@effect-auth/core 0.1.0-alpha.10 → 0.1.0-alpha.13

package/dist/EffectQbSqliteStorage.js

@@ -1,11 +1,14 @@
 import { Data, Effect, Layer, Option, Redacted } from "effect";
 import { Column, Executor, Query, Scalar, Table } from "effect-qb/sqlite";
+import { AuditLogStore, AuditLogStoreError, auditEventActorUserId, auditEventUserId, filterAuditLogEvents, } from "./AuditLog.js";
 import { ApiKeyId, ApiKeyPrefix, ApiKeySecretHash, ApiKeyStore, ApiKeyStoreError, } from "./ApiKey.js";
-import { AuthFlowId, ChallengeId, CredentialId, Email, OAuthAccountId, OAuthProviderId, SessionId, UnixMillis, UserId, } from "./Identifiers.js";
+import { DomainName, DomainVerificationId, DomainVerificationProofToken, DomainVerificationStore, DomainVerificationStoreError, } from "./DomainVerification.js";
+import { AuthFlowId, ChallengeId, CredentialId, Email, OAuthAccountId, OAuthClientId, OAuthProviderId, SessionId, UnixMillis, UserId, } from "./Identifiers.js";
+import { currentUnixMillis } from "./Internal.js";
 import { JwtError, JwtRevocationStore } from "./Jwt.js";
 import { LoginApprovalReviewError, LoginApprovalReviewStore, } from "./LoginApproval.js";
-import { LoginRiskContext, LoginRiskSignal } from "./LoginRisk.js";
-import { OAuthAccountStore, OAuthAccountStoreError, OAuthProviderTokenVault, OAuthProviderTokenVaultError, } from "./OAuth.js";
+import { LoginRiskContext, LoginRiskHistory, LoginRiskHistoryError, LoginRiskSignal, maxLoginRiskLevel, } from "./LoginRisk.js";
+import { OAuthAccountStore, OAuthAccountStoreError, OAuthAuthorizationCodeStore, OAuthAuthorizationCodeStoreError, OAuthClientStore, OAuthClientStoreError, OAuthConsentStore, OAuthConsentStoreError, OAuthClientSecretHash, OAuthClientSecretPrefix, OAuthClientSecretStore, OAuthClientSecretStoreError, OAuthCodeChallenge, OAuthProviderModeTokenStore, OAuthProviderModeTokenStoreError, OAuthProviderTokenVault, OAuthProviderTokenVaultError, } from "./OAuth.js";
 import { PasskeyCredentialId, PasskeyCredentialStore, PasskeyCredentialStoreError, } from "./Passkey.js";
 import { RecoveryCodeHash, RecoveryCodeStore, RecoveryCodeStoreError, } from "./RecoveryCode.js";
 import { RefreshTokenFamilyId, RefreshTokenId, RefreshTokenSecretHash, RefreshTokenStore, RefreshTokenStoreError, } from "./RefreshToken.js";
@@ -13,6 +16,7 @@ import { filterSecurityTimelineEvents, SecurityTimelineEventId, SecurityTimeline
 import { CredentialStore, SessionStore, StorageError, UserStore, VerificationStore, } from "./Storage.js";
 import { TotpFactorStore, TotpFactorStoreError, TotpSecret, } from "./Totp.js";
 import { filterTrustedDevicesForUser, TrustedDeviceError, TrustedDeviceStore, } from "./TrustedDevice.js";
+import { filterDueWebhookOutboxRecords, WebhookOutboxItemId, WebhookOutboxStore, WebhookOutboxStoreError, WebhookReplayStore, WebhookReplayStoreError, } from "./Webhook.js";
 export class D1EffectQbError extends Data.TaggedError("D1EffectQbError") {
 }
 const makeAuthUserTable = (name) => Table.make(name, {
@@ -59,6 +63,17 @@ const makeAuthVerificationTable = (name) => Table.make(name, {
     metadata: Column.text().pipe(Column.nullable),
     consumed_at: Column.int().pipe(Column.nullable),
 });
+const makeAuthAuditLogTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.nullable),
+    type: Column.text(),
+    user_id: Column.text().pipe(Column.nullable),
+    actor_user_id: Column.text().pipe(Column.nullable),
+    occurred_at: Column.int(),
+    request_ip_hash: Column.text().pipe(Column.nullable),
+    request_user_agent_hash: Column.text().pipe(Column.nullable),
+    event: Column.text(),
+    created_at: Column.int(),
+});
 const makeAuthLoginApprovalReviewTable = (name) => Table.make(name, {
     approval_challenge_id: Column.text().pipe(Column.primaryKey),
     flow_id: Column.text(),
@@ -77,6 +92,24 @@ const makeAuthLoginApprovalReviewTable = (name) => Table.make(name, {
     metadata: Column.text().pipe(Column.nullable),
     review_metadata: Column.text().pipe(Column.nullable),
 });
+const makeAuthLoginRiskHistoryTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    occurred_at: Column.int(),
+    outcome: Column.text(),
+    method: Column.text(),
+    amr: Column.text(),
+    aal: Column.text(),
+    device_status: Column.text(),
+    device_key: Column.text().pipe(Column.nullable),
+    location_key: Column.text().pipe(Column.nullable),
+    country: Column.text().pipe(Column.nullable),
+    region: Column.text().pipe(Column.nullable),
+    latitude_micro: Column.int().pipe(Column.nullable),
+    longitude_micro: Column.int().pipe(Column.nullable),
+    risk_level: Column.text().pipe(Column.nullable),
+    created_at: Column.int(),
+});
 const makeAuthTrustedDeviceTable = (name) => Table.make(name, {
     user_id: Column.text(),
     token_hash: Column.text(),
@@ -179,6 +212,84 @@ const makeAuthOAuthProviderTokenVaultTable = (name) => Table.make(name, {
     revoked_at: Column.int().pipe(Column.nullable),
     revocation_reason: Column.text().pipe(Column.nullable),
 });
+const makeAuthOAuthClientTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    type: Column.text(),
+    status: Column.text(),
+    name: Column.text().pipe(Column.nullable),
+    redirect_uris: Column.text(),
+    allowed_grant_types: Column.text(),
+    allowed_response_types: Column.text(),
+    allowed_scopes: Column.text().pipe(Column.nullable),
+    created_at: Column.int().pipe(Column.nullable),
+    updated_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthOAuthConsentTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    client_id: Column.text(),
+    scopes: Column.text(),
+    granted_at: Column.int(),
+    expires_at: Column.int().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthOAuthAuthorizationCodeTable = (name) => Table.make(name, {
+    code_hash: Column.text().pipe(Column.primaryKey),
+    client_id: Column.text(),
+    subject: Column.text(),
+    redirect_uri: Column.text(),
+    scopes: Column.text(),
+    code_challenge: Column.text().pipe(Column.nullable),
+    code_challenge_method: Column.text().pipe(Column.nullable),
+    issued_at: Column.int(),
+    expires_at: Column.int(),
+    consumed_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthOAuthClientSecretTable = (name) => Table.make(name, {
+    prefix: Column.text().pipe(Column.primaryKey),
+    client_id: Column.text(),
+    secret_hash: Column.text(),
+    authentication_methods: Column.text(),
+    created_at: Column.int(),
+    expires_at: Column.int().pipe(Column.nullable),
+    last_used_at: Column.int().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthOAuthProviderModeTokenTable = (name) => Table.make(name, {
+    token_hash: Column.text().pipe(Column.primaryKey),
+    token_type: Column.text(),
+    client_id: Column.text(),
+    subject: Column.text(),
+    scopes: Column.text(),
+    issued_at: Column.int(),
+    expires_at: Column.int(),
+    issuer: Column.text().pipe(Column.nullable),
+    audience: Column.text().pipe(Column.nullable),
+    jwt_id: Column.text().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    revocation_reason: Column.text().pipe(Column.nullable),
+    rotated_at: Column.int().pipe(Column.nullable),
+    replaced_by_token_hash: Column.text().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthDomainVerificationTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    owner_id: Column.text(),
+    domain: Column.text(),
+    proof_method: Column.text(),
+    proof_token: Column.text(),
+    status: Column.text(),
+    created_at: Column.int(),
+    expires_at: Column.int(),
+    verified_at: Column.int().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    last_checked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
 const makeAuthSecurityTimelineTable = (name) => Table.make(name, {
     id: Column.text().pipe(Column.primaryKey),
     user_id: Column.text(),
@@ -191,6 +302,23 @@ const makeAuthSecurityTimelineTable = (name) => Table.make(name, {
     request: Column.text().pipe(Column.nullable),
     metadata: Column.text().pipe(Column.nullable),
 });
+const makeAuthWebhookOutboxTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    endpoint_key: Column.text(),
+    event: Column.text(),
+    status: Column.text(),
+    attempts: Column.int(),
+    next_attempt_at: Column.int(),
+    created_at: Column.int(),
+    updated_at: Column.int(),
+    delivered_at: Column.int().pipe(Column.nullable),
+    last_error: Column.text().pipe(Column.nullable),
+});
+const makeAuthWebhookReplayTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    expires_at: Column.int(),
+    created_at: Column.int(),
+});
 const authSqliteTablesTypeId = Symbol.for("@effect-auth/core/EffectQbSqliteStorage/AuthSqliteTables");
 const jsonEncode = (value) => value === undefined ? null : JSON.stringify(value);
 const jsonDecode = (value) => {
@@ -220,6 +348,7 @@ const queryInsert = (table, values) => Query.insert(table, values);
 const queryUpdate = (table, values) => Query.update(table, values);
 const queryEq = (left, right) => Query.eq(left, right);
 const queryGt = (left, right) => Query.gt(left, right);
+const queryLt = (left, right) => Query.lt(left, right);
 const queryLte = (left, right) => Query.lte(left, right);
 const queryIsNull = (value) => Query.isNull(value);
 const queryIn = (value, first, ...rest) => Query.in(value, first, ...rest);
@@ -353,6 +482,10 @@ const decodeDefaultVerificationRow = (row) => omitUndefined({
 const decodeVerificationRow = (tables, row) => tables.verification.decode === undefined
     ? decodeDefaultVerificationRow(row)
     : tables.verification.decode(row);
+const decodeDefaultAuditLogEvent = (row) => jsonDecode(row.event);
+const decodeAuditLogEvent = (tables, row) => tables.auditLog.decode === undefined
+    ? decodeDefaultAuditLogEvent(row)
+    : tables.auditLog.decode(row);
 const decodeDefaultLoginApprovalReviewRow = (row) => omitUndefined({
     approvalChallengeId: ChallengeId(row.approvalChallengeId),
     flowId: AuthFlowId(row.flowId),
@@ -376,6 +509,29 @@ const decodeDefaultLoginApprovalReviewRow = (row) => omitUndefined({
 const decodeLoginApprovalReviewRow = (tables, row) => tables.loginApprovalReview.decode === undefined
     ? decodeDefaultLoginApprovalReviewRow(row)
     : tables.loginApprovalReview.decode(row);
+const decodeDefaultLoginRiskHistoryRecord = (row) => omitUndefined({
+    id: row.id,
+    userId: UserId(row.userId),
+    occurredAt: UnixMillis(Number(row.occurredAt)),
+    outcome: row.outcome,
+    method: row.method,
+    amr: decodeAmr(row.amr),
+    aal: row.aal,
+    device: { status: row.deviceStatus },
+    deviceKey: row.deviceKey ?? undefined,
+    locationKey: row.locationKey ?? undefined,
+    country: row.country ?? undefined,
+    region: row.region ?? undefined,
+    latitude: row.latitudeMicro === null ? undefined : Number(row.latitudeMicro) / 1_000_000,
+    longitude: row.longitudeMicro === null
+        ? undefined
+        : Number(row.longitudeMicro) / 1_000_000,
+    riskLevel: row.riskLevel === null ? undefined : row.riskLevel,
+    createdAt: UnixMillis(Number(row.createdAt)),
+});
+const decodeLoginRiskHistoryRecord = (tables, row) => tables.loginRiskHistory.decode === undefined
+    ? decodeDefaultLoginRiskHistoryRecord(row)
+    : tables.loginRiskHistory.decode(row);
 const decodeDefaultTrustedDeviceRow = (row) => omitUndefined({
     userId: UserId(row.userId),
     tokenHash: row.tokenHash,
@@ -525,6 +681,134 @@ const decodeDefaultOAuthProviderTokenVaultRow = (row) => omitUndefined({
 const decodeOAuthProviderTokenVaultRow = (tables, row) => tables.oauthProviderTokenVault.decode === undefined
     ? decodeDefaultOAuthProviderTokenVaultRow(row)
     : tables.oauthProviderTokenVault.decode(row);
+const decodeDefaultOAuthClientRow = (row) => omitUndefined({
+    id: OAuthClientId(row.id),
+    type: row.type,
+    status: row.status,
+    name: row.name ?? undefined,
+    redirectUris: decodeStringArray(row.redirectUris),
+    allowedGrantTypes: decodeStringArray(row.allowedGrantTypes),
+    allowedResponseTypes: decodeStringArray(row.allowedResponseTypes),
+    allowedScopes: decodeOptionalStringArray(row.allowedScopes),
+    createdAt: optionalUnixMillis(row.createdAt),
+    updatedAt: optionalUnixMillis(row.updatedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeOAuthClientRow = (tables, row) => tables.oauthClient.decode === undefined
+    ? decodeDefaultOAuthClientRow(row)
+    : tables.oauthClient.decode(row);
+const decodeDefaultOAuthConsentRow = (row) => omitUndefined({
+    userId: UserId(row.userId),
+    clientId: OAuthClientId(row.clientId),
+    scopes: decodeStringArray(row.scopes),
+    grantedAt: UnixMillis(Number(row.grantedAt)),
+    expiresAt: optionalUnixMillis(row.expiresAt),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeOAuthConsentRow = (tables, row) => tables.oauthConsent.decode === undefined
+    ? decodeDefaultOAuthConsentRow(row)
+    : tables.oauthConsent.decode(row);
+const oauthConsentCoversScopes = (record, scopes = []) => scopes.every((scope) => record.scopes.includes(scope));
+const isOAuthConsentActive = (record, input) => record.revokedAt === undefined &&
+    (record.expiresAt === undefined || Number(record.expiresAt) > Number(input.now)) &&
+    oauthConsentCoversScopes(record, input.scopes);
+const oauthClientRedirectUriValidationResult = (client, input) => {
+    if (client === undefined) {
+        return { valid: false, reason: "unknown_client" };
+    }
+    if (client.status !== "active") {
+        return { valid: false, reason: "disabled_client" };
+    }
+    const responseType = input.responseType ?? "code";
+    if (!client.allowedResponseTypes.includes(responseType)) {
+        return { valid: false, reason: "unsupported_response_type" };
+    }
+    if (input.grantType !== undefined &&
+        !client.allowedGrantTypes.includes(input.grantType)) {
+        return { valid: false, reason: "unsupported_grant_type" };
+    }
+    if (!client.redirectUris.includes(input.redirectUri)) {
+        return { valid: false, reason: "redirect_uri_mismatch" };
+    }
+    return { valid: true, client };
+};
+const decodeDefaultOAuthAuthorizationCodeRow = (row) => omitUndefined({
+    codeHash: row.codeHash,
+    clientId: OAuthClientId(row.clientId),
+    subject: row.subject,
+    redirectUri: row.redirectUri,
+    scopes: decodeStringArray(row.scopes),
+    codeChallenge: row.codeChallenge === null ? undefined : OAuthCodeChallenge(row.codeChallenge),
+    codeChallengeMethod: row.codeChallengeMethod === null
+        ? undefined
+        : row.codeChallengeMethod,
+    issuedAt: UnixMillis(Number(row.issuedAt)),
+    expiresAt: UnixMillis(Number(row.expiresAt)),
+    consumedAt: optionalUnixMillis(row.consumedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeOAuthAuthorizationCodeRow = (tables, row) => tables.oauthAuthorizationCode.decode === undefined
+    ? decodeDefaultOAuthAuthorizationCodeRow(row)
+    : tables.oauthAuthorizationCode.decode(row);
+const decodeDefaultOAuthClientSecretRow = (row) => omitUndefined({
+    prefix: OAuthClientSecretPrefix(row.prefix),
+    clientId: OAuthClientId(row.clientId),
+    secretHash: OAuthClientSecretHash(row.secretHash),
+    authenticationMethods: decodeStringArray(row.authenticationMethods),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    expiresAt: optionalUnixMillis(row.expiresAt),
+    lastUsedAt: optionalUnixMillis(row.lastUsedAt),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeOAuthClientSecretRow = (tables, row) => tables.oauthClientSecret.decode === undefined
+    ? decodeDefaultOAuthClientSecretRow(row)
+    : tables.oauthClientSecret.decode(row);
+const decodeOAuthProviderModeTokenAudience = (value) => {
+    const decoded = jsonDecode(value);
+    if (typeof decoded === "string") {
+        return decoded;
+    }
+    return Array.isArray(decoded) ? decoded.map(String) : undefined;
+};
+const decodeDefaultOAuthProviderModeTokenRow = (row) => omitUndefined({
+    tokenHash: row.tokenHash,
+    tokenType: row.tokenType,
+    clientId: OAuthClientId(row.clientId),
+    subject: row.subject,
+    scopes: decodeStringArray(row.scopes),
+    issuedAt: UnixMillis(Number(row.issuedAt)),
+    expiresAt: UnixMillis(Number(row.expiresAt)),
+    issuer: row.issuer ?? undefined,
+    audience: decodeOAuthProviderModeTokenAudience(row.audience),
+    jwtId: row.jwtId ?? undefined,
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    revocationReason: row.revocationReason ?? undefined,
+    rotatedAt: optionalUnixMillis(row.rotatedAt),
+    replacedByTokenHash: row.replacedByTokenHash ?? undefined,
+    metadata: jsonDecode(row.metadata),
+});
+const decodeOAuthProviderModeTokenRow = (tables, row) => tables.oauthProviderModeToken.decode === undefined
+    ? decodeDefaultOAuthProviderModeTokenRow(row)
+    : tables.oauthProviderModeToken.decode(row);
+const decodeDefaultDomainVerificationRecord = (row) => omitUndefined({
+    id: DomainVerificationId(row.id),
+    ownerId: row.ownerId,
+    domain: DomainName(row.domain),
+    proofMethod: row.proofMethod,
+    proofToken: DomainVerificationProofToken(row.proofToken),
+    status: row.status,
+    createdAt: UnixMillis(Number(row.createdAt)),
+    expiresAt: UnixMillis(Number(row.expiresAt)),
+    verifiedAt: optionalUnixMillis(row.verifiedAt),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    lastCheckedAt: optionalUnixMillis(row.lastCheckedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeDomainVerificationRecord = (tables, row) => tables.domainVerification.decode === undefined
+    ? decodeDefaultDomainVerificationRecord(row)
+    : tables.domainVerification.decode(row);
 const decodeDefaultSecurityTimelineEvent = (row) => omitUndefined({
     id: SecurityTimelineEventId(row.id),
     userId: UserId(row.userId),
@@ -540,6 +824,21 @@ const decodeDefaultSecurityTimelineEvent = (row) => omitUndefined({
 const decodeSecurityTimelineEvent = (tables, row) => tables.securityTimeline.decode === undefined
     ? decodeDefaultSecurityTimelineEvent(row)
     : tables.securityTimeline.decode(row);
+const decodeDefaultWebhookOutboxRecord = (row) => omitUndefined({
+    id: WebhookOutboxItemId(row.id),
+    endpointKey: row.endpointKey,
+    event: jsonDecode(row.event),
+    status: row.status,
+    attempts: Number(row.attempts),
+    nextAttemptAt: UnixMillis(Number(row.nextAttemptAt)),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    updatedAt: UnixMillis(Number(row.updatedAt)),
+    deliveredAt: optionalUnixMillis(row.deliveredAt),
+    lastError: row.lastError ?? undefined,
+});
+const decodeWebhookOutboxRecord = (tables, row) => tables.webhookOutbox.decode === undefined
+    ? decodeDefaultWebhookOutboxRecord(row)
+    : tables.webhookOutbox.decode(row);
 const providerTokenVaultTokens = (record) => omitUndefined({
     accessTokenCiphertext: record.accessTokenCiphertext,
     refreshTokenCiphertext: record.refreshTokenCiphertext,
@@ -596,6 +895,17 @@ const verificationInsert = (row) => ({
     metadata: jsonEncode(row.metadata),
     consumed_at: null,
 });
+const auditLogInsert = (event, createdAt) => ({
+    id: event.id ?? null,
+    type: event.type,
+    user_id: auditEventUserId(event) ?? null,
+    actor_user_id: auditEventActorUserId(event) ?? null,
+    occurred_at: Number(event.occurredAt),
+    request_ip_hash: event.request?.ipHash ?? null,
+    request_user_agent_hash: event.request?.userAgentHash ?? null,
+    event: JSON.stringify(event),
+    created_at: Number(createdAt),
+});
 const loginApprovalReviewInsert = (row) => ({
     approval_challenge_id: row.approvalChallengeId,
     flow_id: row.flowId,
@@ -614,6 +924,27 @@ const loginApprovalReviewInsert = (row) => ({
     metadata: jsonEncode(row.metadata),
     review_metadata: jsonEncode(row.reviewMetadata),
 });
+const coordinateMicro = (value) => value === undefined || !Number.isFinite(value)
+    ? null
+    : Math.round(value * 1_000_000);
+const loginRiskHistoryInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    occurred_at: Number(row.occurredAt),
+    outcome: row.outcome,
+    method: row.method,
+    amr: JSON.stringify(row.amr),
+    aal: row.aal,
+    device_status: row.device.status,
+    device_key: row.deviceKey ?? null,
+    location_key: row.locationKey ?? null,
+    country: row.country ?? null,
+    region: row.region ?? null,
+    latitude_micro: coordinateMicro(row.latitude),
+    longitude_micro: coordinateMicro(row.longitude),
+    risk_level: row.riskLevel ?? null,
+    created_at: Number(row.createdAt),
+});
 const userMarkEmailVerifiedUpdate = (input) => ({
     email_verified: 1,
     updated_at: Number(input.updatedAt),
@@ -825,6 +1156,119 @@ const oauthProviderTokenVaultMarkRevoked = (input) => ({
     revoked_at: Number(input.revokedAt),
     revocation_reason: input.reason,
 });
+const oauthClientValues = (record) => ({
+    id: record.id,
+    type: record.type,
+    status: record.status,
+    name: record.name ?? null,
+    redirect_uris: JSON.stringify(record.redirectUris),
+    allowed_grant_types: JSON.stringify(record.allowedGrantTypes),
+    allowed_response_types: JSON.stringify(record.allowedResponseTypes),
+    allowed_scopes: jsonEncode(record.allowedScopes),
+    created_at: record.createdAt === undefined ? null : Number(record.createdAt),
+    updated_at: record.updatedAt === undefined ? null : Number(record.updatedAt),
+    metadata: jsonEncode(record.metadata),
+});
+const oauthConsentId = (input) => JSON.stringify([input.userId, input.clientId]);
+const oauthConsentValues = (record) => ({
+    id: oauthConsentId(record),
+    user_id: record.userId,
+    client_id: record.clientId,
+    scopes: JSON.stringify(record.scopes),
+    granted_at: Number(record.grantedAt),
+    expires_at: record.expiresAt === undefined ? null : Number(record.expiresAt),
+    revoked_at: record.revokedAt === undefined ? null : Number(record.revokedAt),
+    metadata: jsonEncode(record.metadata),
+});
+const oauthConsentRevoke = (input, row) => ({
+    revoked_at: Number(row.revokedAt ?? input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
+});
+const oauthAuthorizationCodeValues = (record) => ({
+    code_hash: record.codeHash,
+    client_id: record.clientId,
+    subject: record.subject,
+    redirect_uri: record.redirectUri,
+    scopes: JSON.stringify(record.scopes),
+    code_challenge: record.codeChallenge ?? null,
+    code_challenge_method: record.codeChallengeMethod ?? null,
+    issued_at: Number(record.issuedAt),
+    expires_at: Number(record.expiresAt),
+    consumed_at: record.consumedAt === undefined ? null : Number(record.consumedAt),
+    metadata: jsonEncode(record.metadata),
+});
+const oauthAuthorizationCodeMarkConsumed = (input) => ({
+    consumed_at: Number(input.consumedAt),
+});
+const oauthClientSecretValues = (record) => ({
+    prefix: record.prefix,
+    client_id: record.clientId,
+    secret_hash: record.secretHash,
+    authentication_methods: JSON.stringify(record.authenticationMethods),
+    created_at: Number(record.createdAt),
+    expires_at: record.expiresAt === undefined ? null : Number(record.expiresAt),
+    last_used_at: record.lastUsedAt === undefined ? null : Number(record.lastUsedAt),
+    revoked_at: record.revokedAt === undefined ? null : Number(record.revokedAt),
+    metadata: jsonEncode(record.metadata),
+});
+const oauthClientSecretMarkUsed = (input) => omitUndefined({
+    last_used_at: Number(input.lastUsedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
+const oauthClientSecretRevoke = (input, row) => ({
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
+});
+const oauthProviderModeTokenValues = (record) => ({
+    token_hash: record.tokenHash,
+    token_type: record.tokenType,
+    client_id: record.clientId,
+    subject: record.subject,
+    scopes: JSON.stringify(record.scopes),
+    issued_at: Number(record.issuedAt),
+    expires_at: Number(record.expiresAt),
+    issuer: record.issuer ?? null,
+    audience: jsonEncode(record.audience),
+    jwt_id: record.jwtId ?? null,
+    revoked_at: record.revokedAt === undefined ? null : Number(record.revokedAt),
+    revocation_reason: record.revocationReason ?? null,
+    rotated_at: record.rotatedAt === undefined ? null : Number(record.rotatedAt),
+    replaced_by_token_hash: record.replacedByTokenHash ?? null,
+    metadata: jsonEncode(record.metadata),
+});
+const oauthProviderModeTokenRevoke = (input, row) => ({
+    revoked_at: Number(row.revokedAt ?? input.revokedAt),
+    revocation_reason: row.revocationReason ?? input.reason ?? null,
+});
+const oauthProviderModeTokenRotate = (input) => ({
+    rotated_at: Number(input.rotatedAt),
+    replaced_by_token_hash: input.replacedByTokenHash,
+});
+const domainVerificationValues = (record) => ({
+    id: record.id,
+    owner_id: record.ownerId,
+    domain: record.domain,
+    proof_method: record.proofMethod,
+    proof_token: record.proofToken,
+    status: record.status,
+    created_at: Number(record.createdAt),
+    expires_at: Number(record.expiresAt),
+    verified_at: record.verifiedAt === undefined ? null : Number(record.verifiedAt),
+    revoked_at: record.revokedAt === undefined ? null : Number(record.revokedAt),
+    last_checked_at: record.lastCheckedAt === undefined ? null : Number(record.lastCheckedAt),
+    metadata: jsonEncode(record.metadata),
+});
+const domainVerificationMarkVerified = (input) => omitUndefined({
+    status: "verified",
+    verified_at: Number(input.verifiedAt),
+    last_checked_at: Number(input.verifiedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
+const domainVerificationRevoke = (input, row) => ({
+    status: "revoked",
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
+});
 const securityTimelineInsert = (event) => ({
     id: event.id,
     user_id: event.userId,
@@ -837,17 +1281,59 @@ const securityTimelineInsert = (event) => ({
     request: jsonEncode(event.request),
     metadata: jsonEncode(event.metadata),
 });
+const webhookOutboxInsert = (record) => ({
+    id: record.id,
+    endpoint_key: record.endpointKey,
+    event: jsonEncode(record.event),
+    status: record.status,
+    attempts: record.attempts,
+    next_attempt_at: Number(record.nextAttemptAt),
+    created_at: Number(record.createdAt),
+    updated_at: Number(record.updatedAt),
+    delivered_at: record.deliveredAt === undefined ? null : Number(record.deliveredAt),
+    last_error: record.lastError ?? null,
+});
+const webhookOutboxMarkDelivered = (input) => ({
+    status: "delivered",
+    delivered_at: Number(input.deliveredAt),
+    updated_at: Number(input.deliveredAt),
+    last_error: null,
+});
+const webhookOutboxMarkFailed = (input) => ({
+    status: "failed",
+    attempts: input.attempts,
+    next_attempt_at: Number(input.nextAttemptAt),
+    updated_at: Number(input.failedAt),
+    last_error: input.error ?? null,
+});
+const webhookOutboxMarkDeadLettered = (input) => ({
+    status: "dead_lettered",
+    updated_at: Number(input.deadLetteredAt),
+    last_error: input.error ?? null,
+});
+const webhookReplayInsert = (input) => ({
+    id: input.id,
+    expires_at: Number(input.expiresAt),
+    created_at: Number(input.now),
+});
+const webhookReplayUpdate = (input) => ({
+    expires_at: Number(input.expiresAt),
+    created_at: Number(input.now),
+});
 const jwtRevocationUpdate = (record) => ({
     revoked_at: Number(record.revokedAt),
     expires_at: record.expiresAt === undefined ? null : Number(record.expiresAt),
     reason: record.reason ?? null,
 });
+const authSqliteTableName = (name, defaultName) => name ?? defaultName;
 const makeInternalAuthSqliteTables = (names = {}) => {
     const user = makeAuthUserTable(names.user ?? "auth_user");
     const credential = makeAuthCredentialTable(names.credential ?? "auth_credential");
     const session = makeAuthSessionTable(names.session ?? "auth_session");
     const verification = makeAuthVerificationTable(names.verification ?? "auth_verification");
+    const auditLog = makeAuthAuditLogTable(authSqliteTableName(names.auditLog, "auth_audit_log"));
     const loginApprovalReview = makeAuthLoginApprovalReviewTable(names.loginApprovalReview ?? "auth_login_approval_review");
+    const loginRiskHistory = makeAuthLoginRiskHistoryTable(names.loginRiskHistory ?? "auth_login_risk_history");
     const trustedDevice = makeAuthTrustedDeviceTable(names.trustedDevice ?? "auth_trusted_device");
     const passkeyCredential = makeAuthPasskeyCredentialTable(names.passkeyCredential ?? "auth_passkey_credential");
     const totpFactor = makeAuthTotpFactorTable(names.totpFactor ?? "auth_totp_factor");
@@ -856,8 +1342,16 @@ const makeInternalAuthSqliteTables = (names = {}) => {
     const refreshToken = makeAuthRefreshTokenTable(names.refreshToken ?? "auth_refresh_token");
     const jwtRevocation = makeAuthJwtRevocationTable(names.jwtRevocation ?? "auth_jwt_revocation");
     const oauthAccount = makeAuthOAuthAccountTable(names.oauthAccount ?? "auth_oauth_account");
+    const oauthClient = makeAuthOAuthClientTable(authSqliteTableName(names.oauthClient, "auth_oauth_client"));
+    const oauthConsent = makeAuthOAuthConsentTable(authSqliteTableName(names.oauthConsent, "auth_oauth_consent"));
+    const oauthAuthorizationCode = makeAuthOAuthAuthorizationCodeTable(authSqliteTableName(names.oauthAuthorizationCode, "auth_oauth_authorization_code"));
+    const oauthClientSecret = makeAuthOAuthClientSecretTable(authSqliteTableName(names.oauthClientSecret, "auth_oauth_client_secret"));
+    const oauthProviderModeToken = makeAuthOAuthProviderModeTokenTable(authSqliteTableName(names.oauthProviderModeToken, "auth_oauth_provider_mode_token"));
     const oauthProviderTokenVault = makeAuthOAuthProviderTokenVaultTable(names.oauthProviderTokenVault ?? "auth_oauth_provider_token_vault");
+    const domainVerification = makeAuthDomainVerificationTable(authSqliteTableName(names.domainVerification, "auth_domain_verification"));
     const securityTimeline = makeAuthSecurityTimelineTable(names.securityTimeline ?? "auth_security_timeline");
+    const webhookOutbox = makeAuthWebhookOutboxTable(names.webhookOutbox ?? "auth_webhook_outbox");
+    const webhookReplay = makeAuthWebhookReplayTable(names.webhookReplay ?? "auth_webhook_replay");
     return {
         user: {
             table: user,
@@ -926,6 +1420,21 @@ const makeInternalAuthSqliteTables = (names = {}) => {
             insert: verificationInsert,
             consume: verificationConsumeUpdate,
         },
+        auditLog: {
+            table: auditLog,
+            select: {
+                id: auditLog.id,
+                type: auditLog.type,
+                userId: auditLog.user_id,
+                actorUserId: auditLog.actor_user_id,
+                occurredAt: auditLog.occurred_at,
+                requestIpHash: auditLog.request_ip_hash,
+                requestUserAgentHash: auditLog.request_user_agent_hash,
+                event: auditLog.event,
+                createdAt: auditLog.created_at,
+            },
+            insert: auditLogInsert,
+        },
         loginApprovalReview: {
             table: loginApprovalReview,
             select: {
@@ -950,6 +1459,28 @@ const makeInternalAuthSqliteTables = (names = {}) => {
             approve: loginApprovalReviewApproveUpdate,
             deny: loginApprovalReviewDenyUpdate,
         },
+        loginRiskHistory: {
+            table: loginRiskHistory,
+            select: {
+                id: loginRiskHistory.id,
+                userId: loginRiskHistory.user_id,
+                occurredAt: loginRiskHistory.occurred_at,
+                outcome: loginRiskHistory.outcome,
+                method: loginRiskHistory.method,
+                amr: loginRiskHistory.amr,
+                aal: loginRiskHistory.aal,
+                deviceStatus: loginRiskHistory.device_status,
+                deviceKey: loginRiskHistory.device_key,
+                locationKey: loginRiskHistory.location_key,
+                country: loginRiskHistory.country,
+                region: loginRiskHistory.region,
+                latitudeMicro: loginRiskHistory.latitude_micro,
+                longitudeMicro: loginRiskHistory.longitude_micro,
+                riskLevel: loginRiskHistory.risk_level,
+                createdAt: loginRiskHistory.created_at,
+            },
+            insert: loginRiskHistoryInsert,
+        },
         trustedDevice: {
             table: trustedDevice,
             select: {
@@ -1085,6 +1616,101 @@ const makeInternalAuthSqliteTables = (names = {}) => {
             insert: oauthAccountInsert,
             unlink: oauthAccountUnlink,
         },
+        oauthClient: {
+            table: oauthClient,
+            select: {
+                id: oauthClient.id,
+                type: oauthClient.type,
+                status: oauthClient.status,
+                name: oauthClient.name,
+                redirectUris: oauthClient.redirect_uris,
+                allowedGrantTypes: oauthClient.allowed_grant_types,
+                allowedResponseTypes: oauthClient.allowed_response_types,
+                allowedScopes: oauthClient.allowed_scopes,
+                createdAt: oauthClient.created_at,
+                updatedAt: oauthClient.updated_at,
+                metadata: oauthClient.metadata,
+            },
+            insert: oauthClientValues,
+            update: oauthClientValues,
+        },
+        oauthConsent: {
+            table: oauthConsent,
+            select: {
+                id: oauthConsent.id,
+                userId: oauthConsent.user_id,
+                clientId: oauthConsent.client_id,
+                scopes: oauthConsent.scopes,
+                grantedAt: oauthConsent.granted_at,
+                expiresAt: oauthConsent.expires_at,
+                revokedAt: oauthConsent.revoked_at,
+                metadata: oauthConsent.metadata,
+            },
+            insert: oauthConsentValues,
+            update: oauthConsentValues,
+            revoke: oauthConsentRevoke,
+        },
+        oauthAuthorizationCode: {
+            table: oauthAuthorizationCode,
+            select: {
+                codeHash: oauthAuthorizationCode.code_hash,
+                clientId: oauthAuthorizationCode.client_id,
+                subject: oauthAuthorizationCode.subject,
+                redirectUri: oauthAuthorizationCode.redirect_uri,
+                scopes: oauthAuthorizationCode.scopes,
+                codeChallenge: oauthAuthorizationCode.code_challenge,
+                codeChallengeMethod: oauthAuthorizationCode.code_challenge_method,
+                issuedAt: oauthAuthorizationCode.issued_at,
+                expiresAt: oauthAuthorizationCode.expires_at,
+                consumedAt: oauthAuthorizationCode.consumed_at,
+                metadata: oauthAuthorizationCode.metadata,
+            },
+            insert: oauthAuthorizationCodeValues,
+            update: oauthAuthorizationCodeValues,
+            markConsumed: oauthAuthorizationCodeMarkConsumed,
+        },
+        oauthClientSecret: {
+            table: oauthClientSecret,
+            select: {
+                prefix: oauthClientSecret.prefix,
+                clientId: oauthClientSecret.client_id,
+                secretHash: oauthClientSecret.secret_hash,
+                authenticationMethods: oauthClientSecret.authentication_methods,
+                createdAt: oauthClientSecret.created_at,
+                expiresAt: oauthClientSecret.expires_at,
+                lastUsedAt: oauthClientSecret.last_used_at,
+                revokedAt: oauthClientSecret.revoked_at,
+                metadata: oauthClientSecret.metadata,
+            },
+            insert: oauthClientSecretValues,
+            update: oauthClientSecretValues,
+            markUsed: oauthClientSecretMarkUsed,
+            revoke: oauthClientSecretRevoke,
+        },
+        oauthProviderModeToken: {
+            table: oauthProviderModeToken,
+            select: {
+                tokenHash: oauthProviderModeToken.token_hash,
+                tokenType: oauthProviderModeToken.token_type,
+                clientId: oauthProviderModeToken.client_id,
+                subject: oauthProviderModeToken.subject,
+                scopes: oauthProviderModeToken.scopes,
+                issuedAt: oauthProviderModeToken.issued_at,
+                expiresAt: oauthProviderModeToken.expires_at,
+                issuer: oauthProviderModeToken.issuer,
+                audience: oauthProviderModeToken.audience,
+                jwtId: oauthProviderModeToken.jwt_id,
+                revokedAt: oauthProviderModeToken.revoked_at,
+                revocationReason: oauthProviderModeToken.revocation_reason,
+                rotatedAt: oauthProviderModeToken.rotated_at,
+                replacedByTokenHash: oauthProviderModeToken.replaced_by_token_hash,
+                metadata: oauthProviderModeToken.metadata,
+            },
+            insert: oauthProviderModeTokenValues,
+            update: oauthProviderModeTokenValues,
+            revoke: oauthProviderModeTokenRevoke,
+            rotate: oauthProviderModeTokenRotate,
+        },
         oauthProviderTokenVault: {
             table: oauthProviderTokenVault,
             select: {
@@ -1106,6 +1732,27 @@ const makeInternalAuthSqliteTables = (names = {}) => {
             update: oauthProviderTokenVaultValues,
             markRevoked: oauthProviderTokenVaultMarkRevoked,
         },
+        domainVerification: {
+            table: domainVerification,
+            select: {
+                id: domainVerification.id,
+                ownerId: domainVerification.owner_id,
+                domain: domainVerification.domain,
+                proofMethod: domainVerification.proof_method,
+                proofToken: domainVerification.proof_token,
+                status: domainVerification.status,
+                createdAt: domainVerification.created_at,
+                expiresAt: domainVerification.expires_at,
+                verifiedAt: domainVerification.verified_at,
+                revokedAt: domainVerification.revoked_at,
+                lastCheckedAt: domainVerification.last_checked_at,
+                metadata: domainVerification.metadata,
+            },
+            insert: domainVerificationValues,
+            update: domainVerificationValues,
+            markVerified: domainVerificationMarkVerified,
+            revoke: domainVerificationRevoke,
+        },
         securityTimeline: {
             table: securityTimeline,
             select: {
@@ -1122,6 +1769,35 @@ const makeInternalAuthSqliteTables = (names = {}) => {
             },
             insert: securityTimelineInsert,
         },
+        webhookOutbox: {
+            table: webhookOutbox,
+            select: {
+                id: webhookOutbox.id,
+                endpointKey: webhookOutbox.endpoint_key,
+                event: webhookOutbox.event,
+                status: webhookOutbox.status,
+                attempts: webhookOutbox.attempts,
+                nextAttemptAt: webhookOutbox.next_attempt_at,
+                createdAt: webhookOutbox.created_at,
+                updatedAt: webhookOutbox.updated_at,
+                deliveredAt: webhookOutbox.delivered_at,
+                lastError: webhookOutbox.last_error,
+            },
+            insert: webhookOutboxInsert,
+            markDelivered: webhookOutboxMarkDelivered,
+            markFailed: webhookOutboxMarkFailed,
+            markDeadLettered: webhookOutboxMarkDeadLettered,
+        },
+        webhookReplay: {
+            table: webhookReplay,
+            select: {
+                id: webhookReplay.id,
+                expiresAt: webhookReplay.expires_at,
+                createdAt: webhookReplay.created_at,
+            },
+            insert: webhookReplayInsert,
+            update: webhookReplayUpdate,
+        },
     };
 };
 const asAuthSqliteTables = (tables) => tables;
@@ -1132,7 +1808,9 @@ const selectUserColumns = (tables) => tables.user.select;
 const selectCredentialColumns = (tables) => tables.credential.select;
 const selectSessionColumns = (tables) => tables.session.select;
 const selectVerificationColumns = (tables) => tables.verification.select;
+const selectAuditLogColumns = (tables) => tables.auditLog.select;
 const selectLoginApprovalReviewColumns = (tables) => tables.loginApprovalReview.select;
+const selectLoginRiskHistoryColumns = (tables) => tables.loginRiskHistory.select;
 const selectTrustedDeviceColumns = (tables) => tables.trustedDevice.select;
 const selectPasskeyCredentialColumns = (tables) => tables.passkeyCredential.select;
 const selectTotpFactorColumns = (tables) => tables.totpFactor.select;
@@ -1141,13 +1819,31 @@ const selectApiKeyColumns = (tables) => tables.apiKey.select;
 const selectRefreshTokenColumns = (tables) => tables.refreshToken.select;
 const selectJwtRevocationColumns = (tables) => tables.jwtRevocation.select;
 const selectOAuthAccountColumns = (tables) => tables.oauthAccount.select;
+const selectOAuthClientColumns = (tables) => tables.oauthClient.select;
+const selectOAuthConsentColumns = (tables) => tables.oauthConsent.select;
+const selectOAuthAuthorizationCodeColumns = (tables) => tables.oauthAuthorizationCode.select;
+const selectOAuthClientSecretColumns = (tables) => tables.oauthClientSecret.select;
+const selectOAuthProviderModeTokenColumns = (tables) => tables.oauthProviderModeToken.select;
 const selectOAuthProviderTokenVaultColumns = (tables) => tables.oauthProviderTokenVault.select;
+const selectDomainVerificationColumns = (tables) => tables.domainVerification.select;
 const selectSecurityTimelineColumns = (tables) => tables.securityTimeline.select;
+const selectWebhookOutboxColumns = (tables) => tables.webhookOutbox.select;
+const selectWebhookReplayColumns = (tables) => tables.webhookReplay.select;
 const storageError = (entity, operation, cause) => StorageError.fromUnknown(entity, operation, cause);
+const auditLogStoreError = (operation, cause) => new AuditLogStoreError({
+    operation,
+    message: `Audit log ${operation} failed`,
+    cause,
+});
 const loginApprovalReviewStoreError = (operation, cause) => new LoginApprovalReviewError({
     message: `Login approval review ${operation} failed`,
     cause,
 });
+const loginRiskHistoryStoreError = (operation, cause) => new LoginRiskHistoryError({
+    operation,
+    message: `Login risk history ${operation} failed`,
+    cause,
+});
 const trustedDeviceStoreError = (operation, cause) => new TrustedDeviceError({
     operation,
     message: `Trusted device ${operation} failed`,
@@ -1188,16 +1884,56 @@ const oauthAccountStoreError = (operation, cause) => new OAuthAccountStoreError(
     message: `OAuth account ${operation} failed`,
     cause,
 });
+const oauthClientStoreError = (operation, cause) => new OAuthClientStoreError({
+    operation,
+    message: `OAuth client ${operation} failed`,
+    cause,
+});
+const oauthConsentStoreError = (operation, cause) => new OAuthConsentStoreError({
+    operation,
+    message: `OAuth consent ${operation} failed`,
+    cause,
+});
+const oauthAuthorizationCodeStoreError = (operation, cause) => new OAuthAuthorizationCodeStoreError({
+    operation,
+    message: `OAuth authorization code ${operation} failed`,
+    cause,
+});
+const oauthClientSecretStoreError = (operation, cause) => new OAuthClientSecretStoreError({
+    operation,
+    message: `OAuth client secret ${operation} failed`,
+    cause,
+});
+const oauthProviderModeTokenStoreError = (operation, cause) => new OAuthProviderModeTokenStoreError({
+    operation,
+    message: `OAuth provider-mode token ${operation} failed`,
+    cause,
+});
 const oauthProviderTokenVaultError = (operation, cause) => new OAuthProviderTokenVaultError({
     operation,
     message: `OAuth provider token vault ${operation} failed`,
     cause,
 });
+const domainVerificationStoreError = (operation, cause) => new DomainVerificationStoreError({
+    operation,
+    message: `Domain verification ${operation} failed`,
+    cause,
+});
 const securityTimelineStoreError = (operation, cause) => new SecurityTimelineStoreError({
     operation,
     message: `Security timeline ${operation} failed`,
     cause,
 });
+const webhookOutboxStoreError = (operation, cause) => new WebhookOutboxStoreError({
+    operation,
+    message: `Webhook outbox ${operation} failed`,
+    cause,
+});
+const webhookReplayStoreError = (operation, cause) => new WebhookReplayStoreError({
+    operation,
+    message: `Webhook replay ${operation} failed`,
+    cause,
+});
 const findUserById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectUserColumns(tables)).pipe(Query.from(tables.user.table), Query.where(queryEq(tables.user.select.id, id)))).pipe(Effect.mapError((cause) => storageError("user", operation, cause)), Effect.map((rows) => rows[0] === undefined
     ? Option.none()
     : Option.some(decodeUserRow(tables, rows[0]))));
@@ -1260,6 +1996,44 @@ const findOAuthAccountByProviderAccount = (executor, tables, input, operation =
         ? Option.none()
         : Option.some(decodeOAuthAccountRow(tables, rows[0]))));
 };
+const findOAuthClientById = (executor, tables, input, operation = "find") => executePlan(executor, Query.select(selectOAuthClientColumns(tables)).pipe(Query.from(tables.oauthClient.table), Query.where(queryEq(tables.oauthClient.select.id, input.clientId)))).pipe(Effect.mapError((cause) => oauthClientStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeOAuthClientRow(tables, rows[0]))));
+const findOAuthConsentByUserAndClient = (executor, tables, input, operation = "find-active") => executePlan(executor, Query.select(selectOAuthConsentColumns(tables)).pipe(Query.from(tables.oauthConsent.table), Query.where(queryEq(tables.oauthConsent.select.userId, input.userId)), Query.where(queryEq(tables.oauthConsent.select.clientId, input.clientId)))).pipe(Effect.mapError((cause) => oauthConsentStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeOAuthConsentRow(tables, rows[0]))));
+const deleteOAuthConsentRowsBefore = (executor, tables, column, before) => executePlan(executor, Query.delete(tables.oauthConsent.table).pipe(Query.where(queryLt(column, Number(before))), Query.returning({ id: tables.oauthConsent.select.id }))).pipe(Effect.map((rows) => rows.length));
+const deleteOAuthInactiveConsents = (executor, tables, input) => Effect.gen(function* () {
+    const expiredDeleted = input.beforeExpiresAt === undefined
+        ? 0
+        : yield* deleteOAuthConsentRowsBefore(executor, tables, tables.oauthConsent.select.expiresAt, input.beforeExpiresAt);
+    const revokedDeleted = input.beforeRevokedAt === undefined
+        ? 0
+        : yield* deleteOAuthConsentRowsBefore(executor, tables, tables.oauthConsent.select.revokedAt, input.beforeRevokedAt);
+    return expiredDeleted + revokedDeleted;
+}).pipe(Effect.mapError((cause) => oauthConsentStoreError("deleteInactive", cause)));
+const findOAuthAuthorizationCodeByHash = (executor, tables, input, operation = "find") => executePlan(executor, Query.select(selectOAuthAuthorizationCodeColumns(tables)).pipe(Query.from(tables.oauthAuthorizationCode.table), Query.where(queryEq(tables.oauthAuthorizationCode.select.codeHash, input.codeHash)))).pipe(Effect.mapError((cause) => oauthAuthorizationCodeStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeOAuthAuthorizationCodeRow(tables, rows[0]))));
+const findOAuthClientSecretByClientIdAndPrefix = (executor, tables, input, operation = "find") => executePlan(executor, Query.select(selectOAuthClientSecretColumns(tables)).pipe(Query.from(tables.oauthClientSecret.table), Query.where(queryEq(tables.oauthClientSecret.select.clientId, input.clientId)), Query.where(queryEq(tables.oauthClientSecret.select.prefix, input.prefix)))).pipe(Effect.mapError((cause) => oauthClientSecretStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeOAuthClientSecretRow(tables, rows[0]))));
+const findOAuthProviderModeTokenByHash = (executor, tables, input, operation = "find") => executePlan(executor, Query.select(selectOAuthProviderModeTokenColumns(tables)).pipe(Query.from(tables.oauthProviderModeToken.table), Query.where(queryEq(tables.oauthProviderModeToken.select.tokenHash, input.tokenHash)))).pipe(Effect.mapError((cause) => oauthProviderModeTokenStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeOAuthProviderModeTokenRow(tables, rows[0]))));
+const deleteOAuthProviderModeTokenRowsBefore = (executor, tables, column, before) => executePlan(executor, Query.delete(tables.oauthProviderModeToken.table).pipe(Query.where(queryLt(column, Number(before))), Query.returning({ tokenHash: tables.oauthProviderModeToken.select.tokenHash }))).pipe(Effect.map((rows) => rows.length));
+const deleteOAuthProviderModeRetiredTokens = (executor, tables, input) => Effect.gen(function* () {
+    const expiredDeleted = input.beforeExpiresAt === undefined
+        ? 0
+        : yield* deleteOAuthProviderModeTokenRowsBefore(executor, tables, tables.oauthProviderModeToken.select.expiresAt, input.beforeExpiresAt);
+    const revokedDeleted = input.beforeRevokedAt === undefined
+        ? 0
+        : yield* deleteOAuthProviderModeTokenRowsBefore(executor, tables, tables.oauthProviderModeToken.select.revokedAt, input.beforeRevokedAt);
+    const rotatedDeleted = input.beforeRotatedAt === undefined
+        ? 0
+        : yield* deleteOAuthProviderModeTokenRowsBefore(executor, tables, tables.oauthProviderModeToken.select.rotatedAt, input.beforeRotatedAt);
+    return expiredDeleted + revokedDeleted + rotatedDeleted;
+}).pipe(Effect.mapError((cause) => oauthProviderModeTokenStoreError("deleteRetired", cause)));
 const findOAuthProviderTokenVaultRecordByAccountId = (executor, tables, input, operation, includeRevoked = false) => {
     const base = Query.select(selectOAuthProviderTokenVaultColumns(tables)).pipe(Query.from(tables.oauthProviderTokenVault.table), Query.where(queryEq(tables.oauthProviderTokenVault.select.accountId, input.accountId)));
     const query = includeRevoked
@@ -1269,7 +2043,175 @@ const findOAuthProviderTokenVaultRecordByAccountId = (executor, tables, input, o
         ? Option.none()
         : Option.some(decodeOAuthProviderTokenVaultRow(tables, rows[0]))));
 };
+const findDomainVerificationById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectDomainVerificationColumns(tables)).pipe(Query.from(tables.domainVerification.table), Query.where(queryEq(tables.domainVerification.select.id, id)))).pipe(Effect.mapError((cause) => domainVerificationStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeDomainVerificationRecord(tables, rows[0]))));
+const findDomainVerificationByOwnerAndDomain = (executor, tables, input, operation = "find") => executePlan(executor, Query.select(selectDomainVerificationColumns(tables)).pipe(Query.from(tables.domainVerification.table), Query.where(queryEq(tables.domainVerification.select.ownerId, input.ownerId)), Query.where(queryEq(tables.domainVerification.select.domain, input.domain)))).pipe(Effect.mapError((cause) => domainVerificationStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeDomainVerificationRecord(tables, rows[0]))));
 const listSecurityTimelineByUser = (executor, tables, input, operation = "list") => executePlan(executor, Query.select(selectSecurityTimelineColumns(tables)).pipe(Query.from(tables.securityTimeline.table), Query.where(queryEq(tables.securityTimeline.select.userId, input.userId)))).pipe(Effect.mapError((cause) => securityTimelineStoreError(operation, cause)), Effect.map((rows) => filterSecurityTimelineEvents(rows.map((row) => decodeSecurityTimelineEvent(tables, row)), input)));
+const deleteSecurityTimelineBefore = (executor, tables, input) => {
+    const base = Query.delete(tables.securityTimeline.table).pipe(Query.where(queryLt(tables.securityTimeline.select.occurredAt, Number(input.beforeOccurredAt))));
+    const query = input.userId === undefined
+        ? base
+        : base.pipe(Query.where(queryEq(tables.securityTimeline.select.userId, input.userId)));
+    return executePlan(executor, query.pipe(Query.returning({ id: tables.securityTimeline.select.id }))).pipe(Effect.mapError((cause) => securityTimelineStoreError("deleteBefore", cause)), Effect.map((rows) => rows.length));
+};
+const findWebhookOutboxRecordById = (executor, tables, id, operation) => executePlan(executor, Query.select(selectWebhookOutboxColumns(tables)).pipe(Query.from(tables.webhookOutbox.table), Query.where(queryEq(tables.webhookOutbox.select.id, id)))).pipe(Effect.mapError((cause) => webhookOutboxStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeWebhookOutboxRecord(tables, rows[0]))));
+const claimDueWebhookOutboxRecords = (executor, tables, input) => Effect.gen(function* () {
+    const now = input.now ?? (yield* currentUnixMillis);
+    const base = Query.select(selectWebhookOutboxColumns(tables)).pipe(Query.from(tables.webhookOutbox.table), Query.where(queryLte(tables.webhookOutbox.select.nextAttemptAt, Number(now))));
+    const query = input.endpointKey === undefined
+        ? base
+        : base.pipe(Query.where(queryEq(tables.webhookOutbox.select.endpointKey, input.endpointKey)));
+    const rows = yield* executePlan(executor, query).pipe(Effect.mapError((cause) => webhookOutboxStoreError("claimDue", cause)));
+    return filterDueWebhookOutboxRecords(rows.map((row) => decodeWebhookOutboxRecord(tables, row)), { ...input, now });
+});
+const deleteWebhookOutboxRecordsBefore = (executor, tables, input) => {
+    const [firstStatus, ...remainingStatuses] = input.statuses;
+    const base = Query.delete(tables.webhookOutbox.table).pipe(Query.where(queryLt(tables.webhookOutbox.select.updatedAt, Number(input.beforeUpdatedAt))), Query.where(queryIn(tables.webhookOutbox.select.status, firstStatus, ...remainingStatuses)));
+    const query = input.endpointKey === undefined
+        ? base
+        : base.pipe(Query.where(queryEq(tables.webhookOutbox.select.endpointKey, input.endpointKey)));
+    return executePlan(executor, query.pipe(Query.returning({ id: tables.webhookOutbox.select.id }))).pipe(Effect.mapError((cause) => webhookOutboxStoreError("deleteBefore", cause)), Effect.map((rows) => rows.length));
+};
+const deleteExpiredWebhookReplayRecords = (executor, tables, input) => Effect.gen(function* () {
+    const now = input.now ?? (yield* currentUnixMillis);
+    return yield* executePlan(executor, Query.delete(tables.webhookReplay.table).pipe(Query.where(queryLt(tables.webhookReplay.select.expiresAt, Number(now))), Query.returning({ id: tables.webhookReplay.select.id }))).pipe(Effect.mapError((cause) => webhookReplayStoreError("deleteExpired", cause)), Effect.map((rows) => rows.length));
+});
+const listAuditLogRecords = (executor, tables, input = {}) => {
+    if (input.types !== undefined && input.types.length === 0) {
+        return Effect.succeed([]);
+    }
+    const base = Query.select(selectAuditLogColumns(tables)).pipe(Query.from(tables.auditLog.table));
+    const byUser = input.userId === undefined
+        ? base
+        : base.pipe(Query.where(queryEq(tables.auditLog.select.userId, input.userId)));
+    const byOccurredAt = input.beforeOccurredAt === undefined
+        ? byUser
+        : byUser.pipe(Query.where(queryLt(tables.auditLog.select.occurredAt, Number(input.beforeOccurredAt))));
+    const query = input.types === undefined
+        ? byOccurredAt
+        : byOccurredAt.pipe(Query.where(queryIn(tables.auditLog.select.type, input.types[0], ...input.types.slice(1))));
+    return executePlan(executor, query).pipe(Effect.mapError((cause) => auditLogStoreError("list", cause)), Effect.map((rows) => filterAuditLogEvents(rows.map((row) => decodeAuditLogEvent(tables, row)), input)));
+};
+const deleteAuditLogRecordsBefore = (executor, tables, input) => {
+    const base = Query.delete(tables.auditLog.table).pipe(Query.where(queryLt(tables.auditLog.select.occurredAt, Number(input.beforeOccurredAt))));
+    const query = input.userId === undefined
+        ? base
+        : base.pipe(Query.where(queryEq(tables.auditLog.select.userId, input.userId)));
+    return executePlan(executor, query.pipe(Query.returning({ occurredAt: tables.auditLog.select.occurredAt }))).pipe(Effect.mapError((cause) => auditLogStoreError("deleteBefore", cause)), Effect.map((rows) => rows.length));
+};
+const defaultLoginRiskHistoryRecentWindowMillis = 15 * 60 * 1000;
+const defaultLoginRiskHistoryWindowMillis = 90 * 24 * 60 * 60 * 1000;
+const defaultLoginRiskImpossibleTravelWindowMillis = 24 * 60 * 60 * 1000;
+const defaultLoginRiskImpossibleTravelKmh = 900;
+const positiveWindowMillis = (value, defaultValue) => value === undefined || !Number.isFinite(value)
+    ? defaultValue
+    : Math.max(0, value);
+const loginRiskHistoryOptions = (options) => ({
+    recentWindowMillis: positiveWindowMillis(options?.recentWindowMillis, defaultLoginRiskHistoryRecentWindowMillis),
+    historyWindowMillis: positiveWindowMillis(options?.historyWindowMillis, defaultLoginRiskHistoryWindowMillis),
+    impossibleTravelWindowMillis: positiveWindowMillis(options?.impossibleTravelWindowMillis, defaultLoginRiskImpossibleTravelWindowMillis),
+    impossibleTravelKmh: options?.impossibleTravelKmh === undefined ||
+        !Number.isFinite(options.impossibleTravelKmh)
+        ? defaultLoginRiskImpossibleTravelKmh
+        : Math.max(0, options.impossibleTravelKmh),
+});
+const toRadians = (degrees) => (degrees * Math.PI) / 180;
+const distanceKm = (first, second) => {
+    const earthRadiusKm = 6371;
+    const latitudeDelta = toRadians(second.latitude - first.latitude);
+    const longitudeDelta = toRadians(second.longitude - first.longitude);
+    const firstLatitude = toRadians(first.latitude);
+    const secondLatitude = toRadians(second.latitude);
+    const haversine = Math.sin(latitudeDelta / 2) ** 2 +
+        Math.cos(firstLatitude) *
+            Math.cos(secondLatitude) *
+            Math.sin(longitudeDelta / 2) ** 2;
+    return (2 * earthRadiusKm * Math.atan2(Math.sqrt(haversine), Math.sqrt(1 - haversine)));
+};
+const hasCoordinates = (value) => value.latitude !== undefined &&
+    Number.isFinite(value.latitude) &&
+    value.longitude !== undefined &&
+    Number.isFinite(value.longitude);
+const loginRiskHistoryLookupResult = (input, rows, options) => {
+    const normalized = loginRiskHistoryOptions(options);
+    const occurredAt = Number(input.occurredAt);
+    const recentStart = occurredAt - normalized.recentWindowMillis;
+    const historyStart = occurredAt - normalized.historyWindowMillis;
+    const impossibleTravelStart = occurredAt - normalized.impossibleTravelWindowMillis;
+    const previousRows = rows.filter((row) => Number(row.occurredAt) < occurredAt);
+    const recentRows = previousRows.filter((row) => Number(row.occurredAt) >= recentStart);
+    const historyRows = previousRows.filter((row) => Number(row.occurredAt) >= historyStart);
+    const recentFailedLoginCount = recentRows.filter((row) => row.outcome === "failure").length;
+    const recentSuccessfulLoginCount = recentRows.filter((row) => row.outcome === "success").length;
+    const knownDevice = input.deviceKey === undefined
+        ? undefined
+        : historyRows.some((row) => row.deviceKey === input.deviceKey);
+    const knownLocation = input.locationKey === undefined
+        ? undefined
+        : historyRows.some((row) => row.locationKey === input.locationKey);
+    const currentLocation = {
+        latitude: input.request?.latitude,
+        longitude: input.request?.longitude,
+    };
+    const impossibleTravel = hasCoordinates(currentLocation)
+        ? previousRows
+            .filter((row) => row.outcome === "success" &&
+            Number(row.occurredAt) >= impossibleTravelStart)
+            .some((row) => {
+            const previousLocation = {
+                latitude: row.latitude,
+                longitude: row.longitude,
+            };
+            if (!hasCoordinates(previousLocation)) {
+                return false;
+            }
+            const elapsedHours = (occurredAt - Number(row.occurredAt)) / 3_600_000;
+            return (elapsedHours > 0 &&
+                distanceKm(previousLocation, currentLocation) / elapsedHours >
+                    normalized.impossibleTravelKmh);
+        })
+        : undefined;
+    const recentRiskLevels = recentRows.flatMap((row) => row.riskLevel === undefined ? [] : [row.riskLevel]);
+    const riskLevel = recentRiskLevels.length === 0
+        ? undefined
+        : maxLoginRiskLevel(recentRiskLevels, "unknown");
+    const reasons = [
+        ...(recentFailedLoginCount > 0 ? ["recent-failed-login"] : []),
+        ...(knownDevice === false ? ["new-device"] : []),
+        ...(knownLocation === false ? ["new-location"] : []),
+        ...(impossibleTravel === true ? ["impossible-travel"] : []),
+    ];
+    return omitUndefined({
+        recentLoginCount: recentRows.length,
+        recentFailedLoginCount,
+        recentSuccessfulLoginCount,
+        knownDevice,
+        newDevice: knownDevice === undefined ? undefined : !knownDevice,
+        knownLocation,
+        newLocation: knownLocation === undefined ? undefined : !knownLocation,
+        impossibleTravel,
+        riskLevel,
+        reasons: reasons.length === 0 ? undefined : reasons,
+    });
+};
+const lookupLoginRiskHistory = (executor, tables, input, options) => {
+    const normalized = loginRiskHistoryOptions(options);
+    const occurredAt = Number(input.occurredAt);
+    const earliestOccurredAt = Math.min(occurredAt - normalized.recentWindowMillis, occurredAt - normalized.historyWindowMillis, occurredAt - normalized.impossibleTravelWindowMillis);
+    return executePlan(executor, Query.select(selectLoginRiskHistoryColumns(tables)).pipe(Query.from(tables.loginRiskHistory.table), Query.where(queryEq(tables.loginRiskHistory.select.userId, input.userId)), Query.where(queryLt(tables.loginRiskHistory.select.occurredAt, occurredAt)), Query.where(queryGt(tables.loginRiskHistory.select.occurredAt, earliestOccurredAt - 1)))).pipe(Effect.mapError((cause) => loginRiskHistoryStoreError("lookup", cause)), Effect.map((rows) => loginRiskHistoryLookupResult(input, rows.map((row) => decodeLoginRiskHistoryRecord(tables, row)), options)));
+};
+const deleteLoginRiskHistoryRecordsBefore = (executor, tables, input) => {
+    const base = Query.delete(tables.loginRiskHistory.table).pipe(Query.where(queryLt(tables.loginRiskHistory.select.occurredAt, Number(input.beforeOccurredAt))));
+    const query = input.userId === undefined
+        ? base
+        : base.pipe(Query.where(queryEq(tables.loginRiskHistory.select.userId, input.userId)));
+    return executePlan(executor, query.pipe(Query.returning({ id: tables.loginRiskHistory.select.id }))).pipe(Effect.mapError((cause) => loginRiskHistoryStoreError("deleteBefore", cause)), Effect.map((rows) => rows.length));
+};
 export const makeEffectQbSqliteUserStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
     return UserStore.make({
@@ -1349,6 +2291,17 @@ export const makeEffectQbSqliteVerificationStore = (executor, options = {}) => {
         },
     });
 };
+export const makeEffectQbSqliteAuditLogStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return AuditLogStore.make({
+        insert: (event) => Effect.gen(function* () {
+            const createdAt = yield* currentUnixMillis;
+            yield* executePlan(executor, queryInsert(tables.auditLog.table, mutationValues(tables.auditLog.insert(event, createdAt)))).pipe(Effect.mapError((cause) => auditLogStoreError("insert", cause)), Effect.asVoid);
+        }),
+        list: (input = {}) => listAuditLogRecords(executor, tables, input),
+        deleteBefore: (input) => deleteAuditLogRecordsBefore(executor, tables, input),
+    });
+};
 export const makeEffectQbSqliteLoginApprovalReviewStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
     return LoginApprovalReviewStore.make({
@@ -1362,6 +2315,17 @@ export const makeEffectQbSqliteLoginApprovalReviewStore = (executor, options = {
             : Option.some(decodeLoginApprovalReviewRow(tables, rows[0])))),
     });
 };
+export const makeEffectQbSqliteLoginRiskHistoryStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return LoginRiskHistory.make({
+        lookup: (input) => lookupLoginRiskHistory(executor, tables, input, options.loginRiskHistory),
+        record: (input) => Effect.gen(function* () {
+            const createdAt = input.createdAt ?? (yield* currentUnixMillis);
+            yield* executePlan(executor, queryInsert(tables.loginRiskHistory.table, mutationValues(tables.loginRiskHistory.insert({ ...input, createdAt })))).pipe(Effect.mapError((cause) => loginRiskHistoryStoreError("record", cause)), Effect.asVoid);
+        }),
+        deleteBefore: (input) => deleteLoginRiskHistoryRecordsBefore(executor, tables, input),
+    });
+};
 export const makeEffectQbSqliteTrustedDeviceStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
     return TrustedDeviceStore.make({
@@ -1567,6 +2531,118 @@ export const makeEffectQbSqliteOAuthAccountStore = (executor, options = {}) => {
         })),
     });
 };
+export const makeEffectQbSqliteOAuthClientStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return OAuthClientStore.make({
+        upsert: (record) => executePlan(executor, queryInsert(tables.oauthClient.table, mutationValues(tables.oauthClient.insert(record))).pipe(Query.onConflict("id", {
+            update: mutationValues(tables.oauthClient.update(record)),
+        }))).pipe(Effect.mapError((cause) => oauthClientStoreError("upsert", cause)), Effect.asVoid),
+        find: (input) => findOAuthClientById(executor, tables, input),
+        list: (input = {}) => {
+            const base = Query.select(selectOAuthClientColumns(tables)).pipe(Query.from(tables.oauthClient.table));
+            const query = input.includeDisabled === true
+                ? base
+                : base.pipe(Query.where(queryEq(tables.oauthClient.select.status, "active")));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => oauthClientStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeOAuthClientRow(tables, row))));
+        },
+        validateRedirectUri: (input) => findOAuthClientById(executor, tables, input, "validate-redirect-uri").pipe(Effect.map((client) => oauthClientRedirectUriValidationResult(Option.isNone(client) ? undefined : client.value, input))),
+    });
+};
+export const makeEffectQbSqliteOAuthConsentStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return OAuthConsentStore.make({
+        upsert: (record) => executePlan(executor, queryInsert(tables.oauthConsent.table, mutationValues(tables.oauthConsent.insert(record))).pipe(Query.onConflict("id", {
+            update: mutationValues(tables.oauthConsent.update(record)),
+        }))).pipe(Effect.mapError((cause) => oauthConsentStoreError("upsert", cause)), Effect.asVoid),
+        findActive: (input) => findOAuthConsentByUserAndClient(executor, tables, input).pipe(Effect.map((record) => Option.isNone(record) || !isOAuthConsentActive(record.value, input)
+            ? Option.none()
+            : Option.some(record.value))),
+        listForUser: (input) => executePlan(executor, Query.select(selectOAuthConsentColumns(tables)).pipe(Query.from(tables.oauthConsent.table), Query.where(queryEq(tables.oauthConsent.select.userId, input.userId)))).pipe(Effect.mapError((cause) => oauthConsentStoreError("list-for-user", cause)), Effect.map((rows) => rows
+            .map((row) => decodeOAuthConsentRow(tables, row))
+            .filter((record) => input.includeInactive === true ||
+            isOAuthConsentActive(record, { now: input.now })))),
+        revoke: (input) => findOAuthConsentByUserAndClient(executor, tables, input, "revoke").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.succeed(Option.none());
+            }
+            return executePlan(executor, queryUpdate(tables.oauthConsent.table, mutationValues(tables.oauthConsent.revoke(input, row.value))).pipe(Query.where(queryEq(tables.oauthConsent.select.userId, input.userId)), Query.where(queryEq(tables.oauthConsent.select.clientId, input.clientId)), Query.returning(selectOAuthConsentColumns(tables)))).pipe(Effect.mapError((cause) => oauthConsentStoreError("revoke", cause)), Effect.map((rows) => rows[0] === undefined
+                ? Option.none()
+                : Option.some(decodeOAuthConsentRow(tables, rows[0]))));
+        })),
+        deleteInactive: (input) => deleteOAuthInactiveConsents(executor, tables, input),
+    });
+};
+export const makeEffectQbSqliteOAuthAuthorizationCodeStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return OAuthAuthorizationCodeStore.make({
+        upsert: (record) => executePlan(executor, queryInsert(tables.oauthAuthorizationCode.table, mutationValues(tables.oauthAuthorizationCode.insert(record))).pipe(Query.onConflict("code_hash", {
+            update: mutationValues(tables.oauthAuthorizationCode.update(record)),
+        }))).pipe(Effect.mapError((cause) => oauthAuthorizationCodeStoreError("upsert", cause)), Effect.asVoid),
+        findByHash: (input) => findOAuthAuthorizationCodeByHash(executor, tables, input),
+        markConsumed: (input) => executePlan(executor, queryUpdate(tables.oauthAuthorizationCode.table, mutationValues(tables.oauthAuthorizationCode.markConsumed(input))).pipe(Query.where(queryEq(tables.oauthAuthorizationCode.select.codeHash, input.codeHash)), Query.where(queryIsNull(tables.oauthAuthorizationCode.select.consumedAt)), Query.returning({ codeHash: tables.oauthAuthorizationCode.select.codeHash }))).pipe(Effect.mapError((cause) => oauthAuthorizationCodeStoreError("mark-consumed", cause)), Effect.flatMap((rows) => {
+            const [consumed] = rows;
+            if (consumed !== undefined) {
+                return findOAuthAuthorizationCodeByHash(executor, tables, { codeHash: consumed.codeHash }, "mark-consumed").pipe(Effect.map((record) => Option.isNone(record)
+                    ? { status: "missing" }
+                    : {
+                        status: "consumed",
+                        record: record.value,
+                    }));
+            }
+            return findOAuthAuthorizationCodeByHash(executor, tables, { codeHash: input.codeHash }, "mark-consumed").pipe(Effect.map((record) => Option.isNone(record)
+                ? { status: "missing" }
+                : {
+                    status: "already_consumed",
+                    record: record.value,
+                }));
+        })),
+    });
+};
+export const makeEffectQbSqliteOAuthClientSecretStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return OAuthClientSecretStore.make({
+        upsert: (record) => executePlan(executor, queryInsert(tables.oauthClientSecret.table, mutationValues(tables.oauthClientSecret.insert(record))).pipe(Query.onConflict("prefix", {
+            update: mutationValues(tables.oauthClientSecret.update(record)),
+        }))).pipe(Effect.mapError((cause) => oauthClientSecretStoreError("upsert", cause)), Effect.asVoid),
+        findByClientIdAndPrefix: (input) => findOAuthClientSecretByClientIdAndPrefix(executor, tables, input),
+        markUsed: (input) => executePlan(executor, queryUpdate(tables.oauthClientSecret.table, mutationValues(tables.oauthClientSecret.markUsed(input))).pipe(Query.where(queryEq(tables.oauthClientSecret.select.clientId, input.clientId)), Query.where(queryEq(tables.oauthClientSecret.select.prefix, input.prefix)), Query.where(queryIsNull(tables.oauthClientSecret.select.revokedAt)), Query.returning(selectOAuthClientSecretColumns(tables)))).pipe(Effect.mapError((cause) => oauthClientSecretStoreError("mark-used", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeOAuthClientSecretRow(tables, rows[0])))),
+        revoke: (input) => findOAuthClientSecretByClientIdAndPrefix(executor, tables, input, "revoke").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.succeed(Option.none());
+            }
+            return executePlan(executor, queryUpdate(tables.oauthClientSecret.table, mutationValues(tables.oauthClientSecret.revoke(input, row.value))).pipe(Query.where(queryEq(tables.oauthClientSecret.select.clientId, input.clientId)), Query.where(queryEq(tables.oauthClientSecret.select.prefix, input.prefix)), Query.returning(selectOAuthClientSecretColumns(tables)))).pipe(Effect.mapError((cause) => oauthClientSecretStoreError("revoke", cause)), Effect.map((rows) => rows[0] === undefined
+                ? Option.none()
+                : Option.some(decodeOAuthClientSecretRow(tables, rows[0]))));
+        })),
+    });
+};
+export const makeEffectQbSqliteOAuthProviderModeTokenStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return OAuthProviderModeTokenStore.make({
+        upsert: (record) => executePlan(executor, queryInsert(tables.oauthProviderModeToken.table, mutationValues(tables.oauthProviderModeToken.insert(record))).pipe(Query.onConflict("token_hash", {
+            update: mutationValues(tables.oauthProviderModeToken.update(record)),
+        }))).pipe(Effect.mapError((cause) => oauthProviderModeTokenStoreError("upsert", cause)), Effect.asVoid),
+        findByHash: (input) => findOAuthProviderModeTokenByHash(executor, tables, input),
+        revokeByHash: (input) => findOAuthProviderModeTokenByHash(executor, tables, input, "revoke").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row) ||
+                (input.tokenTypeHint !== undefined &&
+                    row.value.tokenType !== input.tokenTypeHint)) {
+                return Effect.succeed(Option.none());
+            }
+            return executePlan(executor, queryUpdate(tables.oauthProviderModeToken.table, mutationValues(tables.oauthProviderModeToken.revoke(input, row.value))).pipe(Query.where(queryEq(tables.oauthProviderModeToken.select.tokenHash, input.tokenHash)), Query.returning(selectOAuthProviderModeTokenColumns(tables)))).pipe(Effect.mapError((cause) => oauthProviderModeTokenStoreError("revoke", cause)), Effect.map((rows) => rows[0] === undefined
+                ? Option.none()
+                : Option.some(decodeOAuthProviderModeTokenRow(tables, rows[0]))));
+        })),
+        rotateRefreshToken: (input) => executePlan(executor, queryUpdate(tables.oauthProviderModeToken.table, mutationValues(tables.oauthProviderModeToken.rotate(input))).pipe(Query.where(queryEq(tables.oauthProviderModeToken.select.tokenHash, input.tokenHash)), Query.where(queryEq(tables.oauthProviderModeToken.select.tokenType, "refresh_token")), Query.where(queryIsNull(tables.oauthProviderModeToken.select.revokedAt)), Query.where(queryIsNull(tables.oauthProviderModeToken.select.rotatedAt)), Query.returning({
+            tokenHash: tables.oauthProviderModeToken.select.tokenHash,
+        }))).pipe(Effect.mapError((cause) => oauthProviderModeTokenStoreError("rotate", cause)), Effect.flatMap((rows) => rows[0] === undefined
+            ? Effect.succeed(Option.none())
+            : findOAuthProviderModeTokenByHash(executor, tables, { tokenHash: rows[0].tokenHash }, "rotate"))),
+        deleteRetired: (input) => deleteOAuthProviderModeRetiredTokens(executor, tables, input),
+    });
+};
 export const makeEffectQbSqliteOAuthProviderTokenVault = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
     return OAuthProviderTokenVault.make({
@@ -1592,11 +2668,112 @@ export const makeEffectQbSqliteOAuthProviderTokenVault = (executor, options = {}
         })),
     });
 };
+export const makeEffectQbSqliteDomainVerificationStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return DomainVerificationStore.make({
+        upsert: (record) => findDomainVerificationByOwnerAndDomain(executor, tables, { ownerId: record.ownerId, domain: record.domain }, "upsert").pipe(Effect.flatMap((existing) => Option.isNone(existing)
+            ? executePlan(executor, queryInsert(tables.domainVerification.table, mutationValues(tables.domainVerification.insert(record))))
+            : executePlan(executor, queryUpdate(tables.domainVerification.table, mutationValues(tables.domainVerification.update(record))).pipe(Query.where(queryEq(tables.domainVerification.select.ownerId, record.ownerId)), Query.where(queryEq(tables.domainVerification.select.domain, record.domain))))), Effect.mapError((cause) => cause instanceof DomainVerificationStoreError
+            ? cause
+            : domainVerificationStoreError("upsert", cause)), Effect.asVoid),
+        findById: (id) => findDomainVerificationById(executor, tables, id),
+        findByOwnerAndDomain: (input) => findDomainVerificationByOwnerAndDomain(executor, tables, input),
+        listByOwner: (input) => {
+            const base = Query.select(selectDomainVerificationColumns(tables)).pipe(Query.from(tables.domainVerification.table), Query.where(queryEq(tables.domainVerification.select.ownerId, input.ownerId)));
+            const query = input.includeRevoked === true
+                ? base
+                : base.pipe(Query.where(queryIsNull(tables.domainVerification.select.revokedAt)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => domainVerificationStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeDomainVerificationRecord(tables, row))));
+        },
+        markVerified: (input) => executePlan(executor, queryUpdate(tables.domainVerification.table, mutationValues(tables.domainVerification.markVerified(input))).pipe(Query.where(queryEq(tables.domainVerification.select.id, input.id)), Query.where(queryEq(tables.domainVerification.select.status, "pending")), Query.returning(selectDomainVerificationColumns(tables)))).pipe(Effect.mapError((cause) => domainVerificationStoreError("mark-verified", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeDomainVerificationRecord(tables, rows[0])))),
+        revoke: (input) => findDomainVerificationById(executor, tables, input.id, "revoke").pipe(Effect.flatMap((record) => {
+            if (Option.isNone(record)) {
+                return Effect.void;
+            }
+            return executePlan(executor, queryUpdate(tables.domainVerification.table, mutationValues(tables.domainVerification.revoke(input, record.value))).pipe(Query.where(queryEq(tables.domainVerification.select.id, input.id)))).pipe(Effect.mapError((cause) => domainVerificationStoreError("revoke", cause)), Effect.asVoid);
+        })),
+    });
+};
 export const makeEffectQbSqliteSecurityTimelineStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
     return SecurityTimelineStore.make({
         insert: (event) => executePlan(executor, queryInsert(tables.securityTimeline.table, mutationValues(tables.securityTimeline.insert(event)))).pipe(Effect.mapError((cause) => securityTimelineStoreError("insert", cause)), Effect.asVoid),
         listByUser: (input) => listSecurityTimelineByUser(executor, tables, input),
+        deleteBefore: (input) => deleteSecurityTimelineBefore(executor, tables, input),
+    });
+};
+export const makeEffectQbSqliteWebhookOutboxStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return WebhookOutboxStore.make({
+        enqueue: (input) => Effect.gen(function* () {
+            const now = input.now ?? (yield* currentUnixMillis);
+            const record = {
+                id: input.id,
+                endpointKey: input.endpointKey,
+                event: input.event,
+                status: "pending",
+                attempts: 0,
+                nextAttemptAt: input.nextAttemptAt ?? now,
+                createdAt: now,
+                updatedAt: now,
+            };
+            yield* executePlan(executor, queryInsert(tables.webhookOutbox.table, mutationValues(tables.webhookOutbox.insert(record)))).pipe(Effect.mapError((cause) => webhookOutboxStoreError("enqueue", cause)), Effect.asVoid);
+            return record;
+        }),
+        claimDue: (input) => claimDueWebhookOutboxRecords(executor, tables, input),
+        markDelivered: (input) => Effect.gen(function* () {
+            const existing = yield* findWebhookOutboxRecordById(executor, tables, input.id, "markDelivered");
+            if (Option.isNone(existing) || existing.value.status === "dead_lettered") {
+                return;
+            }
+            const deliveredAt = input.deliveredAt ?? (yield* currentUnixMillis);
+            yield* executePlan(executor, queryUpdate(tables.webhookOutbox.table, mutationValues(tables.webhookOutbox.markDelivered({ ...input, deliveredAt }))).pipe(Query.where(queryEq(tables.webhookOutbox.select.id, input.id)))).pipe(Effect.mapError((cause) => webhookOutboxStoreError("markDelivered", cause)), Effect.asVoid);
+        }),
+        markFailed: (input) => Effect.gen(function* () {
+            const existing = yield* findWebhookOutboxRecordById(executor, tables, input.id, "markFailed");
+            if (Option.isNone(existing) ||
+                existing.value.status === "delivered" ||
+                existing.value.status === "dead_lettered") {
+                return;
+            }
+            const failedAt = input.failedAt ?? (yield* currentUnixMillis);
+            yield* executePlan(executor, queryUpdate(tables.webhookOutbox.table, mutationValues(tables.webhookOutbox.markFailed({
+                ...input,
+                failedAt,
+                attempts: existing.value.attempts + 1,
+            }))).pipe(Query.where(queryEq(tables.webhookOutbox.select.id, input.id)))).pipe(Effect.mapError((cause) => webhookOutboxStoreError("markFailed", cause)), Effect.asVoid);
+        }),
+        markDeadLettered: (input) => Effect.gen(function* () {
+            const existing = yield* findWebhookOutboxRecordById(executor, tables, input.id, "markDeadLettered");
+            if (Option.isNone(existing) ||
+                existing.value.status === "delivered" ||
+                existing.value.status === "dead_lettered") {
+                return;
+            }
+            const deadLetteredAt = input.deadLetteredAt ?? (yield* currentUnixMillis);
+            yield* executePlan(executor, queryUpdate(tables.webhookOutbox.table, mutationValues(tables.webhookOutbox.markDeadLettered({
+                ...input,
+                deadLetteredAt,
+            }))).pipe(Query.where(queryEq(tables.webhookOutbox.select.id, input.id)))).pipe(Effect.mapError((cause) => webhookOutboxStoreError("markDeadLettered", cause)), Effect.asVoid);
+        }),
+        deleteBefore: (input) => deleteWebhookOutboxRecordsBefore(executor, tables, input),
+    });
+};
+export const makeEffectQbSqliteWebhookReplayStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return WebhookReplayStore.make({
+        claim: (input) => Effect.gen(function* () {
+            const now = input.now ?? (yield* currentUnixMillis);
+            const claim = { ...input, now };
+            const rows = yield* executePlan(executor, queryInsert(tables.webhookReplay.table, mutationValues(tables.webhookReplay.insert(claim))).pipe(Query.onConflict("id", {
+                update: mutationValues(tables.webhookReplay.update(claim)),
+                where: queryLt(tables.webhookReplay.select.expiresAt, Number(now)),
+            }), Query.returning(selectWebhookReplayColumns(tables)))).pipe(Effect.mapError((cause) => webhookReplayStoreError("claim", cause)));
+            return rows.length > 0;
+        }),
+        deleteExpired: (input = {}) => deleteExpiredWebhookReplayRecords(executor, tables, input),
     });
 };
 export const makeEffectQbSqliteStorage = (executor, options = {}) => ({
@@ -1604,7 +2781,9 @@ export const makeEffectQbSqliteStorage = (executor, options = {}) => ({
     credentialStore: makeEffectQbSqliteCredentialStore(executor, options),
     sessionStore: makeEffectQbSqliteSessionStore(executor, options),
     verificationStore: makeEffectQbSqliteVerificationStore(executor, options),
+    auditLogStore: makeEffectQbSqliteAuditLogStore(executor, options),
     loginApprovalReviewStore: makeEffectQbSqliteLoginApprovalReviewStore(executor, options),
+    loginRiskHistoryStore: makeEffectQbSqliteLoginRiskHistoryStore(executor, options),
     trustedDeviceStore: makeEffectQbSqliteTrustedDeviceStore(executor, options),
     passkeyCredentialStore: makeEffectQbSqlitePasskeyCredentialStore(executor, options),
     totpFactorStore: makeEffectQbSqliteTotpFactorStore(executor, options),
@@ -1613,10 +2792,18 @@ export const makeEffectQbSqliteStorage = (executor, options = {}) => ({
     refreshTokenStore: makeEffectQbSqliteRefreshTokenStore(executor, options),
     jwtRevocationStore: makeEffectQbSqliteJwtRevocationStore(executor, options),
     oauthAccountStore: makeEffectQbSqliteOAuthAccountStore(executor, options),
+    oauthClientStore: makeEffectQbSqliteOAuthClientStore(executor, options),
+    oauthConsentStore: makeEffectQbSqliteOAuthConsentStore(executor, options),
+    oauthAuthorizationCodeStore: makeEffectQbSqliteOAuthAuthorizationCodeStore(executor, options),
+    oauthClientSecretStore: makeEffectQbSqliteOAuthClientSecretStore(executor, options),
+    oauthProviderModeTokenStore: makeEffectQbSqliteOAuthProviderModeTokenStore(executor, options),
     oauthProviderTokenVault: makeEffectQbSqliteOAuthProviderTokenVault(executor, options),
+    domainVerificationStore: makeEffectQbSqliteDomainVerificationStore(executor, options),
     securityTimelineStore: makeEffectQbSqliteSecurityTimelineStore(executor, options),
+    webhookOutboxStore: makeEffectQbSqliteWebhookOutboxStore(executor, options),
+    webhookReplayStore: makeEffectQbSqliteWebhookReplayStore(executor, options),
 });
-export const EffectQbSqliteAuthStorageLive = (executor, options = {}) => Layer.mergeAll(Layer.succeed(UserStore)(makeEffectQbSqliteUserStore(executor, options)), Layer.succeed(CredentialStore)(makeEffectQbSqliteCredentialStore(executor, options)), Layer.succeed(SessionStore)(makeEffectQbSqliteSessionStore(executor, options)), Layer.succeed(VerificationStore)(makeEffectQbSqliteVerificationStore(executor, options)), Layer.succeed(LoginApprovalReviewStore)(makeEffectQbSqliteLoginApprovalReviewStore(executor, options)), Layer.succeed(TrustedDeviceStore)(makeEffectQbSqliteTrustedDeviceStore(executor, options)), Layer.succeed(PasskeyCredentialStore)(makeEffectQbSqlitePasskeyCredentialStore(executor, options)), Layer.succeed(TotpFactorStore)(makeEffectQbSqliteTotpFactorStore(executor, options)), Layer.succeed(RecoveryCodeStore)(makeEffectQbSqliteRecoveryCodeStore(executor, options)), Layer.succeed(ApiKeyStore)(makeEffectQbSqliteApiKeyStore(executor, options)), Layer.succeed(RefreshTokenStore)(makeEffectQbSqliteRefreshTokenStore(executor, options)), Layer.succeed(JwtRevocationStore)(makeEffectQbSqliteJwtRevocationStore(executor, options)), Layer.succeed(OAuthAccountStore)(makeEffectQbSqliteOAuthAccountStore(executor, options)), Layer.succeed(OAuthProviderTokenVault)(makeEffectQbSqliteOAuthProviderTokenVault(executor, options)), Layer.succeed(SecurityTimelineStore)(makeEffectQbSqliteSecurityTimelineStore(executor, options)));
+export const EffectQbSqliteAuthStorageLive = (executor, options = {}) => Layer.mergeAll(Layer.succeed(UserStore)(makeEffectQbSqliteUserStore(executor, options)), Layer.succeed(CredentialStore)(makeEffectQbSqliteCredentialStore(executor, options)), Layer.succeed(SessionStore)(makeEffectQbSqliteSessionStore(executor, options)), Layer.succeed(VerificationStore)(makeEffectQbSqliteVerificationStore(executor, options)), Layer.succeed(AuditLogStore)(makeEffectQbSqliteAuditLogStore(executor, options)), Layer.succeed(LoginApprovalReviewStore)(makeEffectQbSqliteLoginApprovalReviewStore(executor, options)), Layer.succeed(LoginRiskHistory)(makeEffectQbSqliteLoginRiskHistoryStore(executor, options)), Layer.succeed(TrustedDeviceStore)(makeEffectQbSqliteTrustedDeviceStore(executor, options)), Layer.succeed(PasskeyCredentialStore)(makeEffectQbSqlitePasskeyCredentialStore(executor, options)), Layer.succeed(TotpFactorStore)(makeEffectQbSqliteTotpFactorStore(executor, options)), Layer.succeed(RecoveryCodeStore)(makeEffectQbSqliteRecoveryCodeStore(executor, options)), Layer.succeed(ApiKeyStore)(makeEffectQbSqliteApiKeyStore(executor, options)), Layer.succeed(RefreshTokenStore)(makeEffectQbSqliteRefreshTokenStore(executor, options)), Layer.succeed(JwtRevocationStore)(makeEffectQbSqliteJwtRevocationStore(executor, options)), Layer.succeed(OAuthAccountStore)(makeEffectQbSqliteOAuthAccountStore(executor, options)), Layer.succeed(OAuthClientStore)(makeEffectQbSqliteOAuthClientStore(executor, options)), Layer.succeed(OAuthConsentStore)(makeEffectQbSqliteOAuthConsentStore(executor, options)), Layer.succeed(OAuthAuthorizationCodeStore)(makeEffectQbSqliteOAuthAuthorizationCodeStore(executor, options)), Layer.succeed(OAuthClientSecretStore)(makeEffectQbSqliteOAuthClientSecretStore(executor, options)), Layer.succeed(OAuthProviderModeTokenStore)(makeEffectQbSqliteOAuthProviderModeTokenStore(executor, options)), Layer.succeed(OAuthProviderTokenVault)(makeEffectQbSqliteOAuthProviderTokenVault(executor, options)), Layer.succeed(DomainVerificationStore)(makeEffectQbSqliteDomainVerificationStore(executor, options)), Layer.succeed(SecurityTimelineStore)(makeEffectQbSqliteSecurityTimelineStore(executor, options)), Layer.succeed(WebhookOutboxStore)(makeEffectQbSqliteWebhookOutboxStore(executor, options)), Layer.succeed(WebhookReplayStore)(makeEffectQbSqliteWebhookReplayStore(executor, options)));
 export const makeD1EffectQbSqliteExecutor = (database) => Executor.make({
     driver: Executor.driver((query) => Effect.tryPromise({
         try: () => database