serverless-ircd 0.9.0 → 0.10.0

package/tools/migrate-accounts-to-services.ts

@@ -0,0 +1,270 @@
+#!/usr/bin/env node
+/**
+ * Migration script: backfills rows from the legacy `accounts` / `Accounts`
+ * table into the unified `nickserv_accounts` / `Services` table BEFORE the
+ * build that drops the legacy table is deployed.
+ *
+ * The migration is:
+ *   - **One-shot**: run once per environment (staging then prod), then the
+ *     new build lands.
+ *   - **Idempotent**: re-running is a no-op — `INSERT OR IGNORE` (D1) /
+ *     conditional PutItem (DynamoDB) never clobbers an existing services
+ *     row.
+ *   - **Never-overwrite**: a nick already registered in the services table
+ *     (via NickServ REGISTER or a prior seed) wins; the legacy row's
+ *     credential is NOT copied over it.
+ *   - **Cert-subject carry-through**: the legacy `accounts` / `Accounts`
+ *     table has no `cert_subjects` column. The script reads the still-
+ *     deployed `SASL_ACCOUNTS` env var at run time; any account declared
+ *     there is registered (if not already present) so the env-seed
+ *     survives the table drop. The env-var format (`username:password`)
+ *     does NOT carry cert subjects, so `cert_subjects` defaults to `'[]'`
+ *     for every migrated row — matching today's effective behavior (SASL
+ *     EXTERNAL only worked against the static `InMemoryAccountStore`, never
+ *     against the hashed `accounts`/`Accounts` table).
+ *
+ * Usage (Cloudflare D1):
+ *   node --import tsx tools/migrate-accounts-to-services.ts \
+ *     --platform cf \
+ *     --database serverless-ircd-accounts \
+ *     --env staging \
+ *     --remote
+ *
+ * Usage (AWS DynamoDB):
+ *   node --import tsx tools/migrate-accounts-to-services.ts \
+ *     --platform aws \
+ *     --accounts-table StagingAccounts \
+ *     --services-table StagingServices \
+ *     --region us-east-1
+ *
+ * The `SASL_ACCOUNTS` env var is read at run time in both modes so any
+ * operator-declared seed accounts are carried into the services table.
+ */
+
+// ============================================================================
+// Pure helpers (re-exported from irc-core for testability)
+// ============================================================================
+
+export {
+  type LegacyAccountRow,
+  type ParsedSaslAccount,
+  buildMigrationSql,
+  buildServicesPutItem,
+  parseSaslAccountsForMigration,
+} from '@serverless-ircd/irc-core';
+import { caseFold } from '@serverless-ircd/irc-core';
+
+// ============================================================================
+// CLI entry point (only runs when executed directly via `node --import tsx`)
+// ============================================================================
+
+async function main(): Promise<void> {
+  const { execFileSync } = await import('node:child_process');
+  const { parseArgs } = await import('node:util');
+  const { values } = parseArgs({
+    options: {
+      platform: { type: 'string' },
+      database: { type: 'string', default: undefined },
+      env: { type: 'string', default: undefined },
+      remote: { type: 'boolean', default: false },
+      'accounts-table': { type: 'string', default: undefined },
+      'services-table': { type: 'string', default: undefined },
+      region: { type: 'string', default: undefined },
+      endpoint: { type: 'string', default: undefined },
+    },
+  });
+
+  const SASL_ACCOUNTS_RAW = process.env.SASL_ACCOUNTS;
+
+  if (values.platform === 'cf') {
+    await runCfMigration(values, SASL_ACCOUNTS_RAW, execFileSync);
+  } else if (values.platform === 'aws') {
+    await runAwsMigration(values, SASL_ACCOUNTS_RAW);
+  } else {
+    console.error(
+      'Usage: migrate-accounts-to-services --platform cf|aws [platform-specific flags]',
+    );
+    console.error('  cf:  --database <d1-name> [--env staging] [--remote]');
+    console.error(
+      '  aws: --accounts-table <name> --services-table <name> [--region <r>] [--endpoint <url>]',
+    );
+    process.exit(1);
+  }
+}
+
+type CfValues = {
+  database?: string;
+  env?: string;
+  remote?: boolean;
+};
+
+async function runCfMigration(
+  values: CfValues,
+  saslAccountsRaw: string | undefined,
+  execFileSync: typeof import('node:child_process').execFileSync,
+): Promise<void> {
+  if (values.database === undefined) {
+    console.error('CF migration requires --database <d1-name>');
+    process.exit(1);
+  }
+  const selectArgs = [
+    'd1',
+    'execute',
+    values.database,
+    '--command',
+    'SELECT account, algorithm, salt, hash FROM accounts',
+    '--json',
+  ];
+  if (values.env !== undefined) selectArgs.push('--env', values.env);
+  if (values.remote) selectArgs.push('--remote');
+
+  let legacyRows: LegacyAccountRow[] = [];
+  try {
+    const output = execFileSync('npx', ['wrangler', ...selectArgs], {
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'inherit'],
+    });
+    const parsed = JSON.parse(output) as Array<{ results?: Array<Record<string, unknown>> }>;
+    legacyRows = parsed
+      .flatMap((r) => r.results ?? [])
+      .filter(
+        (r): r is Record<string, string> =>
+          typeof r.account === 'string' &&
+          typeof r.algorithm === 'string' &&
+          typeof r.salt === 'string' &&
+          typeof r.hash === 'string',
+      )
+      .map((r) => ({
+        account: r.account,
+        algorithm: r.algorithm,
+        salt: r.salt,
+        hash: r.hash,
+      }));
+  } catch (err) {
+    console.error(`Could not read legacy accounts table: ${String(err)}`);
+    console.error('Continuing with SASL_ACCOUNTS env-seed carry-through only.');
+  }
+
+  const statements = buildMigrationSql(legacyRows, saslAccountsRaw);
+  for (const sql of statements) {
+    const execArgs = ['d1', 'execute', values.database, '--command', sql];
+    if (values.env !== undefined) execArgs.push('--env', values.env);
+    if (values.remote) execArgs.push('--remote');
+    execFileSync('npx', ['wrangler', ...execArgs], { stdio: 'inherit' });
+  }
+  console.log(
+    `CF migration complete: ${statements.length - 1} statement(s) executed ` +
+      `(${legacyRows.length} legacy rows + env-seed carry-through).`,
+  );
+}
+
+type AwsValues = {
+  'accounts-table'?: string;
+  'services-table'?: string;
+  region?: string;
+  endpoint?: string;
+};
+
+async function runAwsMigration(
+  values: AwsValues,
+  saslAccountsRaw: string | undefined,
+): Promise<void> {
+  if (values['accounts-table'] === undefined || values['services-table'] === undefined) {
+    console.error('AWS migration requires --accounts-table and --services-table');
+    process.exit(1);
+  }
+  const { PutCommand, ScanCommand } = await import('@aws-sdk/lib-dynamodb');
+  const { createDynamoDocumentClient, loadDynamoServicesStore } = await import(
+    '@serverless-ircd/aws-adapter'
+  );
+  const { SystemClock } = await import('@serverless-ircd/irc-core');
+
+  const clientOpts: Record<string, string> = {};
+  if (values.region !== undefined) clientOpts.region = values.region;
+  if (values.endpoint !== undefined) clientOpts.endpoint = values.endpoint;
+  const docClient = createDynamoDocumentClient(clientOpts);
+
+  const legacyRows: LegacyAccountRow[] = [];
+  try {
+    let exclusiveStartKey: Record<string, unknown> | undefined;
+    do {
+      const result = await docClient.send(
+        new ScanCommand({
+          TableName: values['accounts-table'],
+          ExclusiveStartKey: exclusiveStartKey,
+        }),
+      );
+      for (const item of result.Items ?? []) {
+        if (
+          typeof item.account === 'string' &&
+          typeof item.algorithm === 'string' &&
+          typeof item.salt === 'string' &&
+          typeof item.hash === 'string'
+        ) {
+          legacyRows.push({
+            account: item.account,
+            algorithm: item.algorithm,
+            salt: item.salt,
+            hash: item.hash,
+          });
+        }
+      }
+      exclusiveStartKey = result.LastEvaluatedKey;
+    } while (exclusiveStartKey !== undefined);
+  } catch (err) {
+    console.error(`Could not scan legacy Accounts table: ${String(err)}`);
+    console.error('Continuing with SASL_ACCOUNTS env-seed carry-through only.');
+  }
+
+  const seen = new Set<string>();
+  let legacyPutCount = 0;
+  for (const row of legacyRows) {
+    const nickKey = caseFold('rfc1459', row.account);
+    seen.add(nickKey);
+    const input = buildServicesPutItem(row, values['services-table']);
+    try {
+      await docClient.send(
+        new PutCommand({
+          ...input,
+          ConditionExpression: 'attribute_not_exists(pk)',
+        }),
+      );
+      legacyPutCount++;
+    } catch (err) {
+      const msg = String(err);
+      if (msg.includes('ConditionalCheckFailed')) {
+        console.log(`Skipped ${row.account} (already registered in services).`);
+      } else {
+        throw err;
+      }
+    }
+  }
+
+  const store = await loadDynamoServicesStore(docClient, values['services-table'], SystemClock);
+  if (store === undefined) {
+    console.error(`Could not load services store from ${values['services-table']}`);
+    process.exit(1);
+  }
+
+  let envSeedCount = 0;
+  for (const acct of parseSaslAccountsForMigration(saslAccountsRaw)) {
+    const nickKey = caseFold('rfc1459', acct.username);
+    if (seen.has(nickKey)) continue;
+    seen.add(nickKey);
+    const result = store.registerNick(acct.username, acct.password, '');
+    if (result.ok) {
+      envSeedCount++;
+      console.log(`Registered ${acct.username} from SASL_ACCOUNTS env seed.`);
+    } else {
+      console.log(`Skipped ${acct.username} (already registered in services).`);
+    }
+  }
+  await store.flush();
+
+  console.log(
+    `AWS migration complete: ${legacyRows.length} legacy rows scanned ` +
+      `(${legacyPutCount} PutItem'd), ${envSeedCount} env-seed accounts registered.`,
+  );
+}
+
+void main();

package/tools/package.json

@@ -4,6 +4,7 @@
   "type": "module",
   "dependencies": {
     "@serverless-ircd/aws-adapter": "workspace:*",
-    "@serverless-ircd/cf-adapter": "workspace:*"
+    "@serverless-ircd/cf-adapter": "workspace:*",
+    "@serverless-ircd/irc-core": "workspace:*"
   }
 }

package/tools/seed-aws-accounts.ts

@@ -1,25 +1,34 @@
 #!/usr/bin/env node
 /**
- * Seed SASL PLAIN accounts into the DynamoDB `Accounts` table.
+ * Seed SASL PLAIN accounts into the DynamoDB `Services` table (the unified
+ * services credential home).
+ *
+ * Repointed from the legacy `Accounts` table to the `Services` table —
+ * `Services` (`NICK:<fold>` partition) is the single credential home for
+ * SASL PLAIN, SASL EXTERNAL, PASS-auth, and NickServ IDENTIFY. Seeded
+ * accounts verify via `services.verifyNick` end-to-end.
  *
  * Usage:
  *   node --import tsx tools/seed-aws-accounts.ts \
- *     --table StagingAccounts \
+ *     --table StagingServices \
  *     --endpoint http://localhost:8000 \
  *     --accounts alice:s3cret bob:password2
  *
  * Or read from a file (newline-delimited `username:password`):
  *   node --import tsx tools/seed-aws-accounts.ts \
- *     --table StagingAccounts \
+ *     --table StagingServices \
  *     --file accounts.txt
  *
- * The script hashes each password with scrypt (never writes plaintext).
- * Re-running with the same username overwrites the prior row.
+ * The script hashes each password with scrypt (never writes plaintext) and
+ * writes via a conditional PutItem that never clobbers an existing nick
+ * registration (a NickServ-registered nick whose password was set by the
+ * user wins over the seed).
  */
 
 import { readFileSync } from 'node:fs';
 import { parseArgs } from 'node:util';
-import { createDynamoDocumentClient, putAccountCredential } from '@serverless-ircd/aws-adapter';
+import { createDynamoDocumentClient, loadDynamoServicesStore } from '@serverless-ircd/aws-adapter';
+import { SystemClock } from '@serverless-ircd/irc-core';
 
 const { values } = parseArgs({
   options: {
@@ -33,7 +42,7 @@ const { values } = parseArgs({
 
 if (values.table === undefined) {
   console.error(
-    'Usage: seed-aws-accounts --table <TableName> [--endpoint <url>] [--accounts user:pass ...] [--file <path>]',
+    'Usage: seed-aws-accounts --table <ServicesTableName> [--endpoint <url>] [--accounts user:pass ...] [--file <path>]',
   );
   process.exit(1);
 }
@@ -71,9 +80,25 @@ if (pairs.length === 0) {
   process.exit(1);
 }
 
+// Load the services store against the target table, then register each
+// account. `registerNick` is idempotent: it returns `{ ok: false }` when
+// the nick already exists and does NOT overwrite the credential.
+const store = await loadDynamoServicesStore(docClient, values.table, SystemClock);
+if (store === undefined) {
+  console.error(`Could not load services store from table ${values.table}.`);
+  process.exit(1);
+}
+
 for (const { username, password } of pairs) {
-  const entry = await putAccountCredential(docClient, values.table, username, password);
-  console.log(`Seeded ${username} (algorithm=${entry.algorithm})`);
+  const result = store.registerNick(username, password, '');
+  if (result.ok) {
+    console.log(`Seeded ${username}`);
+  } else {
+    console.log(`Skipped ${username} (already registered)`);
+  }
 }
 
-console.log(`Done: ${pairs.length} account(s) written to ${values.table}.`);
+// Flush the write-behind queue so the registrations land in DynamoDB.
+await store.flush();
+
+console.log(`Done: ${pairs.length} account(s) processed against ${values.table}.`);

package/tools/seed-cf-accounts.ts

@@ -1,6 +1,11 @@
 #!/usr/bin/env node
 /**
- * Seed SASL PLAIN accounts into a Cloudflare D1 `accounts` table.
+ * Seed SASL PLAIN accounts into a Cloudflare D1 `nickserv_accounts` table.
+ *
+ * Repointed from the legacy `accounts` table to the unified services table
+ * — `nickserv_accounts` is the single credential home for SASL PLAIN, SASL
+ * EXTERNAL, PASS-auth, and NickServ IDENTIFY. Seeded accounts verify via
+ * `services.verifyNick` end-to-end.
  *
  * Usage:
  *   node --import tsx tools/seed-cf-accounts.ts \
@@ -17,9 +22,10 @@
  *     --file accounts.txt
  *
  * The script hashes each password with scrypt (never writes plaintext) and
- * executes the resulting `INSERT OR REPLACE` via `wrangler d1 execute`.
- * Re-running with the same username overwrites the prior row. The `accounts`
- * table is created (IF NOT EXISTS) on the first run.
+ * executes the resulting `INSERT OR IGNORE` via `wrangler d1 execute`.
+ * `INSERT OR IGNORE` is idempotent: re-running with the same username does
+ * NOT overwrite an existing row (a NickServ-registered nick whose password
+ * was set by the user wins over the seed).
  *
  * Flags:
  *   --database   D1 database name (as declared in wrangler.toml). Required.
@@ -33,10 +39,12 @@
 import { execFileSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { parseArgs } from 'node:util';
+import { CREATE_NICKSERV_ACCOUNTS_SQL } from '@serverless-ircd/cf-adapter';
 import {
-  CREATE_ACCOUNTS_TABLE_SQL,
-  buildAccountPutStatement,
-} from '@serverless-ircd/cf-adapter/accounts';
+  type HashedAccountCredential,
+  caseFold,
+  hashAccountCredential,
+} from '@serverless-ircd/irc-core';
 
 const { values } = parseArgs({
   options: {
@@ -96,10 +104,35 @@ function runD1Execute(sql: string): void {
 }
 
 // Ensure the table exists (idempotent).
-runD1Execute(CREATE_ACCOUNTS_TABLE_SQL);
+runD1Execute(CREATE_NICKSERV_ACCOUNTS_SQL);
+
+/**
+ * Builds a self-contained `INSERT OR IGNORE` SQL statement that writes a
+ * scrypt-hashed `nickserv_accounts` row.
+ *
+ * `INSERT OR IGNORE` (not `INSERT OR REPLACE`) ensures the seed NEVER
+ * clobbers an existing registration — a NickServ-registered nick or a
+ * prior seed's password wins. The row carries an empty email, the default
+ * `'none'` enforcement policy, `cert_subjects = '[]'`, and the scrypt
+ * credential derived from the plaintext password.
+ */
+export function buildNickServPutStatement(
+  username: string,
+  password: string,
+): { entry: HashedAccountCredential; sql: string } {
+  const entry = hashAccountCredential(username, password);
+  const nickKey = caseFold('rfc1459', username);
+  const sql = `INSERT OR IGNORE INTO nickserv_accounts (nick_key, nick, account, email, created_at, enforce, cert_subjects, algorithm, salt, hash) VALUES ('${sqlEscape(nickKey)}', '${sqlEscape(username)}', '${sqlEscape(username)}', '', 0, 'none', '[]', '${sqlEscape(entry.algorithm)}', '${sqlEscape(entry.salt)}', '${sqlEscape(entry.hash)}')`;
+  return { entry, sql };
+}
+
+/** Doubles single quotes for safe embedding in a D1 SQL string literal. */
+function sqlEscape(value: string): string {
+  return value.replace(/'/g, "''");
+}
 
 for (const { username, password } of pairs) {
-  const { entry, sql } = buildAccountPutStatement(username, password);
+  const { entry, sql } = buildNickServPutStatement(username, password);
   runD1Execute(sql);
   console.log(`Seeded ${username} (algorithm=${entry.algorithm})`);
 }

package/tools/tcp-ws-forwarder/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/tcp-ws-forwarder",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "private": true,
   "description": "Local TCP to ws/wss forwarder so standard IRC clients can reach the WebSocket-only ServerlessIRCd transport",
   "license": "BSD-3-Clause",

package/packages/aws-adapter/src/account-store.ts

@@ -1,121 +0,0 @@
-/**
- * SASL account store construction + resolution for the AWS adapter.
- *
- * Centralises `AccountStore` creation so the actor-construction site
- * (`handleDefault`) binds a single helper rather than constructing the
- * store inline. Two sources of credentials are reconciled here:
- *
- *   1. The DynamoDB `Accounts` table (authoritative when populated) —
- *      loaded at cold start into a {@link DynamoAccountStore} by
- *      {@link resolveAccountStore}. Credentials are stored as scrypt
- *      hashes, never plaintext.
- *   2. The parsed server config (`saslAccounts`, sourced from the
- *      `SASL_ACCOUNTS` env var) — the legacy/config fallback used only
- *      when the table is empty, preserving the config-seed behaviour for
- *      deployments that have not migrated to the table.
- *
- * The resolved store is scoped to the Lambda execution context: it
- * persists across warm invocations (via the memoised `HandlerDeps`) but
- * is rebuilt on cold start, picking up account changes made since the
- * last cold start.
- */
-
-import { PutCommand } from '@aws-sdk/lib-dynamodb';
-import type { DynamoDBDocumentClient } from '@aws-sdk/lib-dynamodb';
-import {
-  type AccountStore,
-  InMemoryAccountStore,
-  type ParsedServerConfig,
-} from '@serverless-ircd/irc-core';
-import {
-  DynamoAccountStore,
-  type HashedAccountCredential,
-  hashAccountCredential,
-  loadDynamoAccountStore,
-} from './dynamo-account-store.js';
-
-// Re-export so callers can import everything from one module.
-export {
-  DynamoAccountStore,
-  type HashedAccountCredential,
-  hashAccountCredential,
-  loadDynamoAccountStore,
-};
-
-/**
- * Constructs the config-seeded in-memory account store (the legacy
- * fallback). Returns `undefined` when no accounts are configured so the
- * actor's `ctx.accounts` stays unset (preserving the no-store behaviour:
- * `AUTHENTICATE PLAIN` → `904`).
- *
- * @param serverConfig Parsed config carrying the `saslAccounts` seed list.
- */
-export function bindAccountStore(serverConfig?: ParsedServerConfig): AccountStore | undefined {
-  if (serverConfig === undefined || serverConfig.saslAccounts.length === 0) {
-    return undefined;
-  }
-  return new InMemoryAccountStore(serverConfig.saslAccounts);
-}
-
-/**
- * Resolves the SASL account store for a deployment, applying the
- * table-then-config precedence.
- *
- *   1. Scans the DynamoDB `Accounts` table (pre-loading every hashed
- *      credential into a {@link DynamoAccountStore}). When the table has
- *      one or more rows it is authoritative — the table wins and the
- *      config seed is ignored.
- *   2. When the table is empty, falls back to {@link bindAccountStore}
- *      (the `SASL_ACCOUNTS` env-var seed) so existing deployments that
- *      have not migrated to the table keep working unchanged.
- *   3. Returns `undefined` when neither source has accounts (the default)
- *      so `ctx.accounts` stays unset and `AUTHENTICATE PLAIN` → `904`.
- *
- * Scan failures (table not found, network error) are swallowed and
- * treated as an empty table, falling through to the config seed.
- *
- * @param docClient DynamoDB client addressed at the deployment's tables.
- * @param tableName Physical name of the `Accounts` table for this env.
- * @param serverConfig Parsed config (the config-seed fallback source).
- */
-export async function resolveAccountStore(
-  docClient: DynamoDBDocumentClient,
-  tableName: string,
-  serverConfig?: ParsedServerConfig,
-): Promise<AccountStore | undefined> {
-  try {
-    const store = await loadDynamoAccountStore(docClient, tableName);
-    if (store !== undefined) return store;
-  } catch {
-    // Table might not exist or be unreachable; fall through to config seed.
-  }
-  return bindAccountStore(serverConfig);
-}
-
-/**
- * Writes (or re-seeds) a SASL PLAIN account into the `Accounts` table.
- *
- * The password is hashed via {@link hashAccountCredential} (scrypt,
- * random salt) and stored as a {@link HashedAccountCredential} row —
- * plaintext is never written. A repeat call for the same `username`
- * overwrites the prior row (the PK is `account`), so this is the
- * canonical CRUD/seed entry point for oper and SASL account
- * provisioning.
- *
- * @returns The stored {@link HashedAccountCredential} (for tooling/tests).
- */
-export async function putAccountCredential(
-  docClient: DynamoDBDocumentClient,
-  tableName: string,
-  username: string,
-  password: string,
-): Promise<HashedAccountCredential> {
-  const entry = hashAccountCredential(username, password);
-  await docClient.send(
-    new PutCommand({
-      TableName: tableName,
-      Item: entry,
-    }),
-  );
-  return entry;
-}

package/packages/aws-adapter/src/dynamo-account-store.ts

@@ -1,95 +0,0 @@
-/**
- * DynamoDB-backed {@link AccountStore} primitives for the AWS adapter.
- *
- * The `Accounts` DynamoDB table stores SASL PLAIN credentials as
- * **scrypt hashes** (never plaintext). Each row is a flat
- * {@link HashedAccountCredential} (`{ account, algorithm, salt, hash }`).
- *
- * Two-phase construction keeps the `AccountStore` port synchronous:
- *   1. {@link loadDynamoAccountStore} (async) scans the table at Lambda
- *      cold start and returns a fully-populated `DynamoAccountStore`.
- *   2. `DynamoAccountStore(entries)` (sync constructor) takes the
- *      pre-loaded entries. The class itself has zero DynamoDB
- *      coupling — it works equally well with entries from any source.
- *
- * This mirrors the pre-load pattern documented in
- * `irc-core/src/ports.ts` and used by `MotdProvider` / `MessageStore`:
- * adapters that need an async backend pre-load the data at boot into a
- * synchronously-readable store.
- *
- * The scrypt hashing helpers (`hashAccountCredential` /
- * `verifyHashedPassword` + the `HashedAccountCredential` type) live in
- * `irc-core` and are shared with the CF adapter's `D1AccountStore`. They
- * are re-exported below so existing call sites importing from this module
- * keep working.
- */
-
-import type { ScanCommandOutput } from '@aws-sdk/client-dynamodb';
-import { ScanCommand } from '@aws-sdk/lib-dynamodb';
-import type { DynamoDBDocumentClient } from '@aws-sdk/lib-dynamodb';
-import {
-  type HashedAccountCredential,
-  HashedAccountStore,
-  hashAccountCredential,
-  verifyHashedPassword,
-} from '@serverless-ircd/irc-core';
-
-// Re-export so callers importing these from `@serverless-ircd/aws-adapter`
-// (the historical home of the hashing helpers) keep compiling.
-export { type HashedAccountCredential, hashAccountCredential, verifyHashedPassword };
-
-/**
- * Synchronous {@link AccountStore} backed by pre-loaded hashed credentials.
- *
- * Now a re-export of the shared `HashedAccountStore` from `irc-core` —
- * both adapters use one store implementation. The AWS-specific surface
- * (`loadDynamoAccountStore`) lives below; it diverges from CF only at the
- * scan boundary.
- */
-export { HashedAccountStore as DynamoAccountStore };
-
-/**
- * Scans the `Accounts` table and returns a fully-populated
- * {@link DynamoAccountStore}, or `undefined` when the table has no rows.
- *
- * Handles pagination (`LastEvaluatedKey`) so tables larger than the 1 MB
- * scan page are fully loaded. Rows missing required attributes are
- * silently skipped.
- */
-export async function loadDynamoAccountStore(
-  docClient: DynamoDBDocumentClient,
-  tableName: string,
-): Promise<HashedAccountStore | undefined> {
-  const entries: HashedAccountCredential[] = [];
-  let exclusiveStartKey: Record<string, unknown> | undefined = undefined;
-  do {
-    const result: ScanCommandOutput = await docClient.send(
-      new ScanCommand({
-        TableName: tableName,
-        ExclusiveStartKey: exclusiveStartKey,
-      }),
-    );
-    for (const item of result.Items ?? []) {
-      const account = typeof item.account === 'string' ? item.account : undefined;
-      const algorithm = typeof item.algorithm === 'string' ? item.algorithm : undefined;
-      const salt = typeof item.salt === 'string' ? item.salt : undefined;
-      const hash = typeof item.hash === 'string' ? item.hash : undefined;
-      if (
-        account !== undefined &&
-        algorithm !== undefined &&
-        salt !== undefined &&
-        hash !== undefined
-      ) {
-        entries.push({
-          account,
-          algorithm: algorithm as HashedAccountCredential['algorithm'],
-          salt,
-          hash,
-        });
-      }
-    }
-    exclusiveStartKey = result.LastEvaluatedKey;
-  } while (exclusiveStartKey !== undefined);
-  if (entries.length === 0) return undefined;
-  return new HashedAccountStore(entries);
-}