@effect-auth/core 0.1.0-alpha.1 → 0.1.0-alpha.13

package/dist/EffectQbSqliteStorage.js

@@ -0,0 +1,2824 @@
+import { Data, Effect, Layer, Option, Redacted } from "effect";
+import { Column, Executor, Query, Scalar, Table } from "effect-qb/sqlite";
+import { AuditLogStore, AuditLogStoreError, auditEventActorUserId, auditEventUserId, filterAuditLogEvents, } from "./AuditLog.js";
+import { ApiKeyId, ApiKeyPrefix, ApiKeySecretHash, ApiKeyStore, ApiKeyStoreError, } from "./ApiKey.js";
+import { DomainName, DomainVerificationId, DomainVerificationProofToken, DomainVerificationStore, DomainVerificationStoreError, } from "./DomainVerification.js";
+import { AuthFlowId, ChallengeId, CredentialId, Email, OAuthAccountId, OAuthClientId, OAuthProviderId, SessionId, UnixMillis, UserId, } from "./Identifiers.js";
+import { currentUnixMillis } from "./Internal.js";
+import { JwtError, JwtRevocationStore } from "./Jwt.js";
+import { LoginApprovalReviewError, LoginApprovalReviewStore, } from "./LoginApproval.js";
+import { LoginRiskContext, LoginRiskHistory, LoginRiskHistoryError, LoginRiskSignal, maxLoginRiskLevel, } from "./LoginRisk.js";
+import { OAuthAccountStore, OAuthAccountStoreError, OAuthAuthorizationCodeStore, OAuthAuthorizationCodeStoreError, OAuthClientStore, OAuthClientStoreError, OAuthConsentStore, OAuthConsentStoreError, OAuthClientSecretHash, OAuthClientSecretPrefix, OAuthClientSecretStore, OAuthClientSecretStoreError, OAuthCodeChallenge, OAuthProviderModeTokenStore, OAuthProviderModeTokenStoreError, OAuthProviderTokenVault, OAuthProviderTokenVaultError, } from "./OAuth.js";
+import { PasskeyCredentialId, PasskeyCredentialStore, PasskeyCredentialStoreError, } from "./Passkey.js";
+import { RecoveryCodeHash, RecoveryCodeStore, RecoveryCodeStoreError, } from "./RecoveryCode.js";
+import { RefreshTokenFamilyId, RefreshTokenId, RefreshTokenSecretHash, RefreshTokenStore, RefreshTokenStoreError, } from "./RefreshToken.js";
+import { filterSecurityTimelineEvents, SecurityTimelineEventId, SecurityTimelineStore, SecurityTimelineStoreError, } from "./SecurityTimeline.js";
+import { CredentialStore, SessionStore, StorageError, UserStore, VerificationStore, } from "./Storage.js";
+import { TotpFactorStore, TotpFactorStoreError, TotpSecret, } from "./Totp.js";
+import { filterTrustedDevicesForUser, TrustedDeviceError, TrustedDeviceStore, } from "./TrustedDevice.js";
+import { filterDueWebhookOutboxRecords, WebhookOutboxItemId, WebhookOutboxStore, WebhookOutboxStoreError, WebhookReplayStore, WebhookReplayStoreError, } from "./Webhook.js";
+export class D1EffectQbError extends Data.TaggedError("D1EffectQbError") {
+}
+const makeAuthUserTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    email: Column.text(),
+    email_verified: Column.int(),
+    created_at: Column.int(),
+    updated_at: Column.int(),
+    disabled_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthCredentialTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    type: Column.text(),
+    password_hash: Column.text().pipe(Column.nullable),
+    created_at: Column.int(),
+    updated_at: Column.int(),
+    revoked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthSessionTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    secret_hash: Column.text(),
+    created_at: Column.int(),
+    expires_at: Column.int(),
+    auth_time: Column.int(),
+    aal: Column.text(),
+    amr: Column.text(),
+    mfa_verified_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    last_seen_at: Column.int().pipe(Column.nullable),
+    rotated_at: Column.int().pipe(Column.nullable),
+});
+const makeAuthVerificationTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    type: Column.text(),
+    subject: Column.text(),
+    secret_hash: Column.text().pipe(Column.nullable),
+    created_at: Column.int(),
+    expires_at: Column.int(),
+    metadata: Column.text().pipe(Column.nullable),
+    consumed_at: Column.int().pipe(Column.nullable),
+});
+const makeAuthAuditLogTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.nullable),
+    type: Column.text(),
+    user_id: Column.text().pipe(Column.nullable),
+    actor_user_id: Column.text().pipe(Column.nullable),
+    occurred_at: Column.int(),
+    request_ip_hash: Column.text().pipe(Column.nullable),
+    request_user_agent_hash: Column.text().pipe(Column.nullable),
+    event: Column.text(),
+    created_at: Column.int(),
+});
+const makeAuthLoginApprovalReviewTable = (name) => Table.make(name, {
+    approval_challenge_id: Column.text().pipe(Column.primaryKey),
+    flow_id: Column.text(),
+    user_id: Column.text(),
+    channel: Column.text(),
+    reason: Column.text(),
+    session_binding: Column.text(),
+    same_device_required: Column.int(),
+    status: Column.text(),
+    created_at: Column.int(),
+    expires_at: Column.int(),
+    reviewed_at: Column.int().pipe(Column.nullable),
+    reviewed_by: Column.text().pipe(Column.nullable),
+    denied_reason: Column.text().pipe(Column.nullable),
+    risk: Column.text().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+    review_metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthLoginRiskHistoryTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    occurred_at: Column.int(),
+    outcome: Column.text(),
+    method: Column.text(),
+    amr: Column.text(),
+    aal: Column.text(),
+    device_status: Column.text(),
+    device_key: Column.text().pipe(Column.nullable),
+    location_key: Column.text().pipe(Column.nullable),
+    country: Column.text().pipe(Column.nullable),
+    region: Column.text().pipe(Column.nullable),
+    latitude_micro: Column.int().pipe(Column.nullable),
+    longitude_micro: Column.int().pipe(Column.nullable),
+    risk_level: Column.text().pipe(Column.nullable),
+    created_at: Column.int(),
+});
+const makeAuthTrustedDeviceTable = (name) => Table.make(name, {
+    user_id: Column.text(),
+    token_hash: Column.text(),
+    created_at: Column.int(),
+    last_seen_at: Column.int(),
+    expires_at: Column.int(),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthPasskeyCredentialTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    credential_id: Column.text(),
+    public_key: Column.text(),
+    sign_count: Column.int(),
+    transports: Column.text().pipe(Column.nullable),
+    backed_up: Column.int().pipe(Column.nullable),
+    created_at: Column.int(),
+    last_used_at: Column.int().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthTotpFactorTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    secret: Column.text(),
+    algorithm: Column.text(),
+    digits: Column.int(),
+    period: Column.int(),
+    created_at: Column.int(),
+    confirmed_at: Column.int().pipe(Column.nullable),
+    last_used_at: Column.int().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthRecoveryCodeTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    code_hash: Column.text(),
+    created_at: Column.int(),
+    used_at: Column.int().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthApiKeyTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    prefix: Column.text(),
+    secret_hash: Column.text(),
+    scopes: Column.text(),
+    created_at: Column.int(),
+    expires_at: Column.int().pipe(Column.nullable),
+    last_used_at: Column.int().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthRefreshTokenTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    family_id: Column.text(),
+    user_id: Column.text(),
+    secret_hash: Column.text(),
+    created_at: Column.int(),
+    expires_at: Column.int(),
+    last_used_at: Column.int().pipe(Column.nullable),
+    rotated_at: Column.int().pipe(Column.nullable),
+    replaced_by_id: Column.text().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    reuse_detected_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthJwtRevocationTable = (name) => Table.make(name, {
+    jwt_id: Column.text().pipe(Column.primaryKey),
+    revoked_at: Column.int(),
+    expires_at: Column.int().pipe(Column.nullable),
+    reason: Column.text().pipe(Column.nullable),
+});
+const makeAuthOAuthAccountTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    provider_id: Column.text(),
+    provider_account_id: Column.text(),
+    user_id: Column.text(),
+    email: Column.text().pipe(Column.nullable),
+    email_verified: Column.int().pipe(Column.nullable),
+    created_at: Column.int(),
+    updated_at: Column.int(),
+    unlinked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthOAuthProviderTokenVaultTable = (name) => Table.make(name, {
+    account_id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    provider_id: Column.text(),
+    provider_account_id: Column.text(),
+    access_token_ciphertext: Column.text(),
+    refresh_token_ciphertext: Column.text().pipe(Column.nullable),
+    id_token_ciphertext: Column.text().pipe(Column.nullable),
+    token_type: Column.text(),
+    scopes: Column.text().pipe(Column.nullable),
+    expires_at: Column.int().pipe(Column.nullable),
+    updated_at: Column.int(),
+    revoked_at: Column.int().pipe(Column.nullable),
+    revocation_reason: Column.text().pipe(Column.nullable),
+});
+const makeAuthOAuthClientTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    type: Column.text(),
+    status: Column.text(),
+    name: Column.text().pipe(Column.nullable),
+    redirect_uris: Column.text(),
+    allowed_grant_types: Column.text(),
+    allowed_response_types: Column.text(),
+    allowed_scopes: Column.text().pipe(Column.nullable),
+    created_at: Column.int().pipe(Column.nullable),
+    updated_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthOAuthConsentTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    client_id: Column.text(),
+    scopes: Column.text(),
+    granted_at: Column.int(),
+    expires_at: Column.int().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthOAuthAuthorizationCodeTable = (name) => Table.make(name, {
+    code_hash: Column.text().pipe(Column.primaryKey),
+    client_id: Column.text(),
+    subject: Column.text(),
+    redirect_uri: Column.text(),
+    scopes: Column.text(),
+    code_challenge: Column.text().pipe(Column.nullable),
+    code_challenge_method: Column.text().pipe(Column.nullable),
+    issued_at: Column.int(),
+    expires_at: Column.int(),
+    consumed_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthOAuthClientSecretTable = (name) => Table.make(name, {
+    prefix: Column.text().pipe(Column.primaryKey),
+    client_id: Column.text(),
+    secret_hash: Column.text(),
+    authentication_methods: Column.text(),
+    created_at: Column.int(),
+    expires_at: Column.int().pipe(Column.nullable),
+    last_used_at: Column.int().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthOAuthProviderModeTokenTable = (name) => Table.make(name, {
+    token_hash: Column.text().pipe(Column.primaryKey),
+    token_type: Column.text(),
+    client_id: Column.text(),
+    subject: Column.text(),
+    scopes: Column.text(),
+    issued_at: Column.int(),
+    expires_at: Column.int(),
+    issuer: Column.text().pipe(Column.nullable),
+    audience: Column.text().pipe(Column.nullable),
+    jwt_id: Column.text().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    revocation_reason: Column.text().pipe(Column.nullable),
+    rotated_at: Column.int().pipe(Column.nullable),
+    replaced_by_token_hash: Column.text().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthDomainVerificationTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    owner_id: Column.text(),
+    domain: Column.text(),
+    proof_method: Column.text(),
+    proof_token: Column.text(),
+    status: Column.text(),
+    created_at: Column.int(),
+    expires_at: Column.int(),
+    verified_at: Column.int().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    last_checked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthSecurityTimelineTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    type: Column.text(),
+    category: Column.text(),
+    severity: Column.text(),
+    occurred_at: Column.int(),
+    summary: Column.text(),
+    actor: Column.text().pipe(Column.nullable),
+    request: Column.text().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthWebhookOutboxTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    endpoint_key: Column.text(),
+    event: Column.text(),
+    status: Column.text(),
+    attempts: Column.int(),
+    next_attempt_at: Column.int(),
+    created_at: Column.int(),
+    updated_at: Column.int(),
+    delivered_at: Column.int().pipe(Column.nullable),
+    last_error: Column.text().pipe(Column.nullable),
+});
+const makeAuthWebhookReplayTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    expires_at: Column.int(),
+    created_at: Column.int(),
+});
+const authSqliteTablesTypeId = Symbol.for("@effect-auth/core/EffectQbSqliteStorage/AuthSqliteTables");
+const jsonEncode = (value) => value === undefined ? null : JSON.stringify(value);
+const jsonDecode = (value) => {
+    if (value === null || value === undefined) {
+        return undefined;
+    }
+    return typeof value === "string" ? JSON.parse(value) : value;
+};
+const optionalUnixMillis = (value) => value === null || value === undefined ? undefined : UnixMillis(Number(value));
+const decodeAmr = (value) => typeof value === "string"
+    ? JSON.parse(value)
+    : value;
+const decodeBoolean = (value) => {
+    if (typeof value === "boolean") {
+        return value;
+    }
+    if (typeof value === "number") {
+        return value !== 0;
+    }
+    if (typeof value === "string") {
+        return value !== "" && value !== "0" && value !== "false";
+    }
+    return value !== null && value !== undefined;
+};
+const mutationValues = (value) => value;
+const queryInsert = (table, values) => Query.insert(table, values);
+const queryUpdate = (table, values) => Query.update(table, values);
+const queryEq = (left, right) => Query.eq(left, right);
+const queryGt = (left, right) => Query.gt(left, right);
+const queryLt = (left, right) => Query.lt(left, right);
+const queryLte = (left, right) => Query.lte(left, right);
+const queryIsNull = (value) => Query.isNull(value);
+const queryIn = (value, first, ...rest) => Query.in(value, first, ...rest);
+const executePlan = (executor, plan) => executor.execute(plan);
+const omitUndefined = (record) => Object.fromEntries(Object.entries(record).filter(([, value]) => value !== undefined));
+const sessionMetadataEnvelopeKey = "__effectAuthSession";
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const metadataWithReason = (metadata, key, reason) => reason === undefined ? metadata : { ...metadata, [key]: reason };
+const isLoginRiskLevel = (value) => value === "unknown" ||
+    value === "low" ||
+    value === "medium" ||
+    value === "high" ||
+    value === "critical";
+const decodeLoginRiskSignal = (value) => {
+    const record = isRecord(value) ? value : {};
+    const level = isLoginRiskLevel(record.level) ? record.level : undefined;
+    return LoginRiskSignal.make({
+        type: typeof record.type === "string" ? record.type : "unknown",
+        ...(level === undefined ? {} : { level }),
+        ...(isRecord(record.metadata) ? { metadata: record.metadata } : {}),
+    });
+};
+const decodeLoginRiskContext = (value) => {
+    const decoded = jsonDecode(value);
+    if (!isRecord(decoded)) {
+        return undefined;
+    }
+    return LoginRiskContext.make({
+        level: isLoginRiskLevel(decoded.level) ? decoded.level : "unknown",
+        signals: Array.isArray(decoded.signals)
+            ? decoded.signals.map(decodeLoginRiskSignal)
+            : [],
+        ...(isRecord(decoded.metadata) ? { metadata: decoded.metadata } : {}),
+    });
+};
+const encodeLoginRiskSignal = (signal) => omitUndefined({
+    type: signal.type,
+    level: signal.level,
+    metadata: signal.metadata,
+});
+const encodeLoginRiskContext = (risk) => risk === undefined
+    ? null
+    : jsonEncode(omitUndefined({
+        level: risk.level,
+        signals: risk.signals.map(encodeLoginRiskSignal),
+        metadata: risk.metadata,
+    }));
+const decodeSessionMetadata = (value) => {
+    const decoded = jsonDecode(value);
+    const envelope = isRecord(decoded)
+        ? decoded[sessionMetadataEnvelopeKey]
+        : undefined;
+    if (!isRecord(envelope) || envelope.version !== 1) {
+        return omitUndefined({
+            metadata: decoded,
+        });
+    }
+    return omitUndefined({
+        metadata: envelope.metadata,
+        claims: envelope.claims,
+    });
+};
+const encodeSessionMetadata = (row) => {
+    if (row.claims === undefined) {
+        return jsonEncode(row.metadata);
+    }
+    return jsonEncode({
+        [sessionMetadataEnvelopeKey]: omitUndefined({
+            version: 1,
+            metadata: row.metadata,
+            claims: row.claims,
+        }),
+    });
+};
+const decodeDefaultUserRow = (row) => omitUndefined({
+    id: UserId(row.id),
+    email: Email(row.email),
+    emailVerified: decodeBoolean(row.emailVerified),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    updatedAt: UnixMillis(Number(row.updatedAt)),
+    disabledAt: optionalUnixMillis(row.disabledAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeUserRow = (tables, row) => tables.user.decode === undefined
+    ? decodeDefaultUserRow(row)
+    : tables.user.decode(row);
+const decodeDefaultPasswordCredentialRow = (row) => omitUndefined({
+    id: CredentialId(row.id),
+    userId: UserId(row.userId),
+    passwordHash: row.passwordHash ?? "",
+    createdAt: UnixMillis(Number(row.createdAt)),
+    updatedAt: UnixMillis(Number(row.updatedAt)),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodePasswordCredentialRow = (tables, row) => tables.credential.decodePassword === undefined
+    ? decodeDefaultPasswordCredentialRow(row)
+    : tables.credential.decodePassword(row);
+const decodeDefaultSessionRow = (row) => {
+    const sessionMetadata = decodeSessionMetadata(row.metadata);
+    return omitUndefined({
+        id: SessionId(row.id),
+        userId: UserId(row.userId),
+        secretHash: row.secretHash,
+        createdAt: UnixMillis(Number(row.createdAt)),
+        expiresAt: UnixMillis(Number(row.expiresAt)),
+        authTime: UnixMillis(Number(row.authTime)),
+        aal: row.aal,
+        amr: decodeAmr(row.amr),
+        mfaVerifiedAt: optionalUnixMillis(row.mfaVerifiedAt),
+        metadata: sessionMetadata.metadata,
+        claims: sessionMetadata.claims,
+        revokedAt: optionalUnixMillis(row.revokedAt),
+        lastSeenAt: optionalUnixMillis(row.lastSeenAt),
+        rotatedAt: optionalUnixMillis(row.rotatedAt),
+    });
+};
+const decodeSessionRow = (tables, row) => tables.session.decode === undefined
+    ? decodeDefaultSessionRow(row)
+    : tables.session.decode(row);
+const decodeDefaultVerificationRow = (row) => omitUndefined({
+    id: ChallengeId(row.id),
+    type: row.type,
+    subject: row.subject,
+    secretHash: row.secretHash ?? undefined,
+    createdAt: UnixMillis(Number(row.createdAt)),
+    expiresAt: UnixMillis(Number(row.expiresAt)),
+    metadata: jsonDecode(row.metadata),
+    consumedAt: optionalUnixMillis(row.consumedAt),
+});
+const decodeVerificationRow = (tables, row) => tables.verification.decode === undefined
+    ? decodeDefaultVerificationRow(row)
+    : tables.verification.decode(row);
+const decodeDefaultAuditLogEvent = (row) => jsonDecode(row.event);
+const decodeAuditLogEvent = (tables, row) => tables.auditLog.decode === undefined
+    ? decodeDefaultAuditLogEvent(row)
+    : tables.auditLog.decode(row);
+const decodeDefaultLoginApprovalReviewRow = (row) => omitUndefined({
+    approvalChallengeId: ChallengeId(row.approvalChallengeId),
+    flowId: AuthFlowId(row.flowId),
+    userId: UserId(row.userId),
+    channel: row.channel,
+    reason: row.reason,
+    sessionBinding: row.sessionBinding,
+    sameDeviceRequired: decodeBoolean(row.sameDeviceRequired),
+    status: row.status,
+    createdAt: UnixMillis(Number(row.createdAt)),
+    expiresAt: UnixMillis(Number(row.expiresAt)),
+    reviewedAt: optionalUnixMillis(row.reviewedAt),
+    reviewedBy: row.reviewedBy === null
+        ? undefined
+        : row.reviewedBy,
+    deniedReason: row.deniedReason === null ? undefined : row.deniedReason,
+    risk: decodeLoginRiskContext(row.risk),
+    metadata: jsonDecode(row.metadata),
+    reviewMetadata: jsonDecode(row.reviewMetadata),
+});
+const decodeLoginApprovalReviewRow = (tables, row) => tables.loginApprovalReview.decode === undefined
+    ? decodeDefaultLoginApprovalReviewRow(row)
+    : tables.loginApprovalReview.decode(row);
+const decodeDefaultLoginRiskHistoryRecord = (row) => omitUndefined({
+    id: row.id,
+    userId: UserId(row.userId),
+    occurredAt: UnixMillis(Number(row.occurredAt)),
+    outcome: row.outcome,
+    method: row.method,
+    amr: decodeAmr(row.amr),
+    aal: row.aal,
+    device: { status: row.deviceStatus },
+    deviceKey: row.deviceKey ?? undefined,
+    locationKey: row.locationKey ?? undefined,
+    country: row.country ?? undefined,
+    region: row.region ?? undefined,
+    latitude: row.latitudeMicro === null ? undefined : Number(row.latitudeMicro) / 1_000_000,
+    longitude: row.longitudeMicro === null
+        ? undefined
+        : Number(row.longitudeMicro) / 1_000_000,
+    riskLevel: row.riskLevel === null ? undefined : row.riskLevel,
+    createdAt: UnixMillis(Number(row.createdAt)),
+});
+const decodeLoginRiskHistoryRecord = (tables, row) => tables.loginRiskHistory.decode === undefined
+    ? decodeDefaultLoginRiskHistoryRecord(row)
+    : tables.loginRiskHistory.decode(row);
+const decodeDefaultTrustedDeviceRow = (row) => omitUndefined({
+    userId: UserId(row.userId),
+    tokenHash: row.tokenHash,
+    createdAt: UnixMillis(Number(row.createdAt)),
+    lastSeenAt: UnixMillis(Number(row.lastSeenAt)),
+    expiresAt: UnixMillis(Number(row.expiresAt)),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeTrustedDeviceRow = (tables, row) => tables.trustedDevice.decode === undefined
+    ? decodeDefaultTrustedDeviceRow(row)
+    : tables.trustedDevice.decode(row);
+const decodePasskeyTransports = (value) => {
+    const decoded = jsonDecode(value);
+    return Array.isArray(decoded) ? decoded : undefined;
+};
+const decodeDefaultPasskeyCredentialRow = (row) => omitUndefined({
+    id: CredentialId(row.id),
+    userId: UserId(row.userId),
+    credentialId: PasskeyCredentialId(row.credentialId),
+    publicKey: row.publicKey,
+    signCount: Number(row.signCount),
+    transports: decodePasskeyTransports(row.transports),
+    backedUp: row.backedUp === null || row.backedUp === undefined
+        ? undefined
+        : decodeBoolean(row.backedUp),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    lastUsedAt: optionalUnixMillis(row.lastUsedAt),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodePasskeyCredentialRow = (tables, row) => tables.passkeyCredential.decode === undefined
+    ? decodeDefaultPasskeyCredentialRow(row)
+    : tables.passkeyCredential.decode(row);
+const decodeDefaultTotpFactorRow = (row) => omitUndefined({
+    id: CredentialId(row.id),
+    userId: UserId(row.userId),
+    secret: Redacted.make(TotpSecret(row.secret)),
+    algorithm: row.algorithm,
+    digits: Number(row.digits),
+    period: Number(row.period),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    confirmedAt: optionalUnixMillis(row.confirmedAt),
+    lastUsedAt: optionalUnixMillis(row.lastUsedAt),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeTotpFactorRow = (tables, row) => tables.totpFactor.decode === undefined
+    ? decodeDefaultTotpFactorRow(row)
+    : tables.totpFactor.decode(row);
+const decodeDefaultRecoveryCodeRow = (row) => omitUndefined({
+    id: CredentialId(row.id),
+    userId: UserId(row.userId),
+    codeHash: RecoveryCodeHash(row.codeHash),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    usedAt: optionalUnixMillis(row.usedAt),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeRecoveryCodeRow = (tables, row) => tables.recoveryCode.decode === undefined
+    ? decodeDefaultRecoveryCodeRow(row)
+    : tables.recoveryCode.decode(row);
+const decodeStringArray = (value) => {
+    const decoded = jsonDecode(value);
+    return Array.isArray(decoded) ? decoded.map(String) : [];
+};
+const decodeOptionalStringArray = (value) => {
+    const decoded = jsonDecode(value);
+    return Array.isArray(decoded) ? decoded.map(String) : undefined;
+};
+const decodeDefaultApiKeyRow = (row) => omitUndefined({
+    id: ApiKeyId(row.id),
+    userId: UserId(row.userId),
+    prefix: ApiKeyPrefix(row.prefix),
+    secretHash: ApiKeySecretHash(row.secretHash),
+    scopes: decodeStringArray(row.scopes),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    expiresAt: optionalUnixMillis(row.expiresAt),
+    lastUsedAt: optionalUnixMillis(row.lastUsedAt),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeApiKeyRow = (tables, row) => tables.apiKey.decode === undefined
+    ? decodeDefaultApiKeyRow(row)
+    : tables.apiKey.decode(row);
+const decodeDefaultRefreshTokenRow = (row) => omitUndefined({
+    id: RefreshTokenId(row.id),
+    familyId: RefreshTokenFamilyId(row.familyId),
+    userId: UserId(row.userId),
+    secretHash: RefreshTokenSecretHash(row.secretHash),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    expiresAt: UnixMillis(Number(row.expiresAt)),
+    lastUsedAt: optionalUnixMillis(row.lastUsedAt),
+    rotatedAt: optionalUnixMillis(row.rotatedAt),
+    replacedById: row.replacedById === null ? undefined : RefreshTokenId(row.replacedById),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    reuseDetectedAt: optionalUnixMillis(row.reuseDetectedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeRefreshTokenRow = (tables, row) => tables.refreshToken.decode === undefined
+    ? decodeDefaultRefreshTokenRow(row)
+    : tables.refreshToken.decode(row);
+const decodeDefaultJwtRevocationRow = (row) => omitUndefined({
+    jwtId: row.jwtId,
+    revokedAt: UnixMillis(Number(row.revokedAt)),
+    expiresAt: optionalUnixMillis(row.expiresAt),
+    reason: row.reason ?? undefined,
+});
+const decodeJwtRevocationRow = (tables, row) => tables.jwtRevocation.decode === undefined
+    ? decodeDefaultJwtRevocationRow(row)
+    : tables.jwtRevocation.decode(row);
+const decodeDefaultOAuthAccountRow = (row) => omitUndefined({
+    id: OAuthAccountId(row.id),
+    providerId: OAuthProviderId(row.providerId),
+    providerAccountId: row.providerAccountId,
+    userId: UserId(row.userId),
+    email: row.email === null ? undefined : Email(row.email),
+    emailVerified: row.emailVerified === null || row.emailVerified === undefined
+        ? undefined
+        : decodeBoolean(row.emailVerified),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    updatedAt: UnixMillis(Number(row.updatedAt)),
+    unlinkedAt: optionalUnixMillis(row.unlinkedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeOAuthAccountRow = (tables, row) => tables.oauthAccount.decode === undefined
+    ? decodeDefaultOAuthAccountRow(row)
+    : tables.oauthAccount.decode(row);
+const decodeDefaultOAuthProviderTokenVaultRow = (row) => omitUndefined({
+    accountId: OAuthAccountId(row.accountId),
+    userId: UserId(row.userId),
+    providerId: OAuthProviderId(row.providerId),
+    providerAccountId: row.providerAccountId,
+    accessTokenCiphertext: Redacted.make(row.accessTokenCiphertext),
+    refreshTokenCiphertext: row.refreshTokenCiphertext === null
+        ? undefined
+        : Redacted.make(row.refreshTokenCiphertext),
+    idTokenCiphertext: row.idTokenCiphertext === null
+        ? undefined
+        : Redacted.make(row.idTokenCiphertext),
+    tokenType: row.tokenType,
+    scopes: decodeOptionalStringArray(row.scopes),
+    expiresAt: optionalUnixMillis(row.expiresAt),
+    updatedAt: UnixMillis(Number(row.updatedAt)),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    revocationReason: row.revocationReason ?? undefined,
+});
+const decodeOAuthProviderTokenVaultRow = (tables, row) => tables.oauthProviderTokenVault.decode === undefined
+    ? decodeDefaultOAuthProviderTokenVaultRow(row)
+    : tables.oauthProviderTokenVault.decode(row);
+const decodeDefaultOAuthClientRow = (row) => omitUndefined({
+    id: OAuthClientId(row.id),
+    type: row.type,
+    status: row.status,
+    name: row.name ?? undefined,
+    redirectUris: decodeStringArray(row.redirectUris),
+    allowedGrantTypes: decodeStringArray(row.allowedGrantTypes),
+    allowedResponseTypes: decodeStringArray(row.allowedResponseTypes),
+    allowedScopes: decodeOptionalStringArray(row.allowedScopes),
+    createdAt: optionalUnixMillis(row.createdAt),
+    updatedAt: optionalUnixMillis(row.updatedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeOAuthClientRow = (tables, row) => tables.oauthClient.decode === undefined
+    ? decodeDefaultOAuthClientRow(row)
+    : tables.oauthClient.decode(row);
+const decodeDefaultOAuthConsentRow = (row) => omitUndefined({
+    userId: UserId(row.userId),
+    clientId: OAuthClientId(row.clientId),
+    scopes: decodeStringArray(row.scopes),
+    grantedAt: UnixMillis(Number(row.grantedAt)),
+    expiresAt: optionalUnixMillis(row.expiresAt),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeOAuthConsentRow = (tables, row) => tables.oauthConsent.decode === undefined
+    ? decodeDefaultOAuthConsentRow(row)
+    : tables.oauthConsent.decode(row);
+const oauthConsentCoversScopes = (record, scopes = []) => scopes.every((scope) => record.scopes.includes(scope));
+const isOAuthConsentActive = (record, input) => record.revokedAt === undefined &&
+    (record.expiresAt === undefined || Number(record.expiresAt) > Number(input.now)) &&
+    oauthConsentCoversScopes(record, input.scopes);
+const oauthClientRedirectUriValidationResult = (client, input) => {
+    if (client === undefined) {
+        return { valid: false, reason: "unknown_client" };
+    }
+    if (client.status !== "active") {
+        return { valid: false, reason: "disabled_client" };
+    }
+    const responseType = input.responseType ?? "code";
+    if (!client.allowedResponseTypes.includes(responseType)) {
+        return { valid: false, reason: "unsupported_response_type" };
+    }
+    if (input.grantType !== undefined &&
+        !client.allowedGrantTypes.includes(input.grantType)) {
+        return { valid: false, reason: "unsupported_grant_type" };
+    }
+    if (!client.redirectUris.includes(input.redirectUri)) {
+        return { valid: false, reason: "redirect_uri_mismatch" };
+    }
+    return { valid: true, client };
+};
+const decodeDefaultOAuthAuthorizationCodeRow = (row) => omitUndefined({
+    codeHash: row.codeHash,
+    clientId: OAuthClientId(row.clientId),
+    subject: row.subject,
+    redirectUri: row.redirectUri,
+    scopes: decodeStringArray(row.scopes),
+    codeChallenge: row.codeChallenge === null ? undefined : OAuthCodeChallenge(row.codeChallenge),
+    codeChallengeMethod: row.codeChallengeMethod === null
+        ? undefined
+        : row.codeChallengeMethod,
+    issuedAt: UnixMillis(Number(row.issuedAt)),
+    expiresAt: UnixMillis(Number(row.expiresAt)),
+    consumedAt: optionalUnixMillis(row.consumedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeOAuthAuthorizationCodeRow = (tables, row) => tables.oauthAuthorizationCode.decode === undefined
+    ? decodeDefaultOAuthAuthorizationCodeRow(row)
+    : tables.oauthAuthorizationCode.decode(row);
+const decodeDefaultOAuthClientSecretRow = (row) => omitUndefined({
+    prefix: OAuthClientSecretPrefix(row.prefix),
+    clientId: OAuthClientId(row.clientId),
+    secretHash: OAuthClientSecretHash(row.secretHash),
+    authenticationMethods: decodeStringArray(row.authenticationMethods),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    expiresAt: optionalUnixMillis(row.expiresAt),
+    lastUsedAt: optionalUnixMillis(row.lastUsedAt),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeOAuthClientSecretRow = (tables, row) => tables.oauthClientSecret.decode === undefined
+    ? decodeDefaultOAuthClientSecretRow(row)
+    : tables.oauthClientSecret.decode(row);
+const decodeOAuthProviderModeTokenAudience = (value) => {
+    const decoded = jsonDecode(value);
+    if (typeof decoded === "string") {
+        return decoded;
+    }
+    return Array.isArray(decoded) ? decoded.map(String) : undefined;
+};
+const decodeDefaultOAuthProviderModeTokenRow = (row) => omitUndefined({
+    tokenHash: row.tokenHash,
+    tokenType: row.tokenType,
+    clientId: OAuthClientId(row.clientId),
+    subject: row.subject,
+    scopes: decodeStringArray(row.scopes),
+    issuedAt: UnixMillis(Number(row.issuedAt)),
+    expiresAt: UnixMillis(Number(row.expiresAt)),
+    issuer: row.issuer ?? undefined,
+    audience: decodeOAuthProviderModeTokenAudience(row.audience),
+    jwtId: row.jwtId ?? undefined,
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    revocationReason: row.revocationReason ?? undefined,
+    rotatedAt: optionalUnixMillis(row.rotatedAt),
+    replacedByTokenHash: row.replacedByTokenHash ?? undefined,
+    metadata: jsonDecode(row.metadata),
+});
+const decodeOAuthProviderModeTokenRow = (tables, row) => tables.oauthProviderModeToken.decode === undefined
+    ? decodeDefaultOAuthProviderModeTokenRow(row)
+    : tables.oauthProviderModeToken.decode(row);
+const decodeDefaultDomainVerificationRecord = (row) => omitUndefined({
+    id: DomainVerificationId(row.id),
+    ownerId: row.ownerId,
+    domain: DomainName(row.domain),
+    proofMethod: row.proofMethod,
+    proofToken: DomainVerificationProofToken(row.proofToken),
+    status: row.status,
+    createdAt: UnixMillis(Number(row.createdAt)),
+    expiresAt: UnixMillis(Number(row.expiresAt)),
+    verifiedAt: optionalUnixMillis(row.verifiedAt),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    lastCheckedAt: optionalUnixMillis(row.lastCheckedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeDomainVerificationRecord = (tables, row) => tables.domainVerification.decode === undefined
+    ? decodeDefaultDomainVerificationRecord(row)
+    : tables.domainVerification.decode(row);
+const decodeDefaultSecurityTimelineEvent = (row) => omitUndefined({
+    id: SecurityTimelineEventId(row.id),
+    userId: UserId(row.userId),
+    type: row.type,
+    category: row.category,
+    severity: row.severity,
+    occurredAt: UnixMillis(Number(row.occurredAt)),
+    summary: row.summary,
+    actor: jsonDecode(row.actor),
+    request: jsonDecode(row.request),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeSecurityTimelineEvent = (tables, row) => tables.securityTimeline.decode === undefined
+    ? decodeDefaultSecurityTimelineEvent(row)
+    : tables.securityTimeline.decode(row);
+const decodeDefaultWebhookOutboxRecord = (row) => omitUndefined({
+    id: WebhookOutboxItemId(row.id),
+    endpointKey: row.endpointKey,
+    event: jsonDecode(row.event),
+    status: row.status,
+    attempts: Number(row.attempts),
+    nextAttemptAt: UnixMillis(Number(row.nextAttemptAt)),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    updatedAt: UnixMillis(Number(row.updatedAt)),
+    deliveredAt: optionalUnixMillis(row.deliveredAt),
+    lastError: row.lastError ?? undefined,
+});
+const decodeWebhookOutboxRecord = (tables, row) => tables.webhookOutbox.decode === undefined
+    ? decodeDefaultWebhookOutboxRecord(row)
+    : tables.webhookOutbox.decode(row);
+const providerTokenVaultTokens = (record) => omitUndefined({
+    accessTokenCiphertext: record.accessTokenCiphertext,
+    refreshTokenCiphertext: record.refreshTokenCiphertext,
+    idTokenCiphertext: record.idTokenCiphertext,
+    tokenType: record.tokenType,
+    scopes: record.scopes === undefined ? undefined : [...record.scopes],
+    expiresAt: record.expiresAt,
+});
+const userInsert = (row) => ({
+    id: row.id,
+    email: row.email,
+    email_verified: row.emailVerified ? 1 : 0,
+    created_at: Number(row.createdAt),
+    updated_at: Number(row.updatedAt),
+    disabled_at: row.disabledAt === undefined ? null : Number(row.disabledAt),
+    metadata: jsonEncode(row.metadata),
+});
+const passwordCredentialInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    type: "password",
+    password_hash: row.passwordHash,
+    created_at: Number(row.createdAt),
+    updated_at: Number(row.updatedAt),
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const passwordCredentialUpdatePassword = (input) => ({
+    password_hash: input.passwordHash,
+    updated_at: Number(input.updatedAt),
+});
+const sessionInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    secret_hash: row.secretHash,
+    created_at: Number(row.createdAt),
+    expires_at: Number(row.expiresAt),
+    auth_time: Number(row.authTime),
+    aal: row.aal,
+    amr: JSON.stringify(row.amr),
+    mfa_verified_at: row.mfaVerifiedAt === undefined ? null : Number(row.mfaVerifiedAt),
+    metadata: encodeSessionMetadata(row),
+    revoked_at: null,
+    last_seen_at: null,
+    rotated_at: null,
+});
+const verificationInsert = (row) => ({
+    id: row.id,
+    type: row.type,
+    subject: row.subject,
+    secret_hash: row.secretHash ?? null,
+    created_at: Number(row.createdAt),
+    expires_at: Number(row.expiresAt),
+    metadata: jsonEncode(row.metadata),
+    consumed_at: null,
+});
+const auditLogInsert = (event, createdAt) => ({
+    id: event.id ?? null,
+    type: event.type,
+    user_id: auditEventUserId(event) ?? null,
+    actor_user_id: auditEventActorUserId(event) ?? null,
+    occurred_at: Number(event.occurredAt),
+    request_ip_hash: event.request?.ipHash ?? null,
+    request_user_agent_hash: event.request?.userAgentHash ?? null,
+    event: JSON.stringify(event),
+    created_at: Number(createdAt),
+});
+const loginApprovalReviewInsert = (row) => ({
+    approval_challenge_id: row.approvalChallengeId,
+    flow_id: row.flowId,
+    user_id: row.userId,
+    channel: row.channel,
+    reason: row.reason,
+    session_binding: row.sessionBinding,
+    same_device_required: row.sameDeviceRequired ? 1 : 0,
+    status: row.status,
+    created_at: Number(row.createdAt),
+    expires_at: Number(row.expiresAt),
+    reviewed_at: row.reviewedAt === undefined ? null : Number(row.reviewedAt),
+    reviewed_by: row.reviewedBy ?? null,
+    denied_reason: row.deniedReason ?? null,
+    risk: encodeLoginRiskContext(row.risk),
+    metadata: jsonEncode(row.metadata),
+    review_metadata: jsonEncode(row.reviewMetadata),
+});
+const coordinateMicro = (value) => value === undefined || !Number.isFinite(value)
+    ? null
+    : Math.round(value * 1_000_000);
+const loginRiskHistoryInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    occurred_at: Number(row.occurredAt),
+    outcome: row.outcome,
+    method: row.method,
+    amr: JSON.stringify(row.amr),
+    aal: row.aal,
+    device_status: row.device.status,
+    device_key: row.deviceKey ?? null,
+    location_key: row.locationKey ?? null,
+    country: row.country ?? null,
+    region: row.region ?? null,
+    latitude_micro: coordinateMicro(row.latitude),
+    longitude_micro: coordinateMicro(row.longitude),
+    risk_level: row.riskLevel ?? null,
+    created_at: Number(row.createdAt),
+});
+const userMarkEmailVerifiedUpdate = (input) => ({
+    email_verified: 1,
+    updated_at: Number(input.updatedAt),
+});
+const sessionRefreshUpdate = (input) => omitUndefined({
+    expires_at: Number(input.expiresAt),
+    last_seen_at: input.lastSeenAt === undefined ? undefined : Number(input.lastSeenAt),
+});
+const sessionRotateUpdate = (input) => omitUndefined({
+    secret_hash: input.secretHash,
+    rotated_at: Number(input.rotatedAt),
+    expires_at: input.expiresAt === undefined ? undefined : Number(input.expiresAt),
+});
+const sessionUpdateClaimsUpdate = (row, input) => omitUndefined({
+    aal: input.aal,
+    amr: input.amr === undefined ? undefined : JSON.stringify(input.amr),
+    mfa_verified_at: input.mfaVerifiedAt === undefined ? undefined : Number(input.mfaVerifiedAt),
+    metadata: encodeSessionMetadata({
+        ...row,
+        claims: input.claims ?? row.claims,
+    }),
+});
+const sessionRevokeUpdate = (input) => ({
+    revoked_at: Number(input.revokedAt),
+});
+const verificationConsumeUpdate = (input) => ({
+    consumed_at: Number(input.consumedAt),
+});
+const loginApprovalReviewApproveUpdate = (input) => ({
+    status: "approved",
+    reviewed_at: Number(input.reviewedAt),
+    reviewed_by: input.reviewedBy ?? null,
+    review_metadata: jsonEncode(input.metadata),
+});
+const loginApprovalReviewDenyUpdate = (input) => ({
+    status: "denied",
+    reviewed_at: Number(input.reviewedAt),
+    reviewed_by: input.reviewedBy ?? null,
+    denied_reason: input.reason ?? null,
+    review_metadata: jsonEncode(input.metadata),
+});
+const trustedDeviceInsert = (input, createdAt) => ({
+    user_id: input.userId,
+    token_hash: input.tokenHash,
+    created_at: Number(createdAt),
+    last_seen_at: Number(input.now),
+    expires_at: Number(input.expiresAt),
+    metadata: jsonEncode(input.metadata),
+});
+const trustedDeviceUpdate = (input, existing) => ({
+    last_seen_at: Number(input.now),
+    expires_at: Number(input.expiresAt),
+    metadata: jsonEncode(input.metadata ?? existing.metadata),
+});
+const passkeyCredentialInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    credential_id: row.credentialId,
+    public_key: row.publicKey,
+    sign_count: row.signCount,
+    transports: jsonEncode(row.transports),
+    backed_up: row.backedUp === undefined ? null : row.backedUp ? 1 : 0,
+    created_at: Number(row.createdAt),
+    last_used_at: row.lastUsedAt === undefined ? null : Number(row.lastUsedAt),
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const passkeyCredentialUpdateSignCount = (input) => omitUndefined({
+    sign_count: input.signCount,
+    last_used_at: Number(input.lastUsedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
+const passkeyCredentialRevoke = (input, row) => ({
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
+});
+const totpFactorInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    secret: Redacted.value(row.secret),
+    algorithm: row.algorithm,
+    digits: row.digits,
+    period: row.period,
+    created_at: Number(row.createdAt),
+    confirmed_at: row.confirmedAt === undefined ? null : Number(row.confirmedAt),
+    last_used_at: row.lastUsedAt === undefined ? null : Number(row.lastUsedAt),
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const totpFactorConfirm = (input) => omitUndefined({
+    confirmed_at: Number(input.confirmedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
+const totpFactorMarkUsed = (input) => omitUndefined({
+    last_used_at: Number(input.lastUsedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
+const totpFactorRevoke = (input, row) => ({
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
+});
+const recoveryCodeInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    code_hash: row.codeHash,
+    created_at: Number(row.createdAt),
+    used_at: row.usedAt === undefined ? null : Number(row.usedAt),
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const recoveryCodeMarkUsed = (input) => omitUndefined({
+    used_at: Number(input.usedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
+const recoveryCodeRevoke = (input, row) => ({
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
+});
+const apiKeyInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    prefix: row.prefix,
+    secret_hash: row.secretHash,
+    scopes: JSON.stringify(row.scopes),
+    created_at: Number(row.createdAt),
+    expires_at: row.expiresAt === undefined ? null : Number(row.expiresAt),
+    last_used_at: row.lastUsedAt === undefined ? null : Number(row.lastUsedAt),
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const apiKeyMarkUsed = (input) => omitUndefined({
+    last_used_at: Number(input.lastUsedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
+const apiKeyRevoke = (input, row) => ({
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
+});
+const refreshTokenInsert = (row) => ({
+    id: row.id,
+    family_id: row.familyId,
+    user_id: row.userId,
+    secret_hash: row.secretHash,
+    created_at: Number(row.createdAt),
+    expires_at: Number(row.expiresAt),
+    last_used_at: row.lastUsedAt === undefined ? null : Number(row.lastUsedAt),
+    rotated_at: row.rotatedAt === undefined ? null : Number(row.rotatedAt),
+    replaced_by_id: row.replacedById ?? null,
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    reuse_detected_at: row.reuseDetectedAt === undefined ? null : Number(row.reuseDetectedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const refreshTokenRotate = (input) => ({
+    last_used_at: Number(input.rotatedAt),
+    rotated_at: Number(input.rotatedAt),
+    replaced_by_id: input.replacement.id,
+});
+const refreshTokenMarkReuseDetected = (input) => ({
+    reuse_detected_at: Number(input.reuseDetectedAt),
+});
+const refreshTokenRevoke = (input, row) => ({
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
+});
+const refreshTokenRevokeFamily = (input, row) => ({
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "familyRevokeReason", input.reason)),
+});
+const jwtRevocationInsert = (record) => ({
+    jwt_id: record.jwtId,
+    revoked_at: Number(record.revokedAt),
+    expires_at: record.expiresAt === undefined ? null : Number(record.expiresAt),
+    reason: record.reason ?? null,
+});
+const oauthAccountInsert = (row) => ({
+    id: row.id,
+    provider_id: row.providerId,
+    provider_account_id: row.providerAccountId,
+    user_id: row.userId,
+    email: row.email ?? null,
+    email_verified: row.emailVerified === undefined ? null : row.emailVerified ? 1 : 0,
+    created_at: Number(row.createdAt),
+    updated_at: Number(row.updatedAt),
+    unlinked_at: row.unlinkedAt === undefined ? null : Number(row.unlinkedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const oauthAccountUnlink = (input, row) => ({
+    unlinked_at: Number(input.unlinkedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "unlinkReason", input.reason)),
+});
+const oauthProviderTokenVaultValues = (row) => ({
+    account_id: row.accountId,
+    user_id: row.userId,
+    provider_id: row.providerId,
+    provider_account_id: row.providerAccountId,
+    access_token_ciphertext: Redacted.value(row.accessTokenCiphertext),
+    refresh_token_ciphertext: row.refreshTokenCiphertext === undefined
+        ? null
+        : Redacted.value(row.refreshTokenCiphertext),
+    id_token_ciphertext: row.idTokenCiphertext === undefined ? null : Redacted.value(row.idTokenCiphertext),
+    token_type: row.tokenType,
+    scopes: jsonEncode(row.scopes),
+    expires_at: row.expiresAt === undefined ? null : Number(row.expiresAt),
+    updated_at: Number(row.updatedAt),
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    revocation_reason: row.revocationReason ?? null,
+});
+const oauthProviderTokenVaultMarkRevoked = (input) => ({
+    revoked_at: Number(input.revokedAt),
+    revocation_reason: input.reason,
+});
+const oauthClientValues = (record) => ({
+    id: record.id,
+    type: record.type,
+    status: record.status,
+    name: record.name ?? null,
+    redirect_uris: JSON.stringify(record.redirectUris),
+    allowed_grant_types: JSON.stringify(record.allowedGrantTypes),
+    allowed_response_types: JSON.stringify(record.allowedResponseTypes),
+    allowed_scopes: jsonEncode(record.allowedScopes),
+    created_at: record.createdAt === undefined ? null : Number(record.createdAt),
+    updated_at: record.updatedAt === undefined ? null : Number(record.updatedAt),
+    metadata: jsonEncode(record.metadata),
+});
+const oauthConsentId = (input) => JSON.stringify([input.userId, input.clientId]);
+const oauthConsentValues = (record) => ({
+    id: oauthConsentId(record),
+    user_id: record.userId,
+    client_id: record.clientId,
+    scopes: JSON.stringify(record.scopes),
+    granted_at: Number(record.grantedAt),
+    expires_at: record.expiresAt === undefined ? null : Number(record.expiresAt),
+    revoked_at: record.revokedAt === undefined ? null : Number(record.revokedAt),
+    metadata: jsonEncode(record.metadata),
+});
+const oauthConsentRevoke = (input, row) => ({
+    revoked_at: Number(row.revokedAt ?? input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
+});
+const oauthAuthorizationCodeValues = (record) => ({
+    code_hash: record.codeHash,
+    client_id: record.clientId,
+    subject: record.subject,
+    redirect_uri: record.redirectUri,
+    scopes: JSON.stringify(record.scopes),
+    code_challenge: record.codeChallenge ?? null,
+    code_challenge_method: record.codeChallengeMethod ?? null,
+    issued_at: Number(record.issuedAt),
+    expires_at: Number(record.expiresAt),
+    consumed_at: record.consumedAt === undefined ? null : Number(record.consumedAt),
+    metadata: jsonEncode(record.metadata),
+});
+const oauthAuthorizationCodeMarkConsumed = (input) => ({
+    consumed_at: Number(input.consumedAt),
+});
+const oauthClientSecretValues = (record) => ({
+    prefix: record.prefix,
+    client_id: record.clientId,
+    secret_hash: record.secretHash,
+    authentication_methods: JSON.stringify(record.authenticationMethods),
+    created_at: Number(record.createdAt),
+    expires_at: record.expiresAt === undefined ? null : Number(record.expiresAt),
+    last_used_at: record.lastUsedAt === undefined ? null : Number(record.lastUsedAt),
+    revoked_at: record.revokedAt === undefined ? null : Number(record.revokedAt),
+    metadata: jsonEncode(record.metadata),
+});
+const oauthClientSecretMarkUsed = (input) => omitUndefined({
+    last_used_at: Number(input.lastUsedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
+const oauthClientSecretRevoke = (input, row) => ({
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
+});
+const oauthProviderModeTokenValues = (record) => ({
+    token_hash: record.tokenHash,
+    token_type: record.tokenType,
+    client_id: record.clientId,
+    subject: record.subject,
+    scopes: JSON.stringify(record.scopes),
+    issued_at: Number(record.issuedAt),
+    expires_at: Number(record.expiresAt),
+    issuer: record.issuer ?? null,
+    audience: jsonEncode(record.audience),
+    jwt_id: record.jwtId ?? null,
+    revoked_at: record.revokedAt === undefined ? null : Number(record.revokedAt),
+    revocation_reason: record.revocationReason ?? null,
+    rotated_at: record.rotatedAt === undefined ? null : Number(record.rotatedAt),
+    replaced_by_token_hash: record.replacedByTokenHash ?? null,
+    metadata: jsonEncode(record.metadata),
+});
+const oauthProviderModeTokenRevoke = (input, row) => ({
+    revoked_at: Number(row.revokedAt ?? input.revokedAt),
+    revocation_reason: row.revocationReason ?? input.reason ?? null,
+});
+const oauthProviderModeTokenRotate = (input) => ({
+    rotated_at: Number(input.rotatedAt),
+    replaced_by_token_hash: input.replacedByTokenHash,
+});
+const domainVerificationValues = (record) => ({
+    id: record.id,
+    owner_id: record.ownerId,
+    domain: record.domain,
+    proof_method: record.proofMethod,
+    proof_token: record.proofToken,
+    status: record.status,
+    created_at: Number(record.createdAt),
+    expires_at: Number(record.expiresAt),
+    verified_at: record.verifiedAt === undefined ? null : Number(record.verifiedAt),
+    revoked_at: record.revokedAt === undefined ? null : Number(record.revokedAt),
+    last_checked_at: record.lastCheckedAt === undefined ? null : Number(record.lastCheckedAt),
+    metadata: jsonEncode(record.metadata),
+});
+const domainVerificationMarkVerified = (input) => omitUndefined({
+    status: "verified",
+    verified_at: Number(input.verifiedAt),
+    last_checked_at: Number(input.verifiedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
+const domainVerificationRevoke = (input, row) => ({
+    status: "revoked",
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
+});
+const securityTimelineInsert = (event) => ({
+    id: event.id,
+    user_id: event.userId,
+    type: event.type,
+    category: event.category,
+    severity: event.severity,
+    occurred_at: Number(event.occurredAt),
+    summary: event.summary,
+    actor: jsonEncode(event.actor),
+    request: jsonEncode(event.request),
+    metadata: jsonEncode(event.metadata),
+});
+const webhookOutboxInsert = (record) => ({
+    id: record.id,
+    endpoint_key: record.endpointKey,
+    event: jsonEncode(record.event),
+    status: record.status,
+    attempts: record.attempts,
+    next_attempt_at: Number(record.nextAttemptAt),
+    created_at: Number(record.createdAt),
+    updated_at: Number(record.updatedAt),
+    delivered_at: record.deliveredAt === undefined ? null : Number(record.deliveredAt),
+    last_error: record.lastError ?? null,
+});
+const webhookOutboxMarkDelivered = (input) => ({
+    status: "delivered",
+    delivered_at: Number(input.deliveredAt),
+    updated_at: Number(input.deliveredAt),
+    last_error: null,
+});
+const webhookOutboxMarkFailed = (input) => ({
+    status: "failed",
+    attempts: input.attempts,
+    next_attempt_at: Number(input.nextAttemptAt),
+    updated_at: Number(input.failedAt),
+    last_error: input.error ?? null,
+});
+const webhookOutboxMarkDeadLettered = (input) => ({
+    status: "dead_lettered",
+    updated_at: Number(input.deadLetteredAt),
+    last_error: input.error ?? null,
+});
+const webhookReplayInsert = (input) => ({
+    id: input.id,
+    expires_at: Number(input.expiresAt),
+    created_at: Number(input.now),
+});
+const webhookReplayUpdate = (input) => ({
+    expires_at: Number(input.expiresAt),
+    created_at: Number(input.now),
+});
+const jwtRevocationUpdate = (record) => ({
+    revoked_at: Number(record.revokedAt),
+    expires_at: record.expiresAt === undefined ? null : Number(record.expiresAt),
+    reason: record.reason ?? null,
+});
+const authSqliteTableName = (name, defaultName) => name ?? defaultName;
+const makeInternalAuthSqliteTables = (names = {}) => {
+    const user = makeAuthUserTable(names.user ?? "auth_user");
+    const credential = makeAuthCredentialTable(names.credential ?? "auth_credential");
+    const session = makeAuthSessionTable(names.session ?? "auth_session");
+    const verification = makeAuthVerificationTable(names.verification ?? "auth_verification");
+    const auditLog = makeAuthAuditLogTable(authSqliteTableName(names.auditLog, "auth_audit_log"));
+    const loginApprovalReview = makeAuthLoginApprovalReviewTable(names.loginApprovalReview ?? "auth_login_approval_review");
+    const loginRiskHistory = makeAuthLoginRiskHistoryTable(names.loginRiskHistory ?? "auth_login_risk_history");
+    const trustedDevice = makeAuthTrustedDeviceTable(names.trustedDevice ?? "auth_trusted_device");
+    const passkeyCredential = makeAuthPasskeyCredentialTable(names.passkeyCredential ?? "auth_passkey_credential");
+    const totpFactor = makeAuthTotpFactorTable(names.totpFactor ?? "auth_totp_factor");
+    const recoveryCode = makeAuthRecoveryCodeTable(names.recoveryCode ?? "auth_recovery_code");
+    const apiKey = makeAuthApiKeyTable(names.apiKey ?? "auth_api_key");
+    const refreshToken = makeAuthRefreshTokenTable(names.refreshToken ?? "auth_refresh_token");
+    const jwtRevocation = makeAuthJwtRevocationTable(names.jwtRevocation ?? "auth_jwt_revocation");
+    const oauthAccount = makeAuthOAuthAccountTable(names.oauthAccount ?? "auth_oauth_account");
+    const oauthClient = makeAuthOAuthClientTable(authSqliteTableName(names.oauthClient, "auth_oauth_client"));
+    const oauthConsent = makeAuthOAuthConsentTable(authSqliteTableName(names.oauthConsent, "auth_oauth_consent"));
+    const oauthAuthorizationCode = makeAuthOAuthAuthorizationCodeTable(authSqliteTableName(names.oauthAuthorizationCode, "auth_oauth_authorization_code"));
+    const oauthClientSecret = makeAuthOAuthClientSecretTable(authSqliteTableName(names.oauthClientSecret, "auth_oauth_client_secret"));
+    const oauthProviderModeToken = makeAuthOAuthProviderModeTokenTable(authSqliteTableName(names.oauthProviderModeToken, "auth_oauth_provider_mode_token"));
+    const oauthProviderTokenVault = makeAuthOAuthProviderTokenVaultTable(names.oauthProviderTokenVault ?? "auth_oauth_provider_token_vault");
+    const domainVerification = makeAuthDomainVerificationTable(authSqliteTableName(names.domainVerification, "auth_domain_verification"));
+    const securityTimeline = makeAuthSecurityTimelineTable(names.securityTimeline ?? "auth_security_timeline");
+    const webhookOutbox = makeAuthWebhookOutboxTable(names.webhookOutbox ?? "auth_webhook_outbox");
+    const webhookReplay = makeAuthWebhookReplayTable(names.webhookReplay ?? "auth_webhook_replay");
+    return {
+        user: {
+            table: user,
+            select: {
+                id: user.id,
+                email: user.email,
+                emailVerified: user.email_verified,
+                createdAt: user.created_at,
+                updatedAt: user.updated_at,
+                disabledAt: user.disabled_at,
+                metadata: user.metadata,
+            },
+            insert: userInsert,
+            markEmailVerified: userMarkEmailVerifiedUpdate,
+        },
+        credential: {
+            table: credential,
+            select: {
+                id: credential.id,
+                userId: credential.user_id,
+                type: credential.type,
+                passwordHash: credential.password_hash,
+                createdAt: credential.created_at,
+                updatedAt: credential.updated_at,
+                revokedAt: credential.revoked_at,
+                metadata: credential.metadata,
+            },
+            insertPassword: passwordCredentialInsert,
+            updatePassword: passwordCredentialUpdatePassword,
+        },
+        session: {
+            table: session,
+            select: {
+                id: session.id,
+                userId: session.user_id,
+                secretHash: session.secret_hash,
+                createdAt: session.created_at,
+                expiresAt: session.expires_at,
+                authTime: session.auth_time,
+                aal: session.aal,
+                amr: session.amr,
+                mfaVerifiedAt: session.mfa_verified_at,
+                metadata: session.metadata,
+                revokedAt: session.revoked_at,
+                lastSeenAt: session.last_seen_at,
+                rotatedAt: session.rotated_at,
+            },
+            insert: sessionInsert,
+            refresh: sessionRefreshUpdate,
+            rotate: sessionRotateUpdate,
+            updateClaims: sessionUpdateClaimsUpdate,
+            revoke: sessionRevokeUpdate,
+        },
+        verification: {
+            table: verification,
+            select: {
+                id: verification.id,
+                type: verification.type,
+                subject: verification.subject,
+                secretHash: verification.secret_hash,
+                createdAt: verification.created_at,
+                expiresAt: verification.expires_at,
+                metadata: verification.metadata,
+                consumedAt: verification.consumed_at,
+            },
+            insert: verificationInsert,
+            consume: verificationConsumeUpdate,
+        },
+        auditLog: {
+            table: auditLog,
+            select: {
+                id: auditLog.id,
+                type: auditLog.type,
+                userId: auditLog.user_id,
+                actorUserId: auditLog.actor_user_id,
+                occurredAt: auditLog.occurred_at,
+                requestIpHash: auditLog.request_ip_hash,
+                requestUserAgentHash: auditLog.request_user_agent_hash,
+                event: auditLog.event,
+                createdAt: auditLog.created_at,
+            },
+            insert: auditLogInsert,
+        },
+        loginApprovalReview: {
+            table: loginApprovalReview,
+            select: {
+                approvalChallengeId: loginApprovalReview.approval_challenge_id,
+                flowId: loginApprovalReview.flow_id,
+                userId: loginApprovalReview.user_id,
+                channel: loginApprovalReview.channel,
+                reason: loginApprovalReview.reason,
+                sessionBinding: loginApprovalReview.session_binding,
+                sameDeviceRequired: loginApprovalReview.same_device_required,
+                status: loginApprovalReview.status,
+                createdAt: loginApprovalReview.created_at,
+                expiresAt: loginApprovalReview.expires_at,
+                reviewedAt: loginApprovalReview.reviewed_at,
+                reviewedBy: loginApprovalReview.reviewed_by,
+                deniedReason: loginApprovalReview.denied_reason,
+                risk: loginApprovalReview.risk,
+                metadata: loginApprovalReview.metadata,
+                reviewMetadata: loginApprovalReview.review_metadata,
+            },
+            insertPending: loginApprovalReviewInsert,
+            approve: loginApprovalReviewApproveUpdate,
+            deny: loginApprovalReviewDenyUpdate,
+        },
+        loginRiskHistory: {
+            table: loginRiskHistory,
+            select: {
+                id: loginRiskHistory.id,
+                userId: loginRiskHistory.user_id,
+                occurredAt: loginRiskHistory.occurred_at,
+                outcome: loginRiskHistory.outcome,
+                method: loginRiskHistory.method,
+                amr: loginRiskHistory.amr,
+                aal: loginRiskHistory.aal,
+                deviceStatus: loginRiskHistory.device_status,
+                deviceKey: loginRiskHistory.device_key,
+                locationKey: loginRiskHistory.location_key,
+                country: loginRiskHistory.country,
+                region: loginRiskHistory.region,
+                latitudeMicro: loginRiskHistory.latitude_micro,
+                longitudeMicro: loginRiskHistory.longitude_micro,
+                riskLevel: loginRiskHistory.risk_level,
+                createdAt: loginRiskHistory.created_at,
+            },
+            insert: loginRiskHistoryInsert,
+        },
+        trustedDevice: {
+            table: trustedDevice,
+            select: {
+                userId: trustedDevice.user_id,
+                tokenHash: trustedDevice.token_hash,
+                createdAt: trustedDevice.created_at,
+                lastSeenAt: trustedDevice.last_seen_at,
+                expiresAt: trustedDevice.expires_at,
+                metadata: trustedDevice.metadata,
+            },
+            insert: trustedDeviceInsert,
+            update: trustedDeviceUpdate,
+        },
+        passkeyCredential: {
+            table: passkeyCredential,
+            select: {
+                id: passkeyCredential.id,
+                userId: passkeyCredential.user_id,
+                credentialId: passkeyCredential.credential_id,
+                publicKey: passkeyCredential.public_key,
+                signCount: passkeyCredential.sign_count,
+                transports: passkeyCredential.transports,
+                backedUp: passkeyCredential.backed_up,
+                createdAt: passkeyCredential.created_at,
+                lastUsedAt: passkeyCredential.last_used_at,
+                revokedAt: passkeyCredential.revoked_at,
+                metadata: passkeyCredential.metadata,
+            },
+            insert: passkeyCredentialInsert,
+            updateSignCount: passkeyCredentialUpdateSignCount,
+            revoke: passkeyCredentialRevoke,
+        },
+        totpFactor: {
+            table: totpFactor,
+            select: {
+                id: totpFactor.id,
+                userId: totpFactor.user_id,
+                secret: totpFactor.secret,
+                algorithm: totpFactor.algorithm,
+                digits: totpFactor.digits,
+                period: totpFactor.period,
+                createdAt: totpFactor.created_at,
+                confirmedAt: totpFactor.confirmed_at,
+                lastUsedAt: totpFactor.last_used_at,
+                revokedAt: totpFactor.revoked_at,
+                metadata: totpFactor.metadata,
+            },
+            insert: totpFactorInsert,
+            confirm: totpFactorConfirm,
+            markUsed: totpFactorMarkUsed,
+            revoke: totpFactorRevoke,
+        },
+        recoveryCode: {
+            table: recoveryCode,
+            select: {
+                id: recoveryCode.id,
+                userId: recoveryCode.user_id,
+                codeHash: recoveryCode.code_hash,
+                createdAt: recoveryCode.created_at,
+                usedAt: recoveryCode.used_at,
+                revokedAt: recoveryCode.revoked_at,
+                metadata: recoveryCode.metadata,
+            },
+            insert: recoveryCodeInsert,
+            markUsed: recoveryCodeMarkUsed,
+            revoke: recoveryCodeRevoke,
+        },
+        apiKey: {
+            table: apiKey,
+            select: {
+                id: apiKey.id,
+                userId: apiKey.user_id,
+                prefix: apiKey.prefix,
+                secretHash: apiKey.secret_hash,
+                scopes: apiKey.scopes,
+                createdAt: apiKey.created_at,
+                expiresAt: apiKey.expires_at,
+                lastUsedAt: apiKey.last_used_at,
+                revokedAt: apiKey.revoked_at,
+                metadata: apiKey.metadata,
+            },
+            insert: apiKeyInsert,
+            markUsed: apiKeyMarkUsed,
+            revoke: apiKeyRevoke,
+        },
+        refreshToken: {
+            table: refreshToken,
+            select: {
+                id: refreshToken.id,
+                familyId: refreshToken.family_id,
+                userId: refreshToken.user_id,
+                secretHash: refreshToken.secret_hash,
+                createdAt: refreshToken.created_at,
+                expiresAt: refreshToken.expires_at,
+                lastUsedAt: refreshToken.last_used_at,
+                rotatedAt: refreshToken.rotated_at,
+                replacedById: refreshToken.replaced_by_id,
+                revokedAt: refreshToken.revoked_at,
+                reuseDetectedAt: refreshToken.reuse_detected_at,
+                metadata: refreshToken.metadata,
+            },
+            insert: refreshTokenInsert,
+            rotate: refreshTokenRotate,
+            markReuseDetected: refreshTokenMarkReuseDetected,
+            revoke: refreshTokenRevoke,
+            revokeFamily: refreshTokenRevokeFamily,
+        },
+        jwtRevocation: {
+            table: jwtRevocation,
+            select: {
+                jwtId: jwtRevocation.jwt_id,
+                revokedAt: jwtRevocation.revoked_at,
+                expiresAt: jwtRevocation.expires_at,
+                reason: jwtRevocation.reason,
+            },
+            insert: jwtRevocationInsert,
+            update: jwtRevocationUpdate,
+        },
+        oauthAccount: {
+            table: oauthAccount,
+            select: {
+                id: oauthAccount.id,
+                providerId: oauthAccount.provider_id,
+                providerAccountId: oauthAccount.provider_account_id,
+                userId: oauthAccount.user_id,
+                email: oauthAccount.email,
+                emailVerified: oauthAccount.email_verified,
+                createdAt: oauthAccount.created_at,
+                updatedAt: oauthAccount.updated_at,
+                unlinkedAt: oauthAccount.unlinked_at,
+                metadata: oauthAccount.metadata,
+            },
+            insert: oauthAccountInsert,
+            unlink: oauthAccountUnlink,
+        },
+        oauthClient: {
+            table: oauthClient,
+            select: {
+                id: oauthClient.id,
+                type: oauthClient.type,
+                status: oauthClient.status,
+                name: oauthClient.name,
+                redirectUris: oauthClient.redirect_uris,
+                allowedGrantTypes: oauthClient.allowed_grant_types,
+                allowedResponseTypes: oauthClient.allowed_response_types,
+                allowedScopes: oauthClient.allowed_scopes,
+                createdAt: oauthClient.created_at,
+                updatedAt: oauthClient.updated_at,
+                metadata: oauthClient.metadata,
+            },
+            insert: oauthClientValues,
+            update: oauthClientValues,
+        },
+        oauthConsent: {
+            table: oauthConsent,
+            select: {
+                id: oauthConsent.id,
+                userId: oauthConsent.user_id,
+                clientId: oauthConsent.client_id,
+                scopes: oauthConsent.scopes,
+                grantedAt: oauthConsent.granted_at,
+                expiresAt: oauthConsent.expires_at,
+                revokedAt: oauthConsent.revoked_at,
+                metadata: oauthConsent.metadata,
+            },
+            insert: oauthConsentValues,
+            update: oauthConsentValues,
+            revoke: oauthConsentRevoke,
+        },
+        oauthAuthorizationCode: {
+            table: oauthAuthorizationCode,
+            select: {
+                codeHash: oauthAuthorizationCode.code_hash,
+                clientId: oauthAuthorizationCode.client_id,
+                subject: oauthAuthorizationCode.subject,
+                redirectUri: oauthAuthorizationCode.redirect_uri,
+                scopes: oauthAuthorizationCode.scopes,
+                codeChallenge: oauthAuthorizationCode.code_challenge,
+                codeChallengeMethod: oauthAuthorizationCode.code_challenge_method,
+                issuedAt: oauthAuthorizationCode.issued_at,
+                expiresAt: oauthAuthorizationCode.expires_at,
+                consumedAt: oauthAuthorizationCode.consumed_at,
+                metadata: oauthAuthorizationCode.metadata,
+            },
+            insert: oauthAuthorizationCodeValues,
+            update: oauthAuthorizationCodeValues,
+            markConsumed: oauthAuthorizationCodeMarkConsumed,
+        },
+        oauthClientSecret: {
+            table: oauthClientSecret,
+            select: {
+                prefix: oauthClientSecret.prefix,
+                clientId: oauthClientSecret.client_id,
+                secretHash: oauthClientSecret.secret_hash,
+                authenticationMethods: oauthClientSecret.authentication_methods,
+                createdAt: oauthClientSecret.created_at,
+                expiresAt: oauthClientSecret.expires_at,
+                lastUsedAt: oauthClientSecret.last_used_at,
+                revokedAt: oauthClientSecret.revoked_at,
+                metadata: oauthClientSecret.metadata,
+            },
+            insert: oauthClientSecretValues,
+            update: oauthClientSecretValues,
+            markUsed: oauthClientSecretMarkUsed,
+            revoke: oauthClientSecretRevoke,
+        },
+        oauthProviderModeToken: {
+            table: oauthProviderModeToken,
+            select: {
+                tokenHash: oauthProviderModeToken.token_hash,
+                tokenType: oauthProviderModeToken.token_type,
+                clientId: oauthProviderModeToken.client_id,
+                subject: oauthProviderModeToken.subject,
+                scopes: oauthProviderModeToken.scopes,
+                issuedAt: oauthProviderModeToken.issued_at,
+                expiresAt: oauthProviderModeToken.expires_at,
+                issuer: oauthProviderModeToken.issuer,
+                audience: oauthProviderModeToken.audience,
+                jwtId: oauthProviderModeToken.jwt_id,
+                revokedAt: oauthProviderModeToken.revoked_at,
+                revocationReason: oauthProviderModeToken.revocation_reason,
+                rotatedAt: oauthProviderModeToken.rotated_at,
+                replacedByTokenHash: oauthProviderModeToken.replaced_by_token_hash,
+                metadata: oauthProviderModeToken.metadata,
+            },
+            insert: oauthProviderModeTokenValues,
+            update: oauthProviderModeTokenValues,
+            revoke: oauthProviderModeTokenRevoke,
+            rotate: oauthProviderModeTokenRotate,
+        },
+        oauthProviderTokenVault: {
+            table: oauthProviderTokenVault,
+            select: {
+                accountId: oauthProviderTokenVault.account_id,
+                userId: oauthProviderTokenVault.user_id,
+                providerId: oauthProviderTokenVault.provider_id,
+                providerAccountId: oauthProviderTokenVault.provider_account_id,
+                accessTokenCiphertext: oauthProviderTokenVault.access_token_ciphertext,
+                refreshTokenCiphertext: oauthProviderTokenVault.refresh_token_ciphertext,
+                idTokenCiphertext: oauthProviderTokenVault.id_token_ciphertext,
+                tokenType: oauthProviderTokenVault.token_type,
+                scopes: oauthProviderTokenVault.scopes,
+                expiresAt: oauthProviderTokenVault.expires_at,
+                updatedAt: oauthProviderTokenVault.updated_at,
+                revokedAt: oauthProviderTokenVault.revoked_at,
+                revocationReason: oauthProviderTokenVault.revocation_reason,
+            },
+            insert: oauthProviderTokenVaultValues,
+            update: oauthProviderTokenVaultValues,
+            markRevoked: oauthProviderTokenVaultMarkRevoked,
+        },
+        domainVerification: {
+            table: domainVerification,
+            select: {
+                id: domainVerification.id,
+                ownerId: domainVerification.owner_id,
+                domain: domainVerification.domain,
+                proofMethod: domainVerification.proof_method,
+                proofToken: domainVerification.proof_token,
+                status: domainVerification.status,
+                createdAt: domainVerification.created_at,
+                expiresAt: domainVerification.expires_at,
+                verifiedAt: domainVerification.verified_at,
+                revokedAt: domainVerification.revoked_at,
+                lastCheckedAt: domainVerification.last_checked_at,
+                metadata: domainVerification.metadata,
+            },
+            insert: domainVerificationValues,
+            update: domainVerificationValues,
+            markVerified: domainVerificationMarkVerified,
+            revoke: domainVerificationRevoke,
+        },
+        securityTimeline: {
+            table: securityTimeline,
+            select: {
+                id: securityTimeline.id,
+                userId: securityTimeline.user_id,
+                type: securityTimeline.type,
+                category: securityTimeline.category,
+                severity: securityTimeline.severity,
+                occurredAt: securityTimeline.occurred_at,
+                summary: securityTimeline.summary,
+                actor: securityTimeline.actor,
+                request: securityTimeline.request,
+                metadata: securityTimeline.metadata,
+            },
+            insert: securityTimelineInsert,
+        },
+        webhookOutbox: {
+            table: webhookOutbox,
+            select: {
+                id: webhookOutbox.id,
+                endpointKey: webhookOutbox.endpoint_key,
+                event: webhookOutbox.event,
+                status: webhookOutbox.status,
+                attempts: webhookOutbox.attempts,
+                nextAttemptAt: webhookOutbox.next_attempt_at,
+                createdAt: webhookOutbox.created_at,
+                updatedAt: webhookOutbox.updated_at,
+                deliveredAt: webhookOutbox.delivered_at,
+                lastError: webhookOutbox.last_error,
+            },
+            insert: webhookOutboxInsert,
+            markDelivered: webhookOutboxMarkDelivered,
+            markFailed: webhookOutboxMarkFailed,
+            markDeadLettered: webhookOutboxMarkDeadLettered,
+        },
+        webhookReplay: {
+            table: webhookReplay,
+            select: {
+                id: webhookReplay.id,
+                expiresAt: webhookReplay.expires_at,
+                createdAt: webhookReplay.created_at,
+            },
+            insert: webhookReplayInsert,
+            update: webhookReplayUpdate,
+        },
+    };
+};
+const asAuthSqliteTables = (tables) => tables;
+export const defineEffectQbAuthTables = (tables) => asAuthSqliteTables(tables);
+export const makeAuthSqliteTables = (names = {}) => asAuthSqliteTables(makeInternalAuthSqliteTables(names));
+export const authSqliteTables = makeAuthSqliteTables();
+const selectUserColumns = (tables) => tables.user.select;
+const selectCredentialColumns = (tables) => tables.credential.select;
+const selectSessionColumns = (tables) => tables.session.select;
+const selectVerificationColumns = (tables) => tables.verification.select;
+const selectAuditLogColumns = (tables) => tables.auditLog.select;
+const selectLoginApprovalReviewColumns = (tables) => tables.loginApprovalReview.select;
+const selectLoginRiskHistoryColumns = (tables) => tables.loginRiskHistory.select;
+const selectTrustedDeviceColumns = (tables) => tables.trustedDevice.select;
+const selectPasskeyCredentialColumns = (tables) => tables.passkeyCredential.select;
+const selectTotpFactorColumns = (tables) => tables.totpFactor.select;
+const selectRecoveryCodeColumns = (tables) => tables.recoveryCode.select;
+const selectApiKeyColumns = (tables) => tables.apiKey.select;
+const selectRefreshTokenColumns = (tables) => tables.refreshToken.select;
+const selectJwtRevocationColumns = (tables) => tables.jwtRevocation.select;
+const selectOAuthAccountColumns = (tables) => tables.oauthAccount.select;
+const selectOAuthClientColumns = (tables) => tables.oauthClient.select;
+const selectOAuthConsentColumns = (tables) => tables.oauthConsent.select;
+const selectOAuthAuthorizationCodeColumns = (tables) => tables.oauthAuthorizationCode.select;
+const selectOAuthClientSecretColumns = (tables) => tables.oauthClientSecret.select;
+const selectOAuthProviderModeTokenColumns = (tables) => tables.oauthProviderModeToken.select;
+const selectOAuthProviderTokenVaultColumns = (tables) => tables.oauthProviderTokenVault.select;
+const selectDomainVerificationColumns = (tables) => tables.domainVerification.select;
+const selectSecurityTimelineColumns = (tables) => tables.securityTimeline.select;
+const selectWebhookOutboxColumns = (tables) => tables.webhookOutbox.select;
+const selectWebhookReplayColumns = (tables) => tables.webhookReplay.select;
+const storageError = (entity, operation, cause) => StorageError.fromUnknown(entity, operation, cause);
+const auditLogStoreError = (operation, cause) => new AuditLogStoreError({
+    operation,
+    message: `Audit log ${operation} failed`,
+    cause,
+});
+const loginApprovalReviewStoreError = (operation, cause) => new LoginApprovalReviewError({
+    message: `Login approval review ${operation} failed`,
+    cause,
+});
+const loginRiskHistoryStoreError = (operation, cause) => new LoginRiskHistoryError({
+    operation,
+    message: `Login risk history ${operation} failed`,
+    cause,
+});
+const trustedDeviceStoreError = (operation, cause) => new TrustedDeviceError({
+    operation,
+    message: `Trusted device ${operation} failed`,
+    cause,
+});
+const passkeyCredentialStoreError = (operation, cause) => new PasskeyCredentialStoreError({
+    operation,
+    message: `Passkey credential ${operation} failed`,
+    cause,
+});
+const totpFactorStoreError = (operation, cause) => new TotpFactorStoreError({
+    operation,
+    message: `TOTP factor ${operation} failed`,
+    cause,
+});
+const recoveryCodeStoreError = (operation, cause) => new RecoveryCodeStoreError({
+    operation,
+    message: `Recovery code ${operation} failed`,
+    cause,
+});
+const apiKeyStoreError = (operation, cause) => new ApiKeyStoreError({
+    operation,
+    message: `API key ${operation} failed`,
+    cause,
+});
+const refreshTokenStoreError = (operation, cause) => new RefreshTokenStoreError({
+    operation,
+    message: `Refresh token ${operation} failed`,
+    cause,
+});
+const jwtRevocationStoreError = (operation, cause) => new JwtError({
+    operation: "revocation",
+    message: `JWT revocation ${operation} failed`,
+    cause,
+});
+const oauthAccountStoreError = (operation, cause) => new OAuthAccountStoreError({
+    operation,
+    message: `OAuth account ${operation} failed`,
+    cause,
+});
+const oauthClientStoreError = (operation, cause) => new OAuthClientStoreError({
+    operation,
+    message: `OAuth client ${operation} failed`,
+    cause,
+});
+const oauthConsentStoreError = (operation, cause) => new OAuthConsentStoreError({
+    operation,
+    message: `OAuth consent ${operation} failed`,
+    cause,
+});
+const oauthAuthorizationCodeStoreError = (operation, cause) => new OAuthAuthorizationCodeStoreError({
+    operation,
+    message: `OAuth authorization code ${operation} failed`,
+    cause,
+});
+const oauthClientSecretStoreError = (operation, cause) => new OAuthClientSecretStoreError({
+    operation,
+    message: `OAuth client secret ${operation} failed`,
+    cause,
+});
+const oauthProviderModeTokenStoreError = (operation, cause) => new OAuthProviderModeTokenStoreError({
+    operation,
+    message: `OAuth provider-mode token ${operation} failed`,
+    cause,
+});
+const oauthProviderTokenVaultError = (operation, cause) => new OAuthProviderTokenVaultError({
+    operation,
+    message: `OAuth provider token vault ${operation} failed`,
+    cause,
+});
+const domainVerificationStoreError = (operation, cause) => new DomainVerificationStoreError({
+    operation,
+    message: `Domain verification ${operation} failed`,
+    cause,
+});
+const securityTimelineStoreError = (operation, cause) => new SecurityTimelineStoreError({
+    operation,
+    message: `Security timeline ${operation} failed`,
+    cause,
+});
+const webhookOutboxStoreError = (operation, cause) => new WebhookOutboxStoreError({
+    operation,
+    message: `Webhook outbox ${operation} failed`,
+    cause,
+});
+const webhookReplayStoreError = (operation, cause) => new WebhookReplayStoreError({
+    operation,
+    message: `Webhook replay ${operation} failed`,
+    cause,
+});
+const findUserById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectUserColumns(tables)).pipe(Query.from(tables.user.table), Query.where(queryEq(tables.user.select.id, id)))).pipe(Effect.mapError((cause) => storageError("user", operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeUserRow(tables, rows[0]))));
+const findUserByEmail = (executor, tables, email, operation = "find") => executePlan(executor, Query.select(selectUserColumns(tables)).pipe(Query.from(tables.user.table), Query.where(queryEq(tables.user.select.email, email)))).pipe(Effect.mapError((cause) => storageError("user", operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeUserRow(tables, rows[0]))));
+const findPasswordCredentialByUserId = (executor, tables, userId, operation = "find") => executePlan(executor, Query.select(selectCredentialColumns(tables)).pipe(Query.from(tables.credential.table), Query.where(queryEq(tables.credential.select.userId, userId)), Query.where(queryEq(tables.credential.select.type, "password")))).pipe(Effect.mapError((cause) => storageError("credential", operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodePasswordCredentialRow(tables, rows[0]))));
+const findJwtRevocation = (executor, tables, jwtId, operation = "find") => executePlan(executor, Query.select(selectJwtRevocationColumns(tables)).pipe(Query.from(tables.jwtRevocation.table), Query.where(queryEq(tables.jwtRevocation.select.jwtId, jwtId)))).pipe(Effect.mapError((cause) => jwtRevocationStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeJwtRevocationRow(tables, rows[0]))));
+const findSessionById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectSessionColumns(tables)).pipe(Query.from(tables.session.table), Query.where(queryEq(tables.session.select.id, id)))).pipe(Effect.mapError((cause) => storageError("session", operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeSessionRow(tables, rows[0]))));
+const listSessionsByUser = (executor, tables, input, operation = "listByUser") => executePlan(executor, Query.select(selectSessionColumns(tables)).pipe(Query.from(tables.session.table), Query.where(queryEq(tables.session.select.userId, input.userId)))).pipe(Effect.mapError((cause) => storageError("session", operation, cause)), Effect.map((rows) => rows.map((row) => decodeSessionRow(tables, row))));
+const findVerificationById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectVerificationColumns(tables)).pipe(Query.from(tables.verification.table), Query.where(queryEq(tables.verification.select.id, id)))).pipe(Effect.mapError((cause) => storageError("verification", operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeVerificationRow(tables, rows[0]))));
+const findLoginApprovalReviewByApprovalChallengeId = (executor, tables, input, operation = "find") => executePlan(executor, Query.select(selectLoginApprovalReviewColumns(tables)).pipe(Query.from(tables.loginApprovalReview.table), Query.where(queryEq(tables.loginApprovalReview.select.approvalChallengeId, input.approvalChallengeId)))).pipe(Effect.mapError((cause) => loginApprovalReviewStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeLoginApprovalReviewRow(tables, rows[0]))));
+const findTrustedDevice = (executor, tables, input, operation = "status") => executePlan(executor, Query.select(selectTrustedDeviceColumns(tables)).pipe(Query.from(tables.trustedDevice.table), Query.where(queryEq(tables.trustedDevice.select.userId, input.userId)), Query.where(queryEq(tables.trustedDevice.select.tokenHash, input.tokenHash)), Query.where(queryGt(tables.trustedDevice.select.expiresAt, Number(input.now))))).pipe(Effect.mapError((cause) => trustedDeviceStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeTrustedDeviceRow(tables, rows[0]))));
+const findTrustedDeviceIncludingExpired = (executor, tables, input) => executePlan(executor, Query.select(selectTrustedDeviceColumns(tables)).pipe(Query.from(tables.trustedDevice.table), Query.where(queryEq(tables.trustedDevice.select.userId, input.userId)), Query.where(queryEq(tables.trustedDevice.select.tokenHash, input.tokenHash)))).pipe(Effect.mapError((cause) => trustedDeviceStoreError("trust", cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeTrustedDeviceRow(tables, rows[0]))));
+const listTrustedDevicesForUser = (executor, tables, input, operation = "list") => executePlan(executor, Query.select(selectTrustedDeviceColumns(tables)).pipe(Query.from(tables.trustedDevice.table), Query.where(queryEq(tables.trustedDevice.select.userId, input.userId)), Query.where(queryGt(tables.trustedDevice.select.expiresAt, Number(input.now))))).pipe(Effect.mapError((cause) => trustedDeviceStoreError(operation, cause)), Effect.map((rows) => filterTrustedDevicesForUser(rows.map((row) => decodeTrustedDeviceRow(tables, row)), input)));
+const findPasskeyCredentialByCredentialId = (executor, tables, credentialId, operation = "find") => executePlan(executor, Query.select(selectPasskeyCredentialColumns(tables)).pipe(Query.from(tables.passkeyCredential.table), Query.where(queryEq(tables.passkeyCredential.select.credentialId, credentialId)))).pipe(Effect.mapError((cause) => passkeyCredentialStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodePasskeyCredentialRow(tables, rows[0]))));
+const findTotpFactorById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectTotpFactorColumns(tables)).pipe(Query.from(tables.totpFactor.table), Query.where(queryEq(tables.totpFactor.select.id, id)))).pipe(Effect.mapError((cause) => totpFactorStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeTotpFactorRow(tables, rows[0]))));
+const findRecoveryCodeById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectRecoveryCodeColumns(tables)).pipe(Query.from(tables.recoveryCode.table), Query.where(queryEq(tables.recoveryCode.select.id, id)))).pipe(Effect.mapError((cause) => recoveryCodeStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeRecoveryCodeRow(tables, rows[0]))));
+const findApiKeyById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectApiKeyColumns(tables)).pipe(Query.from(tables.apiKey.table), Query.where(queryEq(tables.apiKey.select.id, id)))).pipe(Effect.mapError((cause) => apiKeyStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeApiKeyRow(tables, rows[0]))));
+const findApiKeyByPrefix = (executor, tables, prefix, operation = "find") => executePlan(executor, Query.select(selectApiKeyColumns(tables)).pipe(Query.from(tables.apiKey.table), Query.where(queryEq(tables.apiKey.select.prefix, prefix)))).pipe(Effect.mapError((cause) => apiKeyStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeApiKeyRow(tables, rows[0]))));
+const findRefreshTokenById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectRefreshTokenColumns(tables)).pipe(Query.from(tables.refreshToken.table), Query.where(queryEq(tables.refreshToken.select.id, id)))).pipe(Effect.mapError((cause) => refreshTokenStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeRefreshTokenRow(tables, rows[0]))));
+const findRefreshTokenBySecretHash = (executor, tables, hash, operation = "find") => executePlan(executor, Query.select(selectRefreshTokenColumns(tables)).pipe(Query.from(tables.refreshToken.table), Query.where(queryEq(tables.refreshToken.select.secretHash, hash)))).pipe(Effect.mapError((cause) => refreshTokenStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeRefreshTokenRow(tables, rows[0]))));
+const findOAuthAccountById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectOAuthAccountColumns(tables)).pipe(Query.from(tables.oauthAccount.table), Query.where(queryEq(tables.oauthAccount.select.id, id)))).pipe(Effect.mapError((cause) => oauthAccountStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeOAuthAccountRow(tables, rows[0]))));
+const findOAuthAccountByProviderAccount = (executor, tables, input, operation = "find") => {
+    const base = Query.select(selectOAuthAccountColumns(tables)).pipe(Query.from(tables.oauthAccount.table), Query.where(queryEq(tables.oauthAccount.select.providerId, input.providerId)), Query.where(queryEq(tables.oauthAccount.select.providerAccountId, input.providerAccountId)));
+    const query = input.includeUnlinked === true
+        ? base
+        : base.pipe(Query.where(queryIsNull(tables.oauthAccount.select.unlinkedAt)));
+    return executePlan(executor, query).pipe(Effect.mapError((cause) => oauthAccountStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+        ? Option.none()
+        : Option.some(decodeOAuthAccountRow(tables, rows[0]))));
+};
+const findOAuthClientById = (executor, tables, input, operation = "find") => executePlan(executor, Query.select(selectOAuthClientColumns(tables)).pipe(Query.from(tables.oauthClient.table), Query.where(queryEq(tables.oauthClient.select.id, input.clientId)))).pipe(Effect.mapError((cause) => oauthClientStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeOAuthClientRow(tables, rows[0]))));
+const findOAuthConsentByUserAndClient = (executor, tables, input, operation = "find-active") => executePlan(executor, Query.select(selectOAuthConsentColumns(tables)).pipe(Query.from(tables.oauthConsent.table), Query.where(queryEq(tables.oauthConsent.select.userId, input.userId)), Query.where(queryEq(tables.oauthConsent.select.clientId, input.clientId)))).pipe(Effect.mapError((cause) => oauthConsentStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeOAuthConsentRow(tables, rows[0]))));
+const deleteOAuthConsentRowsBefore = (executor, tables, column, before) => executePlan(executor, Query.delete(tables.oauthConsent.table).pipe(Query.where(queryLt(column, Number(before))), Query.returning({ id: tables.oauthConsent.select.id }))).pipe(Effect.map((rows) => rows.length));
+const deleteOAuthInactiveConsents = (executor, tables, input) => Effect.gen(function* () {
+    const expiredDeleted = input.beforeExpiresAt === undefined
+        ? 0
+        : yield* deleteOAuthConsentRowsBefore(executor, tables, tables.oauthConsent.select.expiresAt, input.beforeExpiresAt);
+    const revokedDeleted = input.beforeRevokedAt === undefined
+        ? 0
+        : yield* deleteOAuthConsentRowsBefore(executor, tables, tables.oauthConsent.select.revokedAt, input.beforeRevokedAt);
+    return expiredDeleted + revokedDeleted;
+}).pipe(Effect.mapError((cause) => oauthConsentStoreError("deleteInactive", cause)));
+const findOAuthAuthorizationCodeByHash = (executor, tables, input, operation = "find") => executePlan(executor, Query.select(selectOAuthAuthorizationCodeColumns(tables)).pipe(Query.from(tables.oauthAuthorizationCode.table), Query.where(queryEq(tables.oauthAuthorizationCode.select.codeHash, input.codeHash)))).pipe(Effect.mapError((cause) => oauthAuthorizationCodeStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeOAuthAuthorizationCodeRow(tables, rows[0]))));
+const findOAuthClientSecretByClientIdAndPrefix = (executor, tables, input, operation = "find") => executePlan(executor, Query.select(selectOAuthClientSecretColumns(tables)).pipe(Query.from(tables.oauthClientSecret.table), Query.where(queryEq(tables.oauthClientSecret.select.clientId, input.clientId)), Query.where(queryEq(tables.oauthClientSecret.select.prefix, input.prefix)))).pipe(Effect.mapError((cause) => oauthClientSecretStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeOAuthClientSecretRow(tables, rows[0]))));
+const findOAuthProviderModeTokenByHash = (executor, tables, input, operation = "find") => executePlan(executor, Query.select(selectOAuthProviderModeTokenColumns(tables)).pipe(Query.from(tables.oauthProviderModeToken.table), Query.where(queryEq(tables.oauthProviderModeToken.select.tokenHash, input.tokenHash)))).pipe(Effect.mapError((cause) => oauthProviderModeTokenStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeOAuthProviderModeTokenRow(tables, rows[0]))));
+const deleteOAuthProviderModeTokenRowsBefore = (executor, tables, column, before) => executePlan(executor, Query.delete(tables.oauthProviderModeToken.table).pipe(Query.where(queryLt(column, Number(before))), Query.returning({ tokenHash: tables.oauthProviderModeToken.select.tokenHash }))).pipe(Effect.map((rows) => rows.length));
+const deleteOAuthProviderModeRetiredTokens = (executor, tables, input) => Effect.gen(function* () {
+    const expiredDeleted = input.beforeExpiresAt === undefined
+        ? 0
+        : yield* deleteOAuthProviderModeTokenRowsBefore(executor, tables, tables.oauthProviderModeToken.select.expiresAt, input.beforeExpiresAt);
+    const revokedDeleted = input.beforeRevokedAt === undefined
+        ? 0
+        : yield* deleteOAuthProviderModeTokenRowsBefore(executor, tables, tables.oauthProviderModeToken.select.revokedAt, input.beforeRevokedAt);
+    const rotatedDeleted = input.beforeRotatedAt === undefined
+        ? 0
+        : yield* deleteOAuthProviderModeTokenRowsBefore(executor, tables, tables.oauthProviderModeToken.select.rotatedAt, input.beforeRotatedAt);
+    return expiredDeleted + revokedDeleted + rotatedDeleted;
+}).pipe(Effect.mapError((cause) => oauthProviderModeTokenStoreError("deleteRetired", cause)));
+const findOAuthProviderTokenVaultRecordByAccountId = (executor, tables, input, operation, includeRevoked = false) => {
+    const base = Query.select(selectOAuthProviderTokenVaultColumns(tables)).pipe(Query.from(tables.oauthProviderTokenVault.table), Query.where(queryEq(tables.oauthProviderTokenVault.select.accountId, input.accountId)));
+    const query = includeRevoked
+        ? base
+        : base.pipe(Query.where(queryIsNull(tables.oauthProviderTokenVault.select.revokedAt)));
+    return executePlan(executor, query).pipe(Effect.mapError((cause) => oauthProviderTokenVaultError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+        ? Option.none()
+        : Option.some(decodeOAuthProviderTokenVaultRow(tables, rows[0]))));
+};
+const findDomainVerificationById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectDomainVerificationColumns(tables)).pipe(Query.from(tables.domainVerification.table), Query.where(queryEq(tables.domainVerification.select.id, id)))).pipe(Effect.mapError((cause) => domainVerificationStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeDomainVerificationRecord(tables, rows[0]))));
+const findDomainVerificationByOwnerAndDomain = (executor, tables, input, operation = "find") => executePlan(executor, Query.select(selectDomainVerificationColumns(tables)).pipe(Query.from(tables.domainVerification.table), Query.where(queryEq(tables.domainVerification.select.ownerId, input.ownerId)), Query.where(queryEq(tables.domainVerification.select.domain, input.domain)))).pipe(Effect.mapError((cause) => domainVerificationStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeDomainVerificationRecord(tables, rows[0]))));
+const listSecurityTimelineByUser = (executor, tables, input, operation = "list") => executePlan(executor, Query.select(selectSecurityTimelineColumns(tables)).pipe(Query.from(tables.securityTimeline.table), Query.where(queryEq(tables.securityTimeline.select.userId, input.userId)))).pipe(Effect.mapError((cause) => securityTimelineStoreError(operation, cause)), Effect.map((rows) => filterSecurityTimelineEvents(rows.map((row) => decodeSecurityTimelineEvent(tables, row)), input)));
+const deleteSecurityTimelineBefore = (executor, tables, input) => {
+    const base = Query.delete(tables.securityTimeline.table).pipe(Query.where(queryLt(tables.securityTimeline.select.occurredAt, Number(input.beforeOccurredAt))));
+    const query = input.userId === undefined
+        ? base
+        : base.pipe(Query.where(queryEq(tables.securityTimeline.select.userId, input.userId)));
+    return executePlan(executor, query.pipe(Query.returning({ id: tables.securityTimeline.select.id }))).pipe(Effect.mapError((cause) => securityTimelineStoreError("deleteBefore", cause)), Effect.map((rows) => rows.length));
+};
+const findWebhookOutboxRecordById = (executor, tables, id, operation) => executePlan(executor, Query.select(selectWebhookOutboxColumns(tables)).pipe(Query.from(tables.webhookOutbox.table), Query.where(queryEq(tables.webhookOutbox.select.id, id)))).pipe(Effect.mapError((cause) => webhookOutboxStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeWebhookOutboxRecord(tables, rows[0]))));
+const claimDueWebhookOutboxRecords = (executor, tables, input) => Effect.gen(function* () {
+    const now = input.now ?? (yield* currentUnixMillis);
+    const base = Query.select(selectWebhookOutboxColumns(tables)).pipe(Query.from(tables.webhookOutbox.table), Query.where(queryLte(tables.webhookOutbox.select.nextAttemptAt, Number(now))));
+    const query = input.endpointKey === undefined
+        ? base
+        : base.pipe(Query.where(queryEq(tables.webhookOutbox.select.endpointKey, input.endpointKey)));
+    const rows = yield* executePlan(executor, query).pipe(Effect.mapError((cause) => webhookOutboxStoreError("claimDue", cause)));
+    return filterDueWebhookOutboxRecords(rows.map((row) => decodeWebhookOutboxRecord(tables, row)), { ...input, now });
+});
+const deleteWebhookOutboxRecordsBefore = (executor, tables, input) => {
+    const [firstStatus, ...remainingStatuses] = input.statuses;
+    const base = Query.delete(tables.webhookOutbox.table).pipe(Query.where(queryLt(tables.webhookOutbox.select.updatedAt, Number(input.beforeUpdatedAt))), Query.where(queryIn(tables.webhookOutbox.select.status, firstStatus, ...remainingStatuses)));
+    const query = input.endpointKey === undefined
+        ? base
+        : base.pipe(Query.where(queryEq(tables.webhookOutbox.select.endpointKey, input.endpointKey)));
+    return executePlan(executor, query.pipe(Query.returning({ id: tables.webhookOutbox.select.id }))).pipe(Effect.mapError((cause) => webhookOutboxStoreError("deleteBefore", cause)), Effect.map((rows) => rows.length));
+};
+const deleteExpiredWebhookReplayRecords = (executor, tables, input) => Effect.gen(function* () {
+    const now = input.now ?? (yield* currentUnixMillis);
+    return yield* executePlan(executor, Query.delete(tables.webhookReplay.table).pipe(Query.where(queryLt(tables.webhookReplay.select.expiresAt, Number(now))), Query.returning({ id: tables.webhookReplay.select.id }))).pipe(Effect.mapError((cause) => webhookReplayStoreError("deleteExpired", cause)), Effect.map((rows) => rows.length));
+});
+const listAuditLogRecords = (executor, tables, input = {}) => {
+    if (input.types !== undefined && input.types.length === 0) {
+        return Effect.succeed([]);
+    }
+    const base = Query.select(selectAuditLogColumns(tables)).pipe(Query.from(tables.auditLog.table));
+    const byUser = input.userId === undefined
+        ? base
+        : base.pipe(Query.where(queryEq(tables.auditLog.select.userId, input.userId)));
+    const byOccurredAt = input.beforeOccurredAt === undefined
+        ? byUser
+        : byUser.pipe(Query.where(queryLt(tables.auditLog.select.occurredAt, Number(input.beforeOccurredAt))));
+    const query = input.types === undefined
+        ? byOccurredAt
+        : byOccurredAt.pipe(Query.where(queryIn(tables.auditLog.select.type, input.types[0], ...input.types.slice(1))));
+    return executePlan(executor, query).pipe(Effect.mapError((cause) => auditLogStoreError("list", cause)), Effect.map((rows) => filterAuditLogEvents(rows.map((row) => decodeAuditLogEvent(tables, row)), input)));
+};
+const deleteAuditLogRecordsBefore = (executor, tables, input) => {
+    const base = Query.delete(tables.auditLog.table).pipe(Query.where(queryLt(tables.auditLog.select.occurredAt, Number(input.beforeOccurredAt))));
+    const query = input.userId === undefined
+        ? base
+        : base.pipe(Query.where(queryEq(tables.auditLog.select.userId, input.userId)));
+    return executePlan(executor, query.pipe(Query.returning({ occurredAt: tables.auditLog.select.occurredAt }))).pipe(Effect.mapError((cause) => auditLogStoreError("deleteBefore", cause)), Effect.map((rows) => rows.length));
+};
+const defaultLoginRiskHistoryRecentWindowMillis = 15 * 60 * 1000;
+const defaultLoginRiskHistoryWindowMillis = 90 * 24 * 60 * 60 * 1000;
+const defaultLoginRiskImpossibleTravelWindowMillis = 24 * 60 * 60 * 1000;
+const defaultLoginRiskImpossibleTravelKmh = 900;
+const positiveWindowMillis = (value, defaultValue) => value === undefined || !Number.isFinite(value)
+    ? defaultValue
+    : Math.max(0, value);
+const loginRiskHistoryOptions = (options) => ({
+    recentWindowMillis: positiveWindowMillis(options?.recentWindowMillis, defaultLoginRiskHistoryRecentWindowMillis),
+    historyWindowMillis: positiveWindowMillis(options?.historyWindowMillis, defaultLoginRiskHistoryWindowMillis),
+    impossibleTravelWindowMillis: positiveWindowMillis(options?.impossibleTravelWindowMillis, defaultLoginRiskImpossibleTravelWindowMillis),
+    impossibleTravelKmh: options?.impossibleTravelKmh === undefined ||
+        !Number.isFinite(options.impossibleTravelKmh)
+        ? defaultLoginRiskImpossibleTravelKmh
+        : Math.max(0, options.impossibleTravelKmh),
+});
+const toRadians = (degrees) => (degrees * Math.PI) / 180;
+const distanceKm = (first, second) => {
+    const earthRadiusKm = 6371;
+    const latitudeDelta = toRadians(second.latitude - first.latitude);
+    const longitudeDelta = toRadians(second.longitude - first.longitude);
+    const firstLatitude = toRadians(first.latitude);
+    const secondLatitude = toRadians(second.latitude);
+    const haversine = Math.sin(latitudeDelta / 2) ** 2 +
+        Math.cos(firstLatitude) *
+            Math.cos(secondLatitude) *
+            Math.sin(longitudeDelta / 2) ** 2;
+    return (2 * earthRadiusKm * Math.atan2(Math.sqrt(haversine), Math.sqrt(1 - haversine)));
+};
+const hasCoordinates = (value) => value.latitude !== undefined &&
+    Number.isFinite(value.latitude) &&
+    value.longitude !== undefined &&
+    Number.isFinite(value.longitude);
+const loginRiskHistoryLookupResult = (input, rows, options) => {
+    const normalized = loginRiskHistoryOptions(options);
+    const occurredAt = Number(input.occurredAt);
+    const recentStart = occurredAt - normalized.recentWindowMillis;
+    const historyStart = occurredAt - normalized.historyWindowMillis;
+    const impossibleTravelStart = occurredAt - normalized.impossibleTravelWindowMillis;
+    const previousRows = rows.filter((row) => Number(row.occurredAt) < occurredAt);
+    const recentRows = previousRows.filter((row) => Number(row.occurredAt) >= recentStart);
+    const historyRows = previousRows.filter((row) => Number(row.occurredAt) >= historyStart);
+    const recentFailedLoginCount = recentRows.filter((row) => row.outcome === "failure").length;
+    const recentSuccessfulLoginCount = recentRows.filter((row) => row.outcome === "success").length;
+    const knownDevice = input.deviceKey === undefined
+        ? undefined
+        : historyRows.some((row) => row.deviceKey === input.deviceKey);
+    const knownLocation = input.locationKey === undefined
+        ? undefined
+        : historyRows.some((row) => row.locationKey === input.locationKey);
+    const currentLocation = {
+        latitude: input.request?.latitude,
+        longitude: input.request?.longitude,
+    };
+    const impossibleTravel = hasCoordinates(currentLocation)
+        ? previousRows
+            .filter((row) => row.outcome === "success" &&
+            Number(row.occurredAt) >= impossibleTravelStart)
+            .some((row) => {
+            const previousLocation = {
+                latitude: row.latitude,
+                longitude: row.longitude,
+            };
+            if (!hasCoordinates(previousLocation)) {
+                return false;
+            }
+            const elapsedHours = (occurredAt - Number(row.occurredAt)) / 3_600_000;
+            return (elapsedHours > 0 &&
+                distanceKm(previousLocation, currentLocation) / elapsedHours >
+                    normalized.impossibleTravelKmh);
+        })
+        : undefined;
+    const recentRiskLevels = recentRows.flatMap((row) => row.riskLevel === undefined ? [] : [row.riskLevel]);
+    const riskLevel = recentRiskLevels.length === 0
+        ? undefined
+        : maxLoginRiskLevel(recentRiskLevels, "unknown");
+    const reasons = [
+        ...(recentFailedLoginCount > 0 ? ["recent-failed-login"] : []),
+        ...(knownDevice === false ? ["new-device"] : []),
+        ...(knownLocation === false ? ["new-location"] : []),
+        ...(impossibleTravel === true ? ["impossible-travel"] : []),
+    ];
+    return omitUndefined({
+        recentLoginCount: recentRows.length,
+        recentFailedLoginCount,
+        recentSuccessfulLoginCount,
+        knownDevice,
+        newDevice: knownDevice === undefined ? undefined : !knownDevice,
+        knownLocation,
+        newLocation: knownLocation === undefined ? undefined : !knownLocation,
+        impossibleTravel,
+        riskLevel,
+        reasons: reasons.length === 0 ? undefined : reasons,
+    });
+};
+const lookupLoginRiskHistory = (executor, tables, input, options) => {
+    const normalized = loginRiskHistoryOptions(options);
+    const occurredAt = Number(input.occurredAt);
+    const earliestOccurredAt = Math.min(occurredAt - normalized.recentWindowMillis, occurredAt - normalized.historyWindowMillis, occurredAt - normalized.impossibleTravelWindowMillis);
+    return executePlan(executor, Query.select(selectLoginRiskHistoryColumns(tables)).pipe(Query.from(tables.loginRiskHistory.table), Query.where(queryEq(tables.loginRiskHistory.select.userId, input.userId)), Query.where(queryLt(tables.loginRiskHistory.select.occurredAt, occurredAt)), Query.where(queryGt(tables.loginRiskHistory.select.occurredAt, earliestOccurredAt - 1)))).pipe(Effect.mapError((cause) => loginRiskHistoryStoreError("lookup", cause)), Effect.map((rows) => loginRiskHistoryLookupResult(input, rows.map((row) => decodeLoginRiskHistoryRecord(tables, row)), options)));
+};
+const deleteLoginRiskHistoryRecordsBefore = (executor, tables, input) => {
+    const base = Query.delete(tables.loginRiskHistory.table).pipe(Query.where(queryLt(tables.loginRiskHistory.select.occurredAt, Number(input.beforeOccurredAt))));
+    const query = input.userId === undefined
+        ? base
+        : base.pipe(Query.where(queryEq(tables.loginRiskHistory.select.userId, input.userId)));
+    return executePlan(executor, query.pipe(Query.returning({ id: tables.loginRiskHistory.select.id }))).pipe(Effect.mapError((cause) => loginRiskHistoryStoreError("deleteBefore", cause)), Effect.map((rows) => rows.length));
+};
+export const makeEffectQbSqliteUserStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return UserStore.make({
+        findById: (id) => findUserById(executor, tables, id),
+        findByEmail: (email) => findUserByEmail(executor, tables, email),
+        insert: (row) => executePlan(executor, queryInsert(tables.user.table, mutationValues(tables.user.insert(row)))).pipe(Effect.mapError((cause) => storageError("user", "insert", cause)), Effect.asVoid),
+        markEmailVerified: (input) => executePlan(executor, queryUpdate(tables.user.table, mutationValues(tables.user.markEmailVerified(input))).pipe(Query.where(queryEq(tables.user.select.id, input.userId)), Query.returning(selectUserColumns(tables)))).pipe(Effect.mapError((cause) => storageError("user", "markEmailVerified", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeUserRow(tables, rows[0])))),
+    });
+};
+export const makeEffectQbSqliteCredentialStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return CredentialStore.make({
+        findPasswordByUserId: (userId) => findPasswordCredentialByUserId(executor, tables, userId),
+        insertPassword: (row) => executePlan(executor, queryInsert(tables.credential.table, mutationValues(tables.credential.insertPassword(row)))).pipe(Effect.mapError((cause) => storageError("credential", "insert", cause)), Effect.asVoid),
+        updatePassword: (input) => executePlan(executor, queryUpdate(tables.credential.table, mutationValues(tables.credential.updatePassword(input))).pipe(Query.where(queryEq(tables.credential.select.userId, input.userId)), Query.where(queryEq(tables.credential.select.type, "password")), Query.where(queryIsNull(tables.credential.select.revokedAt)), Query.returning({ id: tables.credential.select.id }))).pipe(Effect.mapError((cause) => storageError("credential", "updatePassword", cause)), Effect.flatMap((rows) => rows[0] === undefined
+            ? Effect.succeed(Option.none())
+            : findPasswordCredentialByUserId(executor, tables, input.userId, "updatePassword"))),
+    });
+};
+export const makeEffectQbSqliteSessionStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return SessionStore.make({
+        findById: (id) => findSessionById(executor, tables, id),
+        listByUser: (input) => listSessionsByUser(executor, tables, input),
+        insert: (row) => executePlan(executor, queryInsert(tables.session.table, mutationValues(tables.session.insert(row)))).pipe(Effect.mapError((cause) => storageError("session", "insert", cause)), Effect.asVoid),
+        refresh: (input) => {
+            const query = queryUpdate(tables.session.table, mutationValues(tables.session.refresh(input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), Query.returning(selectSessionColumns(tables)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => storageError("session", "refresh", cause)), Effect.map((rows) => rows[0] === undefined
+                ? Option.none()
+                : Option.some(decodeSessionRow(tables, rows[0]))));
+        },
+        rotate: (input) => {
+            const query = queryUpdate(tables.session.table, mutationValues(tables.session.rotate(input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), Query.returning(selectSessionColumns(tables)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => storageError("session", "rotate", cause)), Effect.map((rows) => rows[0] === undefined
+                ? Option.none()
+                : Option.some(decodeSessionRow(tables, rows[0]))));
+        },
+        updateClaims: (input) => findSessionById(executor, tables, input.sessionId, "updateClaims").pipe(Effect.flatMap((rowOption) => {
+            if (Option.isNone(rowOption)) {
+                return Effect.succeed(Option.none());
+            }
+            return executePlan(executor, queryUpdate(tables.session.table, mutationValues(tables.session.updateClaims(rowOption.value, input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), Query.returning(selectSessionColumns(tables)))).pipe(Effect.mapError((cause) => storageError("session", "updateClaims", cause)), Effect.map((rows) => rows[0] === undefined
+                ? Option.none()
+                : Option.some(decodeSessionRow(tables, rows[0]))));
+        })),
+        revoke: (input) => executePlan(executor, queryUpdate(tables.session.table, mutationValues(tables.session.revoke(input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)))).pipe(Effect.mapError((cause) => storageError("session", "revoke", cause)), Effect.asVoid),
+        revokeAllForUser: (input) => executePlan(executor, queryUpdate(tables.session.table, mutationValues(tables.session.revoke(input))).pipe(Query.where(queryEq(tables.session.select.userId, input.userId)))).pipe(Effect.mapError((cause) => storageError("session", "revokeAllForUser", cause)), Effect.asVoid),
+    });
+};
+export const makeEffectQbSqliteVerificationStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return VerificationStore.make({
+        findById: (id) => findVerificationById(executor, tables, id),
+        insert: (row) => executePlan(executor, queryInsert(tables.verification.table, mutationValues(tables.verification.insert(row)))).pipe(Effect.mapError((cause) => storageError("verification", "insert", cause)), Effect.asVoid),
+        consume: (input) => {
+            const base = queryUpdate(tables.verification.table, mutationValues(tables.verification.consume(input))).pipe(Query.where(queryEq(tables.verification.select.id, input.id)), Query.where(queryIsNull(tables.verification.select.consumedAt)), Query.where(queryGt(tables.verification.select.expiresAt, Number(input.consumedAt))));
+            const plan = input.type === undefined
+                ? base
+                : base.pipe(Query.where(queryEq(tables.verification.select.type, input.type)));
+            return executePlan(executor, plan.pipe(Query.returning({ id: tables.verification.select.id }))).pipe(Effect.mapError((cause) => storageError("verification", "consume", cause)), Effect.flatMap((rows) => rows[0] === undefined
+                ? Effect.succeed(Option.none())
+                : findVerificationById(executor, tables, input.id, "consume")));
+        },
+        deleteExpired: (input) => {
+            if (input.limit === undefined) {
+                return executePlan(executor, Query.delete(tables.verification.table).pipe(Query.where(queryLte(tables.verification.select.expiresAt, Number(input.now))), Query.returning({ id: tables.verification.select.id }))).pipe(Effect.mapError((cause) => storageError("verification", "deleteExpired", cause)), Effect.map((rows) => rows.length));
+            }
+            return executePlan(executor, Query.select({ id: tables.verification.select.id }).pipe(Query.from(tables.verification.table), Query.where(queryLte(tables.verification.select.expiresAt, Number(input.now))), Query.limit(input.limit))).pipe(Effect.mapError((cause) => storageError("verification", "deleteExpired", cause)), Effect.flatMap((rows) => {
+                const [first, ...rest] = rows.map((row) => row.id);
+                if (first === undefined) {
+                    return Effect.succeed(0);
+                }
+                return executePlan(executor, Query.delete(tables.verification.table).pipe(Query.where(queryIn(tables.verification.select.id, first, ...rest)), Query.returning({ id: tables.verification.select.id }))).pipe(Effect.mapError((cause) => storageError("verification", "deleteExpired", cause)), Effect.map((deleted) => deleted.length));
+            }));
+        },
+    });
+};
+export const makeEffectQbSqliteAuditLogStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return AuditLogStore.make({
+        insert: (event) => Effect.gen(function* () {
+            const createdAt = yield* currentUnixMillis;
+            yield* executePlan(executor, queryInsert(tables.auditLog.table, mutationValues(tables.auditLog.insert(event, createdAt)))).pipe(Effect.mapError((cause) => auditLogStoreError("insert", cause)), Effect.asVoid);
+        }),
+        list: (input = {}) => listAuditLogRecords(executor, tables, input),
+        deleteBefore: (input) => deleteAuditLogRecordsBefore(executor, tables, input),
+    });
+};
+export const makeEffectQbSqliteLoginApprovalReviewStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return LoginApprovalReviewStore.make({
+        insertPending: (input) => executePlan(executor, queryInsert(tables.loginApprovalReview.table, mutationValues(tables.loginApprovalReview.insertPending(input)))).pipe(Effect.mapError((cause) => loginApprovalReviewStoreError("insert", cause)), Effect.as(input)),
+        findByApprovalChallengeId: (input) => findLoginApprovalReviewByApprovalChallengeId(executor, tables, input),
+        approve: (input) => executePlan(executor, queryUpdate(tables.loginApprovalReview.table, mutationValues(tables.loginApprovalReview.approve(input))).pipe(Query.where(queryEq(tables.loginApprovalReview.select.approvalChallengeId, input.approvalChallengeId)), Query.where(queryEq(tables.loginApprovalReview.select.status, "pending")), Query.returning(selectLoginApprovalReviewColumns(tables)))).pipe(Effect.mapError((cause) => loginApprovalReviewStoreError("approve", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeLoginApprovalReviewRow(tables, rows[0])))),
+        deny: (input) => executePlan(executor, queryUpdate(tables.loginApprovalReview.table, mutationValues(tables.loginApprovalReview.deny(input))).pipe(Query.where(queryEq(tables.loginApprovalReview.select.approvalChallengeId, input.approvalChallengeId)), Query.where(queryEq(tables.loginApprovalReview.select.status, "pending")), Query.returning(selectLoginApprovalReviewColumns(tables)))).pipe(Effect.mapError((cause) => loginApprovalReviewStoreError("deny", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeLoginApprovalReviewRow(tables, rows[0])))),
+    });
+};
+export const makeEffectQbSqliteLoginRiskHistoryStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return LoginRiskHistory.make({
+        lookup: (input) => lookupLoginRiskHistory(executor, tables, input, options.loginRiskHistory),
+        record: (input) => Effect.gen(function* () {
+            const createdAt = input.createdAt ?? (yield* currentUnixMillis);
+            yield* executePlan(executor, queryInsert(tables.loginRiskHistory.table, mutationValues(tables.loginRiskHistory.insert({ ...input, createdAt })))).pipe(Effect.mapError((cause) => loginRiskHistoryStoreError("record", cause)), Effect.asVoid);
+        }),
+        deleteBefore: (input) => deleteLoginRiskHistoryRecordsBefore(executor, tables, input),
+    });
+};
+export const makeEffectQbSqliteTrustedDeviceStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return TrustedDeviceStore.make({
+        find: (input) => findTrustedDevice(executor, tables, input),
+        listForUser: (input) => listTrustedDevicesForUser(executor, tables, input),
+        revokeForUser: (input) => executePlan(executor, Query.delete(tables.trustedDevice.table).pipe(Query.where(queryEq(tables.trustedDevice.select.userId, input.userId)), Query.where(queryEq(tables.trustedDevice.select.tokenHash, input.tokenHash)))).pipe(Effect.mapError((cause) => trustedDeviceStoreError("revoke", cause)), Effect.asVoid),
+        upsert: (input) => findTrustedDeviceIncludingExpired(executor, tables, input).pipe(Effect.flatMap((existing) => {
+            if (Option.isNone(existing)) {
+                return executePlan(executor, queryInsert(tables.trustedDevice.table, mutationValues(tables.trustedDevice.insert(input, input.now)))).pipe(Effect.mapError((cause) => trustedDeviceStoreError("trust", cause)), Effect.asVoid);
+            }
+            return executePlan(executor, queryUpdate(tables.trustedDevice.table, mutationValues(tables.trustedDevice.update(input, existing.value))).pipe(Query.where(queryEq(tables.trustedDevice.select.userId, input.userId)), Query.where(queryEq(tables.trustedDevice.select.tokenHash, input.tokenHash)))).pipe(Effect.mapError((cause) => trustedDeviceStoreError("trust", cause)), Effect.asVoid);
+        }), Effect.flatMap(() => findTrustedDeviceIncludingExpired(executor, tables, input)), Effect.flatMap((stored) => Option.isSome(stored)
+            ? Effect.succeed(stored.value)
+            : Effect.fail(trustedDeviceStoreError("trust", "missing row")))),
+    });
+};
+export const makeEffectQbSqlitePasskeyCredentialStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return PasskeyCredentialStore.make({
+        insert: (row) => executePlan(executor, queryInsert(tables.passkeyCredential.table, mutationValues(tables.passkeyCredential.insert(row)))).pipe(Effect.mapError((cause) => passkeyCredentialStoreError("insert", cause)), Effect.asVoid),
+        findByCredentialId: (credentialId) => findPasskeyCredentialByCredentialId(executor, tables, credentialId),
+        listByUser: (input) => {
+            const base = Query.select(selectPasskeyCredentialColumns(tables)).pipe(Query.from(tables.passkeyCredential.table), Query.where(queryEq(tables.passkeyCredential.select.userId, input.userId)));
+            const query = input.includeRevoked === true
+                ? base
+                : base.pipe(Query.where(queryIsNull(tables.passkeyCredential.select.revokedAt)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => passkeyCredentialStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodePasskeyCredentialRow(tables, row))));
+        },
+        updateSignCount: (input) => executePlan(executor, queryUpdate(tables.passkeyCredential.table, mutationValues(tables.passkeyCredential.updateSignCount(input))).pipe(Query.where(queryEq(tables.passkeyCredential.select.credentialId, input.credentialId)), Query.where(queryIsNull(tables.passkeyCredential.select.revokedAt)), Query.returning(selectPasskeyCredentialColumns(tables)))).pipe(Effect.mapError((cause) => passkeyCredentialStoreError("update-sign-count", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodePasskeyCredentialRow(tables, rows[0])))),
+        revoke: (input) => findPasskeyCredentialByCredentialId(executor, tables, input.credentialId, "revoke").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.void;
+            }
+            return executePlan(executor, queryUpdate(tables.passkeyCredential.table, mutationValues(tables.passkeyCredential.revoke(input, row.value))).pipe(Query.where(queryEq(tables.passkeyCredential.select.credentialId, input.credentialId)))).pipe(Effect.mapError((cause) => passkeyCredentialStoreError("revoke", cause)), Effect.asVoid);
+        })),
+    });
+};
+export const makeEffectQbSqliteTotpFactorStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return TotpFactorStore.make({
+        insert: (row) => executePlan(executor, queryInsert(tables.totpFactor.table, mutationValues(tables.totpFactor.insert(row)))).pipe(Effect.mapError((cause) => totpFactorStoreError("insert", cause)), Effect.asVoid),
+        findById: (id) => findTotpFactorById(executor, tables, id),
+        listByUser: (input) => {
+            const byUser = Query.select(selectTotpFactorColumns(tables)).pipe(Query.from(tables.totpFactor.table), Query.where(queryEq(tables.totpFactor.select.userId, input.userId)));
+            const byRevoked = input.includeRevoked === true
+                ? byUser
+                : byUser.pipe(Query.where(queryIsNull(tables.totpFactor.select.revokedAt)));
+            const query = input.includeUnconfirmed === true
+                ? byRevoked
+                : byRevoked.pipe(Query.where(queryGt(tables.totpFactor.select.confirmedAt, 0)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => totpFactorStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeTotpFactorRow(tables, row))));
+        },
+        confirm: (input) => executePlan(executor, queryUpdate(tables.totpFactor.table, mutationValues(tables.totpFactor.confirm(input))).pipe(Query.where(queryEq(tables.totpFactor.select.id, input.id)), Query.where(queryIsNull(tables.totpFactor.select.revokedAt)), Query.returning(selectTotpFactorColumns(tables)))).pipe(Effect.mapError((cause) => totpFactorStoreError("confirm", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeTotpFactorRow(tables, rows[0])))),
+        markUsed: (input) => executePlan(executor, queryUpdate(tables.totpFactor.table, mutationValues(tables.totpFactor.markUsed(input))).pipe(Query.where(queryEq(tables.totpFactor.select.id, input.id)), Query.where(queryIsNull(tables.totpFactor.select.revokedAt)), Query.where(queryGt(tables.totpFactor.select.confirmedAt, 0)), Query.returning(selectTotpFactorColumns(tables)))).pipe(Effect.mapError((cause) => totpFactorStoreError("mark-used", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeTotpFactorRow(tables, rows[0])))),
+        revoke: (input) => findTotpFactorById(executor, tables, input.id, "revoke").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.void;
+            }
+            return executePlan(executor, queryUpdate(tables.totpFactor.table, mutationValues(tables.totpFactor.revoke(input, row.value))).pipe(Query.where(queryEq(tables.totpFactor.select.id, input.id)))).pipe(Effect.mapError((cause) => totpFactorStoreError("revoke", cause)), Effect.asVoid);
+        })),
+    });
+};
+export const makeEffectQbSqliteRecoveryCodeStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return RecoveryCodeStore.make({
+        insertMany: (rows) => Effect.forEach(rows, (row) => executePlan(executor, queryInsert(tables.recoveryCode.table, mutationValues(tables.recoveryCode.insert(row)))).pipe(Effect.mapError((cause) => recoveryCodeStoreError("insert", cause)), Effect.asVoid), { discard: true }),
+        findById: (id) => findRecoveryCodeById(executor, tables, id),
+        listByUser: (input) => {
+            const byUser = Query.select(selectRecoveryCodeColumns(tables)).pipe(Query.from(tables.recoveryCode.table), Query.where(queryEq(tables.recoveryCode.select.userId, input.userId)));
+            const byUsed = input.includeUsed === true
+                ? byUser
+                : byUser.pipe(Query.where(queryIsNull(tables.recoveryCode.select.usedAt)));
+            const query = input.includeRevoked === true
+                ? byUsed
+                : byUsed.pipe(Query.where(queryIsNull(tables.recoveryCode.select.revokedAt)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => recoveryCodeStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeRecoveryCodeRow(tables, row))));
+        },
+        markUsed: (input) => executePlan(executor, queryUpdate(tables.recoveryCode.table, mutationValues(tables.recoveryCode.markUsed(input))).pipe(Query.where(queryEq(tables.recoveryCode.select.id, input.id)), Query.where(queryIsNull(tables.recoveryCode.select.usedAt)), Query.where(queryIsNull(tables.recoveryCode.select.revokedAt)), Query.returning({ id: tables.recoveryCode.select.id }))).pipe(Effect.mapError((cause) => recoveryCodeStoreError("mark-used", cause)), Effect.flatMap((rows) => rows[0] === undefined
+            ? Effect.succeed(Option.none())
+            : findRecoveryCodeById(executor, tables, input.id, "mark-used"))),
+        revoke: (input) => findRecoveryCodeById(executor, tables, input.id, "revoke").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.void;
+            }
+            return executePlan(executor, queryUpdate(tables.recoveryCode.table, mutationValues(tables.recoveryCode.revoke(input, row.value))).pipe(Query.where(queryEq(tables.recoveryCode.select.id, input.id)))).pipe(Effect.mapError((cause) => recoveryCodeStoreError("revoke", cause)), Effect.asVoid);
+        })),
+    });
+};
+export const makeEffectQbSqliteApiKeyStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return ApiKeyStore.make({
+        insert: (row) => executePlan(executor, queryInsert(tables.apiKey.table, mutationValues(tables.apiKey.insert(row)))).pipe(Effect.mapError((cause) => apiKeyStoreError("insert", cause)), Effect.asVoid),
+        findById: (id) => findApiKeyById(executor, tables, id),
+        findByPrefix: (prefix) => findApiKeyByPrefix(executor, tables, prefix),
+        listByUser: (input) => {
+            const base = Query.select(selectApiKeyColumns(tables)).pipe(Query.from(tables.apiKey.table), Query.where(queryEq(tables.apiKey.select.userId, input.userId)));
+            const query = input.includeRevoked === true
+                ? base
+                : base.pipe(Query.where(queryIsNull(tables.apiKey.select.revokedAt)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => apiKeyStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeApiKeyRow(tables, row))));
+        },
+        markUsed: (input) => executePlan(executor, queryUpdate(tables.apiKey.table, mutationValues(tables.apiKey.markUsed(input))).pipe(Query.where(queryEq(tables.apiKey.select.id, input.id)), Query.where(queryIsNull(tables.apiKey.select.revokedAt)), Query.returning(selectApiKeyColumns(tables)))).pipe(Effect.mapError((cause) => apiKeyStoreError("mark-used", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeApiKeyRow(tables, rows[0])))),
+        revoke: (input) => findApiKeyById(executor, tables, input.id, "revoke").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.void;
+            }
+            return executePlan(executor, queryUpdate(tables.apiKey.table, mutationValues(tables.apiKey.revoke(input, row.value))).pipe(Query.where(queryEq(tables.apiKey.select.id, input.id)))).pipe(Effect.mapError((cause) => apiKeyStoreError("revoke", cause)), Effect.asVoid);
+        })),
+    });
+};
+export const makeEffectQbSqliteRefreshTokenStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return RefreshTokenStore.make({
+        insert: (row) => executePlan(executor, queryInsert(tables.refreshToken.table, mutationValues(tables.refreshToken.insert(row)))).pipe(Effect.mapError((cause) => refreshTokenStoreError("insert", cause)), Effect.asVoid),
+        findById: (id) => findRefreshTokenById(executor, tables, id),
+        findBySecretHash: (hash) => findRefreshTokenBySecretHash(executor, tables, hash),
+        listByUser: (input) => {
+            const base = Query.select(selectRefreshTokenColumns(tables)).pipe(Query.from(tables.refreshToken.table), Query.where(queryEq(tables.refreshToken.select.userId, input.userId)));
+            const query = input.includeRevoked === true
+                ? base
+                : base.pipe(Query.where(queryIsNull(tables.refreshToken.select.revokedAt)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => refreshTokenStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeRefreshTokenRow(tables, row))));
+        },
+        listByFamily: (input) => {
+            const base = Query.select(selectRefreshTokenColumns(tables)).pipe(Query.from(tables.refreshToken.table), Query.where(queryEq(tables.refreshToken.select.familyId, input.familyId)));
+            const query = input.includeRevoked === true
+                ? base
+                : base.pipe(Query.where(queryIsNull(tables.refreshToken.select.revokedAt)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => refreshTokenStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeRefreshTokenRow(tables, row))));
+        },
+        rotate: (input) => executePlan(executor, queryUpdate(tables.refreshToken.table, mutationValues(tables.refreshToken.rotate(input))).pipe(Query.where(queryEq(tables.refreshToken.select.id, input.id)), Query.where(queryIsNull(tables.refreshToken.select.rotatedAt)), Query.where(queryIsNull(tables.refreshToken.select.revokedAt)), Query.returning({ id: tables.refreshToken.select.id }))).pipe(Effect.mapError((cause) => refreshTokenStoreError("rotate", cause)), Effect.flatMap((rows) => {
+            const [updated] = rows;
+            if (updated === undefined) {
+                return Effect.succeed(Option.none());
+            }
+            return findRefreshTokenById(executor, tables, RefreshTokenId(updated.id), "rotate").pipe(Effect.flatMap((previous) => {
+                if (Option.isNone(previous)) {
+                    return Effect.succeed(Option.none());
+                }
+                return executePlan(executor, queryInsert(tables.refreshToken.table, mutationValues(tables.refreshToken.insert(input.replacement)))).pipe(Effect.mapError((cause) => refreshTokenStoreError("rotate", cause)), Effect.as(Option.some({
+                    previous: previous.value,
+                    replacement: input.replacement,
+                })));
+            }));
+        })),
+        markReuseDetected: (input) => executePlan(executor, queryUpdate(tables.refreshToken.table, mutationValues(tables.refreshToken.markReuseDetected(input))).pipe(Query.where(queryEq(tables.refreshToken.select.id, input.id)), Query.returning(selectRefreshTokenColumns(tables)))).pipe(Effect.mapError((cause) => refreshTokenStoreError("reuse", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeRefreshTokenRow(tables, rows[0])))),
+        revoke: (input) => findRefreshTokenById(executor, tables, input.id, "revoke").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.void;
+            }
+            return executePlan(executor, queryUpdate(tables.refreshToken.table, mutationValues(tables.refreshToken.revoke(input, row.value))).pipe(Query.where(queryEq(tables.refreshToken.select.id, input.id)))).pipe(Effect.mapError((cause) => refreshTokenStoreError("revoke", cause)), Effect.asVoid);
+        })),
+        revokeFamily: (input) => executePlan(executor, Query.select(selectRefreshTokenColumns(tables)).pipe(Query.from(tables.refreshToken.table), Query.where(queryEq(tables.refreshToken.select.familyId, input.familyId)))).pipe(Effect.mapError((cause) => refreshTokenStoreError("revoke", cause)), Effect.flatMap((rows) => Effect.forEach(rows.map((row) => decodeRefreshTokenRow(tables, row)), (row) => executePlan(executor, queryUpdate(tables.refreshToken.table, mutationValues(tables.refreshToken.revokeFamily(input, row))).pipe(Query.where(queryEq(tables.refreshToken.select.id, row.id)))).pipe(Effect.mapError((cause) => refreshTokenStoreError("revoke", cause)), Effect.asVoid), { discard: true }))),
+    });
+};
+export const makeEffectQbSqliteJwtRevocationStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return JwtRevocationStore.make({
+        revoke: (record) => findJwtRevocation(executor, tables, record.jwtId, "revoke").pipe(Effect.flatMap((existing) => {
+            if (Option.isNone(existing)) {
+                return executePlan(executor, queryInsert(tables.jwtRevocation.table, mutationValues(tables.jwtRevocation.insert(record))));
+            }
+            return executePlan(executor, queryUpdate(tables.jwtRevocation.table, mutationValues(tables.jwtRevocation.update(record))).pipe(Query.where(queryEq(tables.jwtRevocation.select.jwtId, record.jwtId))));
+        }), Effect.mapError((cause) => cause instanceof JwtError
+            ? cause
+            : jwtRevocationStoreError("revoke", cause)), Effect.asVoid),
+        find: (jwtId) => findJwtRevocation(executor, tables, jwtId),
+    });
+};
+export const makeEffectQbSqliteOAuthAccountStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return OAuthAccountStore.make({
+        insert: (row) => executePlan(executor, queryInsert(tables.oauthAccount.table, mutationValues(tables.oauthAccount.insert(row)))).pipe(Effect.mapError((cause) => oauthAccountStoreError("insert", cause)), Effect.asVoid),
+        findById: (id) => findOAuthAccountById(executor, tables, id),
+        findByProviderAccount: (input) => findOAuthAccountByProviderAccount(executor, tables, input),
+        listByUser: (input) => {
+            const base = Query.select(selectOAuthAccountColumns(tables)).pipe(Query.from(tables.oauthAccount.table), Query.where(queryEq(tables.oauthAccount.select.userId, input.userId)));
+            const query = input.includeUnlinked === true
+                ? base
+                : base.pipe(Query.where(queryIsNull(tables.oauthAccount.select.unlinkedAt)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => oauthAccountStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeOAuthAccountRow(tables, row))));
+        },
+        unlink: (input) => findOAuthAccountByProviderAccount(executor, tables, {
+            providerId: input.providerId,
+            providerAccountId: input.providerAccountId,
+        }, "unlink").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.succeed(Option.none());
+            }
+            return executePlan(executor, queryUpdate(tables.oauthAccount.table, mutationValues(tables.oauthAccount.unlink(input, row.value))).pipe(Query.where(queryEq(tables.oauthAccount.select.id, row.value.id)), Query.returning(selectOAuthAccountColumns(tables)))).pipe(Effect.mapError((cause) => oauthAccountStoreError("unlink", cause)), Effect.map((rows) => rows[0] === undefined
+                ? Option.none()
+                : Option.some(decodeOAuthAccountRow(tables, rows[0]))));
+        })),
+    });
+};
+export const makeEffectQbSqliteOAuthClientStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return OAuthClientStore.make({
+        upsert: (record) => executePlan(executor, queryInsert(tables.oauthClient.table, mutationValues(tables.oauthClient.insert(record))).pipe(Query.onConflict("id", {
+            update: mutationValues(tables.oauthClient.update(record)),
+        }))).pipe(Effect.mapError((cause) => oauthClientStoreError("upsert", cause)), Effect.asVoid),
+        find: (input) => findOAuthClientById(executor, tables, input),
+        list: (input = {}) => {
+            const base = Query.select(selectOAuthClientColumns(tables)).pipe(Query.from(tables.oauthClient.table));
+            const query = input.includeDisabled === true
+                ? base
+                : base.pipe(Query.where(queryEq(tables.oauthClient.select.status, "active")));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => oauthClientStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeOAuthClientRow(tables, row))));
+        },
+        validateRedirectUri: (input) => findOAuthClientById(executor, tables, input, "validate-redirect-uri").pipe(Effect.map((client) => oauthClientRedirectUriValidationResult(Option.isNone(client) ? undefined : client.value, input))),
+    });
+};
+export const makeEffectQbSqliteOAuthConsentStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return OAuthConsentStore.make({
+        upsert: (record) => executePlan(executor, queryInsert(tables.oauthConsent.table, mutationValues(tables.oauthConsent.insert(record))).pipe(Query.onConflict("id", {
+            update: mutationValues(tables.oauthConsent.update(record)),
+        }))).pipe(Effect.mapError((cause) => oauthConsentStoreError("upsert", cause)), Effect.asVoid),
+        findActive: (input) => findOAuthConsentByUserAndClient(executor, tables, input).pipe(Effect.map((record) => Option.isNone(record) || !isOAuthConsentActive(record.value, input)
+            ? Option.none()
+            : Option.some(record.value))),
+        listForUser: (input) => executePlan(executor, Query.select(selectOAuthConsentColumns(tables)).pipe(Query.from(tables.oauthConsent.table), Query.where(queryEq(tables.oauthConsent.select.userId, input.userId)))).pipe(Effect.mapError((cause) => oauthConsentStoreError("list-for-user", cause)), Effect.map((rows) => rows
+            .map((row) => decodeOAuthConsentRow(tables, row))
+            .filter((record) => input.includeInactive === true ||
+            isOAuthConsentActive(record, { now: input.now })))),
+        revoke: (input) => findOAuthConsentByUserAndClient(executor, tables, input, "revoke").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.succeed(Option.none());
+            }
+            return executePlan(executor, queryUpdate(tables.oauthConsent.table, mutationValues(tables.oauthConsent.revoke(input, row.value))).pipe(Query.where(queryEq(tables.oauthConsent.select.userId, input.userId)), Query.where(queryEq(tables.oauthConsent.select.clientId, input.clientId)), Query.returning(selectOAuthConsentColumns(tables)))).pipe(Effect.mapError((cause) => oauthConsentStoreError("revoke", cause)), Effect.map((rows) => rows[0] === undefined
+                ? Option.none()
+                : Option.some(decodeOAuthConsentRow(tables, rows[0]))));
+        })),
+        deleteInactive: (input) => deleteOAuthInactiveConsents(executor, tables, input),
+    });
+};
+export const makeEffectQbSqliteOAuthAuthorizationCodeStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return OAuthAuthorizationCodeStore.make({
+        upsert: (record) => executePlan(executor, queryInsert(tables.oauthAuthorizationCode.table, mutationValues(tables.oauthAuthorizationCode.insert(record))).pipe(Query.onConflict("code_hash", {
+            update: mutationValues(tables.oauthAuthorizationCode.update(record)),
+        }))).pipe(Effect.mapError((cause) => oauthAuthorizationCodeStoreError("upsert", cause)), Effect.asVoid),
+        findByHash: (input) => findOAuthAuthorizationCodeByHash(executor, tables, input),
+        markConsumed: (input) => executePlan(executor, queryUpdate(tables.oauthAuthorizationCode.table, mutationValues(tables.oauthAuthorizationCode.markConsumed(input))).pipe(Query.where(queryEq(tables.oauthAuthorizationCode.select.codeHash, input.codeHash)), Query.where(queryIsNull(tables.oauthAuthorizationCode.select.consumedAt)), Query.returning({ codeHash: tables.oauthAuthorizationCode.select.codeHash }))).pipe(Effect.mapError((cause) => oauthAuthorizationCodeStoreError("mark-consumed", cause)), Effect.flatMap((rows) => {
+            const [consumed] = rows;
+            if (consumed !== undefined) {
+                return findOAuthAuthorizationCodeByHash(executor, tables, { codeHash: consumed.codeHash }, "mark-consumed").pipe(Effect.map((record) => Option.isNone(record)
+                    ? { status: "missing" }
+                    : {
+                        status: "consumed",
+                        record: record.value,
+                    }));
+            }
+            return findOAuthAuthorizationCodeByHash(executor, tables, { codeHash: input.codeHash }, "mark-consumed").pipe(Effect.map((record) => Option.isNone(record)
+                ? { status: "missing" }
+                : {
+                    status: "already_consumed",
+                    record: record.value,
+                }));
+        })),
+    });
+};
+export const makeEffectQbSqliteOAuthClientSecretStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return OAuthClientSecretStore.make({
+        upsert: (record) => executePlan(executor, queryInsert(tables.oauthClientSecret.table, mutationValues(tables.oauthClientSecret.insert(record))).pipe(Query.onConflict("prefix", {
+            update: mutationValues(tables.oauthClientSecret.update(record)),
+        }))).pipe(Effect.mapError((cause) => oauthClientSecretStoreError("upsert", cause)), Effect.asVoid),
+        findByClientIdAndPrefix: (input) => findOAuthClientSecretByClientIdAndPrefix(executor, tables, input),
+        markUsed: (input) => executePlan(executor, queryUpdate(tables.oauthClientSecret.table, mutationValues(tables.oauthClientSecret.markUsed(input))).pipe(Query.where(queryEq(tables.oauthClientSecret.select.clientId, input.clientId)), Query.where(queryEq(tables.oauthClientSecret.select.prefix, input.prefix)), Query.where(queryIsNull(tables.oauthClientSecret.select.revokedAt)), Query.returning(selectOAuthClientSecretColumns(tables)))).pipe(Effect.mapError((cause) => oauthClientSecretStoreError("mark-used", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeOAuthClientSecretRow(tables, rows[0])))),
+        revoke: (input) => findOAuthClientSecretByClientIdAndPrefix(executor, tables, input, "revoke").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.succeed(Option.none());
+            }
+            return executePlan(executor, queryUpdate(tables.oauthClientSecret.table, mutationValues(tables.oauthClientSecret.revoke(input, row.value))).pipe(Query.where(queryEq(tables.oauthClientSecret.select.clientId, input.clientId)), Query.where(queryEq(tables.oauthClientSecret.select.prefix, input.prefix)), Query.returning(selectOAuthClientSecretColumns(tables)))).pipe(Effect.mapError((cause) => oauthClientSecretStoreError("revoke", cause)), Effect.map((rows) => rows[0] === undefined
+                ? Option.none()
+                : Option.some(decodeOAuthClientSecretRow(tables, rows[0]))));
+        })),
+    });
+};
+export const makeEffectQbSqliteOAuthProviderModeTokenStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return OAuthProviderModeTokenStore.make({
+        upsert: (record) => executePlan(executor, queryInsert(tables.oauthProviderModeToken.table, mutationValues(tables.oauthProviderModeToken.insert(record))).pipe(Query.onConflict("token_hash", {
+            update: mutationValues(tables.oauthProviderModeToken.update(record)),
+        }))).pipe(Effect.mapError((cause) => oauthProviderModeTokenStoreError("upsert", cause)), Effect.asVoid),
+        findByHash: (input) => findOAuthProviderModeTokenByHash(executor, tables, input),
+        revokeByHash: (input) => findOAuthProviderModeTokenByHash(executor, tables, input, "revoke").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row) ||
+                (input.tokenTypeHint !== undefined &&
+                    row.value.tokenType !== input.tokenTypeHint)) {
+                return Effect.succeed(Option.none());
+            }
+            return executePlan(executor, queryUpdate(tables.oauthProviderModeToken.table, mutationValues(tables.oauthProviderModeToken.revoke(input, row.value))).pipe(Query.where(queryEq(tables.oauthProviderModeToken.select.tokenHash, input.tokenHash)), Query.returning(selectOAuthProviderModeTokenColumns(tables)))).pipe(Effect.mapError((cause) => oauthProviderModeTokenStoreError("revoke", cause)), Effect.map((rows) => rows[0] === undefined
+                ? Option.none()
+                : Option.some(decodeOAuthProviderModeTokenRow(tables, rows[0]))));
+        })),
+        rotateRefreshToken: (input) => executePlan(executor, queryUpdate(tables.oauthProviderModeToken.table, mutationValues(tables.oauthProviderModeToken.rotate(input))).pipe(Query.where(queryEq(tables.oauthProviderModeToken.select.tokenHash, input.tokenHash)), Query.where(queryEq(tables.oauthProviderModeToken.select.tokenType, "refresh_token")), Query.where(queryIsNull(tables.oauthProviderModeToken.select.revokedAt)), Query.where(queryIsNull(tables.oauthProviderModeToken.select.rotatedAt)), Query.returning({
+            tokenHash: tables.oauthProviderModeToken.select.tokenHash,
+        }))).pipe(Effect.mapError((cause) => oauthProviderModeTokenStoreError("rotate", cause)), Effect.flatMap((rows) => rows[0] === undefined
+            ? Effect.succeed(Option.none())
+            : findOAuthProviderModeTokenByHash(executor, tables, { tokenHash: rows[0].tokenHash }, "rotate"))),
+        deleteRetired: (input) => deleteOAuthProviderModeRetiredTokens(executor, tables, input),
+    });
+};
+export const makeEffectQbSqliteOAuthProviderTokenVault = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return OAuthProviderTokenVault.make({
+        upsert: (record) => findOAuthProviderTokenVaultRecordByAccountId(executor, tables, { accountId: record.accountId }, "upsert", true).pipe(Effect.flatMap((existing) => Option.isNone(existing)
+            ? executePlan(executor, queryInsert(tables.oauthProviderTokenVault.table, mutationValues(tables.oauthProviderTokenVault.insert(record))))
+            : executePlan(executor, queryUpdate(tables.oauthProviderTokenVault.table, mutationValues(tables.oauthProviderTokenVault.update(record))).pipe(Query.where(queryEq(tables.oauthProviderTokenVault.select.accountId, record.accountId))))), Effect.mapError((cause) => cause instanceof OAuthProviderTokenVaultError
+            ? cause
+            : oauthProviderTokenVaultError("upsert", cause)), Effect.asVoid),
+        refreshTokenForAccount: (input) => findOAuthProviderTokenVaultRecordByAccountId(executor, tables, input, "refresh-token").pipe(Effect.map((row) => Option.isNone(row) || row.value.refreshTokenCiphertext === undefined
+            ? Option.none()
+            : Option.some(row.value.refreshTokenCiphertext))),
+        tokensForAccount: (input) => findOAuthProviderTokenVaultRecordByAccountId(executor, tables, input, "tokens").pipe(Effect.map((row) => Option.isNone(row)
+            ? Option.none()
+            : Option.some(providerTokenVaultTokens(row.value)))),
+        markRevoked: (input) => executePlan(executor, queryUpdate(tables.oauthProviderTokenVault.table, mutationValues(tables.oauthProviderTokenVault.markRevoked(input))).pipe(Query.where(queryEq(tables.oauthProviderTokenVault.select.accountId, input.accountId)), Query.returning({
+            accountId: tables.oauthProviderTokenVault.select.accountId,
+        }))).pipe(Effect.mapError((cause) => oauthProviderTokenVaultError("mark-revoked", cause)), Effect.flatMap((rows) => {
+            const [updated] = rows;
+            if (updated === undefined) {
+                return Effect.succeed(Option.none());
+            }
+            return findOAuthProviderTokenVaultRecordByAccountId(executor, tables, { accountId: OAuthAccountId(updated.accountId) }, "mark-revoked", true);
+        })),
+    });
+};
+export const makeEffectQbSqliteDomainVerificationStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return DomainVerificationStore.make({
+        upsert: (record) => findDomainVerificationByOwnerAndDomain(executor, tables, { ownerId: record.ownerId, domain: record.domain }, "upsert").pipe(Effect.flatMap((existing) => Option.isNone(existing)
+            ? executePlan(executor, queryInsert(tables.domainVerification.table, mutationValues(tables.domainVerification.insert(record))))
+            : executePlan(executor, queryUpdate(tables.domainVerification.table, mutationValues(tables.domainVerification.update(record))).pipe(Query.where(queryEq(tables.domainVerification.select.ownerId, record.ownerId)), Query.where(queryEq(tables.domainVerification.select.domain, record.domain))))), Effect.mapError((cause) => cause instanceof DomainVerificationStoreError
+            ? cause
+            : domainVerificationStoreError("upsert", cause)), Effect.asVoid),
+        findById: (id) => findDomainVerificationById(executor, tables, id),
+        findByOwnerAndDomain: (input) => findDomainVerificationByOwnerAndDomain(executor, tables, input),
+        listByOwner: (input) => {
+            const base = Query.select(selectDomainVerificationColumns(tables)).pipe(Query.from(tables.domainVerification.table), Query.where(queryEq(tables.domainVerification.select.ownerId, input.ownerId)));
+            const query = input.includeRevoked === true
+                ? base
+                : base.pipe(Query.where(queryIsNull(tables.domainVerification.select.revokedAt)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => domainVerificationStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeDomainVerificationRecord(tables, row))));
+        },
+        markVerified: (input) => executePlan(executor, queryUpdate(tables.domainVerification.table, mutationValues(tables.domainVerification.markVerified(input))).pipe(Query.where(queryEq(tables.domainVerification.select.id, input.id)), Query.where(queryEq(tables.domainVerification.select.status, "pending")), Query.returning(selectDomainVerificationColumns(tables)))).pipe(Effect.mapError((cause) => domainVerificationStoreError("mark-verified", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeDomainVerificationRecord(tables, rows[0])))),
+        revoke: (input) => findDomainVerificationById(executor, tables, input.id, "revoke").pipe(Effect.flatMap((record) => {
+            if (Option.isNone(record)) {
+                return Effect.void;
+            }
+            return executePlan(executor, queryUpdate(tables.domainVerification.table, mutationValues(tables.domainVerification.revoke(input, record.value))).pipe(Query.where(queryEq(tables.domainVerification.select.id, input.id)))).pipe(Effect.mapError((cause) => domainVerificationStoreError("revoke", cause)), Effect.asVoid);
+        })),
+    });
+};
+export const makeEffectQbSqliteSecurityTimelineStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return SecurityTimelineStore.make({
+        insert: (event) => executePlan(executor, queryInsert(tables.securityTimeline.table, mutationValues(tables.securityTimeline.insert(event)))).pipe(Effect.mapError((cause) => securityTimelineStoreError("insert", cause)), Effect.asVoid),
+        listByUser: (input) => listSecurityTimelineByUser(executor, tables, input),
+        deleteBefore: (input) => deleteSecurityTimelineBefore(executor, tables, input),
+    });
+};
+export const makeEffectQbSqliteWebhookOutboxStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return WebhookOutboxStore.make({
+        enqueue: (input) => Effect.gen(function* () {
+            const now = input.now ?? (yield* currentUnixMillis);
+            const record = {
+                id: input.id,
+                endpointKey: input.endpointKey,
+                event: input.event,
+                status: "pending",
+                attempts: 0,
+                nextAttemptAt: input.nextAttemptAt ?? now,
+                createdAt: now,
+                updatedAt: now,
+            };
+            yield* executePlan(executor, queryInsert(tables.webhookOutbox.table, mutationValues(tables.webhookOutbox.insert(record)))).pipe(Effect.mapError((cause) => webhookOutboxStoreError("enqueue", cause)), Effect.asVoid);
+            return record;
+        }),
+        claimDue: (input) => claimDueWebhookOutboxRecords(executor, tables, input),
+        markDelivered: (input) => Effect.gen(function* () {
+            const existing = yield* findWebhookOutboxRecordById(executor, tables, input.id, "markDelivered");
+            if (Option.isNone(existing) || existing.value.status === "dead_lettered") {
+                return;
+            }
+            const deliveredAt = input.deliveredAt ?? (yield* currentUnixMillis);
+            yield* executePlan(executor, queryUpdate(tables.webhookOutbox.table, mutationValues(tables.webhookOutbox.markDelivered({ ...input, deliveredAt }))).pipe(Query.where(queryEq(tables.webhookOutbox.select.id, input.id)))).pipe(Effect.mapError((cause) => webhookOutboxStoreError("markDelivered", cause)), Effect.asVoid);
+        }),
+        markFailed: (input) => Effect.gen(function* () {
+            const existing = yield* findWebhookOutboxRecordById(executor, tables, input.id, "markFailed");
+            if (Option.isNone(existing) ||
+                existing.value.status === "delivered" ||
+                existing.value.status === "dead_lettered") {
+                return;
+            }
+            const failedAt = input.failedAt ?? (yield* currentUnixMillis);
+            yield* executePlan(executor, queryUpdate(tables.webhookOutbox.table, mutationValues(tables.webhookOutbox.markFailed({
+                ...input,
+                failedAt,
+                attempts: existing.value.attempts + 1,
+            }))).pipe(Query.where(queryEq(tables.webhookOutbox.select.id, input.id)))).pipe(Effect.mapError((cause) => webhookOutboxStoreError("markFailed", cause)), Effect.asVoid);
+        }),
+        markDeadLettered: (input) => Effect.gen(function* () {
+            const existing = yield* findWebhookOutboxRecordById(executor, tables, input.id, "markDeadLettered");
+            if (Option.isNone(existing) ||
+                existing.value.status === "delivered" ||
+                existing.value.status === "dead_lettered") {
+                return;
+            }
+            const deadLetteredAt = input.deadLetteredAt ?? (yield* currentUnixMillis);
+            yield* executePlan(executor, queryUpdate(tables.webhookOutbox.table, mutationValues(tables.webhookOutbox.markDeadLettered({
+                ...input,
+                deadLetteredAt,
+            }))).pipe(Query.where(queryEq(tables.webhookOutbox.select.id, input.id)))).pipe(Effect.mapError((cause) => webhookOutboxStoreError("markDeadLettered", cause)), Effect.asVoid);
+        }),
+        deleteBefore: (input) => deleteWebhookOutboxRecordsBefore(executor, tables, input),
+    });
+};
+export const makeEffectQbSqliteWebhookReplayStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return WebhookReplayStore.make({
+        claim: (input) => Effect.gen(function* () {
+            const now = input.now ?? (yield* currentUnixMillis);
+            const claim = { ...input, now };
+            const rows = yield* executePlan(executor, queryInsert(tables.webhookReplay.table, mutationValues(tables.webhookReplay.insert(claim))).pipe(Query.onConflict("id", {
+                update: mutationValues(tables.webhookReplay.update(claim)),
+                where: queryLt(tables.webhookReplay.select.expiresAt, Number(now)),
+            }), Query.returning(selectWebhookReplayColumns(tables)))).pipe(Effect.mapError((cause) => webhookReplayStoreError("claim", cause)));
+            return rows.length > 0;
+        }),
+        deleteExpired: (input = {}) => deleteExpiredWebhookReplayRecords(executor, tables, input),
+    });
+};
+export const makeEffectQbSqliteStorage = (executor, options = {}) => ({
+    userStore: makeEffectQbSqliteUserStore(executor, options),
+    credentialStore: makeEffectQbSqliteCredentialStore(executor, options),
+    sessionStore: makeEffectQbSqliteSessionStore(executor, options),
+    verificationStore: makeEffectQbSqliteVerificationStore(executor, options),
+    auditLogStore: makeEffectQbSqliteAuditLogStore(executor, options),
+    loginApprovalReviewStore: makeEffectQbSqliteLoginApprovalReviewStore(executor, options),
+    loginRiskHistoryStore: makeEffectQbSqliteLoginRiskHistoryStore(executor, options),
+    trustedDeviceStore: makeEffectQbSqliteTrustedDeviceStore(executor, options),
+    passkeyCredentialStore: makeEffectQbSqlitePasskeyCredentialStore(executor, options),
+    totpFactorStore: makeEffectQbSqliteTotpFactorStore(executor, options),
+    recoveryCodeStore: makeEffectQbSqliteRecoveryCodeStore(executor, options),
+    apiKeyStore: makeEffectQbSqliteApiKeyStore(executor, options),
+    refreshTokenStore: makeEffectQbSqliteRefreshTokenStore(executor, options),
+    jwtRevocationStore: makeEffectQbSqliteJwtRevocationStore(executor, options),
+    oauthAccountStore: makeEffectQbSqliteOAuthAccountStore(executor, options),
+    oauthClientStore: makeEffectQbSqliteOAuthClientStore(executor, options),
+    oauthConsentStore: makeEffectQbSqliteOAuthConsentStore(executor, options),
+    oauthAuthorizationCodeStore: makeEffectQbSqliteOAuthAuthorizationCodeStore(executor, options),
+    oauthClientSecretStore: makeEffectQbSqliteOAuthClientSecretStore(executor, options),
+    oauthProviderModeTokenStore: makeEffectQbSqliteOAuthProviderModeTokenStore(executor, options),
+    oauthProviderTokenVault: makeEffectQbSqliteOAuthProviderTokenVault(executor, options),
+    domainVerificationStore: makeEffectQbSqliteDomainVerificationStore(executor, options),
+    securityTimelineStore: makeEffectQbSqliteSecurityTimelineStore(executor, options),
+    webhookOutboxStore: makeEffectQbSqliteWebhookOutboxStore(executor, options),
+    webhookReplayStore: makeEffectQbSqliteWebhookReplayStore(executor, options),
+});
+export const EffectQbSqliteAuthStorageLive = (executor, options = {}) => Layer.mergeAll(Layer.succeed(UserStore)(makeEffectQbSqliteUserStore(executor, options)), Layer.succeed(CredentialStore)(makeEffectQbSqliteCredentialStore(executor, options)), Layer.succeed(SessionStore)(makeEffectQbSqliteSessionStore(executor, options)), Layer.succeed(VerificationStore)(makeEffectQbSqliteVerificationStore(executor, options)), Layer.succeed(AuditLogStore)(makeEffectQbSqliteAuditLogStore(executor, options)), Layer.succeed(LoginApprovalReviewStore)(makeEffectQbSqliteLoginApprovalReviewStore(executor, options)), Layer.succeed(LoginRiskHistory)(makeEffectQbSqliteLoginRiskHistoryStore(executor, options)), Layer.succeed(TrustedDeviceStore)(makeEffectQbSqliteTrustedDeviceStore(executor, options)), Layer.succeed(PasskeyCredentialStore)(makeEffectQbSqlitePasskeyCredentialStore(executor, options)), Layer.succeed(TotpFactorStore)(makeEffectQbSqliteTotpFactorStore(executor, options)), Layer.succeed(RecoveryCodeStore)(makeEffectQbSqliteRecoveryCodeStore(executor, options)), Layer.succeed(ApiKeyStore)(makeEffectQbSqliteApiKeyStore(executor, options)), Layer.succeed(RefreshTokenStore)(makeEffectQbSqliteRefreshTokenStore(executor, options)), Layer.succeed(JwtRevocationStore)(makeEffectQbSqliteJwtRevocationStore(executor, options)), Layer.succeed(OAuthAccountStore)(makeEffectQbSqliteOAuthAccountStore(executor, options)), Layer.succeed(OAuthClientStore)(makeEffectQbSqliteOAuthClientStore(executor, options)), Layer.succeed(OAuthConsentStore)(makeEffectQbSqliteOAuthConsentStore(executor, options)), Layer.succeed(OAuthAuthorizationCodeStore)(makeEffectQbSqliteOAuthAuthorizationCodeStore(executor, options)), Layer.succeed(OAuthClientSecretStore)(makeEffectQbSqliteOAuthClientSecretStore(executor, options)), Layer.succeed(OAuthProviderModeTokenStore)(makeEffectQbSqliteOAuthProviderModeTokenStore(executor, options)), Layer.succeed(OAuthProviderTokenVault)(makeEffectQbSqliteOAuthProviderTokenVault(executor, options)), Layer.succeed(DomainVerificationStore)(makeEffectQbSqliteDomainVerificationStore(executor, options)), Layer.succeed(SecurityTimelineStore)(makeEffectQbSqliteSecurityTimelineStore(executor, options)), Layer.succeed(WebhookOutboxStore)(makeEffectQbSqliteWebhookOutboxStore(executor, options)), Layer.succeed(WebhookReplayStore)(makeEffectQbSqliteWebhookReplayStore(executor, options)));
+export const makeD1EffectQbSqliteExecutor = (database) => Executor.make({
+    driver: Executor.driver((query) => Effect.tryPromise({
+        try: () => database
+            .prepare(query.sql)
+            .bind(...query.params)
+            .all(),
+        catch: (cause) => new D1EffectQbError({ message: "D1 query failed", cause }),
+    }).pipe(Effect.flatMap((result) => {
+        if (result.success === false || result.error !== undefined) {
+            return Effect.fail(new D1EffectQbError({
+                message: result.error ?? "D1 query failed",
+            }));
+        }
+        return Effect.succeed([...(result.results ?? [])]);
+    }))),
+});
+export const D1EffectQbSqliteAuthStorageLive = (database, options = {}) => EffectQbSqliteAuthStorageLive(makeD1EffectQbSqliteExecutor(database), options);
+//# sourceMappingURL=EffectQbSqliteStorage.js.map