@effect-auth/core 0.1.0-alpha.1 → 0.1.0-alpha.10

package/dist/EffectQbSqliteStorage.js

@@ -0,0 +1,1637 @@
+import { Data, Effect, Layer, Option, Redacted } from "effect";
+import { Column, Executor, Query, Scalar, Table } from "effect-qb/sqlite";
+import { ApiKeyId, ApiKeyPrefix, ApiKeySecretHash, ApiKeyStore, ApiKeyStoreError, } from "./ApiKey.js";
+import { AuthFlowId, ChallengeId, CredentialId, Email, OAuthAccountId, OAuthProviderId, SessionId, UnixMillis, UserId, } from "./Identifiers.js";
+import { JwtError, JwtRevocationStore } from "./Jwt.js";
+import { LoginApprovalReviewError, LoginApprovalReviewStore, } from "./LoginApproval.js";
+import { LoginRiskContext, LoginRiskSignal } from "./LoginRisk.js";
+import { OAuthAccountStore, OAuthAccountStoreError, OAuthProviderTokenVault, OAuthProviderTokenVaultError, } from "./OAuth.js";
+import { PasskeyCredentialId, PasskeyCredentialStore, PasskeyCredentialStoreError, } from "./Passkey.js";
+import { RecoveryCodeHash, RecoveryCodeStore, RecoveryCodeStoreError, } from "./RecoveryCode.js";
+import { RefreshTokenFamilyId, RefreshTokenId, RefreshTokenSecretHash, RefreshTokenStore, RefreshTokenStoreError, } from "./RefreshToken.js";
+import { filterSecurityTimelineEvents, SecurityTimelineEventId, SecurityTimelineStore, SecurityTimelineStoreError, } from "./SecurityTimeline.js";
+import { CredentialStore, SessionStore, StorageError, UserStore, VerificationStore, } from "./Storage.js";
+import { TotpFactorStore, TotpFactorStoreError, TotpSecret, } from "./Totp.js";
+import { filterTrustedDevicesForUser, TrustedDeviceError, TrustedDeviceStore, } from "./TrustedDevice.js";
+export class D1EffectQbError extends Data.TaggedError("D1EffectQbError") {
+}
+const makeAuthUserTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    email: Column.text(),
+    email_verified: Column.int(),
+    created_at: Column.int(),
+    updated_at: Column.int(),
+    disabled_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthCredentialTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    type: Column.text(),
+    password_hash: Column.text().pipe(Column.nullable),
+    created_at: Column.int(),
+    updated_at: Column.int(),
+    revoked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthSessionTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    secret_hash: Column.text(),
+    created_at: Column.int(),
+    expires_at: Column.int(),
+    auth_time: Column.int(),
+    aal: Column.text(),
+    amr: Column.text(),
+    mfa_verified_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    last_seen_at: Column.int().pipe(Column.nullable),
+    rotated_at: Column.int().pipe(Column.nullable),
+});
+const makeAuthVerificationTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    type: Column.text(),
+    subject: Column.text(),
+    secret_hash: Column.text().pipe(Column.nullable),
+    created_at: Column.int(),
+    expires_at: Column.int(),
+    metadata: Column.text().pipe(Column.nullable),
+    consumed_at: Column.int().pipe(Column.nullable),
+});
+const makeAuthLoginApprovalReviewTable = (name) => Table.make(name, {
+    approval_challenge_id: Column.text().pipe(Column.primaryKey),
+    flow_id: Column.text(),
+    user_id: Column.text(),
+    channel: Column.text(),
+    reason: Column.text(),
+    session_binding: Column.text(),
+    same_device_required: Column.int(),
+    status: Column.text(),
+    created_at: Column.int(),
+    expires_at: Column.int(),
+    reviewed_at: Column.int().pipe(Column.nullable),
+    reviewed_by: Column.text().pipe(Column.nullable),
+    denied_reason: Column.text().pipe(Column.nullable),
+    risk: Column.text().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+    review_metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthTrustedDeviceTable = (name) => Table.make(name, {
+    user_id: Column.text(),
+    token_hash: Column.text(),
+    created_at: Column.int(),
+    last_seen_at: Column.int(),
+    expires_at: Column.int(),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthPasskeyCredentialTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    credential_id: Column.text(),
+    public_key: Column.text(),
+    sign_count: Column.int(),
+    transports: Column.text().pipe(Column.nullable),
+    backed_up: Column.int().pipe(Column.nullable),
+    created_at: Column.int(),
+    last_used_at: Column.int().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthTotpFactorTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    secret: Column.text(),
+    algorithm: Column.text(),
+    digits: Column.int(),
+    period: Column.int(),
+    created_at: Column.int(),
+    confirmed_at: Column.int().pipe(Column.nullable),
+    last_used_at: Column.int().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthRecoveryCodeTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    code_hash: Column.text(),
+    created_at: Column.int(),
+    used_at: Column.int().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthApiKeyTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    prefix: Column.text(),
+    secret_hash: Column.text(),
+    scopes: Column.text(),
+    created_at: Column.int(),
+    expires_at: Column.int().pipe(Column.nullable),
+    last_used_at: Column.int().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthRefreshTokenTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    family_id: Column.text(),
+    user_id: Column.text(),
+    secret_hash: Column.text(),
+    created_at: Column.int(),
+    expires_at: Column.int(),
+    last_used_at: Column.int().pipe(Column.nullable),
+    rotated_at: Column.int().pipe(Column.nullable),
+    replaced_by_id: Column.text().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    reuse_detected_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthJwtRevocationTable = (name) => Table.make(name, {
+    jwt_id: Column.text().pipe(Column.primaryKey),
+    revoked_at: Column.int(),
+    expires_at: Column.int().pipe(Column.nullable),
+    reason: Column.text().pipe(Column.nullable),
+});
+const makeAuthOAuthAccountTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    provider_id: Column.text(),
+    provider_account_id: Column.text(),
+    user_id: Column.text(),
+    email: Column.text().pipe(Column.nullable),
+    email_verified: Column.int().pipe(Column.nullable),
+    created_at: Column.int(),
+    updated_at: Column.int(),
+    unlinked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthOAuthProviderTokenVaultTable = (name) => Table.make(name, {
+    account_id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    provider_id: Column.text(),
+    provider_account_id: Column.text(),
+    access_token_ciphertext: Column.text(),
+    refresh_token_ciphertext: Column.text().pipe(Column.nullable),
+    id_token_ciphertext: Column.text().pipe(Column.nullable),
+    token_type: Column.text(),
+    scopes: Column.text().pipe(Column.nullable),
+    expires_at: Column.int().pipe(Column.nullable),
+    updated_at: Column.int(),
+    revoked_at: Column.int().pipe(Column.nullable),
+    revocation_reason: Column.text().pipe(Column.nullable),
+});
+const makeAuthSecurityTimelineTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    type: Column.text(),
+    category: Column.text(),
+    severity: Column.text(),
+    occurred_at: Column.int(),
+    summary: Column.text(),
+    actor: Column.text().pipe(Column.nullable),
+    request: Column.text().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const authSqliteTablesTypeId = Symbol.for("@effect-auth/core/EffectQbSqliteStorage/AuthSqliteTables");
+const jsonEncode = (value) => value === undefined ? null : JSON.stringify(value);
+const jsonDecode = (value) => {
+    if (value === null || value === undefined) {
+        return undefined;
+    }
+    return typeof value === "string" ? JSON.parse(value) : value;
+};
+const optionalUnixMillis = (value) => value === null || value === undefined ? undefined : UnixMillis(Number(value));
+const decodeAmr = (value) => typeof value === "string"
+    ? JSON.parse(value)
+    : value;
+const decodeBoolean = (value) => {
+    if (typeof value === "boolean") {
+        return value;
+    }
+    if (typeof value === "number") {
+        return value !== 0;
+    }
+    if (typeof value === "string") {
+        return value !== "" && value !== "0" && value !== "false";
+    }
+    return value !== null && value !== undefined;
+};
+const mutationValues = (value) => value;
+const queryInsert = (table, values) => Query.insert(table, values);
+const queryUpdate = (table, values) => Query.update(table, values);
+const queryEq = (left, right) => Query.eq(left, right);
+const queryGt = (left, right) => Query.gt(left, right);
+const queryLte = (left, right) => Query.lte(left, right);
+const queryIsNull = (value) => Query.isNull(value);
+const queryIn = (value, first, ...rest) => Query.in(value, first, ...rest);
+const executePlan = (executor, plan) => executor.execute(plan);
+const omitUndefined = (record) => Object.fromEntries(Object.entries(record).filter(([, value]) => value !== undefined));
+const sessionMetadataEnvelopeKey = "__effectAuthSession";
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const metadataWithReason = (metadata, key, reason) => reason === undefined ? metadata : { ...metadata, [key]: reason };
+const isLoginRiskLevel = (value) => value === "unknown" ||
+    value === "low" ||
+    value === "medium" ||
+    value === "high" ||
+    value === "critical";
+const decodeLoginRiskSignal = (value) => {
+    const record = isRecord(value) ? value : {};
+    const level = isLoginRiskLevel(record.level) ? record.level : undefined;
+    return LoginRiskSignal.make({
+        type: typeof record.type === "string" ? record.type : "unknown",
+        ...(level === undefined ? {} : { level }),
+        ...(isRecord(record.metadata) ? { metadata: record.metadata } : {}),
+    });
+};
+const decodeLoginRiskContext = (value) => {
+    const decoded = jsonDecode(value);
+    if (!isRecord(decoded)) {
+        return undefined;
+    }
+    return LoginRiskContext.make({
+        level: isLoginRiskLevel(decoded.level) ? decoded.level : "unknown",
+        signals: Array.isArray(decoded.signals)
+            ? decoded.signals.map(decodeLoginRiskSignal)
+            : [],
+        ...(isRecord(decoded.metadata) ? { metadata: decoded.metadata } : {}),
+    });
+};
+const encodeLoginRiskSignal = (signal) => omitUndefined({
+    type: signal.type,
+    level: signal.level,
+    metadata: signal.metadata,
+});
+const encodeLoginRiskContext = (risk) => risk === undefined
+    ? null
+    : jsonEncode(omitUndefined({
+        level: risk.level,
+        signals: risk.signals.map(encodeLoginRiskSignal),
+        metadata: risk.metadata,
+    }));
+const decodeSessionMetadata = (value) => {
+    const decoded = jsonDecode(value);
+    const envelope = isRecord(decoded)
+        ? decoded[sessionMetadataEnvelopeKey]
+        : undefined;
+    if (!isRecord(envelope) || envelope.version !== 1) {
+        return omitUndefined({
+            metadata: decoded,
+        });
+    }
+    return omitUndefined({
+        metadata: envelope.metadata,
+        claims: envelope.claims,
+    });
+};
+const encodeSessionMetadata = (row) => {
+    if (row.claims === undefined) {
+        return jsonEncode(row.metadata);
+    }
+    return jsonEncode({
+        [sessionMetadataEnvelopeKey]: omitUndefined({
+            version: 1,
+            metadata: row.metadata,
+            claims: row.claims,
+        }),
+    });
+};
+const decodeDefaultUserRow = (row) => omitUndefined({
+    id: UserId(row.id),
+    email: Email(row.email),
+    emailVerified: decodeBoolean(row.emailVerified),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    updatedAt: UnixMillis(Number(row.updatedAt)),
+    disabledAt: optionalUnixMillis(row.disabledAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeUserRow = (tables, row) => tables.user.decode === undefined
+    ? decodeDefaultUserRow(row)
+    : tables.user.decode(row);
+const decodeDefaultPasswordCredentialRow = (row) => omitUndefined({
+    id: CredentialId(row.id),
+    userId: UserId(row.userId),
+    passwordHash: row.passwordHash ?? "",
+    createdAt: UnixMillis(Number(row.createdAt)),
+    updatedAt: UnixMillis(Number(row.updatedAt)),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodePasswordCredentialRow = (tables, row) => tables.credential.decodePassword === undefined
+    ? decodeDefaultPasswordCredentialRow(row)
+    : tables.credential.decodePassword(row);
+const decodeDefaultSessionRow = (row) => {
+    const sessionMetadata = decodeSessionMetadata(row.metadata);
+    return omitUndefined({
+        id: SessionId(row.id),
+        userId: UserId(row.userId),
+        secretHash: row.secretHash,
+        createdAt: UnixMillis(Number(row.createdAt)),
+        expiresAt: UnixMillis(Number(row.expiresAt)),
+        authTime: UnixMillis(Number(row.authTime)),
+        aal: row.aal,
+        amr: decodeAmr(row.amr),
+        mfaVerifiedAt: optionalUnixMillis(row.mfaVerifiedAt),
+        metadata: sessionMetadata.metadata,
+        claims: sessionMetadata.claims,
+        revokedAt: optionalUnixMillis(row.revokedAt),
+        lastSeenAt: optionalUnixMillis(row.lastSeenAt),
+        rotatedAt: optionalUnixMillis(row.rotatedAt),
+    });
+};
+const decodeSessionRow = (tables, row) => tables.session.decode === undefined
+    ? decodeDefaultSessionRow(row)
+    : tables.session.decode(row);
+const decodeDefaultVerificationRow = (row) => omitUndefined({
+    id: ChallengeId(row.id),
+    type: row.type,
+    subject: row.subject,
+    secretHash: row.secretHash ?? undefined,
+    createdAt: UnixMillis(Number(row.createdAt)),
+    expiresAt: UnixMillis(Number(row.expiresAt)),
+    metadata: jsonDecode(row.metadata),
+    consumedAt: optionalUnixMillis(row.consumedAt),
+});
+const decodeVerificationRow = (tables, row) => tables.verification.decode === undefined
+    ? decodeDefaultVerificationRow(row)
+    : tables.verification.decode(row);
+const decodeDefaultLoginApprovalReviewRow = (row) => omitUndefined({
+    approvalChallengeId: ChallengeId(row.approvalChallengeId),
+    flowId: AuthFlowId(row.flowId),
+    userId: UserId(row.userId),
+    channel: row.channel,
+    reason: row.reason,
+    sessionBinding: row.sessionBinding,
+    sameDeviceRequired: decodeBoolean(row.sameDeviceRequired),
+    status: row.status,
+    createdAt: UnixMillis(Number(row.createdAt)),
+    expiresAt: UnixMillis(Number(row.expiresAt)),
+    reviewedAt: optionalUnixMillis(row.reviewedAt),
+    reviewedBy: row.reviewedBy === null
+        ? undefined
+        : row.reviewedBy,
+    deniedReason: row.deniedReason === null ? undefined : row.deniedReason,
+    risk: decodeLoginRiskContext(row.risk),
+    metadata: jsonDecode(row.metadata),
+    reviewMetadata: jsonDecode(row.reviewMetadata),
+});
+const decodeLoginApprovalReviewRow = (tables, row) => tables.loginApprovalReview.decode === undefined
+    ? decodeDefaultLoginApprovalReviewRow(row)
+    : tables.loginApprovalReview.decode(row);
+const decodeDefaultTrustedDeviceRow = (row) => omitUndefined({
+    userId: UserId(row.userId),
+    tokenHash: row.tokenHash,
+    createdAt: UnixMillis(Number(row.createdAt)),
+    lastSeenAt: UnixMillis(Number(row.lastSeenAt)),
+    expiresAt: UnixMillis(Number(row.expiresAt)),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeTrustedDeviceRow = (tables, row) => tables.trustedDevice.decode === undefined
+    ? decodeDefaultTrustedDeviceRow(row)
+    : tables.trustedDevice.decode(row);
+const decodePasskeyTransports = (value) => {
+    const decoded = jsonDecode(value);
+    return Array.isArray(decoded) ? decoded : undefined;
+};
+const decodeDefaultPasskeyCredentialRow = (row) => omitUndefined({
+    id: CredentialId(row.id),
+    userId: UserId(row.userId),
+    credentialId: PasskeyCredentialId(row.credentialId),
+    publicKey: row.publicKey,
+    signCount: Number(row.signCount),
+    transports: decodePasskeyTransports(row.transports),
+    backedUp: row.backedUp === null || row.backedUp === undefined
+        ? undefined
+        : decodeBoolean(row.backedUp),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    lastUsedAt: optionalUnixMillis(row.lastUsedAt),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodePasskeyCredentialRow = (tables, row) => tables.passkeyCredential.decode === undefined
+    ? decodeDefaultPasskeyCredentialRow(row)
+    : tables.passkeyCredential.decode(row);
+const decodeDefaultTotpFactorRow = (row) => omitUndefined({
+    id: CredentialId(row.id),
+    userId: UserId(row.userId),
+    secret: Redacted.make(TotpSecret(row.secret)),
+    algorithm: row.algorithm,
+    digits: Number(row.digits),
+    period: Number(row.period),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    confirmedAt: optionalUnixMillis(row.confirmedAt),
+    lastUsedAt: optionalUnixMillis(row.lastUsedAt),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeTotpFactorRow = (tables, row) => tables.totpFactor.decode === undefined
+    ? decodeDefaultTotpFactorRow(row)
+    : tables.totpFactor.decode(row);
+const decodeDefaultRecoveryCodeRow = (row) => omitUndefined({
+    id: CredentialId(row.id),
+    userId: UserId(row.userId),
+    codeHash: RecoveryCodeHash(row.codeHash),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    usedAt: optionalUnixMillis(row.usedAt),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeRecoveryCodeRow = (tables, row) => tables.recoveryCode.decode === undefined
+    ? decodeDefaultRecoveryCodeRow(row)
+    : tables.recoveryCode.decode(row);
+const decodeStringArray = (value) => {
+    const decoded = jsonDecode(value);
+    return Array.isArray(decoded) ? decoded.map(String) : [];
+};
+const decodeOptionalStringArray = (value) => {
+    const decoded = jsonDecode(value);
+    return Array.isArray(decoded) ? decoded.map(String) : undefined;
+};
+const decodeDefaultApiKeyRow = (row) => omitUndefined({
+    id: ApiKeyId(row.id),
+    userId: UserId(row.userId),
+    prefix: ApiKeyPrefix(row.prefix),
+    secretHash: ApiKeySecretHash(row.secretHash),
+    scopes: decodeStringArray(row.scopes),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    expiresAt: optionalUnixMillis(row.expiresAt),
+    lastUsedAt: optionalUnixMillis(row.lastUsedAt),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeApiKeyRow = (tables, row) => tables.apiKey.decode === undefined
+    ? decodeDefaultApiKeyRow(row)
+    : tables.apiKey.decode(row);
+const decodeDefaultRefreshTokenRow = (row) => omitUndefined({
+    id: RefreshTokenId(row.id),
+    familyId: RefreshTokenFamilyId(row.familyId),
+    userId: UserId(row.userId),
+    secretHash: RefreshTokenSecretHash(row.secretHash),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    expiresAt: UnixMillis(Number(row.expiresAt)),
+    lastUsedAt: optionalUnixMillis(row.lastUsedAt),
+    rotatedAt: optionalUnixMillis(row.rotatedAt),
+    replacedById: row.replacedById === null ? undefined : RefreshTokenId(row.replacedById),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    reuseDetectedAt: optionalUnixMillis(row.reuseDetectedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeRefreshTokenRow = (tables, row) => tables.refreshToken.decode === undefined
+    ? decodeDefaultRefreshTokenRow(row)
+    : tables.refreshToken.decode(row);
+const decodeDefaultJwtRevocationRow = (row) => omitUndefined({
+    jwtId: row.jwtId,
+    revokedAt: UnixMillis(Number(row.revokedAt)),
+    expiresAt: optionalUnixMillis(row.expiresAt),
+    reason: row.reason ?? undefined,
+});
+const decodeJwtRevocationRow = (tables, row) => tables.jwtRevocation.decode === undefined
+    ? decodeDefaultJwtRevocationRow(row)
+    : tables.jwtRevocation.decode(row);
+const decodeDefaultOAuthAccountRow = (row) => omitUndefined({
+    id: OAuthAccountId(row.id),
+    providerId: OAuthProviderId(row.providerId),
+    providerAccountId: row.providerAccountId,
+    userId: UserId(row.userId),
+    email: row.email === null ? undefined : Email(row.email),
+    emailVerified: row.emailVerified === null || row.emailVerified === undefined
+        ? undefined
+        : decodeBoolean(row.emailVerified),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    updatedAt: UnixMillis(Number(row.updatedAt)),
+    unlinkedAt: optionalUnixMillis(row.unlinkedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeOAuthAccountRow = (tables, row) => tables.oauthAccount.decode === undefined
+    ? decodeDefaultOAuthAccountRow(row)
+    : tables.oauthAccount.decode(row);
+const decodeDefaultOAuthProviderTokenVaultRow = (row) => omitUndefined({
+    accountId: OAuthAccountId(row.accountId),
+    userId: UserId(row.userId),
+    providerId: OAuthProviderId(row.providerId),
+    providerAccountId: row.providerAccountId,
+    accessTokenCiphertext: Redacted.make(row.accessTokenCiphertext),
+    refreshTokenCiphertext: row.refreshTokenCiphertext === null
+        ? undefined
+        : Redacted.make(row.refreshTokenCiphertext),
+    idTokenCiphertext: row.idTokenCiphertext === null
+        ? undefined
+        : Redacted.make(row.idTokenCiphertext),
+    tokenType: row.tokenType,
+    scopes: decodeOptionalStringArray(row.scopes),
+    expiresAt: optionalUnixMillis(row.expiresAt),
+    updatedAt: UnixMillis(Number(row.updatedAt)),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    revocationReason: row.revocationReason ?? undefined,
+});
+const decodeOAuthProviderTokenVaultRow = (tables, row) => tables.oauthProviderTokenVault.decode === undefined
+    ? decodeDefaultOAuthProviderTokenVaultRow(row)
+    : tables.oauthProviderTokenVault.decode(row);
+const decodeDefaultSecurityTimelineEvent = (row) => omitUndefined({
+    id: SecurityTimelineEventId(row.id),
+    userId: UserId(row.userId),
+    type: row.type,
+    category: row.category,
+    severity: row.severity,
+    occurredAt: UnixMillis(Number(row.occurredAt)),
+    summary: row.summary,
+    actor: jsonDecode(row.actor),
+    request: jsonDecode(row.request),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeSecurityTimelineEvent = (tables, row) => tables.securityTimeline.decode === undefined
+    ? decodeDefaultSecurityTimelineEvent(row)
+    : tables.securityTimeline.decode(row);
+const providerTokenVaultTokens = (record) => omitUndefined({
+    accessTokenCiphertext: record.accessTokenCiphertext,
+    refreshTokenCiphertext: record.refreshTokenCiphertext,
+    idTokenCiphertext: record.idTokenCiphertext,
+    tokenType: record.tokenType,
+    scopes: record.scopes === undefined ? undefined : [...record.scopes],
+    expiresAt: record.expiresAt,
+});
+const userInsert = (row) => ({
+    id: row.id,
+    email: row.email,
+    email_verified: row.emailVerified ? 1 : 0,
+    created_at: Number(row.createdAt),
+    updated_at: Number(row.updatedAt),
+    disabled_at: row.disabledAt === undefined ? null : Number(row.disabledAt),
+    metadata: jsonEncode(row.metadata),
+});
+const passwordCredentialInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    type: "password",
+    password_hash: row.passwordHash,
+    created_at: Number(row.createdAt),
+    updated_at: Number(row.updatedAt),
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const passwordCredentialUpdatePassword = (input) => ({
+    password_hash: input.passwordHash,
+    updated_at: Number(input.updatedAt),
+});
+const sessionInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    secret_hash: row.secretHash,
+    created_at: Number(row.createdAt),
+    expires_at: Number(row.expiresAt),
+    auth_time: Number(row.authTime),
+    aal: row.aal,
+    amr: JSON.stringify(row.amr),
+    mfa_verified_at: row.mfaVerifiedAt === undefined ? null : Number(row.mfaVerifiedAt),
+    metadata: encodeSessionMetadata(row),
+    revoked_at: null,
+    last_seen_at: null,
+    rotated_at: null,
+});
+const verificationInsert = (row) => ({
+    id: row.id,
+    type: row.type,
+    subject: row.subject,
+    secret_hash: row.secretHash ?? null,
+    created_at: Number(row.createdAt),
+    expires_at: Number(row.expiresAt),
+    metadata: jsonEncode(row.metadata),
+    consumed_at: null,
+});
+const loginApprovalReviewInsert = (row) => ({
+    approval_challenge_id: row.approvalChallengeId,
+    flow_id: row.flowId,
+    user_id: row.userId,
+    channel: row.channel,
+    reason: row.reason,
+    session_binding: row.sessionBinding,
+    same_device_required: row.sameDeviceRequired ? 1 : 0,
+    status: row.status,
+    created_at: Number(row.createdAt),
+    expires_at: Number(row.expiresAt),
+    reviewed_at: row.reviewedAt === undefined ? null : Number(row.reviewedAt),
+    reviewed_by: row.reviewedBy ?? null,
+    denied_reason: row.deniedReason ?? null,
+    risk: encodeLoginRiskContext(row.risk),
+    metadata: jsonEncode(row.metadata),
+    review_metadata: jsonEncode(row.reviewMetadata),
+});
+const userMarkEmailVerifiedUpdate = (input) => ({
+    email_verified: 1,
+    updated_at: Number(input.updatedAt),
+});
+const sessionRefreshUpdate = (input) => omitUndefined({
+    expires_at: Number(input.expiresAt),
+    last_seen_at: input.lastSeenAt === undefined ? undefined : Number(input.lastSeenAt),
+});
+const sessionRotateUpdate = (input) => omitUndefined({
+    secret_hash: input.secretHash,
+    rotated_at: Number(input.rotatedAt),
+    expires_at: input.expiresAt === undefined ? undefined : Number(input.expiresAt),
+});
+const sessionUpdateClaimsUpdate = (row, input) => omitUndefined({
+    aal: input.aal,
+    amr: input.amr === undefined ? undefined : JSON.stringify(input.amr),
+    mfa_verified_at: input.mfaVerifiedAt === undefined ? undefined : Number(input.mfaVerifiedAt),
+    metadata: encodeSessionMetadata({
+        ...row,
+        claims: input.claims ?? row.claims,
+    }),
+});
+const sessionRevokeUpdate = (input) => ({
+    revoked_at: Number(input.revokedAt),
+});
+const verificationConsumeUpdate = (input) => ({
+    consumed_at: Number(input.consumedAt),
+});
+const loginApprovalReviewApproveUpdate = (input) => ({
+    status: "approved",
+    reviewed_at: Number(input.reviewedAt),
+    reviewed_by: input.reviewedBy ?? null,
+    review_metadata: jsonEncode(input.metadata),
+});
+const loginApprovalReviewDenyUpdate = (input) => ({
+    status: "denied",
+    reviewed_at: Number(input.reviewedAt),
+    reviewed_by: input.reviewedBy ?? null,
+    denied_reason: input.reason ?? null,
+    review_metadata: jsonEncode(input.metadata),
+});
+const trustedDeviceInsert = (input, createdAt) => ({
+    user_id: input.userId,
+    token_hash: input.tokenHash,
+    created_at: Number(createdAt),
+    last_seen_at: Number(input.now),
+    expires_at: Number(input.expiresAt),
+    metadata: jsonEncode(input.metadata),
+});
+const trustedDeviceUpdate = (input, existing) => ({
+    last_seen_at: Number(input.now),
+    expires_at: Number(input.expiresAt),
+    metadata: jsonEncode(input.metadata ?? existing.metadata),
+});
+const passkeyCredentialInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    credential_id: row.credentialId,
+    public_key: row.publicKey,
+    sign_count: row.signCount,
+    transports: jsonEncode(row.transports),
+    backed_up: row.backedUp === undefined ? null : row.backedUp ? 1 : 0,
+    created_at: Number(row.createdAt),
+    last_used_at: row.lastUsedAt === undefined ? null : Number(row.lastUsedAt),
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const passkeyCredentialUpdateSignCount = (input) => omitUndefined({
+    sign_count: input.signCount,
+    last_used_at: Number(input.lastUsedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
+const passkeyCredentialRevoke = (input, row) => ({
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
+});
+const totpFactorInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    secret: Redacted.value(row.secret),
+    algorithm: row.algorithm,
+    digits: row.digits,
+    period: row.period,
+    created_at: Number(row.createdAt),
+    confirmed_at: row.confirmedAt === undefined ? null : Number(row.confirmedAt),
+    last_used_at: row.lastUsedAt === undefined ? null : Number(row.lastUsedAt),
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const totpFactorConfirm = (input) => omitUndefined({
+    confirmed_at: Number(input.confirmedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
+const totpFactorMarkUsed = (input) => omitUndefined({
+    last_used_at: Number(input.lastUsedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
+const totpFactorRevoke = (input, row) => ({
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
+});
+const recoveryCodeInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    code_hash: row.codeHash,
+    created_at: Number(row.createdAt),
+    used_at: row.usedAt === undefined ? null : Number(row.usedAt),
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const recoveryCodeMarkUsed = (input) => omitUndefined({
+    used_at: Number(input.usedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
+const recoveryCodeRevoke = (input, row) => ({
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
+});
+const apiKeyInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    prefix: row.prefix,
+    secret_hash: row.secretHash,
+    scopes: JSON.stringify(row.scopes),
+    created_at: Number(row.createdAt),
+    expires_at: row.expiresAt === undefined ? null : Number(row.expiresAt),
+    last_used_at: row.lastUsedAt === undefined ? null : Number(row.lastUsedAt),
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const apiKeyMarkUsed = (input) => omitUndefined({
+    last_used_at: Number(input.lastUsedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
+const apiKeyRevoke = (input, row) => ({
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
+});
+const refreshTokenInsert = (row) => ({
+    id: row.id,
+    family_id: row.familyId,
+    user_id: row.userId,
+    secret_hash: row.secretHash,
+    created_at: Number(row.createdAt),
+    expires_at: Number(row.expiresAt),
+    last_used_at: row.lastUsedAt === undefined ? null : Number(row.lastUsedAt),
+    rotated_at: row.rotatedAt === undefined ? null : Number(row.rotatedAt),
+    replaced_by_id: row.replacedById ?? null,
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    reuse_detected_at: row.reuseDetectedAt === undefined ? null : Number(row.reuseDetectedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const refreshTokenRotate = (input) => ({
+    last_used_at: Number(input.rotatedAt),
+    rotated_at: Number(input.rotatedAt),
+    replaced_by_id: input.replacement.id,
+});
+const refreshTokenMarkReuseDetected = (input) => ({
+    reuse_detected_at: Number(input.reuseDetectedAt),
+});
+const refreshTokenRevoke = (input, row) => ({
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
+});
+const refreshTokenRevokeFamily = (input, row) => ({
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "familyRevokeReason", input.reason)),
+});
+const jwtRevocationInsert = (record) => ({
+    jwt_id: record.jwtId,
+    revoked_at: Number(record.revokedAt),
+    expires_at: record.expiresAt === undefined ? null : Number(record.expiresAt),
+    reason: record.reason ?? null,
+});
+const oauthAccountInsert = (row) => ({
+    id: row.id,
+    provider_id: row.providerId,
+    provider_account_id: row.providerAccountId,
+    user_id: row.userId,
+    email: row.email ?? null,
+    email_verified: row.emailVerified === undefined ? null : row.emailVerified ? 1 : 0,
+    created_at: Number(row.createdAt),
+    updated_at: Number(row.updatedAt),
+    unlinked_at: row.unlinkedAt === undefined ? null : Number(row.unlinkedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const oauthAccountUnlink = (input, row) => ({
+    unlinked_at: Number(input.unlinkedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "unlinkReason", input.reason)),
+});
+const oauthProviderTokenVaultValues = (row) => ({
+    account_id: row.accountId,
+    user_id: row.userId,
+    provider_id: row.providerId,
+    provider_account_id: row.providerAccountId,
+    access_token_ciphertext: Redacted.value(row.accessTokenCiphertext),
+    refresh_token_ciphertext: row.refreshTokenCiphertext === undefined
+        ? null
+        : Redacted.value(row.refreshTokenCiphertext),
+    id_token_ciphertext: row.idTokenCiphertext === undefined ? null : Redacted.value(row.idTokenCiphertext),
+    token_type: row.tokenType,
+    scopes: jsonEncode(row.scopes),
+    expires_at: row.expiresAt === undefined ? null : Number(row.expiresAt),
+    updated_at: Number(row.updatedAt),
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    revocation_reason: row.revocationReason ?? null,
+});
+const oauthProviderTokenVaultMarkRevoked = (input) => ({
+    revoked_at: Number(input.revokedAt),
+    revocation_reason: input.reason,
+});
+const securityTimelineInsert = (event) => ({
+    id: event.id,
+    user_id: event.userId,
+    type: event.type,
+    category: event.category,
+    severity: event.severity,
+    occurred_at: Number(event.occurredAt),
+    summary: event.summary,
+    actor: jsonEncode(event.actor),
+    request: jsonEncode(event.request),
+    metadata: jsonEncode(event.metadata),
+});
+const jwtRevocationUpdate = (record) => ({
+    revoked_at: Number(record.revokedAt),
+    expires_at: record.expiresAt === undefined ? null : Number(record.expiresAt),
+    reason: record.reason ?? null,
+});
+const makeInternalAuthSqliteTables = (names = {}) => {
+    const user = makeAuthUserTable(names.user ?? "auth_user");
+    const credential = makeAuthCredentialTable(names.credential ?? "auth_credential");
+    const session = makeAuthSessionTable(names.session ?? "auth_session");
+    const verification = makeAuthVerificationTable(names.verification ?? "auth_verification");
+    const loginApprovalReview = makeAuthLoginApprovalReviewTable(names.loginApprovalReview ?? "auth_login_approval_review");
+    const trustedDevice = makeAuthTrustedDeviceTable(names.trustedDevice ?? "auth_trusted_device");
+    const passkeyCredential = makeAuthPasskeyCredentialTable(names.passkeyCredential ?? "auth_passkey_credential");
+    const totpFactor = makeAuthTotpFactorTable(names.totpFactor ?? "auth_totp_factor");
+    const recoveryCode = makeAuthRecoveryCodeTable(names.recoveryCode ?? "auth_recovery_code");
+    const apiKey = makeAuthApiKeyTable(names.apiKey ?? "auth_api_key");
+    const refreshToken = makeAuthRefreshTokenTable(names.refreshToken ?? "auth_refresh_token");
+    const jwtRevocation = makeAuthJwtRevocationTable(names.jwtRevocation ?? "auth_jwt_revocation");
+    const oauthAccount = makeAuthOAuthAccountTable(names.oauthAccount ?? "auth_oauth_account");
+    const oauthProviderTokenVault = makeAuthOAuthProviderTokenVaultTable(names.oauthProviderTokenVault ?? "auth_oauth_provider_token_vault");
+    const securityTimeline = makeAuthSecurityTimelineTable(names.securityTimeline ?? "auth_security_timeline");
+    return {
+        user: {
+            table: user,
+            select: {
+                id: user.id,
+                email: user.email,
+                emailVerified: user.email_verified,
+                createdAt: user.created_at,
+                updatedAt: user.updated_at,
+                disabledAt: user.disabled_at,
+                metadata: user.metadata,
+            },
+            insert: userInsert,
+            markEmailVerified: userMarkEmailVerifiedUpdate,
+        },
+        credential: {
+            table: credential,
+            select: {
+                id: credential.id,
+                userId: credential.user_id,
+                type: credential.type,
+                passwordHash: credential.password_hash,
+                createdAt: credential.created_at,
+                updatedAt: credential.updated_at,
+                revokedAt: credential.revoked_at,
+                metadata: credential.metadata,
+            },
+            insertPassword: passwordCredentialInsert,
+            updatePassword: passwordCredentialUpdatePassword,
+        },
+        session: {
+            table: session,
+            select: {
+                id: session.id,
+                userId: session.user_id,
+                secretHash: session.secret_hash,
+                createdAt: session.created_at,
+                expiresAt: session.expires_at,
+                authTime: session.auth_time,
+                aal: session.aal,
+                amr: session.amr,
+                mfaVerifiedAt: session.mfa_verified_at,
+                metadata: session.metadata,
+                revokedAt: session.revoked_at,
+                lastSeenAt: session.last_seen_at,
+                rotatedAt: session.rotated_at,
+            },
+            insert: sessionInsert,
+            refresh: sessionRefreshUpdate,
+            rotate: sessionRotateUpdate,
+            updateClaims: sessionUpdateClaimsUpdate,
+            revoke: sessionRevokeUpdate,
+        },
+        verification: {
+            table: verification,
+            select: {
+                id: verification.id,
+                type: verification.type,
+                subject: verification.subject,
+                secretHash: verification.secret_hash,
+                createdAt: verification.created_at,
+                expiresAt: verification.expires_at,
+                metadata: verification.metadata,
+                consumedAt: verification.consumed_at,
+            },
+            insert: verificationInsert,
+            consume: verificationConsumeUpdate,
+        },
+        loginApprovalReview: {
+            table: loginApprovalReview,
+            select: {
+                approvalChallengeId: loginApprovalReview.approval_challenge_id,
+                flowId: loginApprovalReview.flow_id,
+                userId: loginApprovalReview.user_id,
+                channel: loginApprovalReview.channel,
+                reason: loginApprovalReview.reason,
+                sessionBinding: loginApprovalReview.session_binding,
+                sameDeviceRequired: loginApprovalReview.same_device_required,
+                status: loginApprovalReview.status,
+                createdAt: loginApprovalReview.created_at,
+                expiresAt: loginApprovalReview.expires_at,
+                reviewedAt: loginApprovalReview.reviewed_at,
+                reviewedBy: loginApprovalReview.reviewed_by,
+                deniedReason: loginApprovalReview.denied_reason,
+                risk: loginApprovalReview.risk,
+                metadata: loginApprovalReview.metadata,
+                reviewMetadata: loginApprovalReview.review_metadata,
+            },
+            insertPending: loginApprovalReviewInsert,
+            approve: loginApprovalReviewApproveUpdate,
+            deny: loginApprovalReviewDenyUpdate,
+        },
+        trustedDevice: {
+            table: trustedDevice,
+            select: {
+                userId: trustedDevice.user_id,
+                tokenHash: trustedDevice.token_hash,
+                createdAt: trustedDevice.created_at,
+                lastSeenAt: trustedDevice.last_seen_at,
+                expiresAt: trustedDevice.expires_at,
+                metadata: trustedDevice.metadata,
+            },
+            insert: trustedDeviceInsert,
+            update: trustedDeviceUpdate,
+        },
+        passkeyCredential: {
+            table: passkeyCredential,
+            select: {
+                id: passkeyCredential.id,
+                userId: passkeyCredential.user_id,
+                credentialId: passkeyCredential.credential_id,
+                publicKey: passkeyCredential.public_key,
+                signCount: passkeyCredential.sign_count,
+                transports: passkeyCredential.transports,
+                backedUp: passkeyCredential.backed_up,
+                createdAt: passkeyCredential.created_at,
+                lastUsedAt: passkeyCredential.last_used_at,
+                revokedAt: passkeyCredential.revoked_at,
+                metadata: passkeyCredential.metadata,
+            },
+            insert: passkeyCredentialInsert,
+            updateSignCount: passkeyCredentialUpdateSignCount,
+            revoke: passkeyCredentialRevoke,
+        },
+        totpFactor: {
+            table: totpFactor,
+            select: {
+                id: totpFactor.id,
+                userId: totpFactor.user_id,
+                secret: totpFactor.secret,
+                algorithm: totpFactor.algorithm,
+                digits: totpFactor.digits,
+                period: totpFactor.period,
+                createdAt: totpFactor.created_at,
+                confirmedAt: totpFactor.confirmed_at,
+                lastUsedAt: totpFactor.last_used_at,
+                revokedAt: totpFactor.revoked_at,
+                metadata: totpFactor.metadata,
+            },
+            insert: totpFactorInsert,
+            confirm: totpFactorConfirm,
+            markUsed: totpFactorMarkUsed,
+            revoke: totpFactorRevoke,
+        },
+        recoveryCode: {
+            table: recoveryCode,
+            select: {
+                id: recoveryCode.id,
+                userId: recoveryCode.user_id,
+                codeHash: recoveryCode.code_hash,
+                createdAt: recoveryCode.created_at,
+                usedAt: recoveryCode.used_at,
+                revokedAt: recoveryCode.revoked_at,
+                metadata: recoveryCode.metadata,
+            },
+            insert: recoveryCodeInsert,
+            markUsed: recoveryCodeMarkUsed,
+            revoke: recoveryCodeRevoke,
+        },
+        apiKey: {
+            table: apiKey,
+            select: {
+                id: apiKey.id,
+                userId: apiKey.user_id,
+                prefix: apiKey.prefix,
+                secretHash: apiKey.secret_hash,
+                scopes: apiKey.scopes,
+                createdAt: apiKey.created_at,
+                expiresAt: apiKey.expires_at,
+                lastUsedAt: apiKey.last_used_at,
+                revokedAt: apiKey.revoked_at,
+                metadata: apiKey.metadata,
+            },
+            insert: apiKeyInsert,
+            markUsed: apiKeyMarkUsed,
+            revoke: apiKeyRevoke,
+        },
+        refreshToken: {
+            table: refreshToken,
+            select: {
+                id: refreshToken.id,
+                familyId: refreshToken.family_id,
+                userId: refreshToken.user_id,
+                secretHash: refreshToken.secret_hash,
+                createdAt: refreshToken.created_at,
+                expiresAt: refreshToken.expires_at,
+                lastUsedAt: refreshToken.last_used_at,
+                rotatedAt: refreshToken.rotated_at,
+                replacedById: refreshToken.replaced_by_id,
+                revokedAt: refreshToken.revoked_at,
+                reuseDetectedAt: refreshToken.reuse_detected_at,
+                metadata: refreshToken.metadata,
+            },
+            insert: refreshTokenInsert,
+            rotate: refreshTokenRotate,
+            markReuseDetected: refreshTokenMarkReuseDetected,
+            revoke: refreshTokenRevoke,
+            revokeFamily: refreshTokenRevokeFamily,
+        },
+        jwtRevocation: {
+            table: jwtRevocation,
+            select: {
+                jwtId: jwtRevocation.jwt_id,
+                revokedAt: jwtRevocation.revoked_at,
+                expiresAt: jwtRevocation.expires_at,
+                reason: jwtRevocation.reason,
+            },
+            insert: jwtRevocationInsert,
+            update: jwtRevocationUpdate,
+        },
+        oauthAccount: {
+            table: oauthAccount,
+            select: {
+                id: oauthAccount.id,
+                providerId: oauthAccount.provider_id,
+                providerAccountId: oauthAccount.provider_account_id,
+                userId: oauthAccount.user_id,
+                email: oauthAccount.email,
+                emailVerified: oauthAccount.email_verified,
+                createdAt: oauthAccount.created_at,
+                updatedAt: oauthAccount.updated_at,
+                unlinkedAt: oauthAccount.unlinked_at,
+                metadata: oauthAccount.metadata,
+            },
+            insert: oauthAccountInsert,
+            unlink: oauthAccountUnlink,
+        },
+        oauthProviderTokenVault: {
+            table: oauthProviderTokenVault,
+            select: {
+                accountId: oauthProviderTokenVault.account_id,
+                userId: oauthProviderTokenVault.user_id,
+                providerId: oauthProviderTokenVault.provider_id,
+                providerAccountId: oauthProviderTokenVault.provider_account_id,
+                accessTokenCiphertext: oauthProviderTokenVault.access_token_ciphertext,
+                refreshTokenCiphertext: oauthProviderTokenVault.refresh_token_ciphertext,
+                idTokenCiphertext: oauthProviderTokenVault.id_token_ciphertext,
+                tokenType: oauthProviderTokenVault.token_type,
+                scopes: oauthProviderTokenVault.scopes,
+                expiresAt: oauthProviderTokenVault.expires_at,
+                updatedAt: oauthProviderTokenVault.updated_at,
+                revokedAt: oauthProviderTokenVault.revoked_at,
+                revocationReason: oauthProviderTokenVault.revocation_reason,
+            },
+            insert: oauthProviderTokenVaultValues,
+            update: oauthProviderTokenVaultValues,
+            markRevoked: oauthProviderTokenVaultMarkRevoked,
+        },
+        securityTimeline: {
+            table: securityTimeline,
+            select: {
+                id: securityTimeline.id,
+                userId: securityTimeline.user_id,
+                type: securityTimeline.type,
+                category: securityTimeline.category,
+                severity: securityTimeline.severity,
+                occurredAt: securityTimeline.occurred_at,
+                summary: securityTimeline.summary,
+                actor: securityTimeline.actor,
+                request: securityTimeline.request,
+                metadata: securityTimeline.metadata,
+            },
+            insert: securityTimelineInsert,
+        },
+    };
+};
+const asAuthSqliteTables = (tables) => tables;
+export const defineEffectQbAuthTables = (tables) => asAuthSqliteTables(tables);
+export const makeAuthSqliteTables = (names = {}) => asAuthSqliteTables(makeInternalAuthSqliteTables(names));
+export const authSqliteTables = makeAuthSqliteTables();
+const selectUserColumns = (tables) => tables.user.select;
+const selectCredentialColumns = (tables) => tables.credential.select;
+const selectSessionColumns = (tables) => tables.session.select;
+const selectVerificationColumns = (tables) => tables.verification.select;
+const selectLoginApprovalReviewColumns = (tables) => tables.loginApprovalReview.select;
+const selectTrustedDeviceColumns = (tables) => tables.trustedDevice.select;
+const selectPasskeyCredentialColumns = (tables) => tables.passkeyCredential.select;
+const selectTotpFactorColumns = (tables) => tables.totpFactor.select;
+const selectRecoveryCodeColumns = (tables) => tables.recoveryCode.select;
+const selectApiKeyColumns = (tables) => tables.apiKey.select;
+const selectRefreshTokenColumns = (tables) => tables.refreshToken.select;
+const selectJwtRevocationColumns = (tables) => tables.jwtRevocation.select;
+const selectOAuthAccountColumns = (tables) => tables.oauthAccount.select;
+const selectOAuthProviderTokenVaultColumns = (tables) => tables.oauthProviderTokenVault.select;
+const selectSecurityTimelineColumns = (tables) => tables.securityTimeline.select;
+const storageError = (entity, operation, cause) => StorageError.fromUnknown(entity, operation, cause);
+const loginApprovalReviewStoreError = (operation, cause) => new LoginApprovalReviewError({
+    message: `Login approval review ${operation} failed`,
+    cause,
+});
+const trustedDeviceStoreError = (operation, cause) => new TrustedDeviceError({
+    operation,
+    message: `Trusted device ${operation} failed`,
+    cause,
+});
+const passkeyCredentialStoreError = (operation, cause) => new PasskeyCredentialStoreError({
+    operation,
+    message: `Passkey credential ${operation} failed`,
+    cause,
+});
+const totpFactorStoreError = (operation, cause) => new TotpFactorStoreError({
+    operation,
+    message: `TOTP factor ${operation} failed`,
+    cause,
+});
+const recoveryCodeStoreError = (operation, cause) => new RecoveryCodeStoreError({
+    operation,
+    message: `Recovery code ${operation} failed`,
+    cause,
+});
+const apiKeyStoreError = (operation, cause) => new ApiKeyStoreError({
+    operation,
+    message: `API key ${operation} failed`,
+    cause,
+});
+const refreshTokenStoreError = (operation, cause) => new RefreshTokenStoreError({
+    operation,
+    message: `Refresh token ${operation} failed`,
+    cause,
+});
+const jwtRevocationStoreError = (operation, cause) => new JwtError({
+    operation: "revocation",
+    message: `JWT revocation ${operation} failed`,
+    cause,
+});
+const oauthAccountStoreError = (operation, cause) => new OAuthAccountStoreError({
+    operation,
+    message: `OAuth account ${operation} failed`,
+    cause,
+});
+const oauthProviderTokenVaultError = (operation, cause) => new OAuthProviderTokenVaultError({
+    operation,
+    message: `OAuth provider token vault ${operation} failed`,
+    cause,
+});
+const securityTimelineStoreError = (operation, cause) => new SecurityTimelineStoreError({
+    operation,
+    message: `Security timeline ${operation} failed`,
+    cause,
+});
+const findUserById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectUserColumns(tables)).pipe(Query.from(tables.user.table), Query.where(queryEq(tables.user.select.id, id)))).pipe(Effect.mapError((cause) => storageError("user", operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeUserRow(tables, rows[0]))));
+const findUserByEmail = (executor, tables, email, operation = "find") => executePlan(executor, Query.select(selectUserColumns(tables)).pipe(Query.from(tables.user.table), Query.where(queryEq(tables.user.select.email, email)))).pipe(Effect.mapError((cause) => storageError("user", operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeUserRow(tables, rows[0]))));
+const findPasswordCredentialByUserId = (executor, tables, userId, operation = "find") => executePlan(executor, Query.select(selectCredentialColumns(tables)).pipe(Query.from(tables.credential.table), Query.where(queryEq(tables.credential.select.userId, userId)), Query.where(queryEq(tables.credential.select.type, "password")))).pipe(Effect.mapError((cause) => storageError("credential", operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodePasswordCredentialRow(tables, rows[0]))));
+const findJwtRevocation = (executor, tables, jwtId, operation = "find") => executePlan(executor, Query.select(selectJwtRevocationColumns(tables)).pipe(Query.from(tables.jwtRevocation.table), Query.where(queryEq(tables.jwtRevocation.select.jwtId, jwtId)))).pipe(Effect.mapError((cause) => jwtRevocationStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeJwtRevocationRow(tables, rows[0]))));
+const findSessionById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectSessionColumns(tables)).pipe(Query.from(tables.session.table), Query.where(queryEq(tables.session.select.id, id)))).pipe(Effect.mapError((cause) => storageError("session", operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeSessionRow(tables, rows[0]))));
+const listSessionsByUser = (executor, tables, input, operation = "listByUser") => executePlan(executor, Query.select(selectSessionColumns(tables)).pipe(Query.from(tables.session.table), Query.where(queryEq(tables.session.select.userId, input.userId)))).pipe(Effect.mapError((cause) => storageError("session", operation, cause)), Effect.map((rows) => rows.map((row) => decodeSessionRow(tables, row))));
+const findVerificationById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectVerificationColumns(tables)).pipe(Query.from(tables.verification.table), Query.where(queryEq(tables.verification.select.id, id)))).pipe(Effect.mapError((cause) => storageError("verification", operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeVerificationRow(tables, rows[0]))));
+const findLoginApprovalReviewByApprovalChallengeId = (executor, tables, input, operation = "find") => executePlan(executor, Query.select(selectLoginApprovalReviewColumns(tables)).pipe(Query.from(tables.loginApprovalReview.table), Query.where(queryEq(tables.loginApprovalReview.select.approvalChallengeId, input.approvalChallengeId)))).pipe(Effect.mapError((cause) => loginApprovalReviewStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeLoginApprovalReviewRow(tables, rows[0]))));
+const findTrustedDevice = (executor, tables, input, operation = "status") => executePlan(executor, Query.select(selectTrustedDeviceColumns(tables)).pipe(Query.from(tables.trustedDevice.table), Query.where(queryEq(tables.trustedDevice.select.userId, input.userId)), Query.where(queryEq(tables.trustedDevice.select.tokenHash, input.tokenHash)), Query.where(queryGt(tables.trustedDevice.select.expiresAt, Number(input.now))))).pipe(Effect.mapError((cause) => trustedDeviceStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeTrustedDeviceRow(tables, rows[0]))));
+const findTrustedDeviceIncludingExpired = (executor, tables, input) => executePlan(executor, Query.select(selectTrustedDeviceColumns(tables)).pipe(Query.from(tables.trustedDevice.table), Query.where(queryEq(tables.trustedDevice.select.userId, input.userId)), Query.where(queryEq(tables.trustedDevice.select.tokenHash, input.tokenHash)))).pipe(Effect.mapError((cause) => trustedDeviceStoreError("trust", cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeTrustedDeviceRow(tables, rows[0]))));
+const listTrustedDevicesForUser = (executor, tables, input, operation = "list") => executePlan(executor, Query.select(selectTrustedDeviceColumns(tables)).pipe(Query.from(tables.trustedDevice.table), Query.where(queryEq(tables.trustedDevice.select.userId, input.userId)), Query.where(queryGt(tables.trustedDevice.select.expiresAt, Number(input.now))))).pipe(Effect.mapError((cause) => trustedDeviceStoreError(operation, cause)), Effect.map((rows) => filterTrustedDevicesForUser(rows.map((row) => decodeTrustedDeviceRow(tables, row)), input)));
+const findPasskeyCredentialByCredentialId = (executor, tables, credentialId, operation = "find") => executePlan(executor, Query.select(selectPasskeyCredentialColumns(tables)).pipe(Query.from(tables.passkeyCredential.table), Query.where(queryEq(tables.passkeyCredential.select.credentialId, credentialId)))).pipe(Effect.mapError((cause) => passkeyCredentialStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodePasskeyCredentialRow(tables, rows[0]))));
+const findTotpFactorById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectTotpFactorColumns(tables)).pipe(Query.from(tables.totpFactor.table), Query.where(queryEq(tables.totpFactor.select.id, id)))).pipe(Effect.mapError((cause) => totpFactorStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeTotpFactorRow(tables, rows[0]))));
+const findRecoveryCodeById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectRecoveryCodeColumns(tables)).pipe(Query.from(tables.recoveryCode.table), Query.where(queryEq(tables.recoveryCode.select.id, id)))).pipe(Effect.mapError((cause) => recoveryCodeStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeRecoveryCodeRow(tables, rows[0]))));
+const findApiKeyById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectApiKeyColumns(tables)).pipe(Query.from(tables.apiKey.table), Query.where(queryEq(tables.apiKey.select.id, id)))).pipe(Effect.mapError((cause) => apiKeyStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeApiKeyRow(tables, rows[0]))));
+const findApiKeyByPrefix = (executor, tables, prefix, operation = "find") => executePlan(executor, Query.select(selectApiKeyColumns(tables)).pipe(Query.from(tables.apiKey.table), Query.where(queryEq(tables.apiKey.select.prefix, prefix)))).pipe(Effect.mapError((cause) => apiKeyStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeApiKeyRow(tables, rows[0]))));
+const findRefreshTokenById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectRefreshTokenColumns(tables)).pipe(Query.from(tables.refreshToken.table), Query.where(queryEq(tables.refreshToken.select.id, id)))).pipe(Effect.mapError((cause) => refreshTokenStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeRefreshTokenRow(tables, rows[0]))));
+const findRefreshTokenBySecretHash = (executor, tables, hash, operation = "find") => executePlan(executor, Query.select(selectRefreshTokenColumns(tables)).pipe(Query.from(tables.refreshToken.table), Query.where(queryEq(tables.refreshToken.select.secretHash, hash)))).pipe(Effect.mapError((cause) => refreshTokenStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeRefreshTokenRow(tables, rows[0]))));
+const findOAuthAccountById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectOAuthAccountColumns(tables)).pipe(Query.from(tables.oauthAccount.table), Query.where(queryEq(tables.oauthAccount.select.id, id)))).pipe(Effect.mapError((cause) => oauthAccountStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeOAuthAccountRow(tables, rows[0]))));
+const findOAuthAccountByProviderAccount = (executor, tables, input, operation = "find") => {
+    const base = Query.select(selectOAuthAccountColumns(tables)).pipe(Query.from(tables.oauthAccount.table), Query.where(queryEq(tables.oauthAccount.select.providerId, input.providerId)), Query.where(queryEq(tables.oauthAccount.select.providerAccountId, input.providerAccountId)));
+    const query = input.includeUnlinked === true
+        ? base
+        : base.pipe(Query.where(queryIsNull(tables.oauthAccount.select.unlinkedAt)));
+    return executePlan(executor, query).pipe(Effect.mapError((cause) => oauthAccountStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+        ? Option.none()
+        : Option.some(decodeOAuthAccountRow(tables, rows[0]))));
+};
+const findOAuthProviderTokenVaultRecordByAccountId = (executor, tables, input, operation, includeRevoked = false) => {
+    const base = Query.select(selectOAuthProviderTokenVaultColumns(tables)).pipe(Query.from(tables.oauthProviderTokenVault.table), Query.where(queryEq(tables.oauthProviderTokenVault.select.accountId, input.accountId)));
+    const query = includeRevoked
+        ? base
+        : base.pipe(Query.where(queryIsNull(tables.oauthProviderTokenVault.select.revokedAt)));
+    return executePlan(executor, query).pipe(Effect.mapError((cause) => oauthProviderTokenVaultError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+        ? Option.none()
+        : Option.some(decodeOAuthProviderTokenVaultRow(tables, rows[0]))));
+};
+const listSecurityTimelineByUser = (executor, tables, input, operation = "list") => executePlan(executor, Query.select(selectSecurityTimelineColumns(tables)).pipe(Query.from(tables.securityTimeline.table), Query.where(queryEq(tables.securityTimeline.select.userId, input.userId)))).pipe(Effect.mapError((cause) => securityTimelineStoreError(operation, cause)), Effect.map((rows) => filterSecurityTimelineEvents(rows.map((row) => decodeSecurityTimelineEvent(tables, row)), input)));
+export const makeEffectQbSqliteUserStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return UserStore.make({
+        findById: (id) => findUserById(executor, tables, id),
+        findByEmail: (email) => findUserByEmail(executor, tables, email),
+        insert: (row) => executePlan(executor, queryInsert(tables.user.table, mutationValues(tables.user.insert(row)))).pipe(Effect.mapError((cause) => storageError("user", "insert", cause)), Effect.asVoid),
+        markEmailVerified: (input) => executePlan(executor, queryUpdate(tables.user.table, mutationValues(tables.user.markEmailVerified(input))).pipe(Query.where(queryEq(tables.user.select.id, input.userId)), Query.returning(selectUserColumns(tables)))).pipe(Effect.mapError((cause) => storageError("user", "markEmailVerified", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeUserRow(tables, rows[0])))),
+    });
+};
+export const makeEffectQbSqliteCredentialStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return CredentialStore.make({
+        findPasswordByUserId: (userId) => findPasswordCredentialByUserId(executor, tables, userId),
+        insertPassword: (row) => executePlan(executor, queryInsert(tables.credential.table, mutationValues(tables.credential.insertPassword(row)))).pipe(Effect.mapError((cause) => storageError("credential", "insert", cause)), Effect.asVoid),
+        updatePassword: (input) => executePlan(executor, queryUpdate(tables.credential.table, mutationValues(tables.credential.updatePassword(input))).pipe(Query.where(queryEq(tables.credential.select.userId, input.userId)), Query.where(queryEq(tables.credential.select.type, "password")), Query.where(queryIsNull(tables.credential.select.revokedAt)), Query.returning({ id: tables.credential.select.id }))).pipe(Effect.mapError((cause) => storageError("credential", "updatePassword", cause)), Effect.flatMap((rows) => rows[0] === undefined
+            ? Effect.succeed(Option.none())
+            : findPasswordCredentialByUserId(executor, tables, input.userId, "updatePassword"))),
+    });
+};
+export const makeEffectQbSqliteSessionStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return SessionStore.make({
+        findById: (id) => findSessionById(executor, tables, id),
+        listByUser: (input) => listSessionsByUser(executor, tables, input),
+        insert: (row) => executePlan(executor, queryInsert(tables.session.table, mutationValues(tables.session.insert(row)))).pipe(Effect.mapError((cause) => storageError("session", "insert", cause)), Effect.asVoid),
+        refresh: (input) => {
+            const query = queryUpdate(tables.session.table, mutationValues(tables.session.refresh(input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), Query.returning(selectSessionColumns(tables)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => storageError("session", "refresh", cause)), Effect.map((rows) => rows[0] === undefined
+                ? Option.none()
+                : Option.some(decodeSessionRow(tables, rows[0]))));
+        },
+        rotate: (input) => {
+            const query = queryUpdate(tables.session.table, mutationValues(tables.session.rotate(input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), Query.returning(selectSessionColumns(tables)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => storageError("session", "rotate", cause)), Effect.map((rows) => rows[0] === undefined
+                ? Option.none()
+                : Option.some(decodeSessionRow(tables, rows[0]))));
+        },
+        updateClaims: (input) => findSessionById(executor, tables, input.sessionId, "updateClaims").pipe(Effect.flatMap((rowOption) => {
+            if (Option.isNone(rowOption)) {
+                return Effect.succeed(Option.none());
+            }
+            return executePlan(executor, queryUpdate(tables.session.table, mutationValues(tables.session.updateClaims(rowOption.value, input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), Query.returning(selectSessionColumns(tables)))).pipe(Effect.mapError((cause) => storageError("session", "updateClaims", cause)), Effect.map((rows) => rows[0] === undefined
+                ? Option.none()
+                : Option.some(decodeSessionRow(tables, rows[0]))));
+        })),
+        revoke: (input) => executePlan(executor, queryUpdate(tables.session.table, mutationValues(tables.session.revoke(input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)))).pipe(Effect.mapError((cause) => storageError("session", "revoke", cause)), Effect.asVoid),
+        revokeAllForUser: (input) => executePlan(executor, queryUpdate(tables.session.table, mutationValues(tables.session.revoke(input))).pipe(Query.where(queryEq(tables.session.select.userId, input.userId)))).pipe(Effect.mapError((cause) => storageError("session", "revokeAllForUser", cause)), Effect.asVoid),
+    });
+};
+export const makeEffectQbSqliteVerificationStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return VerificationStore.make({
+        findById: (id) => findVerificationById(executor, tables, id),
+        insert: (row) => executePlan(executor, queryInsert(tables.verification.table, mutationValues(tables.verification.insert(row)))).pipe(Effect.mapError((cause) => storageError("verification", "insert", cause)), Effect.asVoid),
+        consume: (input) => {
+            const base = queryUpdate(tables.verification.table, mutationValues(tables.verification.consume(input))).pipe(Query.where(queryEq(tables.verification.select.id, input.id)), Query.where(queryIsNull(tables.verification.select.consumedAt)), Query.where(queryGt(tables.verification.select.expiresAt, Number(input.consumedAt))));
+            const plan = input.type === undefined
+                ? base
+                : base.pipe(Query.where(queryEq(tables.verification.select.type, input.type)));
+            return executePlan(executor, plan.pipe(Query.returning({ id: tables.verification.select.id }))).pipe(Effect.mapError((cause) => storageError("verification", "consume", cause)), Effect.flatMap((rows) => rows[0] === undefined
+                ? Effect.succeed(Option.none())
+                : findVerificationById(executor, tables, input.id, "consume")));
+        },
+        deleteExpired: (input) => {
+            if (input.limit === undefined) {
+                return executePlan(executor, Query.delete(tables.verification.table).pipe(Query.where(queryLte(tables.verification.select.expiresAt, Number(input.now))), Query.returning({ id: tables.verification.select.id }))).pipe(Effect.mapError((cause) => storageError("verification", "deleteExpired", cause)), Effect.map((rows) => rows.length));
+            }
+            return executePlan(executor, Query.select({ id: tables.verification.select.id }).pipe(Query.from(tables.verification.table), Query.where(queryLte(tables.verification.select.expiresAt, Number(input.now))), Query.limit(input.limit))).pipe(Effect.mapError((cause) => storageError("verification", "deleteExpired", cause)), Effect.flatMap((rows) => {
+                const [first, ...rest] = rows.map((row) => row.id);
+                if (first === undefined) {
+                    return Effect.succeed(0);
+                }
+                return executePlan(executor, Query.delete(tables.verification.table).pipe(Query.where(queryIn(tables.verification.select.id, first, ...rest)), Query.returning({ id: tables.verification.select.id }))).pipe(Effect.mapError((cause) => storageError("verification", "deleteExpired", cause)), Effect.map((deleted) => deleted.length));
+            }));
+        },
+    });
+};
+export const makeEffectQbSqliteLoginApprovalReviewStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return LoginApprovalReviewStore.make({
+        insertPending: (input) => executePlan(executor, queryInsert(tables.loginApprovalReview.table, mutationValues(tables.loginApprovalReview.insertPending(input)))).pipe(Effect.mapError((cause) => loginApprovalReviewStoreError("insert", cause)), Effect.as(input)),
+        findByApprovalChallengeId: (input) => findLoginApprovalReviewByApprovalChallengeId(executor, tables, input),
+        approve: (input) => executePlan(executor, queryUpdate(tables.loginApprovalReview.table, mutationValues(tables.loginApprovalReview.approve(input))).pipe(Query.where(queryEq(tables.loginApprovalReview.select.approvalChallengeId, input.approvalChallengeId)), Query.where(queryEq(tables.loginApprovalReview.select.status, "pending")), Query.returning(selectLoginApprovalReviewColumns(tables)))).pipe(Effect.mapError((cause) => loginApprovalReviewStoreError("approve", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeLoginApprovalReviewRow(tables, rows[0])))),
+        deny: (input) => executePlan(executor, queryUpdate(tables.loginApprovalReview.table, mutationValues(tables.loginApprovalReview.deny(input))).pipe(Query.where(queryEq(tables.loginApprovalReview.select.approvalChallengeId, input.approvalChallengeId)), Query.where(queryEq(tables.loginApprovalReview.select.status, "pending")), Query.returning(selectLoginApprovalReviewColumns(tables)))).pipe(Effect.mapError((cause) => loginApprovalReviewStoreError("deny", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeLoginApprovalReviewRow(tables, rows[0])))),
+    });
+};
+export const makeEffectQbSqliteTrustedDeviceStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return TrustedDeviceStore.make({
+        find: (input) => findTrustedDevice(executor, tables, input),
+        listForUser: (input) => listTrustedDevicesForUser(executor, tables, input),
+        revokeForUser: (input) => executePlan(executor, Query.delete(tables.trustedDevice.table).pipe(Query.where(queryEq(tables.trustedDevice.select.userId, input.userId)), Query.where(queryEq(tables.trustedDevice.select.tokenHash, input.tokenHash)))).pipe(Effect.mapError((cause) => trustedDeviceStoreError("revoke", cause)), Effect.asVoid),
+        upsert: (input) => findTrustedDeviceIncludingExpired(executor, tables, input).pipe(Effect.flatMap((existing) => {
+            if (Option.isNone(existing)) {
+                return executePlan(executor, queryInsert(tables.trustedDevice.table, mutationValues(tables.trustedDevice.insert(input, input.now)))).pipe(Effect.mapError((cause) => trustedDeviceStoreError("trust", cause)), Effect.asVoid);
+            }
+            return executePlan(executor, queryUpdate(tables.trustedDevice.table, mutationValues(tables.trustedDevice.update(input, existing.value))).pipe(Query.where(queryEq(tables.trustedDevice.select.userId, input.userId)), Query.where(queryEq(tables.trustedDevice.select.tokenHash, input.tokenHash)))).pipe(Effect.mapError((cause) => trustedDeviceStoreError("trust", cause)), Effect.asVoid);
+        }), Effect.flatMap(() => findTrustedDeviceIncludingExpired(executor, tables, input)), Effect.flatMap((stored) => Option.isSome(stored)
+            ? Effect.succeed(stored.value)
+            : Effect.fail(trustedDeviceStoreError("trust", "missing row")))),
+    });
+};
+export const makeEffectQbSqlitePasskeyCredentialStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return PasskeyCredentialStore.make({
+        insert: (row) => executePlan(executor, queryInsert(tables.passkeyCredential.table, mutationValues(tables.passkeyCredential.insert(row)))).pipe(Effect.mapError((cause) => passkeyCredentialStoreError("insert", cause)), Effect.asVoid),
+        findByCredentialId: (credentialId) => findPasskeyCredentialByCredentialId(executor, tables, credentialId),
+        listByUser: (input) => {
+            const base = Query.select(selectPasskeyCredentialColumns(tables)).pipe(Query.from(tables.passkeyCredential.table), Query.where(queryEq(tables.passkeyCredential.select.userId, input.userId)));
+            const query = input.includeRevoked === true
+                ? base
+                : base.pipe(Query.where(queryIsNull(tables.passkeyCredential.select.revokedAt)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => passkeyCredentialStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodePasskeyCredentialRow(tables, row))));
+        },
+        updateSignCount: (input) => executePlan(executor, queryUpdate(tables.passkeyCredential.table, mutationValues(tables.passkeyCredential.updateSignCount(input))).pipe(Query.where(queryEq(tables.passkeyCredential.select.credentialId, input.credentialId)), Query.where(queryIsNull(tables.passkeyCredential.select.revokedAt)), Query.returning(selectPasskeyCredentialColumns(tables)))).pipe(Effect.mapError((cause) => passkeyCredentialStoreError("update-sign-count", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodePasskeyCredentialRow(tables, rows[0])))),
+        revoke: (input) => findPasskeyCredentialByCredentialId(executor, tables, input.credentialId, "revoke").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.void;
+            }
+            return executePlan(executor, queryUpdate(tables.passkeyCredential.table, mutationValues(tables.passkeyCredential.revoke(input, row.value))).pipe(Query.where(queryEq(tables.passkeyCredential.select.credentialId, input.credentialId)))).pipe(Effect.mapError((cause) => passkeyCredentialStoreError("revoke", cause)), Effect.asVoid);
+        })),
+    });
+};
+export const makeEffectQbSqliteTotpFactorStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return TotpFactorStore.make({
+        insert: (row) => executePlan(executor, queryInsert(tables.totpFactor.table, mutationValues(tables.totpFactor.insert(row)))).pipe(Effect.mapError((cause) => totpFactorStoreError("insert", cause)), Effect.asVoid),
+        findById: (id) => findTotpFactorById(executor, tables, id),
+        listByUser: (input) => {
+            const byUser = Query.select(selectTotpFactorColumns(tables)).pipe(Query.from(tables.totpFactor.table), Query.where(queryEq(tables.totpFactor.select.userId, input.userId)));
+            const byRevoked = input.includeRevoked === true
+                ? byUser
+                : byUser.pipe(Query.where(queryIsNull(tables.totpFactor.select.revokedAt)));
+            const query = input.includeUnconfirmed === true
+                ? byRevoked
+                : byRevoked.pipe(Query.where(queryGt(tables.totpFactor.select.confirmedAt, 0)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => totpFactorStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeTotpFactorRow(tables, row))));
+        },
+        confirm: (input) => executePlan(executor, queryUpdate(tables.totpFactor.table, mutationValues(tables.totpFactor.confirm(input))).pipe(Query.where(queryEq(tables.totpFactor.select.id, input.id)), Query.where(queryIsNull(tables.totpFactor.select.revokedAt)), Query.returning(selectTotpFactorColumns(tables)))).pipe(Effect.mapError((cause) => totpFactorStoreError("confirm", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeTotpFactorRow(tables, rows[0])))),
+        markUsed: (input) => executePlan(executor, queryUpdate(tables.totpFactor.table, mutationValues(tables.totpFactor.markUsed(input))).pipe(Query.where(queryEq(tables.totpFactor.select.id, input.id)), Query.where(queryIsNull(tables.totpFactor.select.revokedAt)), Query.where(queryGt(tables.totpFactor.select.confirmedAt, 0)), Query.returning(selectTotpFactorColumns(tables)))).pipe(Effect.mapError((cause) => totpFactorStoreError("mark-used", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeTotpFactorRow(tables, rows[0])))),
+        revoke: (input) => findTotpFactorById(executor, tables, input.id, "revoke").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.void;
+            }
+            return executePlan(executor, queryUpdate(tables.totpFactor.table, mutationValues(tables.totpFactor.revoke(input, row.value))).pipe(Query.where(queryEq(tables.totpFactor.select.id, input.id)))).pipe(Effect.mapError((cause) => totpFactorStoreError("revoke", cause)), Effect.asVoid);
+        })),
+    });
+};
+export const makeEffectQbSqliteRecoveryCodeStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return RecoveryCodeStore.make({
+        insertMany: (rows) => Effect.forEach(rows, (row) => executePlan(executor, queryInsert(tables.recoveryCode.table, mutationValues(tables.recoveryCode.insert(row)))).pipe(Effect.mapError((cause) => recoveryCodeStoreError("insert", cause)), Effect.asVoid), { discard: true }),
+        findById: (id) => findRecoveryCodeById(executor, tables, id),
+        listByUser: (input) => {
+            const byUser = Query.select(selectRecoveryCodeColumns(tables)).pipe(Query.from(tables.recoveryCode.table), Query.where(queryEq(tables.recoveryCode.select.userId, input.userId)));
+            const byUsed = input.includeUsed === true
+                ? byUser
+                : byUser.pipe(Query.where(queryIsNull(tables.recoveryCode.select.usedAt)));
+            const query = input.includeRevoked === true
+                ? byUsed
+                : byUsed.pipe(Query.where(queryIsNull(tables.recoveryCode.select.revokedAt)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => recoveryCodeStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeRecoveryCodeRow(tables, row))));
+        },
+        markUsed: (input) => executePlan(executor, queryUpdate(tables.recoveryCode.table, mutationValues(tables.recoveryCode.markUsed(input))).pipe(Query.where(queryEq(tables.recoveryCode.select.id, input.id)), Query.where(queryIsNull(tables.recoveryCode.select.usedAt)), Query.where(queryIsNull(tables.recoveryCode.select.revokedAt)), Query.returning({ id: tables.recoveryCode.select.id }))).pipe(Effect.mapError((cause) => recoveryCodeStoreError("mark-used", cause)), Effect.flatMap((rows) => rows[0] === undefined
+            ? Effect.succeed(Option.none())
+            : findRecoveryCodeById(executor, tables, input.id, "mark-used"))),
+        revoke: (input) => findRecoveryCodeById(executor, tables, input.id, "revoke").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.void;
+            }
+            return executePlan(executor, queryUpdate(tables.recoveryCode.table, mutationValues(tables.recoveryCode.revoke(input, row.value))).pipe(Query.where(queryEq(tables.recoveryCode.select.id, input.id)))).pipe(Effect.mapError((cause) => recoveryCodeStoreError("revoke", cause)), Effect.asVoid);
+        })),
+    });
+};
+export const makeEffectQbSqliteApiKeyStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return ApiKeyStore.make({
+        insert: (row) => executePlan(executor, queryInsert(tables.apiKey.table, mutationValues(tables.apiKey.insert(row)))).pipe(Effect.mapError((cause) => apiKeyStoreError("insert", cause)), Effect.asVoid),
+        findById: (id) => findApiKeyById(executor, tables, id),
+        findByPrefix: (prefix) => findApiKeyByPrefix(executor, tables, prefix),
+        listByUser: (input) => {
+            const base = Query.select(selectApiKeyColumns(tables)).pipe(Query.from(tables.apiKey.table), Query.where(queryEq(tables.apiKey.select.userId, input.userId)));
+            const query = input.includeRevoked === true
+                ? base
+                : base.pipe(Query.where(queryIsNull(tables.apiKey.select.revokedAt)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => apiKeyStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeApiKeyRow(tables, row))));
+        },
+        markUsed: (input) => executePlan(executor, queryUpdate(tables.apiKey.table, mutationValues(tables.apiKey.markUsed(input))).pipe(Query.where(queryEq(tables.apiKey.select.id, input.id)), Query.where(queryIsNull(tables.apiKey.select.revokedAt)), Query.returning(selectApiKeyColumns(tables)))).pipe(Effect.mapError((cause) => apiKeyStoreError("mark-used", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeApiKeyRow(tables, rows[0])))),
+        revoke: (input) => findApiKeyById(executor, tables, input.id, "revoke").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.void;
+            }
+            return executePlan(executor, queryUpdate(tables.apiKey.table, mutationValues(tables.apiKey.revoke(input, row.value))).pipe(Query.where(queryEq(tables.apiKey.select.id, input.id)))).pipe(Effect.mapError((cause) => apiKeyStoreError("revoke", cause)), Effect.asVoid);
+        })),
+    });
+};
+export const makeEffectQbSqliteRefreshTokenStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return RefreshTokenStore.make({
+        insert: (row) => executePlan(executor, queryInsert(tables.refreshToken.table, mutationValues(tables.refreshToken.insert(row)))).pipe(Effect.mapError((cause) => refreshTokenStoreError("insert", cause)), Effect.asVoid),
+        findById: (id) => findRefreshTokenById(executor, tables, id),
+        findBySecretHash: (hash) => findRefreshTokenBySecretHash(executor, tables, hash),
+        listByUser: (input) => {
+            const base = Query.select(selectRefreshTokenColumns(tables)).pipe(Query.from(tables.refreshToken.table), Query.where(queryEq(tables.refreshToken.select.userId, input.userId)));
+            const query = input.includeRevoked === true
+                ? base
+                : base.pipe(Query.where(queryIsNull(tables.refreshToken.select.revokedAt)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => refreshTokenStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeRefreshTokenRow(tables, row))));
+        },
+        listByFamily: (input) => {
+            const base = Query.select(selectRefreshTokenColumns(tables)).pipe(Query.from(tables.refreshToken.table), Query.where(queryEq(tables.refreshToken.select.familyId, input.familyId)));
+            const query = input.includeRevoked === true
+                ? base
+                : base.pipe(Query.where(queryIsNull(tables.refreshToken.select.revokedAt)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => refreshTokenStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeRefreshTokenRow(tables, row))));
+        },
+        rotate: (input) => executePlan(executor, queryUpdate(tables.refreshToken.table, mutationValues(tables.refreshToken.rotate(input))).pipe(Query.where(queryEq(tables.refreshToken.select.id, input.id)), Query.where(queryIsNull(tables.refreshToken.select.rotatedAt)), Query.where(queryIsNull(tables.refreshToken.select.revokedAt)), Query.returning({ id: tables.refreshToken.select.id }))).pipe(Effect.mapError((cause) => refreshTokenStoreError("rotate", cause)), Effect.flatMap((rows) => {
+            const [updated] = rows;
+            if (updated === undefined) {
+                return Effect.succeed(Option.none());
+            }
+            return findRefreshTokenById(executor, tables, RefreshTokenId(updated.id), "rotate").pipe(Effect.flatMap((previous) => {
+                if (Option.isNone(previous)) {
+                    return Effect.succeed(Option.none());
+                }
+                return executePlan(executor, queryInsert(tables.refreshToken.table, mutationValues(tables.refreshToken.insert(input.replacement)))).pipe(Effect.mapError((cause) => refreshTokenStoreError("rotate", cause)), Effect.as(Option.some({
+                    previous: previous.value,
+                    replacement: input.replacement,
+                })));
+            }));
+        })),
+        markReuseDetected: (input) => executePlan(executor, queryUpdate(tables.refreshToken.table, mutationValues(tables.refreshToken.markReuseDetected(input))).pipe(Query.where(queryEq(tables.refreshToken.select.id, input.id)), Query.returning(selectRefreshTokenColumns(tables)))).pipe(Effect.mapError((cause) => refreshTokenStoreError("reuse", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeRefreshTokenRow(tables, rows[0])))),
+        revoke: (input) => findRefreshTokenById(executor, tables, input.id, "revoke").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.void;
+            }
+            return executePlan(executor, queryUpdate(tables.refreshToken.table, mutationValues(tables.refreshToken.revoke(input, row.value))).pipe(Query.where(queryEq(tables.refreshToken.select.id, input.id)))).pipe(Effect.mapError((cause) => refreshTokenStoreError("revoke", cause)), Effect.asVoid);
+        })),
+        revokeFamily: (input) => executePlan(executor, Query.select(selectRefreshTokenColumns(tables)).pipe(Query.from(tables.refreshToken.table), Query.where(queryEq(tables.refreshToken.select.familyId, input.familyId)))).pipe(Effect.mapError((cause) => refreshTokenStoreError("revoke", cause)), Effect.flatMap((rows) => Effect.forEach(rows.map((row) => decodeRefreshTokenRow(tables, row)), (row) => executePlan(executor, queryUpdate(tables.refreshToken.table, mutationValues(tables.refreshToken.revokeFamily(input, row))).pipe(Query.where(queryEq(tables.refreshToken.select.id, row.id)))).pipe(Effect.mapError((cause) => refreshTokenStoreError("revoke", cause)), Effect.asVoid), { discard: true }))),
+    });
+};
+export const makeEffectQbSqliteJwtRevocationStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return JwtRevocationStore.make({
+        revoke: (record) => findJwtRevocation(executor, tables, record.jwtId, "revoke").pipe(Effect.flatMap((existing) => {
+            if (Option.isNone(existing)) {
+                return executePlan(executor, queryInsert(tables.jwtRevocation.table, mutationValues(tables.jwtRevocation.insert(record))));
+            }
+            return executePlan(executor, queryUpdate(tables.jwtRevocation.table, mutationValues(tables.jwtRevocation.update(record))).pipe(Query.where(queryEq(tables.jwtRevocation.select.jwtId, record.jwtId))));
+        }), Effect.mapError((cause) => cause instanceof JwtError
+            ? cause
+            : jwtRevocationStoreError("revoke", cause)), Effect.asVoid),
+        find: (jwtId) => findJwtRevocation(executor, tables, jwtId),
+    });
+};
+export const makeEffectQbSqliteOAuthAccountStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return OAuthAccountStore.make({
+        insert: (row) => executePlan(executor, queryInsert(tables.oauthAccount.table, mutationValues(tables.oauthAccount.insert(row)))).pipe(Effect.mapError((cause) => oauthAccountStoreError("insert", cause)), Effect.asVoid),
+        findById: (id) => findOAuthAccountById(executor, tables, id),
+        findByProviderAccount: (input) => findOAuthAccountByProviderAccount(executor, tables, input),
+        listByUser: (input) => {
+            const base = Query.select(selectOAuthAccountColumns(tables)).pipe(Query.from(tables.oauthAccount.table), Query.where(queryEq(tables.oauthAccount.select.userId, input.userId)));
+            const query = input.includeUnlinked === true
+                ? base
+                : base.pipe(Query.where(queryIsNull(tables.oauthAccount.select.unlinkedAt)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => oauthAccountStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeOAuthAccountRow(tables, row))));
+        },
+        unlink: (input) => findOAuthAccountByProviderAccount(executor, tables, {
+            providerId: input.providerId,
+            providerAccountId: input.providerAccountId,
+        }, "unlink").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.succeed(Option.none());
+            }
+            return executePlan(executor, queryUpdate(tables.oauthAccount.table, mutationValues(tables.oauthAccount.unlink(input, row.value))).pipe(Query.where(queryEq(tables.oauthAccount.select.id, row.value.id)), Query.returning(selectOAuthAccountColumns(tables)))).pipe(Effect.mapError((cause) => oauthAccountStoreError("unlink", cause)), Effect.map((rows) => rows[0] === undefined
+                ? Option.none()
+                : Option.some(decodeOAuthAccountRow(tables, rows[0]))));
+        })),
+    });
+};
+export const makeEffectQbSqliteOAuthProviderTokenVault = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return OAuthProviderTokenVault.make({
+        upsert: (record) => findOAuthProviderTokenVaultRecordByAccountId(executor, tables, { accountId: record.accountId }, "upsert", true).pipe(Effect.flatMap((existing) => Option.isNone(existing)
+            ? executePlan(executor, queryInsert(tables.oauthProviderTokenVault.table, mutationValues(tables.oauthProviderTokenVault.insert(record))))
+            : executePlan(executor, queryUpdate(tables.oauthProviderTokenVault.table, mutationValues(tables.oauthProviderTokenVault.update(record))).pipe(Query.where(queryEq(tables.oauthProviderTokenVault.select.accountId, record.accountId))))), Effect.mapError((cause) => cause instanceof OAuthProviderTokenVaultError
+            ? cause
+            : oauthProviderTokenVaultError("upsert", cause)), Effect.asVoid),
+        refreshTokenForAccount: (input) => findOAuthProviderTokenVaultRecordByAccountId(executor, tables, input, "refresh-token").pipe(Effect.map((row) => Option.isNone(row) || row.value.refreshTokenCiphertext === undefined
+            ? Option.none()
+            : Option.some(row.value.refreshTokenCiphertext))),
+        tokensForAccount: (input) => findOAuthProviderTokenVaultRecordByAccountId(executor, tables, input, "tokens").pipe(Effect.map((row) => Option.isNone(row)
+            ? Option.none()
+            : Option.some(providerTokenVaultTokens(row.value)))),
+        markRevoked: (input) => executePlan(executor, queryUpdate(tables.oauthProviderTokenVault.table, mutationValues(tables.oauthProviderTokenVault.markRevoked(input))).pipe(Query.where(queryEq(tables.oauthProviderTokenVault.select.accountId, input.accountId)), Query.returning({
+            accountId: tables.oauthProviderTokenVault.select.accountId,
+        }))).pipe(Effect.mapError((cause) => oauthProviderTokenVaultError("mark-revoked", cause)), Effect.flatMap((rows) => {
+            const [updated] = rows;
+            if (updated === undefined) {
+                return Effect.succeed(Option.none());
+            }
+            return findOAuthProviderTokenVaultRecordByAccountId(executor, tables, { accountId: OAuthAccountId(updated.accountId) }, "mark-revoked", true);
+        })),
+    });
+};
+export const makeEffectQbSqliteSecurityTimelineStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return SecurityTimelineStore.make({
+        insert: (event) => executePlan(executor, queryInsert(tables.securityTimeline.table, mutationValues(tables.securityTimeline.insert(event)))).pipe(Effect.mapError((cause) => securityTimelineStoreError("insert", cause)), Effect.asVoid),
+        listByUser: (input) => listSecurityTimelineByUser(executor, tables, input),
+    });
+};
+export const makeEffectQbSqliteStorage = (executor, options = {}) => ({
+    userStore: makeEffectQbSqliteUserStore(executor, options),
+    credentialStore: makeEffectQbSqliteCredentialStore(executor, options),
+    sessionStore: makeEffectQbSqliteSessionStore(executor, options),
+    verificationStore: makeEffectQbSqliteVerificationStore(executor, options),
+    loginApprovalReviewStore: makeEffectQbSqliteLoginApprovalReviewStore(executor, options),
+    trustedDeviceStore: makeEffectQbSqliteTrustedDeviceStore(executor, options),
+    passkeyCredentialStore: makeEffectQbSqlitePasskeyCredentialStore(executor, options),
+    totpFactorStore: makeEffectQbSqliteTotpFactorStore(executor, options),
+    recoveryCodeStore: makeEffectQbSqliteRecoveryCodeStore(executor, options),
+    apiKeyStore: makeEffectQbSqliteApiKeyStore(executor, options),
+    refreshTokenStore: makeEffectQbSqliteRefreshTokenStore(executor, options),
+    jwtRevocationStore: makeEffectQbSqliteJwtRevocationStore(executor, options),
+    oauthAccountStore: makeEffectQbSqliteOAuthAccountStore(executor, options),
+    oauthProviderTokenVault: makeEffectQbSqliteOAuthProviderTokenVault(executor, options),
+    securityTimelineStore: makeEffectQbSqliteSecurityTimelineStore(executor, options),
+});
+export const EffectQbSqliteAuthStorageLive = (executor, options = {}) => Layer.mergeAll(Layer.succeed(UserStore)(makeEffectQbSqliteUserStore(executor, options)), Layer.succeed(CredentialStore)(makeEffectQbSqliteCredentialStore(executor, options)), Layer.succeed(SessionStore)(makeEffectQbSqliteSessionStore(executor, options)), Layer.succeed(VerificationStore)(makeEffectQbSqliteVerificationStore(executor, options)), Layer.succeed(LoginApprovalReviewStore)(makeEffectQbSqliteLoginApprovalReviewStore(executor, options)), Layer.succeed(TrustedDeviceStore)(makeEffectQbSqliteTrustedDeviceStore(executor, options)), Layer.succeed(PasskeyCredentialStore)(makeEffectQbSqlitePasskeyCredentialStore(executor, options)), Layer.succeed(TotpFactorStore)(makeEffectQbSqliteTotpFactorStore(executor, options)), Layer.succeed(RecoveryCodeStore)(makeEffectQbSqliteRecoveryCodeStore(executor, options)), Layer.succeed(ApiKeyStore)(makeEffectQbSqliteApiKeyStore(executor, options)), Layer.succeed(RefreshTokenStore)(makeEffectQbSqliteRefreshTokenStore(executor, options)), Layer.succeed(JwtRevocationStore)(makeEffectQbSqliteJwtRevocationStore(executor, options)), Layer.succeed(OAuthAccountStore)(makeEffectQbSqliteOAuthAccountStore(executor, options)), Layer.succeed(OAuthProviderTokenVault)(makeEffectQbSqliteOAuthProviderTokenVault(executor, options)), Layer.succeed(SecurityTimelineStore)(makeEffectQbSqliteSecurityTimelineStore(executor, options)));
+export const makeD1EffectQbSqliteExecutor = (database) => Executor.make({
+    driver: Executor.driver((query) => Effect.tryPromise({
+        try: () => database
+            .prepare(query.sql)
+            .bind(...query.params)
+            .all(),
+        catch: (cause) => new D1EffectQbError({ message: "D1 query failed", cause }),
+    }).pipe(Effect.flatMap((result) => {
+        if (result.success === false || result.error !== undefined) {
+            return Effect.fail(new D1EffectQbError({
+                message: result.error ?? "D1 query failed",
+            }));
+        }
+        return Effect.succeed([...(result.results ?? [])]);
+    }))),
+});
+export const D1EffectQbSqliteAuthStorageLive = (database, options = {}) => EffectQbSqliteAuthStorageLive(makeD1EffectQbSqliteExecutor(database), options);
+//# sourceMappingURL=EffectQbSqliteStorage.js.map