serverless-ircd 0.8.0 → 0.10.0

package/tools/seed-aws-accounts.ts

@@ -1,25 +1,34 @@
 #!/usr/bin/env node
 /**
- * Seed SASL PLAIN accounts into the DynamoDB `Accounts` table.
+ * Seed SASL PLAIN accounts into the DynamoDB `Services` table (the unified
+ * services credential home).
+ *
+ * Repointed from the legacy `Accounts` table to the `Services` table —
+ * `Services` (`NICK:<fold>` partition) is the single credential home for
+ * SASL PLAIN, SASL EXTERNAL, PASS-auth, and NickServ IDENTIFY. Seeded
+ * accounts verify via `services.verifyNick` end-to-end.
  *
  * Usage:
  *   node --import tsx tools/seed-aws-accounts.ts \
- *     --table StagingAccounts \
+ *     --table StagingServices \
  *     --endpoint http://localhost:8000 \
  *     --accounts alice:s3cret bob:password2
  *
  * Or read from a file (newline-delimited `username:password`):
  *   node --import tsx tools/seed-aws-accounts.ts \
- *     --table StagingAccounts \
+ *     --table StagingServices \
  *     --file accounts.txt
  *
- * The script hashes each password with scrypt (never writes plaintext).
- * Re-running with the same username overwrites the prior row.
+ * The script hashes each password with scrypt (never writes plaintext) and
+ * writes via a conditional PutItem that never clobbers an existing nick
+ * registration (a NickServ-registered nick whose password was set by the
+ * user wins over the seed).
  */
 
 import { readFileSync } from 'node:fs';
 import { parseArgs } from 'node:util';
-import { createDynamoDocumentClient, putAccountCredential } from '@serverless-ircd/aws-adapter';
+import { createDynamoDocumentClient, loadDynamoServicesStore } from '@serverless-ircd/aws-adapter';
+import { SystemClock } from '@serverless-ircd/irc-core';
 
 const { values } = parseArgs({
   options: {
@@ -33,7 +42,7 @@ const { values } = parseArgs({
 
 if (values.table === undefined) {
   console.error(
-    'Usage: seed-aws-accounts --table <TableName> [--endpoint <url>] [--accounts user:pass ...] [--file <path>]',
+    'Usage: seed-aws-accounts --table <ServicesTableName> [--endpoint <url>] [--accounts user:pass ...] [--file <path>]',
   );
   process.exit(1);
 }
@@ -71,9 +80,25 @@ if (pairs.length === 0) {
   process.exit(1);
 }
 
+// Load the services store against the target table, then register each
+// account. `registerNick` is idempotent: it returns `{ ok: false }` when
+// the nick already exists and does NOT overwrite the credential.
+const store = await loadDynamoServicesStore(docClient, values.table, SystemClock);
+if (store === undefined) {
+  console.error(`Could not load services store from table ${values.table}.`);
+  process.exit(1);
+}
+
 for (const { username, password } of pairs) {
-  const entry = await putAccountCredential(docClient, values.table, username, password);
-  console.log(`Seeded ${username} (algorithm=${entry.algorithm})`);
+  const result = store.registerNick(username, password, '');
+  if (result.ok) {
+    console.log(`Seeded ${username}`);
+  } else {
+    console.log(`Skipped ${username} (already registered)`);
+  }
 }
 
-console.log(`Done: ${pairs.length} account(s) written to ${values.table}.`);
+// Flush the write-behind queue so the registrations land in DynamoDB.
+await store.flush();
+
+console.log(`Done: ${pairs.length} account(s) processed against ${values.table}.`);

package/tools/seed-cf-accounts.ts

@@ -1,6 +1,11 @@
 #!/usr/bin/env node
 /**
- * Seed SASL PLAIN accounts into a Cloudflare D1 `accounts` table.
+ * Seed SASL PLAIN accounts into a Cloudflare D1 `nickserv_accounts` table.
+ *
+ * Repointed from the legacy `accounts` table to the unified services table
+ * — `nickserv_accounts` is the single credential home for SASL PLAIN, SASL
+ * EXTERNAL, PASS-auth, and NickServ IDENTIFY. Seeded accounts verify via
+ * `services.verifyNick` end-to-end.
  *
  * Usage:
  *   node --import tsx tools/seed-cf-accounts.ts \
@@ -17,9 +22,10 @@
  *     --file accounts.txt
  *
  * The script hashes each password with scrypt (never writes plaintext) and
- * executes the resulting `INSERT OR REPLACE` via `wrangler d1 execute`.
- * Re-running with the same username overwrites the prior row. The `accounts`
- * table is created (IF NOT EXISTS) on the first run.
+ * executes the resulting `INSERT OR IGNORE` via `wrangler d1 execute`.
+ * `INSERT OR IGNORE` is idempotent: re-running with the same username does
+ * NOT overwrite an existing row (a NickServ-registered nick whose password
+ * was set by the user wins over the seed).
  *
  * Flags:
  *   --database   D1 database name (as declared in wrangler.toml). Required.
@@ -33,10 +39,12 @@
 import { execFileSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { parseArgs } from 'node:util';
+import { CREATE_NICKSERV_ACCOUNTS_SQL } from '@serverless-ircd/cf-adapter';
 import {
-  CREATE_ACCOUNTS_TABLE_SQL,
-  buildAccountPutStatement,
-} from '@serverless-ircd/cf-adapter/accounts';
+  type HashedAccountCredential,
+  caseFold,
+  hashAccountCredential,
+} from '@serverless-ircd/irc-core';
 
 const { values } = parseArgs({
   options: {
@@ -96,10 +104,35 @@ function runD1Execute(sql: string): void {
 }
 
 // Ensure the table exists (idempotent).
-runD1Execute(CREATE_ACCOUNTS_TABLE_SQL);
+runD1Execute(CREATE_NICKSERV_ACCOUNTS_SQL);
+
+/**
+ * Builds a self-contained `INSERT OR IGNORE` SQL statement that writes a
+ * scrypt-hashed `nickserv_accounts` row.
+ *
+ * `INSERT OR IGNORE` (not `INSERT OR REPLACE`) ensures the seed NEVER
+ * clobbers an existing registration — a NickServ-registered nick or a
+ * prior seed's password wins. The row carries an empty email, the default
+ * `'none'` enforcement policy, `cert_subjects = '[]'`, and the scrypt
+ * credential derived from the plaintext password.
+ */
+export function buildNickServPutStatement(
+  username: string,
+  password: string,
+): { entry: HashedAccountCredential; sql: string } {
+  const entry = hashAccountCredential(username, password);
+  const nickKey = caseFold('rfc1459', username);
+  const sql = `INSERT OR IGNORE INTO nickserv_accounts (nick_key, nick, account, email, created_at, enforce, cert_subjects, algorithm, salt, hash) VALUES ('${sqlEscape(nickKey)}', '${sqlEscape(username)}', '${sqlEscape(username)}', '', 0, 'none', '[]', '${sqlEscape(entry.algorithm)}', '${sqlEscape(entry.salt)}', '${sqlEscape(entry.hash)}')`;
+  return { entry, sql };
+}
+
+/** Doubles single quotes for safe embedding in a D1 SQL string literal. */
+function sqlEscape(value: string): string {
+  return value.replace(/'/g, "''");
+}
 
 for (const { username, password } of pairs) {
-  const { entry, sql } = buildAccountPutStatement(username, password);
+  const { entry, sql } = buildNickServPutStatement(username, password);
   runD1Execute(sql);
   console.log(`Seeded ${username} (algorithm=${entry.algorithm})`);
 }

package/tools/tcp-ws-forwarder/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/tcp-ws-forwarder",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "private": true,
   "description": "Local TCP to ws/wss forwarder so standard IRC clients can reach the WebSocket-only ServerlessIRCd transport",
   "license": "BSD-3-Clause",

package/tools/tcp-ws-forwarder/tests/close-error.test.ts

@@ -0,0 +1,40 @@
+import type { Socket } from 'node:net';
+import { describe, expect, it, vi } from 'vitest';
+
+/**
+ * Dedicated coverage for the `server.close` error-rejection branch in
+ * forwarder close() (forwarder.ts:135): `server.close((err) => err ?
+ * reject(err) : resolve())`. Under normal operation the callback never
+ * surfaces an error, so the truthy branch is unreachable without a stub.
+ *
+ * This file mocks `node:net` so the forwarder's TCP listener gets a server
+ * whose `close` invokes its callback with a synthetic Error. The mock is
+ * file-scoped (vi.mock), leaving the real-socket integration suite in
+ * forwarder.test.ts untouched.
+ */
+
+vi.mock('node:net', async (importActual) => {
+  const actual = await importActual<typeof import('node:net')>();
+  const wrappedCreateServer = (connectionListener?: (socket: Socket) => void) => {
+    const server = actual.createServer(connectionListener);
+    const realClose = server.close.bind(server);
+    // Drive the real shutdown so the listener is actually torn down, but
+    // surface a synthetic error to the callback to exercise the
+    // error-rejection branch.
+    server.close = ((cb?: (err?: Error | null) => void) => {
+      realClose(() => cb?.(new Error('synthetic server.close failure')));
+      return server;
+    }) as unknown as typeof server.close;
+    return server;
+  };
+  return { ...actual, createServer: wrappedCreateServer as unknown as typeof actual.createServer };
+});
+
+const { startForwarder } = await import('../src/forwarder');
+
+describe('forwarder close() — server.close error branch', () => {
+  it('rejects when server.close surfaces an error to its callback', async () => {
+    const fwd = await startForwarder({ listenPort: 0, targetUrl: 'ws://127.0.0.1:1/' });
+    await expect(fwd.close()).rejects.toThrow('synthetic server.close failure');
+  });
+});

package/tools/tcp-ws-forwarder/tests/defensive-branches.test.ts

@@ -0,0 +1,78 @@
+import { EventEmitter } from 'node:events';
+import type { Socket } from 'node:net';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+/**
+ * Coverage for two defensive branches in forwarder.ts that cannot be reached
+ * through real sockets:
+ *   - line 148: `server.address()` always returns an AddressInfo after the
+ *     'listening' event fires, so the `opts.listenPort` ternary fallback is
+ *     never taken in practice.
+ *   - line 184: a connected server-side socket always carries remoteAddress/
+ *     remotePort, so the `?? '?'` remote-label fallbacks are never taken.
+ *
+ * Both are exercised here by mocking `node:net` so the forwarder's TCP server
+ * reports a null address and its connection listener is captured, allowing a
+ * synthetic address-less socket to be fed in. The mock is file-scoped
+ * (vi.mock); the real-socket integration suite in forwarder.test.ts is
+ * untouched.
+ */
+
+const state = vi.hoisted(() => ({
+  captured: undefined as ((socket: Socket) => void) | undefined,
+}));
+
+vi.mock('node:net', async (importActual) => {
+  const actual = await importActual<typeof import('node:net')>();
+  const wrappedCreateServer = (connectionListener?: (socket: Socket) => void) => {
+    state.captured = connectionListener;
+    const server = actual.createServer(connectionListener);
+    // Force the defensive AddressInfo fallback (forwarder.ts:148).
+    server.address = (() => null) as typeof server.address;
+    return server;
+  };
+  return {
+    ...actual,
+    createServer: wrappedCreateServer as unknown as typeof actual.createServer,
+  };
+});
+
+const { startForwarder } = await import('../src/forwarder');
+
+const openForwarders: { close(): Promise<void> }[] = [];
+afterEach(async () => {
+  for (const f of openForwarders.splice(0)) {
+    await f.close().catch(() => undefined);
+  }
+});
+
+describe('forwarder — defensive branches unreachable via real sockets', () => {
+  it('falls back to opts.listenPort when server.address() yields no AddressInfo', async () => {
+    const fwd = await startForwarder({ listenPort: 0, targetUrl: 'ws://127.0.0.1:1/' });
+    openForwarders.push(fwd);
+    // server.address() returns null → the ternary takes its false branch and
+    // the reported port is the requested opts.listenPort (0), not a real
+    // ephemeral port.
+    expect(fwd.listenPort).toBe(0);
+  });
+
+  it('builds the remote label with "?" placeholders for an address-less socket', async () => {
+    const fwd = await startForwarder({ listenPort: 0, targetUrl: 'ws://127.0.0.1:1/' });
+    openForwarders.push(fwd);
+
+    // Synthesize an incoming connection on a socket with no remote address/
+    // port; bridgeConnection must build the `?:?` label (forwarder.ts:184)
+    // and register the bridge without throwing.
+    const fakeSocket = new EventEmitter();
+    Object.assign(fakeSocket, {
+      remoteAddress: undefined,
+      remotePort: undefined,
+      destroy: () => undefined,
+    });
+    const listener = state.captured;
+    if (listener === undefined) throw new Error('connection listener was not captured');
+    listener(fakeSocket as unknown as Socket);
+
+    expect([...fwd.testSockets]).toContain(fakeSocket);
+  });
+});

package/tools/tcp-ws-forwarder/tests/forwarder.test.ts

@@ -735,3 +735,54 @@ describe('forwarder — logging', () => {
     infoSpy.mockRestore();
   });
 });
+
+describe('forwarder — empty-line drop (TCP→WS guard)', () => {
+  it('drops a bare-CRLF empty line and forwards only the next non-empty line', async () => {
+    const target = await startTarget();
+    openServers.push(target);
+    const fwd = await startForwarder({ listenPort: 0, targetUrl: `ws://127.0.0.1:${target.port}` });
+    openServers.push(fwd);
+
+    const client = new TcpClient(fwd.listenPort);
+    openClients.push(client);
+    await client.opened();
+
+    // A bare CRLF yields an empty line from the LineScanner; the
+    // `line.length > 0` guard drops it, so only the subsequent real line is
+    // bridged as a single WS frame.
+    client.sendRaw('\r\n');
+    client.send('PING :after-empty');
+
+    const ws = await target.waitForConnection();
+    await new Promise<void>((res) => ws.once('message', () => res()));
+    expect(target.frames).toEqual(['PING :after-empty']);
+  });
+});
+
+describe('forwarder — post-teardown error suppression', () => {
+  it('suppresses a tcp socket error arriving after the bridge has torn down', async () => {
+    const target = await startTarget();
+    openServers.push(target);
+    const fwd = await startForwarder({ listenPort: 0, targetUrl: `ws://127.0.0.1:${target.port}` });
+    openServers.push(fwd);
+
+    const client = new TcpClient(fwd.listenPort);
+    openClients.push(client);
+    await client.opened();
+    await target.waitForConnection();
+
+    const serverSide = [...fwd.testSockets][0];
+    if (serverSide === undefined) throw new Error('no server-side socket');
+
+    // Tearing the bridge down arms the `bridgeClosed` guard; a tcp error
+    // arriving afterwards (e.g. an RST echoing our own destroy()) is
+    // expected and must be silently suppressed.
+    await fwd.close();
+
+    const errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+    serverSide.emit('error', new Error('post-teardown noise'));
+    await new Promise((r) => setImmediate(r));
+    expect(errSpy).not.toHaveBeenCalled();
+    errSpy.mockRestore();
+  });
+});

package/tools/tcp-ws-forwarder/tests/logger.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 import { ConsoleLogger, LogLevel, parseLogLevel } from '../src/logger';
 
 /**
@@ -134,3 +134,33 @@ describe('ConsoleLogger — output shape', () => {
     expect(JSON.parse(lines.error[0] as string).msg).toBe('e');
   });
 });
+
+describe('ConsoleLogger — global console sinks', () => {
+  it('routes a warn record to the global console.warn sink when no sinks are injected', () => {
+    const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    const log = new ConsoleLogger(undefined, LogLevel.Warn);
+    log.warn('global sink warn', { k: 'v' });
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+    const rec = JSON.parse(String(warnSpy.mock.calls[0]?.[0] ?? '{}'));
+    expect(rec.msg).toBe('global sink warn');
+    warnSpy.mockRestore();
+  });
+
+  it('falls back to no-op drop-sinks when globalThis.console is undefined', () => {
+    const original = globalThis.console;
+    (globalThis as { console?: Console | undefined }).console = undefined;
+    try {
+      // globalConsoleSinks() takes the `console === undefined` branch and
+      // returns drop-sinks; every level must swallow without throwing.
+      const log = new ConsoleLogger(undefined, LogLevel.Debug);
+      expect(() => {
+        log.debug('d');
+        log.info('i');
+        log.warn('w');
+        log.error('e');
+      }).not.toThrow();
+    } finally {
+      (globalThis as { console?: Console | undefined }).console = original;
+    }
+  });
+});

package/packages/aws-adapter/src/account-store.ts

@@ -1,121 +0,0 @@
-/**
- * SASL account store construction + resolution for the AWS adapter.
- *
- * Centralises `AccountStore` creation so the actor-construction site
- * (`handleDefault`) binds a single helper rather than constructing the
- * store inline. Two sources of credentials are reconciled here:
- *
- *   1. The DynamoDB `Accounts` table (authoritative when populated) —
- *      loaded at cold start into a {@link DynamoAccountStore} by
- *      {@link resolveAccountStore}. Credentials are stored as scrypt
- *      hashes, never plaintext.
- *   2. The parsed server config (`saslAccounts`, sourced from the
- *      `SASL_ACCOUNTS` env var) — the legacy/config fallback used only
- *      when the table is empty, preserving the config-seed behaviour for
- *      deployments that have not migrated to the table.
- *
- * The resolved store is scoped to the Lambda execution context: it
- * persists across warm invocations (via the memoised `HandlerDeps`) but
- * is rebuilt on cold start, picking up account changes made since the
- * last cold start.
- */
-
-import { PutCommand } from '@aws-sdk/lib-dynamodb';
-import type { DynamoDBDocumentClient } from '@aws-sdk/lib-dynamodb';
-import {
-  type AccountStore,
-  InMemoryAccountStore,
-  type ParsedServerConfig,
-} from '@serverless-ircd/irc-core';
-import {
-  DynamoAccountStore,
-  type HashedAccountCredential,
-  hashAccountCredential,
-  loadDynamoAccountStore,
-} from './dynamo-account-store.js';
-
-// Re-export so callers can import everything from one module.
-export {
-  DynamoAccountStore,
-  type HashedAccountCredential,
-  hashAccountCredential,
-  loadDynamoAccountStore,
-};
-
-/**
- * Constructs the config-seeded in-memory account store (the legacy
- * fallback). Returns `undefined` when no accounts are configured so the
- * actor's `ctx.accounts` stays unset (preserving the no-store behaviour:
- * `AUTHENTICATE PLAIN` → `904`).
- *
- * @param serverConfig Parsed config carrying the `saslAccounts` seed list.
- */
-export function bindAccountStore(serverConfig?: ParsedServerConfig): AccountStore | undefined {
-  if (serverConfig === undefined || serverConfig.saslAccounts.length === 0) {
-    return undefined;
-  }
-  return new InMemoryAccountStore(serverConfig.saslAccounts);
-}
-
-/**
- * Resolves the SASL account store for a deployment, applying the
- * table-then-config precedence.
- *
- *   1. Scans the DynamoDB `Accounts` table (pre-loading every hashed
- *      credential into a {@link DynamoAccountStore}). When the table has
- *      one or more rows it is authoritative — the table wins and the
- *      config seed is ignored.
- *   2. When the table is empty, falls back to {@link bindAccountStore}
- *      (the `SASL_ACCOUNTS` env-var seed) so existing deployments that
- *      have not migrated to the table keep working unchanged.
- *   3. Returns `undefined` when neither source has accounts (the default)
- *      so `ctx.accounts` stays unset and `AUTHENTICATE PLAIN` → `904`.
- *
- * Scan failures (table not found, network error) are swallowed and
- * treated as an empty table, falling through to the config seed.
- *
- * @param docClient DynamoDB client addressed at the deployment's tables.
- * @param tableName Physical name of the `Accounts` table for this env.
- * @param serverConfig Parsed config (the config-seed fallback source).
- */
-export async function resolveAccountStore(
-  docClient: DynamoDBDocumentClient,
-  tableName: string,
-  serverConfig?: ParsedServerConfig,
-): Promise<AccountStore | undefined> {
-  try {
-    const store = await loadDynamoAccountStore(docClient, tableName);
-    if (store !== undefined) return store;
-  } catch {
-    // Table might not exist or be unreachable; fall through to config seed.
-  }
-  return bindAccountStore(serverConfig);
-}
-
-/**
- * Writes (or re-seeds) a SASL PLAIN account into the `Accounts` table.
- *
- * The password is hashed via {@link hashAccountCredential} (scrypt,
- * random salt) and stored as a {@link HashedAccountCredential} row —
- * plaintext is never written. A repeat call for the same `username`
- * overwrites the prior row (the PK is `account`), so this is the
- * canonical CRUD/seed entry point for oper and SASL account
- * provisioning.
- *
- * @returns The stored {@link HashedAccountCredential} (for tooling/tests).
- */
-export async function putAccountCredential(
-  docClient: DynamoDBDocumentClient,
-  tableName: string,
-  username: string,
-  password: string,
-): Promise<HashedAccountCredential> {
-  const entry = hashAccountCredential(username, password);
-  await docClient.send(
-    new PutCommand({
-      TableName: tableName,
-      Item: entry,
-    }),
-  );
-  return entry;
-}

package/packages/aws-adapter/src/dynamo-account-store.ts

@@ -1,95 +0,0 @@
-/**
- * DynamoDB-backed {@link AccountStore} primitives for the AWS adapter.
- *
- * The `Accounts` DynamoDB table stores SASL PLAIN credentials as
- * **scrypt hashes** (never plaintext). Each row is a flat
- * {@link HashedAccountCredential} (`{ account, algorithm, salt, hash }`).
- *
- * Two-phase construction keeps the `AccountStore` port synchronous:
- *   1. {@link loadDynamoAccountStore} (async) scans the table at Lambda
- *      cold start and returns a fully-populated `DynamoAccountStore`.
- *   2. `DynamoAccountStore(entries)` (sync constructor) takes the
- *      pre-loaded entries. The class itself has zero DynamoDB
- *      coupling — it works equally well with entries from any source.
- *
- * This mirrors the pre-load pattern documented in
- * `irc-core/src/ports.ts` and used by `MotdProvider` / `MessageStore`:
- * adapters that need an async backend pre-load the data at boot into a
- * synchronously-readable store.
- *
- * The scrypt hashing helpers (`hashAccountCredential` /
- * `verifyHashedPassword` + the `HashedAccountCredential` type) live in
- * `irc-core` and are shared with the CF adapter's `D1AccountStore`. They
- * are re-exported below so existing call sites importing from this module
- * keep working.
- */
-
-import type { ScanCommandOutput } from '@aws-sdk/client-dynamodb';
-import { ScanCommand } from '@aws-sdk/lib-dynamodb';
-import type { DynamoDBDocumentClient } from '@aws-sdk/lib-dynamodb';
-import {
-  type HashedAccountCredential,
-  HashedAccountStore,
-  hashAccountCredential,
-  verifyHashedPassword,
-} from '@serverless-ircd/irc-core';
-
-// Re-export so callers importing these from `@serverless-ircd/aws-adapter`
-// (the historical home of the hashing helpers) keep compiling.
-export { type HashedAccountCredential, hashAccountCredential, verifyHashedPassword };
-
-/**
- * Synchronous {@link AccountStore} backed by pre-loaded hashed credentials.
- *
- * Now a re-export of the shared `HashedAccountStore` from `irc-core` —
- * both adapters use one store implementation. The AWS-specific surface
- * (`loadDynamoAccountStore`) lives below; it diverges from CF only at the
- * scan boundary.
- */
-export { HashedAccountStore as DynamoAccountStore };
-
-/**
- * Scans the `Accounts` table and returns a fully-populated
- * {@link DynamoAccountStore}, or `undefined` when the table has no rows.
- *
- * Handles pagination (`LastEvaluatedKey`) so tables larger than the 1 MB
- * scan page are fully loaded. Rows missing required attributes are
- * silently skipped.
- */
-export async function loadDynamoAccountStore(
-  docClient: DynamoDBDocumentClient,
-  tableName: string,
-): Promise<HashedAccountStore | undefined> {
-  const entries: HashedAccountCredential[] = [];
-  let exclusiveStartKey: Record<string, unknown> | undefined = undefined;
-  do {
-    const result: ScanCommandOutput = await docClient.send(
-      new ScanCommand({
-        TableName: tableName,
-        ExclusiveStartKey: exclusiveStartKey,
-      }),
-    );
-    for (const item of result.Items ?? []) {
-      const account = typeof item.account === 'string' ? item.account : undefined;
-      const algorithm = typeof item.algorithm === 'string' ? item.algorithm : undefined;
-      const salt = typeof item.salt === 'string' ? item.salt : undefined;
-      const hash = typeof item.hash === 'string' ? item.hash : undefined;
-      if (
-        account !== undefined &&
-        algorithm !== undefined &&
-        salt !== undefined &&
-        hash !== undefined
-      ) {
-        entries.push({
-          account,
-          algorithm: algorithm as HashedAccountCredential['algorithm'],
-          salt,
-          hash,
-        });
-      }
-    }
-    exclusiveStartKey = result.LastEvaluatedKey;
-  } while (exclusiveStartKey !== undefined);
-  if (entries.length === 0) return undefined;
-  return new HashedAccountStore(entries);
-}