@aooth/auth 0.1.18 → 0.1.20

package/dist/atscript-db.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_clock = require("./clock-Bl-H3eqE.cjs");
 const require_payload = require("./payload-BJjvj8AH.cjs");
-const require_auth_code_store = require("./auth-code-store-B_m51OSB.cjs");
+const require_dynamic_client_store = require("./dynamic-client-store-DAStgv2j.cjs");
 let node_crypto = require("node:crypto");
 //#region src/atscript-db/authz-stores.ts
 /**
@@ -9,7 +9,7 @@ let node_crypto = require("node:crypto");
 * fresh opaque `handle`; `get` rejects (and lazily evicts) a past-expiry row;
 * `delete` drops it once consumed. PK is `handle`, so reads/deletes are O(1).
 */
-var PendingAuthorizationStoreAtscriptDb = class extends require_auth_code_store.PendingAuthorizationStore {
+var PendingAuthorizationStoreAtscriptDb = class extends require_dynamic_client_store.PendingAuthorizationStore {
 	table;
 	clock;
 	ttlMs;
@@ -32,7 +32,9 @@ var PendingAuthorizationStoreAtscriptDb = class extends require_auth_code_store.
 			createdAt: now,
 			expiresAt,
 			...rec.clientId !== void 0 && { clientId: rec.clientId },
+			...rec.clientName !== void 0 && { clientName: rec.clientName },
 			...rec.clientState !== void 0 && { clientState: rec.clientState },
+			...rec.resource !== void 0 && { resource: rec.resource },
 			...rec.scope !== void 0 && { scope: rec.scope },
 			...rec.nonce !== void 0 && { nonce: rec.nonce },
 			...rec.idToken !== void 0 && { idToken: rec.idToken },
@@ -69,7 +71,9 @@ function rowToPending(row) {
 		expiresAt: row.expiresAt
 	};
 	if (row.clientId != null) out.clientId = row.clientId;
+	if (row.clientName != null) out.clientName = row.clientName;
 	if (row.clientState != null) out.clientState = row.clientState;
+	if (row.resource != null) out.resource = row.resource;
 	if (row.scope != null) out.scope = row.scope;
 	if (row.nonce != null) out.nonce = row.nonce;
 	if (row.idToken != null) out.idToken = row.idToken;
@@ -86,7 +90,7 @@ function rowToPending(row) {
 * back-button replay loses the race and gets `null`. (The delete is the claim,
 * so no version column is needed — `deleteOne(PK)` is atomic per the DB engine.)
 */
-var AuthCodeStoreAtscriptDb = class extends require_auth_code_store.AuthCodeStore {
+var AuthCodeStoreAtscriptDb = class extends require_dynamic_client_store.AuthCodeStore {
 	table;
 	clock;
 	ttlMs;
@@ -107,6 +111,7 @@ var AuthCodeStoreAtscriptDb = class extends require_auth_code_store.AuthCodeStor
 			expiresAt: this.clock.now() + this.ttlMs,
 			...rec.clientId !== void 0 && { clientId: rec.clientId },
 			...rec.scope !== void 0 && { scope: rec.scope },
+			...rec.resource !== void 0 && { resource: rec.resource },
 			...rec.nonce !== void 0 && { nonce: rec.nonce },
 			...rec.idToken !== void 0 && { idToken: rec.idToken },
 			...rec.accessToken !== void 0 && { accessToken: rec.accessToken },
@@ -134,12 +139,83 @@ function rowToAuthCode(row) {
 	};
 	if (row.clientId != null) out.clientId = row.clientId;
 	if (row.scope != null) out.scope = row.scope;
+	if (row.resource != null) out.resource = row.resource;
 	if (row.nonce != null) out.nonce = row.nonce;
 	if (row.idToken != null) out.idToken = row.idToken;
 	if (row.accessToken != null) out.accessToken = row.accessToken;
 	if (row.audience != null) out.audience = row.audience;
 	return out;
 }
+/**
+* Durable {@link DynamicClientStore}. Long-lived rows (a connector caches its
+* `client_id` across grants). `touch` is the portable findOne + replaceOne
+* (same trick as `CredentialStoreAtscriptDb.touch` — no engine-specific patch
+* op); `deleteUnusedBefore` is one mass `deleteMany` over
+* `createdAt < cutoff && lastUsedAt unset` — the never-used GC.
+*/
+var DynamicClientStoreAtscriptDb = class extends require_dynamic_client_store.DynamicClientStore {
+	table;
+	clock;
+	constructor(opts) {
+		super();
+		this.table = opts.table;
+		this.clock = opts.clock ?? require_clock.defaultClock;
+	}
+	async create(rec) {
+		const row = {
+			clientId: (0, node_crypto.randomUUID)(),
+			redirectUris: JSON.stringify(rec.redirectUris),
+			tokenEndpointAuthMethod: rec.tokenEndpointAuthMethod,
+			grantTypes: JSON.stringify(rec.grantTypes),
+			responseTypes: JSON.stringify(rec.responseTypes),
+			createdAt: this.clock.now(),
+			...rec.clientName !== void 0 && { clientName: rec.clientName },
+			...rec.scope !== void 0 && { scope: rec.scope }
+		};
+		await this.table.insertOne(row);
+		return rowToDynamicClient(row);
+	}
+	async get(clientId) {
+		const row = await this.table.findOne({ filter: { clientId } });
+		return row ? rowToDynamicClient(row) : null;
+	}
+	async delete(clientId) {
+		const { deletedCount } = await this.table.deleteOne(clientId);
+		return deletedCount > 0;
+	}
+	async count() {
+		return this.table.count({});
+	}
+	async touch(clientId, at) {
+		const row = await this.table.findOne({ filter: { clientId } });
+		if (!row) return;
+		await this.table.replaceOne({
+			...row,
+			lastUsedAt: at
+		});
+	}
+	async deleteUnusedBefore(cutoff) {
+		const { deletedCount } = await this.table.deleteMany({
+			createdAt: { $lt: cutoff },
+			lastUsedAt: { $exists: false }
+		});
+		return deletedCount;
+	}
+};
+function rowToDynamicClient(row) {
+	const out = {
+		clientId: row.clientId,
+		redirectUris: JSON.parse(row.redirectUris),
+		tokenEndpointAuthMethod: row.tokenEndpointAuthMethod,
+		grantTypes: JSON.parse(row.grantTypes),
+		responseTypes: JSON.parse(row.responseTypes),
+		createdAt: row.createdAt
+	};
+	if (row.clientName != null) out.clientName = row.clientName;
+	if (row.scope != null) out.scope = row.scope;
+	if (row.lastUsedAt != null) out.lastUsedAt = row.lastUsedAt;
+	return out;
+}
 //#endregion
 //#region src/atscript-db/index.ts
 /**
@@ -157,13 +233,15 @@ function rowToAuthCode(row) {
 */
 var CredentialStoreAtscriptDb = class {
 	table;
+	metadataField;
 	constructor(opts) {
 		this.table = opts.table;
+		this.metadataField = opts.metadataField;
 	}
 	async persist(state, ttl) {
 		const token = (0, node_crypto.randomUUID)();
 		const expiresAt = typeof ttl === "number" ? Date.now() + ttl : state.expiresAt;
-		await this.table.insertOne(stateToRow(state, token, expiresAt));
+		await this.table.insertOne(stateToRow(state, token, expiresAt, this.metadataField));
 		return token;
 	}
 	async retrieve(token) {
@@ -173,7 +251,7 @@ var CredentialStoreAtscriptDb = class {
 			await this.table.deleteOne(token).catch(() => {});
 			return null;
 		}
-		return rowToState(row);
+		return rowToState(row, this.metadataField);
 	}
 	async consume(token) {
 		const state = await this.retrieve(token);
@@ -187,7 +265,7 @@ var CredentialStoreAtscriptDb = class {
 			await this.revoke(token);
 			return token;
 		}
-		await this.table.replaceOne(stateToRow(state, token, state.expiresAt));
+		await this.table.replaceOne(stateToRow(state, token, state.expiresAt, this.metadataField));
 		return token;
 	}
 	async revoke(token) {
@@ -216,7 +294,7 @@ var CredentialStoreAtscriptDb = class {
 				continue;
 			}
 			out.push({
-				...rowToState(row),
+				...rowToState(row, this.metadataField),
 				token: row.token
 			});
 		}
@@ -229,30 +307,45 @@ var CredentialStoreAtscriptDb = class {
 * (so an envelope field wins a name clash), then the fixed envelope fields and
 * the resolved `token` + `expiresAt`. Shared by `persist` and `update`, which
 * differ only in the `expiresAt` they resolve.
+*
+* The envelope's `metadata` is written to the consumer's `metadataField`
+* column (a dynamic key the static row type can't carry) — only when the
+* field is configured; otherwise metadata is silently not persisted.
 */
-function stateToRow(state, token, expiresAt) {
-	return {
+function stateToRow(state, token, expiresAt, metadataField) {
+	const row = {
 		...require_payload.credentialPayloadOf(state),
 		token,
 		userId: state.userId,
 		issuedAt: state.issuedAt,
 		expiresAt,
 		kind: state.kind,
-		metadata: state.metadata,
 		parentCredentialId: state.parentCredentialId,
 		rotatedAt: state.rotatedAt,
 		sessionId: state.sessionId,
 		lastSeenAt: state.lastSeenAt
 	};
+	if (metadataField !== void 0 && state.metadata !== void 0) row[metadataField] = state.metadata;
+	return row;
 }
-function rowToState(row) {
+/**
+* Inverse of {@link stateToRow}. The consumer's `metadataField` column maps
+* back onto the envelope's `metadata` — and is excluded from the extracted
+* payload (it is envelope data riding under a consumer-chosen name, not a
+* typed payload field).
+*/
+function rowToState(row, metadataField) {
 	const state = {
 		...require_payload.credentialPayloadOf(row),
 		userId: row.userId,
 		issuedAt: row.issuedAt,
 		expiresAt: row.expiresAt
 	};
-	if (row.metadata !== void 0) state.metadata = row.metadata;
+	if (metadataField !== void 0) {
+		delete state[metadataField];
+		const metadata = row[metadataField];
+		if (metadata !== void 0) state.metadata = metadata;
+	}
 	if (row.kind === "access" || row.kind === "refresh") state.kind = row.kind;
 	if (row.parentCredentialId !== void 0) state.parentCredentialId = row.parentCredentialId;
 	if (row.rotatedAt !== void 0) state.rotatedAt = row.rotatedAt;
@@ -263,4 +356,5 @@ function rowToState(row) {
 //#endregion
 exports.AuthCodeStoreAtscriptDb = AuthCodeStoreAtscriptDb;
 exports.CredentialStoreAtscriptDb = CredentialStoreAtscriptDb;
+exports.DynamicClientStoreAtscriptDb = DynamicClientStoreAtscriptDb;
 exports.PendingAuthorizationStoreAtscriptDb = PendingAuthorizationStoreAtscriptDb;

package/dist/atscript-db.d.cts

@@ -1,6 +1,6 @@
 import { a as CredentialState, t as CredentialStore } from "./store-BG6m6oSJ.cjs";
 import { t as Clock } from "./clock-BjXa0LXb.cjs";
-import { a as NewAuthCode, c as PendingAuthorization, l as PendingAuthorizationStore, n as AuthCodeStore, s as NewPendingAuthorization, t as AuthCode } from "./auth-code-store-BZ88d_tq.cjs";
+import { a as NewDynamicClient, f as NewPendingAuthorization, m as PendingAuthorizationStore, n as DynamicClientStore, o as AuthCode, p as PendingAuthorization, s as AuthCodeStore, t as DynamicClient, u as NewAuthCode } from "./dynamic-client-store-DzqdUwnw.cjs";
 
 //#region src/atscript-db/authz-stores.d.ts
 /**
@@ -22,7 +22,9 @@ interface PendingAuthorizationRow {
   redirectUri: string;
   codeChallenge: string;
   clientId?: string;
+  clientName?: string;
   clientState?: string;
+  resource?: string;
   scope?: string;
   nonce?: string;
   idToken?: boolean;
@@ -84,6 +86,7 @@ interface AuthCodeRow {
   redirectUri: string;
   clientId?: string;
   scope?: string;
+  resource?: string;
   nonce?: string;
   idToken?: boolean;
   accessToken?: boolean;
@@ -130,6 +133,71 @@ declare class AuthCodeStoreAtscriptDb extends AuthCodeStore {
   }>;
   consume(code: string): Promise<AuthCode | null>;
 }
+/**
+ * Persisted row — mirrors `AoothDynamicClient` (`dynamic-client.as`). The
+ * three array fields are JSON-STRING columns (same opaque-string pattern as
+ * `tokenPolicy` above): a `string[]` column would need engine-specific array
+ * support, and all matching happens in `DynamicClientPolicy` after parse.
+ */
+interface DynamicClientRow {
+  clientId: string;
+  clientName?: string;
+  /** `JSON.stringify(string[])`. */
+  redirectUris: string;
+  tokenEndpointAuthMethod: string;
+  /** `JSON.stringify(string[])`. */
+  grantTypes: string;
+  /** `JSON.stringify(string[])`. */
+  responseTypes: string;
+  scope?: string;
+  createdAt: number;
+  lastUsedAt?: number;
+}
+/** Structural surface of `AtscriptDbTable` for the dynamic-client adapter. */
+interface DynamicClientTable {
+  insertOne(row: DynamicClientRow): Promise<{
+    insertedId: unknown;
+  }>;
+  findOne(query: {
+    filter: Record<string, unknown>;
+  }): Promise<DynamicClientRow | null>;
+  count(query: {
+    filter?: Record<string, unknown>;
+  }): Promise<number>;
+  replaceOne(row: DynamicClientRow): Promise<{
+    matchedCount: number;
+    modifiedCount: number;
+  }>;
+  deleteOne(idOrPk: unknown): Promise<{
+    deletedCount: number;
+  }>;
+  deleteMany(filter: Record<string, unknown>): Promise<{
+    deletedCount: number;
+  }>;
+}
+interface DynamicClientStoreAtscriptDbOptions {
+  table: DynamicClientTable;
+  /** Injectable clock for deterministic `createdAt`. Defaults to {@link defaultClock}. */
+  clock?: Clock;
+}
+/**
+ * Durable {@link DynamicClientStore}. Long-lived rows (a connector caches its
+ * `client_id` across grants). `touch` is the portable findOne + replaceOne
+ * (same trick as `CredentialStoreAtscriptDb.touch` — no engine-specific patch
+ * op); `deleteUnusedBefore` is one mass `deleteMany` over
+ * `createdAt < cutoff && lastUsedAt unset` — the never-used GC.
+ */
+declare class DynamicClientStoreAtscriptDb extends DynamicClientStore {
+  private readonly table;
+  private readonly clock;
+  constructor(opts: DynamicClientStoreAtscriptDbOptions);
+  create(rec: NewDynamicClient): Promise<DynamicClient>;
+  get(clientId: string): Promise<DynamicClient | null>;
+  delete(clientId: string): Promise<boolean>;
+  count(): Promise<number>;
+  touch(clientId: string, at: number): Promise<void>;
+  deleteUnusedBefore(cutoff: number): Promise<number>;
+}
 //#endregion
 //#region src/atscript-db/index.d.ts
 /**
@@ -142,6 +210,11 @@ declare class AuthCodeStoreAtscriptDb extends AuthCodeStore {
  * The consumer's typed payload `TPayload` (the root fields they add to their
  * `extends AoothAuthCredential` model) is intersected flat — those become real
  * typed columns, replacing the dropped free-form `claims` blob.
+ *
+ * There is NO `metadata` envelope column: credential metadata is
+ * consumer-declared (a fully-typed `@db.json` field on the extending model,
+ * marked `@aooth.auth.metadata`) and mapped dynamically through the
+ * `metadataField` option below.
  */
 type AuthCredentialRow<TPayload extends object = object> = {
   token: string;
@@ -149,12 +222,6 @@ type AuthCredentialRow<TPayload extends object = object> = {
   issuedAt: number;
   expiresAt: number;
   kind?: string;
-  metadata?: {
-    ip?: string;
-    userAgent?: string;
-    fingerprint?: string;
-    label?: string;
-  };
   parentCredentialId?: string;
   rotatedAt?: number;
   sessionId?: string;
@@ -190,6 +257,15 @@ interface AuthCredentialTable<TPayload extends object = object> {
 }
 interface CredentialStoreAtscriptDbOptions<TPayload extends object> {
   table: AuthCredentialTable<TPayload>;
+  /**
+   * Name of the consumer's `@aooth.auth.metadata`-annotated column — the
+   * fully-typed `@db.json` field declared on their `extends AoothAuthCredential`
+   * model that persists the envelope's `metadata`. Resolved at boot by
+   * `getAoothCredentialMetadataSpec` (`@aooth/arbac-moost/atscript`) and
+   * threaded here as plain config — same pattern as `UserStore.handleFields`.
+   * Absent → metadata is not persisted/read by this store.
+   */
+  metadataField?: string;
 }
 /**
  * atscript-db-backed `CredentialStore`.
@@ -206,6 +282,7 @@ interface CredentialStoreAtscriptDbOptions<TPayload extends object> {
  */
 declare class CredentialStoreAtscriptDb<TPayload extends object = object> implements CredentialStore<TPayload> {
   private readonly table;
+  private readonly metadataField;
   constructor(opts: CredentialStoreAtscriptDbOptions<TPayload>);
   persist(state: CredentialState & TPayload, ttl?: number): Promise<string>;
   retrieve(token: string): Promise<(CredentialState & TPayload) | null>;
@@ -219,4 +296,4 @@ declare class CredentialStoreAtscriptDb<TPayload extends object = object> implem
   }>>;
 }
 //#endregion
-export { AuthCodeRow, AuthCodeStoreAtscriptDb, AuthCodeStoreAtscriptDbOptions, AuthCodeTable, AuthCredentialRow, AuthCredentialTable, CredentialStoreAtscriptDb, PendingAuthorizationRow, PendingAuthorizationStoreAtscriptDb, PendingAuthorizationStoreAtscriptDbOptions, PendingAuthorizationTable };
+export { AuthCodeRow, AuthCodeStoreAtscriptDb, AuthCodeStoreAtscriptDbOptions, AuthCodeTable, AuthCredentialRow, AuthCredentialTable, CredentialStoreAtscriptDb, DynamicClientRow, DynamicClientStoreAtscriptDb, DynamicClientStoreAtscriptDbOptions, DynamicClientTable, PendingAuthorizationRow, PendingAuthorizationStoreAtscriptDb, PendingAuthorizationStoreAtscriptDbOptions, PendingAuthorizationTable };

package/dist/atscript-db.d.mts

@@ -1,6 +1,6 @@
 import { a as CredentialState, t as CredentialStore } from "./store-BG6m6oSJ.mjs";
 import { t as Clock } from "./clock-BjXa0LXb.mjs";
-import { a as NewAuthCode, c as PendingAuthorization, l as PendingAuthorizationStore, n as AuthCodeStore, s as NewPendingAuthorization, t as AuthCode } from "./auth-code-store-Om5MXNUT.mjs";
+import { a as NewDynamicClient, f as NewPendingAuthorization, m as PendingAuthorizationStore, n as DynamicClientStore, o as AuthCode, p as PendingAuthorization, s as AuthCodeStore, t as DynamicClient, u as NewAuthCode } from "./dynamic-client-store-oHEsQaJg.mjs";
 
 //#region src/atscript-db/authz-stores.d.ts
 /**
@@ -22,7 +22,9 @@ interface PendingAuthorizationRow {
   redirectUri: string;
   codeChallenge: string;
   clientId?: string;
+  clientName?: string;
   clientState?: string;
+  resource?: string;
   scope?: string;
   nonce?: string;
   idToken?: boolean;
@@ -84,6 +86,7 @@ interface AuthCodeRow {
   redirectUri: string;
   clientId?: string;
   scope?: string;
+  resource?: string;
   nonce?: string;
   idToken?: boolean;
   accessToken?: boolean;
@@ -130,6 +133,71 @@ declare class AuthCodeStoreAtscriptDb extends AuthCodeStore {
   }>;
   consume(code: string): Promise<AuthCode | null>;
 }
+/**
+ * Persisted row — mirrors `AoothDynamicClient` (`dynamic-client.as`). The
+ * three array fields are JSON-STRING columns (same opaque-string pattern as
+ * `tokenPolicy` above): a `string[]` column would need engine-specific array
+ * support, and all matching happens in `DynamicClientPolicy` after parse.
+ */
+interface DynamicClientRow {
+  clientId: string;
+  clientName?: string;
+  /** `JSON.stringify(string[])`. */
+  redirectUris: string;
+  tokenEndpointAuthMethod: string;
+  /** `JSON.stringify(string[])`. */
+  grantTypes: string;
+  /** `JSON.stringify(string[])`. */
+  responseTypes: string;
+  scope?: string;
+  createdAt: number;
+  lastUsedAt?: number;
+}
+/** Structural surface of `AtscriptDbTable` for the dynamic-client adapter. */
+interface DynamicClientTable {
+  insertOne(row: DynamicClientRow): Promise<{
+    insertedId: unknown;
+  }>;
+  findOne(query: {
+    filter: Record<string, unknown>;
+  }): Promise<DynamicClientRow | null>;
+  count(query: {
+    filter?: Record<string, unknown>;
+  }): Promise<number>;
+  replaceOne(row: DynamicClientRow): Promise<{
+    matchedCount: number;
+    modifiedCount: number;
+  }>;
+  deleteOne(idOrPk: unknown): Promise<{
+    deletedCount: number;
+  }>;
+  deleteMany(filter: Record<string, unknown>): Promise<{
+    deletedCount: number;
+  }>;
+}
+interface DynamicClientStoreAtscriptDbOptions {
+  table: DynamicClientTable;
+  /** Injectable clock for deterministic `createdAt`. Defaults to {@link defaultClock}. */
+  clock?: Clock;
+}
+/**
+ * Durable {@link DynamicClientStore}. Long-lived rows (a connector caches its
+ * `client_id` across grants). `touch` is the portable findOne + replaceOne
+ * (same trick as `CredentialStoreAtscriptDb.touch` — no engine-specific patch
+ * op); `deleteUnusedBefore` is one mass `deleteMany` over
+ * `createdAt < cutoff && lastUsedAt unset` — the never-used GC.
+ */
+declare class DynamicClientStoreAtscriptDb extends DynamicClientStore {
+  private readonly table;
+  private readonly clock;
+  constructor(opts: DynamicClientStoreAtscriptDbOptions);
+  create(rec: NewDynamicClient): Promise<DynamicClient>;
+  get(clientId: string): Promise<DynamicClient | null>;
+  delete(clientId: string): Promise<boolean>;
+  count(): Promise<number>;
+  touch(clientId: string, at: number): Promise<void>;
+  deleteUnusedBefore(cutoff: number): Promise<number>;
+}
 //#endregion
 //#region src/atscript-db/index.d.ts
 /**
@@ -142,6 +210,11 @@ declare class AuthCodeStoreAtscriptDb extends AuthCodeStore {
  * The consumer's typed payload `TPayload` (the root fields they add to their
  * `extends AoothAuthCredential` model) is intersected flat — those become real
  * typed columns, replacing the dropped free-form `claims` blob.
+ *
+ * There is NO `metadata` envelope column: credential metadata is
+ * consumer-declared (a fully-typed `@db.json` field on the extending model,
+ * marked `@aooth.auth.metadata`) and mapped dynamically through the
+ * `metadataField` option below.
  */
 type AuthCredentialRow<TPayload extends object = object> = {
   token: string;
@@ -149,12 +222,6 @@ type AuthCredentialRow<TPayload extends object = object> = {
   issuedAt: number;
   expiresAt: number;
   kind?: string;
-  metadata?: {
-    ip?: string;
-    userAgent?: string;
-    fingerprint?: string;
-    label?: string;
-  };
   parentCredentialId?: string;
   rotatedAt?: number;
   sessionId?: string;
@@ -190,6 +257,15 @@ interface AuthCredentialTable<TPayload extends object = object> {
 }
 interface CredentialStoreAtscriptDbOptions<TPayload extends object> {
   table: AuthCredentialTable<TPayload>;
+  /**
+   * Name of the consumer's `@aooth.auth.metadata`-annotated column — the
+   * fully-typed `@db.json` field declared on their `extends AoothAuthCredential`
+   * model that persists the envelope's `metadata`. Resolved at boot by
+   * `getAoothCredentialMetadataSpec` (`@aooth/arbac-moost/atscript`) and
+   * threaded here as plain config — same pattern as `UserStore.handleFields`.
+   * Absent → metadata is not persisted/read by this store.
+   */
+  metadataField?: string;
 }
 /**
  * atscript-db-backed `CredentialStore`.
@@ -206,6 +282,7 @@ interface CredentialStoreAtscriptDbOptions<TPayload extends object> {
  */
 declare class CredentialStoreAtscriptDb<TPayload extends object = object> implements CredentialStore<TPayload> {
   private readonly table;
+  private readonly metadataField;
   constructor(opts: CredentialStoreAtscriptDbOptions<TPayload>);
   persist(state: CredentialState & TPayload, ttl?: number): Promise<string>;
   retrieve(token: string): Promise<(CredentialState & TPayload) | null>;
@@ -219,4 +296,4 @@ declare class CredentialStoreAtscriptDb<TPayload extends object = object> implem
   }>>;
 }
 //#endregion
-export { AuthCodeRow, AuthCodeStoreAtscriptDb, AuthCodeStoreAtscriptDbOptions, AuthCodeTable, AuthCredentialRow, AuthCredentialTable, CredentialStoreAtscriptDb, PendingAuthorizationRow, PendingAuthorizationStoreAtscriptDb, PendingAuthorizationStoreAtscriptDbOptions, PendingAuthorizationTable };
+export { AuthCodeRow, AuthCodeStoreAtscriptDb, AuthCodeStoreAtscriptDbOptions, AuthCodeTable, AuthCredentialRow, AuthCredentialTable, CredentialStoreAtscriptDb, DynamicClientRow, DynamicClientStoreAtscriptDb, DynamicClientStoreAtscriptDbOptions, DynamicClientTable, PendingAuthorizationRow, PendingAuthorizationStoreAtscriptDb, PendingAuthorizationStoreAtscriptDbOptions, PendingAuthorizationTable };