@aooth/auth 0.1.9 → 0.1.11

package/dist/atscript-db.cjs

@@ -1,6 +1,140 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_clock = require("./clock-Bl-H3eqE.cjs");
 const require_payload = require("./payload-BJjvj8AH.cjs");
+const require_auth_code_store = require("./auth-code-store-CmUhRrwG.cjs");
 let node_crypto = require("node:crypto");
+//#region src/atscript-db/authz-stores.ts
+/**
+* Durable {@link PendingAuthorizationStore}. `create` inserts a row keyed by a
+* fresh opaque `handle`; `get` rejects (and lazily evicts) a past-expiry row;
+* `delete` drops it once consumed. PK is `handle`, so reads/deletes are O(1).
+*/
+var PendingAuthorizationStoreAtscriptDb = class extends require_auth_code_store.PendingAuthorizationStore {
+	table;
+	clock;
+	ttlMs;
+	constructor(opts) {
+		super();
+		this.table = opts.table;
+		this.clock = opts.clock ?? require_clock.defaultClock;
+		this.ttlMs = opts.ttlMs ?? 9e5;
+	}
+	async create(rec) {
+		const now = this.clock.now();
+		const handle = (0, node_crypto.randomUUID)();
+		await this.table.insertOne({
+			handle,
+			redirectUri: rec.redirectUri,
+			codeChallenge: rec.codeChallenge,
+			tokenPolicy: JSON.stringify(rec.tokenPolicy),
+			createdAt: now,
+			expiresAt: now + this.ttlMs,
+			...rec.clientId !== void 0 && { clientId: rec.clientId },
+			...rec.clientState !== void 0 && { clientState: rec.clientState },
+			...rec.scope !== void 0 && { scope: rec.scope },
+			...rec.nonce !== void 0 && { nonce: rec.nonce },
+			...rec.idToken !== void 0 && { idToken: rec.idToken },
+			...rec.accessToken !== void 0 && { accessToken: rec.accessToken },
+			...rec.audience !== void 0 && { audience: rec.audience }
+		});
+		return { handle };
+	}
+	async get(handle) {
+		const row = await this.table.findOne({ filter: { handle } });
+		if (!row) return null;
+		if (row.expiresAt <= this.clock.now()) {
+			await this.table.deleteOne(handle).catch(() => {});
+			return null;
+		}
+		return rowToPending(row);
+	}
+	async delete(handle) {
+		const { deletedCount } = await this.table.deleteOne(handle);
+		return deletedCount > 0;
+	}
+};
+function rowToPending(row) {
+	const out = {
+		handle: row.handle,
+		redirectUri: row.redirectUri,
+		codeChallenge: row.codeChallenge,
+		tokenPolicy: JSON.parse(row.tokenPolicy),
+		createdAt: row.createdAt,
+		expiresAt: row.expiresAt
+	};
+	if (row.clientId != null) out.clientId = row.clientId;
+	if (row.clientState != null) out.clientState = row.clientState;
+	if (row.scope != null) out.scope = row.scope;
+	if (row.nonce != null) out.nonce = row.nonce;
+	if (row.idToken != null) out.idToken = row.idToken;
+	if (row.accessToken != null) out.accessToken = row.accessToken;
+	if (row.audience != null) out.audience = row.audience;
+	return out;
+}
+/**
+* Durable {@link AuthCodeStore}. `mint` inserts a single-use code; `consume`
+* is an **atomic check-and-delete**: it reads the row, then `deleteOne(code)`
+* — and only the caller whose delete reports `deletedCount === 1` wins the row.
+* Because an auth-code row is immutable once minted, the value read before the
+* delete is exactly what the winner returns; a concurrent double-redeem or a
+* back-button replay loses the race and gets `null`. (The delete is the claim,
+* so no version column is needed — `deleteOne(PK)` is atomic per the DB engine.)
+*/
+var AuthCodeStoreAtscriptDb = class extends require_auth_code_store.AuthCodeStore {
+	table;
+	clock;
+	ttlMs;
+	constructor(opts) {
+		super();
+		this.table = opts.table;
+		this.clock = opts.clock ?? require_clock.defaultClock;
+		this.ttlMs = opts.ttlMs ?? 6e4;
+	}
+	async mint(rec) {
+		const code = (0, node_crypto.randomUUID)();
+		await this.table.insertOne({
+			code,
+			userId: rec.userId,
+			codeChallenge: rec.codeChallenge,
+			redirectUri: rec.redirectUri,
+			tokenPolicy: JSON.stringify(rec.tokenPolicy),
+			expiresAt: this.clock.now() + this.ttlMs,
+			...rec.clientId !== void 0 && { clientId: rec.clientId },
+			...rec.scope !== void 0 && { scope: rec.scope },
+			...rec.nonce !== void 0 && { nonce: rec.nonce },
+			...rec.idToken !== void 0 && { idToken: rec.idToken },
+			...rec.accessToken !== void 0 && { accessToken: rec.accessToken },
+			...rec.audience !== void 0 && { audience: rec.audience }
+		});
+		return { code };
+	}
+	async consume(code) {
+		const row = await this.table.findOne({ filter: { code } });
+		if (!row) return null;
+		const { deletedCount } = await this.table.deleteOne(code);
+		if (deletedCount !== 1) return null;
+		if (row.expiresAt <= this.clock.now()) return null;
+		return rowToAuthCode(row);
+	}
+};
+function rowToAuthCode(row) {
+	const out = {
+		code: row.code,
+		userId: row.userId,
+		codeChallenge: row.codeChallenge,
+		redirectUri: row.redirectUri,
+		tokenPolicy: JSON.parse(row.tokenPolicy),
+		expiresAt: row.expiresAt
+	};
+	if (row.clientId != null) out.clientId = row.clientId;
+	if (row.scope != null) out.scope = row.scope;
+	if (row.nonce != null) out.nonce = row.nonce;
+	if (row.idToken != null) out.idToken = row.idToken;
+	if (row.accessToken != null) out.accessToken = row.accessToken;
+	if (row.audience != null) out.audience = row.audience;
+	return out;
+}
+//#endregion
 //#region src/atscript-db/index.ts
 /**
 * atscript-db-backed `CredentialStore`.
@@ -121,4 +255,6 @@ function rowToState(row) {
 	return state;
 }
 //#endregion
+exports.AuthCodeStoreAtscriptDb = AuthCodeStoreAtscriptDb;
 exports.CredentialStoreAtscriptDb = CredentialStoreAtscriptDb;
+exports.PendingAuthorizationStoreAtscriptDb = PendingAuthorizationStoreAtscriptDb;

package/dist/atscript-db.d.cts

@@ -1,5 +1,133 @@
 import { a as CredentialState, t as CredentialStore } from "./store-BG6m6oSJ.cjs";
+import { t as Clock } from "./clock-BjXa0LXb.cjs";
+import { a as NewAuthCode, c as PendingAuthorizationStore, n as AuthCodeStore, o as NewPendingAuthorization, s as PendingAuthorization, t as AuthCode } from "./auth-code-store-HOHlz_3z.cjs";
 
+//#region src/atscript-db/authz-stores.d.ts
+/**
+ * atscript-db-backed durable implementations of the two short-lived
+ * authorization-server stores (AUTH-SERVER.md §4.3) — the multi-pod replacement
+ * for the in-memory reference impls. They slot under the same DI tokens
+ * (`PENDING_AUTHORIZATION_STORE_TOKEN` / `AUTH_CODE_STORE_TOKEN`) so a deployment
+ * swaps memory → durable with zero controller change.
+ *
+ * Row types are re-declared as plain TS (mirroring the `.as` models
+ * `AoothPendingAuthorization` / `AoothAuthCode`), so `@aooth/auth` needs no
+ * build-time `@atscript/db` dependency. `tokenPolicy` is persisted as a JSON
+ * STRING — its `payload` is an open `Record<string, unknown>` that a closed
+ * `@db.json` schema would reject — and (de)serialized at this boundary.
+ */
+/** Persisted row — mirrors `AoothPendingAuthorization` (`pending-authorization.as`). */
+interface PendingAuthorizationRow {
+  handle: string;
+  redirectUri: string;
+  codeChallenge: string;
+  clientId?: string;
+  clientState?: string;
+  scope?: string;
+  nonce?: string;
+  idToken?: boolean;
+  accessToken?: boolean;
+  audience?: string;
+  /** `JSON.stringify(TokenPolicy)`. */
+  tokenPolicy: string;
+  createdAt: number;
+  expiresAt: number;
+}
+/**
+ * Structural surface of `AtscriptDbTable` covering exactly the methods this
+ * adapter calls — kept loose so `@atscript/db` types stay out of the public
+ * surface (consumers pass `db.getTable(AoothPendingAuthorization)` and TS matches
+ * by-shape, same seam as `AuthCredentialTable`).
+ */
+interface PendingAuthorizationTable {
+  insertOne(row: PendingAuthorizationRow): Promise<{
+    insertedId: unknown;
+  }>;
+  findOne(query: {
+    filter: Record<string, unknown>;
+  }): Promise<PendingAuthorizationRow | null>;
+  deleteOne(idOrPk: unknown): Promise<{
+    deletedCount: number;
+  }>;
+}
+interface PendingAuthorizationStoreAtscriptDbOptions {
+  table: PendingAuthorizationTable;
+  /** Injectable clock for deterministic expiry. Defaults to {@link defaultClock}. */
+  clock?: Clock;
+  /** How long a pending authorization stays valid. Default 15 min. */
+  ttlMs?: number;
+}
+/**
+ * Durable {@link PendingAuthorizationStore}. `create` inserts a row keyed by a
+ * fresh opaque `handle`; `get` rejects (and lazily evicts) a past-expiry row;
+ * `delete` drops it once consumed. PK is `handle`, so reads/deletes are O(1).
+ */
+declare class PendingAuthorizationStoreAtscriptDb extends PendingAuthorizationStore {
+  private readonly table;
+  private readonly clock;
+  private readonly ttlMs;
+  constructor(opts: PendingAuthorizationStoreAtscriptDbOptions);
+  create(rec: NewPendingAuthorization): Promise<{
+    handle: string;
+  }>;
+  get(handle: string): Promise<PendingAuthorization | null>;
+  delete(handle: string): Promise<boolean>;
+}
+/** Persisted row — mirrors `AoothAuthCode` (`auth-code.as`). */
+interface AuthCodeRow {
+  code: string;
+  userId: string;
+  codeChallenge: string;
+  redirectUri: string;
+  clientId?: string;
+  scope?: string;
+  nonce?: string;
+  idToken?: boolean;
+  accessToken?: boolean;
+  audience?: string;
+  /** `JSON.stringify(TokenPolicy)`. */
+  tokenPolicy: string;
+  expiresAt: number;
+}
+/** Structural surface of `AtscriptDbTable` for the auth-code adapter. */
+interface AuthCodeTable {
+  insertOne(row: AuthCodeRow): Promise<{
+    insertedId: unknown;
+  }>;
+  findOne(query: {
+    filter: Record<string, unknown>;
+  }): Promise<AuthCodeRow | null>;
+  deleteOne(idOrPk: unknown): Promise<{
+    deletedCount: number;
+  }>;
+}
+interface AuthCodeStoreAtscriptDbOptions {
+  table: AuthCodeTable;
+  /** Injectable clock for deterministic expiry. Defaults to {@link defaultClock}. */
+  clock?: Clock;
+  /** Code lifetime. Default 60 s. */
+  ttlMs?: number;
+}
+/**
+ * Durable {@link AuthCodeStore}. `mint` inserts a single-use code; `consume`
+ * is an **atomic check-and-delete**: it reads the row, then `deleteOne(code)`
+ * — and only the caller whose delete reports `deletedCount === 1` wins the row.
+ * Because an auth-code row is immutable once minted, the value read before the
+ * delete is exactly what the winner returns; a concurrent double-redeem or a
+ * back-button replay loses the race and gets `null`. (The delete is the claim,
+ * so no version column is needed — `deleteOne(PK)` is atomic per the DB engine.)
+ */
+declare class AuthCodeStoreAtscriptDb extends AuthCodeStore {
+  private readonly table;
+  private readonly clock;
+  private readonly ttlMs;
+  constructor(opts: AuthCodeStoreAtscriptDbOptions);
+  mint(rec: NewAuthCode): Promise<{
+    code: string;
+  }>;
+  consume(code: string): Promise<AuthCode | null>;
+}
+//#endregion
 //#region src/atscript-db/index.d.ts
 /**
  * Persisted row shape — mirrors `AoothAuthCredential` from
@@ -88,4 +216,4 @@ declare class CredentialStoreAtscriptDb<TPayload extends object = object> implem
   }>>;
 }
 //#endregion
-export { AuthCredentialRow, AuthCredentialTable, CredentialStoreAtscriptDb };
+export { AuthCodeRow, AuthCodeStoreAtscriptDb, AuthCodeStoreAtscriptDbOptions, AuthCodeTable, AuthCredentialRow, AuthCredentialTable, CredentialStoreAtscriptDb, PendingAuthorizationRow, PendingAuthorizationStoreAtscriptDb, PendingAuthorizationStoreAtscriptDbOptions, PendingAuthorizationTable };

package/dist/atscript-db.d.mts

@@ -1,5 +1,133 @@
 import { a as CredentialState, t as CredentialStore } from "./store-BG6m6oSJ.mjs";
+import { t as Clock } from "./clock-BjXa0LXb.mjs";
+import { a as NewAuthCode, c as PendingAuthorizationStore, n as AuthCodeStore, o as NewPendingAuthorization, s as PendingAuthorization, t as AuthCode } from "./auth-code-store-NqEDfqrf.mjs";
 
+//#region src/atscript-db/authz-stores.d.ts
+/**
+ * atscript-db-backed durable implementations of the two short-lived
+ * authorization-server stores (AUTH-SERVER.md §4.3) — the multi-pod replacement
+ * for the in-memory reference impls. They slot under the same DI tokens
+ * (`PENDING_AUTHORIZATION_STORE_TOKEN` / `AUTH_CODE_STORE_TOKEN`) so a deployment
+ * swaps memory → durable with zero controller change.
+ *
+ * Row types are re-declared as plain TS (mirroring the `.as` models
+ * `AoothPendingAuthorization` / `AoothAuthCode`), so `@aooth/auth` needs no
+ * build-time `@atscript/db` dependency. `tokenPolicy` is persisted as a JSON
+ * STRING — its `payload` is an open `Record<string, unknown>` that a closed
+ * `@db.json` schema would reject — and (de)serialized at this boundary.
+ */
+/** Persisted row — mirrors `AoothPendingAuthorization` (`pending-authorization.as`). */
+interface PendingAuthorizationRow {
+  handle: string;
+  redirectUri: string;
+  codeChallenge: string;
+  clientId?: string;
+  clientState?: string;
+  scope?: string;
+  nonce?: string;
+  idToken?: boolean;
+  accessToken?: boolean;
+  audience?: string;
+  /** `JSON.stringify(TokenPolicy)`. */
+  tokenPolicy: string;
+  createdAt: number;
+  expiresAt: number;
+}
+/**
+ * Structural surface of `AtscriptDbTable` covering exactly the methods this
+ * adapter calls — kept loose so `@atscript/db` types stay out of the public
+ * surface (consumers pass `db.getTable(AoothPendingAuthorization)` and TS matches
+ * by-shape, same seam as `AuthCredentialTable`).
+ */
+interface PendingAuthorizationTable {
+  insertOne(row: PendingAuthorizationRow): Promise<{
+    insertedId: unknown;
+  }>;
+  findOne(query: {
+    filter: Record<string, unknown>;
+  }): Promise<PendingAuthorizationRow | null>;
+  deleteOne(idOrPk: unknown): Promise<{
+    deletedCount: number;
+  }>;
+}
+interface PendingAuthorizationStoreAtscriptDbOptions {
+  table: PendingAuthorizationTable;
+  /** Injectable clock for deterministic expiry. Defaults to {@link defaultClock}. */
+  clock?: Clock;
+  /** How long a pending authorization stays valid. Default 15 min. */
+  ttlMs?: number;
+}
+/**
+ * Durable {@link PendingAuthorizationStore}. `create` inserts a row keyed by a
+ * fresh opaque `handle`; `get` rejects (and lazily evicts) a past-expiry row;
+ * `delete` drops it once consumed. PK is `handle`, so reads/deletes are O(1).
+ */
+declare class PendingAuthorizationStoreAtscriptDb extends PendingAuthorizationStore {
+  private readonly table;
+  private readonly clock;
+  private readonly ttlMs;
+  constructor(opts: PendingAuthorizationStoreAtscriptDbOptions);
+  create(rec: NewPendingAuthorization): Promise<{
+    handle: string;
+  }>;
+  get(handle: string): Promise<PendingAuthorization | null>;
+  delete(handle: string): Promise<boolean>;
+}
+/** Persisted row — mirrors `AoothAuthCode` (`auth-code.as`). */
+interface AuthCodeRow {
+  code: string;
+  userId: string;
+  codeChallenge: string;
+  redirectUri: string;
+  clientId?: string;
+  scope?: string;
+  nonce?: string;
+  idToken?: boolean;
+  accessToken?: boolean;
+  audience?: string;
+  /** `JSON.stringify(TokenPolicy)`. */
+  tokenPolicy: string;
+  expiresAt: number;
+}
+/** Structural surface of `AtscriptDbTable` for the auth-code adapter. */
+interface AuthCodeTable {
+  insertOne(row: AuthCodeRow): Promise<{
+    insertedId: unknown;
+  }>;
+  findOne(query: {
+    filter: Record<string, unknown>;
+  }): Promise<AuthCodeRow | null>;
+  deleteOne(idOrPk: unknown): Promise<{
+    deletedCount: number;
+  }>;
+}
+interface AuthCodeStoreAtscriptDbOptions {
+  table: AuthCodeTable;
+  /** Injectable clock for deterministic expiry. Defaults to {@link defaultClock}. */
+  clock?: Clock;
+  /** Code lifetime. Default 60 s. */
+  ttlMs?: number;
+}
+/**
+ * Durable {@link AuthCodeStore}. `mint` inserts a single-use code; `consume`
+ * is an **atomic check-and-delete**: it reads the row, then `deleteOne(code)`
+ * — and only the caller whose delete reports `deletedCount === 1` wins the row.
+ * Because an auth-code row is immutable once minted, the value read before the
+ * delete is exactly what the winner returns; a concurrent double-redeem or a
+ * back-button replay loses the race and gets `null`. (The delete is the claim,
+ * so no version column is needed — `deleteOne(PK)` is atomic per the DB engine.)
+ */
+declare class AuthCodeStoreAtscriptDb extends AuthCodeStore {
+  private readonly table;
+  private readonly clock;
+  private readonly ttlMs;
+  constructor(opts: AuthCodeStoreAtscriptDbOptions);
+  mint(rec: NewAuthCode): Promise<{
+    code: string;
+  }>;
+  consume(code: string): Promise<AuthCode | null>;
+}
+//#endregion
 //#region src/atscript-db/index.d.ts
 /**
  * Persisted row shape — mirrors `AoothAuthCredential` from
@@ -88,4 +216,4 @@ declare class CredentialStoreAtscriptDb<TPayload extends object = object> implem
   }>>;
 }
 //#endregion
-export { AuthCredentialRow, AuthCredentialTable, CredentialStoreAtscriptDb };
+export { AuthCodeRow, AuthCodeStoreAtscriptDb, AuthCodeStoreAtscriptDbOptions, AuthCodeTable, AuthCredentialRow, AuthCredentialTable, CredentialStoreAtscriptDb, PendingAuthorizationRow, PendingAuthorizationStoreAtscriptDb, PendingAuthorizationStoreAtscriptDbOptions, PendingAuthorizationTable };

package/dist/atscript-db.mjs

@@ -1,5 +1,139 @@
+import { t as defaultClock } from "./clock-Bdsep_1j.mjs";
 import { t as credentialPayloadOf } from "./payload-D-DzH5-J.mjs";
+import { a as PendingAuthorizationStore, t as AuthCodeStore } from "./auth-code-store-uaoL7dvU.mjs";
 import { randomUUID } from "node:crypto";
+//#region src/atscript-db/authz-stores.ts
+/**
+* Durable {@link PendingAuthorizationStore}. `create` inserts a row keyed by a
+* fresh opaque `handle`; `get` rejects (and lazily evicts) a past-expiry row;
+* `delete` drops it once consumed. PK is `handle`, so reads/deletes are O(1).
+*/
+var PendingAuthorizationStoreAtscriptDb = class extends PendingAuthorizationStore {
+	table;
+	clock;
+	ttlMs;
+	constructor(opts) {
+		super();
+		this.table = opts.table;
+		this.clock = opts.clock ?? defaultClock;
+		this.ttlMs = opts.ttlMs ?? 9e5;
+	}
+	async create(rec) {
+		const now = this.clock.now();
+		const handle = randomUUID();
+		await this.table.insertOne({
+			handle,
+			redirectUri: rec.redirectUri,
+			codeChallenge: rec.codeChallenge,
+			tokenPolicy: JSON.stringify(rec.tokenPolicy),
+			createdAt: now,
+			expiresAt: now + this.ttlMs,
+			...rec.clientId !== void 0 && { clientId: rec.clientId },
+			...rec.clientState !== void 0 && { clientState: rec.clientState },
+			...rec.scope !== void 0 && { scope: rec.scope },
+			...rec.nonce !== void 0 && { nonce: rec.nonce },
+			...rec.idToken !== void 0 && { idToken: rec.idToken },
+			...rec.accessToken !== void 0 && { accessToken: rec.accessToken },
+			...rec.audience !== void 0 && { audience: rec.audience }
+		});
+		return { handle };
+	}
+	async get(handle) {
+		const row = await this.table.findOne({ filter: { handle } });
+		if (!row) return null;
+		if (row.expiresAt <= this.clock.now()) {
+			await this.table.deleteOne(handle).catch(() => {});
+			return null;
+		}
+		return rowToPending(row);
+	}
+	async delete(handle) {
+		const { deletedCount } = await this.table.deleteOne(handle);
+		return deletedCount > 0;
+	}
+};
+function rowToPending(row) {
+	const out = {
+		handle: row.handle,
+		redirectUri: row.redirectUri,
+		codeChallenge: row.codeChallenge,
+		tokenPolicy: JSON.parse(row.tokenPolicy),
+		createdAt: row.createdAt,
+		expiresAt: row.expiresAt
+	};
+	if (row.clientId != null) out.clientId = row.clientId;
+	if (row.clientState != null) out.clientState = row.clientState;
+	if (row.scope != null) out.scope = row.scope;
+	if (row.nonce != null) out.nonce = row.nonce;
+	if (row.idToken != null) out.idToken = row.idToken;
+	if (row.accessToken != null) out.accessToken = row.accessToken;
+	if (row.audience != null) out.audience = row.audience;
+	return out;
+}
+/**
+* Durable {@link AuthCodeStore}. `mint` inserts a single-use code; `consume`
+* is an **atomic check-and-delete**: it reads the row, then `deleteOne(code)`
+* — and only the caller whose delete reports `deletedCount === 1` wins the row.
+* Because an auth-code row is immutable once minted, the value read before the
+* delete is exactly what the winner returns; a concurrent double-redeem or a
+* back-button replay loses the race and gets `null`. (The delete is the claim,
+* so no version column is needed — `deleteOne(PK)` is atomic per the DB engine.)
+*/
+var AuthCodeStoreAtscriptDb = class extends AuthCodeStore {
+	table;
+	clock;
+	ttlMs;
+	constructor(opts) {
+		super();
+		this.table = opts.table;
+		this.clock = opts.clock ?? defaultClock;
+		this.ttlMs = opts.ttlMs ?? 6e4;
+	}
+	async mint(rec) {
+		const code = randomUUID();
+		await this.table.insertOne({
+			code,
+			userId: rec.userId,
+			codeChallenge: rec.codeChallenge,
+			redirectUri: rec.redirectUri,
+			tokenPolicy: JSON.stringify(rec.tokenPolicy),
+			expiresAt: this.clock.now() + this.ttlMs,
+			...rec.clientId !== void 0 && { clientId: rec.clientId },
+			...rec.scope !== void 0 && { scope: rec.scope },
+			...rec.nonce !== void 0 && { nonce: rec.nonce },
+			...rec.idToken !== void 0 && { idToken: rec.idToken },
+			...rec.accessToken !== void 0 && { accessToken: rec.accessToken },
+			...rec.audience !== void 0 && { audience: rec.audience }
+		});
+		return { code };
+	}
+	async consume(code) {
+		const row = await this.table.findOne({ filter: { code } });
+		if (!row) return null;
+		const { deletedCount } = await this.table.deleteOne(code);
+		if (deletedCount !== 1) return null;
+		if (row.expiresAt <= this.clock.now()) return null;
+		return rowToAuthCode(row);
+	}
+};
+function rowToAuthCode(row) {
+	const out = {
+		code: row.code,
+		userId: row.userId,
+		codeChallenge: row.codeChallenge,
+		redirectUri: row.redirectUri,
+		tokenPolicy: JSON.parse(row.tokenPolicy),
+		expiresAt: row.expiresAt
+	};
+	if (row.clientId != null) out.clientId = row.clientId;
+	if (row.scope != null) out.scope = row.scope;
+	if (row.nonce != null) out.nonce = row.nonce;
+	if (row.idToken != null) out.idToken = row.idToken;
+	if (row.accessToken != null) out.accessToken = row.accessToken;
+	if (row.audience != null) out.audience = row.audience;
+	return out;
+}
+//#endregion
 //#region src/atscript-db/index.ts
 /**
 * atscript-db-backed `CredentialStore`.
@@ -120,4 +254,4 @@ function rowToState(row) {
 	return state;
 }
 //#endregion
-export { CredentialStoreAtscriptDb };
+export { AuthCodeStoreAtscriptDb, CredentialStoreAtscriptDb, PendingAuthorizationStoreAtscriptDb };