@effect-auth/core 0.1.0-alpha.16 → 0.1.0-alpha.19

package/dist/EffectQbPostgresStorage.js

@@ -0,0 +1,4637 @@
+// oxlint-disable complexity, promise/prefer-await-to-then, typescript/no-explicit-any
+import { Cause, Data, Effect, Layer, Option, Redacted, Schema } from "effect";
+import { Column, Executor as CoreExecutor, Query, RowSet, Scalar, Table, } from "effect-qb";
+import { Column as PostgresColumn, Errors as PostgresErrors, Executor, Jsonb, Query as PostgresQuery, Renderer, } from "effect-qb/postgres";
+import { ApiKeyId, ApiKeyPrefix, ApiKeySecretHash, ApiKeyStore, ApiKeyStoreError, } from "./ApiKey.js";
+import { parseAuthenticationEvents } from "./Assurance.js";
+import { AtomicPlanError } from "./AtomicPlanExecutor.js";
+import { AuditLogStore, AuditLogStoreError, auditEventActorUserId, auditEventUserId, decodeAuditEvent, filterAuditLogEvents, } from "./AuditLog.js";
+import { DomainName, DomainVerificationId, DomainVerificationProofToken, DomainVerificationStore, DomainVerificationStoreError, } from "./DomainVerification.js";
+import { AuthFlowId, ChallengeId, CredentialId, Email, IdentityId, OAuthAccountId, OAuthClientId, OAuthProviderId, PermissionId, RoleId, SessionId, UnixMillis, UserId, } from "./Identifiers.js";
+import { isIdentityLoginEligible } from "./Identity.js";
+import { currentUnixMillis } from "./Internal.js";
+import { JwtError, JwtRevocationStore } from "./Jwt.js";
+import { LoginApprovalReviewError, LoginApprovalReviewStore, } from "./LoginApproval.js";
+import { LoginRiskContext, LoginRiskHistory, LoginRiskHistoryError, LoginRiskSignal, maxLoginRiskLevel, } from "./LoginRisk.js";
+import { OAuthAuthorizationCodeStore, OAuthAuthorizationCodeStoreError, OAuthAccountStore, OAuthAccountStoreError, OAuthClientSecretHash, OAuthClientSecretPrefix, OAuthClientSecretStore, OAuthClientSecretStoreError, OAuthClientStore, OAuthClientStoreError, OAuthCodeChallenge, OAuthConsentStore, OAuthConsentStoreError, OAuthIdentityBridgeConflictError, OAuthIdentityBridgeStore, OAuthIdentityBridgeStoreError, OAuthProviderModeTokenStore, OAuthProviderModeTokenStoreError, OAuthProviderTokenVault, OAuthProviderTokenVaultError, } from "./OAuth.js";
+import { OAuthDeviceAuthorizationId, OAuthDeviceAuthorizationStore, OAuthDeviceAuthorizationStoreError, OAuthDeviceCodeTokenCommitStore, OAuthDeviceCodeTokenCommitStoreError, } from "./OAuthDeviceAuthorization.js";
+import { PasskeyCredentialId, PasskeyCredentialStore, PasskeyCredentialStoreError, } from "./Passkey.js";
+import { canonicalPermissionScope, normalizePermissionDefinitionListLimit, PermissionStore, PermissionStoreError, } from "./Permission.js";
+import { RecoveryCodeHash, RecoveryCodeLoginCommitStore, RecoveryCodeLoginCommitStoreError, RecoveryCodeSessionRotateStore, RecoveryCodeSessionRotateStoreError, RecoveryCodeStore, RecoveryCodeStoreError, } from "./RecoveryCode.js";
+import { RefreshTokenFamilyId, RefreshTokenId, RefreshTokenSecretHash, RefreshTokenStore, RefreshTokenStoreError, } from "./RefreshToken.js";
+import { SecurityTimelineEventId, SecurityTimelineStore, SecurityTimelineStoreError, filterSecurityTimelineEvents, } from "./SecurityTimeline.js";
+import { CredentialStore, IdentityConflictError, IdentityStore, RegistrationConflictError, RegistrationFailureError, RegistrationStore, SessionStore, StorageError, UserStore, VerificationStore, } from "./Storage.js";
+import { TotpFactorStore, TotpFactorStoreError, TotpLoginCommitStore, TotpLoginCommitStoreError, TotpSecret, TotpSessionRotateStore, TotpSessionRotateStoreError, } from "./Totp.js";
+import { TrustedDeviceError, TrustedDeviceStore } from "./TrustedDevice.js";
+import { WebhookOutboxItemId, WebhookOutboxStore, WebhookOutboxStoreError, WebhookReplayStore, WebhookReplayStoreError, filterDueWebhookOutboxRecords, } from "./Webhook.js";
+class PostgresPlanBuildError extends Data.TaggedError("PostgresPlanBuildError") {
+}
+const postgresValueMappings = {
+    json: { toDriver: (value) => JSON.stringify(value) },
+    jsonb: { toDriver: (value) => JSON.stringify(value) },
+};
+const postgresRenderer = Renderer.make({
+    valueMappings: postgresValueMappings,
+});
+const jsonb = () => PostgresColumn.jsonb(Schema.Unknown).pipe(Column.nullable);
+const int8 = () => PostgresColumn.int8();
+const nullableInt8 = () => int8().pipe(Column.nullable);
+const authPostgresUser = Table.make("auth_user", {
+    id: Column.text().pipe(Column.primaryKey),
+    created_at: int8(),
+    updated_at: int8(),
+    disabled_at: nullableInt8(),
+    metadata: jsonb(),
+});
+const authPostgresUserIdentity = Table.make("auth_user_identity", {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    scope_type: Column.text(),
+    scope_id: Column.text(),
+    kind: Column.text(),
+    value: Column.text(),
+    normalized_value: Column.text(),
+    verified_at: nullableInt8(),
+    is_primary_login: Column.boolean(),
+    created_at: int8(),
+    updated_at: int8(),
+    revoked_at: nullableInt8(),
+    replaced_by_id: Column.text().pipe(Column.nullable),
+    metadata: jsonb(),
+});
+const authPostgresCredential = Table.make("auth_credential", {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    type: Column.text(),
+    password_hash: Column.text().pipe(Column.nullable),
+    created_at: int8(),
+    updated_at: int8(),
+    revoked_at: nullableInt8(),
+    metadata: jsonb(),
+});
+const authPostgresPasskeyCredential = Table.make("auth_passkey_credential", {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    credential_id: Column.text().pipe(Column.unique),
+    public_key: Column.text(),
+    sign_count: int8(),
+    transports: jsonb(),
+    backed_up: Column.boolean().pipe(Column.nullable),
+    created_at: int8(),
+    last_used_at: nullableInt8(),
+    revoked_at: nullableInt8(),
+    metadata: jsonb(),
+});
+const authPostgresSession = Table.make("auth_session", {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    secret_hash: Column.text(),
+    created_at: int8(),
+    expires_at: int8(),
+    auth_time: int8(),
+    authentication_events: PostgresColumn.jsonb(Schema.Unknown),
+    aal: Column.text(),
+    amr: PostgresColumn.jsonb(Schema.Unknown),
+    claims: jsonb(),
+    mfa_verified_at: nullableInt8(),
+    metadata: jsonb(),
+    revoked_at: nullableInt8(),
+    last_seen_at: nullableInt8(),
+    rotated_at: nullableInt8(),
+});
+const authPostgresVerification = Table.make("auth_verification", {
+    id: Column.text().pipe(Column.primaryKey),
+    type: Column.text(),
+    subject: Column.text(),
+    secret_hash: Column.text().pipe(Column.nullable),
+    created_at: int8(),
+    expires_at: int8(),
+    metadata: jsonb(),
+    consumed_at: nullableInt8(),
+});
+const authPostgresTotpFactor = Table.make("auth_totp_factor", {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    secret: Column.text(),
+    algorithm: Column.text(),
+    digits: Column.int(),
+    period: Column.int(),
+    created_at: int8(),
+    confirmed_at: nullableInt8(),
+    last_used_at: nullableInt8(),
+    last_accepted_counter: nullableInt8(),
+    revoked_at: nullableInt8(),
+    metadata: jsonb(),
+});
+const authPostgresRecoveryCode = Table.make("auth_recovery_code", {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    code_hash: Column.text(),
+    created_at: int8(),
+    used_at: nullableInt8(),
+    revoked_at: nullableInt8(),
+    metadata: jsonb(),
+});
+const authPostgresApiKey = Table.make("auth_api_key", {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    prefix: Column.text().pipe(Column.unique),
+    secret_hash: Column.text(),
+    scopes: PostgresColumn.jsonb(Schema.Unknown),
+    created_at: int8(),
+    expires_at: nullableInt8(),
+    last_used_at: nullableInt8(),
+    revoked_at: nullableInt8(),
+    metadata: jsonb(),
+});
+const authPostgresRefreshToken = Table.make("auth_refresh_token", {
+    id: Column.text().pipe(Column.primaryKey),
+    family_id: Column.text(),
+    user_id: Column.text(),
+    secret_hash: Column.text(),
+    created_at: int8(),
+    expires_at: int8(),
+    last_used_at: nullableInt8(),
+    rotated_at: nullableInt8(),
+    replaced_by_id: Column.text().pipe(Column.nullable),
+    revoked_at: nullableInt8(),
+    reuse_detected_at: nullableInt8(),
+    metadata: jsonb(),
+});
+const authPostgresJwtRevocation = Table.make("auth_jwt_revocation", {
+    jwt_id: Column.text().pipe(Column.primaryKey),
+    revoked_at: int8(),
+    expires_at: nullableInt8(),
+    reason: Column.text().pipe(Column.nullable),
+});
+const authPostgresOAuthAccount = Table.make("auth_oauth_account", {
+    id: Column.text().pipe(Column.primaryKey),
+    provider_id: Column.text(),
+    provider_account_id: Column.text(),
+    user_id: Column.text(),
+    email: Column.text().pipe(Column.nullable),
+    email_verified: Column.boolean().pipe(Column.nullable),
+    created_at: int8(),
+    updated_at: int8(),
+    unlinked_at: nullableInt8(),
+    metadata: jsonb(),
+});
+const authPostgresOAuthClient = Table.make("auth_oauth_client", {
+    id: Column.text().pipe(Column.primaryKey),
+    type: Column.text(),
+    status: Column.text(),
+    name: Column.text().pipe(Column.nullable),
+    redirect_uris: PostgresColumn.jsonb(Schema.Unknown),
+    allowed_grant_types: PostgresColumn.jsonb(Schema.Unknown),
+    allowed_response_types: PostgresColumn.jsonb(Schema.Unknown),
+    allowed_scopes: jsonb(),
+    created_at: nullableInt8(),
+    updated_at: nullableInt8(),
+    metadata: jsonb(),
+});
+const authPostgresOAuthConsent = Table.make("auth_oauth_consent", {
+    user_id: Column.text(),
+    client_id: Column.text(),
+    scopes: PostgresColumn.jsonb(Schema.Unknown),
+    granted_at: int8(),
+    expires_at: nullableInt8(),
+    revoked_at: nullableInt8(),
+    metadata: jsonb(),
+});
+const authPostgresOAuthAuthorizationCode = Table.make("auth_oauth_authorization_code", {
+    code_hash: Column.text().pipe(Column.primaryKey),
+    client_id: Column.text(),
+    subject: Column.text(),
+    redirect_uri: Column.text(),
+    scopes: PostgresColumn.jsonb(Schema.Unknown),
+    code_challenge: Column.text().pipe(Column.nullable),
+    code_challenge_method: Column.text().pipe(Column.nullable),
+    issued_at: int8(),
+    expires_at: int8(),
+    consumed_at: nullableInt8(),
+    metadata: jsonb(),
+});
+const authPostgresOAuthDeviceAuthorization = Table.make("auth_oauth_device_authorization", {
+    id: Column.text().pipe(Column.primaryKey),
+    device_code_hash: Column.text().pipe(Column.unique),
+    user_code_hash: Column.text().pipe(Column.unique),
+    client_id: Column.text(),
+    requested_scopes: PostgresColumn.jsonb(Schema.Unknown),
+    granted_scopes: jsonb(),
+    subject: Column.text().pipe(Column.nullable),
+    status: Column.text(),
+    issued_at: int8(),
+    expires_at: int8(),
+    poll_interval_seconds: Column.int(),
+    next_poll_at: int8(),
+    last_polled_at: nullableInt8(),
+    approved_at: nullableInt8(),
+    denied_at: nullableInt8(),
+    consumed_at: nullableInt8(),
+    metadata: jsonb(),
+});
+const authPostgresOAuthClientSecret = Table.make("auth_oauth_client_secret", {
+    prefix: Column.text(),
+    client_id: Column.text(),
+    secret_hash: Column.text(),
+    authentication_methods: PostgresColumn.jsonb(Schema.Unknown),
+    created_at: int8(),
+    expires_at: nullableInt8(),
+    last_used_at: nullableInt8(),
+    revoked_at: nullableInt8(),
+    metadata: jsonb(),
+});
+const authPostgresOAuthProviderModeToken = Table.make("auth_oauth_provider_mode_token", {
+    token_hash: Column.text().pipe(Column.primaryKey),
+    token_type: Column.text(),
+    client_id: Column.text(),
+    subject: Column.text(),
+    scopes: PostgresColumn.jsonb(Schema.Unknown),
+    issued_at: int8(),
+    expires_at: int8(),
+    issuer: Column.text().pipe(Column.nullable),
+    audience: jsonb(),
+    jwt_id: Column.text().pipe(Column.nullable),
+    revoked_at: nullableInt8(),
+    revocation_reason: Column.text().pipe(Column.nullable),
+    rotated_at: nullableInt8(),
+    replaced_by_token_hash: Column.text().pipe(Column.nullable),
+    metadata: jsonb(),
+});
+const authPostgresOAuthProviderTokenVault = Table.make("auth_oauth_provider_token_vault", {
+    account_id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    provider_id: Column.text(),
+    provider_account_id: Column.text(),
+    access_token_ciphertext: Column.text(),
+    refresh_token_ciphertext: Column.text().pipe(Column.nullable),
+    id_token_ciphertext: Column.text().pipe(Column.nullable),
+    token_type: Column.text(),
+    scopes: jsonb(),
+    expires_at: nullableInt8(),
+    updated_at: int8(),
+    revoked_at: nullableInt8(),
+    revocation_reason: Column.text().pipe(Column.nullable),
+});
+const authPostgresAuditLog = Table.make("auth_audit_log", {
+    storage_id: int8().pipe(PostgresColumn.identityAlways, Column.primaryKey),
+    id: Column.text().pipe(Column.nullable),
+    type: Column.text(),
+    user_id: Column.text().pipe(Column.nullable),
+    actor_user_id: Column.text().pipe(Column.nullable),
+    occurred_at: int8(),
+    request_ip_hash: Column.text().pipe(Column.nullable),
+    request_user_agent_hash: Column.text().pipe(Column.nullable),
+    event: PostgresColumn.jsonb(Schema.Unknown),
+    created_at: int8(),
+});
+const authPostgresLoginApprovalReview = Table.make("auth_login_approval_review", {
+    approval_challenge_id: Column.text().pipe(Column.primaryKey),
+    flow_id: Column.text(),
+    user_id: Column.text(),
+    channel: Column.text(),
+    reason: Column.text(),
+    session_binding: Column.text(),
+    same_device_required: Column.boolean(),
+    status: Column.text(),
+    created_at: int8(),
+    expires_at: int8(),
+    reviewed_at: nullableInt8(),
+    reviewed_by: Column.text().pipe(Column.nullable),
+    denied_reason: Column.text().pipe(Column.nullable),
+    risk: jsonb(),
+    metadata: jsonb(),
+    review_metadata: jsonb(),
+});
+const authPostgresLoginRiskHistory = Table.make("auth_login_risk_history", {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    occurred_at: int8(),
+    outcome: Column.text(),
+    method: Column.text(),
+    amr: PostgresColumn.jsonb(Schema.Unknown),
+    aal: Column.text(),
+    device_status: Column.text(),
+    device_key: Column.text().pipe(Column.nullable),
+    location_key: Column.text().pipe(Column.nullable),
+    country: Column.text().pipe(Column.nullable),
+    region: Column.text().pipe(Column.nullable),
+    latitude_micro: nullableInt8(),
+    longitude_micro: nullableInt8(),
+    risk_level: Column.text().pipe(Column.nullable),
+    created_at: int8(),
+});
+const authPostgresTrustedDevice = Table.make("auth_trusted_device", {
+    user_id: Column.text(),
+    token_hash: Column.text(),
+    created_at: int8(),
+    last_seen_at: int8(),
+    expires_at: int8(),
+    metadata: jsonb(),
+});
+const authPostgresDomainVerification = Table.make("auth_domain_verification", {
+    id: Column.text().pipe(Column.primaryKey),
+    owner_id: Column.text(),
+    domain: Column.text(),
+    proof_method: Column.text(),
+    proof_token: Column.text(),
+    status: Column.text(),
+    created_at: int8(),
+    expires_at: int8(),
+    verified_at: nullableInt8(),
+    revoked_at: nullableInt8(),
+    last_checked_at: nullableInt8(),
+    metadata: jsonb(),
+});
+const authPostgresSecurityTimeline = Table.make("auth_security_timeline", {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    type: Column.text(),
+    category: Column.text(),
+    severity: Column.text(),
+    occurred_at: int8(),
+    summary: Column.text(),
+    actor: jsonb(),
+    request: jsonb(),
+    metadata: jsonb(),
+});
+const authPostgresWebhookOutbox = Table.make("auth_webhook_outbox", {
+    id: Column.text().pipe(Column.primaryKey),
+    endpoint_key: Column.text(),
+    event: PostgresColumn.jsonb(Schema.Unknown),
+    status: Column.text(),
+    attempts: Column.int(),
+    next_attempt_at: int8(),
+    created_at: int8(),
+    updated_at: int8(),
+    delivered_at: nullableInt8(),
+    last_error: Column.text().pipe(Column.nullable),
+});
+const authPostgresWebhookReplay = Table.make("auth_webhook_replay", {
+    id: Column.text().pipe(Column.primaryKey),
+    expires_at: int8(),
+    created_at: int8(),
+});
+const authPostgresPermissionDefinition = Table.make("auth_permission_definition", {
+    id: Column.text().pipe(Column.primaryKey),
+    description: Column.text().pipe(Column.nullable),
+    scope_type_present: Column.boolean(),
+    scope_type: Column.text(),
+    created_at: int8(),
+    updated_at: int8(),
+    disabled_at: nullableInt8(),
+    deleted_at: nullableInt8(),
+});
+const authPostgresRoleDefinition = Table.make("auth_role_definition", {
+    id: Column.text().pipe(Column.primaryKey),
+    description: Column.text().pipe(Column.nullable),
+    created_at: int8(),
+    updated_at: int8(),
+    disabled_at: nullableInt8(),
+    deleted_at: nullableInt8(),
+});
+const authPostgresPermissionGrant = Table.make("auth_permission_grant", {
+    subject_type: Column.text(),
+    subject_id: Column.text(),
+    permission_id: Column.text(),
+    scope_type: Column.text(),
+    scope_id_present: Column.boolean(),
+    scope_id: Column.text(),
+    expires_at: nullableInt8(),
+    metadata: jsonb(),
+    revoked_at: nullableInt8(),
+});
+const authPostgresRoleGrant = Table.make("auth_role_grant", {
+    subject_type: Column.text(),
+    subject_id: Column.text(),
+    role_id: Column.text(),
+    scope_type: Column.text(),
+    scope_id_present: Column.boolean(),
+    scope_id: Column.text(),
+    expires_at: nullableInt8(),
+    metadata: jsonb(),
+    revoked_at: nullableInt8(),
+});
+const authPostgresRolePermission = Table.make("auth_role_permission", {
+    role_id: Column.text(),
+    permission_id: Column.text(),
+    scope_type_present: Column.boolean(),
+    scope_type: Column.text(),
+});
+/** Canonical tables used by the maintained Postgres adapter, exposed for application-owned queries. */
+export const effectQbPostgresTables = {
+    user: authPostgresUser,
+    userIdentity: authPostgresUserIdentity,
+    credential: authPostgresCredential,
+    passkeyCredential: authPostgresPasskeyCredential,
+    session: authPostgresSession,
+    verification: authPostgresVerification,
+    totpFactor: authPostgresTotpFactor,
+    recoveryCode: authPostgresRecoveryCode,
+    apiKey: authPostgresApiKey,
+    refreshToken: authPostgresRefreshToken,
+    jwtRevocation: authPostgresJwtRevocation,
+    oauthAccount: authPostgresOAuthAccount,
+    oauthClient: authPostgresOAuthClient,
+    oauthConsent: authPostgresOAuthConsent,
+    oauthAuthorizationCode: authPostgresOAuthAuthorizationCode,
+    oauthDeviceAuthorization: authPostgresOAuthDeviceAuthorization,
+    oauthClientSecret: authPostgresOAuthClientSecret,
+    oauthProviderModeToken: authPostgresOAuthProviderModeToken,
+    oauthProviderTokenVault: authPostgresOAuthProviderTokenVault,
+    auditLog: authPostgresAuditLog,
+    loginApprovalReview: authPostgresLoginApprovalReview,
+    loginRiskHistory: authPostgresLoginRiskHistory,
+    trustedDevice: authPostgresTrustedDevice,
+    domainVerification: authPostgresDomainVerification,
+    securityTimeline: authPostgresSecurityTimeline,
+    webhookOutbox: authPostgresWebhookOutbox,
+    webhookReplay: authPostgresWebhookReplay,
+    permissionDefinition: authPostgresPermissionDefinition,
+    roleDefinition: authPostgresRoleDefinition,
+    permissionGrant: authPostgresPermissionGrant,
+    roleGrant: authPostgresRoleGrant,
+    rolePermission: authPostgresRolePermission,
+};
+const userSelection = {
+    id: authPostgresUser.id,
+    createdAt: authPostgresUser.created_at,
+    updatedAt: authPostgresUser.updated_at,
+    disabledAt: authPostgresUser.disabled_at,
+    metadata: authPostgresUser.metadata,
+};
+const identitySelection = {
+    id: authPostgresUserIdentity.id,
+    userId: authPostgresUserIdentity.user_id,
+    scopeType: authPostgresUserIdentity.scope_type,
+    scopeId: authPostgresUserIdentity.scope_id,
+    kind: authPostgresUserIdentity.kind,
+    value: authPostgresUserIdentity.value,
+    normalizedValue: authPostgresUserIdentity.normalized_value,
+    verifiedAt: authPostgresUserIdentity.verified_at,
+    isPrimaryLogin: authPostgresUserIdentity.is_primary_login,
+    createdAt: authPostgresUserIdentity.created_at,
+    updatedAt: authPostgresUserIdentity.updated_at,
+    revokedAt: authPostgresUserIdentity.revoked_at,
+    replacedById: authPostgresUserIdentity.replaced_by_id,
+    metadata: authPostgresUserIdentity.metadata,
+};
+const credentialSelection = {
+    id: authPostgresCredential.id,
+    userId: authPostgresCredential.user_id,
+    type: authPostgresCredential.type,
+    passwordHash: authPostgresCredential.password_hash,
+    createdAt: authPostgresCredential.created_at,
+    updatedAt: authPostgresCredential.updated_at,
+    revokedAt: authPostgresCredential.revoked_at,
+    metadata: authPostgresCredential.metadata,
+};
+const passkeyCredentialSelection = {
+    id: authPostgresPasskeyCredential.id,
+    userId: authPostgresPasskeyCredential.user_id,
+    credentialId: authPostgresPasskeyCredential.credential_id,
+    publicKey: authPostgresPasskeyCredential.public_key,
+    signCount: authPostgresPasskeyCredential.sign_count,
+    transports: authPostgresPasskeyCredential.transports,
+    backedUp: authPostgresPasskeyCredential.backed_up,
+    createdAt: authPostgresPasskeyCredential.created_at,
+    lastUsedAt: authPostgresPasskeyCredential.last_used_at,
+    revokedAt: authPostgresPasskeyCredential.revoked_at,
+    metadata: authPostgresPasskeyCredential.metadata,
+};
+const sessionSelection = {
+    id: authPostgresSession.id,
+    userId: authPostgresSession.user_id,
+    secretHash: authPostgresSession.secret_hash,
+    createdAt: authPostgresSession.created_at,
+    expiresAt: authPostgresSession.expires_at,
+    authTime: authPostgresSession.auth_time,
+    authenticationEvents: authPostgresSession.authentication_events,
+    aal: authPostgresSession.aal,
+    amr: authPostgresSession.amr,
+    claims: authPostgresSession.claims,
+    mfaVerifiedAt: authPostgresSession.mfa_verified_at,
+    metadata: authPostgresSession.metadata,
+    revokedAt: authPostgresSession.revoked_at,
+    lastSeenAt: authPostgresSession.last_seen_at,
+    rotatedAt: authPostgresSession.rotated_at,
+};
+const verificationSelection = {
+    id: authPostgresVerification.id,
+    type: authPostgresVerification.type,
+    subject: authPostgresVerification.subject,
+    secretHash: authPostgresVerification.secret_hash,
+    createdAt: authPostgresVerification.created_at,
+    expiresAt: authPostgresVerification.expires_at,
+    metadata: authPostgresVerification.metadata,
+    consumedAt: authPostgresVerification.consumed_at,
+};
+const totpFactorSelection = {
+    id: authPostgresTotpFactor.id,
+    userId: authPostgresTotpFactor.user_id,
+    secret: authPostgresTotpFactor.secret,
+    algorithm: authPostgresTotpFactor.algorithm,
+    digits: authPostgresTotpFactor.digits,
+    period: authPostgresTotpFactor.period,
+    createdAt: authPostgresTotpFactor.created_at,
+    confirmedAt: authPostgresTotpFactor.confirmed_at,
+    lastUsedAt: authPostgresTotpFactor.last_used_at,
+    lastAcceptedCounter: authPostgresTotpFactor.last_accepted_counter,
+    revokedAt: authPostgresTotpFactor.revoked_at,
+    metadata: authPostgresTotpFactor.metadata,
+};
+const recoveryCodeSelection = {
+    id: authPostgresRecoveryCode.id,
+    userId: authPostgresRecoveryCode.user_id,
+    codeHash: authPostgresRecoveryCode.code_hash,
+    createdAt: authPostgresRecoveryCode.created_at,
+    usedAt: authPostgresRecoveryCode.used_at,
+    revokedAt: authPostgresRecoveryCode.revoked_at,
+    metadata: authPostgresRecoveryCode.metadata,
+};
+const apiKeySelection = {
+    id: authPostgresApiKey.id,
+    userId: authPostgresApiKey.user_id,
+    prefix: authPostgresApiKey.prefix,
+    secretHash: authPostgresApiKey.secret_hash,
+    scopes: authPostgresApiKey.scopes,
+    createdAt: authPostgresApiKey.created_at,
+    expiresAt: authPostgresApiKey.expires_at,
+    lastUsedAt: authPostgresApiKey.last_used_at,
+    revokedAt: authPostgresApiKey.revoked_at,
+    metadata: authPostgresApiKey.metadata,
+};
+const refreshTokenSelection = {
+    id: authPostgresRefreshToken.id,
+    familyId: authPostgresRefreshToken.family_id,
+    userId: authPostgresRefreshToken.user_id,
+    secretHash: authPostgresRefreshToken.secret_hash,
+    createdAt: authPostgresRefreshToken.created_at,
+    expiresAt: authPostgresRefreshToken.expires_at,
+    lastUsedAt: authPostgresRefreshToken.last_used_at,
+    rotatedAt: authPostgresRefreshToken.rotated_at,
+    replacedById: authPostgresRefreshToken.replaced_by_id,
+    revokedAt: authPostgresRefreshToken.revoked_at,
+    reuseDetectedAt: authPostgresRefreshToken.reuse_detected_at,
+    metadata: authPostgresRefreshToken.metadata,
+};
+const jwtRevocationSelection = {
+    jwtId: authPostgresJwtRevocation.jwt_id,
+    revokedAt: authPostgresJwtRevocation.revoked_at,
+    expiresAt: authPostgresJwtRevocation.expires_at,
+    reason: authPostgresJwtRevocation.reason,
+};
+const oauthAccountSelection = {
+    id: authPostgresOAuthAccount.id,
+    providerId: authPostgresOAuthAccount.provider_id,
+    providerAccountId: authPostgresOAuthAccount.provider_account_id,
+    userId: authPostgresOAuthAccount.user_id,
+    email: authPostgresOAuthAccount.email,
+    emailVerified: authPostgresOAuthAccount.email_verified,
+    createdAt: authPostgresOAuthAccount.created_at,
+    updatedAt: authPostgresOAuthAccount.updated_at,
+    unlinkedAt: authPostgresOAuthAccount.unlinked_at,
+    metadata: authPostgresOAuthAccount.metadata,
+};
+const oauthClientSelection = {
+    id: authPostgresOAuthClient.id,
+    type: authPostgresOAuthClient.type,
+    status: authPostgresOAuthClient.status,
+    name: authPostgresOAuthClient.name,
+    redirectUris: authPostgresOAuthClient.redirect_uris,
+    allowedGrantTypes: authPostgresOAuthClient.allowed_grant_types,
+    allowedResponseTypes: authPostgresOAuthClient.allowed_response_types,
+    allowedScopes: authPostgresOAuthClient.allowed_scopes,
+    createdAt: authPostgresOAuthClient.created_at,
+    updatedAt: authPostgresOAuthClient.updated_at,
+    metadata: authPostgresOAuthClient.metadata,
+};
+const oauthConsentSelection = {
+    userId: authPostgresOAuthConsent.user_id,
+    clientId: authPostgresOAuthConsent.client_id,
+    scopes: authPostgresOAuthConsent.scopes,
+    grantedAt: authPostgresOAuthConsent.granted_at,
+    expiresAt: authPostgresOAuthConsent.expires_at,
+    revokedAt: authPostgresOAuthConsent.revoked_at,
+    metadata: authPostgresOAuthConsent.metadata,
+};
+const oauthAuthorizationCodeSelection = {
+    codeHash: authPostgresOAuthAuthorizationCode.code_hash,
+    clientId: authPostgresOAuthAuthorizationCode.client_id,
+    subject: authPostgresOAuthAuthorizationCode.subject,
+    redirectUri: authPostgresOAuthAuthorizationCode.redirect_uri,
+    scopes: authPostgresOAuthAuthorizationCode.scopes,
+    codeChallenge: authPostgresOAuthAuthorizationCode.code_challenge,
+    codeChallengeMethod: authPostgresOAuthAuthorizationCode.code_challenge_method,
+    issuedAt: authPostgresOAuthAuthorizationCode.issued_at,
+    expiresAt: authPostgresOAuthAuthorizationCode.expires_at,
+    consumedAt: authPostgresOAuthAuthorizationCode.consumed_at,
+    metadata: authPostgresOAuthAuthorizationCode.metadata,
+};
+const oauthDeviceAuthorizationSelection = {
+    id: authPostgresOAuthDeviceAuthorization.id,
+    deviceCodeHash: authPostgresOAuthDeviceAuthorization.device_code_hash,
+    userCodeHash: authPostgresOAuthDeviceAuthorization.user_code_hash,
+    clientId: authPostgresOAuthDeviceAuthorization.client_id,
+    requestedScopes: authPostgresOAuthDeviceAuthorization.requested_scopes,
+    grantedScopes: authPostgresOAuthDeviceAuthorization.granted_scopes,
+    subject: authPostgresOAuthDeviceAuthorization.subject,
+    status: authPostgresOAuthDeviceAuthorization.status,
+    issuedAt: authPostgresOAuthDeviceAuthorization.issued_at,
+    expiresAt: authPostgresOAuthDeviceAuthorization.expires_at,
+    pollIntervalSeconds: authPostgresOAuthDeviceAuthorization.poll_interval_seconds,
+    nextPollAt: authPostgresOAuthDeviceAuthorization.next_poll_at,
+    lastPolledAt: authPostgresOAuthDeviceAuthorization.last_polled_at,
+    approvedAt: authPostgresOAuthDeviceAuthorization.approved_at,
+    deniedAt: authPostgresOAuthDeviceAuthorization.denied_at,
+    consumedAt: authPostgresOAuthDeviceAuthorization.consumed_at,
+    metadata: authPostgresOAuthDeviceAuthorization.metadata,
+};
+const oauthClientSecretSelection = {
+    prefix: authPostgresOAuthClientSecret.prefix,
+    clientId: authPostgresOAuthClientSecret.client_id,
+    secretHash: authPostgresOAuthClientSecret.secret_hash,
+    authenticationMethods: authPostgresOAuthClientSecret.authentication_methods,
+    createdAt: authPostgresOAuthClientSecret.created_at,
+    expiresAt: authPostgresOAuthClientSecret.expires_at,
+    lastUsedAt: authPostgresOAuthClientSecret.last_used_at,
+    revokedAt: authPostgresOAuthClientSecret.revoked_at,
+    metadata: authPostgresOAuthClientSecret.metadata,
+};
+const oauthProviderModeTokenSelection = {
+    tokenHash: authPostgresOAuthProviderModeToken.token_hash,
+    tokenType: authPostgresOAuthProviderModeToken.token_type,
+    clientId: authPostgresOAuthProviderModeToken.client_id,
+    subject: authPostgresOAuthProviderModeToken.subject,
+    scopes: authPostgresOAuthProviderModeToken.scopes,
+    issuedAt: authPostgresOAuthProviderModeToken.issued_at,
+    expiresAt: authPostgresOAuthProviderModeToken.expires_at,
+    issuer: authPostgresOAuthProviderModeToken.issuer,
+    audience: authPostgresOAuthProviderModeToken.audience,
+    jwtId: authPostgresOAuthProviderModeToken.jwt_id,
+    revokedAt: authPostgresOAuthProviderModeToken.revoked_at,
+    revocationReason: authPostgresOAuthProviderModeToken.revocation_reason,
+    rotatedAt: authPostgresOAuthProviderModeToken.rotated_at,
+    replacedByTokenHash: authPostgresOAuthProviderModeToken.replaced_by_token_hash,
+    metadata: authPostgresOAuthProviderModeToken.metadata,
+};
+const oauthProviderTokenVaultSelection = {
+    accountId: authPostgresOAuthProviderTokenVault.account_id,
+    userId: authPostgresOAuthProviderTokenVault.user_id,
+    providerId: authPostgresOAuthProviderTokenVault.provider_id,
+    providerAccountId: authPostgresOAuthProviderTokenVault.provider_account_id,
+    accessTokenCiphertext: authPostgresOAuthProviderTokenVault.access_token_ciphertext,
+    refreshTokenCiphertext: authPostgresOAuthProviderTokenVault.refresh_token_ciphertext,
+    idTokenCiphertext: authPostgresOAuthProviderTokenVault.id_token_ciphertext,
+    tokenType: authPostgresOAuthProviderTokenVault.token_type,
+    scopes: authPostgresOAuthProviderTokenVault.scopes,
+    expiresAt: authPostgresOAuthProviderTokenVault.expires_at,
+    updatedAt: authPostgresOAuthProviderTokenVault.updated_at,
+    revokedAt: authPostgresOAuthProviderTokenVault.revoked_at,
+    revocationReason: authPostgresOAuthProviderTokenVault.revocation_reason,
+};
+const auditLogSelection = {
+    id: authPostgresAuditLog.id,
+    type: authPostgresAuditLog.type,
+    userId: authPostgresAuditLog.user_id,
+    actorUserId: authPostgresAuditLog.actor_user_id,
+    occurredAt: authPostgresAuditLog.occurred_at,
+    requestIpHash: authPostgresAuditLog.request_ip_hash,
+    requestUserAgentHash: authPostgresAuditLog.request_user_agent_hash,
+    event: authPostgresAuditLog.event,
+    createdAt: authPostgresAuditLog.created_at,
+};
+const loginApprovalReviewSelection = {
+    approvalChallengeId: authPostgresLoginApprovalReview.approval_challenge_id,
+    flowId: authPostgresLoginApprovalReview.flow_id,
+    userId: authPostgresLoginApprovalReview.user_id,
+    channel: authPostgresLoginApprovalReview.channel,
+    reason: authPostgresLoginApprovalReview.reason,
+    sessionBinding: authPostgresLoginApprovalReview.session_binding,
+    sameDeviceRequired: authPostgresLoginApprovalReview.same_device_required,
+    status: authPostgresLoginApprovalReview.status,
+    createdAt: authPostgresLoginApprovalReview.created_at,
+    expiresAt: authPostgresLoginApprovalReview.expires_at,
+    reviewedAt: authPostgresLoginApprovalReview.reviewed_at,
+    reviewedBy: authPostgresLoginApprovalReview.reviewed_by,
+    deniedReason: authPostgresLoginApprovalReview.denied_reason,
+    risk: authPostgresLoginApprovalReview.risk,
+    metadata: authPostgresLoginApprovalReview.metadata,
+    reviewMetadata: authPostgresLoginApprovalReview.review_metadata,
+};
+const loginRiskHistorySelection = {
+    id: authPostgresLoginRiskHistory.id,
+    userId: authPostgresLoginRiskHistory.user_id,
+    occurredAt: authPostgresLoginRiskHistory.occurred_at,
+    outcome: authPostgresLoginRiskHistory.outcome,
+    method: authPostgresLoginRiskHistory.method,
+    amr: authPostgresLoginRiskHistory.amr,
+    aal: authPostgresLoginRiskHistory.aal,
+    deviceStatus: authPostgresLoginRiskHistory.device_status,
+    deviceKey: authPostgresLoginRiskHistory.device_key,
+    locationKey: authPostgresLoginRiskHistory.location_key,
+    country: authPostgresLoginRiskHistory.country,
+    region: authPostgresLoginRiskHistory.region,
+    latitudeMicro: authPostgresLoginRiskHistory.latitude_micro,
+    longitudeMicro: authPostgresLoginRiskHistory.longitude_micro,
+    riskLevel: authPostgresLoginRiskHistory.risk_level,
+    createdAt: authPostgresLoginRiskHistory.created_at,
+};
+const trustedDeviceSelection = {
+    userId: authPostgresTrustedDevice.user_id,
+    tokenHash: authPostgresTrustedDevice.token_hash,
+    createdAt: authPostgresTrustedDevice.created_at,
+    lastSeenAt: authPostgresTrustedDevice.last_seen_at,
+    expiresAt: authPostgresTrustedDevice.expires_at,
+    metadata: authPostgresTrustedDevice.metadata,
+};
+const domainVerificationSelection = {
+    id: authPostgresDomainVerification.id,
+    ownerId: authPostgresDomainVerification.owner_id,
+    domain: authPostgresDomainVerification.domain,
+    proofMethod: authPostgresDomainVerification.proof_method,
+    proofToken: authPostgresDomainVerification.proof_token,
+    status: authPostgresDomainVerification.status,
+    createdAt: authPostgresDomainVerification.created_at,
+    expiresAt: authPostgresDomainVerification.expires_at,
+    verifiedAt: authPostgresDomainVerification.verified_at,
+    revokedAt: authPostgresDomainVerification.revoked_at,
+    lastCheckedAt: authPostgresDomainVerification.last_checked_at,
+    metadata: authPostgresDomainVerification.metadata,
+};
+const securityTimelineSelection = {
+    id: authPostgresSecurityTimeline.id,
+    userId: authPostgresSecurityTimeline.user_id,
+    type: authPostgresSecurityTimeline.type,
+    category: authPostgresSecurityTimeline.category,
+    severity: authPostgresSecurityTimeline.severity,
+    occurredAt: authPostgresSecurityTimeline.occurred_at,
+    summary: authPostgresSecurityTimeline.summary,
+    actor: authPostgresSecurityTimeline.actor,
+    request: authPostgresSecurityTimeline.request,
+    metadata: authPostgresSecurityTimeline.metadata,
+};
+const webhookOutboxSelection = {
+    id: authPostgresWebhookOutbox.id,
+    endpointKey: authPostgresWebhookOutbox.endpoint_key,
+    event: authPostgresWebhookOutbox.event,
+    status: authPostgresWebhookOutbox.status,
+    attempts: authPostgresWebhookOutbox.attempts,
+    nextAttemptAt: authPostgresWebhookOutbox.next_attempt_at,
+    createdAt: authPostgresWebhookOutbox.created_at,
+    updatedAt: authPostgresWebhookOutbox.updated_at,
+    deliveredAt: authPostgresWebhookOutbox.delivered_at,
+    lastError: authPostgresWebhookOutbox.last_error,
+};
+const permissionDefinitionSelection = {
+    id: authPostgresPermissionDefinition.id,
+    description: authPostgresPermissionDefinition.description,
+    scopeTypePresent: authPostgresPermissionDefinition.scope_type_present,
+    scopeType: authPostgresPermissionDefinition.scope_type,
+    createdAt: authPostgresPermissionDefinition.created_at,
+    updatedAt: authPostgresPermissionDefinition.updated_at,
+    disabledAt: authPostgresPermissionDefinition.disabled_at,
+    deletedAt: authPostgresPermissionDefinition.deleted_at,
+};
+const roleDefinitionSelection = {
+    id: authPostgresRoleDefinition.id,
+    description: authPostgresRoleDefinition.description,
+    createdAt: authPostgresRoleDefinition.created_at,
+    updatedAt: authPostgresRoleDefinition.updated_at,
+    disabledAt: authPostgresRoleDefinition.disabled_at,
+    deletedAt: authPostgresRoleDefinition.deleted_at,
+};
+const permissionGrantSelection = {
+    subjectType: authPostgresPermissionGrant.subject_type,
+    subjectId: authPostgresPermissionGrant.subject_id,
+    permissionId: authPostgresPermissionGrant.permission_id,
+    scopeType: authPostgresPermissionGrant.scope_type,
+    scopeIdPresent: authPostgresPermissionGrant.scope_id_present,
+    scopeId: authPostgresPermissionGrant.scope_id,
+    expiresAt: authPostgresPermissionGrant.expires_at,
+    metadata: authPostgresPermissionGrant.metadata,
+    revokedAt: authPostgresPermissionGrant.revoked_at,
+};
+const roleGrantSelection = {
+    subjectType: authPostgresRoleGrant.subject_type,
+    subjectId: authPostgresRoleGrant.subject_id,
+    roleId: authPostgresRoleGrant.role_id,
+    scopeType: authPostgresRoleGrant.scope_type,
+    scopeIdPresent: authPostgresRoleGrant.scope_id_present,
+    scopeId: authPostgresRoleGrant.scope_id,
+    expiresAt: authPostgresRoleGrant.expires_at,
+    metadata: authPostgresRoleGrant.metadata,
+    revokedAt: authPostgresRoleGrant.revoked_at,
+};
+const rolePermissionSelection = {
+    roleId: authPostgresRolePermission.role_id,
+    permissionId: authPostgresRolePermission.permission_id,
+    scopeTypePresent: authPostgresRolePermission.scope_type_present,
+    scopeType: authPostgresRolePermission.scope_type,
+};
+/** Converts UnixMillis to a Postgres bigint parameter without precision loss. */
+export const unixMillisToPostgresBigint = (value) => {
+    const number = Number(value);
+    if (!Number.isSafeInteger(number)) {
+        throw new RangeError("UnixMillis exceeds the safe Postgres bigint range");
+    }
+    return String(number);
+};
+const millisParam = unixMillisToPostgresBigint;
+/** Converts a Postgres bigint result without permitting precision loss. */
+export const postgresBigintToUnixMillis = (value) => {
+    if ((typeof value !== "string" &&
+        typeof value !== "number" &&
+        typeof value !== "bigint") ||
+        (typeof value === "string" && !/^-?\d+$/.test(value))) {
+        throw new TypeError("Expected a Postgres bigint UnixMillis value");
+    }
+    const bigint = BigInt(value);
+    if (bigint < BigInt(Number.MIN_SAFE_INTEGER) ||
+        bigint > BigInt(Number.MAX_SAFE_INTEGER)) {
+        throw new RangeError("Postgres bigint UnixMillis exceeds the safe range");
+    }
+    return UnixMillis(Number(bigint));
+};
+const safeIntegerToPostgresBigint = (value, label) => {
+    if (!Number.isSafeInteger(value)) {
+        throw new RangeError(`${label} exceeds the safe Postgres bigint range`);
+    }
+    return String(value);
+};
+const postgresBigintToSafeInteger = (value, label) => {
+    if ((typeof value !== "string" &&
+        typeof value !== "number" &&
+        typeof value !== "bigint") ||
+        (typeof value === "string" && !/^-?\d+$/.test(value)) ||
+        (typeof value === "number" && !Number.isSafeInteger(value))) {
+        throw new TypeError(`Expected a Postgres bigint ${label} value`);
+    }
+    const bigint = BigInt(value);
+    if (bigint < BigInt(Number.MIN_SAFE_INTEGER) ||
+        bigint > BigInt(Number.MAX_SAFE_INTEGER)) {
+        throw new RangeError(`Postgres bigint ${label} exceeds the safe range`);
+    }
+    return Number(bigint);
+};
+const optionalMillis = (value) => value === null || value === undefined
+    ? undefined
+    : postgresBigintToUnixMillis(value);
+const optionalRecord = (value) => value === null || value === undefined
+    ? undefined
+    : value;
+const scopeFrom = (type, id) => type === "tenant"
+    ? { type: "tenant", tenantId: String(id) }
+    : { type: "global" };
+const scopeId = (scope) => scope.type === "tenant" ? scope.tenantId : "";
+const decodeUser = (row) => ({
+    id: UserId(String(row.id)),
+    createdAt: postgresBigintToUnixMillis(row.createdAt ?? row.created_at),
+    updatedAt: postgresBigintToUnixMillis(row.updatedAt ?? row.updated_at),
+    ...(optionalMillis(row.disabledAt ?? row.disabled_at) === undefined
+        ? {}
+        : { disabledAt: optionalMillis(row.disabledAt ?? row.disabled_at) }),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+});
+const decodeIdentity = (row) => ({
+    id: IdentityId(String(row.id)),
+    userId: UserId(String(row.userId ?? row.user_id)),
+    scope: scopeFrom(row.scopeType ?? row.scope_type, row.scopeId ?? row.scope_id),
+    kind: String(row.kind),
+    value: String(row.value),
+    normalizedValue: String(row.normalizedValue ?? row.normalized_value),
+    ...(optionalMillis(row.verifiedAt ?? row.verified_at) === undefined
+        ? {}
+        : { verifiedAt: optionalMillis(row.verifiedAt ?? row.verified_at) }),
+    isPrimaryLogin: Boolean(row.isPrimaryLogin ?? row.is_primary_login),
+    createdAt: postgresBigintToUnixMillis(row.createdAt ?? row.created_at),
+    updatedAt: postgresBigintToUnixMillis(row.updatedAt ?? row.updated_at),
+    ...(optionalMillis(row.revokedAt ?? row.revoked_at) === undefined
+        ? {}
+        : { revokedAt: optionalMillis(row.revokedAt ?? row.revoked_at) }),
+    ...((row.replacedById ?? row.replaced_by_id) === null ||
+        (row.replacedById ?? row.replaced_by_id) === undefined
+        ? {}
+        : {
+            replacedById: IdentityId(String(row.replacedById ?? row.replaced_by_id)),
+        }),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+});
+const decodeCredential = (row) => ({
+    id: CredentialId(String(row.id)),
+    userId: UserId(String(row.userId ?? row.user_id)),
+    passwordHash: String(row.passwordHash ?? row.password_hash),
+    createdAt: postgresBigintToUnixMillis(row.createdAt ?? row.created_at),
+    updatedAt: postgresBigintToUnixMillis(row.updatedAt ?? row.updated_at),
+    ...(optionalMillis(row.revokedAt ?? row.revoked_at) === undefined
+        ? {}
+        : { revokedAt: optionalMillis(row.revokedAt ?? row.revoked_at) }),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+});
+const decodePasskeyCredential = (row) => ({
+    id: CredentialId(String(row.id)),
+    userId: UserId(String(row.userId ?? row.user_id)),
+    credentialId: PasskeyCredentialId(String(row.credentialId ?? row.credential_id)),
+    publicKey: String(row.publicKey ?? row.public_key),
+    signCount: postgresBigintToSafeInteger(row.signCount ?? row.sign_count, "sign count"),
+    ...(Array.isArray(row.transports)
+        ? { transports: row.transports.map(String) }
+        : {}),
+    ...((row.backedUp ?? row.backed_up) === null ||
+        (row.backedUp ?? row.backed_up) === undefined
+        ? {}
+        : { backedUp: Boolean(row.backedUp ?? row.backed_up) }),
+    createdAt: postgresBigintToUnixMillis(row.createdAt ?? row.created_at),
+    ...(optionalMillis(row.lastUsedAt ?? row.last_used_at) === undefined
+        ? {}
+        : { lastUsedAt: optionalMillis(row.lastUsedAt ?? row.last_used_at) }),
+    ...(optionalMillis(row.revokedAt ?? row.revoked_at) === undefined
+        ? {}
+        : { revokedAt: optionalMillis(row.revokedAt ?? row.revoked_at) }),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+});
+const decodeSession = (row) => ({
+    id: SessionId(String(row.id)),
+    userId: UserId(String(row.userId ?? row.user_id)),
+    secretHash: String(row.secretHash ?? row.secret_hash),
+    createdAt: postgresBigintToUnixMillis(row.createdAt ?? row.created_at),
+    expiresAt: postgresBigintToUnixMillis(row.expiresAt ?? row.expires_at),
+    authTime: postgresBigintToUnixMillis(row.authTime ?? row.auth_time),
+    authenticationEvents: parseAuthenticationEvents(row.authenticationEvents ?? row.authentication_events),
+    aal: String(row.aal),
+    amr: row.amr,
+    ...(row.claims === null || row.claims === undefined
+        ? {}
+        : { claims: row.claims }),
+    ...(optionalMillis(row.mfaVerifiedAt ?? row.mfa_verified_at) === undefined
+        ? {}
+        : {
+            mfaVerifiedAt: optionalMillis(row.mfaVerifiedAt ?? row.mfa_verified_at),
+        }),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+    ...(optionalMillis(row.revokedAt ?? row.revoked_at) === undefined
+        ? {}
+        : { revokedAt: optionalMillis(row.revokedAt ?? row.revoked_at) }),
+    ...(optionalMillis(row.lastSeenAt ?? row.last_seen_at) === undefined
+        ? {}
+        : { lastSeenAt: optionalMillis(row.lastSeenAt ?? row.last_seen_at) }),
+    ...(optionalMillis(row.rotatedAt ?? row.rotated_at) === undefined
+        ? {}
+        : { rotatedAt: optionalMillis(row.rotatedAt ?? row.rotated_at) }),
+});
+const decodeVerification = (row) => ({
+    id: ChallengeId(String(row.id)),
+    type: String(row.type),
+    subject: String(row.subject),
+    ...((row.secretHash ?? row.secret_hash) === null ||
+        (row.secretHash ?? row.secret_hash) === undefined
+        ? {}
+        : { secretHash: String(row.secretHash ?? row.secret_hash) }),
+    createdAt: postgresBigintToUnixMillis(row.createdAt ?? row.created_at),
+    expiresAt: postgresBigintToUnixMillis(row.expiresAt ?? row.expires_at),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+    ...(optionalMillis(row.consumedAt ?? row.consumed_at) === undefined
+        ? {}
+        : { consumedAt: optionalMillis(row.consumedAt ?? row.consumed_at) }),
+});
+const decodeTotpFactor = (row) => ({
+    id: CredentialId(String(row.id)),
+    userId: UserId(String(row.userId ?? row.user_id)),
+    secret: Redacted.make(TotpSecret(String(row.secret))),
+    algorithm: String(row.algorithm),
+    digits: Number(row.digits),
+    period: Number(row.period),
+    createdAt: postgresBigintToUnixMillis(row.createdAt ?? row.created_at),
+    ...(optionalMillis(row.confirmedAt ?? row.confirmed_at) === undefined
+        ? {}
+        : { confirmedAt: optionalMillis(row.confirmedAt ?? row.confirmed_at) }),
+    ...(optionalMillis(row.lastUsedAt ?? row.last_used_at) === undefined
+        ? {}
+        : { lastUsedAt: optionalMillis(row.lastUsedAt ?? row.last_used_at) }),
+    ...((row.lastAcceptedCounter ?? row.last_accepted_counter) === null ||
+        (row.lastAcceptedCounter ?? row.last_accepted_counter) === undefined
+        ? {}
+        : {
+            lastAcceptedCounter: Number(row.lastAcceptedCounter ?? row.last_accepted_counter),
+        }),
+    ...(optionalMillis(row.revokedAt ?? row.revoked_at) === undefined
+        ? {}
+        : { revokedAt: optionalMillis(row.revokedAt ?? row.revoked_at) }),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+});
+const decodeRecoveryCode = (row) => ({
+    id: CredentialId(String(row.id)),
+    userId: UserId(String(row.userId ?? row.user_id)),
+    codeHash: RecoveryCodeHash(String(row.codeHash ?? row.code_hash)),
+    createdAt: postgresBigintToUnixMillis(row.createdAt ?? row.created_at),
+    ...(optionalMillis(row.usedAt ?? row.used_at) === undefined
+        ? {}
+        : { usedAt: optionalMillis(row.usedAt ?? row.used_at) }),
+    ...(optionalMillis(row.revokedAt ?? row.revoked_at) === undefined
+        ? {}
+        : { revokedAt: optionalMillis(row.revokedAt ?? row.revoked_at) }),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+});
+const decodeApiKey = (row) => ({
+    id: ApiKeyId(String(row.id)),
+    userId: UserId(String(row.userId ?? row.user_id)),
+    prefix: ApiKeyPrefix(String(row.prefix)),
+    secretHash: ApiKeySecretHash(String(row.secretHash ?? row.secret_hash)),
+    scopes: Array.isArray(row.scopes) ? row.scopes.map(String) : [],
+    createdAt: postgresBigintToUnixMillis(row.createdAt ?? row.created_at),
+    ...(optionalMillis(row.expiresAt ?? row.expires_at) === undefined
+        ? {}
+        : { expiresAt: optionalMillis(row.expiresAt ?? row.expires_at) }),
+    ...(optionalMillis(row.lastUsedAt ?? row.last_used_at) === undefined
+        ? {}
+        : { lastUsedAt: optionalMillis(row.lastUsedAt ?? row.last_used_at) }),
+    ...(optionalMillis(row.revokedAt ?? row.revoked_at) === undefined
+        ? {}
+        : { revokedAt: optionalMillis(row.revokedAt ?? row.revoked_at) }),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+});
+const decodeRefreshToken = (row) => ({
+    id: RefreshTokenId(String(row.id)),
+    familyId: RefreshTokenFamilyId(String(row.familyId ?? row.family_id)),
+    userId: UserId(String(row.userId ?? row.user_id)),
+    secretHash: RefreshTokenSecretHash(String(row.secretHash ?? row.secret_hash)),
+    createdAt: postgresBigintToUnixMillis(row.createdAt ?? row.created_at),
+    expiresAt: postgresBigintToUnixMillis(row.expiresAt ?? row.expires_at),
+    ...(optionalMillis(row.lastUsedAt ?? row.last_used_at) === undefined
+        ? {}
+        : { lastUsedAt: optionalMillis(row.lastUsedAt ?? row.last_used_at) }),
+    ...(optionalMillis(row.rotatedAt ?? row.rotated_at) === undefined
+        ? {}
+        : { rotatedAt: optionalMillis(row.rotatedAt ?? row.rotated_at) }),
+    ...((row.replacedById ?? row.replaced_by_id) === null ||
+        (row.replacedById ?? row.replaced_by_id) === undefined
+        ? {}
+        : {
+            replacedById: RefreshTokenId(String(row.replacedById ?? row.replaced_by_id)),
+        }),
+    ...(optionalMillis(row.revokedAt ?? row.revoked_at) === undefined
+        ? {}
+        : { revokedAt: optionalMillis(row.revokedAt ?? row.revoked_at) }),
+    ...(optionalMillis(row.reuseDetectedAt ?? row.reuse_detected_at) === undefined
+        ? {}
+        : {
+            reuseDetectedAt: optionalMillis(row.reuseDetectedAt ?? row.reuse_detected_at),
+        }),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+});
+const decodeJwtRevocation = (row) => ({
+    jwtId: String(row.jwtId ?? row.jwt_id),
+    revokedAt: postgresBigintToUnixMillis(row.revokedAt ?? row.revoked_at),
+    ...(optionalMillis(row.expiresAt ?? row.expires_at) === undefined
+        ? {}
+        : { expiresAt: optionalMillis(row.expiresAt ?? row.expires_at) }),
+    ...(row.reason === null || row.reason === undefined
+        ? {}
+        : { reason: String(row.reason) }),
+});
+const decodeOAuthAccount = (row) => ({
+    id: OAuthAccountId(String(row.id)),
+    providerId: OAuthProviderId(String(row.providerId ?? row.provider_id)),
+    providerAccountId: String(row.providerAccountId ?? row.provider_account_id),
+    userId: UserId(String(row.userId ?? row.user_id)),
+    ...(row.email === null || row.email === undefined
+        ? {}
+        : { email: Email(String(row.email)) }),
+    ...((row.emailVerified ?? row.email_verified) === null ||
+        (row.emailVerified ?? row.email_verified) === undefined
+        ? {}
+        : { emailVerified: Boolean(row.emailVerified ?? row.email_verified) }),
+    createdAt: postgresBigintToUnixMillis(row.createdAt ?? row.created_at),
+    updatedAt: postgresBigintToUnixMillis(row.updatedAt ?? row.updated_at),
+    ...(optionalMillis(row.unlinkedAt ?? row.unlinked_at) === undefined
+        ? {}
+        : { unlinkedAt: optionalMillis(row.unlinkedAt ?? row.unlinked_at) }),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+});
+const stringArray = (value) => Array.isArray(value) ? value.map(String) : [];
+const decodeOAuthClient = (row) => ({
+    id: OAuthClientId(String(row.id)),
+    type: String(row.type),
+    status: String(row.status),
+    ...(row.name === null || row.name === undefined
+        ? {}
+        : { name: String(row.name) }),
+    redirectUris: stringArray(row.redirectUris ?? row.redirect_uris),
+    allowedGrantTypes: stringArray(row.allowedGrantTypes ?? row.allowed_grant_types),
+    allowedResponseTypes: stringArray(row.allowedResponseTypes ?? row.allowed_response_types),
+    ...((row.allowedScopes ?? row.allowed_scopes) === null ||
+        (row.allowedScopes ?? row.allowed_scopes) === undefined
+        ? {}
+        : { allowedScopes: stringArray(row.allowedScopes ?? row.allowed_scopes) }),
+    ...(optionalMillis(row.createdAt ?? row.created_at) === undefined
+        ? {}
+        : { createdAt: optionalMillis(row.createdAt ?? row.created_at) }),
+    ...(optionalMillis(row.updatedAt ?? row.updated_at) === undefined
+        ? {}
+        : { updatedAt: optionalMillis(row.updatedAt ?? row.updated_at) }),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+});
+const decodeOAuthConsent = (row) => ({
+    userId: UserId(String(row.userId ?? row.user_id)),
+    clientId: OAuthClientId(String(row.clientId ?? row.client_id)),
+    scopes: stringArray(row.scopes),
+    grantedAt: postgresBigintToUnixMillis(row.grantedAt ?? row.granted_at),
+    ...(optionalMillis(row.expiresAt ?? row.expires_at) === undefined
+        ? {}
+        : { expiresAt: optionalMillis(row.expiresAt ?? row.expires_at) }),
+    ...(optionalMillis(row.revokedAt ?? row.revoked_at) === undefined
+        ? {}
+        : { revokedAt: optionalMillis(row.revokedAt ?? row.revoked_at) }),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+});
+const decodeOAuthAuthorizationCode = (row) => ({
+    codeHash: String(row.codeHash ?? row.code_hash),
+    clientId: OAuthClientId(String(row.clientId ?? row.client_id)),
+    subject: String(row.subject),
+    redirectUri: String(row.redirectUri ?? row.redirect_uri),
+    scopes: stringArray(row.scopes),
+    ...((row.codeChallenge ?? row.code_challenge) === null ||
+        (row.codeChallenge ?? row.code_challenge) === undefined
+        ? {}
+        : {
+            codeChallenge: OAuthCodeChallenge(String(row.codeChallenge ?? row.code_challenge)),
+        }),
+    ...((row.codeChallengeMethod ?? row.code_challenge_method) === null ||
+        (row.codeChallengeMethod ?? row.code_challenge_method) === undefined
+        ? {}
+        : { codeChallengeMethod: "S256" }),
+    issuedAt: postgresBigintToUnixMillis(row.issuedAt ?? row.issued_at),
+    expiresAt: postgresBigintToUnixMillis(row.expiresAt ?? row.expires_at),
+    ...(optionalMillis(row.consumedAt ?? row.consumed_at) === undefined
+        ? {}
+        : { consumedAt: optionalMillis(row.consumedAt ?? row.consumed_at) }),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+});
+const decodeOAuthDeviceAuthorization = (row) => {
+    const base = {
+        id: OAuthDeviceAuthorizationId(String(row.id)),
+        deviceCodeHash: String(row.deviceCodeHash ?? row.device_code_hash),
+        userCodeHash: String(row.userCodeHash ?? row.user_code_hash),
+        clientId: OAuthClientId(String(row.clientId ?? row.client_id)),
+        requestedScopes: stringArray(row.requestedScopes ?? row.requested_scopes),
+        issuedAt: postgresBigintToUnixMillis(row.issuedAt ?? row.issued_at),
+        expiresAt: postgresBigintToUnixMillis(row.expiresAt ?? row.expires_at),
+        pollIntervalSeconds: Number(row.pollIntervalSeconds ?? row.poll_interval_seconds),
+        nextPollAt: postgresBigintToUnixMillis(row.nextPollAt ?? row.next_poll_at),
+        ...(optionalMillis(row.lastPolledAt ?? row.last_polled_at) === undefined
+            ? {}
+            : {
+                lastPolledAt: optionalMillis(row.lastPolledAt ?? row.last_polled_at),
+            }),
+        ...(optionalRecord(row.metadata) === undefined
+            ? {}
+            : { metadata: optionalRecord(row.metadata) }),
+    };
+    const status = String(row.status);
+    if (status === "approved") {
+        return {
+            ...base,
+            status: "approved",
+            subject: String(row.subject),
+            grantedScopes: stringArray(row.grantedScopes ?? row.granted_scopes),
+            approvedAt: postgresBigintToUnixMillis(row.approvedAt ?? row.approved_at),
+            ...(optionalMillis(row.consumedAt ?? row.consumed_at) === undefined
+                ? {}
+                : { consumedAt: optionalMillis(row.consumedAt ?? row.consumed_at) }),
+        };
+    }
+    if (status === "denied") {
+        return {
+            ...base,
+            status: "denied",
+            deniedAt: postgresBigintToUnixMillis(row.deniedAt ?? row.denied_at),
+        };
+    }
+    return { ...base, status: "pending" };
+};
+const decodeOAuthClientSecret = (row) => ({
+    prefix: OAuthClientSecretPrefix(String(row.prefix)),
+    clientId: OAuthClientId(String(row.clientId ?? row.client_id)),
+    secretHash: OAuthClientSecretHash(String(row.secretHash ?? row.secret_hash)),
+    authenticationMethods: stringArray(row.authenticationMethods ?? row.authentication_methods),
+    createdAt: postgresBigintToUnixMillis(row.createdAt ?? row.created_at),
+    ...(optionalMillis(row.expiresAt ?? row.expires_at) === undefined
+        ? {}
+        : { expiresAt: optionalMillis(row.expiresAt ?? row.expires_at) }),
+    ...(optionalMillis(row.lastUsedAt ?? row.last_used_at) === undefined
+        ? {}
+        : { lastUsedAt: optionalMillis(row.lastUsedAt ?? row.last_used_at) }),
+    ...(optionalMillis(row.revokedAt ?? row.revoked_at) === undefined
+        ? {}
+        : { revokedAt: optionalMillis(row.revokedAt ?? row.revoked_at) }),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+});
+const decodeOAuthProviderModeTokenAudience = (value) => typeof value === "string"
+    ? value
+    : Array.isArray(value)
+        ? value.map(String)
+        : undefined;
+const decodeOAuthProviderModeToken = (row) => ({
+    tokenHash: String(row.tokenHash ?? row.token_hash),
+    tokenType: String(row.tokenType ?? row.token_type),
+    clientId: OAuthClientId(String(row.clientId ?? row.client_id)),
+    subject: String(row.subject),
+    scopes: stringArray(row.scopes),
+    issuedAt: postgresBigintToUnixMillis(row.issuedAt ?? row.issued_at),
+    expiresAt: postgresBigintToUnixMillis(row.expiresAt ?? row.expires_at),
+    ...(row.issuer === null || row.issuer === undefined
+        ? {}
+        : { issuer: String(row.issuer) }),
+    ...(decodeOAuthProviderModeTokenAudience(row.audience) === undefined
+        ? {}
+        : { audience: decodeOAuthProviderModeTokenAudience(row.audience) }),
+    ...((row.jwtId ?? row.jwt_id) === null ||
+        (row.jwtId ?? row.jwt_id) === undefined
+        ? {}
+        : { jwtId: String(row.jwtId ?? row.jwt_id) }),
+    ...(optionalMillis(row.revokedAt ?? row.revoked_at) === undefined
+        ? {}
+        : { revokedAt: optionalMillis(row.revokedAt ?? row.revoked_at) }),
+    ...((row.revocationReason ?? row.revocation_reason) === null ||
+        (row.revocationReason ?? row.revocation_reason) === undefined
+        ? {}
+        : {
+            revocationReason: String(row.revocationReason ?? row.revocation_reason),
+        }),
+    ...(optionalMillis(row.rotatedAt ?? row.rotated_at) === undefined
+        ? {}
+        : { rotatedAt: optionalMillis(row.rotatedAt ?? row.rotated_at) }),
+    ...((row.replacedByTokenHash ?? row.replaced_by_token_hash) === null ||
+        (row.replacedByTokenHash ?? row.replaced_by_token_hash) === undefined
+        ? {}
+        : {
+            replacedByTokenHash: String(row.replacedByTokenHash ?? row.replaced_by_token_hash),
+        }),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+});
+const decodeOAuthProviderTokenVault = (row) => ({
+    accountId: OAuthAccountId(String(row.accountId ?? row.account_id)),
+    userId: UserId(String(row.userId ?? row.user_id)),
+    providerId: OAuthProviderId(String(row.providerId ?? row.provider_id)),
+    providerAccountId: String(row.providerAccountId ?? row.provider_account_id),
+    accessTokenCiphertext: Redacted.make(String(row.accessTokenCiphertext ?? row.access_token_ciphertext)),
+    ...((row.refreshTokenCiphertext ?? row.refresh_token_ciphertext) === null ||
+        (row.refreshTokenCiphertext ?? row.refresh_token_ciphertext) === undefined
+        ? {}
+        : {
+            refreshTokenCiphertext: Redacted.make(String(row.refreshTokenCiphertext ?? row.refresh_token_ciphertext)),
+        }),
+    ...((row.idTokenCiphertext ?? row.id_token_ciphertext) === null ||
+        (row.idTokenCiphertext ?? row.id_token_ciphertext) === undefined
+        ? {}
+        : {
+            idTokenCiphertext: Redacted.make(String(row.idTokenCiphertext ?? row.id_token_ciphertext)),
+        }),
+    tokenType: String(row.tokenType ?? row.token_type),
+    ...(row.scopes === null || row.scopes === undefined
+        ? {}
+        : { scopes: stringArray(row.scopes) }),
+    ...(optionalMillis(row.expiresAt ?? row.expires_at) === undefined
+        ? {}
+        : { expiresAt: optionalMillis(row.expiresAt ?? row.expires_at) }),
+    updatedAt: postgresBigintToUnixMillis(row.updatedAt ?? row.updated_at),
+    ...(optionalMillis(row.revokedAt ?? row.revoked_at) === undefined
+        ? {}
+        : { revokedAt: optionalMillis(row.revokedAt ?? row.revoked_at) }),
+    ...((row.revocationReason ?? row.revocation_reason) === null ||
+        (row.revocationReason ?? row.revocation_reason) === undefined
+        ? {}
+        : {
+            revocationReason: String(row.revocationReason ?? row.revocation_reason),
+        }),
+});
+const providerTokenVaultTokens = (record) => ({
+    accessTokenCiphertext: record.accessTokenCiphertext,
+    ...(record.refreshTokenCiphertext === undefined
+        ? {}
+        : { refreshTokenCiphertext: record.refreshTokenCiphertext }),
+    ...(record.idTokenCiphertext === undefined
+        ? {}
+        : { idTokenCiphertext: record.idTokenCiphertext }),
+    tokenType: record.tokenType,
+    ...(record.scopes === undefined ? {} : { scopes: record.scopes }),
+    ...(record.expiresAt === undefined ? {} : { expiresAt: record.expiresAt }),
+});
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isLoginRiskLevel = (value) => value === "unknown" ||
+    value === "low" ||
+    value === "medium" ||
+    value === "high" ||
+    value === "critical";
+const decodeLoginRiskSignal = (value) => {
+    const record = isRecord(value) ? value : {};
+    return LoginRiskSignal.make({
+        type: typeof record.type === "string" ? record.type : "unknown",
+        ...(isLoginRiskLevel(record.level) ? { level: record.level } : {}),
+        ...(isRecord(record.metadata) ? { metadata: record.metadata } : {}),
+    });
+};
+const decodeLoginRiskContext = (value) => {
+    if (!isRecord(value)) {
+        return undefined;
+    }
+    return LoginRiskContext.make({
+        level: isLoginRiskLevel(value.level) ? value.level : "unknown",
+        signals: Array.isArray(value.signals)
+            ? value.signals.map(decodeLoginRiskSignal)
+            : [],
+        ...(isRecord(value.metadata) ? { metadata: value.metadata } : {}),
+    });
+};
+const encodeLoginRiskContext = (risk) => risk === undefined
+    ? null
+    : {
+        level: risk.level,
+        signals: risk.signals.map((signal) => ({
+            type: signal.type,
+            ...(signal.level === undefined ? {} : { level: signal.level }),
+            ...(signal.metadata === undefined
+                ? {}
+                : { metadata: signal.metadata }),
+        })),
+        ...(risk.metadata === undefined ? {} : { metadata: risk.metadata }),
+    };
+const decodeAuditLogEvent = (row) => decodeAuditEvent(row.event);
+const decodeLoginApprovalReview = (row) => ({
+    approvalChallengeId: ChallengeId(String(row.approvalChallengeId ?? row.approval_challenge_id)),
+    flowId: AuthFlowId(String(row.flowId ?? row.flow_id)),
+    userId: UserId(String(row.userId ?? row.user_id)),
+    channel: String(row.channel),
+    reason: String(row.reason),
+    sessionBinding: String(row.sessionBinding ?? row.session_binding),
+    sameDeviceRequired: Boolean(row.sameDeviceRequired ?? row.same_device_required),
+    status: String(row.status),
+    createdAt: postgresBigintToUnixMillis(row.createdAt ?? row.created_at),
+    expiresAt: postgresBigintToUnixMillis(row.expiresAt ?? row.expires_at),
+    ...(optionalMillis(row.reviewedAt ?? row.reviewed_at) === undefined
+        ? {}
+        : { reviewedAt: optionalMillis(row.reviewedAt ?? row.reviewed_at) }),
+    ...((row.reviewedBy ?? row.reviewed_by) === null ||
+        (row.reviewedBy ?? row.reviewed_by) === undefined
+        ? {}
+        : {
+            reviewedBy: String(row.reviewedBy ?? row.reviewed_by),
+        }),
+    ...((row.deniedReason ?? row.denied_reason) === null ||
+        (row.deniedReason ?? row.denied_reason) === undefined
+        ? {}
+        : { deniedReason: String(row.deniedReason ?? row.denied_reason) }),
+    ...(decodeLoginRiskContext(row.risk) === undefined
+        ? {}
+        : { risk: decodeLoginRiskContext(row.risk) }),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+    ...(optionalRecord(row.reviewMetadata ?? row.review_metadata) === undefined
+        ? {}
+        : {
+            reviewMetadata: optionalRecord(row.reviewMetadata ?? row.review_metadata),
+        }),
+});
+const decodeLoginRiskHistoryRecord = (row) => {
+    const latitudeMicro = row.latitudeMicro ?? row.latitude_micro;
+    const longitudeMicro = row.longitudeMicro ?? row.longitude_micro;
+    return {
+        id: String(row.id),
+        userId: UserId(String(row.userId ?? row.user_id)),
+        occurredAt: postgresBigintToUnixMillis(row.occurredAt ?? row.occurred_at),
+        outcome: String(row.outcome),
+        method: String(row.method),
+        amr: Array.isArray(row.amr)
+            ? row.amr.map(String)
+            : [],
+        aal: String(row.aal),
+        device: {
+            status: String(row.deviceStatus ?? row.device_status),
+        },
+        ...((row.deviceKey ?? row.device_key) === null ||
+            (row.deviceKey ?? row.device_key) === undefined
+            ? {}
+            : { deviceKey: String(row.deviceKey ?? row.device_key) }),
+        ...((row.locationKey ?? row.location_key) === null ||
+            (row.locationKey ?? row.location_key) === undefined
+            ? {}
+            : { locationKey: String(row.locationKey ?? row.location_key) }),
+        ...(row.country === null || row.country === undefined
+            ? {}
+            : { country: String(row.country) }),
+        ...(row.region === null || row.region === undefined
+            ? {}
+            : { region: String(row.region) }),
+        ...(latitudeMicro === null || latitudeMicro === undefined
+            ? {}
+            : {
+                latitude: postgresBigintToSafeInteger(latitudeMicro, "latitude") / 1_000_000,
+            }),
+        ...(longitudeMicro === null || longitudeMicro === undefined
+            ? {}
+            : {
+                longitude: postgresBigintToSafeInteger(longitudeMicro, "longitude") /
+                    1_000_000,
+            }),
+        ...((row.riskLevel ?? row.risk_level) === null ||
+            (row.riskLevel ?? row.risk_level) === undefined
+            ? {}
+            : {
+                riskLevel: String(row.riskLevel ?? row.risk_level),
+            }),
+        createdAt: postgresBigintToUnixMillis(row.createdAt ?? row.created_at),
+    };
+};
+const decodeTrustedDevice = (row) => ({
+    userId: UserId(String(row.userId ?? row.user_id)),
+    tokenHash: String(row.tokenHash ?? row.token_hash),
+    createdAt: postgresBigintToUnixMillis(row.createdAt ?? row.created_at),
+    lastSeenAt: postgresBigintToUnixMillis(row.lastSeenAt ?? row.last_seen_at),
+    expiresAt: postgresBigintToUnixMillis(row.expiresAt ?? row.expires_at),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+});
+const decodeDomainVerification = (row) => ({
+    id: DomainVerificationId(String(row.id)),
+    ownerId: String(row.ownerId ?? row.owner_id),
+    domain: DomainName(String(row.domain)),
+    proofMethod: String(row.proofMethod ?? row.proof_method),
+    proofToken: DomainVerificationProofToken(String(row.proofToken ?? row.proof_token)),
+    status: String(row.status),
+    createdAt: postgresBigintToUnixMillis(row.createdAt ?? row.created_at),
+    expiresAt: postgresBigintToUnixMillis(row.expiresAt ?? row.expires_at),
+    ...(optionalMillis(row.verifiedAt ?? row.verified_at) === undefined
+        ? {}
+        : { verifiedAt: optionalMillis(row.verifiedAt ?? row.verified_at) }),
+    ...(optionalMillis(row.revokedAt ?? row.revoked_at) === undefined
+        ? {}
+        : { revokedAt: optionalMillis(row.revokedAt ?? row.revoked_at) }),
+    ...(optionalMillis(row.lastCheckedAt ?? row.last_checked_at) === undefined
+        ? {}
+        : {
+            lastCheckedAt: optionalMillis(row.lastCheckedAt ?? row.last_checked_at),
+        }),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+});
+const decodeSecurityTimelineEvent = (row) => ({
+    id: SecurityTimelineEventId(String(row.id)),
+    userId: UserId(String(row.userId ?? row.user_id)),
+    type: String(row.type),
+    category: String(row.category),
+    severity: String(row.severity),
+    occurredAt: postgresBigintToUnixMillis(row.occurredAt ?? row.occurred_at),
+    summary: String(row.summary),
+    ...(row.actor === null || row.actor === undefined
+        ? {}
+        : { actor: row.actor }),
+    ...(row.request === null || row.request === undefined
+        ? {}
+        : { request: row.request }),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+});
+const decodeWebhookOutboxRecord = (row) => ({
+    id: WebhookOutboxItemId(String(row.id)),
+    endpointKey: String(row.endpointKey ?? row.endpoint_key),
+    event: row.event,
+    status: String(row.status),
+    attempts: Number(row.attempts),
+    nextAttemptAt: postgresBigintToUnixMillis(row.nextAttemptAt ?? row.next_attempt_at),
+    createdAt: postgresBigintToUnixMillis(row.createdAt ?? row.created_at),
+    updatedAt: postgresBigintToUnixMillis(row.updatedAt ?? row.updated_at),
+    ...(optionalMillis(row.deliveredAt ?? row.delivered_at) === undefined
+        ? {}
+        : { deliveredAt: optionalMillis(row.deliveredAt ?? row.delivered_at) }),
+    ...((row.lastError ?? row.last_error) === null ||
+        (row.lastError ?? row.last_error) === undefined
+        ? {}
+        : { lastError: String(row.lastError ?? row.last_error) }),
+});
+const decodePermissionDefinition = (row) => ({
+    id: PermissionId(String(row.id)),
+    ...(row.description === null || row.description === undefined
+        ? {}
+        : { description: String(row.description) }),
+    ...((row.scopeTypePresent ?? row.scope_type_present)
+        ? { scopeType: String(row.scopeType ?? row.scope_type) }
+        : {}),
+    createdAt: postgresBigintToUnixMillis(row.createdAt ?? row.created_at),
+    updatedAt: postgresBigintToUnixMillis(row.updatedAt ?? row.updated_at),
+    ...(optionalMillis(row.disabledAt ?? row.disabled_at) === undefined
+        ? {}
+        : { disabledAt: optionalMillis(row.disabledAt ?? row.disabled_at) }),
+    ...(optionalMillis(row.deletedAt ?? row.deleted_at) === undefined
+        ? {}
+        : { deletedAt: optionalMillis(row.deletedAt ?? row.deleted_at) }),
+});
+const decodeRoleDefinition = (row) => ({
+    id: RoleId(String(row.id)),
+    ...(row.description === null || row.description === undefined
+        ? {}
+        : { description: String(row.description) }),
+    createdAt: postgresBigintToUnixMillis(row.createdAt ?? row.created_at),
+    updatedAt: postgresBigintToUnixMillis(row.updatedAt ?? row.updated_at),
+    ...(optionalMillis(row.disabledAt ?? row.disabled_at) === undefined
+        ? {}
+        : { disabledAt: optionalMillis(row.disabledAt ?? row.disabled_at) }),
+    ...(optionalMillis(row.deletedAt ?? row.deleted_at) === undefined
+        ? {}
+        : { deletedAt: optionalMillis(row.deletedAt ?? row.deleted_at) }),
+});
+const decodePermissionScope = (scopeType, scopeIdPresent, storedScopeId) => {
+    const type = String(scopeType);
+    if (!scopeIdPresent) {
+        return type === "global" ? undefined : { type };
+    }
+    return { type, id: String(storedScopeId) };
+};
+const decodePermissionGrant = (row) => ({
+    subject: {
+        type: String(row.subjectType ?? row.subject_type),
+        id: String(row.subjectId ?? row.subject_id),
+    },
+    permission: PermissionId(String(row.permissionId ?? row.permission_id)),
+    ...(decodePermissionScope(row.scopeType ?? row.scope_type, row.scopeIdPresent ?? row.scope_id_present, row.scopeId ?? row.scope_id) === undefined
+        ? {}
+        : {
+            scope: decodePermissionScope(row.scopeType ?? row.scope_type, row.scopeIdPresent ?? row.scope_id_present, row.scopeId ?? row.scope_id),
+        }),
+    ...(optionalMillis(row.expiresAt ?? row.expires_at) === undefined
+        ? {}
+        : { expiresAt: optionalMillis(row.expiresAt ?? row.expires_at) }),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+    ...(optionalMillis(row.revokedAt ?? row.revoked_at) === undefined
+        ? {}
+        : { revokedAt: optionalMillis(row.revokedAt ?? row.revoked_at) }),
+});
+const decodeRoleGrant = (row) => ({
+    subject: {
+        type: String(row.subjectType ?? row.subject_type),
+        id: String(row.subjectId ?? row.subject_id),
+    },
+    role: RoleId(String(row.roleId ?? row.role_id)),
+    ...(decodePermissionScope(row.scopeType ?? row.scope_type, row.scopeIdPresent ?? row.scope_id_present, row.scopeId ?? row.scope_id) === undefined
+        ? {}
+        : {
+            scope: decodePermissionScope(row.scopeType ?? row.scope_type, row.scopeIdPresent ?? row.scope_id_present, row.scopeId ?? row.scope_id),
+        }),
+    ...(optionalMillis(row.expiresAt ?? row.expires_at) === undefined
+        ? {}
+        : { expiresAt: optionalMillis(row.expiresAt ?? row.expires_at) }),
+    ...(optionalRecord(row.metadata) === undefined
+        ? {}
+        : { metadata: optionalRecord(row.metadata) }),
+    ...(optionalMillis(row.revokedAt ?? row.revoked_at) === undefined
+        ? {}
+        : { revokedAt: optionalMillis(row.revokedAt ?? row.revoked_at) }),
+});
+const decodeRolePermission = (row) => ({
+    role: RoleId(String(row.roleId ?? row.role_id)),
+    permission: PermissionId(String(row.permissionId ?? row.permission_id)),
+    ...((row.scopeTypePresent ?? row.scope_type_present)
+        ? { scopeType: String(row.scopeType ?? row.scope_type) }
+        : {}),
+});
+const userValues = (row) => ({
+    id: row.id,
+    created_at: millisParam(row.createdAt),
+    updated_at: millisParam(row.updatedAt),
+    disabled_at: row.disabledAt === undefined ? null : millisParam(row.disabledAt),
+    metadata: row.metadata ?? null,
+});
+const identityValues = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    scope_type: row.scope.type,
+    scope_id: scopeId(row.scope),
+    kind: row.kind,
+    value: row.value,
+    normalized_value: row.normalizedValue,
+    verified_at: row.verifiedAt === undefined ? null : millisParam(row.verifiedAt),
+    is_primary_login: row.isPrimaryLogin ?? false,
+    created_at: millisParam(row.createdAt),
+    updated_at: millisParam(row.createdAt),
+    revoked_at: null,
+    replaced_by_id: null,
+    metadata: row.metadata ?? null,
+});
+const credentialValues = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    type: "password",
+    password_hash: row.passwordHash,
+    created_at: millisParam(row.createdAt),
+    updated_at: millisParam(row.updatedAt),
+    revoked_at: row.revokedAt === undefined ? null : millisParam(row.revokedAt),
+    metadata: row.metadata ?? null,
+});
+const passkeyCredentialValues = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    credential_id: row.credentialId,
+    public_key: row.publicKey,
+    sign_count: safeIntegerToPostgresBigint(row.signCount, "Passkey sign count"),
+    transports: row.transports ?? null,
+    backed_up: row.backedUp ?? null,
+    created_at: millisParam(row.createdAt),
+    last_used_at: row.lastUsedAt === undefined ? null : millisParam(row.lastUsedAt),
+    revoked_at: row.revokedAt === undefined ? null : millisParam(row.revokedAt),
+    metadata: row.metadata ?? null,
+});
+const sessionValues = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    secret_hash: row.secretHash,
+    created_at: millisParam(row.createdAt),
+    expires_at: millisParam(row.expiresAt),
+    auth_time: millisParam(row.authTime),
+    authentication_events: row.authenticationEvents,
+    aal: row.aal,
+    amr: row.amr,
+    claims: row.claims ?? null,
+    mfa_verified_at: row.mfaVerifiedAt === undefined ? null : millisParam(row.mfaVerifiedAt),
+    metadata: row.metadata ?? null,
+    revoked_at: null,
+    last_seen_at: null,
+    rotated_at: null,
+});
+const verificationValues = (row) => ({
+    id: row.id,
+    type: row.type,
+    subject: row.subject,
+    secret_hash: row.secretHash ?? null,
+    created_at: millisParam(row.createdAt),
+    expires_at: millisParam(row.expiresAt),
+    metadata: row.metadata ?? null,
+    consumed_at: null,
+});
+const totpFactorValues = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    secret: Redacted.value(row.secret),
+    algorithm: row.algorithm,
+    digits: row.digits,
+    period: row.period,
+    created_at: millisParam(row.createdAt),
+    confirmed_at: row.confirmedAt === undefined ? null : millisParam(row.confirmedAt),
+    last_used_at: row.lastUsedAt === undefined ? null : millisParam(row.lastUsedAt),
+    last_accepted_counter: row.lastAcceptedCounter === undefined
+        ? null
+        : String(row.lastAcceptedCounter),
+    revoked_at: row.revokedAt === undefined ? null : millisParam(row.revokedAt),
+    metadata: row.metadata ?? null,
+});
+const recoveryCodeValues = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    code_hash: row.codeHash,
+    created_at: millisParam(row.createdAt),
+    used_at: row.usedAt === undefined ? null : millisParam(row.usedAt),
+    revoked_at: row.revokedAt === undefined ? null : millisParam(row.revokedAt),
+    metadata: row.metadata ?? null,
+});
+const apiKeyValues = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    prefix: row.prefix,
+    secret_hash: row.secretHash,
+    scopes: row.scopes,
+    created_at: millisParam(row.createdAt),
+    expires_at: row.expiresAt === undefined ? null : millisParam(row.expiresAt),
+    last_used_at: row.lastUsedAt === undefined ? null : millisParam(row.lastUsedAt),
+    revoked_at: row.revokedAt === undefined ? null : millisParam(row.revokedAt),
+    metadata: row.metadata ?? null,
+});
+const refreshTokenValues = (row) => ({
+    id: row.id,
+    family_id: row.familyId,
+    user_id: row.userId,
+    secret_hash: row.secretHash,
+    created_at: millisParam(row.createdAt),
+    expires_at: millisParam(row.expiresAt),
+    last_used_at: row.lastUsedAt === undefined ? null : millisParam(row.lastUsedAt),
+    rotated_at: row.rotatedAt === undefined ? null : millisParam(row.rotatedAt),
+    replaced_by_id: row.replacedById ?? null,
+    revoked_at: row.revokedAt === undefined ? null : millisParam(row.revokedAt),
+    reuse_detected_at: row.reuseDetectedAt === undefined ? null : millisParam(row.reuseDetectedAt),
+    metadata: row.metadata ?? null,
+});
+const jwtRevocationValues = (row) => ({
+    jwt_id: row.jwtId,
+    revoked_at: millisParam(row.revokedAt),
+    expires_at: row.expiresAt === undefined ? null : millisParam(row.expiresAt),
+    reason: row.reason ?? null,
+});
+const oauthAccountValues = (row) => ({
+    id: row.id,
+    provider_id: row.providerId,
+    provider_account_id: row.providerAccountId,
+    user_id: row.userId,
+    email: row.email ?? null,
+    email_verified: row.emailVerified ?? null,
+    created_at: millisParam(row.createdAt),
+    updated_at: millisParam(row.updatedAt),
+    unlinked_at: row.unlinkedAt === undefined ? null : millisParam(row.unlinkedAt),
+    metadata: row.metadata ?? null,
+});
+const oauthClientValues = (row) => ({
+    id: row.id,
+    type: row.type,
+    status: row.status,
+    name: row.name ?? null,
+    redirect_uris: row.redirectUris,
+    allowed_grant_types: row.allowedGrantTypes,
+    allowed_response_types: row.allowedResponseTypes,
+    allowed_scopes: row.allowedScopes ?? null,
+    created_at: row.createdAt === undefined ? null : millisParam(row.createdAt),
+    updated_at: row.updatedAt === undefined ? null : millisParam(row.updatedAt),
+    metadata: row.metadata ?? null,
+});
+const oauthConsentValues = (row) => ({
+    user_id: row.userId,
+    client_id: row.clientId,
+    scopes: row.scopes,
+    granted_at: millisParam(row.grantedAt),
+    expires_at: row.expiresAt === undefined ? null : millisParam(row.expiresAt),
+    revoked_at: row.revokedAt === undefined ? null : millisParam(row.revokedAt),
+    metadata: row.metadata ?? null,
+});
+const oauthAuthorizationCodeValues = (row) => ({
+    code_hash: row.codeHash,
+    client_id: row.clientId,
+    subject: row.subject,
+    redirect_uri: row.redirectUri,
+    scopes: row.scopes,
+    code_challenge: row.codeChallenge ?? null,
+    code_challenge_method: row.codeChallengeMethod ?? null,
+    issued_at: millisParam(row.issuedAt),
+    expires_at: millisParam(row.expiresAt),
+    consumed_at: row.consumedAt === undefined ? null : millisParam(row.consumedAt),
+    metadata: row.metadata ?? null,
+});
+const oauthDeviceAuthorizationValues = (row) => ({
+    id: row.id,
+    device_code_hash: row.deviceCodeHash,
+    user_code_hash: row.userCodeHash,
+    client_id: row.clientId,
+    requested_scopes: row.requestedScopes,
+    granted_scopes: null,
+    subject: null,
+    status: "pending",
+    issued_at: millisParam(row.issuedAt),
+    expires_at: millisParam(row.expiresAt),
+    poll_interval_seconds: row.pollIntervalSeconds,
+    next_poll_at: millisParam(row.nextPollAt),
+    last_polled_at: row.lastPolledAt === undefined ? null : millisParam(row.lastPolledAt),
+    approved_at: null,
+    denied_at: null,
+    consumed_at: null,
+    metadata: row.metadata ?? null,
+});
+const oauthClientSecretValues = (row) => ({
+    prefix: row.prefix,
+    client_id: row.clientId,
+    secret_hash: row.secretHash,
+    authentication_methods: row.authenticationMethods,
+    created_at: millisParam(row.createdAt),
+    expires_at: row.expiresAt === undefined ? null : millisParam(row.expiresAt),
+    last_used_at: row.lastUsedAt === undefined ? null : millisParam(row.lastUsedAt),
+    revoked_at: row.revokedAt === undefined ? null : millisParam(row.revokedAt),
+    metadata: row.metadata ?? null,
+});
+const oauthProviderModeTokenValues = (row) => ({
+    token_hash: row.tokenHash,
+    token_type: row.tokenType,
+    client_id: row.clientId,
+    subject: row.subject,
+    scopes: row.scopes,
+    issued_at: millisParam(row.issuedAt),
+    expires_at: millisParam(row.expiresAt),
+    issuer: row.issuer ?? null,
+    audience: row.audience ?? null,
+    jwt_id: row.jwtId ?? null,
+    revoked_at: row.revokedAt === undefined ? null : millisParam(row.revokedAt),
+    revocation_reason: row.revocationReason ?? null,
+    rotated_at: row.rotatedAt === undefined ? null : millisParam(row.rotatedAt),
+    replaced_by_token_hash: row.replacedByTokenHash ?? null,
+    metadata: row.metadata ?? null,
+});
+const oauthProviderTokenVaultValues = (row) => ({
+    account_id: row.accountId,
+    user_id: row.userId,
+    provider_id: row.providerId,
+    provider_account_id: row.providerAccountId,
+    access_token_ciphertext: Redacted.value(row.accessTokenCiphertext),
+    refresh_token_ciphertext: row.refreshTokenCiphertext === undefined
+        ? null
+        : Redacted.value(row.refreshTokenCiphertext),
+    id_token_ciphertext: row.idTokenCiphertext === undefined
+        ? null
+        : Redacted.value(row.idTokenCiphertext),
+    token_type: row.tokenType,
+    scopes: row.scopes ?? null,
+    expires_at: row.expiresAt === undefined ? null : millisParam(row.expiresAt),
+    updated_at: millisParam(row.updatedAt),
+    revoked_at: row.revokedAt === undefined ? null : millisParam(row.revokedAt),
+    revocation_reason: row.revocationReason ?? null,
+});
+const auditLogValues = (event, createdAt) => ({
+    id: event.id ?? null,
+    type: event.type,
+    user_id: auditEventUserId(event) ?? null,
+    actor_user_id: auditEventActorUserId(event) ?? null,
+    occurred_at: millisParam(event.occurredAt),
+    request_ip_hash: event.request?.ipHash ?? null,
+    request_user_agent_hash: event.request?.userAgentHash ?? null,
+    event,
+    created_at: millisParam(createdAt),
+});
+const loginApprovalReviewValues = (row) => ({
+    approval_challenge_id: row.approvalChallengeId,
+    flow_id: row.flowId,
+    user_id: row.userId,
+    channel: row.channel,
+    reason: row.reason,
+    session_binding: row.sessionBinding,
+    same_device_required: row.sameDeviceRequired,
+    status: row.status,
+    created_at: millisParam(row.createdAt),
+    expires_at: millisParam(row.expiresAt),
+    reviewed_at: row.reviewedAt === undefined ? null : millisParam(row.reviewedAt),
+    reviewed_by: row.reviewedBy ?? null,
+    denied_reason: row.deniedReason ?? null,
+    risk: encodeLoginRiskContext(row.risk),
+    metadata: row.metadata ?? null,
+    review_metadata: row.reviewMetadata ?? null,
+});
+const coordinateMicro = (value) => value === undefined || !Number.isFinite(value)
+    ? null
+    : safeIntegerToPostgresBigint(Math.round(value * 1_000_000), "Login risk coordinate");
+const loginRiskHistoryValues = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    occurred_at: millisParam(row.occurredAt),
+    outcome: row.outcome,
+    method: row.method,
+    amr: row.amr,
+    aal: row.aal,
+    device_status: row.device.status,
+    device_key: row.deviceKey ?? null,
+    location_key: row.locationKey ?? null,
+    country: row.country ?? null,
+    region: row.region ?? null,
+    latitude_micro: coordinateMicro(row.latitude),
+    longitude_micro: coordinateMicro(row.longitude),
+    risk_level: row.riskLevel ?? null,
+    created_at: millisParam(row.createdAt),
+});
+const trustedDeviceValues = (input) => ({
+    user_id: input.userId,
+    token_hash: input.tokenHash,
+    created_at: millisParam(input.now),
+    last_seen_at: millisParam(input.now),
+    expires_at: millisParam(input.expiresAt),
+    metadata: input.metadata ?? null,
+});
+const domainVerificationValues = (record) => ({
+    id: record.id,
+    owner_id: record.ownerId,
+    domain: record.domain,
+    proof_method: record.proofMethod,
+    proof_token: record.proofToken,
+    status: record.status,
+    created_at: millisParam(record.createdAt),
+    expires_at: millisParam(record.expiresAt),
+    verified_at: record.verifiedAt === undefined ? null : millisParam(record.verifiedAt),
+    revoked_at: record.revokedAt === undefined ? null : millisParam(record.revokedAt),
+    last_checked_at: record.lastCheckedAt === undefined
+        ? null
+        : millisParam(record.lastCheckedAt),
+    metadata: record.metadata ?? null,
+});
+const securityTimelineValues = (event) => ({
+    id: event.id,
+    user_id: event.userId,
+    type: event.type,
+    category: event.category,
+    severity: event.severity,
+    occurred_at: millisParam(event.occurredAt),
+    summary: event.summary,
+    actor: event.actor ?? null,
+    request: event.request ?? null,
+    metadata: event.metadata ?? null,
+});
+const webhookOutboxValues = (record) => ({
+    id: record.id,
+    endpoint_key: record.endpointKey,
+    event: record.event,
+    status: record.status,
+    attempts: record.attempts,
+    next_attempt_at: millisParam(record.nextAttemptAt),
+    created_at: millisParam(record.createdAt),
+    updated_at: millisParam(record.updatedAt),
+    delivered_at: record.deliveredAt === undefined ? null : millisParam(record.deliveredAt),
+    last_error: record.lastError ?? null,
+});
+const permissionScopeValues = (scope) => ({
+    scope_type: scope?.type ?? "global",
+    scope_id_present: scope?.id !== undefined,
+    scope_id: scope?.id ?? "",
+});
+const permissionDefinitionValues = (definition) => ({
+    id: definition.id,
+    description: definition.description ?? null,
+    scope_type_present: definition.scopeType !== undefined,
+    scope_type: definition.scopeType ?? "",
+    created_at: millisParam(definition.createdAt),
+    updated_at: millisParam(definition.updatedAt),
+    disabled_at: definition.disabledAt === undefined
+        ? null
+        : millisParam(definition.disabledAt),
+    deleted_at: definition.deletedAt === undefined
+        ? null
+        : millisParam(definition.deletedAt),
+});
+const roleDefinitionValues = (definition) => ({
+    id: definition.id,
+    description: definition.description ?? null,
+    created_at: millisParam(definition.createdAt),
+    updated_at: millisParam(definition.updatedAt),
+    disabled_at: definition.disabledAt === undefined
+        ? null
+        : millisParam(definition.disabledAt),
+    deleted_at: definition.deletedAt === undefined
+        ? null
+        : millisParam(definition.deletedAt),
+});
+const permissionGrantValues = (input) => ({
+    subject_type: input.subject.type,
+    subject_id: input.subject.id,
+    permission_id: input.permission,
+    ...permissionScopeValues(input.scope),
+    expires_at: input.expiresAt === undefined ? null : millisParam(input.expiresAt),
+    metadata: input.metadata ?? null,
+    revoked_at: null,
+});
+const roleGrantValues = (input) => ({
+    subject_type: input.subject.type,
+    subject_id: input.subject.id,
+    role_id: input.role,
+    ...permissionScopeValues(input.scope),
+    expires_at: input.expiresAt === undefined ? null : millisParam(input.expiresAt),
+    metadata: input.metadata ?? null,
+    revoked_at: null,
+});
+const rolePermissionValues = (input) => ({
+    role_id: input.role,
+    permission_id: input.permission,
+    scope_type_present: input.scopeType !== undefined,
+    scope_type: input.scopeType ?? "",
+});
+const execute = (executor, plan) => executor.execute(plan);
+const executeMapped = (executor, makePlan, mapError) => Effect.try({ try: makePlan, catch: mapError }).pipe(Effect.flatMap((plan) => Effect.try({
+    try: () => execute(executor, plan),
+    catch: mapError,
+}).pipe(Effect.flatMap((effect) => effect.pipe(Effect.mapError(mapError))))));
+const decodeMapped = (decode, mapError) => Effect.try({ try: decode, catch: mapError });
+const eq = (left, right) => Query.eq(left, right);
+const gt = (left, right) => Query.gt(left, right);
+const gte = (left, right) => Query.gte(left, right);
+const lt = (left, right) => Query.lt(left, right);
+const lte = (left, right) => Query.lte(left, right);
+const isNull = (value) => Query.isNull(value);
+const isNotNull = (value) => Query.isNotNull(value);
+const withoutNullRefinement = (value) => Query.cast(value, value[Scalar.TypeId].dbType);
+const or = (...values) => Query.or(...values);
+const and = (...values) => Query.and(...values);
+const exists = (plan) => Query.exists(plan);
+const inValues = (value, values) => Query.in(value, ...values);
+const insert = (table, values) => Query.insert(table, values);
+const update = (table, values) => Query.update(table, values);
+const selectForUpdate = (selection, table, predicate) => Query.lock("update")(Query.where(predicate)(Query.from(table)(Query.select(selection))));
+const metadataWithReason = (column, key, reason) => Jsonb.concat(Query.coalesce(column, Jsonb.toJsonb({})), Jsonb.toJsonb({ [key]: reason }));
+const storageError = (entity, operation, cause) => StorageError.fromUnknown(entity, operation, cause);
+const firstOption = (rows, decode) => rows[0] === undefined ? Option.none() : Option.some(decode(rows[0]));
+export const makeEffectQbPostgresExecutor = (sql) => Executor.make({
+    renderer: postgresRenderer,
+    valueMappings: postgresValueMappings,
+    driver: Executor.driver((query) => sql.unsafe(query.sql, [...query.params])),
+});
+export const makeEffectQbPostgresAtomicPlanExecutor = (sql) => {
+    const executePlans = (plans) => {
+        if (plans.length === 0) {
+            return Effect.succeed([]);
+        }
+        const rendered = Effect.try({
+            try: () => plans.map((plan, statement) => {
+                try {
+                    return { plan, rendered: postgresRenderer.render(plan) };
+                }
+                catch (error) {
+                    throw new AtomicPlanError({
+                        statement,
+                        phase: "render",
+                        commitState: "not-committed",
+                        cause: error,
+                    });
+                }
+            }),
+            catch: (cause) => cause instanceof AtomicPlanError
+                ? cause
+                : new AtomicPlanError({
+                    phase: "render",
+                    commitState: "not-committed",
+                    cause,
+                }),
+        });
+        return rendered.pipe(Effect.flatMap((entries) => sql.withTransaction(Effect.forEach(entries, ({ plan, rendered: query }, statement) => sql.unsafe(query.sql, [...query.params]).pipe(Effect.mapError((cause) => new AtomicPlanError({
+            statement,
+            phase: "execute",
+            commitState: "not-committed",
+            cause,
+        })), Effect.flatMap((rows) => Effect.try({
+            try: () => CoreExecutor.decodeRows(query, plan, rows, {
+                driverMode: "raw",
+            }),
+            catch: (cause) => new AtomicPlanError({
+                statement,
+                phase: "decode",
+                commitState: "not-committed",
+                cause,
+            }),
+        })))))), Effect.catchCause((cause) => {
+            if (Cause.hasInterruptsOnly(cause)) {
+                return Effect.failCause(cause);
+            }
+            const failure = Cause.findErrorOption(cause);
+            return Option.isSome(failure) &&
+                failure.value instanceof AtomicPlanError
+                ? Effect.fail(failure.value)
+                : Effect.fail(new AtomicPlanError({
+                    phase: "transaction",
+                    commitState: "unknown",
+                    cause,
+                }));
+        }), Effect.map((results) => results));
+    };
+    return { dialect: "postgres", execute: executePlans };
+};
+export const postgresErrorDetails = (cause) => {
+    let current = cause;
+    const seen = new Set();
+    let code;
+    let constraintName;
+    while (typeof current === "object" &&
+        current !== null &&
+        !seen.has(current)) {
+        seen.add(current);
+        const record = current;
+        const candidateCode = record.code;
+        if (code === undefined && typeof candidateCode === "string") {
+            const normalized = candidateCode.trim().toUpperCase();
+            if (/^[0-9A-Z]{5}$/.test(normalized)) {
+                code = normalized;
+            }
+        }
+        const candidateConstraint = record.constraintName ?? record.constraint;
+        if (constraintName === undefined &&
+            typeof candidateConstraint === "string" &&
+            candidateConstraint.trim() !== "") {
+            constraintName = candidateConstraint.trim();
+        }
+        current = record.cause ?? record.reason ?? record.raw;
+    }
+    return { code, constraintName };
+};
+const identityConflict = (row) => new IdentityConflictError({
+    scope: row.scope,
+    kind: row.kind,
+    normalizedValue: row.normalizedValue,
+});
+const isExpectedIdentityConflict = (cause) => {
+    const details = postgresErrorDetails(cause);
+    return (details.code === "23505" &&
+        (details.constraintName === "auth_user_identity_pkey" ||
+            details.constraintName === "auth_user_identity_active_value_idx" ||
+            details.constraintName === "auth_user_identity_active_primary_idx"));
+};
+const totpFactorStoreError = (operation, cause) => new TotpFactorStoreError({
+    operation,
+    message: `TOTP factor ${operation} failed`,
+    cause,
+});
+const passkeyCredentialStoreError = (operation, cause) => new PasskeyCredentialStoreError({
+    operation,
+    message: `Passkey credential ${operation} failed`,
+    cause,
+});
+const recoveryCodeStoreError = (operation, cause) => new RecoveryCodeStoreError({
+    operation,
+    message: `Recovery code ${operation} failed`,
+    cause,
+});
+const apiKeyStoreError = (operation, cause) => new ApiKeyStoreError({
+    operation,
+    message: `API key ${operation} failed`,
+    cause,
+});
+const refreshTokenStoreError = (operation, cause) => new RefreshTokenStoreError({
+    operation,
+    message: `Refresh token ${operation} failed`,
+    cause,
+});
+const oauthAccountStoreError = (operation, cause) => new OAuthAccountStoreError({
+    operation,
+    message: `OAuth account ${operation} failed`,
+    cause,
+});
+const oauthClientStoreError = (operation, cause) => new OAuthClientStoreError({
+    operation,
+    message: `OAuth client ${operation} failed`,
+    cause,
+});
+const oauthConsentStoreError = (operation, cause) => new OAuthConsentStoreError({
+    operation,
+    message: `OAuth consent ${operation} failed`,
+    cause,
+});
+const oauthAuthorizationCodeStoreError = (operation, cause) => new OAuthAuthorizationCodeStoreError({
+    operation,
+    message: `OAuth authorization code ${operation} failed`,
+    cause,
+});
+const oauthDeviceAuthorizationStoreError = (operation, cause) => new OAuthDeviceAuthorizationStoreError({
+    operation,
+    message: `OAuth device authorization ${operation} failed`,
+    cause,
+});
+const oauthDeviceCodeTokenCommitStoreError = (cause) => new OAuthDeviceCodeTokenCommitStoreError({
+    operation: "commit",
+    message: "OAuth device token commit failed",
+    cause,
+});
+const oauthClientSecretStoreError = (operation, cause) => new OAuthClientSecretStoreError({
+    operation,
+    message: `OAuth client secret ${operation} failed`,
+    cause,
+});
+const oauthProviderModeTokenStoreError = (operation, cause) => new OAuthProviderModeTokenStoreError({
+    operation,
+    message: `OAuth provider-mode token ${operation} failed`,
+    cause,
+});
+const oauthProviderTokenVaultError = (operation, cause) => new OAuthProviderTokenVaultError({
+    operation,
+    message: `OAuth provider token vault ${operation} failed`,
+    cause,
+});
+const jwtRevocationStoreError = (operation, cause) => new JwtError({
+    operation: "revocation",
+    message: `JWT revocation ${operation} failed`,
+    cause,
+});
+const auditLogStoreError = (operation, cause) => new AuditLogStoreError({
+    operation,
+    message: `Audit log ${operation} failed`,
+    cause,
+});
+const loginApprovalReviewStoreError = (operation, cause) => new LoginApprovalReviewError({
+    message: `Login approval review ${operation} failed`,
+    cause,
+});
+const loginRiskHistoryStoreError = (operation, cause) => new LoginRiskHistoryError({
+    operation,
+    message: `Login risk history ${operation} failed`,
+    cause,
+});
+const trustedDeviceStoreError = (operation, cause) => new TrustedDeviceError({
+    operation,
+    message: `Trusted device ${operation} failed`,
+    cause,
+});
+const domainVerificationStoreError = (operation, cause) => new DomainVerificationStoreError({
+    operation,
+    message: `Domain verification ${operation} failed`,
+    cause,
+});
+const securityTimelineStoreError = (operation, cause) => new SecurityTimelineStoreError({
+    operation,
+    message: `Security timeline ${operation} failed`,
+    cause,
+});
+const webhookOutboxStoreError = (operation, cause) => new WebhookOutboxStoreError({
+    operation,
+    message: `Webhook outbox ${operation} failed`,
+    cause,
+});
+const webhookReplayStoreError = (operation, cause) => new WebhookReplayStoreError({
+    operation,
+    message: `Webhook replay ${operation} failed`,
+    cause,
+});
+const permissionStoreError = (operation, cause) => new PermissionStoreError({
+    operation,
+    message: `Permission store ${operation} failed`,
+    cause,
+});
+const jsonEqual = (left, right) => {
+    if (Object.is(left, right)) {
+        return true;
+    }
+    if (Array.isArray(left) && Array.isArray(right)) {
+        return (left.length === right.length &&
+            left.every((entry, index) => jsonEqual(entry, right[index])));
+    }
+    if (typeof left === "object" &&
+        left !== null &&
+        typeof right === "object" &&
+        right !== null) {
+        const leftRecord = left;
+        const rightRecord = right;
+        const leftKeys = Object.keys(leftRecord);
+        return (leftKeys.length === Object.keys(rightRecord).length &&
+            leftKeys.every((key) => Object.hasOwn(rightRecord, key) &&
+                jsonEqual(leftRecord[key], rightRecord[key])));
+    }
+    return false;
+};
+const sameVerification = (actual, expected) => jsonEqual(decodeVerification(actual), expected);
+const updateAssuredSession = (executor, input) => execute(executor, update(authPostgresSession, {
+    secret_hash: input.secretHash,
+    rotated_at: millisParam(input.rotatedAt),
+    authentication_events: input.authenticationEvents,
+    auth_time: millisParam(input.authTime),
+    aal: input.aal,
+    amr: input.amr,
+    mfa_verified_at: input.mfaVerifiedAt === undefined
+        ? null
+        : millisParam(input.mfaVerifiedAt),
+    ...(input.claims === undefined ? {} : { claims: input.claims }),
+}).pipe(Query.where(eq(authPostgresSession.id, input.sessionId)), Query.where(eq(authPostgresSession.user_id, input.userId)), Query.returning(sessionSelection)));
+const insertSession = (executor, row) => Effect.try({
+    try: () => insert(authPostgresSession, sessionValues(row)).pipe(Query.returning(sessionSelection)),
+    catch: (cause) => new PostgresPlanBuildError({ cause }),
+}).pipe(Effect.flatMap((plan) => execute(executor, plan)));
+export const makeEffectQbPostgresUserStore = (executor) => UserStore.of({
+    findById: (id) => execute(executor, Query.select(userSelection).pipe(Query.from(authPostgresUser), Query.where(eq(authPostgresUser.id, id)))).pipe(Effect.mapError((cause) => storageError("user", "find", cause)), Effect.map((rows) => firstOption(rows, decodeUser))),
+    insert: (row) => execute(executor, insert(authPostgresUser, userValues(row))).pipe(Effect.mapError((cause) => storageError("user", "insert", cause)), Effect.asVoid),
+});
+export const makeEffectQbPostgresIdentityStore = (executor, sql) => {
+    const findById = (id) => execute(executor, Query.select(identitySelection).pipe(Query.from(authPostgresUserIdentity), Query.where(eq(authPostgresUserIdentity.id, id)))).pipe(Effect.mapError((cause) => storageError("identity", "find", cause)), Effect.map((rows) => firstOption(rows, decodeIdentity)));
+    const transactionError = (operation) => (cause) => storageError("identity", operation, cause);
+    return IdentityStore.of({
+        findById,
+        findByKindAndNormalizedValue: (input) => execute(executor, Query.select(identitySelection).pipe(Query.from(authPostgresUserIdentity), Query.where(eq(authPostgresUserIdentity.scope_type, input.scope.type)), Query.where(eq(authPostgresUserIdentity.scope_id, scopeId(input.scope))), Query.where(eq(authPostgresUserIdentity.kind, input.kind)), Query.where(eq(authPostgresUserIdentity.normalized_value, input.normalizedValue)), Query.where(isNull(authPostgresUserIdentity.revoked_at)))).pipe(Effect.mapError((cause) => storageError("identity", "find", cause)), Effect.map((rows) => firstOption(rows, decodeIdentity))),
+        listByUser: (input) => {
+            let plan = Query.select(identitySelection).pipe(Query.from(authPostgresUserIdentity), Query.where(eq(authPostgresUserIdentity.user_id, input.userId)));
+            if (input.includeRevoked !== true) {
+                plan = plan.pipe(Query.where(isNull(authPostgresUserIdentity.revoked_at)));
+            }
+            plan = plan.pipe(Query.orderBy(authPostgresUserIdentity.created_at, "asc"), Query.orderBy(Query.collate(authPostgresUserIdentity.id, "C"), "asc"));
+            return execute(executor, plan).pipe(Effect.mapError((cause) => storageError("identity", "find", cause)), Effect.map((rows) => rows.map(decodeIdentity)));
+        },
+        insert: (row) => execute(executor, insert(authPostgresUserIdentity, identityValues(row))).pipe(Effect.mapError((cause) => isExpectedIdentityConflict(cause)
+            ? identityConflict(row)
+            : storageError("identity", "insert", cause)), Effect.asVoid),
+        markVerified: (input) => execute(executor, update(authPostgresUserIdentity, {
+            verified_at: millisParam(input.verifiedAt),
+            updated_at: millisParam(input.verifiedAt),
+        }).pipe(Query.where(eq(authPostgresUserIdentity.id, input.id)), Query.where(eq(authPostgresUserIdentity.normalized_value, input.expectedNormalizedValue)), Query.where(isNull(authPostgresUserIdentity.revoked_at)), Query.returning(identitySelection))).pipe(Effect.mapError((cause) => storageError("identity", "update", cause)), Effect.map((rows) => firstOption(rows, decodeIdentity))),
+        setPrimaryLogin: (input) => sql
+            .withTransaction(Effect.gen(function* () {
+            const locked = yield* execute(executor, Query.select(identitySelection).pipe(Query.from(authPostgresUserIdentity), Query.where(eq(authPostgresUserIdentity.user_id, input.userId)), Query.where(isNull(authPostgresUserIdentity.revoked_at)), Query.orderBy(authPostgresUserIdentity.created_at, "asc"), Query.orderBy(Query.collate(authPostgresUserIdentity.id, "C"), "asc"), Query.lock("update")));
+            const selected = locked.find((row) => row.id === input.identityId);
+            if (selected === undefined ||
+                String(selected.updatedAt) !==
+                    millisParam(input.expectedUpdatedAt) ||
+                (selected.kind === "email" && selected.verifiedAt === null)) {
+                return Option.none();
+            }
+            yield* execute(executor, update(authPostgresUserIdentity, {
+                is_primary_login: false,
+                updated_at: millisParam(input.updatedAt),
+            }).pipe(Query.where(eq(authPostgresUserIdentity.user_id, input.userId)), Query.where(isNull(authPostgresUserIdentity.revoked_at))));
+            const rows = yield* execute(executor, update(authPostgresUserIdentity, {
+                is_primary_login: true,
+                updated_at: millisParam(input.updatedAt),
+            }).pipe(Query.where(eq(authPostgresUserIdentity.id, input.identityId)), Query.where(eq(authPostgresUserIdentity.user_id, input.userId)), Query.where(isNull(authPostgresUserIdentity.revoked_at)), Query.returning(identitySelection)));
+            return firstOption(rows, decodeIdentity);
+        }))
+            .pipe(Effect.mapError(transactionError("setPrimaryLogin"))),
+        replace: (input) => sql
+            .withTransaction(Effect.gen(function* () {
+            if (input.replacement.userId !== input.userId) {
+                return Option.none();
+            }
+            const locked = yield* execute(executor, Query.select(identitySelection).pipe(Query.from(authPostgresUserIdentity), Query.where(eq(authPostgresUserIdentity.user_id, input.userId)), Query.where(isNull(authPostgresUserIdentity.revoked_at)), Query.orderBy(authPostgresUserIdentity.created_at, "asc"), Query.orderBy(Query.collate(authPostgresUserIdentity.id, "C"), "asc"), Query.lock("update")));
+            const previous = locked.find((row) => row.id === input.id);
+            if (previous === undefined ||
+                String(previous.updatedAt) !==
+                    millisParam(input.expectedUpdatedAt)) {
+                return Option.none();
+            }
+            const active = locked.map(decodeIdentity);
+            if (isIdentityLoginEligible(decodeIdentity(previous)) &&
+                !isIdentityLoginEligible(input.replacement) &&
+                active.filter(isIdentityLoginEligible).length <= 1) {
+                return Option.none();
+            }
+            const updated = yield* execute(executor, update(authPostgresUserIdentity, {
+                revoked_at: millisParam(input.replacedAt),
+                replaced_by_id: input.replacement.id,
+                is_primary_login: false,
+                updated_at: millisParam(input.replacedAt),
+            }).pipe(Query.where(eq(authPostgresUserIdentity.id, input.id)), Query.returning(identitySelection)));
+            const row = input.replacement;
+            const inserted = yield* execute(executor, insert(authPostgresUserIdentity, {
+                ...identityValues(row),
+                is_primary_login: row.isPrimaryLogin ?? Boolean(previous.isPrimaryLogin),
+            }).pipe(Query.returning(identitySelection)));
+            const [updatedPrevious] = updated;
+            const [insertedReplacement] = inserted;
+            return Option.some({
+                previous: decodeIdentity(updatedPrevious),
+                replacement: decodeIdentity(insertedReplacement),
+            });
+        }))
+            .pipe(Effect.mapError((cause) => isExpectedIdentityConflict(cause)
+            ? identityConflict(input.replacement)
+            : transactionError("replace")(cause))),
+        revoke: (input) => sql
+            .withTransaction(Effect.gen(function* () {
+            const rows = yield* execute(executor, Query.select(identitySelection).pipe(Query.from(authPostgresUserIdentity), Query.where(eq(authPostgresUserIdentity.user_id, input.userId)), Query.where(isNull(authPostgresUserIdentity.revoked_at)), Query.orderBy(authPostgresUserIdentity.created_at, "asc"), Query.orderBy(Query.collate(authPostgresUserIdentity.id, "C"), "asc"), Query.lock("update")));
+            const selected = rows.find((row) => row.id === input.id);
+            if (selected === undefined ||
+                String(selected.updatedAt) !==
+                    millisParam(input.expectedUpdatedAt)) {
+                return Option.none();
+            }
+            const eligible = rows.filter((row) => row.kind !== "email" || row.verifiedAt !== null);
+            const selectedEligible = selected.kind !== "email" || selected.verifiedAt !== null;
+            if (selectedEligible && eligible.length <= 1) {
+                return Option.none();
+            }
+            const metadata = input.reason === undefined
+                ? selected.metadata
+                : {
+                    ...optionalRecord(selected.metadata),
+                    revokeReason: input.reason,
+                };
+            const revoked = yield* execute(executor, update(authPostgresUserIdentity, {
+                revoked_at: millisParam(input.revokedAt),
+                updated_at: millisParam(input.revokedAt),
+                is_primary_login: false,
+                metadata: metadata ?? null,
+            }).pipe(Query.where(eq(authPostgresUserIdentity.id, input.id)), Query.returning(identitySelection)));
+            if (selected.isPrimaryLogin === true) {
+                const promoted = eligible.find((row) => row.id !== input.id);
+                if (promoted !== undefined) {
+                    yield* execute(executor, update(authPostgresUserIdentity, {
+                        is_primary_login: true,
+                        updated_at: millisParam(input.revokedAt),
+                    }).pipe(Query.where(eq(authPostgresUserIdentity.id, promoted.id))));
+                }
+            }
+            return firstOption(revoked, decodeIdentity);
+        }))
+            .pipe(Effect.mapError(transactionError("revoke"))),
+    });
+};
+export const makeEffectQbPostgresCredentialStore = (executor) => {
+    const find = (userId, operation = "find") => execute(executor, Query.select(credentialSelection).pipe(Query.from(authPostgresCredential), Query.where(eq(authPostgresCredential.user_id, userId)), Query.where(eq(authPostgresCredential.type, "password")))).pipe(Effect.mapError((cause) => storageError("credential", operation, cause)), Effect.map((rows) => firstOption(rows, decodeCredential)));
+    return CredentialStore.of({
+        findPasswordByUserId: find,
+        insertPassword: (row) => execute(executor, insert(authPostgresCredential, credentialValues(row))).pipe(Effect.mapError((cause) => storageError("credential", "insert", cause)), Effect.asVoid),
+        updatePassword: (input) => execute(executor, update(authPostgresCredential, {
+            password_hash: input.passwordHash,
+            updated_at: millisParam(input.updatedAt),
+        }).pipe(Query.where(eq(authPostgresCredential.user_id, input.userId)), Query.where(eq(authPostgresCredential.type, "password")), Query.where(isNull(authPostgresCredential.revoked_at)), Query.returning(credentialSelection))).pipe(Effect.mapError((cause) => storageError("credential", "updatePassword", cause)), Effect.map((rows) => firstOption(rows, decodeCredential))),
+    });
+};
+export const makeEffectQbPostgresPasskeyCredentialStore = (executor) => {
+    const findByCredentialId = (credentialId, operation = "find") => {
+        const mapError = (cause) => passkeyCredentialStoreError(operation, cause);
+        return executeMapped(executor, () => Query.select(passkeyCredentialSelection).pipe(Query.from(authPostgresPasskeyCredential), Query.where(eq(authPostgresPasskeyCredential.credential_id, credentialId))), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodePasskeyCredential), mapError)));
+    };
+    return PasskeyCredentialStore.of({
+        insert: (row) => {
+            const mapError = (cause) => passkeyCredentialStoreError("insert", cause);
+            return executeMapped(executor, () => insert(authPostgresPasskeyCredential, passkeyCredentialValues(row)), mapError).pipe(Effect.asVoid);
+        },
+        findByCredentialId,
+        listByUser: (input) => {
+            const mapError = (cause) => passkeyCredentialStoreError("list", cause);
+            return executeMapped(executor, () => {
+                let plan = Query.select(passkeyCredentialSelection).pipe(Query.from(authPostgresPasskeyCredential), Query.where(eq(authPostgresPasskeyCredential.user_id, input.userId)));
+                if (input.includeRevoked !== true) {
+                    plan = plan.pipe(Query.where(isNull(authPostgresPasskeyCredential.revoked_at)));
+                }
+                return plan.pipe(Query.orderBy(authPostgresPasskeyCredential.created_at, "asc"), Query.orderBy(Query.collate(authPostgresPasskeyCredential.id, "C"), "asc"));
+            }, mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => rows.map(decodePasskeyCredential), mapError)));
+        },
+        updateSignCount: (input) => {
+            const mapError = (cause) => passkeyCredentialStoreError("update-sign-count", cause);
+            return executeMapped(executor, () => update(authPostgresPasskeyCredential, {
+                sign_count: safeIntegerToPostgresBigint(input.signCount, "Passkey sign count"),
+                last_used_at: millisParam(input.lastUsedAt),
+                ...(input.metadata === undefined
+                    ? {}
+                    : { metadata: input.metadata }),
+            }).pipe(Query.where(eq(authPostgresPasskeyCredential.credential_id, input.credentialId)), Query.where(eq(authPostgresPasskeyCredential.sign_count, safeIntegerToPostgresBigint(input.expectedSignCount, "Expected passkey sign count"))), Query.where(isNull(authPostgresPasskeyCredential.revoked_at)), Query.returning(passkeyCredentialSelection)), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodePasskeyCredential), mapError)));
+        },
+        revoke: (input) => {
+            const mapError = (cause) => passkeyCredentialStoreError("revoke", cause);
+            return executeMapped(executor, () => {
+                const values = {
+                    revoked_at: millisParam(input.revokedAt),
+                    ...(input.reason === undefined
+                        ? {}
+                        : {
+                            metadata: metadataWithReason(authPostgresPasskeyCredential.metadata, "revokeReason", input.reason),
+                        }),
+                };
+                return update(authPostgresPasskeyCredential, values).pipe(Query.where(eq(authPostgresPasskeyCredential.credential_id, input.credentialId)));
+            }, mapError).pipe(Effect.asVoid);
+        },
+    });
+};
+export const makeEffectQbPostgresApiKeyStore = (executor) => {
+    const find = (column, value, operation = "find") => {
+        const mapError = (cause) => apiKeyStoreError(operation, cause);
+        return executeMapped(executor, () => Query.select(apiKeySelection).pipe(Query.from(authPostgresApiKey), Query.where(eq(column, value))), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeApiKey), mapError)));
+    };
+    return ApiKeyStore.of({
+        insert: (row) => {
+            const mapError = (cause) => apiKeyStoreError("insert", cause);
+            return executeMapped(executor, () => insert(authPostgresApiKey, apiKeyValues(row)), mapError).pipe(Effect.asVoid);
+        },
+        findById: (id) => find(authPostgresApiKey.id, id),
+        findByPrefix: (prefix) => find(authPostgresApiKey.prefix, prefix),
+        listByUser: (input) => {
+            const mapError = (cause) => apiKeyStoreError("list", cause);
+            return executeMapped(executor, () => {
+                let plan = Query.select(apiKeySelection).pipe(Query.from(authPostgresApiKey), Query.where(eq(authPostgresApiKey.user_id, input.userId)));
+                if (input.includeRevoked !== true) {
+                    plan = plan.pipe(Query.where(isNull(authPostgresApiKey.revoked_at)));
+                }
+                return plan.pipe(Query.orderBy(authPostgresApiKey.created_at, "asc"), Query.orderBy(Query.collate(authPostgresApiKey.id, "C"), "asc"));
+            }, mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => rows.map(decodeApiKey), mapError)));
+        },
+        markUsed: (input) => {
+            const mapError = (cause) => apiKeyStoreError("mark-used", cause);
+            return executeMapped(executor, () => update(authPostgresApiKey, {
+                last_used_at: millisParam(input.lastUsedAt),
+                ...(input.metadata === undefined
+                    ? {}
+                    : { metadata: input.metadata }),
+            }).pipe(Query.where(eq(authPostgresApiKey.id, input.id)), Query.where(isNull(authPostgresApiKey.revoked_at)), Query.returning(apiKeySelection)), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeApiKey), mapError)));
+        },
+        revoke: (input) => {
+            const mapError = (cause) => apiKeyStoreError("revoke", cause);
+            return executeMapped(executor, () => {
+                const values = {
+                    revoked_at: millisParam(input.revokedAt),
+                    ...(input.reason === undefined
+                        ? {}
+                        : {
+                            metadata: metadataWithReason(authPostgresApiKey.metadata, "revokeReason", input.reason),
+                        }),
+                };
+                return update(authPostgresApiKey, values).pipe(Query.where(eq(authPostgresApiKey.id, input.id)));
+            }, mapError).pipe(Effect.asVoid);
+        },
+    });
+};
+export const makeEffectQbPostgresJwtRevocationStore = (executor) => JwtRevocationStore.of({
+    revoke: (record) => {
+        const mapError = (cause) => jwtRevocationStoreError("revoke", cause);
+        return executeMapped(executor, () => {
+            const values = jwtRevocationValues(record);
+            return insert(authPostgresJwtRevocation, values).pipe(PostgresQuery.onConflict("jwt_id", {
+                update: {
+                    revoked_at: values.revoked_at,
+                    expires_at: values.expires_at,
+                    reason: values.reason,
+                },
+            }));
+        }, mapError).pipe(Effect.asVoid);
+    },
+    find: (jwtId) => {
+        const mapError = (cause) => jwtRevocationStoreError("find", cause);
+        return executeMapped(executor, () => Query.select(jwtRevocationSelection).pipe(Query.from(authPostgresJwtRevocation), Query.where(eq(authPostgresJwtRevocation.jwt_id, jwtId))), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeJwtRevocation), mapError)));
+    },
+});
+const registrationReasonByConstraint = {
+    auth_user_pkey: "user-id",
+    auth_user_identity_pkey: "identity-id",
+    auth_user_identity_active_value_idx: "identity-value",
+    auth_credential_pkey: "credential-id",
+    auth_credential_user_type_key: "password-credential",
+};
+export const makeEffectQbPostgresRegistrationStore = (atomic) => RegistrationStore.of({
+    create: (input) => {
+        if (input.identity.userId !== input.user.id ||
+            (input.passwordCredential !== undefined &&
+                input.passwordCredential.userId !== input.user.id)) {
+            return Effect.fail(new RegistrationConflictError({ reason: "user-id" }));
+        }
+        const userPlan = insert(authPostgresUser, userValues(input.user)).pipe(Query.returning(userSelection));
+        const identityPlan = insert(authPostgresUserIdentity, identityValues(input.identity)).pipe(Query.returning(identitySelection));
+        const plans = input.passwordCredential === undefined
+            ? [userPlan, identityPlan]
+            : [
+                userPlan,
+                identityPlan,
+                insert(authPostgresCredential, credentialValues(input.passwordCredential)).pipe(Query.returning(credentialSelection)),
+            ];
+        return atomic.execute(plans).pipe(Effect.map(() => ({
+            user: input.user,
+            identity: {
+                ...input.identity,
+                isPrimaryLogin: input.identity.isPrimaryLogin ?? false,
+                updatedAt: input.identity.createdAt,
+            },
+            ...(input.passwordCredential === undefined
+                ? {}
+                : { passwordCredential: input.passwordCredential }),
+        })), Effect.mapError((cause) => {
+            const details = postgresErrorDetails(cause);
+            const reason = details.code === "23505" && details.constraintName !== undefined
+                ? registrationReasonByConstraint[details.constraintName]
+                : undefined;
+            return reason === undefined
+                ? new RegistrationFailureError({
+                    message: "Atomic Postgres registration failed",
+                    cause,
+                })
+                : new RegistrationConflictError({ reason });
+        }));
+    },
+});
+export const makeEffectQbPostgresSessionStore = (executor) => {
+    const result = (operation, plan) => {
+        const mapError = (cause) => storageError("session", operation, cause);
+        return execute(executor, plan).pipe(Effect.mapError(mapError), Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeSession), mapError)));
+    };
+    const findForMutation = (operation, sessionId) => {
+        const mapError = (cause) => storageError("session", operation, cause);
+        return execute(executor, Query.select(sessionSelection).pipe(Query.from(authPostgresSession), Query.where(eq(authPostgresSession.id, sessionId)))).pipe(Effect.mapError(mapError), Effect.flatMap((rows) => decodeMapped(() => {
+            const [selected] = rows;
+            return selected === undefined
+                ? Option.none()
+                : Option.some({
+                    row: decodeSession(selected),
+                    rawAuthenticationEvents: selected.authenticationEvents ??
+                        selected.authentication_events,
+                });
+        }, mapError)));
+    };
+    const mutateExisting = (operation, sessionId, plan) => findForMutation(operation, sessionId).pipe(Effect.flatMap((existing) => Option.isNone(existing)
+        ? Effect.succeed(Option.none())
+        : result(operation, plan(existing.value))));
+    const validateEvents = (operation, authenticationEvents) => decodeMapped(() => parseAuthenticationEvents(authenticationEvents), (cause) => storageError("session", operation, cause));
+    return SessionStore.of({
+        findById: (id) => result("find", Query.select(sessionSelection).pipe(Query.from(authPostgresSession), Query.where(eq(authPostgresSession.id, id)))),
+        listByUser: (input) => {
+            const mapError = (cause) => storageError("session", "listByUser", cause);
+            return execute(executor, Query.select(sessionSelection).pipe(Query.from(authPostgresSession), Query.where(eq(authPostgresSession.user_id, input.userId)), Query.orderBy(authPostgresSession.created_at, "asc"), Query.orderBy(Query.collate(authPostgresSession.id, "C"), "asc"))).pipe(Effect.mapError(mapError), Effect.flatMap((rows) => decodeMapped(() => rows.map(decodeSession), mapError)));
+        },
+        insert: (row) => validateEvents("insert", row.authenticationEvents).pipe(Effect.flatMap(() => execute(executor, insert(authPostgresSession, sessionValues(row)))), Effect.mapError((cause) => storageError("session", "insert", cause)), Effect.asVoid),
+        refresh: (input) => mutateExisting("refresh", input.sessionId, (existing) => update(authPostgresSession, {
+            expires_at: millisParam(input.expiresAt),
+            ...(input.lastSeenAt === undefined
+                ? {}
+                : { last_seen_at: millisParam(input.lastSeenAt) }),
+        }).pipe(Query.where(eq(authPostgresSession.id, input.sessionId)), Query.where(eq(authPostgresSession.authentication_events, existing.rawAuthenticationEvents)), Query.returning(sessionSelection))),
+        rotate: (input) => mutateExisting("rotate", input.sessionId, (existing) => update(authPostgresSession, {
+            secret_hash: input.secretHash,
+            rotated_at: millisParam(input.rotatedAt),
+            ...(input.expiresAt === undefined
+                ? {}
+                : { expires_at: millisParam(input.expiresAt) }),
+        }).pipe(Query.where(eq(authPostgresSession.id, input.sessionId)), Query.where(eq(authPostgresSession.authentication_events, existing.rawAuthenticationEvents)), Query.returning(sessionSelection))),
+        updateClaims: (input) => input.claims === undefined
+            ? result("updateClaims", Query.select(sessionSelection).pipe(Query.from(authPostgresSession), Query.where(eq(authPostgresSession.id, input.sessionId))))
+            : mutateExisting("updateClaims", input.sessionId, (existing) => update(authPostgresSession, { claims: input.claims }).pipe(Query.where(eq(authPostgresSession.id, input.sessionId)), Query.where(eq(authPostgresSession.authentication_events, existing.rawAuthenticationEvents)), Query.returning(sessionSelection))),
+        appendEvidence: (input) => validateEvents("appendEvidence", input.authenticationEvents).pipe(Effect.flatMap((authenticationEvents) => mutateExisting("appendEvidence", input.sessionId, (existing) => update(authPostgresSession, {
+            authentication_events: authenticationEvents,
+            auth_time: millisParam(input.authTime),
+            aal: input.aal,
+            amr: input.amr,
+            mfa_verified_at: input.mfaVerifiedAt === undefined
+                ? null
+                : millisParam(input.mfaVerifiedAt),
+            ...(input.claims === undefined ? {} : { claims: input.claims }),
+        }).pipe(Query.where(eq(authPostgresSession.id, input.sessionId)), Query.where(eq(authPostgresSession.authentication_events, existing.rawAuthenticationEvents)), Query.returning(sessionSelection))))),
+        assureAndRotate: (input) => validateEvents("assureAndRotate", input.authenticationEvents).pipe(Effect.flatMap((authenticationEvents) => mutateExisting("assureAndRotate", input.sessionId, (existing) => update(authPostgresSession, {
+            secret_hash: input.secretHash,
+            rotated_at: millisParam(input.rotatedAt),
+            authentication_events: authenticationEvents,
+            auth_time: millisParam(input.authTime),
+            aal: input.aal,
+            amr: input.amr,
+            mfa_verified_at: input.mfaVerifiedAt === undefined
+                ? null
+                : millisParam(input.mfaVerifiedAt),
+            ...(input.claims === undefined ? {} : { claims: input.claims }),
+        }).pipe(Query.where(eq(authPostgresSession.id, input.sessionId)), Query.where(eq(authPostgresSession.secret_hash, input.expectedSecretHash)), Query.where(eq(authPostgresSession.authentication_events, input.expectedAuthenticationEvents)), Query.where(eq(authPostgresSession.authentication_events, existing.rawAuthenticationEvents)), Query.where(isNull(authPostgresSession.revoked_at)), Query.where(gt(authPostgresSession.expires_at, millisParam(input.now))), Query.returning(sessionSelection))))),
+        revoke: (input) => execute(executor, update(authPostgresSession, {
+            revoked_at: millisParam(input.revokedAt),
+        }).pipe(Query.where(eq(authPostgresSession.id, input.sessionId)))).pipe(Effect.mapError((cause) => storageError("session", "revoke", cause)), Effect.asVoid),
+        revokeAllForUser: (input) => execute(executor, update(authPostgresSession, {
+            revoked_at: millisParam(input.revokedAt),
+        }).pipe(Query.where(eq(authPostgresSession.user_id, input.userId)))).pipe(Effect.mapError((cause) => storageError("session", "revokeAllForUser", cause)), Effect.asVoid),
+    });
+};
+export const makeEffectQbPostgresVerificationStore = (executor, sql) => {
+    const findById = (id, operation = "find") => execute(executor, Query.select(verificationSelection).pipe(Query.from(authPostgresVerification), Query.where(eq(authPostgresVerification.id, id)))).pipe(Effect.mapError((cause) => storageError("verification", operation, cause)), Effect.map((rows) => firstOption(rows, decodeVerification)));
+    return VerificationStore.of({
+        findById,
+        insert: (row) => execute(executor, insert(authPostgresVerification, verificationValues(row))).pipe(Effect.mapError((cause) => storageError("verification", "insert", cause)), Effect.asVoid),
+        consume: (input) => {
+            let plan = update(authPostgresVerification, {
+                consumed_at: millisParam(input.consumedAt),
+            }).pipe(Query.where(eq(authPostgresVerification.id, input.id)), Query.where(isNull(authPostgresVerification.consumed_at)), Query.where(gt(authPostgresVerification.expires_at, millisParam(input.consumedAt))));
+            if (input.type !== undefined) {
+                plan = plan.pipe(Query.where(eq(authPostgresVerification.type, input.type)));
+            }
+            return execute(executor, plan.pipe(Query.returning({
+                ...verificationSelection,
+                consumedAt: withoutNullRefinement(authPostgresVerification.consumed_at),
+            }))).pipe(Effect.mapError((cause) => storageError("verification", "consume", cause)), Effect.map((rows) => firstOption(rows, decodeVerification)));
+        },
+        deleteExpired: (input) => {
+            const { limit } = input;
+            if (limit === undefined) {
+                return execute(executor, Query.delete(authPostgresVerification).pipe(Query.where(lte(authPostgresVerification.expires_at, millisParam(input.now))), Query.returning({ id: authPostgresVerification.id }))).pipe(Effect.mapError((cause) => storageError("verification", "deleteExpired", cause)), Effect.map((rows) => rows.length));
+            }
+            return sql
+                .withTransaction(Effect.gen(function* () {
+                const selected = yield* execute(executor, Query.select({ id: authPostgresVerification.id }).pipe(Query.from(authPostgresVerification), Query.where(lte(authPostgresVerification.expires_at, millisParam(input.now))), Query.orderBy(authPostgresVerification.expires_at, "asc"), Query.orderBy(Query.collate(authPostgresVerification.id, "C"), "asc"), Query.limit(limit), Query.lock("update")));
+                if (selected.length === 0) {
+                    return 0;
+                }
+                const deleted = yield* execute(executor, Query.delete(authPostgresVerification).pipe(Query.where(inValues(authPostgresVerification.id, selected.map((row) => row.id))), Query.returning({ id: authPostgresVerification.id })));
+                return deleted.length;
+            }))
+                .pipe(Effect.mapError((cause) => storageError("verification", "deleteExpired", cause)));
+        },
+    });
+};
+const normalizedLimit = (limit) => {
+    if (limit === undefined) {
+        return undefined;
+    }
+    const normalized = Math.floor(limit);
+    if (Number.isNaN(normalized) || normalized <= 0) {
+        return 0;
+    }
+    return Number.isFinite(normalized) && normalized <= Number.MAX_SAFE_INTEGER
+        ? normalized
+        : undefined;
+};
+export const makeEffectQbPostgresAuditLogStore = (executor, sql) => AuditLogStore.of({
+    insertMany: (events) => {
+        if (events.length === 0) {
+            return Effect.void;
+        }
+        const mapError = (cause) => auditLogStoreError("insertMany", cause);
+        return Effect.gen(function* () {
+            const createdAt = yield* currentUnixMillis;
+            yield* sql.withTransaction(Effect.forEach(events, (event) => executeMapped(executor, () => insert(authPostgresAuditLog, auditLogValues(event, createdAt)), mapError)).pipe(Effect.asVoid));
+        }).pipe(Effect.mapError((cause) => cause instanceof AuditLogStoreError ? cause : mapError(cause)));
+    },
+    list: (input = {}) => {
+        if (input.types !== undefined && input.types.length === 0) {
+            return Effect.succeed([]);
+        }
+        const mapError = (cause) => auditLogStoreError("list", cause);
+        return executeMapped(executor, () => {
+            let plan = Query.select(auditLogSelection).pipe(Query.from(authPostgresAuditLog));
+            if (input.userId !== undefined) {
+                plan = plan.pipe(Query.where(eq(authPostgresAuditLog.user_id, input.userId)));
+            }
+            if (input.beforeOccurredAt !== undefined) {
+                plan = plan.pipe(Query.where(lt(authPostgresAuditLog.occurred_at, millisParam(input.beforeOccurredAt))));
+            }
+            if (input.types !== undefined) {
+                plan = plan.pipe(Query.where(inValues(authPostgresAuditLog.type, input.types)));
+            }
+            plan = plan.pipe(Query.orderBy(authPostgresAuditLog.occurred_at, "desc"), Query.orderBy(Query.collate(Query.coalesce(authPostgresAuditLog.id, Query.literal("")), "C"), "desc"), Query.orderBy(authPostgresAuditLog.storage_id, "asc"));
+            const limit = normalizedLimit(input.limit);
+            return limit === undefined ? plan : plan.pipe(Query.limit(limit));
+        }, mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => filterAuditLogEvents(rows.map(decodeAuditLogEvent), {
+            ...input,
+            limit: undefined,
+        }), mapError)));
+    },
+    deleteBefore: (input) => {
+        const mapError = (cause) => auditLogStoreError("deleteBefore", cause);
+        return executeMapped(executor, () => {
+            let plan = Query.delete(authPostgresAuditLog).pipe(Query.where(lt(authPostgresAuditLog.occurred_at, millisParam(input.beforeOccurredAt))));
+            if (input.userId !== undefined) {
+                plan = plan.pipe(Query.where(eq(authPostgresAuditLog.user_id, input.userId)));
+            }
+            return plan.pipe(Query.returning({ id: authPostgresAuditLog.id }));
+        }, mapError).pipe(Effect.map((rows) => rows.length));
+    },
+});
+export const makeEffectQbPostgresLoginApprovalReviewStore = (executor) => {
+    const findByApprovalChallengeId = (input, operation = "find") => {
+        const mapError = (cause) => loginApprovalReviewStoreError(operation, cause);
+        return executeMapped(executor, () => Query.select(loginApprovalReviewSelection).pipe(Query.from(authPostgresLoginApprovalReview), Query.where(eq(authPostgresLoginApprovalReview.approval_challenge_id, input.approvalChallengeId))), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeLoginApprovalReview), mapError)));
+    };
+    const transition = (status, input) => {
+        const operation = status === "approved" ? "approve" : "deny";
+        const mapError = (cause) => loginApprovalReviewStoreError(operation, cause);
+        return executeMapped(executor, () => update(authPostgresLoginApprovalReview, {
+            status,
+            reviewed_at: millisParam(input.reviewedAt),
+            reviewed_by: input.reviewedBy ?? null,
+            ...(status === "denied"
+                ? { denied_reason: input.reason ?? null }
+                : {}),
+            review_metadata: input.metadata ?? null,
+        }).pipe(Query.where(eq(authPostgresLoginApprovalReview.approval_challenge_id, input.approvalChallengeId)), Query.where(eq(authPostgresLoginApprovalReview.status, "pending")), Query.returning({
+            ...loginApprovalReviewSelection,
+            reviewedAt: withoutNullRefinement(authPostgresLoginApprovalReview.reviewed_at),
+        })), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeLoginApprovalReview), mapError)));
+    };
+    return LoginApprovalReviewStore.of({
+        insertPending: (input) => {
+            const mapError = (cause) => loginApprovalReviewStoreError("insert", cause);
+            return executeMapped(executor, () => insert(authPostgresLoginApprovalReview, loginApprovalReviewValues(input)), mapError).pipe(Effect.as(input));
+        },
+        findByApprovalChallengeId,
+        approve: (input) => transition("approved", input),
+        deny: (input) => transition("denied", input),
+    });
+};
+const defaultLoginRiskHistoryRecentWindowMillis = 15 * 60 * 1000;
+const defaultLoginRiskHistoryWindowMillis = 90 * 24 * 60 * 60 * 1000;
+const defaultLoginRiskImpossibleTravelWindowMillis = 24 * 60 * 60 * 1000;
+const defaultLoginRiskImpossibleTravelKmh = 900;
+const positiveWindowMillis = (value, defaultValue) => value === undefined || !Number.isFinite(value)
+    ? defaultValue
+    : Math.max(0, value);
+const resolvedLoginRiskHistoryOptions = (options) => ({
+    recentWindowMillis: positiveWindowMillis(options?.recentWindowMillis, defaultLoginRiskHistoryRecentWindowMillis),
+    historyWindowMillis: positiveWindowMillis(options?.historyWindowMillis, defaultLoginRiskHistoryWindowMillis),
+    impossibleTravelWindowMillis: positiveWindowMillis(options?.impossibleTravelWindowMillis, defaultLoginRiskImpossibleTravelWindowMillis),
+    impossibleTravelKmh: options?.impossibleTravelKmh === undefined ||
+        !Number.isFinite(options.impossibleTravelKmh)
+        ? defaultLoginRiskImpossibleTravelKmh
+        : Math.max(0, options.impossibleTravelKmh),
+});
+const toRadians = (degrees) => (degrees * Math.PI) / 180;
+const distanceKm = (first, second) => {
+    const earthRadiusKm = 6371;
+    const latitudeDelta = toRadians(second.latitude - first.latitude);
+    const longitudeDelta = toRadians(second.longitude - first.longitude);
+    const firstLatitude = toRadians(first.latitude);
+    const secondLatitude = toRadians(second.latitude);
+    const haversine = Math.sin(latitudeDelta / 2) ** 2 +
+        Math.cos(firstLatitude) *
+            Math.cos(secondLatitude) *
+            Math.sin(longitudeDelta / 2) ** 2;
+    return (2 *
+        earthRadiusKm *
+        Math.atan2(Math.sqrt(haversine), Math.sqrt(1 - haversine)));
+};
+const hasCoordinates = (value) => value.latitude !== undefined &&
+    Number.isFinite(value.latitude) &&
+    value.longitude !== undefined &&
+    Number.isFinite(value.longitude);
+const loginRiskHistoryLookupResult = (input, rows, options) => {
+    const normalized = resolvedLoginRiskHistoryOptions(options);
+    const occurredAt = Number(input.occurredAt);
+    const recentStart = occurredAt - normalized.recentWindowMillis;
+    const historyStart = occurredAt - normalized.historyWindowMillis;
+    const impossibleTravelStart = occurredAt - normalized.impossibleTravelWindowMillis;
+    const previousRows = rows.filter((row) => Number(row.occurredAt) < occurredAt);
+    const recentRows = previousRows.filter((row) => Number(row.occurredAt) >= recentStart);
+    const historyRows = previousRows.filter((row) => Number(row.occurredAt) >= historyStart);
+    const recentFailedLoginCount = recentRows.filter((row) => row.outcome === "failure").length;
+    const recentSuccessfulLoginCount = recentRows.filter((row) => row.outcome === "success").length;
+    const knownDevice = input.deviceKey === undefined
+        ? undefined
+        : historyRows.some((row) => row.deviceKey === input.deviceKey);
+    const knownLocation = input.locationKey === undefined
+        ? undefined
+        : historyRows.some((row) => row.locationKey === input.locationKey);
+    const currentLocation = {
+        latitude: input.request?.latitude,
+        longitude: input.request?.longitude,
+    };
+    const impossibleTravel = hasCoordinates(currentLocation)
+        ? previousRows
+            .filter((row) => row.outcome === "success" &&
+            Number(row.occurredAt) >= impossibleTravelStart)
+            .some((row) => {
+            const previousLocation = {
+                latitude: row.latitude,
+                longitude: row.longitude,
+            };
+            if (!hasCoordinates(previousLocation)) {
+                return false;
+            }
+            const elapsedHours = (occurredAt - Number(row.occurredAt)) / 3_600_000;
+            return (elapsedHours > 0 &&
+                distanceKm(previousLocation, currentLocation) / elapsedHours >
+                    normalized.impossibleTravelKmh);
+        })
+        : undefined;
+    const recentRiskLevels = recentRows.flatMap((row) => row.riskLevel === undefined ? [] : [row.riskLevel]);
+    const riskLevel = recentRiskLevels.length === 0
+        ? undefined
+        : maxLoginRiskLevel(recentRiskLevels, "unknown");
+    const reasons = [
+        ...(recentFailedLoginCount > 0 ? ["recent-failed-login"] : []),
+        ...(knownDevice === false ? ["new-device"] : []),
+        ...(knownLocation === false ? ["new-location"] : []),
+        ...(impossibleTravel === true ? ["impossible-travel"] : []),
+    ];
+    return {
+        recentLoginCount: recentRows.length,
+        recentFailedLoginCount,
+        recentSuccessfulLoginCount,
+        ...(knownDevice === undefined
+            ? {}
+            : { knownDevice, newDevice: !knownDevice }),
+        ...(knownLocation === undefined
+            ? {}
+            : { knownLocation, newLocation: !knownLocation }),
+        ...(impossibleTravel === undefined ? {} : { impossibleTravel }),
+        ...(riskLevel === undefined ? {} : { riskLevel }),
+        ...(reasons.length === 0 ? {} : { reasons }),
+    };
+};
+export const makeEffectQbPostgresLoginRiskHistoryStore = (executor, options) => LoginRiskHistory.of({
+    lookup: (input) => {
+        const mapError = (cause) => loginRiskHistoryStoreError("lookup", cause);
+        return executeMapped(executor, () => {
+            const normalized = resolvedLoginRiskHistoryOptions(options);
+            const occurredAt = Number(input.occurredAt);
+            const earliestOccurredAt = Math.min(occurredAt - normalized.recentWindowMillis, occurredAt - normalized.historyWindowMillis, occurredAt - normalized.impossibleTravelWindowMillis);
+            return Query.select(loginRiskHistorySelection).pipe(Query.from(authPostgresLoginRiskHistory), Query.where(eq(authPostgresLoginRiskHistory.user_id, input.userId)), Query.where(lt(authPostgresLoginRiskHistory.occurred_at, millisParam(input.occurredAt))), Query.where(gte(authPostgresLoginRiskHistory.occurred_at, String(Math.ceil(earliestOccurredAt)))), Query.orderBy(authPostgresLoginRiskHistory.occurred_at, "asc"), Query.orderBy(Query.collate(authPostgresLoginRiskHistory.id, "C"), "asc"));
+        }, mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => loginRiskHistoryLookupResult(input, rows.map(decodeLoginRiskHistoryRecord), options), mapError)));
+    },
+    record: (input) => {
+        const mapError = (cause) => loginRiskHistoryStoreError("record", cause);
+        return Effect.gen(function* () {
+            const createdAt = input.createdAt ?? (yield* currentUnixMillis);
+            yield* executeMapped(executor, () => insert(authPostgresLoginRiskHistory, loginRiskHistoryValues({ ...input, createdAt })), mapError);
+        }).pipe(Effect.asVoid);
+    },
+    deleteBefore: (input) => {
+        const mapError = (cause) => loginRiskHistoryStoreError("deleteBefore", cause);
+        return executeMapped(executor, () => {
+            let plan = Query.delete(authPostgresLoginRiskHistory).pipe(Query.where(lt(authPostgresLoginRiskHistory.occurred_at, millisParam(input.beforeOccurredAt))));
+            if (input.userId !== undefined) {
+                plan = plan.pipe(Query.where(eq(authPostgresLoginRiskHistory.user_id, input.userId)));
+            }
+            return plan.pipe(Query.returning({ id: authPostgresLoginRiskHistory.id }));
+        }, mapError).pipe(Effect.map((rows) => rows.length));
+    },
+});
+export const makeEffectQbPostgresTrustedDeviceStore = (executor) => {
+    const findIncludingExpired = (input) => {
+        const mapError = (cause) => trustedDeviceStoreError("trust", cause);
+        return executeMapped(executor, () => Query.select(trustedDeviceSelection).pipe(Query.from(authPostgresTrustedDevice), Query.where(eq(authPostgresTrustedDevice.user_id, input.userId)), Query.where(eq(authPostgresTrustedDevice.token_hash, input.tokenHash))), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeTrustedDevice), mapError)));
+    };
+    return TrustedDeviceStore.of({
+        find: (input) => {
+            const mapError = (cause) => trustedDeviceStoreError("status", cause);
+            return executeMapped(executor, () => Query.select(trustedDeviceSelection).pipe(Query.from(authPostgresTrustedDevice), Query.where(eq(authPostgresTrustedDevice.user_id, input.userId)), Query.where(eq(authPostgresTrustedDevice.token_hash, input.tokenHash)), Query.where(gt(authPostgresTrustedDevice.expires_at, millisParam(input.now)))), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeTrustedDevice), mapError)));
+        },
+        upsert: (input) => {
+            const mapError = (cause) => trustedDeviceStoreError("trust", cause);
+            return executeMapped(executor, () => {
+                const values = trustedDeviceValues(input);
+                return insert(authPostgresTrustedDevice, values).pipe(PostgresQuery.onConflict(["user_id", "token_hash"], {
+                    update: {
+                        last_seen_at: Query.excluded(authPostgresTrustedDevice.last_seen_at),
+                        expires_at: Query.excluded(authPostgresTrustedDevice.expires_at),
+                        ...(input.metadata === undefined
+                            ? {}
+                            : {
+                                metadata: Query.excluded(authPostgresTrustedDevice.metadata),
+                            }),
+                    },
+                    where: lte(authPostgresTrustedDevice.last_seen_at, Query.excluded(authPostgresTrustedDevice.last_seen_at)),
+                }), Query.returning(trustedDeviceSelection));
+            }, mapError).pipe(Effect.flatMap((rows) => rows[0] === undefined
+                ? findIncludingExpired(input).pipe(Effect.flatMap(Option.match({
+                    onNone: () => Effect.fail(trustedDeviceStoreError("trust", "missing row")),
+                    onSome: Effect.succeed,
+                })))
+                : decodeMapped(() => decodeTrustedDevice(rows[0]), mapError)));
+        },
+        listForUser: (input) => {
+            const mapError = (cause) => trustedDeviceStoreError("list", cause);
+            return executeMapped(executor, () => {
+                let plan = Query.select(trustedDeviceSelection).pipe(Query.from(authPostgresTrustedDevice), Query.where(eq(authPostgresTrustedDevice.user_id, input.userId)), Query.where(gt(authPostgresTrustedDevice.expires_at, millisParam(input.now))), Query.orderBy(authPostgresTrustedDevice.last_seen_at, "desc"), Query.orderBy(Query.collate(authPostgresTrustedDevice.token_hash, "C"), "desc"));
+                const limit = normalizedLimit(input.limit);
+                if (limit !== undefined) {
+                    plan = plan.pipe(Query.limit(limit));
+                }
+                return plan;
+            }, mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => rows.map(decodeTrustedDevice), mapError)));
+        },
+        revokeForUser: (input) => {
+            const mapError = (cause) => trustedDeviceStoreError("revoke", cause);
+            return executeMapped(executor, () => Query.delete(authPostgresTrustedDevice).pipe(Query.where(eq(authPostgresTrustedDevice.user_id, input.userId)), Query.where(eq(authPostgresTrustedDevice.token_hash, input.tokenHash))), mapError).pipe(Effect.asVoid);
+        },
+    });
+};
+export const makeEffectQbPostgresDomainVerificationStore = (executor) => {
+    const find = (predicate, operation = "find") => {
+        const mapError = (cause) => domainVerificationStoreError(operation, cause);
+        return executeMapped(executor, () => Query.select(domainVerificationSelection).pipe(Query.from(authPostgresDomainVerification), Query.where(predicate)), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeDomainVerification), mapError)));
+    };
+    return DomainVerificationStore.of({
+        upsert: (record) => {
+            const mapError = (cause) => domainVerificationStoreError("upsert", cause);
+            return executeMapped(executor, () => {
+                const values = domainVerificationValues(record);
+                return insert(authPostgresDomainVerification, values).pipe(PostgresQuery.onConflict(["owner_id", "domain"], {
+                    update: {
+                        id: values.id,
+                        proof_method: values.proof_method,
+                        proof_token: values.proof_token,
+                        status: values.status,
+                        created_at: values.created_at,
+                        expires_at: values.expires_at,
+                        verified_at: values.verified_at,
+                        revoked_at: values.revoked_at,
+                        last_checked_at: values.last_checked_at,
+                        metadata: values.metadata,
+                    },
+                }));
+            }, mapError).pipe(Effect.asVoid);
+        },
+        findById: (id) => find(eq(authPostgresDomainVerification.id, id)),
+        findByOwnerAndDomain: (input) => find(Query.and(eq(authPostgresDomainVerification.owner_id, input.ownerId), eq(authPostgresDomainVerification.domain, input.domain))),
+        listByOwner: (input) => {
+            const mapError = (cause) => domainVerificationStoreError("list", cause);
+            return executeMapped(executor, () => {
+                let plan = Query.select(domainVerificationSelection).pipe(Query.from(authPostgresDomainVerification), Query.where(eq(authPostgresDomainVerification.owner_id, input.ownerId)), Query.orderBy(authPostgresDomainVerification.created_at, "asc"), Query.orderBy(Query.collate(authPostgresDomainVerification.id, "C"), "asc"));
+                if (input.includeRevoked !== true) {
+                    plan = plan.pipe(Query.where(inValues(authPostgresDomainVerification.status, [
+                        "pending",
+                        "verified",
+                    ])));
+                }
+                return plan;
+            }, mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => rows.map(decodeDomainVerification), mapError)));
+        },
+        markVerified: (input) => {
+            const mapError = (cause) => domainVerificationStoreError("mark-verified", cause);
+            return executeMapped(executor, () => update(authPostgresDomainVerification, {
+                status: "verified",
+                verified_at: millisParam(input.verifiedAt),
+                last_checked_at: millisParam(input.verifiedAt),
+                ...(input.metadata === undefined
+                    ? {}
+                    : { metadata: input.metadata }),
+            }).pipe(Query.where(eq(authPostgresDomainVerification.id, input.id)), Query.where(eq(authPostgresDomainVerification.status, "pending")), Query.returning({
+                ...domainVerificationSelection,
+                verifiedAt: withoutNullRefinement(authPostgresDomainVerification.verified_at),
+                lastCheckedAt: withoutNullRefinement(authPostgresDomainVerification.last_checked_at),
+            })), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeDomainVerification), mapError)));
+        },
+        revoke: (input) => {
+            const mapError = (cause) => domainVerificationStoreError("revoke", cause);
+            return executeMapped(executor, () => update(authPostgresDomainVerification, {
+                status: "revoked",
+                revoked_at: millisParam(input.revokedAt),
+                ...(input.reason === undefined
+                    ? {}
+                    : {
+                        metadata: metadataWithReason(authPostgresDomainVerification.metadata, "revokeReason", input.reason),
+                    }),
+            }).pipe(Query.where(eq(authPostgresDomainVerification.id, input.id))), mapError).pipe(Effect.asVoid);
+        },
+    });
+};
+export const makeEffectQbPostgresSecurityTimelineStore = (executor) => SecurityTimelineStore.of({
+    insert: (event) => {
+        const mapError = (cause) => securityTimelineStoreError("insert", cause);
+        return executeMapped(executor, () => insert(authPostgresSecurityTimeline, securityTimelineValues(event)), mapError).pipe(Effect.asVoid);
+    },
+    listByUser: (input) => {
+        if (input.types?.length === 0 || input.categories?.length === 0) {
+            return Effect.succeed([]);
+        }
+        const mapError = (cause) => securityTimelineStoreError("list", cause);
+        return executeMapped(executor, () => {
+            let plan = Query.select(securityTimelineSelection).pipe(Query.from(authPostgresSecurityTimeline), Query.where(eq(authPostgresSecurityTimeline.user_id, input.userId)));
+            if (input.beforeOccurredAt !== undefined) {
+                plan = plan.pipe(Query.where(lt(authPostgresSecurityTimeline.occurred_at, millisParam(input.beforeOccurredAt))));
+            }
+            if (input.types !== undefined) {
+                plan = plan.pipe(Query.where(inValues(authPostgresSecurityTimeline.type, input.types)));
+            }
+            if (input.categories !== undefined) {
+                plan = plan.pipe(Query.where(inValues(authPostgresSecurityTimeline.category, input.categories)));
+            }
+            plan = plan.pipe(Query.orderBy(authPostgresSecurityTimeline.occurred_at, "desc"), Query.orderBy(Query.collate(authPostgresSecurityTimeline.id, "C"), "desc"));
+            const limit = normalizedLimit(input.limit);
+            return limit === undefined ? plan : plan.pipe(Query.limit(limit));
+        }, mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => filterSecurityTimelineEvents(rows.map(decodeSecurityTimelineEvent), { ...input, limit: undefined }), mapError)));
+    },
+    deleteBefore: (input) => {
+        const mapError = (cause) => securityTimelineStoreError("deleteBefore", cause);
+        return executeMapped(executor, () => {
+            let plan = Query.delete(authPostgresSecurityTimeline).pipe(Query.where(lt(authPostgresSecurityTimeline.occurred_at, millisParam(input.beforeOccurredAt))));
+            if (input.userId !== undefined) {
+                plan = plan.pipe(Query.where(eq(authPostgresSecurityTimeline.user_id, input.userId)));
+            }
+            return plan.pipe(Query.returning({ id: authPostgresSecurityTimeline.id }));
+        }, mapError).pipe(Effect.map((rows) => rows.length));
+    },
+});
+export const makeEffectQbPostgresWebhookOutboxStore = (executor, sql) => WebhookOutboxStore.of({
+    enqueue: (input) => {
+        const mapError = (cause) => webhookOutboxStoreError("enqueue", cause);
+        return Effect.gen(function* () {
+            const now = input.now ?? (yield* currentUnixMillis);
+            const record = {
+                id: input.id,
+                endpointKey: input.endpointKey,
+                event: input.event,
+                status: "pending",
+                attempts: 0,
+                nextAttemptAt: input.nextAttemptAt ?? now,
+                createdAt: now,
+                updatedAt: now,
+            };
+            yield* executeMapped(executor, () => insert(authPostgresWebhookOutbox, webhookOutboxValues(record)), mapError);
+            return record;
+        });
+    },
+    claimDue: (input) => {
+        const mapError = (cause) => webhookOutboxStoreError("claimDue", cause);
+        return Effect.gen(function* () {
+            const now = input.now ?? (yield* currentUnixMillis);
+            const rows = yield* executeMapped(executor, () => {
+                let plan = Query.select(webhookOutboxSelection).pipe(Query.from(authPostgresWebhookOutbox), Query.where(lte(authPostgresWebhookOutbox.next_attempt_at, millisParam(now))), Query.where(inValues(authPostgresWebhookOutbox.status, [
+                    "pending",
+                    "failed",
+                ])), Query.orderBy(authPostgresWebhookOutbox.next_attempt_at, "asc"), Query.orderBy(authPostgresWebhookOutbox.created_at, "asc"), Query.orderBy(Query.collate(authPostgresWebhookOutbox.id, "C"), "asc"));
+                if (input.endpointKey !== undefined) {
+                    plan = plan.pipe(Query.where(eq(authPostgresWebhookOutbox.endpoint_key, input.endpointKey)));
+                }
+                const limit = normalizedLimit(input.limit);
+                return limit === undefined ? plan : plan.pipe(Query.limit(limit));
+            }, mapError);
+            return yield* decodeMapped(() => filterDueWebhookOutboxRecords(rows.map(decodeWebhookOutboxRecord), {
+                ...input,
+                now,
+                limit: undefined,
+            }), mapError);
+        });
+    },
+    markDelivered: (input) => {
+        const mapError = (cause) => webhookOutboxStoreError("markDelivered", cause);
+        return Effect.gen(function* () {
+            const deliveredAt = input.deliveredAt ?? (yield* currentUnixMillis);
+            yield* executeMapped(executor, () => update(authPostgresWebhookOutbox, {
+                status: "delivered",
+                delivered_at: millisParam(deliveredAt),
+                updated_at: millisParam(deliveredAt),
+                last_error: null,
+            }).pipe(Query.where(eq(authPostgresWebhookOutbox.id, input.id)), Query.where(inValues(authPostgresWebhookOutbox.status, [
+                "pending",
+                "failed",
+                "delivered",
+            ]))), mapError);
+        }).pipe(Effect.asVoid);
+    },
+    markFailed: (input) => {
+        const mapError = (cause) => webhookOutboxStoreError("markFailed", cause);
+        return sql
+            .withTransaction(Effect.gen(function* () {
+            const rows = yield* executeMapped(executor, () => selectForUpdate(webhookOutboxSelection, authPostgresWebhookOutbox, eq(authPostgresWebhookOutbox.id, input.id)), mapError);
+            const existing = yield* decodeMapped(() => firstOption(rows, decodeWebhookOutboxRecord), mapError);
+            if (Option.isNone(existing) ||
+                existing.value.status === "delivered" ||
+                existing.value.status === "dead_lettered") {
+                return;
+            }
+            const failedAt = input.failedAt ?? (yield* currentUnixMillis);
+            yield* executeMapped(executor, () => update(authPostgresWebhookOutbox, {
+                status: "failed",
+                attempts: existing.value.attempts + 1,
+                next_attempt_at: millisParam(input.nextAttemptAt),
+                updated_at: millisParam(failedAt),
+                last_error: input.error ?? null,
+            }).pipe(Query.where(eq(authPostgresWebhookOutbox.id, input.id)), Query.where(inValues(authPostgresWebhookOutbox.status, [
+                "pending",
+                "failed",
+            ]))), mapError);
+        }))
+            .pipe(Effect.mapError((cause) => cause instanceof WebhookOutboxStoreError ? cause : mapError(cause)), Effect.asVoid);
+    },
+    markDeadLettered: (input) => {
+        const mapError = (cause) => webhookOutboxStoreError("markDeadLettered", cause);
+        return Effect.gen(function* () {
+            const deadLetteredAt = input.deadLetteredAt ?? (yield* currentUnixMillis);
+            yield* executeMapped(executor, () => update(authPostgresWebhookOutbox, {
+                status: "dead_lettered",
+                updated_at: millisParam(deadLetteredAt),
+                last_error: input.error ?? null,
+            }).pipe(Query.where(eq(authPostgresWebhookOutbox.id, input.id)), Query.where(inValues(authPostgresWebhookOutbox.status, [
+                "pending",
+                "failed",
+            ]))), mapError);
+        }).pipe(Effect.asVoid);
+    },
+    deleteBefore: (input) => {
+        const mapError = (cause) => webhookOutboxStoreError("deleteBefore", cause);
+        return executeMapped(executor, () => {
+            let plan = Query.delete(authPostgresWebhookOutbox).pipe(Query.where(lt(authPostgresWebhookOutbox.updated_at, millisParam(input.beforeUpdatedAt))), Query.where(inValues(authPostgresWebhookOutbox.status, input.statuses)));
+            if (input.endpointKey !== undefined) {
+                plan = plan.pipe(Query.where(eq(authPostgresWebhookOutbox.endpoint_key, input.endpointKey)));
+            }
+            return plan.pipe(Query.returning({ id: authPostgresWebhookOutbox.id }));
+        }, mapError).pipe(Effect.map((rows) => rows.length));
+    },
+});
+export const makeEffectQbPostgresWebhookReplayStore = (executor) => WebhookReplayStore.of({
+    claim: (input) => {
+        const mapError = (cause) => webhookReplayStoreError("claim", cause);
+        return Effect.gen(function* () {
+            const now = input.now ?? (yield* currentUnixMillis);
+            const rows = yield* executeMapped(executor, () => insert(authPostgresWebhookReplay, {
+                id: input.id,
+                expires_at: millisParam(input.expiresAt),
+                created_at: millisParam(now),
+            }).pipe(PostgresQuery.onConflict("id", {
+                update: {
+                    expires_at: millisParam(input.expiresAt),
+                    created_at: millisParam(now),
+                },
+                where: lt(authPostgresWebhookReplay.expires_at, millisParam(now)),
+            }), Query.returning({ id: authPostgresWebhookReplay.id })), mapError);
+            return rows.length > 0;
+        });
+    },
+    deleteExpired: (input = {}) => {
+        const mapError = (cause) => webhookReplayStoreError("deleteExpired", cause);
+        return Effect.gen(function* () {
+            const now = input.now ?? (yield* currentUnixMillis);
+            const rows = yield* executeMapped(executor, () => Query.delete(authPostgresWebhookReplay).pipe(Query.where(lt(authPostgresWebhookReplay.expires_at, millisParam(now))), Query.returning({ id: authPostgresWebhookReplay.id })), mapError);
+            return rows.length;
+        });
+    },
+});
+export const makeEffectQbPostgresTotpFactorStore = (executor) => {
+    const findById = (id, operation = "find") => execute(executor, Query.select(totpFactorSelection).pipe(Query.from(authPostgresTotpFactor), Query.where(eq(authPostgresTotpFactor.id, id)))).pipe(Effect.mapError((cause) => totpFactorStoreError(operation, cause)), Effect.map((rows) => firstOption(rows, decodeTotpFactor)));
+    return TotpFactorStore.of({
+        insert: (row) => execute(executor, insert(authPostgresTotpFactor, totpFactorValues(row))).pipe(Effect.mapError((cause) => totpFactorStoreError("insert", cause)), Effect.asVoid),
+        findById,
+        listByUser: (input) => {
+            let plan = Query.select(totpFactorSelection).pipe(Query.from(authPostgresTotpFactor), Query.where(eq(authPostgresTotpFactor.user_id, input.userId)));
+            if (input.includeRevoked !== true) {
+                plan = plan.pipe(Query.where(isNull(authPostgresTotpFactor.revoked_at)));
+            }
+            if (input.includeUnconfirmed !== true) {
+                plan = plan.pipe(Query.where(isNotNull(authPostgresTotpFactor.confirmed_at)));
+            }
+            plan = plan.pipe(Query.orderBy(authPostgresTotpFactor.created_at, "asc"), Query.orderBy(Query.collate(authPostgresTotpFactor.id, "C"), "asc"));
+            return execute(executor, plan).pipe(Effect.mapError((cause) => totpFactorStoreError("list", cause)), Effect.map((rows) => rows.map(decodeTotpFactor)));
+        },
+        confirm: (input) => execute(executor, update(authPostgresTotpFactor, {
+            confirmed_at: millisParam(input.confirmedAt),
+            ...(input.metadata === undefined ? {} : { metadata: input.metadata }),
+        }).pipe(Query.where(eq(authPostgresTotpFactor.id, input.id)), Query.where(isNull(authPostgresTotpFactor.revoked_at)), Query.returning(totpFactorSelection))).pipe(Effect.mapError((cause) => totpFactorStoreError("confirm", cause)), Effect.map((rows) => firstOption(rows, decodeTotpFactor))),
+        acceptCounter: (input) => execute(executor, update(authPostgresTotpFactor, {
+            last_used_at: millisParam(input.lastUsedAt),
+            last_accepted_counter: String(input.counter),
+            ...(input.metadata === undefined ? {} : { metadata: input.metadata }),
+        }).pipe(Query.where(eq(authPostgresTotpFactor.id, input.id)), Query.where(isNotNull(authPostgresTotpFactor.confirmed_at)), Query.where(isNull(authPostgresTotpFactor.revoked_at)), Query.where(or(isNull(authPostgresTotpFactor.last_accepted_counter), Query.lt(authPostgresTotpFactor.last_accepted_counter, String(input.counter)))), Query.returning(totpFactorSelection))).pipe(Effect.mapError((cause) => totpFactorStoreError("accept-counter", cause)), Effect.flatMap((rows) => {
+            if (rows[0] !== undefined) {
+                return Effect.succeed({
+                    _tag: "Accepted",
+                    factor: decodeTotpFactor(rows[0]),
+                });
+            }
+            return findById(input.id, "accept-counter").pipe(Effect.map((factor) => Option.isSome(factor) &&
+                factor.value.confirmedAt !== undefined &&
+                factor.value.revokedAt === undefined &&
+                factor.value.lastAcceptedCounter !== undefined &&
+                factor.value.lastAcceptedCounter >= input.counter
+                ? { _tag: "Replay" }
+                : { _tag: "Unavailable" }));
+        })),
+        revoke: (input) => findById(input.id, "revoke").pipe(Effect.flatMap((found) => {
+            if (Option.isNone(found)) {
+                return Effect.void;
+            }
+            const metadata = input.reason === undefined
+                ? (found.value.metadata ?? null)
+                : { ...found.value.metadata, revokeReason: input.reason };
+            return execute(executor, update(authPostgresTotpFactor, {
+                revoked_at: millisParam(input.revokedAt),
+                metadata,
+            }).pipe(Query.where(eq(authPostgresTotpFactor.id, input.id)))).pipe(Effect.mapError((cause) => totpFactorStoreError("revoke", cause)), Effect.asVoid);
+        })),
+    });
+};
+export const makeEffectQbPostgresRecoveryCodeStore = (executor, sql) => {
+    const findById = (id, operation = "find") => execute(executor, Query.select(recoveryCodeSelection).pipe(Query.from(authPostgresRecoveryCode), Query.where(eq(authPostgresRecoveryCode.id, id)))).pipe(Effect.mapError((cause) => recoveryCodeStoreError(operation, cause)), Effect.map((rows) => firstOption(rows, decodeRecoveryCode)));
+    const insertOne = (row) => execute(executor, insert(authPostgresRecoveryCode, recoveryCodeValues(row))).pipe(Effect.asVoid);
+    return RecoveryCodeStore.of({
+        insertMany: (rows) => sql
+            .withTransaction(Effect.forEach(rows, insertOne, { discard: true }))
+            .pipe(Effect.mapError((cause) => recoveryCodeStoreError("insert", cause))),
+        findById,
+        listByUser: (input) => {
+            let plan = Query.select(recoveryCodeSelection).pipe(Query.from(authPostgresRecoveryCode), Query.where(eq(authPostgresRecoveryCode.user_id, input.userId)));
+            if (input.includeUsed !== true) {
+                plan = plan.pipe(Query.where(isNull(authPostgresRecoveryCode.used_at)));
+            }
+            if (input.includeRevoked !== true) {
+                plan = plan.pipe(Query.where(isNull(authPostgresRecoveryCode.revoked_at)));
+            }
+            plan = plan.pipe(Query.orderBy(authPostgresRecoveryCode.created_at, "asc"), Query.orderBy(Query.collate(authPostgresRecoveryCode.id, "C"), "asc"));
+            return execute(executor, plan).pipe(Effect.mapError((cause) => recoveryCodeStoreError("list", cause)), Effect.map((rows) => rows.map(decodeRecoveryCode)));
+        },
+        markUsed: (input) => execute(executor, update(authPostgresRecoveryCode, {
+            used_at: millisParam(input.usedAt),
+            ...(input.metadata === undefined ? {} : { metadata: input.metadata }),
+        }).pipe(Query.where(eq(authPostgresRecoveryCode.id, input.id)), Query.where(isNull(authPostgresRecoveryCode.used_at)), Query.where(isNull(authPostgresRecoveryCode.revoked_at)), Query.returning({
+            ...recoveryCodeSelection,
+            usedAt: withoutNullRefinement(authPostgresRecoveryCode.used_at),
+        }))).pipe(Effect.mapError((cause) => recoveryCodeStoreError("mark-used", cause)), Effect.map((rows) => firstOption(rows, decodeRecoveryCode))),
+        replaceActiveForUser: (input) => sql
+            .withTransaction(Effect.gen(function* () {
+            yield* execute(executor, update(authPostgresRecoveryCode, {
+                revoked_at: millisParam(input.revokedAt),
+                ...(input.revokeReason === undefined
+                    ? {}
+                    : {
+                        metadata: metadataWithReason(authPostgresRecoveryCode.metadata, "revokeReason", input.revokeReason),
+                    }),
+            }).pipe(Query.where(eq(authPostgresRecoveryCode.user_id, input.userId)), Query.where(isNull(authPostgresRecoveryCode.used_at)), Query.where(isNull(authPostgresRecoveryCode.revoked_at))));
+            yield* Effect.forEach(input.rows, insertOne, { discard: true });
+        }))
+            .pipe(Effect.mapError((cause) => recoveryCodeStoreError("replace-active", cause))),
+        revoke: (input) => findById(input.id, "revoke").pipe(Effect.flatMap((found) => {
+            if (Option.isNone(found)) {
+                return Effect.void;
+            }
+            const metadata = input.reason === undefined
+                ? (found.value.metadata ?? null)
+                : { ...found.value.metadata, revokeReason: input.reason };
+            return execute(executor, update(authPostgresRecoveryCode, {
+                revoked_at: millisParam(input.revokedAt),
+                metadata,
+            }).pipe(Query.where(eq(authPostgresRecoveryCode.id, input.id)))).pipe(Effect.mapError((cause) => recoveryCodeStoreError("revoke", cause)), Effect.asVoid);
+        })),
+    });
+};
+export const makeEffectQbPostgresTotpSessionRotateStore = (sql) => {
+    const executor = makeEffectQbPostgresExecutor(sql);
+    return TotpSessionRotateStore.of({
+        acceptAndRotate: (input) => sql
+            .withTransaction(Effect.gen(function* () {
+            const factors = yield* execute(executor, selectForUpdate(totpFactorSelection, authPostgresTotpFactor, eq(authPostgresTotpFactor.id, input.factorId)));
+            const sessions = yield* execute(executor, selectForUpdate(sessionSelection, authPostgresSession, eq(authPostgresSession.id, input.sessionId)));
+            const [factor] = factors;
+            const [session] = sessions;
+            if (factor === undefined ||
+                factor.userId !== input.userId ||
+                factor.confirmedAt === null ||
+                factor.revokedAt !== null ||
+                (factor.lastAcceptedCounter !== null &&
+                    Number(factor.lastAcceptedCounter) >= input.counter) ||
+                session === undefined ||
+                session.userId !== input.userId ||
+                session.revokedAt !== null ||
+                postgresBigintToUnixMillis(session.expiresAt) <= input.now ||
+                session.secretHash !== input.expectedSecretHash ||
+                !jsonEqual(session.authenticationEvents, input.expectedAuthenticationEvents)) {
+                return Option.none();
+            }
+            yield* execute(executor, update(authPostgresTotpFactor, {
+                last_used_at: millisParam(input.lastUsedAt),
+                last_accepted_counter: String(input.counter),
+                ...(input.factorMetadata === undefined
+                    ? {}
+                    : { metadata: input.factorMetadata }),
+            }).pipe(Query.where(eq(authPostgresTotpFactor.id, input.factorId))));
+            const updated = yield* updateAssuredSession(executor, input);
+            return yield* decodeMapped(() => firstOption(updated, decodeSession), (cause) => cause);
+        }))
+            .pipe(Effect.mapError((cause) => new TotpSessionRotateStoreError({
+            message: "Atomic TOTP session rotation failed",
+            cause,
+        }))),
+    });
+};
+export const makeEffectQbPostgresRecoveryCodeSessionRotateStore = (sql) => {
+    const executor = makeEffectQbPostgresExecutor(sql);
+    return RecoveryCodeSessionRotateStore.of({
+        consumeAndRotate: (input) => sql
+            .withTransaction(Effect.gen(function* () {
+            const codes = yield* execute(executor, selectForUpdate(recoveryCodeSelection, authPostgresRecoveryCode, eq(authPostgresRecoveryCode.id, input.codeId)));
+            const sessions = yield* execute(executor, selectForUpdate(sessionSelection, authPostgresSession, eq(authPostgresSession.id, input.sessionId)));
+            const [code] = codes;
+            const [session] = sessions;
+            if (code === undefined ||
+                code.userId !== input.userId ||
+                code.usedAt !== null ||
+                code.revokedAt !== null ||
+                session === undefined ||
+                session.userId !== input.userId ||
+                session.revokedAt !== null ||
+                postgresBigintToUnixMillis(session.expiresAt) <= input.now ||
+                session.secretHash !== input.expectedSecretHash ||
+                !jsonEqual(session.authenticationEvents, input.expectedAuthenticationEvents)) {
+                return Option.none();
+            }
+            yield* execute(executor, update(authPostgresRecoveryCode, {
+                used_at: millisParam(input.usedAt),
+                ...(input.codeMetadata === undefined
+                    ? {}
+                    : { metadata: input.codeMetadata }),
+            }).pipe(Query.where(eq(authPostgresRecoveryCode.id, input.codeId))));
+            const updated = yield* updateAssuredSession(executor, input);
+            return yield* decodeMapped(() => firstOption(updated, decodeSession), (cause) => cause);
+        }))
+            .pipe(Effect.mapError((cause) => new RecoveryCodeSessionRotateStoreError({
+            message: "Atomic recovery session rotation failed",
+            cause,
+        }))),
+    });
+};
+export const makeEffectQbPostgresTotpLoginCommitStore = (sql) => {
+    const executor = makeEffectQbPostgresExecutor(sql);
+    return TotpLoginCommitStore.of({
+        commit: (input) => {
+            if (input.verification.type !== "auth-flow-state" ||
+                input.verification.subject !== input.userId ||
+                (input.session === undefined &&
+                    input.continuation !== "login-approval") ||
+                (input.session !== undefined && input.continuation !== undefined) ||
+                (input.session !== undefined && input.session.userId !== input.userId)) {
+                return Effect.succeed(false);
+            }
+            return sql
+                .withTransaction(Effect.gen(function* () {
+                const verifications = yield* execute(executor, selectForUpdate(verificationSelection, authPostgresVerification, eq(authPostgresVerification.id, input.verification.id)));
+                const [verification] = verifications;
+                if (verification === undefined ||
+                    !sameVerification(verification, input.verification) ||
+                    verification.consumedAt !== null ||
+                    postgresBigintToUnixMillis(verification.expiresAt) <=
+                        input.consumedAt) {
+                    return false;
+                }
+                const factors = yield* execute(executor, selectForUpdate(totpFactorSelection, authPostgresTotpFactor, eq(authPostgresTotpFactor.id, input.factorId)));
+                const [factor] = factors;
+                if (factor === undefined ||
+                    factor.userId !== input.userId ||
+                    factor.confirmedAt === null ||
+                    factor.revokedAt !== null ||
+                    (factor.lastAcceptedCounter !== null &&
+                        Number(factor.lastAcceptedCounter) >= input.counter)) {
+                    return false;
+                }
+                if (input.session !== undefined) {
+                    const sessions = yield* execute(executor, Query.select({ id: authPostgresSession.id }).pipe(Query.from(authPostgresSession), Query.where(eq(authPostgresSession.id, input.session.id))));
+                    if (sessions[0] !== undefined) {
+                        return false;
+                    }
+                }
+                yield* execute(executor, update(authPostgresVerification, {
+                    consumed_at: millisParam(input.consumedAt),
+                }).pipe(Query.where(eq(authPostgresVerification.id, input.verification.id))));
+                yield* execute(executor, update(authPostgresTotpFactor, {
+                    last_used_at: millisParam(input.lastUsedAt),
+                    last_accepted_counter: String(input.counter),
+                    ...(input.factorMetadata === undefined
+                        ? {}
+                        : { metadata: input.factorMetadata }),
+                }).pipe(Query.where(eq(authPostgresTotpFactor.id, input.factorId))));
+                if (input.session !== undefined) {
+                    yield* insertSession(executor, input.session);
+                }
+                return true;
+            }))
+                .pipe(Effect.mapError((cause) => new TotpLoginCommitStoreError({
+                message: "Atomic TOTP login commit failed",
+                cause,
+            })));
+        },
+    });
+};
+export const makeEffectQbPostgresRecoveryCodeLoginCommitStore = (sql) => {
+    const executor = makeEffectQbPostgresExecutor(sql);
+    return RecoveryCodeLoginCommitStore.of({
+        commit: (input) => {
+            if (input.verification.type !== "auth-flow-state" ||
+                input.verification.subject !== input.userId ||
+                (input.session === undefined &&
+                    input.continuation !== "login-approval") ||
+                (input.session !== undefined && input.continuation !== undefined) ||
+                (input.session !== undefined && input.session.userId !== input.userId)) {
+                return Effect.succeed(false);
+            }
+            return sql
+                .withTransaction(Effect.gen(function* () {
+                const verifications = yield* execute(executor, selectForUpdate(verificationSelection, authPostgresVerification, eq(authPostgresVerification.id, input.verification.id)));
+                const [verification] = verifications;
+                if (verification === undefined ||
+                    !sameVerification(verification, input.verification) ||
+                    verification.consumedAt !== null ||
+                    postgresBigintToUnixMillis(verification.expiresAt) <=
+                        input.consumedAt) {
+                    return false;
+                }
+                const codes = yield* execute(executor, selectForUpdate(recoveryCodeSelection, authPostgresRecoveryCode, eq(authPostgresRecoveryCode.id, input.codeId)));
+                const [code] = codes;
+                if (code === undefined ||
+                    code.userId !== input.userId ||
+                    code.usedAt !== null ||
+                    code.revokedAt !== null) {
+                    return false;
+                }
+                if (input.session !== undefined) {
+                    const sessions = yield* execute(executor, Query.select({ id: authPostgresSession.id }).pipe(Query.from(authPostgresSession), Query.where(eq(authPostgresSession.id, input.session.id))));
+                    if (sessions[0] !== undefined) {
+                        return false;
+                    }
+                }
+                yield* execute(executor, update(authPostgresVerification, {
+                    consumed_at: millisParam(input.consumedAt),
+                }).pipe(Query.where(eq(authPostgresVerification.id, input.verification.id))));
+                yield* execute(executor, update(authPostgresRecoveryCode, {
+                    used_at: millisParam(input.usedAt),
+                    ...(input.codeMetadata === undefined
+                        ? {}
+                        : { metadata: input.codeMetadata }),
+                }).pipe(Query.where(eq(authPostgresRecoveryCode.id, input.codeId))));
+                if (input.session !== undefined) {
+                    yield* insertSession(executor, input.session);
+                }
+                return true;
+            }))
+                .pipe(Effect.mapError((cause) => new RecoveryCodeLoginCommitStoreError({
+                message: "Atomic recovery-code login commit failed",
+                cause,
+            })));
+        },
+    });
+};
+export const makeEffectQbPostgresRefreshTokenStore = (executor, sql) => {
+    const find = (column, value, operation = "find") => execute(executor, Query.select(refreshTokenSelection).pipe(Query.from(authPostgresRefreshToken), Query.where(eq(column, value)))).pipe(Effect.mapError((cause) => refreshTokenStoreError(operation, cause)), Effect.map((rows) => firstOption(rows, decodeRefreshToken)));
+    const list = (column, value, includeRevoked) => {
+        let plan = Query.select(refreshTokenSelection).pipe(Query.from(authPostgresRefreshToken), Query.where(eq(column, value)));
+        if (includeRevoked !== true) {
+            plan = plan.pipe(Query.where(isNull(authPostgresRefreshToken.revoked_at)));
+        }
+        plan = plan.pipe(Query.orderBy(authPostgresRefreshToken.created_at, "asc"), Query.orderBy(Query.collate(authPostgresRefreshToken.id, "C"), "asc"));
+        return execute(executor, plan).pipe(Effect.mapError((cause) => refreshTokenStoreError("list", cause)), Effect.map((rows) => rows.map(decodeRefreshToken)));
+    };
+    const updateRevoke = (row, revokedAt, reasonKey, reason) => execute(executor, update(authPostgresRefreshToken, {
+        revoked_at: millisParam(revokedAt),
+        metadata: reason === undefined
+            ? (row.metadata ?? null)
+            : { ...row.metadata, [reasonKey]: reason },
+    }).pipe(Query.where(eq(authPostgresRefreshToken.id, row.id)))).pipe(Effect.asVoid);
+    return RefreshTokenStore.of({
+        insert: (row) => execute(executor, insert(authPostgresRefreshToken, refreshTokenValues(row))).pipe(Effect.mapError((cause) => refreshTokenStoreError("insert", cause)), Effect.asVoid),
+        findById: (id) => find(authPostgresRefreshToken.id, id),
+        findBySecretHash: (hash) => find(authPostgresRefreshToken.secret_hash, hash),
+        listByUser: (input) => list(authPostgresRefreshToken.user_id, input.userId, input.includeRevoked),
+        listByFamily: (input) => list(authPostgresRefreshToken.family_id, input.familyId, input.includeRevoked),
+        rotate: (input) => sql
+            .withTransaction(Effect.gen(function* () {
+            const currentRows = yield* execute(executor, selectForUpdate(refreshTokenSelection, authPostgresRefreshToken, eq(authPostgresRefreshToken.id, input.id)));
+            const [current] = currentRows;
+            if (current === undefined ||
+                current.rotatedAt !== null ||
+                current.revokedAt !== null) {
+                return Option.none();
+            }
+            const previousRows = yield* execute(executor, update(authPostgresRefreshToken, {
+                last_used_at: millisParam(input.rotatedAt),
+                rotated_at: millisParam(input.rotatedAt),
+                replaced_by_id: input.replacement.id,
+            }).pipe(Query.where(eq(authPostgresRefreshToken.id, input.id)), Query.returning(refreshTokenSelection)));
+            const { replacement } = input;
+            const replacementRows = yield* execute(executor, insert(authPostgresRefreshToken, refreshTokenValues(replacement)).pipe(Query.returning(refreshTokenSelection)));
+            return Option.some({
+                previous: decodeRefreshToken(previousRows[0]),
+                replacement: decodeRefreshToken(replacementRows[0]),
+            });
+        }))
+            .pipe(Effect.mapError((cause) => refreshTokenStoreError("rotate", cause))),
+        markReuseDetected: (input) => execute(executor, update(authPostgresRefreshToken, {
+            reuse_detected_at: millisParam(input.reuseDetectedAt),
+        }).pipe(Query.where(eq(authPostgresRefreshToken.id, input.id)), Query.returning(refreshTokenSelection))).pipe(Effect.mapError((cause) => refreshTokenStoreError("reuse", cause)), Effect.map((rows) => firstOption(rows, decodeRefreshToken))),
+        revoke: (input) => find(authPostgresRefreshToken.id, input.id, "revoke").pipe(Effect.flatMap((found) => Option.isNone(found)
+            ? Effect.void
+            : updateRevoke(found.value, input.revokedAt, "revokeReason", input.reason)), Effect.mapError((cause) => cause instanceof RefreshTokenStoreError
+            ? cause
+            : refreshTokenStoreError("revoke", cause))),
+        revokeFamily: (input) => execute(executor, update(authPostgresRefreshToken, {
+            revoked_at: millisParam(input.revokedAt),
+            ...(input.reason === undefined
+                ? {}
+                : {
+                    metadata: metadataWithReason(authPostgresRefreshToken.metadata, "familyRevokeReason", input.reason),
+                }),
+        }).pipe(Query.where(eq(authPostgresRefreshToken.family_id, input.familyId)))).pipe(Effect.asVoid, Effect.mapError((cause) => refreshTokenStoreError("revoke", cause))),
+    });
+};
+export const makeEffectQbPostgresOAuthAccountStore = (executor, _sql) => {
+    const find = (plan, operation = "find") => execute(executor, plan).pipe(Effect.mapError((cause) => oauthAccountStoreError(operation, cause)), Effect.map((rows) => firstOption(rows, decodeOAuthAccount)));
+    return OAuthAccountStore.of({
+        insert: (row) => execute(executor, insert(authPostgresOAuthAccount, oauthAccountValues(row))).pipe(Effect.mapError((cause) => oauthAccountStoreError("insert", cause)), Effect.asVoid),
+        findById: (id) => find(Query.select(oauthAccountSelection).pipe(Query.from(authPostgresOAuthAccount), Query.where(eq(authPostgresOAuthAccount.id, id)))),
+        findByProviderAccount: (input) => {
+            let plan = Query.select(oauthAccountSelection).pipe(Query.from(authPostgresOAuthAccount), Query.where(eq(authPostgresOAuthAccount.provider_id, input.providerId)), Query.where(eq(authPostgresOAuthAccount.provider_account_id, input.providerAccountId)));
+            if (input.includeUnlinked !== true) {
+                plan = plan.pipe(Query.where(isNull(authPostgresOAuthAccount.unlinked_at)));
+            }
+            return find(plan);
+        },
+        listByUser: (input) => {
+            let plan = Query.select(oauthAccountSelection).pipe(Query.from(authPostgresOAuthAccount), Query.where(eq(authPostgresOAuthAccount.user_id, input.userId)));
+            if (input.includeUnlinked !== true) {
+                plan = plan.pipe(Query.where(isNull(authPostgresOAuthAccount.unlinked_at)));
+            }
+            plan = plan.pipe(Query.orderBy(authPostgresOAuthAccount.created_at, "asc"), Query.orderBy(Query.collate(authPostgresOAuthAccount.id, "C"), "asc"));
+            return execute(executor, plan).pipe(Effect.mapError((cause) => oauthAccountStoreError("list", cause)), Effect.map((rows) => rows.map(decodeOAuthAccount)));
+        },
+        unlink: (input) => execute(executor, update(authPostgresOAuthAccount, {
+            unlinked_at: millisParam(input.unlinkedAt),
+            ...(input.reason === undefined
+                ? {}
+                : {
+                    metadata: metadataWithReason(authPostgresOAuthAccount.metadata, "unlinkReason", input.reason),
+                }),
+        }).pipe(Query.where(eq(authPostgresOAuthAccount.provider_id, input.providerId)), Query.where(eq(authPostgresOAuthAccount.provider_account_id, input.providerAccountId)), Query.where(isNull(authPostgresOAuthAccount.unlinked_at)), Query.returning({
+            ...oauthAccountSelection,
+            unlinkedAt: withoutNullRefinement(authPostgresOAuthAccount.unlinked_at),
+        }))).pipe(Effect.mapError((cause) => oauthAccountStoreError("unlink", cause)), Effect.map((rows) => firstOption(rows, decodeOAuthAccount))),
+    });
+};
+const oauthClientRedirectUriValidationResult = (client, input) => {
+    if (client === undefined) {
+        return { valid: false, reason: "unknown_client" };
+    }
+    if (client.status !== "active") {
+        return { valid: false, reason: "disabled_client" };
+    }
+    if (!client.allowedResponseTypes.includes(input.responseType ?? "code")) {
+        return { valid: false, reason: "unsupported_response_type" };
+    }
+    if (input.grantType !== undefined &&
+        !client.allowedGrantTypes.includes(input.grantType)) {
+        return { valid: false, reason: "unsupported_grant_type" };
+    }
+    if (!client.redirectUris.includes(input.redirectUri)) {
+        return { valid: false, reason: "redirect_uri_mismatch" };
+    }
+    return { valid: true, client };
+};
+export const makeEffectQbPostgresOAuthClientStore = (executor) => {
+    const find = (clientId, operation = "find") => {
+        const mapError = (cause) => oauthClientStoreError(operation, cause);
+        return executeMapped(executor, () => Query.select(oauthClientSelection).pipe(Query.from(authPostgresOAuthClient), Query.where(eq(authPostgresOAuthClient.id, clientId))), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeOAuthClient), mapError)));
+    };
+    return OAuthClientStore.of({
+        upsert: (record) => {
+            const mapError = (cause) => oauthClientStoreError("upsert", cause);
+            return executeMapped(executor, () => {
+                const values = oauthClientValues(record);
+                return insert(authPostgresOAuthClient, values).pipe(PostgresQuery.onConflict("id", {
+                    update: {
+                        type: values.type,
+                        status: values.status,
+                        name: values.name,
+                        redirect_uris: values.redirect_uris,
+                        allowed_grant_types: values.allowed_grant_types,
+                        allowed_response_types: values.allowed_response_types,
+                        allowed_scopes: values.allowed_scopes,
+                        created_at: values.created_at,
+                        updated_at: values.updated_at,
+                        metadata: values.metadata,
+                    },
+                }));
+            }, mapError).pipe(Effect.asVoid);
+        },
+        find: (input) => find(input.clientId),
+        list: (input = {}) => {
+            const mapError = (cause) => oauthClientStoreError("list", cause);
+            return executeMapped(executor, () => {
+                let plan = Query.select(oauthClientSelection).pipe(Query.from(authPostgresOAuthClient), Query.orderBy(Query.collate(authPostgresOAuthClient.id, "C"), "asc"));
+                if (input.includeDisabled !== true) {
+                    plan = plan.pipe(Query.where(eq(authPostgresOAuthClient.status, "active")));
+                }
+                return plan;
+            }, mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => rows.map(decodeOAuthClient), mapError)));
+        },
+        validateRedirectUri: (input) => find(input.clientId, "validate-redirect-uri").pipe(Effect.map((client) => oauthClientRedirectUriValidationResult(Option.isSome(client) ? client.value : undefined, input))),
+    });
+};
+const oauthConsentIsActive = (record, input) => record.revokedAt === undefined &&
+    (record.expiresAt === undefined || record.expiresAt > input.now) &&
+    (input.scopes ?? []).every((scope) => record.scopes.includes(scope));
+export const makeEffectQbPostgresOAuthConsentStore = (executor) => {
+    const find = (input, operation = "find-active") => {
+        const mapError = (cause) => oauthConsentStoreError(operation, cause);
+        return executeMapped(executor, () => Query.select(oauthConsentSelection).pipe(Query.from(authPostgresOAuthConsent), Query.where(eq(authPostgresOAuthConsent.user_id, input.userId)), Query.where(eq(authPostgresOAuthConsent.client_id, input.clientId))), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeOAuthConsent), mapError)));
+    };
+    return OAuthConsentStore.of({
+        upsert: (record) => {
+            const mapError = (cause) => oauthConsentStoreError("upsert", cause);
+            return executeMapped(executor, () => {
+                const values = oauthConsentValues(record);
+                return insert(authPostgresOAuthConsent, values).pipe(PostgresQuery.onConflict(["user_id", "client_id"], {
+                    update: {
+                        scopes: values.scopes,
+                        granted_at: values.granted_at,
+                        expires_at: values.expires_at,
+                        revoked_at: values.revoked_at,
+                        metadata: values.metadata,
+                    },
+                }));
+            }, mapError).pipe(Effect.asVoid);
+        },
+        findActive: (input) => find(input).pipe(Effect.map((record) => Option.isSome(record) && oauthConsentIsActive(record.value, input)
+            ? record
+            : Option.none())),
+        listForUser: (input) => {
+            const mapError = (cause) => oauthConsentStoreError("list-for-user", cause);
+            return executeMapped(executor, () => Query.select(oauthConsentSelection).pipe(Query.from(authPostgresOAuthConsent), Query.where(eq(authPostgresOAuthConsent.user_id, input.userId)), Query.orderBy(authPostgresOAuthConsent.granted_at, "asc"), Query.orderBy(Query.collate(authPostgresOAuthConsent.client_id, "C"), "asc")), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => rows
+                .map(decodeOAuthConsent)
+                .filter((record) => input.includeInactive === true ||
+                oauthConsentIsActive(record, input)), mapError)));
+        },
+        revoke: (input) => {
+            const mapError = (cause) => oauthConsentStoreError("revoke", cause);
+            return executeMapped(executor, () => update(authPostgresOAuthConsent, {
+                revoked_at: Query.coalesce(authPostgresOAuthConsent.revoked_at, millisParam(input.revokedAt)),
+                ...(input.reason === undefined
+                    ? {}
+                    : {
+                        metadata: metadataWithReason(authPostgresOAuthConsent.metadata, "revokeReason", input.reason),
+                    }),
+            }).pipe(Query.where(eq(authPostgresOAuthConsent.user_id, input.userId)), Query.where(eq(authPostgresOAuthConsent.client_id, input.clientId)), Query.returning(oauthConsentSelection)), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeOAuthConsent), mapError)));
+        },
+        deleteInactive: (input) => {
+            const mapError = (cause) => oauthConsentStoreError("deleteInactive", cause);
+            return executeMapped(executor, () => {
+                const predicates = [
+                    ...(input.beforeExpiresAt === undefined
+                        ? []
+                        : [
+                            lt(authPostgresOAuthConsent.expires_at, millisParam(input.beforeExpiresAt)),
+                        ]),
+                    ...(input.beforeRevokedAt === undefined
+                        ? []
+                        : [
+                            lt(authPostgresOAuthConsent.revoked_at, millisParam(input.beforeRevokedAt)),
+                        ]),
+                ];
+                return Query.delete(authPostgresOAuthConsent).pipe(Query.where(predicates.length === 1
+                    ? predicates[0]
+                    : or(predicates[0], predicates[1])), Query.returning({ clientId: authPostgresOAuthConsent.client_id }));
+            }, mapError).pipe(Effect.map((rows) => rows.length));
+        },
+    });
+};
+export const makeEffectQbPostgresOAuthAuthorizationCodeStore = (executor, sql) => {
+    const find = (codeHash, operation = "find") => {
+        const mapError = (cause) => oauthAuthorizationCodeStoreError(operation, cause);
+        return executeMapped(executor, () => Query.select(oauthAuthorizationCodeSelection).pipe(Query.from(authPostgresOAuthAuthorizationCode), Query.where(eq(authPostgresOAuthAuthorizationCode.code_hash, codeHash))), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeOAuthAuthorizationCode), mapError)));
+    };
+    return OAuthAuthorizationCodeStore.of({
+        upsert: (record) => {
+            const mapError = (cause) => oauthAuthorizationCodeStoreError("upsert", cause);
+            return executeMapped(executor, () => {
+                const values = oauthAuthorizationCodeValues(record);
+                return insert(authPostgresOAuthAuthorizationCode, values).pipe(PostgresQuery.onConflict("code_hash", {
+                    update: {
+                        client_id: values.client_id,
+                        subject: values.subject,
+                        redirect_uri: values.redirect_uri,
+                        scopes: values.scopes,
+                        code_challenge: values.code_challenge,
+                        code_challenge_method: values.code_challenge_method,
+                        issued_at: values.issued_at,
+                        expires_at: values.expires_at,
+                        consumed_at: values.consumed_at,
+                        metadata: values.metadata,
+                    },
+                }));
+            }, mapError).pipe(Effect.asVoid);
+        },
+        findByHash: (input) => find(input.codeHash),
+        markConsumed: (input) => {
+            const mapError = (cause) => oauthAuthorizationCodeStoreError("mark-consumed", cause);
+            return sql
+                .withTransaction(Effect.gen(function* () {
+                const selected = yield* executeMapped(executor, () => selectForUpdate(oauthAuthorizationCodeSelection, authPostgresOAuthAuthorizationCode, eq(authPostgresOAuthAuthorizationCode.code_hash, input.codeHash)), mapError);
+                const existing = yield* decodeMapped(() => firstOption(selected, decodeOAuthAuthorizationCode), mapError);
+                if (Option.isNone(existing)) {
+                    return { status: "missing" };
+                }
+                if (existing.value.consumedAt !== undefined) {
+                    return {
+                        status: "already_consumed",
+                        record: existing.value,
+                    };
+                }
+                const rows = yield* executeMapped(executor, () => update(authPostgresOAuthAuthorizationCode, {
+                    consumed_at: millisParam(input.consumedAt),
+                }).pipe(Query.where(eq(authPostgresOAuthAuthorizationCode.code_hash, input.codeHash)), Query.where(isNull(authPostgresOAuthAuthorizationCode.consumed_at)), Query.returning({
+                    ...oauthAuthorizationCodeSelection,
+                    consumedAt: withoutNullRefinement(authPostgresOAuthAuthorizationCode.consumed_at),
+                })), mapError);
+                return yield* decodeMapped(() => ({
+                    status: "consumed",
+                    record: decodeOAuthAuthorizationCode(rows[0]),
+                }), mapError);
+            }))
+                .pipe(Effect.mapError((cause) => cause instanceof OAuthAuthorizationCodeStoreError
+                ? cause
+                : mapError(cause)));
+        },
+    });
+};
+export const makeEffectQbPostgresOAuthDeviceAuthorizationStore = (executor, sql) => {
+    const find = (column, value, operation) => {
+        const mapError = (cause) => oauthDeviceAuthorizationStoreError(operation, cause);
+        return executeMapped(executor, () => Query.select(oauthDeviceAuthorizationSelection).pipe(Query.from(authPostgresOAuthDeviceAuthorization), Query.where(eq(column, value))), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeOAuthDeviceAuthorization), mapError)));
+    };
+    const selectedColumns = `
+    case when u.id is null then c.id else u.id end as id,
+    case when u.id is null then c.device_code_hash else u.device_code_hash end as device_code_hash,
+    case when u.id is null then c.user_code_hash else u.user_code_hash end as user_code_hash,
+    case when u.id is null then c.client_id else u.client_id end as client_id,
+    case when u.id is null then c.requested_scopes else u.requested_scopes end as requested_scopes,
+    case when u.id is null then c.granted_scopes else u.granted_scopes end as granted_scopes,
+    case when u.id is null then c.subject else u.subject end as subject,
+    case when u.id is null then c.status else u.status end as status,
+    case when u.id is null then c.issued_at else u.issued_at end as issued_at,
+    case when u.id is null then c.expires_at else u.expires_at end as expires_at,
+    case when u.id is null then c.poll_interval_seconds else u.poll_interval_seconds end as poll_interval_seconds,
+    case when u.id is null then c.next_poll_at else u.next_poll_at end as next_poll_at,
+    case when u.id is null then c.last_polled_at else u.last_polled_at end as last_polled_at,
+    case when u.id is null then c.approved_at else u.approved_at end as approved_at,
+    case when u.id is null then c.denied_at else u.denied_at end as denied_at,
+    case when u.id is null then c.consumed_at else u.consumed_at end as consumed_at,
+    case when u.id is null then c.metadata else u.metadata end as metadata`;
+    return OAuthDeviceAuthorizationStore.of({
+        insert: (record) => Effect.suspend(() => execute(executor, insert(authPostgresOAuthDeviceAuthorization, oauthDeviceAuthorizationValues(record)).pipe(Query.returning({ id: authPostgresOAuthDeviceAuthorization.id })))).pipe(Effect.as(true), Effect.catch((error) => postgresErrorDetails(error).code === "23505"
+            ? Effect.succeed(false)
+            : Effect.fail(oauthDeviceAuthorizationStoreError("insert", error)))),
+        findByDeviceCodeHash: (input) => find(authPostgresOAuthDeviceAuthorization.device_code_hash, input.deviceCodeHash, "find-by-device-code-hash"),
+        findByUserCodeHash: (input) => find(authPostgresOAuthDeviceAuthorization.user_code_hash, input.userCodeHash, "find-by-user-code-hash"),
+        findById: (id) => find(authPostgresOAuthDeviceAuthorization.id, id, "find-by-id"),
+        decide: (input) => {
+            const mapError = (cause) => oauthDeviceAuthorizationStoreError("decide", cause);
+            const status = input.decision === "approve" ? "approved" : "denied";
+            const subject = input.decision === "approve" ? input.subject : null;
+            const grantedScopes = input.decision === "approve"
+                ? JSON.stringify(input.grantedScopes)
+                : null;
+            return sql
+                .unsafe(`with candidate as materialized (
+  select * from auth_oauth_device_authorization where id = $1 for update
+), updated as (
+  update auth_oauth_device_authorization d set
+    status = $3,
+    subject = $4,
+    granted_scopes = $5::jsonb,
+    approved_at = case when $3 = 'approved' then $2::bigint else null end,
+    denied_at = case when $3 = 'denied' then $2::bigint else null end,
+    metadata = coalesce($6::jsonb, c.metadata)
+  from candidate c
+  where d.id = c.id and c.status = 'pending' and c.expires_at > $2::bigint
+  returning d.*
+)
+select
+  case when u.id is not null then $3 when c.expires_at <= $2::bigint then 'expired' else 'already_decided' end as action,
+  ${selectedColumns}
+from candidate c left join updated u on true`, [
+                input.id,
+                millisParam(input.decidedAt),
+                status,
+                subject,
+                grantedScopes,
+                input.metadata === undefined
+                    ? null
+                    : JSON.stringify(input.metadata),
+            ])
+                .pipe(Effect.mapError(mapError), Effect.flatMap((rows) => decodeMapped(() => {
+                const [row] = rows;
+                if (row === undefined) {
+                    return { status: "missing" };
+                }
+                const record = decodeOAuthDeviceAuthorization(row);
+                if (row.action === "expired") {
+                    return { status: "expired", record };
+                }
+                if (row.action === "already_decided") {
+                    return {
+                        status: "already_decided",
+                        record: record,
+                    };
+                }
+                return record.status === "approved"
+                    ? { status: "approved", record }
+                    : {
+                        status: "denied",
+                        record: record,
+                    };
+            }, mapError)));
+        },
+        poll: (input) => {
+            const mapError = (cause) => oauthDeviceAuthorizationStoreError("poll", cause);
+            return sql
+                .unsafe(`with candidate as materialized (
+  select d.*,
+    case
+      when d.consumed_at is not null then 'already_consumed'
+      when d.expires_at <= $3::bigint then 'expired'
+      when d.status = 'denied' then 'denied'
+      when d.status = 'approved' then 'approved'
+      when d.next_poll_at > $3::bigint then 'slow_down'
+      when d.status = 'pending' then 'pending'
+      else 'pending'
+    end as action
+  from auth_oauth_device_authorization d
+  where d.device_code_hash = $1 and d.client_id = $2
+  for update
+), updated as (
+  update auth_oauth_device_authorization d set
+    poll_interval_seconds = case when c.action = 'slow_down' then c.poll_interval_seconds + 5 else c.poll_interval_seconds end,
+    next_poll_at = $3::bigint + (case when c.action = 'slow_down' then c.poll_interval_seconds + 5 else c.poll_interval_seconds end) * 1000,
+    last_polled_at = $3::bigint
+  from candidate c
+  where d.id = c.id and c.action in ('slow_down', 'pending')
+  returning d.*
+)
+select c.action, ${selectedColumns}
+from candidate c left join updated u on true`, [input.deviceCodeHash, input.clientId, millisParam(input.now)])
+                .pipe(Effect.mapError(mapError), Effect.flatMap((rows) => decodeMapped(() => {
+                const [row] = rows;
+                if (row === undefined) {
+                    return { status: "missing" };
+                }
+                const record = decodeOAuthDeviceAuthorization(row);
+                switch (row.action) {
+                    case "expired": {
+                        return { status: "expired", record };
+                    }
+                    case "denied": {
+                        return {
+                            status: "denied",
+                            record: record,
+                        };
+                    }
+                    case "already_consumed": {
+                        return {
+                            status: "already_consumed",
+                            record: record,
+                        };
+                    }
+                    case "slow_down": {
+                        return {
+                            status: "slow_down",
+                            record,
+                            interval: record.pollIntervalSeconds,
+                        };
+                    }
+                    case "pending": {
+                        return {
+                            status: "pending",
+                            record: record,
+                        };
+                    }
+                    default: {
+                        return {
+                            status: "approved",
+                            record: record,
+                        };
+                    }
+                }
+            }, mapError)));
+        },
+        deleteExpired: (input) => {
+            const mapError = (cause) => oauthDeviceAuthorizationStoreError("delete-expired", cause);
+            return executeMapped(executor, () => Query.delete(authPostgresOAuthDeviceAuthorization).pipe(Query.where(lte(authPostgresOAuthDeviceAuthorization.expires_at, millisParam(input.beforeExpiresAt))), Query.returning({ id: authPostgresOAuthDeviceAuthorization.id })), mapError).pipe(Effect.map((rows) => rows.length));
+        },
+    });
+};
+export const makeEffectQbPostgresOAuthDeviceCodeTokenCommitStore = (sql) => {
+    const executor = makeEffectQbPostgresExecutor(sql);
+    const mapError = oauthDeviceCodeTokenCommitStoreError;
+    return OAuthDeviceCodeTokenCommitStore.of({
+        commit: (input) => sql
+            .withTransaction(Effect.gen(function* () {
+            const selected = yield* executeMapped(executor, () => selectForUpdate(oauthDeviceAuthorizationSelection, authPostgresOAuthDeviceAuthorization, eq(authPostgresOAuthDeviceAuthorization.id, input.authorization.id)), mapError);
+            const existing = yield* decodeMapped(() => selected[0] === undefined
+                ? undefined
+                : decodeOAuthDeviceAuthorization(selected[0]), mapError);
+            if (existing === undefined) {
+                return { status: "missing" };
+            }
+            if (existing.status !== "approved") {
+                return { status: "missing" };
+            }
+            if (existing.consumedAt !== undefined) {
+                return {
+                    status: "already_consumed",
+                    record: existing,
+                };
+            }
+            const expected = input.authorization;
+            const sameArray = (left, right) => left.length === right.length &&
+                left.every((value, index) => value === right[index]);
+            const matchesApprovedSnapshot = existing.id === expected.id &&
+                existing.deviceCodeHash === expected.deviceCodeHash &&
+                existing.userCodeHash === expected.userCodeHash &&
+                existing.clientId === expected.clientId &&
+                sameArray(existing.requestedScopes, expected.requestedScopes) &&
+                existing.subject === expected.subject &&
+                sameArray(existing.grantedScopes, expected.grantedScopes) &&
+                Number(existing.issuedAt) === Number(expected.issuedAt) &&
+                Number(existing.expiresAt) === Number(expected.expiresAt) &&
+                existing.pollIntervalSeconds === expected.pollIntervalSeconds &&
+                Number(existing.nextPollAt) === Number(expected.nextPollAt) &&
+                (existing.lastPolledAt === undefined
+                    ? expected.lastPolledAt === undefined
+                    : Number(existing.lastPolledAt) ===
+                        Number(expected.lastPolledAt)) &&
+                Number(existing.approvedAt) === Number(expected.approvedAt) &&
+                JSON.stringify(existing.metadata ?? null) ===
+                    JSON.stringify(expected.metadata ?? null);
+            if (!matchesApprovedSnapshot) {
+                return { status: "missing" };
+            }
+            if (Number(existing.expiresAt) <= Number(input.consumedAt)) {
+                return {
+                    status: "expired",
+                    record: existing,
+                };
+            }
+            yield* Effect.forEach(input.tokenRecords, (record) => executeMapped(executor, () => insert(authPostgresOAuthProviderModeToken, oauthProviderModeTokenValues(record)), mapError), { discard: true });
+            const updated = yield* executeMapped(executor, () => update(authPostgresOAuthDeviceAuthorization, {
+                consumed_at: millisParam(input.consumedAt),
+                last_polled_at: millisParam(input.consumedAt),
+                next_poll_at: millisParam(UnixMillis(Number(input.consumedAt) +
+                    existing.pollIntervalSeconds * 1000)),
+            }).pipe(Query.where(eq(authPostgresOAuthDeviceAuthorization.id, input.authorization.id)), Query.where(eq(authPostgresOAuthDeviceAuthorization.status, "approved")), Query.where(isNull(authPostgresOAuthDeviceAuthorization.consumed_at)), Query.where(gt(authPostgresOAuthDeviceAuthorization.expires_at, millisParam(input.consumedAt))), Query.returning({
+                ...oauthDeviceAuthorizationSelection,
+                consumedAt: withoutNullRefinement(authPostgresOAuthDeviceAuthorization.consumed_at),
+            })), mapError);
+            return yield* decodeMapped(() => {
+                const [row] = updated;
+                if (row === undefined) {
+                    throw new Error("OAuth device authorization consume CAS failed");
+                }
+                return {
+                    status: "committed",
+                    record: decodeOAuthDeviceAuthorization(row),
+                };
+            }, mapError);
+        }))
+            .pipe(Effect.mapError((cause) => cause instanceof OAuthDeviceCodeTokenCommitStoreError
+            ? cause
+            : mapError(cause))),
+    });
+};
+export const makeEffectQbPostgresOAuthClientSecretStore = (executor) => {
+    const find = (input, operation = "find") => {
+        const mapError = (cause) => oauthClientSecretStoreError(operation, cause);
+        return executeMapped(executor, () => Query.select(oauthClientSecretSelection).pipe(Query.from(authPostgresOAuthClientSecret), Query.where(eq(authPostgresOAuthClientSecret.client_id, input.clientId)), Query.where(eq(authPostgresOAuthClientSecret.prefix, input.prefix))), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeOAuthClientSecret), mapError)));
+    };
+    return OAuthClientSecretStore.of({
+        upsert: (record) => {
+            const mapError = (cause) => oauthClientSecretStoreError("upsert", cause);
+            return executeMapped(executor, () => {
+                const values = oauthClientSecretValues(record);
+                return insert(authPostgresOAuthClientSecret, values).pipe(PostgresQuery.onConflict(["client_id", "prefix"], {
+                    update: {
+                        secret_hash: values.secret_hash,
+                        authentication_methods: values.authentication_methods,
+                        created_at: values.created_at,
+                        expires_at: values.expires_at,
+                        last_used_at: values.last_used_at,
+                        revoked_at: values.revoked_at,
+                        metadata: values.metadata,
+                    },
+                }));
+            }, mapError).pipe(Effect.asVoid);
+        },
+        findByClientIdAndPrefix: (input) => find(input),
+        markUsed: (input) => {
+            const mapError = (cause) => oauthClientSecretStoreError("mark-used", cause);
+            return executeMapped(executor, () => update(authPostgresOAuthClientSecret, {
+                last_used_at: millisParam(input.lastUsedAt),
+                ...(input.metadata === undefined
+                    ? {}
+                    : { metadata: input.metadata }),
+            }).pipe(Query.where(eq(authPostgresOAuthClientSecret.client_id, input.clientId)), Query.where(eq(authPostgresOAuthClientSecret.prefix, input.prefix)), Query.where(isNull(authPostgresOAuthClientSecret.revoked_at)), Query.returning(oauthClientSecretSelection)), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeOAuthClientSecret), mapError)));
+        },
+        revoke: (input) => {
+            const mapError = (cause) => oauthClientSecretStoreError("revoke", cause);
+            return executeMapped(executor, () => update(authPostgresOAuthClientSecret, {
+                revoked_at: millisParam(input.revokedAt),
+                ...(input.reason === undefined
+                    ? {}
+                    : {
+                        metadata: metadataWithReason(authPostgresOAuthClientSecret.metadata, "revokeReason", input.reason),
+                    }),
+            }).pipe(Query.where(eq(authPostgresOAuthClientSecret.client_id, input.clientId)), Query.where(eq(authPostgresOAuthClientSecret.prefix, input.prefix)), Query.returning(oauthClientSecretSelection)), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeOAuthClientSecret), mapError)));
+        },
+    });
+};
+export const makeEffectQbPostgresOAuthProviderModeTokenStore = (executor) => {
+    const find = (tokenHash, operation = "find") => {
+        const mapError = (cause) => oauthProviderModeTokenStoreError(operation, cause);
+        return executeMapped(executor, () => Query.select(oauthProviderModeTokenSelection).pipe(Query.from(authPostgresOAuthProviderModeToken), Query.where(eq(authPostgresOAuthProviderModeToken.token_hash, tokenHash))), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeOAuthProviderModeToken), mapError)));
+    };
+    return OAuthProviderModeTokenStore.of({
+        upsert: (record) => {
+            const mapError = (cause) => oauthProviderModeTokenStoreError("upsert", cause);
+            return executeMapped(executor, () => {
+                const values = oauthProviderModeTokenValues(record);
+                return insert(authPostgresOAuthProviderModeToken, values).pipe(PostgresQuery.onConflict("token_hash", {
+                    update: {
+                        token_type: values.token_type,
+                        client_id: values.client_id,
+                        subject: values.subject,
+                        scopes: values.scopes,
+                        issued_at: values.issued_at,
+                        expires_at: values.expires_at,
+                        issuer: values.issuer,
+                        audience: values.audience,
+                        jwt_id: values.jwt_id,
+                        revoked_at: values.revoked_at,
+                        revocation_reason: values.revocation_reason,
+                        rotated_at: values.rotated_at,
+                        replaced_by_token_hash: values.replaced_by_token_hash,
+                        metadata: values.metadata,
+                    },
+                }));
+            }, mapError).pipe(Effect.asVoid);
+        },
+        findByHash: (input) => find(input.tokenHash),
+        revokeByHash: (input) => {
+            const mapError = (cause) => oauthProviderModeTokenStoreError("revoke", cause);
+            return executeMapped(executor, () => {
+                let plan = update(authPostgresOAuthProviderModeToken, {
+                    revoked_at: Query.coalesce(authPostgresOAuthProviderModeToken.revoked_at, millisParam(input.revokedAt)),
+                    ...(input.reason === undefined
+                        ? {}
+                        : {
+                            revocation_reason: Query.coalesce(authPostgresOAuthProviderModeToken.revocation_reason, input.reason),
+                        }),
+                }).pipe(Query.where(eq(authPostgresOAuthProviderModeToken.token_hash, input.tokenHash)));
+                if (input.tokenTypeHint !== undefined) {
+                    plan = plan.pipe(Query.where(eq(authPostgresOAuthProviderModeToken.token_type, input.tokenTypeHint)));
+                }
+                return plan.pipe(Query.returning(oauthProviderModeTokenSelection));
+            }, mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeOAuthProviderModeToken), mapError)));
+        },
+        rotateRefreshToken: (input) => {
+            const mapError = (cause) => oauthProviderModeTokenStoreError("rotate", cause);
+            return executeMapped(executor, () => update(authPostgresOAuthProviderModeToken, {
+                rotated_at: millisParam(input.rotatedAt),
+                replaced_by_token_hash: input.replacedByTokenHash,
+            }).pipe(Query.where(eq(authPostgresOAuthProviderModeToken.token_hash, input.tokenHash)), Query.where(eq(authPostgresOAuthProviderModeToken.token_type, "refresh_token")), Query.where(isNull(authPostgresOAuthProviderModeToken.revoked_at)), Query.where(isNull(authPostgresOAuthProviderModeToken.rotated_at)), Query.returning({
+                ...oauthProviderModeTokenSelection,
+                rotatedAt: withoutNullRefinement(authPostgresOAuthProviderModeToken.rotated_at),
+                replacedByTokenHash: withoutNullRefinement(authPostgresOAuthProviderModeToken.replaced_by_token_hash),
+            })), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeOAuthProviderModeToken), mapError)));
+        },
+        deleteRetired: (input) => {
+            const mapError = (cause) => oauthProviderModeTokenStoreError("deleteRetired", cause);
+            return executeMapped(executor, () => {
+                const predicates = [
+                    ...(input.beforeExpiresAt === undefined
+                        ? []
+                        : [
+                            lt(authPostgresOAuthProviderModeToken.expires_at, millisParam(input.beforeExpiresAt)),
+                        ]),
+                    ...(input.beforeRevokedAt === undefined
+                        ? []
+                        : [
+                            lt(authPostgresOAuthProviderModeToken.revoked_at, millisParam(input.beforeRevokedAt)),
+                        ]),
+                    ...(input.beforeRotatedAt === undefined
+                        ? []
+                        : [
+                            lt(authPostgresOAuthProviderModeToken.rotated_at, millisParam(input.beforeRotatedAt)),
+                        ]),
+                ];
+                return Query.delete(authPostgresOAuthProviderModeToken).pipe(Query.where(predicates.length === 1 ? predicates[0] : or(...predicates)), Query.returning({
+                    tokenHash: authPostgresOAuthProviderModeToken.token_hash,
+                }));
+            }, mapError).pipe(Effect.map((rows) => rows.length));
+        },
+    });
+};
+export const makeEffectQbPostgresOAuthProviderTokenVault = (executor) => {
+    const findActive = (accountId, operation) => {
+        const mapError = (cause) => oauthProviderTokenVaultError(operation, cause);
+        return executeMapped(executor, () => Query.select(oauthProviderTokenVaultSelection).pipe(Query.from(authPostgresOAuthProviderTokenVault), Query.where(eq(authPostgresOAuthProviderTokenVault.account_id, accountId)), Query.where(isNull(authPostgresOAuthProviderTokenVault.revoked_at))), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeOAuthProviderTokenVault), mapError)));
+    };
+    return OAuthProviderTokenVault.of({
+        upsert: (record) => {
+            // The executor error contains bound query parameters, including ciphertexts.
+            const mapError = (_cause) => oauthProviderTokenVaultError("upsert", new Error("Postgres OAuth provider token vault upsert failed"));
+            return executeMapped(executor, () => {
+                const values = oauthProviderTokenVaultValues(record);
+                return insert(authPostgresOAuthProviderTokenVault, values).pipe(PostgresQuery.onConflict("account_id", {
+                    update: {
+                        user_id: values.user_id,
+                        provider_id: values.provider_id,
+                        provider_account_id: values.provider_account_id,
+                        access_token_ciphertext: values.access_token_ciphertext,
+                        refresh_token_ciphertext: values.refresh_token_ciphertext,
+                        id_token_ciphertext: values.id_token_ciphertext,
+                        token_type: values.token_type,
+                        scopes: values.scopes,
+                        expires_at: values.expires_at,
+                        updated_at: values.updated_at,
+                        revoked_at: values.revoked_at,
+                        revocation_reason: values.revocation_reason,
+                    },
+                }));
+            }, mapError).pipe(Effect.asVoid);
+        },
+        refreshTokenForAccount: (input) => findActive(input.accountId, "refresh-token").pipe(Effect.map((record) => Option.isNone(record) ||
+            record.value.refreshTokenCiphertext === undefined
+            ? Option.none()
+            : Option.some(record.value.refreshTokenCiphertext))),
+        tokensForAccount: (input) => findActive(input.accountId, "tokens").pipe(Effect.map((record) => Option.isNone(record)
+            ? Option.none()
+            : Option.some(providerTokenVaultTokens(record.value)))),
+        markRevoked: (input) => {
+            const mapError = (cause) => oauthProviderTokenVaultError("mark-revoked", cause);
+            return executeMapped(executor, () => update(authPostgresOAuthProviderTokenVault, {
+                revoked_at: millisParam(input.revokedAt),
+                revocation_reason: input.reason,
+            }).pipe(Query.where(eq(authPostgresOAuthProviderTokenVault.account_id, input.accountId)), Query.returning(oauthProviderTokenVaultSelection)), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeOAuthProviderTokenVault), mapError)));
+        },
+    });
+};
+const permissionScopeKey = (scope) => [
+    scope?.type ?? "global",
+    scope?.id !== undefined,
+    scope?.id ?? "",
+];
+const comparePermissionText = (left, right) => left === right
+    ? 0
+    : left === undefined
+        ? -1
+        : right === undefined
+            ? 1
+            : left < right
+                ? -1
+                : 1;
+const comparePermissionScopes = (left, right) => {
+    if (left === undefined || right === undefined) {
+        return left === right ? 0 : left === undefined ? -1 : 1;
+    }
+    return (comparePermissionText(left.type, right.type) ||
+        comparePermissionText(left.id, right.id));
+};
+const permissionScopesMatchExactly = (left, right) => {
+    const leftKey = permissionScopeKey(left);
+    const rightKey = permissionScopeKey(right);
+    return leftKey.every((value, index) => value === rightKey[index]);
+};
+const permissionGrantIsActive = (grant, at) => grant.revokedAt === undefined &&
+    (grant.expiresAt === undefined || Number(grant.expiresAt) > Number(at));
+const comparePermissionGrants = (left, right) => comparePermissionText(left.subject.type, right.subject.type) ||
+    comparePermissionText(left.subject.id, right.subject.id) ||
+    comparePermissionText(left.permission, right.permission) ||
+    comparePermissionScopes(left.scope, right.scope);
+const compareRoleGrants = (left, right) => comparePermissionText(left.subject.type, right.subject.type) ||
+    comparePermissionText(left.subject.id, right.subject.id) ||
+    comparePermissionText(left.role, right.role) ||
+    comparePermissionScopes(left.scope, right.scope);
+const compareRolePermissions = (left, right) => comparePermissionText(left.role, right.role) ||
+    comparePermissionText(left.permission, right.permission) ||
+    comparePermissionText(left.scopeType, right.scopeType);
+export const makeEffectQbPostgresPermissionStore = (executor) => {
+    const findPermissionDefinition = (id, operation = "find_permission_definition") => {
+        const mapError = (cause) => permissionStoreError(operation, cause);
+        return executeMapped(executor, () => Query.select(permissionDefinitionSelection).pipe(Query.from(authPostgresPermissionDefinition), Query.where(eq(authPostgresPermissionDefinition.id, id))), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodePermissionDefinition), mapError)));
+    };
+    const findRoleDefinition = (id, operation = "find_role_definition") => {
+        const mapError = (cause) => permissionStoreError(operation, cause);
+        return executeMapped(executor, () => Query.select(roleDefinitionSelection).pipe(Query.from(authPostgresRoleDefinition), Query.where(eq(authPostgresRoleDefinition.id, id))), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeRoleDefinition), mapError)));
+    };
+    const mutatePermissionDefinition = (operation, input, makeValues) => {
+        const mapError = (cause) => permissionStoreError(operation, cause);
+        const returning = operation === "delete_permission_definition"
+            ? {
+                ...permissionDefinitionSelection,
+                deletedAt: withoutNullRefinement(authPostgresPermissionDefinition.deleted_at),
+            }
+            : permissionDefinitionSelection;
+        return executeMapped(executor, () => update(authPostgresPermissionDefinition, makeValues()).pipe(Query.where(eq(authPostgresPermissionDefinition.id, input.id)), Query.where(eq(authPostgresPermissionDefinition.updated_at, millisParam(input.expectedUpdatedAt))), Query.where(isNull(authPostgresPermissionDefinition.deleted_at)), Query.returning(returning)), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodePermissionDefinition), mapError)));
+    };
+    const mutateRoleDefinition = (operation, input, makeValues) => {
+        const mapError = (cause) => permissionStoreError(operation, cause);
+        const returning = operation === "delete_role_definition"
+            ? {
+                ...roleDefinitionSelection,
+                deletedAt: withoutNullRefinement(authPostgresRoleDefinition.deleted_at),
+            }
+            : roleDefinitionSelection;
+        return executeMapped(executor, () => update(authPostgresRoleDefinition, makeValues()).pipe(Query.where(eq(authPostgresRoleDefinition.id, input.id)), Query.where(eq(authPostgresRoleDefinition.updated_at, millisParam(input.expectedUpdatedAt))), Query.where(isNull(authPostgresRoleDefinition.deleted_at)), Query.returning(returning)), mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => firstOption(rows, decodeRoleDefinition), mapError)));
+    };
+    const checkResult = (operation, makeAllowed) => {
+        const mapError = (cause) => permissionStoreError(operation, cause);
+        return executeMapped(executor, () => Query.select({ allowed: makeAllowed() }), mapError).pipe(Effect.map((rows) => Boolean(rows[0]?.allowed)));
+    };
+    return PermissionStore.of({
+        createPermissionDefinition: (definition) => {
+            const mapError = (cause) => permissionStoreError("create_permission_definition", cause);
+            return executeMapped(executor, () => insert(authPostgresPermissionDefinition, permissionDefinitionValues(definition)).pipe(PostgresQuery.onConflict("id"), Query.returning(permissionDefinitionSelection)), mapError).pipe(Effect.map((rows) => rows.length > 0));
+        },
+        findPermissionDefinition: (id) => findPermissionDefinition(id),
+        listPermissionDefinitions: (input = {}) => {
+            const mapError = (cause) => permissionStoreError("list_permission_definitions", cause);
+            return executeMapped(executor, () => {
+                let plan = Query.select(permissionDefinitionSelection).pipe(Query.from(authPostgresPermissionDefinition));
+                if (input.includeDisabled !== true) {
+                    plan = plan.pipe(Query.where(isNull(authPostgresPermissionDefinition.disabled_at)));
+                }
+                if (input.includeDeleted !== true) {
+                    plan = plan.pipe(Query.where(isNull(authPostgresPermissionDefinition.deleted_at)));
+                }
+                if (input.after !== undefined) {
+                    plan = plan.pipe(Query.where(gt(Query.collate(authPostgresPermissionDefinition.id, "C"), input.after)));
+                }
+                return plan.pipe(Query.orderBy(Query.collate(authPostgresPermissionDefinition.id, "C"), "asc"), Query.limit(normalizePermissionDefinitionListLimit(input.limit)));
+            }, mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => rows.map(decodePermissionDefinition), mapError)));
+        },
+        updatePermissionDefinition: (input) => mutatePermissionDefinition("update_permission_definition", input, () => ({
+            ...(input.description === undefined
+                ? {}
+                : { description: input.description }),
+            ...(input.scopeType === undefined
+                ? {}
+                : {
+                    scope_type_present: input.scopeType !== null,
+                    scope_type: input.scopeType ?? "",
+                }),
+            updated_at: millisParam(input.updatedAt),
+        })),
+        setPermissionDefinitionDisabled: (input) => mutatePermissionDefinition("set_permission_definition_disabled", input, () => ({
+            disabled_at: input.disabledAt === undefined
+                ? null
+                : millisParam(input.disabledAt),
+            updated_at: millisParam(input.updatedAt),
+        })),
+        deletePermissionDefinition: (input) => mutatePermissionDefinition("delete_permission_definition", input, () => ({
+            deleted_at: millisParam(input.deletedAt),
+            updated_at: millisParam(input.updatedAt),
+        })),
+        createRoleDefinition: (definition) => {
+            const mapError = (cause) => permissionStoreError("create_role_definition", cause);
+            return executeMapped(executor, () => insert(authPostgresRoleDefinition, roleDefinitionValues(definition)).pipe(PostgresQuery.onConflict("id"), Query.returning(roleDefinitionSelection)), mapError).pipe(Effect.map((rows) => rows.length > 0));
+        },
+        findRoleDefinition: (id) => findRoleDefinition(id),
+        listRoleDefinitions: (input = {}) => {
+            const mapError = (cause) => permissionStoreError("list_role_definitions", cause);
+            return executeMapped(executor, () => {
+                let plan = Query.select(roleDefinitionSelection).pipe(Query.from(authPostgresRoleDefinition));
+                if (input.includeDisabled !== true) {
+                    plan = plan.pipe(Query.where(isNull(authPostgresRoleDefinition.disabled_at)));
+                }
+                if (input.includeDeleted !== true) {
+                    plan = plan.pipe(Query.where(isNull(authPostgresRoleDefinition.deleted_at)));
+                }
+                return plan;
+            }, mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => rows
+                .map(decodeRoleDefinition)
+                .sort((left, right) => comparePermissionText(left.id, right.id)), mapError)));
+        },
+        updateRoleDefinition: (input) => mutateRoleDefinition("update_role_definition", input, () => ({
+            ...(input.description === undefined
+                ? {}
+                : { description: input.description }),
+            updated_at: millisParam(input.updatedAt),
+        })),
+        setRoleDefinitionDisabled: (input) => mutateRoleDefinition("set_role_definition_disabled", input, () => ({
+            disabled_at: input.disabledAt === undefined ? null : millisParam(input.disabledAt),
+            updated_at: millisParam(input.updatedAt),
+        })),
+        deleteRoleDefinition: (input) => mutateRoleDefinition("delete_role_definition", input, () => ({
+            deleted_at: millisParam(input.deletedAt),
+            updated_at: millisParam(input.updatedAt),
+        })),
+        grantPermission: (input) => {
+            const mapError = (cause) => permissionStoreError("grant_permission", cause);
+            return executeMapped(executor, () => {
+                const scope = canonicalPermissionScope(input.scope);
+                const values = permissionGrantValues({
+                    ...input,
+                    ...(scope === undefined ? { scope: undefined } : { scope }),
+                });
+                return insert(authPostgresPermissionGrant, values).pipe(PostgresQuery.onConflict([
+                    "subject_type",
+                    "subject_id",
+                    "permission_id",
+                    "scope_type",
+                    "scope_id_present",
+                    "scope_id",
+                ], {
+                    update: {
+                        expires_at: values.expires_at,
+                        metadata: values.metadata,
+                        revoked_at: null,
+                    },
+                }));
+            }, mapError).pipe(Effect.asVoid);
+        },
+        revokePermission: (input) => {
+            const mapError = (cause) => permissionStoreError("revoke_permission", cause);
+            return executeMapped(executor, () => {
+                const [scopeType, scopeIdPresent, requestedScopeId] = permissionScopeKey(canonicalPermissionScope(input.scope));
+                return update(authPostgresPermissionGrant, {
+                    revoked_at: millisParam(input.revokedAt ?? UnixMillis(Date.now())),
+                }).pipe(Query.where(eq(authPostgresPermissionGrant.subject_type, input.subject.type)), Query.where(eq(authPostgresPermissionGrant.subject_id, input.subject.id)), Query.where(eq(authPostgresPermissionGrant.permission_id, input.permission)), Query.where(eq(authPostgresPermissionGrant.scope_type, scopeType)), Query.where(eq(authPostgresPermissionGrant.scope_id_present, scopeIdPresent)), Query.where(eq(authPostgresPermissionGrant.scope_id, requestedScopeId)));
+            }, mapError).pipe(Effect.asVoid);
+        },
+        listPermissionGrants: (input = {}) => Effect.suspend(() => {
+            const mapError = (cause) => permissionStoreError("list_permission_grants", cause);
+            const at = input.at ?? UnixMillis(Date.now());
+            const activity = input.activity ?? "active";
+            return executeMapped(executor, () => {
+                let plan = Query.select(permissionGrantSelection).pipe(Query.from(authPostgresPermissionGrant));
+                if (input.subject !== undefined) {
+                    plan = plan.pipe(Query.where(eq(authPostgresPermissionGrant.subject_type, input.subject.type)), Query.where(eq(authPostgresPermissionGrant.subject_id, input.subject.id)));
+                }
+                if (input.permission !== undefined) {
+                    plan = plan.pipe(Query.where(eq(authPostgresPermissionGrant.permission_id, input.permission)));
+                }
+                if (input.scope !== undefined) {
+                    const [scopeType, scopeIdPresent, requestedScopeId] = permissionScopeKey(canonicalPermissionScope(input.scope));
+                    plan = plan.pipe(Query.where(eq(authPostgresPermissionGrant.scope_type, scopeType)), Query.where(eq(authPostgresPermissionGrant.scope_id_present, scopeIdPresent)), Query.where(eq(authPostgresPermissionGrant.scope_id, requestedScopeId)));
+                }
+                return plan;
+            }, mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => rows
+                .map(decodePermissionGrant)
+                .filter((grant) => (input.scope === undefined ||
+                permissionScopesMatchExactly(grant.scope, input.scope)) &&
+                (activity === "all" ||
+                    permissionGrantIsActive(grant, at) ===
+                        (activity === "active")))
+                .sort(comparePermissionGrants), mapError)));
+        }),
+        grantRole: (input) => {
+            const mapError = (cause) => permissionStoreError("grant_role", cause);
+            return executeMapped(executor, () => {
+                const scope = canonicalPermissionScope(input.scope);
+                const values = roleGrantValues({
+                    ...input,
+                    ...(scope === undefined ? { scope: undefined } : { scope }),
+                });
+                return insert(authPostgresRoleGrant, values).pipe(PostgresQuery.onConflict([
+                    "subject_type",
+                    "subject_id",
+                    "role_id",
+                    "scope_type",
+                    "scope_id_present",
+                    "scope_id",
+                ], {
+                    update: {
+                        expires_at: values.expires_at,
+                        metadata: values.metadata,
+                        revoked_at: null,
+                    },
+                }));
+            }, mapError).pipe(Effect.asVoid);
+        },
+        revokeRole: (input) => {
+            const mapError = (cause) => permissionStoreError("revoke_role", cause);
+            return executeMapped(executor, () => {
+                const [scopeType, scopeIdPresent, requestedScopeId] = permissionScopeKey(canonicalPermissionScope(input.scope));
+                return update(authPostgresRoleGrant, {
+                    revoked_at: millisParam(input.revokedAt ?? UnixMillis(Date.now())),
+                }).pipe(Query.where(eq(authPostgresRoleGrant.subject_type, input.subject.type)), Query.where(eq(authPostgresRoleGrant.subject_id, input.subject.id)), Query.where(eq(authPostgresRoleGrant.role_id, input.role)), Query.where(eq(authPostgresRoleGrant.scope_type, scopeType)), Query.where(eq(authPostgresRoleGrant.scope_id_present, scopeIdPresent)), Query.where(eq(authPostgresRoleGrant.scope_id, requestedScopeId)));
+            }, mapError).pipe(Effect.asVoid);
+        },
+        listRoleGrants: (input = {}) => Effect.suspend(() => {
+            const mapError = (cause) => permissionStoreError("list_role_grants", cause);
+            const at = input.at ?? UnixMillis(Date.now());
+            const activity = input.activity ?? "active";
+            return executeMapped(executor, () => {
+                let plan = Query.select(roleGrantSelection).pipe(Query.from(authPostgresRoleGrant));
+                if (input.subject !== undefined) {
+                    plan = plan.pipe(Query.where(eq(authPostgresRoleGrant.subject_type, input.subject.type)), Query.where(eq(authPostgresRoleGrant.subject_id, input.subject.id)));
+                }
+                if (input.role !== undefined) {
+                    plan = plan.pipe(Query.where(eq(authPostgresRoleGrant.role_id, input.role)));
+                }
+                if (input.scope !== undefined) {
+                    const [scopeType, scopeIdPresent, requestedScopeId] = permissionScopeKey(canonicalPermissionScope(input.scope));
+                    plan = plan.pipe(Query.where(eq(authPostgresRoleGrant.scope_type, scopeType)), Query.where(eq(authPostgresRoleGrant.scope_id_present, scopeIdPresent)), Query.where(eq(authPostgresRoleGrant.scope_id, requestedScopeId)));
+                }
+                return plan;
+            }, mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => rows
+                .map(decodeRoleGrant)
+                .filter((grant) => (input.scope === undefined ||
+                permissionScopesMatchExactly(grant.scope, input.scope)) &&
+                (activity === "all" ||
+                    permissionGrantIsActive(grant, at) ===
+                        (activity === "active")))
+                .sort(compareRoleGrants), mapError)));
+        }),
+        assignRolePermission: (input) => {
+            const mapError = (cause) => permissionStoreError("assign_role_permission", cause);
+            return executeMapped(executor, () => insert(authPostgresRolePermission, rolePermissionValues(input)).pipe(PostgresQuery.onConflict([
+                "role_id",
+                "permission_id",
+                "scope_type_present",
+                "scope_type",
+            ])), mapError).pipe(Effect.asVoid);
+        },
+        removeRolePermission: (input) => {
+            const mapError = (cause) => permissionStoreError("remove_role_permission", cause);
+            return executeMapped(executor, () => Query.delete(authPostgresRolePermission).pipe(Query.where(eq(authPostgresRolePermission.role_id, input.role)), Query.where(eq(authPostgresRolePermission.permission_id, input.permission)), Query.where(eq(authPostgresRolePermission.scope_type_present, input.scopeType !== undefined)), Query.where(eq(authPostgresRolePermission.scope_type, input.scopeType ?? ""))), mapError).pipe(Effect.asVoid);
+        },
+        listRolePermissions: (input = {}) => {
+            const mapError = (cause) => permissionStoreError("list_role_permissions", cause);
+            return executeMapped(executor, () => {
+                let plan = Query.select(rolePermissionSelection).pipe(Query.from(authPostgresRolePermission));
+                if (input.role !== undefined) {
+                    plan = plan.pipe(Query.where(eq(authPostgresRolePermission.role_id, input.role)));
+                }
+                if (input.permission !== undefined) {
+                    plan = plan.pipe(Query.where(eq(authPostgresRolePermission.permission_id, input.permission)));
+                }
+                if (input.scopeType !== undefined) {
+                    plan = plan.pipe(Query.where(eq(authPostgresRolePermission.scope_type_present, input.scopeType !== null)));
+                    if (input.scopeType !== null) {
+                        plan = plan.pipe(Query.where(eq(authPostgresRolePermission.scope_type, input.scopeType)));
+                    }
+                }
+                return plan;
+            }, mapError).pipe(Effect.flatMap((rows) => decodeMapped(() => rows.map(decodeRolePermission).sort(compareRolePermissions), mapError)));
+        },
+        hasPermission: (input) => checkResult("has_permission", () => {
+            const now = millisParam(UnixMillis(Date.now()));
+            const [scopeType, scopeIdPresent, requestedScopeId] = permissionScopeKey(canonicalPermissionScope(input.scope));
+            const direct = exists(Query.select({ value: Query.literal(1) }).pipe(Query.from(authPostgresPermissionGrant), Query.where(eq(authPostgresPermissionGrant.subject_type, input.subject.type)), Query.where(eq(authPostgresPermissionGrant.subject_id, input.subject.id)), Query.where(eq(authPostgresPermissionGrant.permission_id, input.permission)), Query.where(isNull(authPostgresPermissionGrant.revoked_at)), Query.where(or(isNull(authPostgresPermissionGrant.expires_at), gt(authPostgresPermissionGrant.expires_at, now))), Query.where(or(and(eq(authPostgresPermissionGrant.scope_type, "global"), eq(authPostgresPermissionGrant.scope_id_present, false)), and(eq(authPostgresPermissionGrant.scope_type, scopeType), eq(authPostgresPermissionGrant.scope_id_present, scopeIdPresent), eq(authPostgresPermissionGrant.scope_id, requestedScopeId))))));
+            const rolePermission = exists(Query.select({ value: Query.literal(1) }).pipe(Query.from(authPostgresRolePermission), Query.where(eq(authPostgresRolePermission.role_id, authPostgresRoleGrant.role_id)), Query.where(eq(authPostgresRolePermission.permission_id, input.permission)), Query.where(or(eq(authPostgresRolePermission.scope_type_present, false), and(eq(authPostgresRolePermission.scope_type_present, true), eq(authPostgresRolePermission.scope_type, scopeType))))));
+            const role = exists(Query.select({ value: Query.literal(1) }).pipe(Query.from(authPostgresRoleGrant), Query.where(eq(authPostgresRoleGrant.subject_type, input.subject.type)), Query.where(eq(authPostgresRoleGrant.subject_id, input.subject.id)), Query.where(isNull(authPostgresRoleGrant.revoked_at)), Query.where(or(isNull(authPostgresRoleGrant.expires_at), gt(authPostgresRoleGrant.expires_at, now))), Query.where(or(and(eq(authPostgresRoleGrant.scope_type, "global"), eq(authPostgresRoleGrant.scope_id_present, false)), and(eq(authPostgresRoleGrant.scope_type, scopeType), eq(authPostgresRoleGrant.scope_id_present, scopeIdPresent), eq(authPostgresRoleGrant.scope_id, requestedScopeId)))), Query.where(rolePermission)));
+            return or(direct, role);
+        }),
+        hasRole: (input) => checkResult("has_role", () => {
+            const now = millisParam(UnixMillis(Date.now()));
+            const [scopeType, scopeIdPresent, requestedScopeId] = permissionScopeKey(canonicalPermissionScope(input.scope));
+            return exists(Query.select({ value: Query.literal(1) }).pipe(Query.from(authPostgresRoleGrant), Query.where(eq(authPostgresRoleGrant.subject_type, input.subject.type)), Query.where(eq(authPostgresRoleGrant.subject_id, input.subject.id)), Query.where(eq(authPostgresRoleGrant.role_id, input.role)), Query.where(isNull(authPostgresRoleGrant.revoked_at)), Query.where(or(isNull(authPostgresRoleGrant.expires_at), gt(authPostgresRoleGrant.expires_at, now))), Query.where(or(and(eq(authPostgresRoleGrant.scope_type, "global"), eq(authPostgresRoleGrant.scope_id_present, false)), and(eq(authPostgresRoleGrant.scope_type, scopeType), eq(authPostgresRoleGrant.scope_id_present, scopeIdPresent), eq(authPostgresRoleGrant.scope_id, requestedScopeId))))));
+        }),
+    });
+};
+const oauthBridgeReasonByConstraint = {
+    auth_user_pkey: "user-id",
+    auth_user_identity_pkey: "identity-id",
+    auth_user_identity_active_value_idx: "identity-value",
+    auth_oauth_account_pkey: "oauth-account-id",
+    auth_oauth_account_provider_account_key: "provider-account",
+};
+export const makeEffectQbPostgresOAuthIdentityBridgeStore = (sql) => {
+    const executor = makeEffectQbPostgresExecutor(sql);
+    return OAuthIdentityBridgeStore.of({
+        create: (input) => {
+            if (input.account.userId !== input.user.id ||
+                (input.identity !== undefined &&
+                    input.identity.userId !== input.user.id)) {
+                return Effect.fail(new OAuthIdentityBridgeConflictError({ reason: "user-id" }));
+            }
+            return sql
+                .withTransaction(Effect.gen(function* () {
+                const userRows = yield* execute(executor, insert(authPostgresUser, userValues(input.user)).pipe(Query.returning(userSelection)));
+                let identity;
+                if (input.identity !== undefined) {
+                    const row = input.identity;
+                    const identityRows = yield* execute(executor, insert(authPostgresUserIdentity, identityValues(row)).pipe(Query.returning(identitySelection)));
+                    identity = decodeIdentity(identityRows[0]);
+                }
+                const { account } = input;
+                const accountRows = yield* execute(executor, insert(authPostgresOAuthAccount, oauthAccountValues(account)).pipe(Query.returning(oauthAccountSelection)));
+                return {
+                    user: decodeUser(userRows[0]),
+                    ...(identity === undefined ? {} : { identity }),
+                    account: decodeOAuthAccount(accountRows[0]),
+                };
+            }))
+                .pipe(Effect.mapError((cause) => {
+                const details = postgresErrorDetails(cause);
+                const reason = details.code === "23505" && details.constraintName !== undefined
+                    ? oauthBridgeReasonByConstraint[details.constraintName]
+                    : undefined;
+                return reason === undefined
+                    ? new OAuthIdentityBridgeStoreError({
+                        message: "Atomic OAuth identity creation failed",
+                        cause,
+                    })
+                    : new OAuthIdentityBridgeConflictError({ reason });
+            }));
+        },
+    });
+};
+export const makeEffectQbPostgresCoreStores = (sql, options = {}) => {
+    const executor = makeEffectQbPostgresExecutor(sql);
+    const atomic = makeEffectQbPostgresAtomicPlanExecutor(sql);
+    return {
+        userStore: makeEffectQbPostgresUserStore(executor),
+        identityStore: makeEffectQbPostgresIdentityStore(executor, sql),
+        registrationStore: makeEffectQbPostgresRegistrationStore(atomic),
+        credentialStore: makeEffectQbPostgresCredentialStore(executor),
+        passkeyCredentialStore: makeEffectQbPostgresPasskeyCredentialStore(executor),
+        sessionStore: makeEffectQbPostgresSessionStore(executor),
+        verificationStore: makeEffectQbPostgresVerificationStore(executor, sql),
+        auditLogStore: makeEffectQbPostgresAuditLogStore(executor, sql),
+        loginApprovalReviewStore: makeEffectQbPostgresLoginApprovalReviewStore(executor),
+        loginRiskHistoryStore: makeEffectQbPostgresLoginRiskHistoryStore(executor, options.loginRiskHistory),
+        trustedDeviceStore: makeEffectQbPostgresTrustedDeviceStore(executor),
+        domainVerificationStore: makeEffectQbPostgresDomainVerificationStore(executor),
+        securityTimelineStore: makeEffectQbPostgresSecurityTimelineStore(executor),
+        webhookOutboxStore: makeEffectQbPostgresWebhookOutboxStore(executor, sql),
+        webhookReplayStore: makeEffectQbPostgresWebhookReplayStore(executor),
+        totpFactorStore: makeEffectQbPostgresTotpFactorStore(executor),
+        totpSessionRotateStore: makeEffectQbPostgresTotpSessionRotateStore(sql),
+        totpLoginCommitStore: makeEffectQbPostgresTotpLoginCommitStore(sql),
+        recoveryCodeStore: makeEffectQbPostgresRecoveryCodeStore(executor, sql),
+        recoveryCodeSessionRotateStore: makeEffectQbPostgresRecoveryCodeSessionRotateStore(sql),
+        recoveryCodeLoginCommitStore: makeEffectQbPostgresRecoveryCodeLoginCommitStore(sql),
+        apiKeyStore: makeEffectQbPostgresApiKeyStore(executor),
+        refreshTokenStore: makeEffectQbPostgresRefreshTokenStore(executor, sql),
+        jwtRevocationStore: makeEffectQbPostgresJwtRevocationStore(executor),
+        oauthAccountStore: makeEffectQbPostgresOAuthAccountStore(executor, sql),
+        oauthIdentityBridgeStore: makeEffectQbPostgresOAuthIdentityBridgeStore(sql),
+        oauthClientStore: makeEffectQbPostgresOAuthClientStore(executor),
+        oauthConsentStore: makeEffectQbPostgresOAuthConsentStore(executor),
+        oauthAuthorizationCodeStore: makeEffectQbPostgresOAuthAuthorizationCodeStore(executor, sql),
+        oauthDeviceAuthorizationStore: makeEffectQbPostgresOAuthDeviceAuthorizationStore(executor, sql),
+        oauthDeviceCodeTokenCommitStore: makeEffectQbPostgresOAuthDeviceCodeTokenCommitStore(sql),
+        oauthClientSecretStore: makeEffectQbPostgresOAuthClientSecretStore(executor),
+        oauthProviderModeTokenStore: makeEffectQbPostgresOAuthProviderModeTokenStore(executor),
+        oauthProviderTokenVault: makeEffectQbPostgresOAuthProviderTokenVault(executor),
+        permissionStore: makeEffectQbPostgresPermissionStore(executor),
+    };
+};
+export const EffectQbPostgresCoreStoresLive = (sql, options = {}) => {
+    const stores = makeEffectQbPostgresCoreStores(sql, options);
+    return Layer.mergeAll(Layer.succeed(UserStore)(stores.userStore), Layer.succeed(IdentityStore)(stores.identityStore), Layer.succeed(RegistrationStore)(stores.registrationStore), Layer.succeed(CredentialStore)(stores.credentialStore), Layer.succeed(PasskeyCredentialStore)(stores.passkeyCredentialStore), Layer.succeed(SessionStore)(stores.sessionStore), Layer.succeed(VerificationStore)(stores.verificationStore), Layer.succeed(AuditLogStore)(stores.auditLogStore), Layer.succeed(LoginApprovalReviewStore)(stores.loginApprovalReviewStore), Layer.succeed(LoginRiskHistory)(stores.loginRiskHistoryStore), Layer.succeed(TrustedDeviceStore)(stores.trustedDeviceStore), Layer.succeed(DomainVerificationStore)(stores.domainVerificationStore), Layer.succeed(SecurityTimelineStore)(stores.securityTimelineStore), Layer.succeed(WebhookOutboxStore)(stores.webhookOutboxStore), Layer.succeed(WebhookReplayStore)(stores.webhookReplayStore), Layer.succeed(TotpFactorStore)(stores.totpFactorStore), Layer.succeed(TotpSessionRotateStore)(stores.totpSessionRotateStore), Layer.succeed(TotpLoginCommitStore)(stores.totpLoginCommitStore), Layer.succeed(RecoveryCodeStore)(stores.recoveryCodeStore), Layer.succeed(RecoveryCodeSessionRotateStore)(stores.recoveryCodeSessionRotateStore), Layer.succeed(RecoveryCodeLoginCommitStore)(stores.recoveryCodeLoginCommitStore), Layer.succeed(ApiKeyStore)(stores.apiKeyStore), Layer.succeed(RefreshTokenStore)(stores.refreshTokenStore), Layer.succeed(JwtRevocationStore)(stores.jwtRevocationStore), Layer.succeed(OAuthAccountStore)(stores.oauthAccountStore), Layer.succeed(OAuthIdentityBridgeStore)(stores.oauthIdentityBridgeStore), Layer.succeed(OAuthClientStore)(stores.oauthClientStore), Layer.succeed(OAuthConsentStore)(stores.oauthConsentStore), Layer.succeed(OAuthAuthorizationCodeStore)(stores.oauthAuthorizationCodeStore), Layer.succeed(OAuthDeviceAuthorizationStore)(stores.oauthDeviceAuthorizationStore), Layer.succeed(OAuthDeviceCodeTokenCommitStore)(stores.oauthDeviceCodeTokenCommitStore), Layer.succeed(OAuthClientSecretStore)(stores.oauthClientSecretStore), Layer.succeed(OAuthProviderModeTokenStore)(stores.oauthProviderModeTokenStore), Layer.succeed(OAuthProviderTokenVault)(stores.oauthProviderTokenVault), Layer.succeed(PermissionStore)(stores.permissionStore));
+};
+//# sourceMappingURL=EffectQbPostgresStorage.js.map