serverless-ircd 0.8.0 → 0.10.0

package/packages/aws-adapter/tests/account-store-dynamo.test.ts

@@ -1,223 +0,0 @@
-/**
- * DynamoDB-backed integration tests for the `Accounts` table path.
- * Exercises the real DynamoDB round-trip that pure unit
- * tests cannot: `putAccountCredential` writes a hashed row,
- * `loadDynamoAccountStore` scans it back, and `resolveAccountStore`
- * applies the table-then-config precedence.
- *
- * Gated on DynamoDB Local availability (same `DDB_AVAILABLE` flag as
- * `handlers.test.ts`).
- */
-
-import { CreateTableCommand, DeleteTableCommand } from '@aws-sdk/client-dynamodb';
-import { PutCommand } from '@aws-sdk/lib-dynamodb';
-import { makeTestServerConfig } from '@serverless-ircd/irc-test-support';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import {
-  loadDynamoAccountStore,
-  putAccountCredential,
-  resolveAccountStore,
-} from '../src/account-store.js';
-import { TABLE_DEFS } from '../src/cdk-table-defs.js';
-import { createDynamoDocumentClient } from '../src/dynamo.js';
-
-const available = process.env.DDB_AVAILABLE === '1';
-const endpoint = process.env.DYNAMO_ENDPOINT;
-
-interface Fx {
-  tableName: string;
-  client: ReturnType<typeof createDynamoDocumentClient>;
-  cleanup: () => Promise<void>;
-}
-
-let fx: Fx | null = null;
-
-function requireFx(): Fx {
-  if (!fx) throw new Error('test fixture not initialized');
-  return fx;
-}
-
-async function makeFx(): Promise<Fx> {
-  if (endpoint === undefined) throw new Error('DYNAMO_ENDPOINT missing');
-  const tableName = `acct-${Date.now()}-${Math.floor(Math.random() * 1e6)}`;
-  const client = createDynamoDocumentClient({ endpoint });
-  const props = TABLE_DEFS.Accounts;
-  const pkName = props.partitionKey?.name;
-  if (pkName === undefined) throw new Error('Accounts table missing partitionKey');
-  await client.send(
-    new CreateTableCommand({
-      TableName: tableName,
-      AttributeDefinitions: [{ AttributeName: pkName, AttributeType: 'S' }],
-      KeySchema: [{ AttributeName: pkName, KeyType: 'HASH' }],
-      BillingMode: 'PAY_PER_REQUEST',
-    }),
-  );
-  return {
-    tableName,
-    client,
-    cleanup: async () => {
-      try {
-        await client.send(new DeleteTableCommand({ TableName: tableName }));
-      } catch {
-        // Idempotent.
-      }
-    },
-  };
-}
-
-describe.skipIf(!available)('Accounts table round-trip', () => {
-  beforeEach(async () => {
-    fx = await makeFx();
-  });
-  afterEach(async () => {
-    if (fx) await fx.cleanup();
-    fx = null;
-  });
-
-  it('putAccountCredential then loadDynamoAccountStore verifies the account', async () => {
-    await putAccountCredential(requireFx().client, requireFx().tableName, 'alice', 's3cret');
-    const store = await loadDynamoAccountStore(requireFx().client, requireFx().tableName);
-    expect(store).toBeDefined();
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 's3cret' }),
-    ).toEqual({
-      ok: true,
-      account: 'alice',
-    });
-  });
-
-  it('loadDynamoAccountStore returns undefined when the table has no rows', async () => {
-    const store = await loadDynamoAccountStore(requireFx().client, requireFx().tableName);
-    expect(store).toBeUndefined();
-  });
-
-  it('putAccountCredential writes multiple distinct accounts', async () => {
-    await putAccountCredential(requireFx().client, requireFx().tableName, 'alice', 'a1');
-    await putAccountCredential(requireFx().client, requireFx().tableName, 'bob', 'b2');
-    const store = await loadDynamoAccountStore(requireFx().client, requireFx().tableName);
-    expect(store).toBeDefined();
-    expect(store?.size).toBe(2);
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'a1' }).ok).toBe(
-      true,
-    );
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'bob', password: 'b2' }).ok).toBe(
-      true,
-    );
-  });
-
-  it('putAccountCredential overwrites an existing account (re-seed)', async () => {
-    await putAccountCredential(requireFx().client, requireFx().tableName, 'alice', 'old');
-    await putAccountCredential(requireFx().client, requireFx().tableName, 'alice', 'new');
-    const store = await loadDynamoAccountStore(requireFx().client, requireFx().tableName);
-    expect(store).toBeDefined();
-    expect(store?.size).toBe(1);
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'old' }).ok).toBe(
-      false,
-    );
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'new' }).ok).toBe(
-      true,
-    );
-  });
-
-  it('rejects a wrong password after round-trip', async () => {
-    await putAccountCredential(requireFx().client, requireFx().tableName, 'alice', 'right');
-    const store = await loadDynamoAccountStore(requireFx().client, requireFx().tableName);
-    expect(store).toBeDefined();
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'wrong' }).ok).toBe(
-      false,
-    );
-  });
-
-  it('silently skips rows with missing or wrong-typed credential fields', async () => {
-    // The scan path must tolerate partially-malformed rows (legacy seeds,
-    // schema drift) without throwing — it just skips them. Each branch of
-    // the per-field `typeof === 'string'` guard is exercised by writing a
-    // row where exactly one non-key field has the wrong type. (The
-    // `account` field is the partition key, so DynamoDB itself enforces
-    // its type at write time and the false branch is not exercisable
-    // through the SDK; that branch is a defensive guard against
-    // synthetically-shaped Scan results.)
-    const client = requireFx().client;
-    const table = requireFx().tableName;
-    // Well-formed row — must survive.
-    await putAccountCredential(client, table, 'good', 's3cret');
-    // Row with non-string `algorithm`.
-    await client.send(
-      new PutCommand({
-        TableName: table,
-        Item: { account: 'noalgo', algorithm: 7, salt: 's', hash: 'h' },
-      }),
-    );
-    // Row with non-string `salt`.
-    await client.send(
-      new PutCommand({
-        TableName: table,
-        Item: { account: 'nosalt', algorithm: 'SCRYPT-SHA-256', salt: false, hash: 'h' },
-      }),
-    );
-    // Row with non-string `hash`.
-    await client.send(
-      new PutCommand({
-        TableName: table,
-        Item: { account: 'nohash', algorithm: 'SCRYPT-SHA-256', salt: 's', hash: null },
-      }),
-    );
-    const store = await loadDynamoAccountStore(client, table);
-    expect(store).toBeDefined();
-    expect(store?.size).toBe(1);
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'good', password: 's3cret' }).ok).toBe(
-      true,
-    );
-  });
-});
-
-describe.skipIf(!available)('resolveAccountStore precedence', () => {
-  beforeEach(async () => {
-    fx = await makeFx();
-  });
-  afterEach(async () => {
-    if (fx) await fx.cleanup();
-    fx = null;
-  });
-
-  it('returns a DynamoAccountStore when the table has rows (table wins)', async () => {
-    await putAccountCredential(requireFx().client, requireFx().tableName, 'alice', 'table-secret');
-    const cfgWithSasl = makeTestServerConfig({
-      saslAccounts: [{ username: 'envuser', password: 'env-secret' }],
-    });
-    const store = await resolveAccountStore(requireFx().client, requireFx().tableName, cfgWithSasl);
-    expect(store).toBeDefined();
-    // Table account verifies; config account does NOT (table is authoritative).
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'table-secret' }).ok,
-    ).toBe(true);
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'envuser', password: 'env-secret' }).ok,
-    ).toBe(false);
-  });
-
-  it('falls back to the config-seeded store when the table is empty', async () => {
-    const cfgWithSasl = makeTestServerConfig({
-      saslAccounts: [{ username: 'envuser', password: 'env-secret' }],
-    });
-    const store = await resolveAccountStore(requireFx().client, requireFx().tableName, cfgWithSasl);
-    expect(store).toBeDefined();
-    expect(
-      store?.verify('PLAIN', { kind: 'PLAIN', username: 'envuser', password: 'env-secret' }).ok,
-    ).toBe(true);
-  });
-
-  it('returns undefined when the table is empty and no config accounts are set', async () => {
-    const store = await resolveAccountStore(
-      requireFx().client,
-      requireFx().tableName,
-      makeTestServerConfig(),
-    );
-    expect(store).toBeUndefined();
-  });
-
-  it('returns undefined when the table is empty and serverConfig is undefined', async () => {
-    const store = await resolveAccountStore(requireFx().client, requireFx().tableName, undefined);
-    expect(store).toBeUndefined();
-  });
-});

package/packages/aws-adapter/tests/account-store.test.ts

@@ -1,276 +0,0 @@
-import { DynamoDBDocumentClient, PutCommand, ScanCommand } from '@aws-sdk/lib-dynamodb';
-import type { ParsedServerConfig, SaslPayload } from '@serverless-ircd/irc-core';
-import { makeTestServerConfig } from '@serverless-ircd/irc-test-support';
-import { mockClient } from 'aws-sdk-client-mock';
-import { describe, expect, it } from 'vitest';
-import {
-  DynamoAccountStore,
-  type HashedAccountCredential,
-  bindAccountStore,
-  hashAccountCredential,
-  putAccountCredential,
-  resolveAccountStore,
-} from '../src/account-store';
-
-function plainPayload(username: string, password: string): SaslPayload {
-  return { kind: 'PLAIN', username, password };
-}
-
-/** Builds a minimal parsed config with the supplied saslAccounts. */
-function configWith(accounts: Array<{ username: string; password: string }>): ParsedServerConfig {
-  return makeTestServerConfig({ saslAccounts: accounts });
-}
-
-// ---------------------------------------------------------------------------
-// bindAccountStore — config-seeded fallback
-// ---------------------------------------------------------------------------
-
-describe('bindAccountStore', () => {
-  it('returns an AccountStore that accepts valid PLAIN creds', () => {
-    const store = bindAccountStore(configWith([{ username: 'alice', password: 'secret' }]));
-    expect(store).toBeDefined();
-    const out = store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'secret' });
-    expect(out).toEqual({ ok: true, account: 'alice' });
-  });
-
-  it('returns undefined when the account list is empty', () => {
-    expect(bindAccountStore(configWith([]))).toBeUndefined();
-  });
-
-  it('returns undefined when serverConfig is undefined', () => {
-    expect(bindAccountStore(undefined)).toBeUndefined();
-  });
-
-  it('rejects wrong credentials', () => {
-    const store = bindAccountStore(configWith([{ username: 'alice', password: 'secret' }]));
-    expect(store).toBeDefined();
-    expect(store?.verify('PLAIN', { kind: 'PLAIN', username: 'alice', password: 'wrong' }).ok).toBe(
-      false,
-    );
-  });
-});
-
-// ---------------------------------------------------------------------------
-// hashAccountCredential — pure scrypt hashing helper
-// ---------------------------------------------------------------------------
-
-describe('hashAccountCredential', () => {
-  it('produces an entry keyed by the username with scrypt', () => {
-    const entry = hashAccountCredential('alice', 'secret');
-    expect(entry.account).toBe('alice');
-    expect(entry.algorithm).toBe('scrypt');
-    expect(entry.salt.length).toBeGreaterThan(0);
-    expect(entry.hash.length).toBeGreaterThan(0);
-  });
-
-  it('never stores the plaintext password in any field', () => {
-    const entry = hashAccountCredential('alice', 'hunter2-secret');
-    expect(entry.account).not.toContain('hunter2');
-    expect(entry.salt).not.toContain('hunter2');
-    expect(entry.hash).not.toContain('hunter2');
-  });
-
-  it('produces different hashes for the same password under different salts', () => {
-    const a = hashAccountCredential('alice', 'secret', { salt: Buffer.from('aaaaaaaaaaaaaaaa') });
-    const b = hashAccountCredential('alice', 'secret', { salt: Buffer.from('bbbbbbbbbbbbbbbb') });
-    expect(a.hash).not.toBe(b.hash);
-  });
-
-  it('is deterministic for a fixed salt', () => {
-    const salt = Buffer.from('1234567890123456');
-    const a = hashAccountCredential('alice', 'secret', { salt });
-    const b = hashAccountCredential('alice', 'secret', { salt });
-    expect(a.hash).toBe(b.hash);
-  });
-
-  it('honours a custom key length', () => {
-    const entry = hashAccountCredential('alice', 'secret', { keyLen: 32 });
-    // base64 of 32 bytes → ~44 chars; base64 of 64 bytes → ~88 chars
-    expect(Buffer.from(entry.hash, 'base64').length).toBe(32);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// DynamoAccountStore — synchronous verify against pre-loaded hashed entries
-// ---------------------------------------------------------------------------
-
-describe('DynamoAccountStore', () => {
-  it('accepts valid PLAIN credentials and returns the account name', () => {
-    const entry = hashAccountCredential('alice', 'secret');
-    const store = new DynamoAccountStore([entry]);
-    expect(store.verify('PLAIN', plainPayload('alice', 'secret'))).toEqual({
-      ok: true,
-      account: 'alice',
-    });
-  });
-
-  it('rejects a wrong password', () => {
-    const entry = hashAccountCredential('alice', 'secret');
-    const store = new DynamoAccountStore([entry]);
-    expect(store.verify('PLAIN', plainPayload('alice', 'wrong')).ok).toBe(false);
-  });
-
-  it('rejects an unknown username', () => {
-    const store = new DynamoAccountStore([hashAccountCredential('alice', 'secret')]);
-    expect(store.verify('PLAIN', plainPayload('bob', 'secret')).ok).toBe(false);
-  });
-
-  it('rejects a non-PLAIN mechanism', () => {
-    const store = new DynamoAccountStore([hashAccountCredential('alice', 'secret')]);
-    expect(store.verify('EXTERNAL', plainPayload('alice', 'secret')).ok).toBe(false);
-  });
-
-  it('rejects a RAW payload', () => {
-    const store = new DynamoAccountStore([hashAccountCredential('alice', 'secret')]);
-    expect(store.verify('PLAIN', { kind: 'RAW', data: 'whatever' }).ok).toBe(false);
-  });
-
-  it('handles multiple loaded accounts', () => {
-    const store = new DynamoAccountStore([
-      hashAccountCredential('alice', 'a-secret'),
-      hashAccountCredential('bob', 'b-secret'),
-    ]);
-    expect(store.verify('PLAIN', plainPayload('alice', 'a-secret'))).toEqual({
-      ok: true,
-      account: 'alice',
-    });
-    expect(store.verify('PLAIN', plainPayload('bob', 'b-secret'))).toEqual({
-      ok: true,
-      account: 'bob',
-    });
-  });
-
-  it('fails every verify when constructed with no entries', () => {
-    const store = new DynamoAccountStore([]);
-    expect(store.verify('PLAIN', plainPayload('alice', 'secret')).ok).toBe(false);
-  });
-
-  it('round-trips an externally-constructed HashedAccountCredential', () => {
-    const row: HashedAccountCredential = hashAccountCredential('carol', 'p@ss');
-    const store = new DynamoAccountStore([row]);
-    expect(store.verify('PLAIN', plainPayload('carol', 'p@ss'))).toEqual({
-      ok: true,
-      account: 'carol',
-    });
-  });
-
-  it('reports the number of loaded entries via size', () => {
-    const store = new DynamoAccountStore([
-      hashAccountCredential('alice', 'a'),
-      hashAccountCredential('bob', 'b'),
-    ]);
-    expect(store.size).toBe(2);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// resolveAccountStore — table-then-config precedence (mock-based)
-// ---------------------------------------------------------------------------
-
-describe('resolveAccountStore', () => {
-  it('returns a DynamoAccountStore when the table has rows (table wins)', async () => {
-    const entry = hashAccountCredential('alice', 's3cret');
-    const ddb = mockClient(DynamoDBDocumentClient);
-    ddb.on(ScanCommand).resolves({
-      Items: [entry],
-    });
-
-    const fallback = bindAccountStore(configWith([{ username: 'envuser', password: 'env-pw' }]));
-    const store = await resolveAccountStore(
-      ddb as unknown as DynamoDBDocumentClient,
-      'Accounts',
-      fallback === undefined
-        ? undefined
-        : makeTestServerConfig({ saslAccounts: [{ username: 'envuser', password: 'env-pw' }] }),
-    );
-    expect(store).toBeDefined();
-    expect(store?.verify('PLAIN', plainPayload('alice', 's3cret')).ok).toBe(true);
-    // Config account does NOT verify (table is authoritative).
-    expect(store?.verify('PLAIN', plainPayload('envuser', 'env-pw')).ok).toBe(false);
-  });
-
-  it('falls back to config-seeded store when the table is empty', async () => {
-    const ddb = mockClient(DynamoDBDocumentClient);
-    ddb.on(ScanCommand).resolves({ Items: [] });
-
-    const store = await resolveAccountStore(
-      ddb as unknown as DynamoDBDocumentClient,
-      'Accounts',
-      configWith([{ username: 'bob', password: 'pw' }]),
-    );
-    expect(store).toBeDefined();
-    expect(store?.verify('PLAIN', plainPayload('bob', 'pw')).ok).toBe(true);
-  });
-
-  it('falls back to config-seeded store when the scan throws', async () => {
-    const ddb = mockClient(DynamoDBDocumentClient);
-    ddb.on(ScanCommand).rejects(new Error('ResourceNotFoundException'));
-
-    const store = await resolveAccountStore(
-      ddb as unknown as DynamoDBDocumentClient,
-      'Accounts',
-      configWith([{ username: 'bob', password: 'pw' }]),
-    );
-    expect(store).toBeDefined();
-    expect(store?.verify('PLAIN', plainPayload('bob', 'pw')).ok).toBe(true);
-  });
-
-  it('returns undefined when table is empty and no config accounts', async () => {
-    const ddb = mockClient(DynamoDBDocumentClient);
-    ddb.on(ScanCommand).resolves({ Items: [] });
-
-    const store = await resolveAccountStore(
-      ddb as unknown as DynamoDBDocumentClient,
-      'Accounts',
-      undefined,
-    );
-    expect(store).toBeUndefined();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// putAccountCredential — CRUD/seed entry point (mock-based)
-// ---------------------------------------------------------------------------
-
-describe('putAccountCredential', () => {
-  it('writes a hashed row to DynamoDB and returns the credential', async () => {
-    const ddb = mockClient(DynamoDBDocumentClient);
-    ddb.on(PutCommand).resolves({});
-
-    const entry = await putAccountCredential(
-      ddb as unknown as DynamoDBDocumentClient,
-      'Accounts',
-      'alice',
-      's3cret',
-    );
-    expect(entry.account).toBe('alice');
-    expect(entry.algorithm).toBe('scrypt');
-
-    const calls = ddb.commandCalls(PutCommand);
-    expect(calls).toHaveLength(1);
-    const item = calls[0]?.args[0].input.Item as HashedAccountCredential;
-    expect(item.account).toBe('alice');
-    expect(item.algorithm).toBe('scrypt');
-    expect(item.salt).toBe(entry.salt);
-    expect(item.hash).toBe(entry.hash);
-  });
-
-  it('the written row round-trips through DynamoAccountStore', async () => {
-    const ddb = mockClient(DynamoDBDocumentClient);
-    ddb.on(PutCommand).resolves({});
-
-    const entry = await putAccountCredential(
-      ddb as unknown as DynamoDBDocumentClient,
-      'Accounts',
-      'alice',
-      's3cret',
-    );
-
-    // Simulate reading the row back via DynamoAccountStore.
-    const store = new DynamoAccountStore([entry]);
-    expect(store.verify('PLAIN', plainPayload('alice', 's3cret'))).toEqual({
-      ok: true,
-      account: 'alice',
-    });
-  });
-});

package/packages/cf-adapter/src/d1-account-store.ts

@@ -1,198 +0,0 @@
-/**
- * D1-backed SASL account store primitives for the Cloudflare adapter.
- *
- * Mirrors the AWS `dynamo-account-store.ts` / `account-store.ts` pair:
- * credentials are stored as scrypt hashes (never plaintext) in a D1
- * `accounts` table and pre-loaded at {@link ConnectionDO} construction
- * into the shared {@link HashedAccountStore}.
- *
- * Table-then-config precedence is implemented by {@link resolveAccountStore}:
- * when the D1 table has rows it is authoritative; when it is empty (or
- * unreachable, or the binding is absent) the code falls back to the
- * `SASL_ACCOUNTS` env-var seed — preserving the config-seed behaviour for
- * deployments that have not migrated to D1.
- *
- * The adapters diverge only at the scan/put boundary; the hashing helpers
- * and the synchronous {@link HashedAccountStore} are shared via `irc-core`.
- */
-
-import {
-  type AccountStore,
-  type HashedAccountCredential,
-  HashedAccountStore,
-  InMemoryAccountStore,
-  hashAccountCredential,
-} from '@serverless-ircd/irc-core';
-
-/**
- * SQL to create the `accounts` table. Exported so the seed tool and
- * provisioning docs reference one schema definition.
- */
-export const CREATE_ACCOUNTS_TABLE_SQL =
-  'CREATE TABLE IF NOT EXISTS accounts (account TEXT PRIMARY KEY, algorithm TEXT NOT NULL, salt TEXT NOT NULL, hash TEXT NOT NULL)';
-
-/**
- * A raw D1 row — the untyped shape returned by `prepare().all()`. Each
- * column is `unknown` until validated into a {@link HashedAccountCredential}.
- */
-type AccountsRow = Record<string, unknown>;
-
-/**
- * Coerces a raw D1 row into a {@link HashedAccountCredential}, or returns
- * `undefined` when the row is missing required columns or has the wrong
- * types. Mirrors the silent-skip behaviour of the DynamoDB loader.
- */
-function coerceRow(row: AccountsRow): HashedAccountCredential | undefined {
-  const { account, algorithm, salt, hash } = row;
-  if (
-    typeof account !== 'string' ||
-    typeof algorithm !== 'string' ||
-    typeof salt !== 'string' ||
-    typeof hash !== 'string'
-  ) {
-    return undefined;
-  }
-  return {
-    account,
-    algorithm: algorithm as HashedAccountCredential['algorithm'],
-    salt,
-    hash,
-  };
-}
-
-/**
- * Queries the D1 `accounts` table and returns a fully-populated
- * {@link HashedAccountStore}, or `undefined` when the table has no rows.
- *
- * Rows missing required attributes are silently skipped. Callers that need
- * the table-then-config fallback should use {@link resolveAccountStore}
- * rather than catching `undefined` themselves.
- *
- * @param db The D1 binding (may be `undefined` when D1 is not configured).
- */
-export async function loadD1AccountStore(
-  db: D1Database | undefined,
-): Promise<HashedAccountStore | undefined> {
-  if (db === undefined) return undefined;
-  const result = await db
-    .prepare('SELECT account, algorithm, salt, hash FROM accounts')
-    .all<AccountsRow>();
-  const entries: HashedAccountCredential[] = [];
-  for (const row of result.results ?? []) {
-    const entry = coerceRow(row);
-    if (entry !== undefined) entries.push(entry);
-  }
-  if (entries.length === 0) return undefined;
-  return new HashedAccountStore(entries);
-}
-
-/**
- * Writes (or re-seeds) a SASL PLAIN account into the D1 `accounts` table.
- *
- * The password is hashed via {@link hashAccountCredential} (scrypt, random
- * salt) and stored as a {@link HashedAccountCredential} row — plaintext is
- * never written. A repeat call for the same `username` overwrites the prior
- * row (the PK is `account`), so this is the canonical CRUD/seed entry point
- * for oper and SASL account provisioning.
- *
- * @returns The stored {@link HashedAccountCredential} (for tooling/tests).
- */
-export async function putAccountCredential(
-  db: D1Database,
-  username: string,
-  password: string,
-): Promise<HashedAccountCredential> {
-  const entry = hashAccountCredential(username, password);
-  await db
-    .prepare('INSERT OR REPLACE INTO accounts (account, algorithm, salt, hash) VALUES (?, ?, ?, ?)')
-    .bind(entry.account, entry.algorithm, entry.salt, entry.hash)
-    .run();
-  return entry;
-}
-
-/**
- * Builds a self-contained `INSERT OR REPLACE` SQL statement that writes a
- * scrypt-hashed account row, suitable for `wrangler d1 execute --command`.
- *
- * The password is hashed via {@link hashAccountCredential}; the plaintext
- * never appears in the SQL. The values are single-quoted with embedded
- * single quotes doubled (`'` → `''`) to avoid injection through the
- * username or the base64 output.
- *
- * This is the pure (non-IO) half of {@link putAccountCredential}; the seed
- * CLI (`tools/seed-cf-accounts.ts`) calls this and pipes the result to
- * `wrangler d1 execute`, while the runtime `ConnectionDO` path uses the
- * bound-parameter {@link putAccountCredential}.
- *
- * @returns The hashed credential and the executable SQL string.
- */
-export function buildAccountPutStatement(
-  username: string,
-  password: string,
-): { entry: HashedAccountCredential; sql: string } {
-  const entry = hashAccountCredential(username, password);
-  const sql = `INSERT OR REPLACE INTO accounts (account, algorithm, salt, hash) VALUES ('${sqlEscape(entry.account)}', '${sqlEscape(entry.algorithm)}', '${sqlEscape(entry.salt)}', '${sqlEscape(entry.hash)}')`;
-  return { entry, sql };
-}
-
-/** Doubles single quotes for safe embedding in a D1 SQL string literal. */
-function sqlEscape(value: string): string {
-  return value.replace(/'/g, "''");
-}
-
-/**
- * Resolves the SASL account store for a CF deployment, applying the
- * table-then-config precedence.
- *
- *   1. Queries the D1 `accounts` table (pre-loading every hashed credential
- *      into a {@link HashedAccountStore}). When the table has one or more
- *      rows it is authoritative — the table wins and the config seed is
- *      ignored.
- *   2. When the table is empty (or the binding is absent), falls back to
- *      the `SASL_ACCOUNTS` env-var seed (an {@link InMemoryAccountStore})
- *      so existing deployments that have not migrated to D1 keep working.
- *   3. Returns `undefined` when neither source has accounts so the actor's
- *      `ctx.accounts` stays unset (`AUTHENTICATE PLAIN` → `904`).
- *
- * Query failures are swallowed and treated as an empty table, falling
- * through to the config seed — mirroring `resolveAccountStore` on AWS.
- *
- * @param db  The D1 binding (`undefined` when D1 is not configured).
- * @param saslAccountsRaw The raw `SASL_ACCOUNTS` env var (newline-delimited
- *   `username:password` pairs), or `undefined` when unset.
- */
-export async function resolveAccountStore(
-  db: D1Database | undefined,
-  saslAccountsRaw: string | undefined,
-): Promise<AccountStore | undefined> {
-  try {
-    const store = await loadD1AccountStore(db);
-    if (store !== undefined) return store;
-  } catch {
-    // Table might not exist yet or be unreachable; fall through to seed.
-  }
-  const seed = parseSeed(saslAccountsRaw);
-  if (seed.length === 0) return undefined;
-  return new InMemoryAccountStore(seed);
-}
-
-/**
- * Parses the `SASL_ACCOUNTS` env var into credential entries for the
- * config-seed fallback. Re-exported from the in-memory account-store module
- * so the precedence resolver is self-contained.
- */
-function parseSeed(raw: string | undefined): Array<{ username: string; password: string }> {
-  if (raw === undefined || raw.length === 0) return [];
-  const out: Array<{ username: string; password: string }> = [];
-  for (const line of raw.split('\n')) {
-    const trimmed = line.trim();
-    if (trimmed.length === 0) continue;
-    const sep = trimmed.indexOf(':');
-    if (sep <= 0) continue;
-    const username = trimmed.slice(0, sep);
-    const password = trimmed.slice(sep + 1);
-    if (username.length === 0 || password.length === 0) continue;
-    out.push({ username, password });
-  }
-  return out;
-}