
+                currentLine = candidate;
+            }
+            else
+            {
+                if (currentLine.Length > 0)
+                    result.Add(currentLine);
+                // If a single word exceeds maxCols, just add it as-is
+                currentLine = word;
+            }
+        }
+
+        if (currentLine.Length > 0)
+            result.Add(currentLine);
+
+        return result;
+    }
 }

src/EchoHub.Client/UI/ProfileEditDialog.cs

@@ -9,7 +9,7 @@ namespace EchoHub.Client.UI;
 /// <summary>
 /// Result returned from the profile edit dialog.
 /// </summary>
-public record ProfileEditResult(string? DisplayName, string? Bio, string? NicknameColor);
+public record ProfileEditResult(string? DisplayName, string? Bio, string? NicknameColor, string? AvatarPath, bool? NotificationSoundEnabled, byte? NotificationVolume);
 
 /// <summary>
 /// A Terminal.Gui dialog for editing the user's profile (display name, bio, nickname color).
@@ -19,11 +19,11 @@ public sealed class ProfileEditDialog
     /// <summary>
     /// Shows the profile edit dialog and returns the result, or null if cancelled.
     /// </summary>
-    public static ProfileEditResult? Show(IApplication app, string? currentDisplayName, string? currentBio, string? currentColor)
+    public static ProfileEditResult? Show(IApplication app, string? currentDisplayName, string? currentBio, string? currentColor, bool notificationSoundEnabled = false, byte notificationVolume = 30)
     {
         ProfileEditResult? result = null;
 
-        var dialog = new Dialog { Title = "Edit Profile", Width = 60, Height = 18 };
+        var dialog = new Dialog { Title = "Edit Profile", Width = 60, Height = 26 };
 
         // Display Name
         var nameLabel = new Label
@@ -102,20 +102,99 @@ public sealed class ProfileEditDialog
             UpdateColorPreview(colorPreview, colorField.Text);
         };
 
+        // Avatar
+        var avatarLabel = new Label
+        {
+            Text = "Avatar:",
+            X = 1,
+            Y = 10
+        };
+        var avatarField = new TextField
+        {
+            Text = "",
+            X = 17,
+            Y = 10,
+            Width = Dim.Fill(12)
+        };
+        var browseButton = new Button
+        {
+            Text = "Browse",
+            X = Pos.AnchorEnd(10),
+            Y = 10
+        };
+        var avatarHintLabel = new Label
+        {
+            Text = "(file path or URL)",
+            X = 17,
+            Y = 11
+        };
+        avatarHintLabel.SetScheme(new Scheme
+        {
+            Normal = new Attribute(Color.DarkGray, Color.Blue)
+        });
+
+        browseButton.Accepting += (s, e) =>
+        {
+            e.Handled = true;
+            var openDialog = new OpenDialog
+            {
+                Title = "Select Avatar Image",
+                OpenMode = OpenMode.File,
+            };
+            app.Run(openDialog);
+            if (openDialog.FilePaths.Count > 0)
+            {
+                avatarField.Text = openDialog.FilePaths[0];
+            }
+        };
+
+        // Notification Sound
+        var notifCheckbox = new CheckBox
+        {
+            Text = "Notification sound on @mention",
+            X = 1,
+            Y = 13,
+            Value = notificationSoundEnabled ? CheckState.Checked : CheckState.UnChecked
+        };
+
+        var volumeLabel = new Label
+        {
+            Text = "Volume:",
+            X = 1,
+            Y = 15
+        };
+        var volumeField = new TextField
+        {
+            Text = notificationVolume.ToString(),
+            X = 17,
+            Y = 15,
+            Width = 6
+        };
+        var volumeHintLabel = new Label
+        {
+            Text = "(0-100)",
+            X = 24,
+            Y = 15
+        };
+        volumeHintLabel.SetScheme(new Scheme
+        {
+            Normal = new Attribute(Color.DarkGray, Color.Blue)
+        });
+
         // Buttons
         var saveButton = new Button
         {
             Text = "Save",
             IsDefault = true,
             X = Pos.Center() - 10,
-            Y = 10
+            Y = 18
         };
 
         var cancelButton = new Button
         {
             Text = "Cancel",
             X = Pos.Center() + 5,
-            Y = 10
+            Y = 18
         };
 
         saveButton.Accepting += (s, e) =>
@@ -123,8 +202,10 @@ public sealed class ProfileEditDialog
             var displayName = NullIfEmpty(nameField.Text?.Trim());
             var bio = NullIfEmpty(bioField.Text?.Trim());
             var nicknameColor = NullIfEmpty(colorField.Text?.Trim());
+            var avatarPath = NullIfEmpty(avatarField.Text?.Trim());
 
-            result = new ProfileEditResult(displayName, bio, nicknameColor);
+            byte? volume = byte.TryParse(volumeField.Text, out var v) ? Math.Min(v, (byte)100) : null;
+            result = new ProfileEditResult(displayName, bio, nicknameColor, avatarPath, notifCheckbox.Value == CheckState.Checked, volume);
             e.Handled = true;
             app.RequestStop();
         };
@@ -137,7 +218,10 @@ public sealed class ProfileEditDialog
         };
 
         dialog.Add(nameLabel, nameField, bioLabel, bioField, colorLabel, colorField,
-            colorHintLabel, previewLabel, colorPreview, saveButton, cancelButton);
+            colorHintLabel, previewLabel, colorPreview,
+            avatarLabel, avatarField, browseButton, avatarHintLabel,
+            notifCheckbox, volumeLabel, volumeField, volumeHintLabel,
+            saveButton, cancelButton);
 
         nameField.SetFocus();
         app.Run(dialog);

src/EchoHub.Client/UI/ProfileViewDialog.cs

@@ -140,12 +140,20 @@ public sealed class ProfileViewDialog
         dialog.Add(bioView);
         row += 3;
 
-        // ASCII Avatar
+        // ASCII Avatar — render with color tags
         if (!string.IsNullOrWhiteSpace(profile.AvatarAscii))
         {
             row++;
-            var avatarLines = profile.AvatarAscii.Split('\n').Length;
-            var avatarHeight = Math.Min(avatarLines + 2, 6);
+            var rawLines = profile.AvatarAscii.Split('\n');
+            var avatarSource = new ChatListSource();
+            foreach (var line in rawLines)
+            {
+                avatarSource.Add(ChatLine.HasColorTags(line)
+                    ? ChatLine.FromColoredText(line)
+                    : new ChatLine(line));
+            }
+
+            var avatarHeight = Math.Min(rawLines.Length + 2, 24);
             var avatarFrame = new FrameView
             {
                 Title = "Avatar",
@@ -154,9 +162,22 @@ public sealed class ProfileViewDialog
                 Width = Dim.Fill(2),
                 Height = avatarHeight
             };
-            avatarFrame.Add(new Label { Text = profile.AvatarAscii, X = 0, Y = 0 });
+            var avatarList = new ListView
+            {
+                X = 0,
+                Y = 0,
+                Width = Dim.Fill(),
+                Height = Dim.Fill(),
+                Source = avatarSource
+            };
+            avatarFrame.Add(avatarList);
             dialog.Add(avatarFrame);
-            // Grow dialog to fit avatar
+
+            // Grow dialog to fit avatar + widen for art
+            var artWidth = rawLines.Max(l => ChatLine.HasColorTags(l)
+                ? ChatLine.FromColoredText(l).TextLength
+                : l.Length);
+            dialog.Width = Math.Max(50, artWidth + 6);
             dialog.Height = row + avatarHeight + 4;
         }
 

src/EchoHub.Core/Constants/HubConstants.cs

@@ -4,10 +4,19 @@ public static class HubConstants
 {
     public const string ChatHubPath = "/hubs/chat";
     public const string DefaultChannel = "general";
-    public const int DefaultHistoryCount = 50;
+    public const int DefaultHistoryCount = 100;
     public const int MaxMessageLength = 2000;
     public const int MaxFileSizeBytes = 10 * 1024 * 1024; // 10 MB
     public const int MaxAvatarSizeBytes = 2 * 1024 * 1024; // 2 MB
+    public const int MaxMessageNewlines = 30;
+    public const int MaxConsecutiveNewlines = 1;
     public const int AsciiArtWidth = 80;
     public const int AsciiArtHeight = 40;
+    public const int AsciiArtHeightHalfBlock = 80;
+
+    // Link embed constants
+    public const int EmbedMaxDescriptionLength = 500;
+    public const int EmbedMaxHtmlBytes = 64 * 1024; // 64 KB
+    public const int EmbedFetchTimeoutSeconds = 5;
+    public const int EmbedMaxUrlsPerMessage = 3;
 }

src/EchoHub.Core/Contracts/IChatBroadcaster.cs

@@ -0,0 +1,18 @@
+using EchoHub.Core.DTOs;
+
+namespace EchoHub.Core.Contracts;
+
+public interface IChatBroadcaster
+{
+    Task SendMessageToChannelAsync(string channelName, MessageDto message);
+    Task SendUserJoinedAsync(string channelName, string username, string? excludeConnectionId = null);
+    Task SendUserLeftAsync(string channelName, string username);
+    Task SendChannelUpdatedAsync(ChannelDto channel, string? channelName = null);
+    Task SendUserStatusChangedAsync(List<string> channelNames, UserPresenceDto presence);
+    Task SendUserKickedAsync(string channelName, string username, string? reason);
+    Task SendUserBannedAsync(string username, string? reason);
+    Task SendMessageDeletedAsync(string channelName, Guid messageId);
+    Task SendChannelNukedAsync(string channelName);
+    Task SendErrorAsync(string connectionId, string message);
+    Task ForceDisconnectUserAsync(List<string> connectionIds, string reason);
+}

src/EchoHub.Core/Contracts/IChatService.cs

@@ -0,0 +1,36 @@
+using EchoHub.Core.DTOs;
+using EchoHub.Core.Models;
+
+namespace EchoHub.Core.Contracts;
+
+public interface IChatService
+{
+    // Connection lifecycle
+    Task UserConnectedAsync(string connectionId, Guid userId, string username);
+    Task<string?> UserDisconnectedAsync(string connectionId);
+
+    // Channel operations
+    Task<(List<MessageDto> History, string? Error)> JoinChannelAsync(string connectionId, Guid userId, string username, string channelName);
+    Task LeaveChannelAsync(string connectionId, string username, string channelName);
+
+    // Messaging
+    Task<string?> SendMessageAsync(Guid userId, string username, string channelName, string content);
+    Task<List<MessageDto>> GetChannelHistoryAsync(string channelName, int count);
+
+    // Presence
+    Task<string?> UpdateStatusAsync(Guid userId, string username, UserStatus status, string? statusMessage);
+    Task<List<UserPresenceDto>> GetOnlineUsersAsync(string channelName);
+
+    // Broadcasting (used by controllers and IRC gateway)
+    Task BroadcastMessageAsync(string channelName, MessageDto message);
+    Task BroadcastChannelUpdatedAsync(ChannelDto channel, string? channelName = null);
+
+    // Query operations (used by IRC gateway for WHOIS, TOPIC, LIST, AUTH)
+    Task<UserProfileDto?> GetUserProfileAsync(string username);
+    Task<(string? Topic, bool Exists)> GetChannelTopicAsync(string channelName);
+    Task<List<ChannelListItem>> GetChannelListAsync();
+    Task<List<string>> GetChannelsForUserAsync(string username);
+    Task<(Guid UserId, string Username)?> AuthenticateUserAsync(string username, string password);
+}
+
+public record ChannelListItem(string Name, string? Topic, int OnlineCount);

src/EchoHub.Core/Contracts/IEchoHubClient.cs

@@ -12,5 +12,10 @@ public interface IEchoHubClient
     Task UserLeft(string channelName, string username);
     Task ChannelUpdated(ChannelDto channel);
     Task UserStatusChanged(UserPresenceDto presence);
+    Task UserKicked(string channelName, string username, string? reason);
+    Task UserBanned(string username, string? reason);
+    Task MessageDeleted(string channelName, Guid messageId);
+    Task ChannelNuked(string channelName);
+    Task ForceDisconnect(string reason);
     Task Error(string message);
 }

src/EchoHub.Core/Contracts/IMessageEncryptionService.cs

@@ -0,0 +1,14 @@
+namespace EchoHub.Core.Contracts;
+
+public interface IMessageEncryptionService
+{
+    /// <summary>
+    /// Whether database content should be encrypted at rest (server setting).
+    /// </summary>
+    bool EncryptDatabaseEnabled { get; }
+
+    string Encrypt(string plaintext);
+    string Decrypt(string content);
+    string? EncryptNullable(string? value);
+    string? DecryptNullable(string? value);
+}

src/EchoHub.Core/DTOs/ChatDtos.cs

@@ -11,12 +11,14 @@ public record MessageDto(
     MessageType Type,
     string? AttachmentUrl,
     string? AttachmentFileName,
-    DateTimeOffset SentAt);
+    DateTimeOffset SentAt,
+    List<EmbedDto>? Embeds = null);
 
 public record ChannelDto(
     Guid Id,
     string Name,
     string? Topic,
+    bool IsPublic,
     int MessageCount,
     DateTimeOffset CreatedAt);
 
@@ -30,8 +32,15 @@ public record UserDto(
 
 public record SendMessageRequest(string ChannelName, string Content);
 
-public record CreateChannelRequest(string Name, string? Topic = null);
+public record CreateChannelRequest(string Name, string? Topic = null, bool IsPublic = true);
 
 public record UpdateTopicRequest(string? Topic);
 
 public record SendUrlRequest(string Url);
+
+public record EmbedDto(
+    string? SiteName,
+    string? Title,
+    string? Description,
+    string? ImageAscii,
+    string Url);

src/EchoHub.Core/DTOs/ModerationDtos.cs

@@ -0,0 +1,8 @@
+using EchoHub.Core.Models;
+
+namespace EchoHub.Core.DTOs;
+
+public record AssignRoleRequest(string Username, ServerRole Role);
+public record MuteRequest(string? Reason = null, int? DurationMinutes = null);
+public record BanRequest(string? Reason = null);
+public record KickRequest(string? Reason = null);

src/EchoHub.Core/DTOs/ProfileDtos.cs

@@ -11,6 +11,7 @@ public record UserProfileDto(
     string? AvatarAscii,
     UserStatus Status,
     string? StatusMessage,
+    ServerRole Role,
     DateTimeOffset CreatedAt,
     DateTimeOffset LastSeenAt);
 
@@ -28,6 +29,7 @@ public record UserPresenceDto(
     string? DisplayName,
     string? NicknameColor,
     UserStatus Status,
-    string? StatusMessage);
+    string? StatusMessage,
+    ServerRole Role);
 
 public record AvatarUploadResponse(string AvatarAscii);

src/EchoHub.Core/DTOs/ServerDtos.cs

@@ -1,3 +1,5 @@
 namespace EchoHub.Core.DTOs;
 
 public record ServerStatusDto(string Name, string? Description, int OnlineUsers, int TotalChannels);
+
+public record EncryptionKeyResponse(string Key);

src/EchoHub.Core/Models/Channel.cs

@@ -5,6 +5,7 @@ public class Channel
     public Guid Id { get; set; }
     public required string Name { get; set; }
     public string? Topic { get; set; }
+    public bool IsPublic { get; set; } = true;
     public DateTimeOffset CreatedAt { get; set; } = DateTimeOffset.UtcNow;
     public Guid CreatedByUserId { get; set; }
 

src/EchoHub.Core/Models/ChannelMembership.cs

@@ -0,0 +1,8 @@
+namespace EchoHub.Core.Models;
+
+public class ChannelMembership
+{
+    public Guid UserId { get; set; }
+    public Guid ChannelId { get; set; }
+    public DateTimeOffset JoinedAt { get; set; } = DateTimeOffset.UtcNow;
+}

src/EchoHub.Core/Models/Message.cs

@@ -7,6 +7,7 @@ public class Message
     public MessageType Type { get; set; } = MessageType.Text;
     public string? AttachmentUrl { get; set; }
     public string? AttachmentFileName { get; set; }
+    public string? EmbedJson { get; set; }
     public DateTimeOffset SentAt { get; set; } = DateTimeOffset.UtcNow;
 
     public Guid ChannelId { get; set; }

src/EchoHub.Core/Models/ServerRole.cs

@@ -0,0 +1,9 @@
+namespace EchoHub.Core.Models;
+
+public enum ServerRole
+{
+    Member = 0,
+    Mod = 1,
+    Admin = 2,
+    Owner = 3
+}

src/EchoHub.Core/Models/User.cs

@@ -11,6 +11,10 @@ public class User
     public string? AvatarAscii { get; set; }
     public UserStatus Status { get; set; } = UserStatus.Online;
     public string? StatusMessage { get; set; }
+    public ServerRole Role { get; set; } = ServerRole.Member;
+    public bool IsMuted { get; set; }
+    public DateTimeOffset? MutedUntil { get; set; }
+    public bool IsBanned { get; set; }
     public DateTimeOffset CreatedAt { get; set; } = DateTimeOffset.UtcNow;
     public DateTimeOffset LastSeenAt { get; set; } = DateTimeOffset.UtcNow;
 }

src/EchoHub.Server.Irc/EchoHub.Server.Irc.csproj

@@ -0,0 +1,18 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <ItemGroup>
+    <FrameworkReference Include="Microsoft.AspNetCore.App" />
+    <ProjectReference Include="..\EchoHub.Core\EchoHub.Core.csproj" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <PackageReference Include="BCrypt.Net-Next" Version="4.1.0" />
+  </ItemGroup>
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+  </PropertyGroup>
+
+</Project>

src/EchoHub.Server.Irc/IrcBroadcaster.cs

@@ -0,0 +1,131 @@
+using EchoHub.Core.Contracts;
+using EchoHub.Core.DTOs;
+
+namespace EchoHub.Server.Irc;
+
+public class IrcBroadcaster : IChatBroadcaster
+{
+    private readonly IrcGatewayService _gateway;
+    private readonly IMessageEncryptionService _encryption;
+
+    public IrcBroadcaster(IrcGatewayService gateway, IMessageEncryptionService encryption)
+    {
+        _gateway = gateway;
+        _encryption = encryption;
+    }
+
+    public async Task SendMessageToChannelAsync(string channelName, MessageDto message)
+    {
+        // Decrypt content for IRC clients (they can't handle app-layer encryption)
+        var decryptedMessage = message with { Content = _encryption.Decrypt(message.Content) };
+        var lines = IrcMessageFormatter.FormatMessage(decryptedMessage);
+
+        foreach (var conn in _gateway.GetConnectionsInChannel(channelName))
+        {
+            // IRC convention: don't echo sender's own message
+            if (conn.Nickname == message.SenderUsername)
+                continue;
+
+            foreach (var line in lines)
+                await conn.SendAsync(line);
+        }
+    }
+
+    public async Task SendUserJoinedAsync(string channelName, string username, string? excludeConnectionId = null)
+    {
+        foreach (var conn in _gateway.GetConnectionsInChannel(channelName))
+        {
+            if (conn.ConnectionId == excludeConnectionId) continue;
+            await conn.SendAsync($":{username}!{username}@echohub JOIN #{channelName}");
+        }
+    }
+
+    public async Task SendUserLeftAsync(string channelName, string username)
+    {
+        foreach (var conn in _gateway.GetConnectionsInChannel(channelName))
+        {
+            if (conn.Nickname == username) continue;
+            await conn.SendAsync($":{username}!{username}@echohub PART #{channelName}");
+        }
+    }
+
+    public async Task SendChannelUpdatedAsync(ChannelDto channel, string? channelName = null)
+    {
+        var target = channelName ?? channel.Name;
+        if (channel.Topic is null) return;
+
+        foreach (var conn in _gateway.GetConnectionsInChannel(target))
+        {
+            await conn.SendAsync($":{_gateway.Options.ServerName} TOPIC #{channel.Name} :{channel.Topic}");
+        }
+    }
+
+    public Task SendUserStatusChangedAsync(List<string> channelNames, UserPresenceDto presence)
+    {
+        // IRC has no active status broadcast. Clients discover away via WHOIS/WHO.
+        return Task.CompletedTask;
+    }
+
+    public async Task SendUserKickedAsync(string channelName, string username, string? reason)
+    {
+        var reasonText = reason is not null ? $" :{reason}" : "";
+        foreach (var conn in _gateway.GetConnectionsInChannel(channelName))
+        {
+            await conn.SendAsync($":{_gateway.Options.ServerName} KICK #{channelName} {username}{reasonText}");
+        }
+    }
+
+    public async Task SendUserBannedAsync(string username, string? reason)
+    {
+        var reasonText = reason ?? "You have been banned.";
+        foreach (var conn in _gateway.GetAllConnections())
+        {
+            if (conn.Nickname == username)
+                await conn.SendAsync($":{_gateway.Options.ServerName} NOTICE {username} :You have been banned: {reasonText}");
+        }
+    }
+
+    public async Task SendMessageDeletedAsync(string channelName, Guid messageId)
+    {
+        foreach (var conn in _gateway.GetConnectionsInChannel(channelName))
+        {
+            await conn.SendAsync($":{_gateway.Options.ServerName} NOTICE {conn.Nickname ?? "*"} :Message {messageId} was deleted in #{channelName}");
+        }
+    }
+
+    public async Task SendChannelNukedAsync(string channelName)
+    {
+        foreach (var conn in _gateway.GetConnectionsInChannel(channelName))
+        {
+            await conn.SendAsync($":{_gateway.Options.ServerName} NOTICE {conn.Nickname ?? "*"} :All messages in #{channelName} have been cleared");
+        }
+    }
+
+    public async Task SendErrorAsync(string connectionId, string message)
+    {
+        if (!connectionId.StartsWith("irc-")) return;
+
+        if (_gateway.Connections.TryGetValue(connectionId, out var conn))
+        {
+            await conn.SendAsync($":{_gateway.Options.ServerName} NOTICE {conn.Nickname ?? "*"} :{message}");
+        }
+    }
+
+    public async Task ForceDisconnectUserAsync(List<string> connectionIds, string reason)
+    {
+        foreach (var connId in connectionIds)
+        {
+            if (!connId.StartsWith("irc-")) continue;
+
+            if (_gateway.Connections.TryGetValue(connId, out var conn))
+            {
+                try
+                {
+                    await conn.SendAsync($"ERROR :Closing Link: {reason}");
+                    await conn.DisposeAsync();
+                }
+                catch { /* connection may already be closed */ }
+            }
+        }
+    }
+}

src/EchoHub.Server.Irc/IrcClientConnection.cs

@@ -0,0 +1,87 @@
+using System.Net.Sockets;
+using System.Text;
+
+namespace EchoHub.Server.Irc;
+
+/// <summary>
+/// Manages a single IRC client TCP connection.
+/// </summary>
+public sealed class IrcClientConnection : IAsyncDisposable
+{
+    private readonly TcpClient _tcpClient;
+    private readonly StreamReader _reader;
+    private readonly StreamWriter _writer;
+    private readonly SemaphoreSlim _writeLock = new(1, 1);
+
+    // Connection identity
+    public string ConnectionId { get; } = $"irc-{Guid.NewGuid()}";
+
+    // Registration state
+    public string? Nickname { get; set; }
+    public string? Username { get; set; }
+    public string? RealName { get; set; }
+    public string? Password { get; set; }
+    public Guid? UserId { get; set; }
+    public bool IsRegistered { get; set; }
+    public bool IsAuthenticated { get; set; }
+    public bool IsSasl { get; set; }
+    public bool CapNegotiating { get; set; }
+
+    // Channel state
+    public HashSet<string> JoinedChannels { get; } = new(StringComparer.OrdinalIgnoreCase);
+
+    // Away state
+    public string? AwayMessage { get; set; }
+
+    public string Hostmask => $"{Nickname}!{Username ?? Nickname}@echohub";
+
+    public IrcClientConnection(TcpClient tcpClient, Stream stream)
+    {
+        _tcpClient = tcpClient;
+        _reader = new StreamReader(stream, Encoding.UTF8);
+        _writer = new StreamWriter(stream, Encoding.UTF8) { AutoFlush = true, NewLine = "\r\n" };
+    }
+
+    public async Task<string?> ReadLineAsync(CancellationToken ct)
+    {
+        try
+        {
+            return await _reader.ReadLineAsync(ct);
+        }
+        catch
+        {
+            return null;
+        }
+    }
+
+    public async Task SendAsync(string line)
+    {
+        await _writeLock.WaitAsync();
+        try
+        {
+            await _writer.WriteLineAsync(line);
+        }
+        catch
+        {
+            // Connection lost — swallow
+        }
+        finally
+        {
+            _writeLock.Release();
+        }
+    }
+
+    public Task SendNumericAsync(string serverName, string numeric, string target, string text)
+        => SendAsync($":{serverName} {numeric} {target} {text}");
+
+    public Task SendNumericAsync(string serverName, string numeric, string text)
+        => SendNumericAsync(serverName, numeric, Nickname ?? "*", text);
+
+    public async ValueTask DisposeAsync()
+    {
+        try { _tcpClient.Close(); } catch { }
+        _reader.Dispose();
+        _writer.Dispose();
+        _writeLock.Dispose();
+    }
+}

src/EchoHub.Server.Irc/IrcCommandHandler.cs

@@ -0,0 +1,641 @@
+using System.Text;
+using EchoHub.Core.Constants;
+using EchoHub.Core.Contracts;
+using EchoHub.Core.DTOs;
+using EchoHub.Core.Models;
+using Microsoft.Extensions.Logging;
+
+namespace EchoHub.Server.Irc;
+
+public sealed class IrcCommandHandler
+{
+    private readonly IrcClientConnection _conn;
+    private readonly IrcOptions _options;
+    private readonly IChatService _chatService;
+    private readonly ILogger _logger;
+
+    private string ServerName => _options.ServerName;
+
+    public IrcCommandHandler(
+        IrcClientConnection conn,
+        IrcOptions options,
+        IChatService chatService,
+        ILogger logger)
+    {
+        _conn = conn;
+        _options = options;
+        _chatService = chatService;
+        _logger = logger;
+    }
+
+    public async Task RunAsync(CancellationToken ct)
+    {
+        while (!ct.IsCancellationRequested)
+        {
+            var line = await _conn.ReadLineAsync(ct);
+            if (line is null) break;
+
+            line = line.TrimEnd('\r', '\n');
+            if (string.IsNullOrWhiteSpace(line)) continue;
+
+            var msg = IrcMessage.Parse(line);
+
+            try
+            {
+                await HandleCommandAsync(msg);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "Error handling IRC command {Command} for {Nick}",
+                    msg.Command, _conn.Nickname ?? "unregistered");
+            }
+        }
+    }
+
+    private Task HandleCommandAsync(IrcMessage msg)
+    {
+        var command = msg.Command.ToUpperInvariant();
+
+        return command switch
+        {
+            // Pre-registration
+            "CAP" => HandleCapAsync(msg),
+            "AUTHENTICATE" => HandleAuthenticateAsync(msg),
+            "PASS" => HandlePassAsync(msg),
+            "NICK" => HandleNickAsync(msg),
+            "USER" => HandleUserAsync(msg),
+
+            // Post-registration
+            "PING" => HandlePingAsync(msg),
+            "PONG" => Task.CompletedTask,
+            "JOIN" => HandleJoinAsync(msg),
+            "PART" => HandlePartAsync(msg),
+            "PRIVMSG" => HandlePrivmsgAsync(msg),
+            "QUIT" => HandleQuitAsync(msg),
+            "NAMES" => HandleNamesAsync(msg),
+            "TOPIC" => HandleTopicAsync(msg),
+            "WHO" => HandleWhoAsync(msg),
+            "WHOIS" => HandleWhoisAsync(msg),
+            "AWAY" => HandleAwayAsync(msg),
+            "LIST" => HandleListAsync(msg),
+            "MODE" => HandleModeAsync(msg),
+            "MOTD" => SendMotdAsync(),
+            "USERHOST" or "LUSERS" => Task.CompletedTask,
+
+            _ => _conn.SendNumericAsync(ServerName, IrcNumericReply.ERR_UNKNOWNCOMMAND,
+                $"{command} :Unknown command"),
+        };
+    }
+
+    // ── Authentication ──────────────────────────────────────────────────────
+
+    private async Task HandleCapAsync(IrcMessage msg)
+    {
+        if (msg.Parameters.Count < 1) return;
+
+        switch (msg.Parameters[0].ToUpperInvariant())
+        {
+            case "LS":
+                await _conn.SendAsync($":{ServerName} CAP * LS :sasl");
+                _conn.CapNegotiating = true;
+                break;
+
+            case "REQ":
+                if (msg.Parameters.Count >= 2 &&
+                    msg.Parameters[1].Trim().Equals("sasl", StringComparison.OrdinalIgnoreCase))
+                {
+                    await _conn.SendAsync($":{ServerName} CAP * ACK :sasl");
+                    _conn.IsSasl = true;
+                }
+                else
+                {
+                    var requested = msg.Parameters.ElementAtOrDefault(1) ?? "";
+                    await _conn.SendAsync($":{ServerName} CAP * NAK :{requested}");
+                }
+                break;
+
+            case "END":
+                _conn.CapNegotiating = false;
+                if (_conn.Nickname is not null && _conn.Username is not null && !_conn.IsRegistered)
+                    await TryCompleteRegistrationAsync();
+                break;
+        }
+    }
+
+    private async Task HandleAuthenticateAsync(IrcMessage msg)
+    {
+        if (msg.Parameters.Count < 1) return;
+
+        if (msg.Parameters[0].Equals("PLAIN", StringComparison.OrdinalIgnoreCase))
+        {
+            await _conn.SendAsync("AUTHENTICATE +");
+            return;
+        }
+
+        try
+        {
+            var decoded = Convert.FromBase64String(msg.Parameters[0]);
+            var text = Encoding.UTF8.GetString(decoded);
+            var parts = text.Split('\0');
+
+            if (parts.Length < 3)
+            {
+                await _conn.SendNumericAsync(ServerName, IrcNumericReply.ERR_SASLFAIL,
+                    ":SASL authentication failed (malformed payload)");
+                return;
+            }
+
+            var username = (parts[1].Length > 0 ? parts[1] : parts[0]).ToLowerInvariant();
+            var password = parts[2];
+
+            var result = await _chatService.AuthenticateUserAsync(username, password);
+
+            if (result is null)
+            {
+                await _conn.SendNumericAsync(ServerName, IrcNumericReply.ERR_SASLFAIL,
+                    ":SASL authentication failed");
+                return;
+            }
+
+            _conn.Nickname = result.Value.Username;
+            _conn.UserId = result.Value.UserId;
+            _conn.IsAuthenticated = true;
+
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_LOGGEDIN,
+                $"{_conn.Hostmask} {username} :You are now logged in as {username}");
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_SASLSUCCESS,
+                ":SASL authentication successful");
+        }
+        catch
+        {
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.ERR_SASLFAIL,
+                ":SASL authentication failed");
+        }
+    }
+
+    private Task HandlePassAsync(IrcMessage msg)
+    {
+        if (_conn.IsRegistered)
+            return _conn.SendNumericAsync(ServerName, IrcNumericReply.ERR_ALREADYREGISTERED,
+                ":You may not reregister");
+
+        if (msg.Parameters.Count >= 1)
+            _conn.Password = msg.Parameters[0];
+
+        return Task.CompletedTask;
+    }
+
+    private async Task HandleNickAsync(IrcMessage msg)
+    {
+        if (msg.Parameters.Count < 1)
+        {
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.ERR_NONICKNAMEGIVEN,
+                ":No nickname given");
+            return;
+        }
+
+        var nick = msg.Parameters[0];
+
+        if (!ValidationConstants.UsernameRegex().IsMatch(nick))
+        {
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.ERR_ERRONEUSNICKNAME,
+                $"{nick} :Erroneous nickname (must be 3-50 chars: a-z, 0-9, _, -)");
+            return;
+        }
+
+        _conn.Nickname = nick.ToLowerInvariant();
+
+        if (!_conn.IsRegistered && _conn.Username is not null)
+            await TryCompleteRegistrationAsync();
+    }
+
+    private async Task HandleUserAsync(IrcMessage msg)
+    {
+        if (_conn.IsRegistered)
+        {
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.ERR_ALREADYREGISTERED,
+                ":You may not reregister");
+            return;
+        }
+
+        if (msg.Parameters.Count < 4)
+        {
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.ERR_NEEDMOREPARAMS,
+                "USER :Not enough parameters");
+            return;
+        }
+
+        _conn.Username = msg.Parameters[0];
+        _conn.RealName = msg.Parameters[3];
+
+        if (_conn.Nickname is not null)
+            await TryCompleteRegistrationAsync();
+    }
+
+    private async Task TryCompleteRegistrationAsync()
+    {
+        if (_conn.CapNegotiating || _conn.IsRegistered) return;
+
+        // SASL already authenticated
+        if (_conn.IsAuthenticated && _conn.UserId is not null)
+        {
+            _conn.IsRegistered = true;
+            await _chatService.UserConnectedAsync(_conn.ConnectionId, _conn.UserId.Value, _conn.Nickname!);
+            await SendWelcomeBurstAsync();
+            return;
+        }
+
+        // PASS-based authentication
+        if (string.IsNullOrEmpty(_conn.Password))
+        {
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.ERR_PASSWDMISMATCH,
+                ":Password required. Use PASS command or SASL PLAIN.");
+            await _conn.SendAsync("ERROR :Authentication failed - no password provided");
+            return;
+        }
+
+        var result = await _chatService.AuthenticateUserAsync(_conn.Nickname!, _conn.Password);
+
+        if (result is null)
+        {
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.ERR_PASSWDMISMATCH,
+                ":Password incorrect or account not found. Register via the EchoHub client first.");
+            await _conn.SendAsync("ERROR :Authentication failed");
+            return;
+        }
+
+        _conn.UserId = result.Value.UserId;
+        _conn.Nickname = result.Value.Username;
+        _conn.IsAuthenticated = true;
+        _conn.IsRegistered = true;
+
+        await _chatService.UserConnectedAsync(_conn.ConnectionId, result.Value.UserId, result.Value.Username);
+        await SendWelcomeBurstAsync();
+    }
+
+    // ── Welcome / MOTD ──────────────────────────────────────────────────────
+
+    private async Task SendWelcomeBurstAsync()
+    {
+        var nick = _conn.Nickname!;
+
+        await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_WELCOME,
+            $":Welcome to the EchoHub IRC Gateway, {nick}!");
+        await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_YOURHOST,
+            $":Your host is {ServerName}, running EchoHub IRC Gateway");
+        await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_CREATED,
+            $":This server was created {DateTimeOffset.UtcNow:yyyy-MM-dd}");
+        await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_MYINFO,
+            $"{ServerName} EchoHub-IRC o o");
+        await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_ISUPPORT,
+            "CHANTYPES=# NICKLEN=50 CHANNELLEN=100 :are supported by this server");
+
+        await SendMotdAsync();
+    }
+
+    private async Task SendMotdAsync()
+    {
+        if (string.IsNullOrWhiteSpace(_options.Motd))
+        {
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.ERR_NOMOTD,
+                ":MOTD File is missing");
+            return;
+        }
+
+        await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_MOTDSTART,
+            $":- {ServerName} Message of the day - ");
+
+        foreach (var line in _options.Motd.Split('\n'))
+        {
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_MOTD,
+                $":- {line.TrimEnd('\r')}");
+        }
+
+        await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_ENDOFMOTD,
+            ":End of MOTD command");
+    }
+
+    // ── Channel Operations ──────────────────────────────────────────────────
+
+    private async Task HandleJoinAsync(IrcMessage msg)
+    {
+        if (!RequireRegistered()) return;
+
+        if (msg.Parameters.Count < 1)
+        {
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.ERR_NEEDMOREPARAMS,
+                "JOIN :Not enough parameters");
+            return;
+        }
+
+        var channels = msg.Parameters[0].Split(',', StringSplitOptions.RemoveEmptyEntries);
+
+        foreach (var rawChannel in channels)
+        {
+            var channelName = IrcToEchoHubChannel(rawChannel);
+            if (channelName is null)
+            {
+                await _conn.SendNumericAsync(ServerName, IrcNumericReply.ERR_NOSUCHCHANNEL,
+                    $"{rawChannel} :Invalid channel name");
+                continue;
+            }
+
+            var (history, error) = await _chatService.JoinChannelAsync(
+                _conn.ConnectionId, _conn.UserId!.Value, _conn.Nickname!, channelName);
+
+            if (error is not null)
+            {
+                await _conn.SendNumericAsync(ServerName, IrcNumericReply.ERR_NOSUCHCHANNEL,
+                    $"#{channelName} :{error}");
+                continue;
+            }
+
+            _conn.JoinedChannels.Add(channelName);
+
+            // Confirm JOIN to the client
+            await _conn.SendAsync($":{_conn.Hostmask} JOIN #{channelName}");
+
+            // Send topic
+            await SendChannelTopicAsync(channelName);
+
+            // Send NAMES list
+            await SendNamesReplyAsync(channelName);
+
+            // Replay history
+            foreach (var m in history)
+            {
+                var lines = IrcMessageFormatter.FormatMessage(m);
+                foreach (var line in lines)
+                    await _conn.SendAsync(line);
+            }
+        }
+    }
+
+    private async Task HandlePartAsync(IrcMessage msg)
+    {
+        if (!RequireRegistered()) return;
+        if (msg.Parameters.Count < 1) return;
+
+        var channels = msg.Parameters[0].Split(',', StringSplitOptions.RemoveEmptyEntries);
+        var partMessage = msg.Parameters.Count > 1 ? msg.Parameters[1] : null;
+
+        foreach (var rawChannel in channels)
+        {
+            var channelName = IrcToEchoHubChannel(rawChannel);
+            if (channelName is null) continue;
+
+            await _chatService.LeaveChannelAsync(_conn.ConnectionId, _conn.Nickname!, channelName);
+            _conn.JoinedChannels.Remove(channelName);
+
+            await _conn.SendAsync($":{_conn.Hostmask} PART #{channelName}" +
+                (partMessage is not null ? $" :{partMessage}" : ""));
+        }
+    }
+
+    private async Task HandlePrivmsgAsync(IrcMessage msg)
+    {
+        if (!RequireRegistered()) return;
+
+        if (msg.Parameters.Count < 2)
+        {
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.ERR_NEEDMOREPARAMS,
+                "PRIVMSG :Not enough parameters");
+            return;
+        }
+
+        var target = msg.Parameters[0];
+        var content = msg.Parameters[1];
+
+        if (!target.StartsWith('#'))
+        {
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.ERR_NOSUCHNICK,
+                $"{target} :Private messages are not supported. Use channels.");
+            return;
+        }
+
+        var channelName = IrcToEchoHubChannel(target);
+        if (channelName is null) return;
+
+        var error = await _chatService.SendMessageAsync(
+            _conn.UserId!.Value, _conn.Nickname!, channelName, content);
+
+        if (error is not null)
+        {
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.ERR_CANNOTSENDTOCHAN,
+                $"#{channelName} :{error}");
+        }
+    }
+
+    private async Task HandleQuitAsync(IrcMessage msg)
+    {
+        var quitMessage = msg.Parameters.Count > 0 ? msg.Parameters[0] : "Client quit";
+        await _conn.SendAsync($"ERROR :Closing Link: {_conn.Nickname} ({quitMessage})");
+    }
+
+    // ── Query Commands ──────────────────────────────────────────────────────
+
+    private async Task HandleNamesAsync(IrcMessage msg)
+    {
+        if (!RequireRegistered()) return;
+        if (msg.Parameters.Count < 1) return;
+
+        var channelName = IrcToEchoHubChannel(msg.Parameters[0]);
+        if (channelName is null) return;
+
+        await SendNamesReplyAsync(channelName);
+    }
+
+    private async Task SendNamesReplyAsync(string channelName)
+    {
+        var users = await _chatService.GetOnlineUsersAsync(channelName);
+        var nicks = string.Join(" ", users.Select(u => u.Username));
+
+        await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_NAMREPLY,
+            $"= #{channelName} :{nicks}");
+        await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_ENDOFNAMES,
+            $"#{channelName} :End of /NAMES list");
+    }
+
+    private async Task HandleTopicAsync(IrcMessage msg)
+    {
+        if (!RequireRegistered()) return;
+        if (msg.Parameters.Count < 1) return;
+
+        var channelName = IrcToEchoHubChannel(msg.Parameters[0]);
+        if (channelName is null) return;
+
+        if (msg.Parameters.Count == 1)
+        {
+            await SendChannelTopicAsync(channelName);
+        }
+        else
+        {
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.ERR_CHANOPRIVSNEEDED,
+                $"#{channelName} :Topic can only be changed by the channel creator via the API");
+        }
+    }
+
+    private async Task SendChannelTopicAsync(string channelName)
+    {
+        var (topic, exists) = await _chatService.GetChannelTopicAsync(channelName);
+
+        if (!exists) return;
+
+        if (topic is not null)
+        {
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_TOPIC,
+                $"#{channelName} :{topic}");
+        }
+        else
+        {
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_NOTOPIC,
+                $"#{channelName} :No topic is set");
+        }
+    }
+
+    private async Task HandleWhoAsync(IrcMessage msg)
+    {
+        if (!RequireRegistered()) return;
+        if (msg.Parameters.Count < 1) return;
+
+        var channelName = IrcToEchoHubChannel(msg.Parameters[0]);
+        if (channelName is null) return;
+
+        var users = await _chatService.GetOnlineUsersAsync(channelName);
+
+        foreach (var u in users)
+        {
+            var awayFlag = u.Status == UserStatus.Away ? "G" : "H";
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_WHOREPLY,
+                $"#{channelName} {u.Username} echohub {ServerName} {u.Username} {awayFlag} :0 {u.DisplayName ?? u.Username}");
+        }
+
+        await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_ENDOFWHO,
+            $"#{channelName} :End of WHO list");
+    }
+
+    private async Task HandleWhoisAsync(IrcMessage msg)
+    {
+        if (!RequireRegistered()) return;
+        if (msg.Parameters.Count < 1) return;
+
+        var nick = msg.Parameters[^1].ToLowerInvariant();
+        var profile = await _chatService.GetUserProfileAsync(nick);
+
+        if (profile is null)
+        {
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.ERR_NOSUCHNICK,
+                $"{nick} :No such nick/channel");
+            return;
+        }
+
+        await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_WHOISUSER,
+            $"{nick} {nick} echohub * :{profile.DisplayName ?? nick}");
+        await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_WHOISSERVER,
+            $"{nick} {ServerName} :EchoHub IRC Gateway");
+
+        var channels = await _chatService.GetChannelsForUserAsync(nick);
+        if (channels.Count > 0)
+        {
+            var chanList = string.Join(" ", channels.Select(c => $"#{c}"));
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_WHOISCHANNELS,
+                $"{nick} :{chanList}");
+        }
+
+        if (profile.Status == UserStatus.Away && profile.StatusMessage is not null)
+        {
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_AWAY,
+                $"{nick} :{profile.StatusMessage}");
+        }
+
+        var idleSeconds = (long)(DateTimeOffset.UtcNow - profile.LastSeenAt).TotalSeconds;
+        var signonUnix = profile.CreatedAt.ToUnixTimeSeconds();
+        await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_WHOISIDLE,
+            $"{nick} {idleSeconds} {signonUnix} :seconds idle, signon time");
+
+        await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_ENDOFWHOIS,
+            $"{nick} :End of WHOIS list");
+    }
+
+    private async Task HandleAwayAsync(IrcMessage msg)
+    {
+        if (!RequireRegistered()) return;
+
+        if (msg.Parameters.Count > 0 && !string.IsNullOrWhiteSpace(msg.Parameters[0]))
+        {
+            _conn.AwayMessage = msg.Parameters[0];
+            await _chatService.UpdateStatusAsync(
+                _conn.UserId!.Value, _conn.Nickname!, UserStatus.Away, _conn.AwayMessage);
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_NOWAWAY,
+                ":You have been marked as being away");
+        }
+        else
+        {
+            _conn.AwayMessage = null;
+            await _chatService.UpdateStatusAsync(
+                _conn.UserId!.Value, _conn.Nickname!, UserStatus.Online, null);
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_UNAWAY,
+                ":You are no longer marked as being away");
+        }
+    }
+
+    private async Task HandleListAsync(IrcMessage msg)
+    {
+        if (!RequireRegistered()) return;
+
+        var channels = await _chatService.GetChannelListAsync();
+
+        foreach (var ch in channels)
+        {
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_LIST,
+                $"#{ch.Name} {ch.OnlineCount} :{ch.Topic ?? ""}");
+        }
+
+        await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_LISTEND,
+            ":End of LIST");
+    }
+
+    private async Task HandleModeAsync(IrcMessage msg)
+    {
+        if (!RequireRegistered()) return;
+        if (msg.Parameters.Count < 1) return;
+
+        var target = msg.Parameters[0];
+
+        if (target.StartsWith('#'))
+        {
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_CHANNELMODEIS,
+                $"{target} +");
+        }
+        else
+        {
+            await _conn.SendNumericAsync(ServerName, IrcNumericReply.RPL_UMODEIS, "+");
+        }
+    }
+
+    private async Task HandlePingAsync(IrcMessage msg)
+    {
+        var token = msg.Parameters.Count > 0 ? msg.Parameters[0] : ServerName;
+        await _conn.SendAsync($":{ServerName} PONG {ServerName} :{token}");
+    }
+
+    // ── Helpers ──────────────────────────────────────────────────────────────
+
+    private bool RequireRegistered()
+    {
+        if (_conn.IsRegistered) return true;
+
+        _ = _conn.SendNumericAsync(ServerName, IrcNumericReply.ERR_NOTREGISTERED,
+            ":You have not registered");
+        return false;
+    }
+
+    private static string? IrcToEchoHubChannel(string ircChannel)
+    {
+        if (!ircChannel.StartsWith('#') || ircChannel.Length < 2)
+            return null;
+
+        var name = ircChannel[1..].ToLowerInvariant().Trim();
+        return ValidationConstants.ChannelNameRegex().IsMatch(name) ? name : null;
+    }
+}

src/EchoHub.Server.Irc/IrcGatewayService.cs

@@ -0,0 +1,175 @@
+using System.Collections.Concurrent;
+using System.Net;
+using System.Net.Security;
+using System.Net.Sockets;
+using System.Security.Cryptography.X509Certificates;
+using EchoHub.Core.Contracts;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+
+namespace EchoHub.Server.Irc;
+
+public sealed class IrcGatewayService : BackgroundService
+{
+    private readonly IrcOptions _options;
+    private readonly IServiceProvider _services;
+    private readonly ILogger<IrcGatewayService> _logger;
+    private readonly ConcurrentDictionary<string, IrcClientConnection> _connections = new();
+
+    public IrcOptions Options => _options;
+    public IReadOnlyDictionary<string, IrcClientConnection> Connections => _connections;
+
+    public IrcGatewayService(
+        IOptions<IrcOptions> options,
+        IServiceProvider services,
+        ILogger<IrcGatewayService> logger)
+    {
+        _options = options.Value;
+        _services = services;
+        _logger = logger;
+    }
+
+    public IEnumerable<IrcClientConnection> GetConnectionsInChannel(string channelName)
+    {
+        return _connections.Values
+            .Where(c => c.IsAuthenticated && c.JoinedChannels.Contains(channelName));
+    }
+
+    public IEnumerable<IrcClientConnection> GetAllConnections()
+    {
+        return _connections.Values.Where(c => c.IsAuthenticated);
+    }
+
+    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
+    {
+        await Task.Yield();
+
+        if (!_options.Enabled)
+        {
+            _logger.LogInformation("IRC gateway is disabled");
+            return;
+        }
+
+        var listeners = new List<Task>();
+
+        listeners.Add(RunListenerAsync(_options.Port, useTls: false, stoppingToken));
+
+        if (_options.TlsEnabled && !string.IsNullOrWhiteSpace(_options.TlsCertPath))
+        {
+            listeners.Add(RunListenerAsync(_options.TlsPort, useTls: true, stoppingToken));
+        }
+
+        await Task.WhenAll(listeners);
+    }
+
+    private async Task RunListenerAsync(int port, bool useTls, CancellationToken ct)
+    {
+        var listener = new TcpListener(IPAddress.Any, port);
+        listener.Start();
+        _logger.LogInformation("IRC gateway listening on port {Port} ({Mode})",
+            port, useTls ? "TLS" : "plain");
+
+        ct.Register(() => listener.Stop());
+
+        try
+        {
+            while (!ct.IsCancellationRequested)
+            {
+                var tcpClient = await listener.AcceptTcpClientAsync(ct);
+                _ = HandleClientAsync(tcpClient, useTls, ct);
+            }
+        }
+        catch (OperationCanceledException) { }
+        catch (ObjectDisposedException) { }
+        finally
+        {
+            listener.Stop();
+        }
+    }
+
+    private async Task HandleClientAsync(TcpClient tcpClient, bool useTls, CancellationToken ct)
+    {
+        Stream stream = tcpClient.GetStream();
+
+        if (useTls)
+        {
+            try
+            {
+                var cert = X509CertificateLoader.LoadPkcs12FromFile(_options.TlsCertPath!, _options.TlsCertPassword);
+                var sslStream = new SslStream(stream, leaveInnerStreamOpen: false);
+                await sslStream.AuthenticateAsServerAsync(cert);
+                stream = sslStream;
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "TLS handshake failed");
+                tcpClient.Close();
+                return;
+            }
+        }
+
+        var connection = new IrcClientConnection(tcpClient, stream);
+        _connections[connection.ConnectionId] = connection;
+
+        _logger.LogInformation("IRC client connected: {Id}", connection.ConnectionId);
+
+        IChatService? chatService = null;
+
+        try
+        {
+            chatService = _services.GetRequiredService<IChatService>();
+            var handler = new IrcCommandHandler(
+                connection, _options, chatService, _logger);
+
+            await handler.RunAsync(ct);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "IRC client {Id} error", connection.ConnectionId);
+        }
+        finally
+        {
+            if (connection.IsAuthenticated)
+            {
+                foreach (var ch in connection.JoinedChannels.ToList())
+                {
+                    if (chatService is null) break;
+                    await chatService.LeaveChannelAsync(
+                        connection.ConnectionId, connection.Nickname!, ch);
+                }
+                if (chatService is not null)
+                    await chatService.UserDisconnectedAsync(connection.ConnectionId);
+            }
+
+            _connections.TryRemove(connection.ConnectionId, out _);
+            await connection.DisposeAsync();
+            _logger.LogInformation("IRC client {Id} ({Nick}) disconnected",
+                connection.ConnectionId, connection.Nickname ?? "unregistered");
+        }
+    }
+
+    public override async Task StopAsync(CancellationToken cancellationToken)
+    {
+        // Cancel ExecuteAsync first so listeners stop accepting
+        await base.StopAsync(cancellationToken);
+
+        // Force-close any remaining client connections
+        foreach (var (_, conn) in _connections)
+        {
+            try
+            {
+                await conn.SendAsync("ERROR :Server shutting down")
+                    .WaitAsync(TimeSpan.FromSeconds(2));
+            }
+            catch { }
+            finally
+            {
+                try { await conn.DisposeAsync(); }
+                catch { }
+            }
+        }
+        _connections.Clear();
+    }
+}

src/EchoHub.Server.Irc/IrcMessage.cs

@@ -0,0 +1,69 @@
+namespace EchoHub.Server.Irc;
+
+/// <summary>
+/// Parsed representation of an IRC protocol line.
+/// Format: [:prefix] COMMAND [params...] [:trailing]
+/// </summary>
+public sealed class IrcMessage
+{
+    public string? Prefix { get; init; }
+    public string Command { get; init; } = "";
+    public List<string> Parameters { get; init; } = [];
+
+    public string? Trailing => Parameters.Count > 0 ? Parameters[^1] : null;
+
+    /// <summary>
+    /// Parse a raw IRC line: [:prefix SPACE] command [SPACE params] CRLF
+    /// </summary>
+    public static IrcMessage Parse(string line)
+    {
+        var span = line.AsSpan().TrimEnd("\r\n");
+        string? prefix = null;
+        var pos = 0;
+
+        // Parse optional prefix
+        if (span.Length > 0 && span[0] == ':')
+        {
+            var spaceIdx = span.IndexOf(' ');
+            if (spaceIdx == -1)
+                return new IrcMessage { Prefix = span[1..].ToString() };
+
+            prefix = span[1..spaceIdx].ToString();
+            pos = spaceIdx + 1;
+        }
+
+        // Skip whitespace
+        while (pos < span.Length && span[pos] == ' ') pos++;
+
+        // Parse command
+        var cmdStart = pos;
+        while (pos < span.Length && span[pos] != ' ') pos++;
+        var command = span[cmdStart..pos].ToString();
+
+        // Parse parameters
+        var parameters = new List<string>();
+        while (pos < span.Length)
+        {
+            while (pos < span.Length && span[pos] == ' ') pos++;
+            if (pos >= span.Length) break;
+
+            if (span[pos] == ':')
+            {
+                // Trailing parameter (rest of line)
+                parameters.Add(span[(pos + 1)..].ToString());
+                break;
+            }
+
+            var paramStart = pos;
+            while (pos < span.Length && span[pos] != ' ') pos++;
+            parameters.Add(span[paramStart..pos].ToString());
+        }
+
+        return new IrcMessage
+        {
+            Prefix = prefix,
+            Command = command,
+            Parameters = parameters,
+        };
+    }
+}

src/EchoHub.Server.Irc/IrcMessageFormatter.cs

@@ -0,0 +1,144 @@
+using System.Text;
+using System.Text.RegularExpressions;
+using EchoHub.Core.DTOs;
+using EchoHub.Core.Models;
+
+namespace EchoHub.Server.Irc;
+
+public static partial class IrcMessageFormatter
+{
+    private const int MaxIrcLineContentBytes = 400;
+
+    /// <summary>
+    /// Format a MessageDto as one or more IRC PRIVMSG lines.
+    /// </summary>
+    public static List<string> FormatMessage(MessageDto message)
+    {
+        var lines = new List<string>();
+        var ircChannel = $"#{message.ChannelName}";
+        var prefix = $":{message.SenderUsername}!{message.SenderUsername}@echohub";
+
+        switch (message.Type)
+        {
+            case MessageType.Text:
+                foreach (var chunk in SplitMessage(message.Content, MaxIrcLineContentBytes))
+                    lines.Add($"{prefix} PRIVMSG {ircChannel} :{chunk}");
+
+                // Append embed previews if present
+                if (message.Embeds is { Count: > 0 })
+                {
+                    foreach (var embed in message.Embeds)
+                        lines.AddRange(FormatEmbed(prefix, ircChannel, embed));
+                }
+                break;
+
+            case MessageType.Image:
+                lines.Add($"{prefix} PRIVMSG {ircChannel} :[Image: {message.AttachmentFileName}]");
+                if (message.AttachmentUrl is not null)
+                    lines.Add($"{prefix} PRIVMSG {ircChannel} :Download: {message.AttachmentUrl}");
+
+                foreach (var line in message.Content.Split('\n'))
+                {
+                    var trimmed = line.TrimEnd('\r');
+                    if (trimmed.Length > 0)
+                        lines.Add($"{prefix} PRIVMSG {ircChannel} :{ColorTagsToAnsi(trimmed)}");
+                }
+                break;
+
+            case MessageType.File:
+                lines.Add($"{prefix} PRIVMSG {ircChannel} :[File: {message.AttachmentFileName}] {message.AttachmentUrl}");
+                break;
+        }
+
+        return lines;
+    }
+
+    /// <summary>
+    /// Format a link embed as IRC PRIVMSG lines (text-only, no ASCII thumbnail).
+    /// </summary>
+    private static List<string> FormatEmbed(string prefix, string ircChannel, EmbedDto embed)
+    {
+        var lines = new List<string>();
+
+        var header = new List<string>();
+        if (!string.IsNullOrWhiteSpace(embed.SiteName))
+            header.Add(embed.SiteName);
+        if (!string.IsNullOrWhiteSpace(embed.Title))
+            header.Add(embed.Title);
+
+        if (header.Count > 0)
+            lines.Add($"{prefix} PRIVMSG {ircChannel} :\u2502 {string.Join(" \u2014 ", header)}");
+
+        if (!string.IsNullOrWhiteSpace(embed.Description))
+        {
+            var desc = embed.Description.Length > 200
+                ? embed.Description[..197] + "..."
+                : embed.Description;
+            lines.Add($"{prefix} PRIVMSG {ircChannel} :\u2502 {desc}");
+        }
+
+        return lines;
+    }
+
+    /// <summary>
+    /// Convert printable color tags ({F:RRGGBB}, {B:RRGGBB}, {X}) to ANSI escape codes for IRC clients.
+    /// Also passes through content that already uses ANSI codes unchanged.
+    /// </summary>
+    public static string ColorTagsToAnsi(string text)
+    {
+        if (!text.Contains('{'))
+            return text;
+
+        return ColorTagRegex().Replace(text, match =>
+        {
+            if (match.Groups[1].Success) // {X} reset
+                return "\x1b[0m";
+            if (match.Groups[2].Success) // {F:RRGGBB} or {B:RRGGBB}
+            {
+                var hex = match.Groups[3].Value;
+                var r = Convert.ToInt32(hex[..2], 16);
+                var g = Convert.ToInt32(hex[2..4], 16);
+                var b = Convert.ToInt32(hex[4..6], 16);
+                var code = match.Groups[2].Value == "F" ? "38" : "48";
+                return $"\x1b[{code};2;{r};{g};{b}m";
+            }
+            return match.Value;
+        });
+    }
+
+    [GeneratedRegex(@"\{(?:(X)|(?:(F|B):([0-9A-Fa-f]{6})))\}")]
+    private static partial Regex ColorTagRegex();
+
+    /// <summary>
+    /// Split a message into chunks of approximately maxBytes (UTF-8), at word boundaries.
+    /// </summary>
+    public static List<string> SplitMessage(string content, int maxBytes)
+    {
+        if (Encoding.UTF8.GetByteCount(content) <= maxBytes)
+            return [content];
+
+        var chunks = new List<string>();
+        var current = new StringBuilder();
+        var currentBytes = 0;
+
+        foreach (var word in content.Split(' '))
+        {
+            var wordBytes = Encoding.UTF8.GetByteCount(word) + 1; // +1 for space
+
+            if (currentBytes + wordBytes > maxBytes && current.Length > 0)
+            {
+                chunks.Add(current.ToString().TrimEnd());
+                current.Clear();
+                currentBytes = 0;
+            }
+
+            current.Append(word).Append(' ');
+            currentBytes += wordBytes;
+        }
+
+        if (current.Length > 0)
+            chunks.Add(current.ToString().TrimEnd());
+
+        return chunks;
+    }
+}

src/EchoHub.Server.Irc/IrcNumericReply.cs

@@ -0,0 +1,65 @@
+namespace EchoHub.Server.Irc;
+
+public static class IrcNumericReply
+{
+    // Connection registration
+    public const string RPL_WELCOME = "001";
+    public const string RPL_YOURHOST = "002";
+    public const string RPL_CREATED = "003";
+    public const string RPL_MYINFO = "004";
+    public const string RPL_ISUPPORT = "005";
+
+    // MOTD
+    public const string RPL_MOTDSTART = "375";
+    public const string RPL_MOTD = "372";
+    public const string RPL_ENDOFMOTD = "376";
+    public const string ERR_NOMOTD = "422";
+
+    // Channel operations
+    public const string RPL_NOTOPIC = "331";
+    public const string RPL_TOPIC = "332";
+    public const string RPL_NAMREPLY = "353";
+    public const string RPL_ENDOFNAMES = "366";
+
+    // LIST
+    public const string RPL_LIST = "322";
+    public const string RPL_LISTEND = "323";
+
+    // WHO / WHOIS
+    public const string RPL_WHOREPLY = "352";
+    public const string RPL_ENDOFWHO = "315";
+    public const string RPL_WHOISUSER = "311";
+    public const string RPL_WHOISSERVER = "312";
+    public const string RPL_WHOISIDLE = "317";
+    public const string RPL_ENDOFWHOIS = "318";
+    public const string RPL_WHOISCHANNELS = "319";
+
+    // AWAY
+    public const string RPL_UNAWAY = "305";
+    public const string RPL_NOWAWAY = "306";
+    public const string RPL_AWAY = "301";
+
+    // MODE
+    public const string RPL_CHANNELMODEIS = "324";
+    public const string RPL_UMODEIS = "221";
+
+    // Errors
+    public const string ERR_NOSUCHNICK = "401";
+    public const string ERR_NOSUCHCHANNEL = "403";
+    public const string ERR_CANNOTSENDTOCHAN = "404";
+    public const string ERR_UNKNOWNCOMMAND = "421";
+    public const string ERR_NONICKNAMEGIVEN = "431";
+    public const string ERR_ERRONEUSNICKNAME = "432";
+    public const string ERR_NICKNAMEINUSE = "433";
+    public const string ERR_NOTONCHANNEL = "442";
+    public const string ERR_NOTREGISTERED = "451";
+    public const string ERR_NEEDMOREPARAMS = "461";
+    public const string ERR_ALREADYREGISTERED = "462";
+    public const string ERR_PASSWDMISMATCH = "464";
+    public const string ERR_CHANOPRIVSNEEDED = "482";
+
+    // SASL
+    public const string RPL_LOGGEDIN = "900";
+    public const string RPL_SASLSUCCESS = "903";
+    public const string ERR_SASLFAIL = "904";
+}

src/EchoHub.Server.Irc/IrcOptions.cs

@@ -0,0 +1,15 @@
+namespace EchoHub.Server.Irc;
+
+public sealed class IrcOptions
+{
+    public const string SectionName = "Irc";
+
+    public bool Enabled { get; set; }
+    public int Port { get; set; } = 6667;
+    public bool TlsEnabled { get; set; }
+    public int TlsPort { get; set; } = 6697;
+    public string? TlsCertPath { get; set; }
+    public string? TlsCertPassword { get; set; }
+    public string ServerName { get; set; } = "echohub";
+    public string? Motd { get; set; }
+}

src/EchoHub.Server.Irc/IrcServiceExtensions.cs

@@ -0,0 +1,25 @@
+using EchoHub.Core.Contracts;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace EchoHub.Server.Irc;
+
+public static class IrcServiceExtensions
+{
+    public static WebApplicationBuilder AddIrcGateway(this WebApplicationBuilder builder)
+    {
+        builder.Services.Configure<IrcOptions>(
+            builder.Configuration.GetSection(IrcOptions.SectionName));
+
+        if (builder.Configuration.GetValue<bool>("Irc:Enabled"))
+        {
+            builder.Services.AddSingleton<IrcGatewayService>();
+            builder.Services.AddSingleton<IChatBroadcaster, IrcBroadcaster>();
+            builder.Services.AddHostedService(sp =>
+                sp.GetRequiredService<IrcGatewayService>());
+        }
+
+        return builder;
+    }
+}

src/EchoHub.Server/Auth/JwtTokenService.cs

@@ -7,18 +7,25 @@ using Microsoft.IdentityModel.Tokens;
 
 namespace EchoHub.Server.Auth;
 
-public class JwtTokenService(IConfiguration configuration)
+public class JwtTokenService
 {
-    private readonly string _secret = configuration["Jwt:Secret"]
-        ?? throw new InvalidOperationException("Jwt:Secret is not configured.");
-    private readonly string _issuer = configuration["Jwt:Issuer"]
-        ?? throw new InvalidOperationException("Jwt:Issuer is not configured.");
-    private readonly string _audience = configuration["Jwt:Audience"]
-        ?? throw new InvalidOperationException("Jwt:Audience is not configured.");
+    private readonly string _secret;
+    private readonly string _issuer;
+    private readonly string _audience;
 
     private static readonly TimeSpan AccessTokenLifetime = TimeSpan.FromMinutes(15);
     public static readonly TimeSpan RefreshTokenLifetime = TimeSpan.FromDays(30);
 
+    public JwtTokenService(IConfiguration configuration)
+    {
+        _secret = configuration["Jwt:Secret"]
+            ?? throw new InvalidOperationException("Jwt:Secret is not configured.");
+        _issuer = configuration["Jwt:Issuer"]
+            ?? throw new InvalidOperationException("Jwt:Issuer is not configured.");
+        _audience = configuration["Jwt:Audience"]
+            ?? throw new InvalidOperationException("Jwt:Audience is not configured.");
+    }
+
     public (string Token, DateTimeOffset ExpiresAt) GenerateAccessToken(User user)
     {
         var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_secret));
@@ -30,6 +37,7 @@ public class JwtTokenService(IConfiguration configuration)
             new(JwtRegisteredClaimNames.Sub, user.Id.ToString()),
             new("username", user.Username),
             new("display_name", user.DisplayName ?? user.Username),
+            new("role", user.Role.ToString()),
             new(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
         ];
 

src/EchoHub.Server/Controllers/AuthController.cs

@@ -12,8 +12,17 @@ namespace EchoHub.Server.Controllers;
 [ApiController]
 [Route("api/auth")]
 [EnableRateLimiting("auth")]
-public class AuthController(EchoHubDbContext db, JwtTokenService jwt) : ControllerBase
+public class AuthController : ControllerBase
 {
+    private readonly EchoHubDbContext _db;
+    private readonly JwtTokenService _jwt;
+
+    public AuthController(EchoHubDbContext db, JwtTokenService jwt)
+    {
+        _db = db;
+        _jwt = jwt;
+    }
+
     [HttpPost("register")]
     public async Task<IActionResult> Register([FromBody] RegisterRequest request)
     {
@@ -31,31 +40,35 @@ public class AuthController(EchoHubDbContext db, JwtTokenService jwt) : Controll
 
         var normalizedUsername = request.Username.ToLowerInvariant().Trim();
 
-        if (await db.Users.AnyAsync(u => u.Username == normalizedUsername))
+        if (await _db.Users.AnyAsync(u => u.Username == normalizedUsername))
             return Conflict(new ErrorResponse("Username is already taken."));
 
+        // First registered user on the server becomes the Owner
+        var isFirstUser = !await _db.Users.AnyAsync();
+
         var user = new User
         {
             Id = Guid.NewGuid(),
             Username = normalizedUsername,
             PasswordHash = BCrypt.Net.BCrypt.HashPassword(request.Password),
             DisplayName = request.DisplayName?.Trim(),
+            Role = isFirstUser ? ServerRole.Owner : ServerRole.Member,
         };
 
-        db.Users.Add(user);
-        await db.SaveChangesAsync();
+        _db.Users.Add(user);
+        await _db.SaveChangesAsync();
 
-        var (accessToken, expiresAt) = jwt.GenerateAccessToken(user);
+        var (accessToken, expiresAt) = _jwt.GenerateAccessToken(user);
         var refreshToken = JwtTokenService.GenerateRefreshToken();
 
-        db.RefreshTokens.Add(new RefreshToken
+        _db.RefreshTokens.Add(new RefreshToken
         {
             Id = Guid.NewGuid(),
             TokenHash = JwtTokenService.HashToken(refreshToken),
             UserId = user.Id,
             ExpiresAt = DateTimeOffset.UtcNow.Add(JwtTokenService.RefreshTokenLifetime),
         });
-        await db.SaveChangesAsync();
+        await _db.SaveChangesAsync();
 
         return Ok(new LoginResponse(accessToken, refreshToken, expiresAt, user.Username, user.DisplayName, user.NicknameColor));
     }
@@ -67,25 +80,28 @@ public class AuthController(EchoHubDbContext db, JwtTokenService jwt) : Controll
             return BadRequest(new ErrorResponse("Username and password are required."));
 
         var normalizedUsername = request.Username.ToLowerInvariant().Trim();
-        var user = await db.Users.FirstOrDefaultAsync(u => u.Username == normalizedUsername);
+        var user = await _db.Users.FirstOrDefaultAsync(u => u.Username == normalizedUsername);
 
         if (user is null || !BCrypt.Net.BCrypt.Verify(request.Password, user.PasswordHash))
             return Unauthorized(new ErrorResponse("Invalid username or password."));
 
-        user.LastSeenAt = DateTimeOffset.UtcNow;
-        await db.SaveChangesAsync();
+        if (user.IsBanned)
+            return Unauthorized(new ErrorResponse("Your account has been banned."));
 
-        var (accessToken, expiresAt) = jwt.GenerateAccessToken(user);
+        user.LastSeenAt = DateTimeOffset.UtcNow;
+        await _db.SaveChangesAsync();
+
+        var (accessToken, expiresAt) = _jwt.GenerateAccessToken(user);
         var refreshToken = JwtTokenService.GenerateRefreshToken();
 
-        db.RefreshTokens.Add(new RefreshToken
+        _db.RefreshTokens.Add(new RefreshToken
         {
             Id = Guid.NewGuid(),
             TokenHash = JwtTokenService.HashToken(refreshToken),
             UserId = user.Id,
             ExpiresAt = DateTimeOffset.UtcNow.Add(JwtTokenService.RefreshTokenLifetime),
         });
-        await db.SaveChangesAsync();
+        await _db.SaveChangesAsync();
 
         return Ok(new LoginResponse(accessToken, refreshToken, expiresAt, user.Username, user.DisplayName, user.NicknameColor));
     }
@@ -97,7 +113,7 @@ public class AuthController(EchoHubDbContext db, JwtTokenService jwt) : Controll
             return BadRequest(new ErrorResponse("Refresh token is required."));
 
         var tokenHash = JwtTokenService.HashToken(request.RefreshToken);
-        var storedToken = await db.RefreshTokens
+        var storedToken = await _db.RefreshTokens
             .Include(r => r.User)
             .FirstOrDefaultAsync(r => r.TokenHash == tokenHash);
 
@@ -111,17 +127,17 @@ public class AuthController(EchoHubDbContext db, JwtTokenService jwt) : Controll
         user.LastSeenAt = DateTimeOffset.UtcNow;
 
         // Issue new token pair
-        var (accessToken, expiresAt) = jwt.GenerateAccessToken(user);
+        var (accessToken, expiresAt) = _jwt.GenerateAccessToken(user);
         var newRefreshToken = JwtTokenService.GenerateRefreshToken();
 
-        db.RefreshTokens.Add(new RefreshToken
+        _db.RefreshTokens.Add(new RefreshToken
         {
             Id = Guid.NewGuid(),
             TokenHash = JwtTokenService.HashToken(newRefreshToken),
             UserId = user.Id,
             ExpiresAt = DateTimeOffset.UtcNow.Add(JwtTokenService.RefreshTokenLifetime),
         });
-        await db.SaveChangesAsync();
+        await _db.SaveChangesAsync();
 
         return Ok(new LoginResponse(accessToken, newRefreshToken, expiresAt, user.Username, user.DisplayName, user.NicknameColor));
     }
@@ -133,12 +149,12 @@ public class AuthController(EchoHubDbContext db, JwtTokenService jwt) : Controll
             return BadRequest(new ErrorResponse("Refresh token is required."));
 
         var tokenHash = JwtTokenService.HashToken(request.RefreshToken);
-        var storedToken = await db.RefreshTokens.FirstOrDefaultAsync(r => r.TokenHash == tokenHash);
+        var storedToken = await _db.RefreshTokens.FirstOrDefaultAsync(r => r.TokenHash == tokenHash);
 
         if (storedToken is not null && storedToken.IsActive)
         {
             storedToken.RevokedAt = DateTimeOffset.UtcNow;
-            await db.SaveChangesAsync();
+            await _db.SaveChangesAsync();
         }
 
         return Ok();

src/EchoHub.Server/Controllers/ChannelsController.cs

@@ -4,12 +4,10 @@ using EchoHub.Core.Contracts;
 using EchoHub.Core.DTOs;
 using EchoHub.Core.Models;
 using EchoHub.Server.Data;
-using EchoHub.Server.Hubs;
 using EchoHub.Server.Services;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.RateLimiting;
-using Microsoft.AspNetCore.SignalR;
 using Microsoft.EntityFrameworkCore;
 
 namespace EchoHub.Server.Controllers;
@@ -18,22 +16,48 @@ namespace EchoHub.Server.Controllers;
 [Route("api/channels")]
 [Authorize]
 [EnableRateLimiting("general")]
-public class ChannelsController(
-    EchoHubDbContext db,
-    FileStorageService fileStorage,
-    ImageToAsciiService asciiService,
-    IHttpClientFactory httpClientFactory,
-    IHubContext<ChatHub, IEchoHubClient> hubContext) : ControllerBase
+public class ChannelsController : ControllerBase
 {
+    private readonly EchoHubDbContext _db;
+    private readonly FileStorageService _fileStorage;
+    private readonly ImageToAsciiService _asciiService;
+    private readonly IHttpClientFactory _httpClientFactory;
+    private readonly IChatService _chatService;
+    private readonly IMessageEncryptionService _encryption;
+
+    public ChannelsController(
+        EchoHubDbContext db,
+        FileStorageService fileStorage,
+        ImageToAsciiService asciiService,
+        IHttpClientFactory httpClientFactory,
+        IChatService chatService,
+        IMessageEncryptionService encryption)
+    {
+        _db = db;
+        _fileStorage = fileStorage;
+        _asciiService = asciiService;
+        _httpClientFactory = httpClientFactory;
+        _chatService = chatService;
+        _encryption = encryption;
+    }
+
     [HttpGet]
     public async Task<IActionResult> GetChannels([FromQuery] int offset = 0, [FromQuery] int limit = 50)
     {
+        var userIdClaim = User.FindFirstValue(ClaimTypes.NameIdentifier);
+        if (userIdClaim is null)
+            return Unauthorized(new ErrorResponse("Authentication required."));
+
+        var userId = Guid.Parse(userIdClaim);
         offset = Math.Max(0, offset);
         limit = Math.Clamp(limit, 1, 100);
 
-        var total = await db.Channels.CountAsync();
+        // Public channels + private channels the user has joined
+        var query = _db.Channels.Where(c =>
+            c.IsPublic || _db.ChannelMemberships.Any(m => m.ChannelId == c.Id && m.UserId == userId));
+        var total = await query.CountAsync();
 
-        var channels = await db.Channels
+        var channels = await query
             .OrderBy(c => c.Name)
             .Skip(offset)
             .Take(limit)
@@ -41,6 +65,7 @@ public class ChannelsController(
                 c.Id,
                 c.Name,
                 c.Topic,
+                c.IsPublic,
                 c.Messages.Count,
                 c.CreatedAt))
             .ToListAsync();
@@ -59,7 +84,7 @@ public class ChannelsController(
         if (!ValidationConstants.ChannelNameRegex().IsMatch(channelName))
             return BadRequest(new ErrorResponse("Channel name must be 2-100 characters and contain only letters, digits, underscores, or hyphens."));
 
-        if (await db.Channels.AnyAsync(c => c.Name == channelName))
+        if (await _db.Channels.AnyAsync(c => c.Name == channelName))
             return Conflict(new ErrorResponse($"Channel '{channelName}' already exists."));
 
         var userIdClaim = User.FindFirstValue(ClaimTypes.NameIdentifier);
@@ -71,14 +96,24 @@ public class ChannelsController(
             Id = Guid.NewGuid(),
             Name = channelName,
             Topic = request.Topic?.Trim(),
+            IsPublic = request.IsPublic,
             CreatedByUserId = Guid.Parse(userIdClaim),
         };
 
-        db.Channels.Add(channel);
-        await db.SaveChangesAsync();
+        _db.Channels.Add(channel);
 
-        var dto = new ChannelDto(channel.Id, channel.Name, channel.Topic, 0, channel.CreatedAt);
-        await hubContext.Clients.All.ChannelUpdated(dto);
+        // Creator automatically becomes a member
+        _db.ChannelMemberships.Add(new ChannelMembership
+        {
+            UserId = Guid.Parse(userIdClaim),
+            ChannelId = channel.Id,
+        });
+
+        await _db.SaveChangesAsync();
+
+        var dto = new ChannelDto(channel.Id, channel.Name, channel.Topic, channel.IsPublic, 0, channel.CreatedAt);
+        if (channel.IsPublic)
+            await _chatService.BroadcastChannelUpdatedAsync(dto);
 
         return Created($"/api/channels/{channelName}", dto);
     }
@@ -91,7 +126,7 @@ public class ChannelsController(
             return Unauthorized(new ErrorResponse("Authentication required."));
 
         var channelName = channel.ToLowerInvariant().Trim();
-        var dbChannel = await db.Channels.FirstOrDefaultAsync(c => c.Name == channelName);
+        var dbChannel = await _db.Channels.FirstOrDefaultAsync(c => c.Name == channelName);
 
         if (dbChannel is null)
             return NotFound(new ErrorResponse($"Channel '{channelName}' does not exist."));
@@ -103,11 +138,11 @@ public class ChannelsController(
             return BadRequest(new ErrorResponse($"Topic must not exceed {ValidationConstants.MaxChannelTopicLength} characters."));
 
         dbChannel.Topic = request.Topic?.Trim();
-        await db.SaveChangesAsync();
+        await _db.SaveChangesAsync();
 
-        var messageCount = await db.Messages.CountAsync(m => m.ChannelId == dbChannel.Id);
-        var dto = new ChannelDto(dbChannel.Id, dbChannel.Name, dbChannel.Topic, messageCount, dbChannel.CreatedAt);
-        await hubContext.Clients.Group(channelName).ChannelUpdated(dto);
+        var messageCount = await _db.Messages.CountAsync(m => m.ChannelId == dbChannel.Id);
+        var dto = new ChannelDto(dbChannel.Id, dbChannel.Name, dbChannel.Topic, dbChannel.IsPublic, messageCount, dbChannel.CreatedAt);
+        await _chatService.BroadcastChannelUpdatedAsync(dto, channelName);
 
         return Ok(dto);
     }
@@ -124,23 +159,25 @@ public class ChannelsController(
         if (channelName == HubConstants.DefaultChannel)
             return BadRequest(new ErrorResponse($"The '{HubConstants.DefaultChannel}' channel cannot be deleted."));
 
-        var dbChannel = await db.Channels.FirstOrDefaultAsync(c => c.Name == channelName);
+        var dbChannel = await _db.Channels.FirstOrDefaultAsync(c => c.Name == channelName);
 
         if (dbChannel is null)
             return NotFound(new ErrorResponse($"Channel '{channelName}' does not exist."));
 
-        if (dbChannel.CreatedByUserId != Guid.Parse(userIdClaim))
-            return StatusCode(403, new ErrorResponse("Only the channel creator can delete the channel."));
+        var userId = Guid.Parse(userIdClaim);
+        var caller = await _db.Users.FindAsync(userId);
+        if (dbChannel.CreatedByUserId != userId && (caller is null || caller.Role < ServerRole.Admin))
+            return StatusCode(403, new ErrorResponse("Only the channel creator or an admin can delete the channel."));
 
-        db.Channels.Remove(dbChannel);
-        await db.SaveChangesAsync();
+        _db.Channels.Remove(dbChannel);
+        await _db.SaveChangesAsync();
 
         return NoContent();
     }
 
     [HttpPost("{channel}/upload")]
     [EnableRateLimiting("upload")]
-    public async Task<IActionResult> Upload(string channel)
+    public async Task<IActionResult> Upload(string channel, [FromQuery] string? size = null)
     {
         var userIdClaim = User.FindFirstValue(ClaimTypes.NameIdentifier);
         var usernameClaim = User.FindFirstValue("username");
@@ -153,7 +190,7 @@ public class ChannelsController(
         if (!ValidationConstants.ChannelNameRegex().IsMatch(channelName))
             return BadRequest(new ErrorResponse("Invalid channel name format."));
 
-        var dbChannel = await db.Channels.FirstOrDefaultAsync(c => c.Name == channelName);
+        var dbChannel = await _db.Channels.FirstOrDefaultAsync(c => c.Name == channelName);
         if (dbChannel is null)
             return NotFound(new ErrorResponse($"Channel '{channelName}' does not exist."));
 
@@ -169,15 +206,16 @@ public class ChannelsController(
         using var stream = file.OpenReadStream();
         var isImage = FileValidationHelper.IsValidImage(stream);
 
-        var (fileId, filePath) = await fileStorage.SaveFileAsync(stream, file.FileName);
+        var (fileId, filePath) = await _fileStorage.SaveFileAsync(stream, file.FileName);
 
         var messageType = isImage ? MessageType.Image : MessageType.File;
         string content;
 
         if (isImage)
         {
+            var (w, h) = ImageToAsciiService.GetDimensions(size);
             using var imageStream = System.IO.File.OpenRead(filePath);
-            content = asciiService.ConvertToAscii(imageStream);
+            content = _asciiService.ConvertToAscii(imageStream, w, h);
         }
         else
         {
@@ -185,12 +223,13 @@ public class ChannelsController(
         }
 
         var attachmentUrl = $"/api/files/{fileId}";
-        var sender = await db.Users.FindAsync(userId);
+        var sender = await _db.Users.FindAsync(userId);
+        var dbContent = _encryption.EncryptDatabaseEnabled ? _encryption.Encrypt(content) : content;
 
         var message = new Message
         {
             Id = Guid.NewGuid(),
-            Content = content,
+            Content = dbContent,
             Type = messageType,
             AttachmentUrl = attachmentUrl,
             AttachmentFileName = file.FileName,
@@ -200,12 +239,13 @@ public class ChannelsController(
             SenderUsername = usernameClaim,
         };
 
-        db.Messages.Add(message);
-        await db.SaveChangesAsync();
+        _db.Messages.Add(message);
+        await _db.SaveChangesAsync();
 
+        // Encrypt for transport — clients decrypt
         var messageDto = new MessageDto(
             message.Id,
-            message.Content,
+            _encryption.Encrypt(content),
             message.SenderUsername,
             sender?.NicknameColor,
             channelName,
@@ -214,14 +254,14 @@ public class ChannelsController(
             file.FileName,
             message.SentAt);
 
-        await hubContext.Clients.Group(channelName).ReceiveMessage(messageDto);
+        await _chatService.BroadcastMessageAsync(channelName, messageDto);
 
         return Ok(messageDto);
     }
 
     [HttpPost("{channel}/send-url")]
     [EnableRateLimiting("upload")]
-    public async Task<IActionResult> SendUrl(string channel, [FromBody] SendUrlRequest request)
+    public async Task<IActionResult> SendUrl(string channel, [FromBody] SendUrlRequest request, [FromQuery] string? size = null)
     {
         var userIdClaim = User.FindFirstValue(ClaimTypes.NameIdentifier);
         var usernameClaim = User.FindFirstValue("username");
@@ -234,7 +274,7 @@ public class ChannelsController(
         if (!ValidationConstants.ChannelNameRegex().IsMatch(channelName))
             return BadRequest(new ErrorResponse("Invalid channel name format."));
 
-        var dbChannel = await db.Channels.FirstOrDefaultAsync(c => c.Name == channelName);
+        var dbChannel = await _db.Channels.FirstOrDefaultAsync(c => c.Name == channelName);
         if (dbChannel is null)
             return NotFound(new ErrorResponse($"Channel '{channelName}' does not exist."));
 
@@ -250,7 +290,7 @@ public class ChannelsController(
         string fileName;
         try
         {
-            using var client = httpClientFactory.CreateClient("ImageDownload");
+            using var client = _httpClientFactory.CreateClient("ImageDownload");
             using var response = await client.GetAsync(uri, HttpCompletionOption.ResponseHeadersRead);
             response.EnsureSuccessStatusCode();
 
@@ -293,21 +333,23 @@ public class ChannelsController(
             return BadRequest(new ErrorResponse("The URL does not point to a valid image. Supported formats: JPEG, PNG, GIF, WebP."));
 
         // Save file and convert to ASCII
-        var (fileId, filePath) = await fileStorage.SaveFileAsync(memoryStream, fileName);
+        var (fileId, filePath) = await _fileStorage.SaveFileAsync(memoryStream, fileName);
 
         string content;
+        var (w, h) = ImageToAsciiService.GetDimensions(size);
         using (var imageStream = System.IO.File.OpenRead(filePath))
         {
-            content = asciiService.ConvertToAscii(imageStream);
+            content = _asciiService.ConvertToAscii(imageStream, w, h);
         }
 
         var attachmentUrl = $"/api/files/{fileId}";
-        var sender = await db.Users.FindAsync(userId);
+        var sender = await _db.Users.FindAsync(userId);
+        var dbContent = _encryption.EncryptDatabaseEnabled ? _encryption.Encrypt(content) : content;
 
         var message = new Message
         {
             Id = Guid.NewGuid(),
-            Content = content,
+            Content = dbContent,
             Type = MessageType.Image,
             AttachmentUrl = attachmentUrl,
             AttachmentFileName = fileName,
@@ -317,12 +359,13 @@ public class ChannelsController(
             SenderUsername = usernameClaim,
         };
 
-        db.Messages.Add(message);
-        await db.SaveChangesAsync();
+        _db.Messages.Add(message);
+        await _db.SaveChangesAsync();
 
+        // Encrypt for transport — clients decrypt
         var messageDto = new MessageDto(
             message.Id,
-            message.Content,
+            _encryption.Encrypt(content),
             message.SenderUsername,
             sender?.NicknameColor,
             channelName,
@@ -331,7 +374,7 @@ public class ChannelsController(
             fileName,
             message.SentAt);
 
-        await hubContext.Clients.Group(channelName).ReceiveMessage(messageDto);
+        await _chatService.BroadcastMessageAsync(channelName, messageDto);
 
         return Ok(messageDto);
     }

src/EchoHub.Server/Controllers/FilesController.cs

@@ -10,15 +10,22 @@ namespace EchoHub.Server.Controllers;
 [Route("api/files")]
 [Authorize]
 [EnableRateLimiting("general")]
-public class FilesController(FileStorageService fileStorage) : ControllerBase
+public class FilesController : ControllerBase
 {
+    private readonly FileStorageService _fileStorage;
+
+    public FilesController(FileStorageService fileStorage)
+    {
+        _fileStorage = fileStorage;
+    }
+
     [HttpGet("{fileId}")]
     public IActionResult GetFile(string fileId)
     {
         if (!Guid.TryParse(fileId, out _))
             return BadRequest(new ErrorResponse("Invalid file identifier."));
 
-        var filePath = fileStorage.GetFilePath(fileId);
+        var filePath = _fileStorage.GetFilePath(fileId);
 
         if (filePath is null)
             return NotFound(new ErrorResponse("File not found."));

src/EchoHub.Server/Controllers/ModerationController.cs

@@ -0,0 +1,266 @@
+using System.Security.Claims;
+using EchoHub.Core.Contracts;
+using EchoHub.Core.DTOs;
+using EchoHub.Core.Models;
+using EchoHub.Server.Data;
+using EchoHub.Server.Services;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.RateLimiting;
+using Microsoft.EntityFrameworkCore;
+
+namespace EchoHub.Server.Controllers;
+
+[ApiController]
+[Route("api/moderation")]
+[Authorize]
+[EnableRateLimiting("general")]
+public class ModerationController : ControllerBase
+{
+    private readonly EchoHubDbContext _db;
+    private readonly IChatService _chatService;
+    private readonly PresenceTracker _presenceTracker;
+    private readonly IEnumerable<IChatBroadcaster> _broadcasters;
+
+    public ModerationController(
+        EchoHubDbContext db,
+        IChatService chatService,
+        PresenceTracker presenceTracker,
+        IEnumerable<IChatBroadcaster> broadcasters)
+    {
+        _db = db;
+        _chatService = chatService;
+        _presenceTracker = presenceTracker;
+        _broadcasters = broadcasters;
+    }
+
+    [HttpPost("role")]
+    public async Task<IActionResult> AssignRole([FromBody] AssignRoleRequest request)
+    {
+        var (caller, error) = await GetCallerAsync(ServerRole.Admin);
+        if (error is not null) return error;
+
+        if (request.Role == ServerRole.Owner)
+            return BadRequest(new ErrorResponse("Cannot assign the Owner role."));
+
+        var target = await _db.Users.FirstOrDefaultAsync(u => u.Username == request.Username.ToLowerInvariant());
+        if (target is null)
+            return NotFound(new ErrorResponse($"User '{request.Username}' not found."));
+
+        if (target.Role == ServerRole.Owner)
+            return BadRequest(new ErrorResponse("Cannot change the server owner's role."));
+
+        if (request.Role >= caller!.Role)
+            return BadRequest(new ErrorResponse("Cannot assign a role equal to or above your own."));
+
+        target.Role = request.Role;
+        await _db.SaveChangesAsync();
+
+        return Ok(new { Message = $"{target.Username} is now {request.Role}." });
+    }
+
+    [HttpPost("kick/{username}")]
+    public async Task<IActionResult> KickUser(string username, [FromBody] KickRequest? request = null)
+    {
+        var (caller, error) = await GetCallerAsync(ServerRole.Mod);
+        if (error is not null) return error;
+
+        var target = await _db.Users.FirstOrDefaultAsync(u => u.Username == username.ToLowerInvariant());
+        if (target is null)
+            return NotFound(new ErrorResponse($"User '{username}' not found."));
+
+        if (target.Role >= caller!.Role)
+            return BadRequest(new ErrorResponse("Cannot kick a user with equal or higher role."));
+
+        // Broadcast kick to all channels the user is in, then clean up presence
+        var channels = _presenceTracker.GetChannelsForUser(target.Username);
+        foreach (var channel in channels)
+        {
+            await BroadcastToAllAsync(b => b.SendUserKickedAsync(channel, target.Username, request?.Reason));
+        }
+
+        // Remove from presence tracker and force disconnect all connections
+        var reason = request?.Reason ?? "You have been kicked from the server.";
+        await ForceDisconnectAndCleanupAsync(target.Username, reason);
+
+        return Ok(new { Message = $"{target.Username} has been kicked." });
+    }
+
+    [HttpPost("ban/{username}")]
+    public async Task<IActionResult> BanUser(string username, [FromBody] BanRequest? request = null)
+    {
+        var (caller, error) = await GetCallerAsync(ServerRole.Admin);
+        if (error is not null) return error;
+
+        var target = await _db.Users.FirstOrDefaultAsync(u => u.Username == username.ToLowerInvariant());
+        if (target is null)
+            return NotFound(new ErrorResponse($"User '{username}' not found."));
+
+        if (target.Role >= caller!.Role)
+            return BadRequest(new ErrorResponse("Cannot ban a user with equal or higher role."));
+
+        target.IsBanned = true;
+        await _db.SaveChangesAsync();
+
+        // Broadcast ban notification, then force disconnect
+        await BroadcastToAllAsync(b => b.SendUserBannedAsync(target.Username, request?.Reason));
+
+        var reason = request?.Reason ?? "You have been banned from this server.";
+        await ForceDisconnectAndCleanupAsync(target.Username, reason);
+
+        return Ok(new { Message = $"{target.Username} has been banned." });
+    }
+
+    [HttpPost("unban/{username}")]
+    public async Task<IActionResult> UnbanUser(string username)
+    {
+        var (_, error) = await GetCallerAsync(ServerRole.Admin);
+        if (error is not null) return error;
+
+        var target = await _db.Users.FirstOrDefaultAsync(u => u.Username == username.ToLowerInvariant());
+        if (target is null)
+            return NotFound(new ErrorResponse($"User '{username}' not found."));
+
+        target.IsBanned = false;
+        await _db.SaveChangesAsync();
+
+        return Ok(new { Message = $"{target.Username} has been unbanned." });
+    }
+
+    [HttpPost("mute/{username}")]
+    public async Task<IActionResult> MuteUser(string username, [FromBody] MuteRequest? request = null)
+    {
+        var (caller, error) = await GetCallerAsync(ServerRole.Mod);
+        if (error is not null) return error;
+
+        var target = await _db.Users.FirstOrDefaultAsync(u => u.Username == username.ToLowerInvariant());
+        if (target is null)
+            return NotFound(new ErrorResponse($"User '{username}' not found."));
+
+        if (target.Role >= caller!.Role)
+            return BadRequest(new ErrorResponse("Cannot mute a user with equal or higher role."));
+
+        target.IsMuted = true;
+        target.MutedUntil = request?.DurationMinutes is > 0
+            ? DateTimeOffset.UtcNow.AddMinutes(request.DurationMinutes.Value)
+            : null;
+        await _db.SaveChangesAsync();
+
+        var durationText = request?.DurationMinutes is > 0 ? $" for {request.DurationMinutes} minutes" : "";
+        return Ok(new { Message = $"{target.Username} has been muted{durationText}." });
+    }
+
+    [HttpPost("unmute/{username}")]
+    public async Task<IActionResult> UnmuteUser(string username)
+    {
+        var (_, error) = await GetCallerAsync(ServerRole.Mod);
+        if (error is not null) return error;
+
+        var target = await _db.Users.FirstOrDefaultAsync(u => u.Username == username.ToLowerInvariant());
+        if (target is null)
+            return NotFound(new ErrorResponse($"User '{username}' not found."));
+
+        target.IsMuted = false;
+        target.MutedUntil = null;
+        await _db.SaveChangesAsync();
+
+        return Ok(new { Message = $"{target.Username} has been unmuted." });
+    }
+
+    [HttpDelete("messages/{messageId:guid}")]
+    public async Task<IActionResult> DeleteMessage(Guid messageId)
+    {
+        var (_, error) = await GetCallerAsync(ServerRole.Mod);
+        if (error is not null) return error;
+
+        var message = await _db.Messages
+            .Include(m => m.Channel)
+            .FirstOrDefaultAsync(m => m.Id == messageId);
+
+        if (message is null)
+            return NotFound(new ErrorResponse("Message not found."));
+
+        var channelName = message.Channel!.Name;
+        _db.Messages.Remove(message);
+        await _db.SaveChangesAsync();
+
+        await BroadcastToAllAsync(b => b.SendMessageDeletedAsync(channelName, messageId));
+
+        return Ok(new { Message = "Message deleted." });
+    }
+
+    [HttpDelete("channels/{channel}/nuke")]
+    public async Task<IActionResult> NukeChannel(string channel)
+    {
+        var (_, error) = await GetCallerAsync(ServerRole.Mod);
+        if (error is not null) return error;
+
+        var channelName = channel.ToLowerInvariant().Trim();
+        var dbChannel = await _db.Channels.FirstOrDefaultAsync(c => c.Name == channelName);
+        if (dbChannel is null)
+            return NotFound(new ErrorResponse($"Channel '{channelName}' does not exist."));
+
+        var messages = await _db.Messages.Where(m => m.ChannelId == dbChannel.Id).ToListAsync();
+        _db.Messages.RemoveRange(messages);
+        await _db.SaveChangesAsync();
+
+        await BroadcastToAllAsync(b => b.SendChannelNukedAsync(channelName));
+
+        return Ok(new { Message = $"All messages in #{channelName} have been cleared." });
+    }
+
+    private async Task<(User? Caller, IActionResult? Error)> GetCallerAsync(ServerRole minimumRole)
+    {
+        var userIdClaim = User.FindFirstValue(ClaimTypes.NameIdentifier);
+        if (userIdClaim is null)
+            return (null, Unauthorized(new ErrorResponse("Authentication required.")));
+
+        var caller = await _db.Users.FindAsync(Guid.Parse(userIdClaim));
+        if (caller is null)
+            return (null, Unauthorized(new ErrorResponse("User not found.")));
+
+        if (caller.Role < minimumRole)
+            return (null, StatusCode(403, new ErrorResponse($"Requires {minimumRole} role or higher.")));
+
+        return (caller, null);
+    }
+
+    /// <summary>
+    /// Remove user from presence tracking, broadcast their departure from all channels,
+    /// send a ForceDisconnect signal, and update their DB status.
+    /// </summary>
+    private async Task ForceDisconnectAndCleanupAsync(string username, string reason)
+    {
+        var (connectionIds, channels) = _presenceTracker.ForceRemoveUser(username);
+
+        // Notify remaining users that this person left each channel
+        foreach (var channel in channels)
+        {
+            await BroadcastToAllAsync(b => b.SendUserLeftAsync(channel, username));
+        }
+
+        // Signal the user's clients to disconnect
+        if (connectionIds.Count > 0)
+        {
+            await BroadcastToAllAsync(b => b.ForceDisconnectUserAsync(connectionIds, reason));
+        }
+
+        // Mark user offline in DB
+        var user = await _db.Users.FirstOrDefaultAsync(u => u.Username == username);
+        if (user is not null)
+        {
+            user.Status = UserStatus.Invisible;
+            user.LastSeenAt = DateTimeOffset.UtcNow;
+            await _db.SaveChangesAsync();
+        }
+    }
+
+    private async Task BroadcastToAllAsync(Func<IChatBroadcaster, Task> action)
+    {
+        foreach (var broadcaster in _broadcasters)
+        {
+            try { await action(broadcaster); }
+            catch { /* logged by broadcaster */ }
+        }
+    }
+}

src/EchoHub.Server/Controllers/ServerController.cs

@@ -1,26 +1,50 @@
 using EchoHub.Core.DTOs;
 using EchoHub.Server.Data;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.RateLimiting;
 using Microsoft.EntityFrameworkCore;
 
 namespace EchoHub.Server.Controllers;
 
 [ApiController]
 [Route("api/server")]
-public class ServerController(EchoHubDbContext db, IConfiguration config) : ControllerBase
+public class ServerController : ControllerBase
 {
+    private readonly EchoHubDbContext _db;
+    private readonly IConfiguration _config;
+
+    public ServerController(EchoHubDbContext db, IConfiguration config)
+    {
+        _db = db;
+        _config = config;
+    }
+
     [HttpGet("info")]
     public async Task<IActionResult> GetInfo()
     {
-        var userCount = await db.Users.CountAsync();
-        var channelCount = await db.Channels.CountAsync();
+        var userCount = await _db.Users.CountAsync();
+        var channelCount = await _db.Channels.CountAsync();
 
         var status = new ServerStatusDto(
-            config["Server:Name"] ?? "EchoHub Server",
-            config["Server:Description"],
+            _config["Server:Name"] ?? "EchoHub Server",
+            _config["Server:Description"],
             userCount,
             channelCount);
 
         return Ok(status);
     }
+
+    [HttpGet("encryption-key")]
+    [Authorize]
+    [EnableRateLimiting("auth")]
+    public IActionResult GetEncryptionKey()
+    {
+        var key = _config["Encryption:Key"];
+
+        if (string.IsNullOrEmpty(key))
+            return StatusCode(503, new ErrorResponse("Encryption is not configured on this server."));
+
+        return Ok(new EncryptionKeyResponse(key));
+    }
 }

src/EchoHub.Server/Controllers/UsersController.cs

@@ -14,13 +14,22 @@ namespace EchoHub.Server.Controllers;
 [Route("api/users")]
 [Authorize]
 [EnableRateLimiting("general")]
-public class UsersController(EchoHubDbContext db, ImageToAsciiService asciiService) : ControllerBase
+public class UsersController : ControllerBase
 {
+    private readonly EchoHubDbContext _db;
+    private readonly ImageToAsciiService _asciiService;
+
+    public UsersController(EchoHubDbContext db, ImageToAsciiService asciiService)
+    {
+        _db = db;
+        _asciiService = asciiService;
+    }
+
     [HttpGet("{username}/profile")]
     public async Task<IActionResult> GetProfile(string username)
     {
         var normalizedUsername = username.ToLowerInvariant().Trim();
-        var user = await db.Users.FirstOrDefaultAsync(u => u.Username == normalizedUsername);
+        var user = await _db.Users.FirstOrDefaultAsync(u => u.Username == normalizedUsername);
 
         if (user is null)
             return NotFound(new ErrorResponse("User not found."));
@@ -36,7 +45,7 @@ public class UsersController(EchoHubDbContext db, ImageToAsciiService asciiServi
             return Unauthorized(new ErrorResponse("Authentication required."));
 
         var userId = Guid.Parse(userIdClaim);
-        var user = await db.Users.FindAsync(userId);
+        var user = await _db.Users.FindAsync(userId);
 
         if (user is null)
             return NotFound(new ErrorResponse("User not found."));
@@ -63,7 +72,7 @@ public class UsersController(EchoHubDbContext db, ImageToAsciiService asciiServi
             user.NicknameColor = color.Length > 0 ? color : null;
         }
 
-        await db.SaveChangesAsync();
+        await _db.SaveChangesAsync();
 
         return Ok(ToProfileDto(user));
     }
@@ -77,7 +86,7 @@ public class UsersController(EchoHubDbContext db, ImageToAsciiService asciiServi
             return Unauthorized(new ErrorResponse("Authentication required."));
 
         var userId = Guid.Parse(userIdClaim);
-        var user = await db.Users.FindAsync(userId);
+        var user = await _db.Users.FindAsync(userId);
 
         if (user is null)
             return NotFound(new ErrorResponse("User not found."));
@@ -95,10 +104,10 @@ public class UsersController(EchoHubDbContext db, ImageToAsciiService asciiServi
         if (!FileValidationHelper.IsValidImage(stream))
             return BadRequest(new ErrorResponse("File is not a valid image. Supported formats: JPEG, PNG, GIF, WebP."));
 
-        var asciiArt = asciiService.ConvertToAscii(stream);
+        var asciiArt = _asciiService.ConvertToAscii(stream);
 
         user.AvatarAscii = asciiArt;
-        await db.SaveChangesAsync();
+        await _db.SaveChangesAsync();
 
         return Ok(new AvatarUploadResponse(asciiArt));
     }
@@ -112,6 +121,7 @@ public class UsersController(EchoHubDbContext db, ImageToAsciiService asciiServi
         user.AvatarAscii,
         user.Status,
         user.StatusMessage,
+        user.Role,
         user.CreatedAt,
         user.LastSeenAt);
 }

src/EchoHub.Server/Data/EchoHubDbContext.cs

@@ -4,12 +4,14 @@ using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
 
 namespace EchoHub.Server.Data;
 
-public class EchoHubDbContext(DbContextOptions<EchoHubDbContext> options) : DbContext(options)
+public class EchoHubDbContext : DbContext
 {
+    public EchoHubDbContext(DbContextOptions<EchoHubDbContext> options) : base(options) { }
     public DbSet<User> Users => Set<User>();
     public DbSet<Channel> Channels => Set<Channel>();
     public DbSet<Message> Messages => Set<Message>();
     public DbSet<RefreshToken> RefreshTokens => Set<RefreshToken>();
+    public DbSet<ChannelMembership> ChannelMemberships => Set<ChannelMembership>();
 
     protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
     {
@@ -33,6 +35,7 @@ public class EchoHubDbContext(DbContextOptions<EchoHubDbContext> options) : DbCo
             entity.Property(u => u.NicknameColor).HasMaxLength(7);
             entity.Property(u => u.AvatarAscii).HasMaxLength(10000);
             entity.Property(u => u.StatusMessage).HasMaxLength(100);
+            entity.Property(u => u.Role).HasConversion<int>();
         });
 
         modelBuilder.Entity<Channel>(entity =>
@@ -52,10 +55,28 @@ public class EchoHubDbContext(DbContextOptions<EchoHubDbContext> options) : DbCo
         {
             entity.HasKey(m => m.Id);
             entity.HasIndex(m => m.SentAt);
-            entity.Property(m => m.Content).IsRequired().HasMaxLength(2000);
+            entity.Property(m => m.Content).IsRequired().HasMaxLength(16000); // Increased for encrypted content (Base64 overhead)
             entity.Property(m => m.SenderUsername).IsRequired().HasMaxLength(50);
             entity.Property(m => m.AttachmentUrl).HasMaxLength(500);
             entity.Property(m => m.AttachmentFileName).HasMaxLength(255);
+            entity.Property(m => m.EmbedJson).HasMaxLength(32000); // Increased for encrypted embed JSON
+        });
+
+        modelBuilder.Entity<ChannelMembership>(entity =>
+        {
+            entity.HasKey(cm => new { cm.UserId, cm.ChannelId });
+            entity.HasIndex(cm => cm.UserId);
+            entity.HasIndex(cm => cm.ChannelId);
+
+            entity.HasOne<Channel>()
+                  .WithMany()
+                  .HasForeignKey(cm => cm.ChannelId)
+                  .OnDelete(DeleteBehavior.Cascade);
+
+            entity.HasOne<User>()
+                  .WithMany()
+                  .HasForeignKey(cm => cm.UserId)
+                  .OnDelete(DeleteBehavior.Cascade);
         });
 
         modelBuilder.Entity<RefreshToken>(entity =>

src/EchoHub.Server/Data/Migrations/20260219162414_AddModerationRoles.Designer.cs

@@ -0,0 +1,222 @@
+// <auto-generated />
+using System;
+using EchoHub.Server.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+
+#nullable disable
+
+namespace EchoHub.Server.Data.Migrations
+{
+    [DbContext(typeof(EchoHubDbContext))]
+    [Migration("20260219162414_AddModerationRoles")]
+    partial class AddModerationRoles
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder.HasAnnotation("ProductVersion", "10.0.3");
+
+            modelBuilder.Entity("EchoHub.Core.Models.Channel", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("CreatedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<Guid>("CreatedByUserId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(100)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Topic")
+                        .HasMaxLength(500)
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.ToTable("Channels");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.Message", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("AttachmentFileName")
+                        .HasMaxLength(255)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("AttachmentUrl")
+                        .HasMaxLength(500)
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("ChannelId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Content")
+                        .IsRequired()
+                        .HasMaxLength(2000)
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("SenderUserId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("SenderUsername")
+                        .IsRequired()
+                        .HasMaxLength(50)
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("SentAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<int>("Type")
+                        .HasColumnType("INTEGER");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ChannelId");
+
+                    b.HasIndex("SentAt");
+
+                    b.ToTable("Messages");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.RefreshToken", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("CreatedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long>("ExpiresAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long?>("RevokedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("TokenHash")
+                        .IsRequired()
+                        .HasMaxLength(128)
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TokenHash");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("RefreshTokens");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.User", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("AvatarAscii")
+                        .HasMaxLength(10000)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Bio")
+                        .HasMaxLength(500)
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("CreatedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("DisplayName")
+                        .HasMaxLength(100)
+                        .HasColumnType("TEXT");
+
+                    b.Property<bool>("IsBanned")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<bool>("IsMuted")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long>("LastSeenAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long?>("MutedUntil")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("NicknameColor")
+                        .HasMaxLength(7)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PasswordHash")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<int>("Role")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("StatusMessage")
+                        .HasMaxLength(100)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Username")
+                        .IsRequired()
+                        .HasMaxLength(50)
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Username")
+                        .IsUnique();
+
+                    b.ToTable("Users");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.Message", b =>
+                {
+                    b.HasOne("EchoHub.Core.Models.Channel", "Channel")
+                        .WithMany("Messages")
+                        .HasForeignKey("ChannelId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Channel");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.RefreshToken", b =>
+                {
+                    b.HasOne("EchoHub.Core.Models.User", "User")
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.Channel", b =>
+                {
+                    b.Navigation("Messages");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}

src/EchoHub.Server/Data/Migrations/20260219162414_AddModerationRoles.cs

@@ -0,0 +1,61 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EchoHub.Server.Data.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddModerationRoles : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<bool>(
+                name: "IsBanned",
+                table: "Users",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: false);
+
+            migrationBuilder.AddColumn<bool>(
+                name: "IsMuted",
+                table: "Users",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: false);
+
+            migrationBuilder.AddColumn<long>(
+                name: "MutedUntil",
+                table: "Users",
+                type: "INTEGER",
+                nullable: true);
+
+            migrationBuilder.AddColumn<int>(
+                name: "Role",
+                table: "Users",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: 0);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "IsBanned",
+                table: "Users");
+
+            migrationBuilder.DropColumn(
+                name: "IsMuted",
+                table: "Users");
+
+            migrationBuilder.DropColumn(
+                name: "MutedUntil",
+                table: "Users");
+
+            migrationBuilder.DropColumn(
+                name: "Role",
+                table: "Users");
+        }
+    }
+}

src/EchoHub.Server/Data/Migrations/20260219172834_AddChannelIsPublic.Designer.cs

@@ -0,0 +1,225 @@
+// <auto-generated />
+using System;
+using EchoHub.Server.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+
+#nullable disable
+
+namespace EchoHub.Server.Data.Migrations
+{
+    [DbContext(typeof(EchoHubDbContext))]
+    [Migration("20260219172834_AddChannelIsPublic")]
+    partial class AddChannelIsPublic
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder.HasAnnotation("ProductVersion", "10.0.3");
+
+            modelBuilder.Entity("EchoHub.Core.Models.Channel", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("CreatedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<Guid>("CreatedByUserId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<bool>("IsPublic")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(100)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Topic")
+                        .HasMaxLength(500)
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.ToTable("Channels");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.Message", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("AttachmentFileName")
+                        .HasMaxLength(255)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("AttachmentUrl")
+                        .HasMaxLength(500)
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("ChannelId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Content")
+                        .IsRequired()
+                        .HasMaxLength(2000)
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("SenderUserId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("SenderUsername")
+                        .IsRequired()
+                        .HasMaxLength(50)
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("SentAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<int>("Type")
+                        .HasColumnType("INTEGER");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ChannelId");
+
+                    b.HasIndex("SentAt");
+
+                    b.ToTable("Messages");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.RefreshToken", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("CreatedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long>("ExpiresAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long?>("RevokedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("TokenHash")
+                        .IsRequired()
+                        .HasMaxLength(128)
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TokenHash");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("RefreshTokens");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.User", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("AvatarAscii")
+                        .HasMaxLength(10000)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Bio")
+                        .HasMaxLength(500)
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("CreatedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("DisplayName")
+                        .HasMaxLength(100)
+                        .HasColumnType("TEXT");
+
+                    b.Property<bool>("IsBanned")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<bool>("IsMuted")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long>("LastSeenAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long?>("MutedUntil")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("NicknameColor")
+                        .HasMaxLength(7)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PasswordHash")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<int>("Role")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("StatusMessage")
+                        .HasMaxLength(100)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Username")
+                        .IsRequired()
+                        .HasMaxLength(50)
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Username")
+                        .IsUnique();
+
+                    b.ToTable("Users");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.Message", b =>
+                {
+                    b.HasOne("EchoHub.Core.Models.Channel", "Channel")
+                        .WithMany("Messages")
+                        .HasForeignKey("ChannelId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Channel");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.RefreshToken", b =>
+                {
+                    b.HasOne("EchoHub.Core.Models.User", "User")
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.Channel", b =>
+                {
+                    b.Navigation("Messages");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}

src/EchoHub.Server/Data/Migrations/20260219172834_AddChannelIsPublic.cs

@@ -0,0 +1,29 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EchoHub.Server.Data.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddChannelIsPublic : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<bool>(
+                name: "IsPublic",
+                table: "Channels",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "IsPublic",
+                table: "Channels");
+        }
+    }
+}

src/EchoHub.Server/Data/Migrations/20260219181720_AddChannelMembership.Designer.cs

@@ -0,0 +1,260 @@
+// <auto-generated />
+using System;
+using EchoHub.Server.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+
+#nullable disable
+
+namespace EchoHub.Server.Data.Migrations
+{
+    [DbContext(typeof(EchoHubDbContext))]
+    [Migration("20260219181720_AddChannelMembership")]
+    partial class AddChannelMembership
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder.HasAnnotation("ProductVersion", "10.0.3");
+
+            modelBuilder.Entity("EchoHub.Core.Models.Channel", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("CreatedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<Guid>("CreatedByUserId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<bool>("IsPublic")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(100)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Topic")
+                        .HasMaxLength(500)
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.ToTable("Channels");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.ChannelMembership", b =>
+                {
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("ChannelId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("JoinedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.HasKey("UserId", "ChannelId");
+
+                    b.HasIndex("ChannelId");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("ChannelMemberships");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.Message", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("AttachmentFileName")
+                        .HasMaxLength(255)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("AttachmentUrl")
+                        .HasMaxLength(500)
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("ChannelId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Content")
+                        .IsRequired()
+                        .HasMaxLength(2000)
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("SenderUserId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("SenderUsername")
+                        .IsRequired()
+                        .HasMaxLength(50)
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("SentAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<int>("Type")
+                        .HasColumnType("INTEGER");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ChannelId");
+
+                    b.HasIndex("SentAt");
+
+                    b.ToTable("Messages");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.RefreshToken", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("CreatedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long>("ExpiresAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long?>("RevokedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("TokenHash")
+                        .IsRequired()
+                        .HasMaxLength(128)
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TokenHash");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("RefreshTokens");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.User", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("AvatarAscii")
+                        .HasMaxLength(10000)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Bio")
+                        .HasMaxLength(500)
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("CreatedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("DisplayName")
+                        .HasMaxLength(100)
+                        .HasColumnType("TEXT");
+
+                    b.Property<bool>("IsBanned")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<bool>("IsMuted")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long>("LastSeenAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long?>("MutedUntil")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("NicknameColor")
+                        .HasMaxLength(7)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PasswordHash")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<int>("Role")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("StatusMessage")
+                        .HasMaxLength(100)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Username")
+                        .IsRequired()
+                        .HasMaxLength(50)
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Username")
+                        .IsUnique();
+
+                    b.ToTable("Users");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.ChannelMembership", b =>
+                {
+                    b.HasOne("EchoHub.Core.Models.Channel", null)
+                        .WithMany()
+                        .HasForeignKey("ChannelId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("EchoHub.Core.Models.User", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.Message", b =>
+                {
+                    b.HasOne("EchoHub.Core.Models.Channel", "Channel")
+                        .WithMany("Messages")
+                        .HasForeignKey("ChannelId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Channel");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.RefreshToken", b =>
+                {
+                    b.HasOne("EchoHub.Core.Models.User", "User")
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.Channel", b =>
+                {
+                    b.Navigation("Messages");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}

src/EchoHub.Server/Data/Migrations/20260219181720_AddChannelMembership.cs

@@ -0,0 +1,57 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EchoHub.Server.Data.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddChannelMembership : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "ChannelMemberships",
+                columns: table => new
+                {
+                    UserId = table.Column<Guid>(type: "TEXT", nullable: false),
+                    ChannelId = table.Column<Guid>(type: "TEXT", nullable: false),
+                    JoinedAt = table.Column<long>(type: "INTEGER", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_ChannelMemberships", x => new { x.UserId, x.ChannelId });
+                    table.ForeignKey(
+                        name: "FK_ChannelMemberships_Channels_ChannelId",
+                        column: x => x.ChannelId,
+                        principalTable: "Channels",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                    table.ForeignKey(
+                        name: "FK_ChannelMemberships_Users_UserId",
+                        column: x => x.UserId,
+                        principalTable: "Users",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_ChannelMemberships_ChannelId",
+                table: "ChannelMemberships",
+                column: "ChannelId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_ChannelMemberships_UserId",
+                table: "ChannelMemberships",
+                column: "UserId");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "ChannelMemberships");
+        }
+    }
+}

src/EchoHub.Server/Data/Migrations/20260219201704_AddMessageEmbed.Designer.cs

@@ -0,0 +1,264 @@
+// <auto-generated />
+using System;
+using EchoHub.Server.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+
+#nullable disable
+
+namespace EchoHub.Server.Data.Migrations
+{
+    [DbContext(typeof(EchoHubDbContext))]
+    [Migration("20260219201704_AddMessageEmbed")]
+    partial class AddMessageEmbed
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder.HasAnnotation("ProductVersion", "10.0.3");
+
+            modelBuilder.Entity("EchoHub.Core.Models.Channel", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("CreatedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<Guid>("CreatedByUserId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<bool>("IsPublic")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(100)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Topic")
+                        .HasMaxLength(500)
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.ToTable("Channels");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.ChannelMembership", b =>
+                {
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("ChannelId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("JoinedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.HasKey("UserId", "ChannelId");
+
+                    b.HasIndex("ChannelId");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("ChannelMemberships");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.Message", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("AttachmentFileName")
+                        .HasMaxLength(255)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("AttachmentUrl")
+                        .HasMaxLength(500)
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("ChannelId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Content")
+                        .IsRequired()
+                        .HasMaxLength(2000)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EmbedJson")
+                        .HasMaxLength(8000)
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("SenderUserId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("SenderUsername")
+                        .IsRequired()
+                        .HasMaxLength(50)
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("SentAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<int>("Type")
+                        .HasColumnType("INTEGER");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ChannelId");
+
+                    b.HasIndex("SentAt");
+
+                    b.ToTable("Messages");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.RefreshToken", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("CreatedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long>("ExpiresAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long?>("RevokedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("TokenHash")
+                        .IsRequired()
+                        .HasMaxLength(128)
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TokenHash");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("RefreshTokens");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.User", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("AvatarAscii")
+                        .HasMaxLength(10000)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Bio")
+                        .HasMaxLength(500)
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("CreatedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("DisplayName")
+                        .HasMaxLength(100)
+                        .HasColumnType("TEXT");
+
+                    b.Property<bool>("IsBanned")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<bool>("IsMuted")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long>("LastSeenAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long?>("MutedUntil")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("NicknameColor")
+                        .HasMaxLength(7)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PasswordHash")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<int>("Role")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("StatusMessage")
+                        .HasMaxLength(100)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Username")
+                        .IsRequired()
+                        .HasMaxLength(50)
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Username")
+                        .IsUnique();
+
+                    b.ToTable("Users");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.ChannelMembership", b =>
+                {
+                    b.HasOne("EchoHub.Core.Models.Channel", null)
+                        .WithMany()
+                        .HasForeignKey("ChannelId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("EchoHub.Core.Models.User", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.Message", b =>
+                {
+                    b.HasOne("EchoHub.Core.Models.Channel", "Channel")
+                        .WithMany("Messages")
+                        .HasForeignKey("ChannelId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Channel");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.RefreshToken", b =>
+                {
+                    b.HasOne("EchoHub.Core.Models.User", "User")
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.Channel", b =>
+                {
+                    b.Navigation("Messages");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}

src/EchoHub.Server/Data/Migrations/20260219201704_AddMessageEmbed.cs

@@ -0,0 +1,29 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EchoHub.Server.Data.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddMessageEmbed : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "EmbedJson",
+                table: "Messages",
+                type: "TEXT",
+                maxLength: 8000,
+                nullable: true);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "EmbedJson",
+                table: "Messages");
+        }
+    }
+}

src/EchoHub.Server/Data/Migrations/20260220133627_AddEncryptionSupport.Designer.cs

@@ -0,0 +1,264 @@
+// <auto-generated />
+using System;
+using EchoHub.Server.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+
+#nullable disable
+
+namespace EchoHub.Server.Data.Migrations
+{
+    [DbContext(typeof(EchoHubDbContext))]
+    [Migration("20260220133627_AddEncryptionSupport")]
+    partial class AddEncryptionSupport
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder.HasAnnotation("ProductVersion", "10.0.3");
+
+            modelBuilder.Entity("EchoHub.Core.Models.Channel", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("CreatedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<Guid>("CreatedByUserId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<bool>("IsPublic")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasMaxLength(100)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Topic")
+                        .HasMaxLength(500)
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Name")
+                        .IsUnique();
+
+                    b.ToTable("Channels");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.ChannelMembership", b =>
+                {
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("ChannelId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("JoinedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.HasKey("UserId", "ChannelId");
+
+                    b.HasIndex("ChannelId");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("ChannelMemberships");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.Message", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("AttachmentFileName")
+                        .HasMaxLength(255)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("AttachmentUrl")
+                        .HasMaxLength(500)
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("ChannelId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Content")
+                        .IsRequired()
+                        .HasMaxLength(16000)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EmbedJson")
+                        .HasMaxLength(32000)
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("SenderUserId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("SenderUsername")
+                        .IsRequired()
+                        .HasMaxLength(50)
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("SentAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<int>("Type")
+                        .HasColumnType("INTEGER");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ChannelId");
+
+                    b.HasIndex("SentAt");
+
+                    b.ToTable("Messages");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.RefreshToken", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("CreatedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long>("ExpiresAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long?>("RevokedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("TokenHash")
+                        .IsRequired()
+                        .HasMaxLength(128)
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("TokenHash");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("RefreshTokens");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.User", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("AvatarAscii")
+                        .HasMaxLength(10000)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Bio")
+                        .HasMaxLength(500)
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("CreatedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("DisplayName")
+                        .HasMaxLength(100)
+                        .HasColumnType("TEXT");
+
+                    b.Property<bool>("IsBanned")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<bool>("IsMuted")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long>("LastSeenAt")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<long?>("MutedUntil")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("NicknameColor")
+                        .HasMaxLength(7)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PasswordHash")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<int>("Role")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<int>("Status")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("StatusMessage")
+                        .HasMaxLength(100)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Username")
+                        .IsRequired()
+                        .HasMaxLength(50)
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Username")
+                        .IsUnique();
+
+                    b.ToTable("Users");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.ChannelMembership", b =>
+                {
+                    b.HasOne("EchoHub.Core.Models.Channel", null)
+                        .WithMany()
+                        .HasForeignKey("ChannelId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("EchoHub.Core.Models.User", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.Message", b =>
+                {
+                    b.HasOne("EchoHub.Core.Models.Channel", "Channel")
+                        .WithMany("Messages")
+                        .HasForeignKey("ChannelId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Channel");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.RefreshToken", b =>
+                {
+                    b.HasOne("EchoHub.Core.Models.User", "User")
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("EchoHub.Core.Models.Channel", b =>
+                {
+                    b.Navigation("Messages");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}

src/EchoHub.Server/Data/Migrations/20260220133627_AddEncryptionSupport.cs

@@ -0,0 +1,22 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace EchoHub.Server.Data.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddEncryptionSupport : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+
+        }
+    }
+}

src/EchoHub.Server/Data/Migrations/EchoHubDbContextModelSnapshot.cs

@@ -29,6 +29,9 @@ namespace EchoHub.Server.Data.Migrations
                     b.Property<Guid>("CreatedByUserId")
                         .HasColumnType("TEXT");
 
+                    b.Property<bool>("IsPublic")
+                        .HasColumnType("INTEGER");
+
                     b.Property<string>("Name")
                         .IsRequired()
                         .HasMaxLength(100)
@@ -46,6 +49,26 @@ namespace EchoHub.Server.Data.Migrations
                     b.ToTable("Channels");
                 });
 
+            modelBuilder.Entity("EchoHub.Core.Models.ChannelMembership", b =>
+                {
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("ChannelId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<long>("JoinedAt")
+                        .HasColumnType("INTEGER");
+
+                    b.HasKey("UserId", "ChannelId");
+
+                    b.HasIndex("ChannelId");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("ChannelMemberships");
+                });
+
             modelBuilder.Entity("EchoHub.Core.Models.Message", b =>
                 {
                     b.Property<Guid>("Id")
@@ -65,7 +88,11 @@ namespace EchoHub.Server.Data.Migrations
 
                     b.Property<string>("Content")
                         .IsRequired()
-                        .HasMaxLength(2000)
+                        .HasMaxLength(16000)
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EmbedJson")
+                        .HasMaxLength(32000)
                         .HasColumnType("TEXT");
 
                     b.Property<Guid>("SenderUserId")
@@ -144,9 +171,18 @@ namespace EchoHub.Server.Data.Migrations
                         .HasMaxLength(100)
                         .HasColumnType("TEXT");
 
+                    b.Property<bool>("IsBanned")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<bool>("IsMuted")
+                        .HasColumnType("INTEGER");
+
                     b.Property<long>("LastSeenAt")
                         .HasColumnType("INTEGER");
 
+                    b.Property<long?>("MutedUntil")
+                        .HasColumnType("INTEGER");
+
                     b.Property<string>("NicknameColor")
                         .HasMaxLength(7)
                         .HasColumnType("TEXT");
@@ -155,6 +191,9 @@ namespace EchoHub.Server.Data.Migrations
                         .IsRequired()
                         .HasColumnType("TEXT");
 
+                    b.Property<int>("Role")
+                        .HasColumnType("INTEGER");
+
                     b.Property<int>("Status")
                         .HasColumnType("INTEGER");
 
@@ -175,6 +214,21 @@ namespace EchoHub.Server.Data.Migrations
                     b.ToTable("Users");
                 });
 
+            modelBuilder.Entity("EchoHub.Core.Models.ChannelMembership", b =>
+                {
+                    b.HasOne("EchoHub.Core.Models.Channel", null)
+                        .WithMany()
+                        .HasForeignKey("ChannelId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("EchoHub.Core.Models.User", null)
+                        .WithMany()
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
             modelBuilder.Entity("EchoHub.Core.Models.Message", b =>
                 {
                     b.HasOne("EchoHub.Core.Models.Channel", "Channel")

src/EchoHub.Server/EchoHub.Server.csproj

@@ -2,6 +2,7 @@
 
   <ItemGroup>
     <ProjectReference Include="..\EchoHub.Core\EchoHub.Core.csproj" />
+    <ProjectReference Include="..\EchoHub.Server.Irc\EchoHub.Server.Irc.csproj" />
   </ItemGroup>
 
   <ItemGroup>

src/EchoHub.Server/Hubs/ChatHub.cs

@@ -3,17 +3,23 @@ using EchoHub.Core.Constants;
 using EchoHub.Core.Contracts;
 using EchoHub.Core.DTOs;
 using EchoHub.Core.Models;
-using EchoHub.Server.Data;
-using EchoHub.Server.Services;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.SignalR;
-using Microsoft.EntityFrameworkCore;
 
 namespace EchoHub.Server.Hubs;
 
 [Authorize]
-public class ChatHub(EchoHubDbContext db, ILogger<ChatHub> logger, PresenceTracker presenceTracker) : Hub<IEchoHubClient>
+public class ChatHub : Hub<IEchoHubClient>
 {
+    private readonly IChatService _chatService;
+    private readonly ILogger<ChatHub> _logger;
+
+    public ChatHub(IChatService chatService, ILogger<ChatHub> logger)
+    {
+        _chatService = chatService;
+        _logger = logger;
+    }
+
     private Guid CurrentUserId =>
         Guid.Parse(Context.User?.FindFirstValue(ClaimTypes.NameIdentifier)
             ?? throw new HubException("User ID claim not found."));
@@ -26,23 +32,12 @@ public class ChatHub(EchoHubDbContext db, ILogger<ChatHub> logger, PresenceTrack
     {
         try
         {
-            presenceTracker.UserConnected(Context.ConnectionId, CurrentUserId, CurrentUsername);
-
-            var user = await db.Users.FindAsync(CurrentUserId);
-            if (user is not null)
-            {
-                user.LastSeenAt = DateTimeOffset.UtcNow;
-                user.Status = UserStatus.Online;
-                await db.SaveChangesAsync();
-            }
-
+            await _chatService.UserConnectedAsync(Context.ConnectionId, CurrentUserId, CurrentUsername);
             await base.OnConnectedAsync();
-
-            logger.LogInformation("{User} connected (ConnectionId: {ConnectionId})", CurrentUsername, Context.ConnectionId);
         }
         catch (Exception ex)
         {
-            logger.LogError(ex, "Error in OnConnectedAsync for {ConnectionId}", Context.ConnectionId);
+            _logger.LogError(ex, "Error in OnConnectedAsync for {ConnectionId}", Context.ConnectionId);
             throw;
         }
     }
@@ -51,43 +46,12 @@ public class ChatHub(EchoHubDbContext db, ILogger<ChatHub> logger, PresenceTrack
     {
         try
         {
-            var preDisconnectUsername = Context.User?.FindFirstValue("username");
-            var channelsBeforeDisconnect = preDisconnectUsername is not null
-                ? presenceTracker.GetChannelsForUser(preDisconnectUsername)
-                : [];
-
-            var username = presenceTracker.UserDisconnected(Context.ConnectionId);
-
-            if (username is not null && !presenceTracker.IsOnline(username))
-            {
-                var user = await db.Users.FirstOrDefaultAsync(u => u.Username == username);
-                if (user is not null)
-                {
-                    user.LastSeenAt = DateTimeOffset.UtcNow;
-                    user.Status = UserStatus.Invisible;
-                    await db.SaveChangesAsync();
-
-                    var presence = new UserPresenceDto(
-                        username,
-                        user.DisplayName,
-                        user.NicknameColor,
-                        UserStatus.Invisible,
-                        user.StatusMessage);
-
-                    foreach (var channel in channelsBeforeDisconnect)
-                    {
-                        await Clients.Group(channel).UserStatusChanged(presence);
-                    }
-                }
-            }
-
+            await _chatService.UserDisconnectedAsync(Context.ConnectionId);
             await base.OnDisconnectedAsync(exception);
-
-            logger.LogInformation("{User} disconnected (ConnectionId: {ConnectionId})", username ?? "Unknown", Context.ConnectionId);
         }
         catch (Exception ex)
         {
-            logger.LogError(ex, "Error in OnDisconnectedAsync for {ConnectionId}", Context.ConnectionId);
+            _logger.LogError(ex, "Error in OnDisconnectedAsync for {ConnectionId}", Context.ConnectionId);
             throw;
         }
     }
@@ -96,37 +60,21 @@ public class ChatHub(EchoHubDbContext db, ILogger<ChatHub> logger, PresenceTrack
     {
         try
         {
-            channelName = channelName.ToLowerInvariant().Trim();
+            var (history, error) = await _chatService.JoinChannelAsync(
+                Context.ConnectionId, CurrentUserId, CurrentUsername, channelName);
 
-            if (!ValidationConstants.ChannelNameRegex().IsMatch(channelName))
+            if (error is not null)
             {
-                await Clients.Caller.Error("Invalid channel name. Use 2-100 characters: letters, digits, underscores, or hyphens.");
+                await Clients.Caller.Error(error);
                 return [];
             }
 
-            var channel = await db.Channels.FirstOrDefaultAsync(c => c.Name == channelName);
-
-            if (channel is null)
-            {
-                await Clients.Caller.Error($"Channel '{channelName}' does not exist. Create it first via the channel list.");
-                return [];
-            }
-
-            var isNewJoin = presenceTracker.JoinChannel(CurrentUsername, channelName);
-
-            if (isNewJoin)
-            {
-                await Groups.AddToGroupAsync(Context.ConnectionId, channelName);
-                await Clients.OthersInGroup(channelName).UserJoined(channelName, CurrentUsername);
-                logger.LogInformation("{User} joined channel '{Channel}'", CurrentUsername, channelName);
-            }
-
-            var history = await GetChannelHistory(channelName, HubConstants.DefaultHistoryCount);
+            await Groups.AddToGroupAsync(Context.ConnectionId, channelName.ToLowerInvariant().Trim());
             return history;
         }
         catch (Exception ex)
         {
-            logger.LogError(ex, "Error joining channel '{Channel}' for {User}", channelName, CurrentUsername);
+            _logger.LogError(ex, "Error joining channel '{Channel}' for {User}", channelName, CurrentUsername);
             await Clients.Caller.Error($"Failed to join channel: {ex.Message}");
             return [];
         }
@@ -137,17 +85,12 @@ public class ChatHub(EchoHubDbContext db, ILogger<ChatHub> logger, PresenceTrack
         try
         {
             channelName = channelName.ToLowerInvariant().Trim();
-
-            presenceTracker.LeaveChannel(CurrentUsername, channelName);
-
+            await _chatService.LeaveChannelAsync(Context.ConnectionId, CurrentUsername, channelName);
             await Groups.RemoveFromGroupAsync(Context.ConnectionId, channelName);
-            await Clients.OthersInGroup(channelName).UserLeft(channelName, CurrentUsername);
-
-            logger.LogInformation("{User} left channel '{Channel}'", CurrentUsername, channelName);
         }
         catch (Exception ex)
         {
-            logger.LogError(ex, "Error leaving channel '{Channel}' for {User}", channelName, CurrentUsername);
+            _logger.LogError(ex, "Error leaving channel '{Channel}' for {User}", channelName, CurrentUsername);
             await Clients.Caller.Error($"Failed to leave channel: {ex.Message}");
         }
     }
@@ -156,68 +99,13 @@ public class ChatHub(EchoHubDbContext db, ILogger<ChatHub> logger, PresenceTrack
     {
         try
         {
-            channelName = channelName.ToLowerInvariant().Trim();
-
-            if (!ValidationConstants.ChannelNameRegex().IsMatch(channelName))
-            {
-                await Clients.Caller.Error("Invalid channel name.");
-                return;
-            }
-
-            if (string.IsNullOrWhiteSpace(content))
-            {
-                await Clients.Caller.Error("Message content cannot be empty.");
-                return;
-            }
-
-            if (content.Length > HubConstants.MaxMessageLength)
-            {
-                await Clients.Caller.Error($"Message exceeds maximum length of {HubConstants.MaxMessageLength} characters.");
-                return;
-            }
-
-            var channel = await db.Channels.FirstOrDefaultAsync(c => c.Name == channelName);
-
-            if (channel is null)
-            {
-                await Clients.Caller.Error($"Channel '{channelName}' does not exist.");
-                return;
-            }
-
-            var sender = await db.Users.FindAsync(CurrentUserId);
-
-            var message = new Message
-            {
-                Id = Guid.NewGuid(),
-                Content = content,
-                Type = MessageType.Text,
-                SentAt = DateTimeOffset.UtcNow,
-                ChannelId = channel.Id,
-                SenderUserId = CurrentUserId,
-                SenderUsername = CurrentUsername,
-            };
-
-            db.Messages.Add(message);
-            await db.SaveChangesAsync();
-
-            var messageDto = new MessageDto(
-                message.Id,
-                message.Content,
-                message.SenderUsername,
-                sender?.NicknameColor,
-                channelName,
-                MessageType.Text,
-                null,
-                null,
-                message.SentAt);
-
-            await Clients.Group(channelName).ReceiveMessage(messageDto);
-
-            logger.LogDebug("{User} sent message in '{Channel}'", CurrentUsername, channelName);
+            var error = await _chatService.SendMessageAsync(CurrentUserId, CurrentUsername, channelName, content);
+            if (error is not null)
+                await Clients.Caller.Error(error);
         }
         catch (Exception ex)
         {
-            logger.LogError(ex, "Error sending message in '{Channel}' for {User}", channelName, CurrentUsername);
+            _logger.LogError(ex, "Error sending message in '{Channel}' for {User}", channelName, CurrentUsername);
             await Clients.Caller.Error($"Failed to send message: {ex.Message}");
         }
     }
@@ -226,39 +114,11 @@ public class ChatHub(EchoHubDbContext db, ILogger<ChatHub> logger, PresenceTrack
     {
         try
         {
-            channelName = channelName.ToLowerInvariant().Trim();
-            count = Math.Clamp(count, 1, ValidationConstants.MaxHistoryCount);
-
-            var channel = await db.Channels.FirstOrDefaultAsync(c => c.Name == channelName);
-
-            if (channel is null)
-                return [];
-
-            var messages = await db.Messages
-                .Where(m => m.ChannelId == channel.Id)
-                .OrderByDescending(m => m.SentAt)
-                .Take(count)
-                .Join(db.Users,
-                    m => m.SenderUserId,
-                    u => u.Id,
-                    (m, u) => new MessageDto(
-                        m.Id,
-                        m.Content,
-                        m.SenderUsername,
-                        u.NicknameColor,
-                        channelName,
-                        m.Type,
-                        m.AttachmentUrl,
-                        m.AttachmentFileName,
-                        m.SentAt))
-                .ToListAsync();
-
-            messages.Reverse();
-            return messages;
+            return await _chatService.GetChannelHistoryAsync(channelName, count);
         }
         catch (Exception ex)
         {
-            logger.LogError(ex, "Error fetching history for '{Channel}'", channelName);
+            _logger.LogError(ex, "Error fetching history for '{Channel}'", channelName);
             await Clients.Caller.Error($"Failed to load history: {ex.Message}");
             return [];
         }
@@ -268,41 +128,13 @@ public class ChatHub(EchoHubDbContext db, ILogger<ChatHub> logger, PresenceTrack
     {
         try
         {
-            if (statusMessage is not null && statusMessage.Length > ValidationConstants.MaxStatusMessageLength)
-            {
-                await Clients.Caller.Error($"Status message must not exceed {ValidationConstants.MaxStatusMessageLength} characters.");
-                return;
-            }
-
-            var user = await db.Users.FindAsync(CurrentUserId);
-
-            if (user is null)
-            {
-                await Clients.Caller.Error("User not found.");
-                return;
-            }
-
-            user.Status = status;
-            user.StatusMessage = statusMessage?.Trim();
-            user.LastSeenAt = DateTimeOffset.UtcNow;
-            await db.SaveChangesAsync();
-
-            var presence = new UserPresenceDto(
-                user.Username,
-                user.DisplayName,
-                user.NicknameColor,
-                status,
-                statusMessage);
-
-            var channels = presenceTracker.GetChannelsForUser(CurrentUsername);
-            var connections = presenceTracker.GetConnectionsInChannels(channels);
-
-            if (connections.Count > 0)
-                await Clients.Clients(connections).UserStatusChanged(presence);
+            var error = await _chatService.UpdateStatusAsync(CurrentUserId, CurrentUsername, status, statusMessage);
+            if (error is not null)
+                await Clients.Caller.Error(error);
         }
         catch (Exception ex)
         {
-            logger.LogError(ex, "Error updating status for {User}", CurrentUsername);
+            _logger.LogError(ex, "Error updating status for {User}", CurrentUsername);
             await Clients.Caller.Error($"Failed to update status: {ex.Message}");
         }
     }
@@ -311,25 +143,11 @@ public class ChatHub(EchoHubDbContext db, ILogger<ChatHub> logger, PresenceTrack
     {
         try
         {
-            channelName = channelName.ToLowerInvariant().Trim();
-
-            var onlineUsernames = presenceTracker.GetOnlineUsersInChannel(channelName);
-
-            var users = await db.Users
-                .Where(u => onlineUsernames.Contains(u.Username))
-                .Select(u => new UserPresenceDto(
-                    u.Username,
-                    u.DisplayName,
-                    u.NicknameColor,
-                    u.Status,
-                    u.StatusMessage))
-                .ToListAsync();
-
-            return users;
+            return await _chatService.GetOnlineUsersAsync(channelName);
         }
         catch (Exception ex)
         {
-            logger.LogError(ex, "Error listing users in '{Channel}'", channelName);
+            _logger.LogError(ex, "Error listing users in '{Channel}'", channelName);
             await Clients.Caller.Error($"Failed to list users: {ex.Message}");
             return [];
         }

src/EchoHub.Server/Program.cs

@@ -1,10 +1,12 @@
 using System.Text;
 using System.Threading.RateLimiting;
 using EchoHub.Core.Constants;
+using EchoHub.Core.Contracts;
 using EchoHub.Core.Models;
 using EchoHub.Server.Auth;
 using EchoHub.Server.Data;
 using EchoHub.Server.Hubs;
+using EchoHub.Server.Irc;
 using EchoHub.Server.Services;
 using EchoHub.Server.Setup;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
@@ -33,6 +35,10 @@ while (true)
     {
         var builder = WebApplication.CreateBuilder(args);
 
+        // ── Host options ────────────────────────────────────────────────────
+        builder.Services.Configure<HostOptions>(options =>
+            options.ShutdownTimeout = TimeSpan.FromSeconds(5));
+
         // ── Serilog ──────────────────────────────────────────────────────────
         builder.Host.UseSerilog((context, config) =>
             config.ReadFrom.Configuration(context.Configuration));
@@ -100,13 +106,32 @@ while (true)
         builder.Services.AddSingleton<PresenceTracker>();
         builder.Services.AddSingleton<ImageToAsciiService>();
         builder.Services.AddSingleton<FileStorageService>();
+        builder.Services.AddSingleton<LinkEmbedService>();
         builder.Services.AddHostedService<ServerDirectoryService>();
+
+        // ── Encryption ─────────────────────────────────────────────────────
+        builder.Services.AddSingleton<IMessageEncryptionService, MessageEncryptionService>();
+
+        // ── Chat Service + Broadcasters ─────────────────────────────────────
+        builder.Services.AddSingleton<IChatBroadcaster, SignalRBroadcaster>();
+        builder.Services.AddSingleton<IChatService, ChatService>();
+
+        // ── IRC Gateway (optional) ──────────────────────────────────────────
+        builder.AddIrcGateway();
+
         builder.Services.AddHttpClient("ImageDownload", client =>
         {
             client.Timeout = TimeSpan.FromSeconds(15);
             client.MaxResponseContentBufferSize = 10 * 1024 * 1024; // 10 MB
         });
 
+        builder.Services.AddHttpClient("OgFetch", client =>
+        {
+            client.Timeout = TimeSpan.FromSeconds(5);
+            client.MaxResponseContentBufferSize = 256 * 1024; // 256 KB
+            client.DefaultRequestHeaders.UserAgent.ParseAdd("EchoHub/1.0 (Link Preview Bot)");
+        });
+
         // ── Rate Limiting ────────────────────────────────────────────────────
         builder.Services.AddRateLimiter(options =>
         {

src/EchoHub.Server/Services/ChatService.cs

@@ -0,0 +1,463 @@
+using System.Text.Json;
+using EchoHub.Core.Constants;
+using EchoHub.Core.Contracts;
+using EchoHub.Core.DTOs;
+using EchoHub.Core.Models;
+using EchoHub.Server.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+
+namespace EchoHub.Server.Services;
+
+public class ChatService : IChatService
+{
+    private readonly IServiceScopeFactory _scopeFactory;
+    private readonly PresenceTracker _presenceTracker;
+    private readonly IEnumerable<IChatBroadcaster> _broadcasters;
+    private readonly LinkEmbedService _embedService;
+    private readonly IMessageEncryptionService _encryption;
+    private readonly ILogger<ChatService> _logger;
+
+    public ChatService(
+        IServiceScopeFactory scopeFactory,
+        PresenceTracker presenceTracker,
+        IEnumerable<IChatBroadcaster> broadcasters,
+        LinkEmbedService embedService,
+        IMessageEncryptionService encryption,
+        ILogger<ChatService> logger)
+    {
+        _scopeFactory = scopeFactory;
+        _presenceTracker = presenceTracker;
+        _broadcasters = broadcasters;
+        _embedService = embedService;
+        _encryption = encryption;
+        _logger = logger;
+    }
+
+    public async Task UserConnectedAsync(string connectionId, Guid userId, string username)
+    {
+        _presenceTracker.UserConnected(connectionId, userId, username);
+
+        using var scope = _scopeFactory.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<EchoHubDbContext>();
+
+        var user = await db.Users.FindAsync(userId);
+        if (user is not null)
+        {
+            user.LastSeenAt = DateTimeOffset.UtcNow;
+            user.Status = UserStatus.Online;
+            await db.SaveChangesAsync();
+        }
+
+        _logger.LogInformation("{User} connected (ConnectionId: {ConnectionId})", username, connectionId);
+    }
+
+    public async Task<string?> UserDisconnectedAsync(string connectionId)
+    {
+        var preDisconnectUsername = _presenceTracker.GetUsernameForConnection(connectionId);
+        var channelsBeforeDisconnect = preDisconnectUsername is not null
+            ? _presenceTracker.GetChannelsForUser(preDisconnectUsername)
+            : [];
+
+        var username = _presenceTracker.UserDisconnected(connectionId);
+
+        if (username is not null && !_presenceTracker.IsOnline(username))
+        {
+            using var scope = _scopeFactory.CreateScope();
+            var db = scope.ServiceProvider.GetRequiredService<EchoHubDbContext>();
+
+            var user = await db.Users.FirstOrDefaultAsync(u => u.Username == username);
+            if (user is not null)
+            {
+                user.LastSeenAt = DateTimeOffset.UtcNow;
+                user.Status = UserStatus.Invisible;
+                await db.SaveChangesAsync();
+
+                var presence = new UserPresenceDto(
+                    username,
+                    user.DisplayName,
+                    user.NicknameColor,
+                    UserStatus.Invisible,
+                    user.StatusMessage,
+                    user.Role);
+
+                await BroadcastToAllAsync(b => b.SendUserStatusChangedAsync(channelsBeforeDisconnect, presence));
+            }
+        }
+
+        _logger.LogInformation("{User} disconnected (ConnectionId: {ConnectionId})", username ?? "Unknown", connectionId);
+        return username;
+    }
+
+    public async Task<(List<MessageDto> History, string? Error)> JoinChannelAsync(
+        string connectionId, Guid userId, string username, string channelName)
+    {
+        channelName = channelName.ToLowerInvariant().Trim();
+
+        if (!ValidationConstants.ChannelNameRegex().IsMatch(channelName))
+            return ([], "Invalid channel name. Use 2-100 characters: letters, digits, underscores, or hyphens.");
+
+        using var scope = _scopeFactory.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<EchoHubDbContext>();
+
+        var channel = await db.Channels.FirstOrDefaultAsync(c => c.Name == channelName);
+        if (channel is null)
+            return ([], $"Channel '{channelName}' does not exist. Create it first via the channel list.");
+
+        // Persist membership so the channel shows in the user's channel list
+        var hasMembership = await db.ChannelMemberships
+            .AnyAsync(m => m.UserId == userId && m.ChannelId == channel.Id);
+        if (!hasMembership)
+        {
+            db.ChannelMemberships.Add(new ChannelMembership
+            {
+                UserId = userId,
+                ChannelId = channel.Id,
+            });
+            await db.SaveChangesAsync();
+        }
+
+        var isNewJoin = _presenceTracker.JoinChannel(username, channelName);
+
+        if (isNewJoin)
+        {
+            await BroadcastToAllAsync(b => b.SendUserJoinedAsync(channelName, username, connectionId));
+            _logger.LogInformation("{User} joined channel '{Channel}'", username, channelName);
+        }
+
+        var history = await GetChannelHistoryInternalAsync(db, channelName, HubConstants.DefaultHistoryCount);
+        return (history, null);
+    }
+
+    public async Task LeaveChannelAsync(string connectionId, string username, string channelName)
+    {
+        channelName = channelName.ToLowerInvariant().Trim();
+        _presenceTracker.LeaveChannel(username, channelName);
+        await BroadcastToAllAsync(b => b.SendUserLeftAsync(channelName, username));
+        _logger.LogInformation("{User} left channel '{Channel}'", username, channelName);
+    }
+
+    public async Task<string?> SendMessageAsync(Guid userId, string username, string channelName, string content)
+    {
+        channelName = channelName.ToLowerInvariant().Trim();
+
+        if (!ValidationConstants.ChannelNameRegex().IsMatch(channelName))
+            return "Invalid channel name.";
+
+        // Decrypt content (client sends encrypted; IRC sends plaintext — Decrypt handles both)
+        var plaintext = _encryption.Decrypt(content);
+
+        // Strip encryption prefix if a user typed it literally (prevents spoofing)
+        while (plaintext.StartsWith("$ENC$"))
+            plaintext = plaintext["$ENC$".Length..];
+
+        if (string.IsNullOrWhiteSpace(plaintext))
+            return "Message content cannot be empty.";
+
+        if (plaintext.Length > HubConstants.MaxMessageLength)
+            return $"Message exceeds maximum length of {HubConstants.MaxMessageLength} characters.";
+
+        // Sanitize on plaintext: collapse excessive newlines
+        plaintext = SanitizeNewlines(plaintext);
+
+        using var scope = _scopeFactory.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<EchoHubDbContext>();
+
+        var channel = await db.Channels.FirstOrDefaultAsync(c => c.Name == channelName);
+        if (channel is null)
+            return $"Channel '{channelName}' does not exist.";
+
+        var sender = await db.Users.FindAsync(userId);
+
+        // Check mute status
+        if (sender is not null && sender.IsMuted)
+        {
+            if (sender.MutedUntil.HasValue && sender.MutedUntil.Value <= DateTimeOffset.UtcNow)
+            {
+                sender.IsMuted = false;
+                sender.MutedUntil = null;
+                await db.SaveChangesAsync();
+            }
+            else
+            {
+                return "You are muted and cannot send messages.";
+            }
+        }
+
+        // Attempt to fetch link embeds for URLs in the plaintext message
+        List<EmbedDto>? embeds = null;
+        try
+        {
+            embeds = await _embedService.TryGetEmbedsAsync(plaintext);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "Failed to fetch link embeds for message in '{Channel}'", channelName);
+        }
+
+        // Store in DB — encrypted at rest if enabled, plaintext otherwise
+        var embedJson = embeds is not null ? JsonSerializer.Serialize(embeds) : null;
+        var dbContent = _encryption.EncryptDatabaseEnabled ? _encryption.Encrypt(plaintext) : plaintext;
+        var dbEmbedJson = _encryption.EncryptDatabaseEnabled ? _encryption.EncryptNullable(embedJson) : embedJson;
+
+        var message = new Message
+        {
+            Id = Guid.NewGuid(),
+            Content = dbContent,
+            Type = MessageType.Text,
+            SentAt = DateTimeOffset.UtcNow,
+            ChannelId = channel.Id,
+            SenderUserId = userId,
+            SenderUsername = username,
+            EmbedJson = dbEmbedJson,
+        };
+
+        db.Messages.Add(message);
+        await db.SaveChangesAsync();
+
+        // Broadcast encrypted for SignalR clients; IRC broadcaster gets plaintext
+        var encryptedContent = _encryption.Encrypt(plaintext);
+        var messageDto = new MessageDto(
+            message.Id,
+            encryptedContent,
+            message.SenderUsername,
+            sender?.NicknameColor,
+            channelName,
+            MessageType.Text,
+            null,
+            null,
+            message.SentAt,
+            embeds);
+
+        await BroadcastToAllAsync(b => b.SendMessageToChannelAsync(channelName, messageDto));
+
+        _logger.LogDebug("{User} sent message in '{Channel}'", username, channelName);
+        return null;
+    }
+
+    public async Task<List<MessageDto>> GetChannelHistoryAsync(string channelName, int count)
+    {
+        channelName = channelName.ToLowerInvariant().Trim();
+        count = Math.Clamp(count, 1, ValidationConstants.MaxHistoryCount);
+
+        using var scope = _scopeFactory.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<EchoHubDbContext>();
+
+        return await GetChannelHistoryInternalAsync(db, channelName, count);
+    }
+
+    public async Task<string?> UpdateStatusAsync(Guid userId, string username, UserStatus status, string? statusMessage)
+    {
+        if (statusMessage is not null && statusMessage.Length > ValidationConstants.MaxStatusMessageLength)
+            return $"Status message must not exceed {ValidationConstants.MaxStatusMessageLength} characters.";
+
+        using var scope = _scopeFactory.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<EchoHubDbContext>();
+
+        var user = await db.Users.FindAsync(userId);
+        if (user is null)
+            return "User not found.";
+
+        user.Status = status;
+        user.StatusMessage = statusMessage?.Trim();
+        user.LastSeenAt = DateTimeOffset.UtcNow;
+        await db.SaveChangesAsync();
+
+        var presence = new UserPresenceDto(
+            user.Username,
+            user.DisplayName,
+            user.NicknameColor,
+            status,
+            statusMessage,
+            user.Role);
+
+        var channels = _presenceTracker.GetChannelsForUser(username);
+        await BroadcastToAllAsync(b => b.SendUserStatusChangedAsync(channels, presence));
+
+        return null;
+    }
+
+    public async Task<List<UserPresenceDto>> GetOnlineUsersAsync(string channelName)
+    {
+        channelName = channelName.ToLowerInvariant().Trim();
+        var onlineUsernames = _presenceTracker.GetOnlineUsersInChannel(channelName);
+
+        using var scope = _scopeFactory.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<EchoHubDbContext>();
+
+        return await db.Users
+            .Where(u => onlineUsernames.Contains(u.Username))
+            .Select(u => new UserPresenceDto(
+                u.Username,
+                u.DisplayName,
+                u.NicknameColor,
+                u.Status,
+                u.StatusMessage,
+                u.Role))
+            .ToListAsync();
+    }
+
+    public Task BroadcastMessageAsync(string channelName, MessageDto message)
+        => BroadcastToAllAsync(b => b.SendMessageToChannelAsync(channelName, message));
+
+    public Task BroadcastChannelUpdatedAsync(ChannelDto channel, string? channelName = null)
+        => BroadcastToAllAsync(b => b.SendChannelUpdatedAsync(channel, channelName));
+
+    private async Task BroadcastToAllAsync(Func<IChatBroadcaster, Task> action)
+    {
+        foreach (var broadcaster in _broadcasters)
+        {
+            try
+            {
+                await action(broadcaster);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "Broadcaster {Type} failed", broadcaster.GetType().Name);
+            }
+        }
+    }
+
+    public async Task<UserProfileDto?> GetUserProfileAsync(string username)
+    {
+        username = username.ToLowerInvariant();
+
+        using var scope = _scopeFactory.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<EchoHubDbContext>();
+
+        var user = await db.Users.FirstOrDefaultAsync(u => u.Username == username);
+        if (user is null) return null;
+
+        return new UserProfileDto(
+            user.Id, user.Username, user.DisplayName, user.Bio,
+            user.NicknameColor, user.AvatarAscii, user.Status,
+            user.StatusMessage, user.Role, user.CreatedAt, user.LastSeenAt);
+    }
+
+    public async Task<(string? Topic, bool Exists)> GetChannelTopicAsync(string channelName)
+    {
+        channelName = channelName.ToLowerInvariant().Trim();
+
+        using var scope = _scopeFactory.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<EchoHubDbContext>();
+
+        var channel = await db.Channels.FirstOrDefaultAsync(c => c.Name == channelName);
+        if (channel is null) return (null, false);
+
+        return (channel.Topic, true);
+    }
+
+    public async Task<List<ChannelListItem>> GetChannelListAsync()
+    {
+        using var scope = _scopeFactory.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<EchoHubDbContext>();
+
+        var channels = await db.Channels.OrderBy(c => c.Name).ToListAsync();
+
+        return channels.Select(c => new ChannelListItem(
+            c.Name,
+            c.Topic,
+            _presenceTracker.GetOnlineUsersInChannel(c.Name).Count)).ToList();
+    }
+
+    public Task<List<string>> GetChannelsForUserAsync(string username)
+        => Task.FromResult(_presenceTracker.GetChannelsForUser(username));
+
+    public async Task<(Guid UserId, string Username)?> AuthenticateUserAsync(string username, string password)
+    {
+        username = username.ToLowerInvariant();
+
+        using var scope = _scopeFactory.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<EchoHubDbContext>();
+
+        var user = await db.Users.FirstOrDefaultAsync(u => u.Username == username);
+        if (user is null) return null;
+
+        if (!BCrypt.Net.BCrypt.Verify(password, user.PasswordHash))
+            return null;
+
+        return (user.Id, user.Username);
+    }
+
+    /// <summary>
+    /// Collapse consecutive newlines and cap total line count to prevent newline spam.
+    /// </summary>
+    private static string SanitizeNewlines(string content)
+    {
+        // Normalize \r\n → \n
+        content = content.Replace("\r\n", "\n").Replace('\r', '\n');
+
+        // Collapse consecutive blank/whitespace-only lines into max 1 blank line
+        var lines = content.Split('\n');
+        var result = new List<string>(lines.Length);
+        int consecutiveBlanks = 0;
+
+        foreach (var line in lines)
+        {
+            if (string.IsNullOrWhiteSpace(line))
+            {
+                consecutiveBlanks++;
+                if (consecutiveBlanks <= HubConstants.MaxConsecutiveNewlines)
+                    result.Add(line);
+            }
+            else
+            {
+                consecutiveBlanks = 0;
+                result.Add(line);
+            }
+        }
+
+        // Cap total lines
+        if (result.Count > HubConstants.MaxMessageNewlines)
+            result = result.Take(HubConstants.MaxMessageNewlines).ToList();
+
+        return string.Join('\n', result);
+    }
+
+    private async Task<List<MessageDto>> GetChannelHistoryInternalAsync(EchoHubDbContext db, string channelName, int count)
+    {
+        var channel = await db.Channels.FirstOrDefaultAsync(c => c.Name == channelName);
+        if (channel is null)
+            return [];
+
+        var raw = await db.Messages
+            .Where(m => m.ChannelId == channel.Id)
+            .OrderByDescending(m => m.SentAt)
+            .Take(count)
+            .Join(db.Users,
+                m => m.SenderUserId,
+                u => u.Id,
+                (m, u) => new { m, u.NicknameColor })
+            .ToListAsync();
+
+        raw.Reverse();
+
+        return raw.Select(x =>
+        {
+            // Decrypt DB content (handles both encrypted and plaintext via prefix detection)
+            var plaintext = _encryption.Decrypt(x.m.Content);
+            var embedJsonPlain = _encryption.DecryptNullable(x.m.EmbedJson);
+
+            List<EmbedDto>? embeds = null;
+            if (embedJsonPlain is not null)
+            {
+                try { embeds = JsonSerializer.Deserialize<List<EmbedDto>>(embedJsonPlain); }
+                catch { /* ignore malformed JSON */ }
+            }
+
+            // Encrypt for transport — client decrypts
+            return new MessageDto(
+                x.m.Id,
+                _encryption.Encrypt(plaintext),
+                x.m.SenderUsername,
+                x.NicknameColor,
+                channelName,
+                x.m.Type,
+                x.m.AttachmentUrl,
+                x.m.AttachmentFileName,
+                x.m.SentAt,
+                embeds);
+        }).ToList();
+    }
+}

src/EchoHub.Server/Services/ImageToAsciiService.cs

@@ -8,47 +8,81 @@ namespace EchoHub.Server.Services;
 
 public class ImageToAsciiService
 {
-    private static readonly char[] AsciiChars = " .:-=+*#%@".ToCharArray();
+    /// <summary>
+    /// Returns (width, height) dimensions for the given size code.
+    /// s = small (40x40), m = medium/default (80x80), l = large (120x120).
+    /// </summary>
+    public static (int Width, int Height) GetDimensions(string? size) => size?.ToLowerInvariant() switch
+    {
+        "s" => (40, 40),
+        "l" => (120, 120),
+        _ => (HubConstants.AsciiArtWidth, HubConstants.AsciiArtHeightHalfBlock),
+    };
 
-    public string ConvertToAscii(Stream imageStream, int width = HubConstants.AsciiArtWidth, int height = HubConstants.AsciiArtHeight)
+    /// <summary>
+    /// Converts an image to ASCII art using half-block characters (▀▄█) with
+    /// printable color tags for 2x vertical resolution.
+    /// Each character cell represents two vertical pixels.
+    /// Format: {F:RRGGBB} foreground, {B:RRGGBB} background, {X} reset.
+    /// Uses only printable ASCII — no terminal escape bytes.
+    /// </summary>
+    public string ConvertToAscii(Stream imageStream, int width = HubConstants.AsciiArtWidth, int height = HubConstants.AsciiArtHeightHalfBlock)
     {
         using var image = Image.Load<Rgba32>(imageStream);
 
+        // Ensure height is even for pair processing
+        if (height % 2 != 0) height++;
+
         image.Mutate(x => x.Resize(width, height));
 
         var sb = new StringBuilder();
 
-        byte lastR = 0, lastG = 0, lastB = 0;
-        bool hasLastColor = false;
-
-        for (int y = 0; y < image.Height; y++)
+        for (int y = 0; y < image.Height; y += 2)
         {
+            byte lastFgR = 0, lastFgG = 0, lastFgB = 0;
+            byte lastBgR = 0, lastBgG = 0, lastBgB = 0;
+            bool hasLastColor = false;
+
             for (int x = 0; x < image.Width; x++)
             {
-                var pixel = image[x, y];
-                var brightness = 0.299 * pixel.R + 0.587 * pixel.G + 0.114 * pixel.B;
+                var topPixel = image[x, y];
+                var bottomPixel = (y + 1 < image.Height) ? image[x, y + 1] : topPixel;
 
-                // Map brightness (0-255) to ASCII char index
-                var index = (int)((brightness / 255.0) * (AsciiChars.Length - 1));
+                byte fgR, fgG, fgB, bgR, bgG, bgB;
+                char blockChar;
 
-                // Emit ANSI 24-bit color only when it changes
-                if (!hasLastColor || pixel.R != lastR || pixel.G != lastG || pixel.B != lastB)
+                if (topPixel.R == bottomPixel.R && topPixel.G == bottomPixel.G && topPixel.B == bottomPixel.B)
                 {
-                    sb.Append($"\x1b[38;2;{pixel.R};{pixel.G};{pixel.B}m");
-                    lastR = pixel.R;
-                    lastG = pixel.G;
-                    lastB = pixel.B;
-                    hasLastColor = true;
+                    fgR = topPixel.R; fgG = topPixel.G; fgB = topPixel.B;
+                    bgR = topPixel.R; bgG = topPixel.G; bgB = topPixel.B;
+                    blockChar = '\u2588'; // █
+                }
+                else
+                {
+                    fgR = topPixel.R; fgG = topPixel.G; fgB = topPixel.B;
+                    bgR = bottomPixel.R; bgG = bottomPixel.G; bgB = bottomPixel.B;
+                    blockChar = '\u2580'; // ▀
                 }
 
-                sb.Append(AsciiChars[index]);
+                bool fgChanged = !hasLastColor || fgR != lastFgR || fgG != lastFgG || fgB != lastFgB;
+                bool bgChanged = !hasLastColor || bgR != lastBgR || bgG != lastBgG || bgB != lastBgB;
+
+                if (fgChanged)
+                    sb.Append($"{{F:{fgR:X2}{fgG:X2}{fgB:X2}}}");
+                if (bgChanged)
+                    sb.Append($"{{B:{bgR:X2}{bgG:X2}{bgB:X2}}}");
+
+                sb.Append(blockChar);
+
+                lastFgR = fgR; lastFgG = fgG; lastFgB = fgB;
+                lastBgR = bgR; lastBgG = bgG; lastBgB = bgB;
+                hasLastColor = true;
             }
 
-            // Reset color at end of line
-            sb.Append("\x1b[0m");
+            sb.Append("{X}");
             hasLastColor = false;
 
-            if (y < image.Height - 1)
+            if (y + 2 < image.Height)
             {
                 sb.AppendLine();
             }

src/EchoHub.Server/Services/LinkEmbedService.cs

@@ -0,0 +1,216 @@
+using System.Net;
+using System.Text;
+using System.Text.RegularExpressions;
+using EchoHub.Core.Constants;
+using EchoHub.Core.DTOs;
+using Microsoft.Extensions.Logging;
+
+namespace EchoHub.Server.Services;
+
+public partial class LinkEmbedService
+{
+    private readonly IHttpClientFactory _httpClientFactory;
+    private readonly ILogger<LinkEmbedService> _logger;
+
+    public LinkEmbedService(
+        IHttpClientFactory httpClientFactory,
+        ILogger<LinkEmbedService> logger)
+    {
+        _httpClientFactory = httpClientFactory;
+        _logger = logger;
+    }
+
+    /// <summary>
+    /// Detect all URLs in message content and attempt to fetch OG embed data for each.
+    /// Returns null if no URLs found or all fetches fail.
+    /// Never throws — all errors are caught internally.
+    /// </summary>
+    public async Task<List<EmbedDto>?> TryGetEmbedsAsync(string content)
+    {
+        var urls = ExtractUrls(content);
+        if (urls.Count == 0)
+            return null;
+
+        var embeds = new List<EmbedDto>();
+
+        foreach (var url in urls)
+        {
+            try
+            {
+                var embed = await FetchEmbedForUrlAsync(url);
+                if (embed is not null)
+                    embeds.Add(embed);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogDebug(ex, "Failed to fetch embed for {Url}", url);
+            }
+        }
+
+        return embeds.Count > 0 ? embeds : null;
+    }
+
+    private async Task<EmbedDto?> FetchEmbedForUrlAsync(string url)
+    {
+        if (!Uri.TryCreate(url, UriKind.Absolute, out var uri))
+            return null;
+
+        if (uri.Scheme is not ("http" or "https"))
+            return null;
+
+        if (IsPrivateHost(uri))
+            return null;
+
+        using var cts = new CancellationTokenSource(
+            TimeSpan.FromSeconds(HubConstants.EmbedFetchTimeoutSeconds));
+
+        var client = _httpClientFactory.CreateClient("OgFetch");
+
+        using var request = new HttpRequestMessage(HttpMethod.Get, uri);
+        using var response = await client.SendAsync(request,
+            HttpCompletionOption.ResponseHeadersRead, cts.Token);
+
+        if (!response.IsSuccessStatusCode)
+            return null;
+
+        var contentType = response.Content.Headers.ContentType?.MediaType;
+        if (contentType is null || !contentType.StartsWith("text/html", StringComparison.OrdinalIgnoreCase))
+            return null;
+
+        var html = await ReadLimitedAsync(response, HubConstants.EmbedMaxHtmlBytes, cts.Token);
+        if (string.IsNullOrWhiteSpace(html))
+            return null;
+
+        var ogTags = ParseOgTags(html);
+
+        // Try og:title, fallback to <title> tag
+        var title = ogTags.GetValueOrDefault("title");
+        if (string.IsNullOrWhiteSpace(title))
+        {
+            var titleMatch = TitleTagRegex().Match(html);
+            if (titleMatch.Success)
+                title = WebUtility.HtmlDecode(titleMatch.Groups[1].Value.Trim());
+        }
+
+        // If no title at all, nothing useful to show
+        if (string.IsNullOrWhiteSpace(title))
+            return null;
+
+        var siteName = ogTags.GetValueOrDefault("site_name");
+        var description = ogTags.GetValueOrDefault("description");
+
+        // Truncate very long descriptions but keep a generous limit
+        if (description is not null && description.Length > HubConstants.EmbedMaxDescriptionLength)
+            description = description[..(HubConstants.EmbedMaxDescriptionLength - 3)] + "...";
+
+        // HTML decode text fields
+        title = WebUtility.HtmlDecode(title);
+        siteName = siteName is not null ? WebUtility.HtmlDecode(siteName) : null;
+        description = description is not null ? WebUtility.HtmlDecode(description) : null;
+
+        return new EmbedDto(siteName, title, description, null, url);
+    }
+
+    private static List<string> ExtractUrls(string content)
+    {
+        var urls = new List<string>();
+
+        foreach (Match match in UrlRegex().Matches(content))
+        {
+            var url = match.Value.TrimEnd('.', ',', '!', '?', ')', ']', ';', ':');
+            if (!urls.Contains(url))
+                urls.Add(url);
+
+            if (urls.Count >= HubConstants.EmbedMaxUrlsPerMessage)
+                break;
+        }
+
+        return urls;
+    }
+
+    private static bool IsPrivateHost(Uri uri)
+    {
+        if (uri.IsLoopback)
+            return true;
+
+        if (IPAddress.TryParse(uri.Host, out var ip))
+        {
+            var bytes = ip.GetAddressBytes();
+            if (bytes.Length == 4)
+            {
+                if (bytes[0] == 10) return true;
+                if (bytes[0] == 172 && bytes[1] >= 16 && bytes[1] <= 31) return true;
+                if (bytes[0] == 192 && bytes[1] == 168) return true;
+                if (bytes[0] == 127) return true;
+                if (bytes[0] == 0) return true;
+            }
+        }
+
+        // Also check hostname-based loopback
+        if (uri.Host.Equals("localhost", StringComparison.OrdinalIgnoreCase))
+            return true;
+
+        return false;
+    }
+
+    private static Dictionary<string, string> ParseOgTags(string html)
+    {
+        var tags = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+
+        // Match: <meta property="og:key" content="value" />
+        // Groups: 1=prop quote, 2=key, 3=content quote, 4=value
+        foreach (Match match in OgTagRegex().Matches(html))
+        {
+            var key = match.Groups[2].Value;
+            var value = match.Groups[4].Value;
+            tags.TryAdd(key, value);
+        }
+
+        // Match reversed order: <meta content="value" property="og:key" />
+        // Groups: 1=content quote, 2=value, 3=prop quote, 4=key
+        foreach (Match match in OgTagReversedRegex().Matches(html))
+        {
+            var value = match.Groups[2].Value;
+            var key = match.Groups[4].Value;
+            tags.TryAdd(key, value);
+        }
+
+        return tags;
+    }
+
+    private static async Task<string> ReadLimitedAsync(HttpResponseMessage response, int maxBytes, CancellationToken ct)
+    {
+        await using var stream = await response.Content.ReadAsStreamAsync(ct);
+        var buffer = new byte[maxBytes];
+        var totalRead = 0;
+
+        while (totalRead < maxBytes)
+        {
+            var read = await stream.ReadAsync(buffer.AsMemory(totalRead, maxBytes - totalRead), ct);
+            if (read == 0) break;
+            totalRead += read;
+        }
+
+        // Try to detect encoding from Content-Type, default to UTF-8
+        var charset = response.Content.Headers.ContentType?.CharSet;
+        var encoding = charset is not null
+            ? Encoding.GetEncoding(charset)
+            : Encoding.UTF8;
+
+        return encoding.GetString(buffer, 0, totalRead);
+    }
+
+    [GeneratedRegex(@"https?://[^\s<>""')\]]+", RegexOptions.IgnoreCase | RegexOptions.Compiled)]
+    private static partial Regex UrlRegex();
+
+    [GeneratedRegex(@"<meta\s+[^>]*?property\s*=\s*([""'])og:(\w+)\1[^>]*?content\s*=\s*([""'])(.*?)\3[^>]*/?>",
+        RegexOptions.IgnoreCase | RegexOptions.Singleline | RegexOptions.Compiled)]
+    private static partial Regex OgTagRegex();
+
+    [GeneratedRegex(@"<meta\s+[^>]*?content\s*=\s*([""'])(.*?)\1[^>]*?property\s*=\s*([""'])og:(\w+)\3[^>]*/?>",
+        RegexOptions.IgnoreCase | RegexOptions.Singleline | RegexOptions.Compiled)]
+    private static partial Regex OgTagReversedRegex();
+
+    [GeneratedRegex(@"<title[^>]*>([^<]+)</title>", RegexOptions.IgnoreCase | RegexOptions.Compiled)]
+    private static partial Regex TitleTagRegex();
+}

src/EchoHub.Server/Services/MessageEncryptionService.cs

@@ -0,0 +1,102 @@
+using System.Security.Cryptography;
+using System.Text;
+using EchoHub.Core.Contracts;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Logging;
+
+namespace EchoHub.Server.Services;
+
+public class MessageEncryptionService : IMessageEncryptionService
+{
+    private const string EncryptionPrefix = "$ENC$v1$";
+    private const int NonceSizeBytes = 12;
+    private const int TagSizeBytes = 16;
+
+    private readonly byte[] _key;
+    private readonly ILogger<MessageEncryptionService> _logger;
+
+    public bool EncryptDatabaseEnabled { get; }
+
+    public MessageEncryptionService(IConfiguration configuration, ILogger<MessageEncryptionService> logger)
+    {
+        _logger = logger;
+
+        var keyBase64 = configuration["Encryption:Key"]
+            ?? throw new InvalidOperationException("Encryption:Key must be configured in appsettings.json.");
+
+        _key = Convert.FromBase64String(keyBase64);
+
+        if (_key.Length != 32)
+            throw new InvalidOperationException($"Encryption:Key must be exactly 32 bytes (256-bit). Got {_key.Length} bytes.");
+
+        EncryptDatabaseEnabled = configuration.GetValue<bool>("Encryption:EncryptDatabase");
+    }
+
+    public string Encrypt(string plaintext)
+    {
+        var plaintextBytes = Encoding.UTF8.GetBytes(plaintext);
+        var nonce = RandomNumberGenerator.GetBytes(NonceSizeBytes);
+        var ciphertext = new byte[plaintextBytes.Length];
+        var tag = new byte[TagSizeBytes];
+
+        using var aes = new AesGcm(_key, TagSizeBytes);
+        aes.Encrypt(nonce, plaintextBytes, ciphertext, tag);
+
+        // Combine ciphertext + tag for storage
+        var combined = new byte[ciphertext.Length + tag.Length];
+        Buffer.BlockCopy(ciphertext, 0, combined, 0, ciphertext.Length);
+        Buffer.BlockCopy(tag, 0, combined, ciphertext.Length, tag.Length);
+
+        return $"{EncryptionPrefix}{Convert.ToBase64String(nonce)}${Convert.ToBase64String(combined)}";
+    }
+
+    public string Decrypt(string content)
+    {
+        if (!content.StartsWith(EncryptionPrefix))
+            return content; // Legacy plaintext
+
+        try
+        {
+            var payload = content[EncryptionPrefix.Length..];
+            var separatorIndex = payload.IndexOf('$');
+            if (separatorIndex < 0)
+            {
+                _logger.LogWarning("Malformed encrypted content: missing separator");
+                return "[encrypted message — decryption failed]";
+            }
+
+            var nonceBase64 = payload[..separatorIndex];
+            var combinedBase64 = payload[(separatorIndex + 1)..];
+
+            var nonce = Convert.FromBase64String(nonceBase64);
+            var combined = Convert.FromBase64String(combinedBase64);
+
+            if (combined.Length < TagSizeBytes)
+            {
+                _logger.LogWarning("Malformed encrypted content: data too short");
+                return "[encrypted message — decryption failed]";
+            }
+
+            var ciphertextLength = combined.Length - TagSizeBytes;
+            var ciphertext = combined.AsSpan(0, ciphertextLength);
+            var tag = combined.AsSpan(ciphertextLength, TagSizeBytes);
+            var plaintext = new byte[ciphertextLength];
+
+            using var aes = new AesGcm(_key, TagSizeBytes);
+            aes.Decrypt(nonce, ciphertext, tag, plaintext);
+
+            return Encoding.UTF8.GetString(plaintext);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to decrypt message content");
+            return "[encrypted message — decryption failed]";
+        }
+    }
+
+    public string? EncryptNullable(string? value)
+        => value is null ? null : Encrypt(value);
+
+    public string? DecryptNullable(string? value)
+        => value is null ? null : Decrypt(value);
+}

src/EchoHub.Server/Services/PresenceTracker.cs

@@ -137,6 +137,11 @@ public class PresenceTracker
         }
     }
 
+    public string? GetUsernameForConnection(string connectionId)
+    {
+        return _connections.TryGetValue(connectionId, out var info) ? info.username : null;
+    }
+
     public bool IsOnline(string username)
     {
         return _userConnections.TryGetValue(username, out var connections) && connections.Count > 0;
@@ -146,4 +151,27 @@ public class PresenceTracker
     {
         return _userConnections.Count;
     }
+
+    /// <summary>
+    /// Forcibly remove a user from all tracking. Returns their connection IDs and channels
+    /// so the caller can broadcast departures and force-disconnect connections.
+    /// </summary>
+    public (List<string> ConnectionIds, List<string> Channels) ForceRemoveUser(string username)
+    {
+        lock (_lock)
+        {
+            var channels = _userChannels.TryRemove(username, out var ch)
+                ? ch.ToList()
+                : [];
+
+            var connectionIds = _userConnections.TryRemove(username, out var conns)
+                ? conns.ToList()
+                : [];
+
+            foreach (var connId in connectionIds)
+                _connections.TryRemove(connId, out _);
+
+            return (connectionIds, channels);
+        }
+    }
 }

src/EchoHub.Server/Services/ServerDirectoryService.cs

@@ -2,107 +2,193 @@ using Microsoft.AspNetCore.SignalR.Client;
 
 namespace EchoHub.Server.Services;
 
-public sealed class ServerDirectoryService(
-    IConfiguration configuration,
-    PresenceTracker presenceTracker,
-    ILogger<ServerDirectoryService> logger) : BackgroundService
+public sealed class ServerDirectoryService : BackgroundService
 {
     private const string DirectoryHubUrl = "https://echohub.voidcube.cloud/hubs/servers";
     private static readonly TimeSpan UpdateInterval = TimeSpan.FromSeconds(30);
+    private static readonly TimeSpan ReconnectBaseDelay = TimeSpan.FromSeconds(2);
+    private static readonly TimeSpan ReconnectMaxDelay = TimeSpan.FromSeconds(30);
+
+    private readonly IConfiguration _configuration;
+    private readonly PresenceTracker _presenceTracker;
+    private readonly ILogger<ServerDirectoryService> _logger;
 
     private HubConnection? _connection;
     private int _lastReportedUserCount = -1;
 
+    public ServerDirectoryService(
+        IConfiguration configuration,
+        PresenceTracker presenceTracker,
+        ILogger<ServerDirectoryService> logger)
+    {
+        _configuration = configuration;
+        _presenceTracker = presenceTracker;
+        _logger = logger;
+    }
+
     protected override async Task ExecuteAsync(CancellationToken stoppingToken)
     {
         // Yield to let the host finish starting before we log or connect
         await Task.Yield();
 
-        var isPublic = configuration.GetValue<bool>("Server:PublicServer");
+        var isPublic = _configuration.GetValue<bool>("Server:PublicServer");
         if (!isPublic)
         {
-            logger.LogInformation("PublicServer is disabled — not registering with directory");
+            _logger.LogInformation("PublicServer is disabled — not registering with directory");
             return;
         }
 
-        var host = configuration["Server:PublicHost"];
+        var host = _configuration["Server:PublicHost"];
 
         if (string.IsNullOrWhiteSpace(host))
         {
-            logger.LogWarning("PublicServer is enabled but Server:PublicHost is not set — skipping directory registration");
+            _logger.LogWarning("PublicServer is enabled but Server:PublicHost is not set — skipping directory registration");
             return;
         }
 
-        var serverName = configuration["Server:Name"] ?? "EchoHub Server";
-        var description = configuration["Server:Description"];
+        var serverName = _configuration["Server:Name"] ?? "EchoHub Server";
+        var description = _configuration["Server:Description"];
 
-        logger.LogInformation("PublicServer is enabled — connecting to EchoHubSpace directory as {Name} ({Host})", serverName, host);
+        _logger.LogInformation("PublicServer is enabled — connecting to EchoHubSpace directory as {Name} ({Host})", serverName, host);
 
-        _connection = new HubConnectionBuilder()
+        // Outer loop: rebuilds the connection if automatic reconnect permanently fails
+        while (!stoppingToken.IsCancellationRequested)
+        {
+            var connection = BuildConnection();
+            _connection = connection;
+
+            try
+            {
+                var connectionPermanentlyClosed = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+
+                connection.On("Ping", async () =>
+                {
+                    _logger.LogDebug("Received alive check from directory — sending heartbeat");
+                    try
+                    {
+                        await connection.InvokeAsync("Heartbeat");
+                    }
+                    catch (Exception ex)
+                    {
+                        _logger.LogWarning(ex, "Failed to send heartbeat response");
+                    }
+                });
+
+                connection.Reconnected += async _ =>
+                {
+                    _logger.LogInformation("Reconnected to directory — re-registering server");
+                    _lastReportedUserCount = -1;
+                    await RegisterAsync(serverName, description, host);
+                };
+
+                connection.Closed += ex =>
+                {
+                    if (ex is not null)
+                        _logger.LogWarning(ex, "Directory connection permanently closed — will rebuild");
+                    else
+                        _logger.LogWarning("Directory connection permanently closed — will rebuild");
+
+                    connectionPermanentlyClosed.TrySetResult();
+                    return Task.CompletedTask;
+                };
+
+                // Connect with retry
+                if (!await ConnectWithRetryAsync(connection, stoppingToken))
+                    return;
+
+                _logger.LogInformation("Successfully connected to EchoHubSpace API at {Url}", DirectoryHubUrl);
+                await RegisterAsync(serverName, description, host);
+
+                // Poll user count until the connection is permanently closed or cancellation
+                await PollUserCountAsync(connection, connectionPermanentlyClosed.Task, stoppingToken);
+
+                if (stoppingToken.IsCancellationRequested)
+                    return;
+
+                // Connection was permanently closed — wait briefly then rebuild
+                _logger.LogInformation("Rebuilding directory connection...");
+                await Task.Delay(ReconnectBaseDelay, stoppingToken);
+            }
+            catch (OperationCanceledException) when (stoppingToken.IsCancellationRequested)
+            {
+                return;
+            }
+            finally
+            {
+                _connection = null;
+                await DisposeConnectionAsync(connection);
+            }
+        }
+    }
+
+    private HubConnection BuildConnection()
+    {
+        return new HubConnectionBuilder()
             .WithUrl(DirectoryHubUrl)
-            .WithAutomaticReconnect()
+            .WithAutomaticReconnect(new InfiniteRetryPolicy())
             .Build();
+    }
 
-        _connection.Reconnected += async _ =>
-        {
-            logger.LogInformation("Reconnected to directory — re-registering server");
-            await RegisterAsync(serverName, description, host);
-        };
-
-        _connection.Closed += ex =>
-        {
-            if (ex is not null)
-                logger.LogWarning(ex, "Directory connection closed with error");
-            return Task.CompletedTask;
-        };
-
-        // Initial connection with retry
-        while (!stoppingToken.IsCancellationRequested)
+    private async Task<bool> ConnectWithRetryAsync(HubConnection connection, CancellationToken ct)
+    {
+        var attempt = 0;
+        while (!ct.IsCancellationRequested)
         {
             try
             {
-                await _connection.StartAsync(stoppingToken);
-                logger.LogInformation("Successfully connected to EchoHubSpace API at {Url}", DirectoryHubUrl);
-                break;
+                await connection.StartAsync(ct);
+                return true;
             }
             catch (Exception ex)
             {
-                logger.LogWarning(ex, "Failed to connect to directory — retrying in 30s");
-                await Task.Delay(UpdateInterval, stoppingToken);
+                attempt++;
+                var delay = GetBackoffDelay(attempt);
+                _logger.LogWarning(ex, "Failed to connect to directory — retrying in {Delay}s", delay.TotalSeconds);
+                await Task.Delay(delay, ct);
             }
         }
 
-        if (stoppingToken.IsCancellationRequested)
-            return;
+        return false;
+    }
 
-        // Register on first connect
-        await RegisterAsync(serverName, description, host);
-
-        // Poll user count and send updates
-        while (!stoppingToken.IsCancellationRequested)
+    private async Task PollUserCountAsync(HubConnection connection, Task connectionClosed, CancellationToken ct)
+    {
+        while (!ct.IsCancellationRequested)
         {
-            await Task.Delay(UpdateInterval, stoppingToken);
+            var delayTask = Task.Delay(UpdateInterval, ct);
+            var completed = await Task.WhenAny(delayTask, connectionClosed);
 
-            if (_connection.State != HubConnectionState.Connected)
+            if (completed == connectionClosed)
+                return;
+
+            // Observe the delay task (may throw if cancelled)
+            try { await delayTask; }
+            catch (OperationCanceledException) { return; }
+
+            if (connection.State != HubConnectionState.Connected)
                 continue;
 
-            var currentCount = presenceTracker.GetOnlineUserCount();
-            if (currentCount == _lastReportedUserCount)
-                continue;
+            var currentCount = _presenceTracker.GetOnlineUserCount();
 
             try
             {
-                await _connection.InvokeAsync("UpdateUserCount", currentCount, stoppingToken);
+                await connection.InvokeAsync("UpdateUserCount", currentCount, ct);
                 _lastReportedUserCount = currentCount;
-                logger.LogDebug("Updated directory user count to {Count}", currentCount);
+                _logger.LogDebug("Updated directory user count to {Count}", currentCount);
             }
             catch (Exception ex)
             {
-                logger.LogWarning(ex, "Failed to update user count on directory");
+                _logger.LogWarning(ex, "Failed to update user count on directory");
             }
         }
     }
 
+    private static TimeSpan GetBackoffDelay(int attempt)
+    {
+        var delay = TimeSpan.FromSeconds(Math.Pow(2, Math.Min(attempt, 10)));
+        return delay > ReconnectMaxDelay ? ReconnectMaxDelay : delay;
+    }
+
     private async Task RegisterAsync(string name, string? description, string host)
     {
         if (_connection?.State != HubConnectionState.Connected)
@@ -110,27 +196,47 @@ public sealed class ServerDirectoryService(
 
         try
         {
-            var userCount = presenceTracker.GetOnlineUserCount();
+            var userCount = _presenceTracker.GetOnlineUserCount();
             var dto = new RegisterServerDto(name, description, host, userCount);
             await _connection.InvokeAsync("RegisterServer", dto);
             _lastReportedUserCount = userCount;
-            logger.LogInformation("Registered with directory as {Name} at {Host}", name, host);
+            _logger.LogInformation("Registered with directory as {Name} at {Host}", name, host);
         }
         catch (Exception ex)
         {
-            logger.LogWarning(ex, "Failed to register with directory");
+            _logger.LogWarning(ex, "Failed to register with directory");
+        }
+    }
+
+    private static async Task DisposeConnectionAsync(HubConnection connection)
+    {
+        try
+        {
+            await connection.DisposeAsync()
+                .AsTask().WaitAsync(TimeSpan.FromSeconds(3));
+        }
+        catch
+        {
+            // Don't let a slow dispose block shutdown
         }
     }
 
     public override async Task StopAsync(CancellationToken cancellationToken)
     {
-        if (_connection is not null)
-        {
-            await _connection.DisposeAsync();
-            _connection = null;
-        }
-
         await base.StopAsync(cancellationToken);
+        _connection = null;
+    }
+
+    /// <summary>
+    /// Retries indefinitely with exponential backoff capped at 30 seconds.
+    /// </summary>
+    private sealed class InfiniteRetryPolicy : IRetryPolicy
+    {
+        public TimeSpan? NextRetryDelay(RetryContext retryContext)
+        {
+            var delay = TimeSpan.FromSeconds(Math.Pow(2, Math.Min(retryContext.PreviousRetryCount, 10)));
+            return delay > ReconnectMaxDelay ? ReconnectMaxDelay : delay;
+        }
     }
 }
 

src/EchoHub.Server/Services/SignalRBroadcaster.cs

@@ -0,0 +1,85 @@
+using EchoHub.Core.Contracts;
+using EchoHub.Core.DTOs;
+using EchoHub.Server.Hubs;
+using Microsoft.AspNetCore.SignalR;
+
+namespace EchoHub.Server.Services;
+
+public class SignalRBroadcaster : IChatBroadcaster
+{
+    private readonly IServiceProvider _serviceProvider;
+    private readonly PresenceTracker _presenceTracker;
+    private IHubContext<ChatHub, IEchoHubClient>? _hubContext;
+
+    private IHubContext<ChatHub, IEchoHubClient> HubContext
+        => _hubContext ??= _serviceProvider.GetRequiredService<IHubContext<ChatHub, IEchoHubClient>>();
+
+    public SignalRBroadcaster(IServiceProvider serviceProvider, PresenceTracker presenceTracker)
+    {
+        _serviceProvider = serviceProvider;
+        _presenceTracker = presenceTracker;
+    }
+
+    public Task SendMessageToChannelAsync(string channelName, MessageDto message)
+        => HubContext.Clients.Group(channelName).ReceiveMessage(message);
+
+    public Task SendUserJoinedAsync(string channelName, string username, string? excludeConnectionId = null)
+    {
+        if (excludeConnectionId is not null && !excludeConnectionId.StartsWith("irc-"))
+            return HubContext.Clients.GroupExcept(channelName, [excludeConnectionId]).UserJoined(channelName, username);
+
+        return HubContext.Clients.Group(channelName).UserJoined(channelName, username);
+    }
+
+    public Task SendUserLeftAsync(string channelName, string username)
+        => HubContext.Clients.Group(channelName).UserLeft(channelName, username);
+
+    public Task SendChannelUpdatedAsync(ChannelDto channel, string? channelName = null)
+    {
+        if (channelName is not null)
+            return HubContext.Clients.Group(channelName).ChannelUpdated(channel);
+
+        return HubContext.Clients.All.ChannelUpdated(channel);
+    }
+
+    public Task SendUserStatusChangedAsync(List<string> channelNames, UserPresenceDto presence)
+    {
+        var connections = _presenceTracker.GetConnectionsInChannels(channelNames)
+            .Where(c => !c.StartsWith("irc-"))
+            .ToList();
+
+        if (connections.Count == 0)
+            return Task.CompletedTask;
+
+        return HubContext.Clients.Clients(connections).UserStatusChanged(presence);
+    }
+
+    public Task SendUserKickedAsync(string channelName, string username, string? reason)
+        => HubContext.Clients.Group(channelName).UserKicked(channelName, username, reason);
+
+    public Task SendUserBannedAsync(string username, string? reason)
+        => HubContext.Clients.All.UserBanned(username, reason);
+
+    public Task SendMessageDeletedAsync(string channelName, Guid messageId)
+        => HubContext.Clients.Group(channelName).MessageDeleted(channelName, messageId);
+
+    public Task SendChannelNukedAsync(string channelName)
+        => HubContext.Clients.Group(channelName).ChannelNuked(channelName);
+
+    public Task SendErrorAsync(string connectionId, string message)
+    {
+        if (connectionId.StartsWith("irc-"))
+            return Task.CompletedTask;
+
+        return HubContext.Clients.Client(connectionId).Error(message);
+    }
+
+    public Task ForceDisconnectUserAsync(List<string> connectionIds, string reason)
+    {
+        var signalRIds = connectionIds.Where(c => !c.StartsWith("irc-")).ToList();
+        if (signalRIds.Count == 0)
+            return Task.CompletedTask;
+
+        return HubContext.Clients.Clients(signalRIds).ForceDisconnect(reason);
+    }
+}

src/EchoHub.Server/Setup/DataMigrationService.cs

@@ -0,0 +1,140 @@
+using System.Text.RegularExpressions;
+using EchoHub.Core.Constants;
+using EchoHub.Core.DTOs;
+using EchoHub.Server.Data;
+using Microsoft.EntityFrameworkCore;
+
+namespace EchoHub.Server.Setup;
+
+public static partial class DataMigrationService
+{
+    public static async Task RunAsync(IServiceProvider services)
+    {
+        using var scope = services.CreateScope();
+        var db = scope.ServiceProvider.GetRequiredService<EchoHubDbContext>();
+        var logger = scope.ServiceProvider.GetRequiredService<ILoggerFactory>()
+            .CreateLogger("EchoHub.Server.Setup.DataMigration");
+
+        await EnsureDefaultChannelsPublicAsync(db, logger);
+        await MigrateAnsiMessagesAsync(db, logger);
+        await MigrateEmbedJsonToArrayAsync(db, logger);
+    }
+
+    /// <summary>
+    /// Ensure the #general channel (and any pre-existing channels from before the IsPublic column) are public.
+    /// </summary>
+    private static async Task EnsureDefaultChannelsPublicAsync(EchoHubDbContext db, ILogger logger)
+    {
+        var general = await db.Channels.FirstOrDefaultAsync(c => c.Name == HubConstants.DefaultChannel);
+        if (general is not null && !general.IsPublic)
+        {
+            general.IsPublic = true;
+            await db.SaveChangesAsync();
+            logger.LogInformation("Marked #{Channel} as public.", HubConstants.DefaultChannel);
+        }
+    }
+
+    private static async Task MigrateAnsiMessagesAsync(EchoHubDbContext db, ILogger logger)
+    {
+        // Load messages that contain the ESC byte (0x1B) — these have legacy ANSI color codes.
+        // Filter by Image type first (only images have ANSI art), then check content in memory.
+        var messages = await db.Messages
+            .Where(m => m.Type == Core.Models.MessageType.Image)
+            .ToListAsync();
+
+        var toMigrate = messages.Where(m => m.Content.Contains('\x1b')).ToList();
+
+        if (toMigrate.Count == 0)
+            return;
+
+        logger.LogInformation("Found {Count} messages with legacy ANSI color codes. Migrating to color tag format...", toMigrate.Count);
+
+        var modified = 0;
+        foreach (var message in toMigrate)
+        {
+            var converted = AnsiToColorTags(message.Content);
+            if (converted != message.Content)
+            {
+                message.Content = converted;
+                modified++;
+            }
+        }
+
+        if (modified > 0)
+        {
+            await db.SaveChangesAsync();
+            logger.LogInformation("Migrated {Count} messages from ANSI escape codes to printable color tags.", modified);
+        }
+    }
+
+    /// <summary>
+    /// Convert ANSI escape codes to printable color tags.
+    /// \x1b[38;2;R;G;Bm → {F:RRGGBB}, \x1b[48;2;R;G;Bm → {B:RRGGBB}, \x1b[0m → {X}
+    /// </summary>
+    public static string AnsiToColorTags(string text)
+    {
+        return AnsiColorRegex().Replace(text, match =>
+        {
+            if (match.Groups[1].Value == "0")
+                return "{X}";
+
+            if (match.Groups[2].Success)
+            {
+                var r = int.Parse(match.Groups[3].Value);
+                var g = int.Parse(match.Groups[4].Value);
+                var b = int.Parse(match.Groups[5].Value);
+                var type = match.Groups[2].Value == "38;2" ? "F" : "B";
+                return $"{{{type}:{r:X2}{g:X2}{b:X2}}}";
+            }
+
+            return match.Value;
+        });
+    }
+
+    [GeneratedRegex(@"\x1b\[(?:(0)|(?:(38;2|48;2);(\d{1,3});(\d{1,3});(\d{1,3})))m")]
+    private static partial Regex AnsiColorRegex();
+
+    /// <summary>
+    /// Migrate old single-object EmbedJson ("{...}") to array format ("[{...}]").
+    /// </summary>
+    private static async Task MigrateEmbedJsonToArrayAsync(EchoHubDbContext db, ILogger logger)
+    {
+        var messages = await db.Messages
+            .Where(m => m.EmbedJson != null)
+            .ToListAsync();
+
+        var toMigrate = messages
+            .Where(m => m.EmbedJson!.TrimStart().StartsWith('{'))
+            .ToList();
+
+        if (toMigrate.Count == 0)
+            return;
+
+        logger.LogInformation("Found {Count} messages with legacy single-embed JSON. Migrating to array format...", toMigrate.Count);
+
+        var modified = 0;
+        foreach (var message in toMigrate)
+        {
+            try
+            {
+                var single = System.Text.Json.JsonSerializer.Deserialize<EmbedDto>(message.EmbedJson!);
+                if (single is not null)
+                {
+                    message.EmbedJson = System.Text.Json.JsonSerializer.Serialize(new[] { single });
+                    modified++;
+                }
+            }
+            catch
+            {
+                // Skip malformed JSON
+            }
+        }
+
+        if (modified > 0)
+        {
+            await db.SaveChangesAsync();
+            logger.LogInformation("Migrated {Count} embed records from single-object to array format.", modified);
+        }
+    }
+
+}

src/EchoHub.Server/Setup/DatabaseSetup.cs

@@ -16,6 +16,9 @@ public static class DatabaseSetup
 
         await MigrateAsync(db, logger);
         await SeedDefaultChannelAsync(db, logger);
+
+        // Run data migrations (e.g. ANSI → color tag format)
+        await DataMigrationService.RunAsync(services);
     }
 
     private static async Task MigrateAsync(EchoHubDbContext db, ILogger logger)

src/EchoHub.Server/Setup/FirstRunSetup.cs

@@ -22,6 +22,7 @@ public static class FirstRunSetup
             return;
 
         EnsureJwtSecret(settingsPath);
+        EnsureEncryptionKey(settingsPath);
     }
 
     private static void EnsureJwtSecret(string settingsPath)
@@ -45,4 +46,27 @@ public static class FirstRunSetup
         File.WriteAllText(settingsPath, root.ToJsonString(writeOptions));
         Console.WriteLine("Generated new JWT secret in appsettings.json.");
     }
+
+    private static void EnsureEncryptionKey(string settingsPath)
+    {
+        var json = File.ReadAllText(settingsPath);
+        var root = JsonNode.Parse(json, documentOptions: new JsonDocumentOptions { CommentHandling = JsonCommentHandling.Skip });
+        if (root is null)
+            return;
+
+        var currentKey = root["Encryption"]?["Key"]?.GetValue<string>();
+
+        if (!string.IsNullOrEmpty(currentKey))
+            return;
+
+        // Generate a 256-bit (32-byte) AES key
+        var key = Convert.ToBase64String(RandomNumberGenerator.GetBytes(32));
+
+        root["Encryption"] ??= new JsonObject();
+        root["Encryption"]!["Key"] = key;
+
+        var writeOptions = new JsonSerializerOptions { WriteIndented = true };
+        File.WriteAllText(settingsPath, root.ToJsonString(writeOptions));
+        Console.WriteLine("Generated new encryption key in appsettings.json.");
+    }
 }

src/EchoHub.Server/appsettings.example.json

@@ -14,6 +14,20 @@
     "PublicServer": false,
     "PublicHost": ""
   },
+  "Encryption": {
+    "Key": "",
+    "EncryptDatabase": false
+  },
+  "Irc": {
+    "Enabled": false,
+    "Port": 6667,
+    "TlsEnabled": false,
+    "TlsPort": 6697,
+    "TlsCertPath": "",
+    "TlsCertPassword": "",
+    "ServerName": "echohub",
+    "Motd": "Welcome to EchoHub IRC Gateway!"
+  },
   "Serilog": {
     "MinimumLevel": {
       "Default": "Information",

src/EchoHub.Tests/ClientEncryptionServiceTests.cs

@@ -0,0 +1,233 @@
+using System.Security.Cryptography;
+using EchoHub.Client.Services;
+using Xunit;
+
+namespace EchoHub.Tests;
+
+public class ClientEncryptionServiceTests
+{
+    private static string GenerateKey() =>
+        Convert.ToBase64String(RandomNumberGenerator.GetBytes(32));
+
+    private static ClientEncryptionService CreateInitialized(string? key = null)
+    {
+        var service = new ClientEncryptionService();
+        service.SetKey(key ?? GenerateKey());
+        return service;
+    }
+
+    // ── Initialization ───────────────────────────────────────────────
+
+    [Fact]
+    public void IsInitialized_DefaultFalse()
+    {
+        var service = new ClientEncryptionService();
+        Assert.False(service.IsInitialized);
+    }
+
+    [Fact]
+    public void IsInitialized_TrueAfterSetKey()
+    {
+        var service = CreateInitialized();
+        Assert.True(service.IsInitialized);
+    }
+
+    [Fact]
+    public void EncryptDatabaseEnabled_AlwaysFalse()
+    {
+        var service = CreateInitialized();
+        Assert.False(service.EncryptDatabaseEnabled);
+    }
+
+    [Fact]
+    public void SetKey_WrongLength_Throws()
+    {
+        var service = new ClientEncryptionService();
+        var shortKey = Convert.ToBase64String(RandomNumberGenerator.GetBytes(16));
+
+        Assert.Throws<InvalidOperationException>(() => service.SetKey(shortKey));
+    }
+
+    [Fact]
+    public void SetKey_InvalidBase64_Throws()
+    {
+        var service = new ClientEncryptionService();
+        Assert.Throws<FormatException>(() => service.SetKey("not-valid-base64!!!"));
+    }
+
+    // ── Encrypt before initialization ────────────────────────────────
+
+    [Fact]
+    public void Encrypt_NotInitialized_PassesThrough()
+    {
+        var service = new ClientEncryptionService();
+        var result = service.Encrypt("hello");
+
+        Assert.Equal("hello", result);
+    }
+
+    [Fact]
+    public void Decrypt_NotInitialized_PassesThrough()
+    {
+        var service = new ClientEncryptionService();
+        var result = service.Decrypt("$ENC$v1$something$else");
+
+        Assert.Equal("$ENC$v1$something$else", result);
+    }
+
+    // ── Encrypt after initialization ─────────────────────────────────
+
+    [Fact]
+    public void Encrypt_ProducesEncryptedFormat()
+    {
+        var service = CreateInitialized();
+        var encrypted = service.Encrypt("Hello, world!");
+
+        Assert.StartsWith("$ENC$v1$", encrypted);
+    }
+
+    [Fact]
+    public void Encrypt_DifferentNonceEachTime()
+    {
+        var service = CreateInitialized();
+        var a = service.Encrypt("same message");
+        var b = service.Encrypt("same message");
+
+        Assert.NotEqual(a, b);
+    }
+
+    [Fact]
+    public void Encrypt_EmptyString_Works()
+    {
+        var service = CreateInitialized();
+        var encrypted = service.Encrypt("");
+
+        Assert.StartsWith("$ENC$v1$", encrypted);
+    }
+
+    // ── Decrypt ──────────────────────────────────────────────────────
+
+    [Fact]
+    public void Decrypt_RoundTrip()
+    {
+        var service = CreateInitialized();
+        var original = "Hello, world!";
+
+        var encrypted = service.Encrypt(original);
+        var decrypted = service.Decrypt(encrypted);
+
+        Assert.Equal(original, decrypted);
+    }
+
+    [Fact]
+    public void Decrypt_EmptyString_RoundTrip()
+    {
+        var service = CreateInitialized();
+        var encrypted = service.Encrypt("");
+        var decrypted = service.Decrypt(encrypted);
+
+        Assert.Equal("", decrypted);
+    }
+
+    [Fact]
+    public void Decrypt_Unicode_RoundTrip()
+    {
+        var service = CreateInitialized();
+        var original = "Hello 🌍 世界 مرحبا";
+
+        var encrypted = service.Encrypt(original);
+        var decrypted = service.Decrypt(encrypted);
+
+        Assert.Equal(original, decrypted);
+    }
+
+    [Fact]
+    public void Decrypt_PlaintextPassthrough()
+    {
+        var service = CreateInitialized();
+        var plaintext = "This is just plain text";
+
+        var result = service.Decrypt(plaintext);
+
+        Assert.Equal(plaintext, result);
+    }
+
+    [Fact]
+    public void Decrypt_WrongKey_ReturnsFailureMessage()
+    {
+        var encryptor = CreateInitialized();
+        var decryptor = CreateInitialized(); // different key
+
+        var encrypted = encryptor.Encrypt("secret message");
+        var result = decryptor.Decrypt(encrypted);
+
+        Assert.Contains("decryption failed", result);
+    }
+
+    [Fact]
+    public void Decrypt_MalformedContent_ReturnsOriginal()
+    {
+        var service = CreateInitialized();
+
+        // Malformed: prefix present but no valid separator after nonce
+        var result = service.Decrypt("$ENC$v1$noseperatorhere");
+
+        Assert.Equal("$ENC$v1$noseperatorhere", result);
+    }
+
+    [Fact]
+    public void Decrypt_TamperedCiphertext_ReturnsFailure()
+    {
+        var service = CreateInitialized();
+        var encrypted = service.Encrypt("original message");
+
+        var tampered = encrypted[..^5] + "XXXXX";
+        var result = service.Decrypt(tampered);
+
+        Assert.Contains("decryption failed", result);
+    }
+
+    // ── Nullable helpers ─────────────────────────────────────────────
+
+    [Fact]
+    public void EncryptNullable_Null_ReturnsNull()
+    {
+        var service = CreateInitialized();
+        Assert.Null(service.EncryptNullable(null));
+    }
+
+    [Fact]
+    public void DecryptNullable_Null_ReturnsNull()
+    {
+        var service = CreateInitialized();
+        Assert.Null(service.DecryptNullable(null));
+    }
+
+    // ── Key replacement ──────────────────────────────────────────────
+
+    [Fact]
+    public void SetKey_CanBeCalledMultipleTimes()
+    {
+        var service = new ClientEncryptionService();
+
+        var key1 = GenerateKey();
+        var key2 = GenerateKey();
+
+        service.SetKey(key1);
+        var encrypted1 = service.Encrypt("test");
+
+        service.SetKey(key2);
+        var encrypted2 = service.Encrypt("test");
+
+        // Both produce encrypted content
+        Assert.StartsWith("$ENC$v1$", encrypted1);
+        Assert.StartsWith("$ENC$v1$", encrypted2);
+
+        // Old key's content can't be decrypted with new key
+        var result = service.Decrypt(encrypted1);
+        Assert.Contains("decryption failed", result);
+
+        // New key's content decrypts fine
+        Assert.Equal("test", service.Decrypt(encrypted2));
+    }
+}