@effect-auth/core 0.1.0-alpha.16 → 0.1.0-alpha.19

package/dist/EffectQbSqliteStorage.js

@@ -1,34 +1,60 @@
 import { Data, Effect, Layer, Option, Redacted } from "effect";
-import { Column, Query, Scalar, Table } from "effect-qb";
-import { Executor, Query as SqliteQuery } from "effect-qb/sqlite";
-import { AuditLogStore, AuditLogStoreError, auditEventActorUserId, auditEventUserId, filterAuditLogEvents, } from "./AuditLog.js";
+import { Column, Executor as EffectQbExecutor, Query, Scalar, Table, } from "effect-qb";
+import { Executor, Query as SqliteQuery, Renderer } from "effect-qb/sqlite";
 import { ApiKeyId, ApiKeyPrefix, ApiKeySecretHash, ApiKeyStore, ApiKeyStoreError, } from "./ApiKey.js";
+import { deriveAssurance, deriveMfaVerifiedAt, parseAuthenticationEvents, } from "./Assurance.js";
+import { AtomicPlanError } from "./AtomicPlanExecutor.js";
+import { AuditLogStore, AuditLogStoreError, auditEventActorUserId, auditEventUserId, decodeAuditEvent, filterAuditLogEvents, } from "./AuditLog.js";
 import { DomainName, DomainVerificationId, DomainVerificationProofToken, DomainVerificationStore, DomainVerificationStoreError, } from "./DomainVerification.js";
-import { AuthFlowId, ChallengeId, CredentialId, Email, OAuthAccountId, OAuthClientId, OAuthProviderId, SessionId, UnixMillis, UserId, } from "./Identifiers.js";
+import { AuthFlowId, ChallengeId, CredentialId, Email, IdentityId, OAuthAccountId, OAuthClientId, OAuthProviderId, PermissionId, RoleId, SessionId, UnixMillis, UserId, } from "./Identifiers.js";
+import { isIdentityLoginEligible } from "./Identity.js";
 import { currentUnixMillis } from "./Internal.js";
 import { JwtError, JwtRevocationStore } from "./Jwt.js";
 import { LoginApprovalReviewError, LoginApprovalReviewStore, } from "./LoginApproval.js";
 import { LoginRiskContext, LoginRiskHistory, LoginRiskHistoryError, LoginRiskSignal, maxLoginRiskLevel, } from "./LoginRisk.js";
-import { OAuthAccountStore, OAuthAccountStoreError, OAuthAuthorizationCodeStore, OAuthAuthorizationCodeStoreError, OAuthClientStore, OAuthClientStoreError, OAuthConsentStore, OAuthConsentStoreError, OAuthClientSecretHash, OAuthClientSecretPrefix, OAuthClientSecretStore, OAuthClientSecretStoreError, OAuthCodeChallenge, OAuthProviderModeTokenStore, OAuthProviderModeTokenStoreError, OAuthProviderTokenVault, OAuthProviderTokenVaultError, } from "./OAuth.js";
+import { OAuthAccountStore, OAuthAccountStoreError, OAuthIdentityBridgeConflictError, OAuthIdentityBridgeStore, OAuthIdentityBridgeStoreError, OAuthAuthorizationCodeStore, OAuthAuthorizationCodeStoreError, OAuthClientStore, OAuthClientStoreError, OAuthConsentStore, OAuthConsentStoreError, OAuthClientSecretHash, OAuthClientSecretPrefix, OAuthClientSecretStore, OAuthClientSecretStoreError, OAuthCodeChallenge, OAuthProviderModeTokenStore, OAuthProviderModeTokenStoreError, OAuthProviderTokenVault, OAuthProviderTokenVaultError, } from "./OAuth.js";
+import { OAuthDeviceAuthorizationId, OAuthDeviceAuthorizationStore, OAuthDeviceAuthorizationStoreError, OAuthDeviceCodeTokenCommitStore, OAuthDeviceCodeTokenCommitStoreError, } from "./OAuthDeviceAuthorization.js";
 import { PasskeyCredentialId, PasskeyCredentialStore, PasskeyCredentialStoreError, } from "./Passkey.js";
-import { RecoveryCodeHash, RecoveryCodeStore, RecoveryCodeStoreError, } from "./RecoveryCode.js";
+import { canonicalPermissionScope, normalizePermissionDefinitionListLimit, PermissionStore, PermissionStoreError, } from "./Permission.js";
+import { RecoveryCodeHash, RecoveryCodeLoginCommitStore, RecoveryCodeLoginCommitStoreError, RecoveryCodeStore, RecoveryCodeStoreError, RecoveryCodeSessionRotateStore, RecoveryCodeSessionRotateStoreError, } from "./RecoveryCode.js";
 import { RefreshTokenFamilyId, RefreshTokenId, RefreshTokenSecretHash, RefreshTokenStore, RefreshTokenStoreError, } from "./RefreshToken.js";
 import { filterSecurityTimelineEvents, SecurityTimelineEventId, SecurityTimelineStore, SecurityTimelineStoreError, } from "./SecurityTimeline.js";
-import { CredentialStore, SessionStore, StorageError, UserStore, VerificationStore, } from "./Storage.js";
-import { TotpFactorStore, TotpFactorStoreError, TotpSecret, } from "./Totp.js";
+import { CredentialStore, IdentityConflictError, IdentityStore, RegistrationConflictError, RegistrationFailureError, RegistrationStore, SessionStore, StorageError, UserStore, VerificationStore, } from "./Storage.js";
+import { TotpFactorStore, TotpFactorStoreError, TotpLoginCommitStore, TotpLoginCommitStoreError, TotpSessionRotateStore, TotpSessionRotateStoreError, TotpSecret, } from "./Totp.js";
 import { filterTrustedDevicesForUser, TrustedDeviceError, TrustedDeviceStore, } from "./TrustedDevice.js";
 import { filterDueWebhookOutboxRecords, WebhookOutboxItemId, WebhookOutboxStore, WebhookOutboxStoreError, WebhookReplayStore, WebhookReplayStoreError, } from "./Webhook.js";
+const boundColumnName = (expression) => {
+    const state = expression[Symbol.for("effect-qb/BoundColumn")];
+    if (typeof state?.columnName !== "string") {
+        throw new TypeError("Atomic SQLite storage requires bound table columns");
+    }
+    return state.columnName;
+};
 export class D1EffectQbError extends Data.TaggedError("D1EffectQbError") {
 }
 const makeAuthUserTable = (name) => Table.make(name, {
     id: Column.text().pipe(Column.primaryKey),
-    email: Column.text(),
-    email_verified: Column.int(),
     created_at: Column.int(),
     updated_at: Column.int(),
     disabled_at: Column.int().pipe(Column.nullable),
     metadata: Column.text().pipe(Column.nullable),
 });
+const makeAuthUserIdentityTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    scope_type: Column.text(),
+    scope_id: Column.text(),
+    kind: Column.text(),
+    value: Column.text(),
+    normalized_value: Column.text(),
+    verified_at: Column.int().pipe(Column.nullable),
+    is_primary_login: Column.int(),
+    created_at: Column.int(),
+    updated_at: Column.int(),
+    revoked_at: Column.int().pipe(Column.nullable),
+    replaced_by_id: Column.text().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
 const makeAuthCredentialTable = (name) => Table.make(name, {
     id: Column.text().pipe(Column.primaryKey),
     user_id: Column.text(),
@@ -46,6 +72,7 @@ const makeAuthSessionTable = (name) => Table.make(name, {
     created_at: Column.int(),
     expires_at: Column.int(),
     auth_time: Column.int(),
+    authentication_events: Column.text(),
     aal: Column.text(),
     amr: Column.text(),
     mfa_verified_at: Column.int().pipe(Column.nullable),
@@ -65,6 +92,7 @@ const makeAuthVerificationTable = (name) => Table.make(name, {
     consumed_at: Column.int().pipe(Column.nullable),
 });
 const makeAuthAuditLogTable = (name) => Table.make(name, {
+    storage_id: Column.int().pipe(Column.primaryKey),
     id: Column.text().pipe(Column.nullable),
     type: Column.text(),
     user_id: Column.text().pipe(Column.nullable),
@@ -142,6 +170,7 @@ const makeAuthTotpFactorTable = (name) => Table.make(name, {
     created_at: Column.int(),
     confirmed_at: Column.int().pipe(Column.nullable),
     last_used_at: Column.int().pipe(Column.nullable),
+    last_accepted_counter: Column.int().pipe(Column.nullable),
     revoked_at: Column.int().pipe(Column.nullable),
     metadata: Column.text().pipe(Column.nullable),
 });
@@ -249,8 +278,27 @@ const makeAuthOAuthAuthorizationCodeTable = (name) => Table.make(name, {
     consumed_at: Column.int().pipe(Column.nullable),
     metadata: Column.text().pipe(Column.nullable),
 });
+const makeAuthOAuthDeviceAuthorizationTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    device_code_hash: Column.text().pipe(Column.unique),
+    user_code_hash: Column.text().pipe(Column.unique),
+    client_id: Column.text(),
+    requested_scopes: Column.text(),
+    granted_scopes: Column.text().pipe(Column.nullable),
+    subject: Column.text().pipe(Column.nullable),
+    status: Column.text(),
+    issued_at: Column.int(),
+    expires_at: Column.int(),
+    poll_interval_seconds: Column.int(),
+    next_poll_at: Column.int(),
+    last_polled_at: Column.int().pipe(Column.nullable),
+    approved_at: Column.int().pipe(Column.nullable),
+    denied_at: Column.int().pipe(Column.nullable),
+    consumed_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
 const makeAuthOAuthClientSecretTable = (name) => Table.make(name, {
-    prefix: Column.text().pipe(Column.primaryKey),
+    prefix: Column.text(),
     client_id: Column.text(),
     secret_hash: Column.text(),
     authentication_methods: Column.text(),
@@ -320,6 +368,52 @@ const makeAuthWebhookReplayTable = (name) => Table.make(name, {
     expires_at: Column.int(),
     created_at: Column.int(),
 });
+const makeAuthPermissionDefinitionTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    description: Column.text().pipe(Column.nullable),
+    scope_type_present: Column.int(),
+    scope_type: Column.text(),
+    created_at: Column.int(),
+    updated_at: Column.int(),
+    disabled_at: Column.int().pipe(Column.nullable),
+    deleted_at: Column.int().pipe(Column.nullable),
+});
+const makeAuthRoleDefinitionTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    description: Column.text().pipe(Column.nullable),
+    created_at: Column.int(),
+    updated_at: Column.int(),
+    disabled_at: Column.int().pipe(Column.nullable),
+    deleted_at: Column.int().pipe(Column.nullable),
+});
+const makeAuthPermissionGrantTable = (name) => Table.make(name, {
+    subject_type: Column.text(),
+    subject_id: Column.text(),
+    permission_id: Column.text(),
+    scope_type: Column.text(),
+    scope_id_present: Column.int(),
+    scope_id: Column.text(),
+    expires_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+});
+const makeAuthRoleGrantTable = (name) => Table.make(name, {
+    subject_type: Column.text(),
+    subject_id: Column.text(),
+    role_id: Column.text(),
+    scope_type: Column.text(),
+    scope_id_present: Column.int(),
+    scope_id: Column.text(),
+    expires_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+});
+const makeAuthRolePermissionTable = (name) => Table.make(name, {
+    role_id: Column.text(),
+    permission_id: Column.text(),
+    scope_type_present: Column.int(),
+    scope_type: Column.text(),
+});
 const authSqliteTablesTypeId = Symbol.for("@effect-auth/core/EffectQbSqliteStorage/AuthSqliteTables");
 const jsonEncode = (value) => value === undefined ? null : JSON.stringify(value);
 const jsonDecode = (value) => {
@@ -346,14 +440,60 @@ const decodeBoolean = (value) => {
 };
 const mutationValues = (value) => value;
 const queryInsert = (table, values) => Query.insert(table, values);
+const queryInsertMany = (table, values) => Query.from(Query.values(values))(Query.insert(table));
 const queryUpdate = (table, values) => Query.update(table, values);
 const queryEq = (left, right) => Query.eq(left, right);
+const queryNeq = (left, right) => Query.neq(left, right);
 const queryGt = (left, right) => Query.gt(left, right);
 const queryLt = (left, right) => Query.lt(left, right);
 const queryLte = (left, right) => Query.lte(left, right);
 const queryIsNull = (value) => Query.isNull(value);
+const queryIsNotNull = (value) => Query.isNotNull(value);
+const queryIsNotDistinctFrom = (left, right) => Query.isNotDistinctFrom(left, right);
+const queryAnd = (...values) => Query.and(...values);
+const queryOr = (...values) => Query.or(...values);
+const queryNot = (value) => Query.not(value);
+const queryExists = (plan) => Query.exists(plan);
+const queryScalar = (plan) => Query.scalar(plan);
+const queryChanges = () => Query.call("changes");
+const queryChangedOne = () => queryEq(queryChanges(), 1);
+const queryWithoutNullRefinement = (value) => Query.cast(value, value[Scalar.TypeId].dbType);
 const queryIn = (value, first, ...rest) => Query.in(value, first, ...rest);
+const sqliteCastLike = (value, column) => Query.cast(value, column[Scalar.TypeId].dbType);
+const sqliteIncrementByFive = (value) => Query.call("length", Query.concat(Query.call("printf", "%.*c", value, "x"), "xxxxx"));
+const sqliteUnixMillisAfterSeconds = (now, seconds, textColumn, millisColumn) => {
+    const secondsText = sqliteCastLike(seconds, textColumn);
+    const modifier = Query.concat("+", secondsText, " seconds");
+    const epochSeconds = Query.call("strftime", "%s", new Date(Number(now)).toISOString(), modifier);
+    const fractionalSeconds = Query.call("strftime", "%f", new Date(Number(now)).toISOString(), modifier);
+    const milliseconds = Query.call("substr", fractionalSeconds, -3);
+    return sqliteCastLike(Query.concat(epochSeconds, milliseconds), millisColumn);
+};
+const aliasTable = (table, alias) => Table.alias(table, alias);
+const aliasColumn = (table, column) => table[boundColumnName(column)];
+const queryAstTypeId = Symbol.for("effect-qb/QueryAst");
+const targetMutationExpression = (table, columnName, value) => {
+    if (value === null) {
+        return Query.literal(null);
+    }
+    const plan = queryUpdate(table, { [columnName]: value });
+    const ast = plan[queryAstTypeId];
+    const assignment = ast?.set?.find((candidate) => candidate.columnName === columnName);
+    if (assignment === undefined) {
+        throw new TypeError(`Invalid SQLite mutation column: ${columnName}`);
+    }
+    return assignment.value;
+};
+const queryInsertWhere = (table, values, predicate) => {
+    const selection = Object.fromEntries(Object.entries(values).map(([key, value]) => [
+        key,
+        targetMutationExpression(table, key, value),
+    ]));
+    const select = Query.where(predicate)(Query.select(selection));
+    return Query.from(select)(Query.insert(table));
+};
 const executePlan = (executor, plan) => executor.execute(plan);
+const executeAtomicPlans = (atomic, plans) => atomic.execute(plans);
 const omitUndefined = (record) => Object.fromEntries(Object.entries(record).filter(([, value]) => value !== undefined));
 const sessionMetadataEnvelopeKey = "__effectAuthSession";
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -426,13 +566,31 @@ const encodeSessionMetadata = (row) => {
 };
 const decodeDefaultUserRow = (row) => omitUndefined({
     id: UserId(row.id),
-    email: Email(row.email),
-    emailVerified: decodeBoolean(row.emailVerified),
     createdAt: UnixMillis(Number(row.createdAt)),
     updatedAt: UnixMillis(Number(row.updatedAt)),
     disabledAt: optionalUnixMillis(row.disabledAt),
     metadata: jsonDecode(row.metadata),
 });
+const decodeDefaultUserIdentityRow = (row) => omitUndefined({
+    id: IdentityId(row.id),
+    userId: UserId(row.userId),
+    scope: row.scopeType === "global"
+        ? { type: "global" }
+        : { type: "tenant", tenantId: row.scopeId },
+    kind: row.kind,
+    value: row.value,
+    normalizedValue: row.normalizedValue,
+    verifiedAt: optionalUnixMillis(row.verifiedAt),
+    isPrimaryLogin: decodeBoolean(row.isPrimaryLogin),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    updatedAt: UnixMillis(Number(row.updatedAt)),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    replacedById: row.replacedById === null ? undefined : IdentityId(row.replacedById),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeUserIdentityRow = (tables, row) => tables.identity.decode === undefined
+    ? decodeDefaultUserIdentityRow(row)
+    : tables.identity.decode(row);
 const decodeUserRow = (tables, row) => tables.user.decode === undefined
     ? decodeDefaultUserRow(row)
     : tables.user.decode(row);
@@ -450,6 +608,34 @@ const decodePasswordCredentialRow = (tables, row) => tables.credential.decodePas
     : tables.credential.decodePassword(row);
 const decodeDefaultSessionRow = (row) => {
     const sessionMetadata = decodeSessionMetadata(row.metadata);
+    const authenticationEvents = parseAuthenticationEvents(jsonDecode(row.authenticationEvents));
+    if (authenticationEvents.some((event) => event.type === "custom")) {
+        return omitUndefined({
+            id: SessionId(row.id),
+            userId: UserId(row.userId),
+            secretHash: row.secretHash,
+            createdAt: UnixMillis(Number(row.createdAt)),
+            expiresAt: UnixMillis(Number(row.expiresAt)),
+            authTime: UnixMillis(Number(row.authTime)),
+            authenticationEvents,
+            aal: row.aal,
+            amr: decodeAmr(row.amr),
+            mfaVerifiedAt: optionalUnixMillis(row.mfaVerifiedAt),
+            claims: sessionMetadata.claims,
+            metadata: sessionMetadata.metadata,
+            revokedAt: optionalUnixMillis(row.revokedAt),
+            lastSeenAt: optionalUnixMillis(row.lastSeenAt),
+            rotatedAt: optionalUnixMillis(row.rotatedAt),
+        });
+    }
+    const assurance = deriveAssurance(authenticationEvents);
+    const mfaVerifiedAt = deriveMfaVerifiedAt(authenticationEvents);
+    if (row.aal !== assurance.level ||
+        JSON.stringify(decodeAmr(row.amr)) !== JSON.stringify(assurance.amr) ||
+        optionalUnixMillis(row.mfaVerifiedAt) !== mfaVerifiedAt ||
+        Number(row.authTime) !== Number(assurance.authenticatedAt)) {
+        throw new Error("Session assurance summary does not match authentication events");
+    }
     return omitUndefined({
         id: SessionId(row.id),
         userId: UserId(row.userId),
@@ -457,6 +643,7 @@ const decodeDefaultSessionRow = (row) => {
         createdAt: UnixMillis(Number(row.createdAt)),
         expiresAt: UnixMillis(Number(row.expiresAt)),
         authTime: UnixMillis(Number(row.authTime)),
+        authenticationEvents,
         aal: row.aal,
         amr: decodeAmr(row.amr),
         mfaVerifiedAt: optionalUnixMillis(row.mfaVerifiedAt),
@@ -467,9 +654,13 @@ const decodeDefaultSessionRow = (row) => {
         rotatedAt: optionalUnixMillis(row.rotatedAt),
     });
 };
-const decodeSessionRow = (tables, row) => tables.session.decode === undefined
-    ? decodeDefaultSessionRow(row)
-    : tables.session.decode(row);
+const decodeSessionRow = (tables, row) => {
+    const decoded = tables.session.decode === undefined
+        ? decodeDefaultSessionRow(row)
+        : tables.session.decode(row);
+    assertSessionAssurance(decoded);
+    return decoded;
+};
 const decodeDefaultVerificationRow = (row) => omitUndefined({
     id: ChallengeId(row.id),
     type: row.type,
@@ -483,7 +674,7 @@ const decodeDefaultVerificationRow = (row) => omitUndefined({
 const decodeVerificationRow = (tables, row) => tables.verification.decode === undefined
     ? decodeDefaultVerificationRow(row)
     : tables.verification.decode(row);
-const decodeDefaultAuditLogEvent = (row) => jsonDecode(row.event);
+const decodeDefaultAuditLogEvent = (row) => decodeAuditEvent(jsonDecode(row.event));
 const decodeAuditLogEvent = (tables, row) => tables.auditLog.decode === undefined
     ? decodeDefaultAuditLogEvent(row)
     : tables.auditLog.decode(row);
@@ -523,7 +714,9 @@ const decodeDefaultLoginRiskHistoryRecord = (row) => omitUndefined({
     locationKey: row.locationKey ?? undefined,
     country: row.country ?? undefined,
     region: row.region ?? undefined,
-    latitude: row.latitudeMicro === null ? undefined : Number(row.latitudeMicro) / 1_000_000,
+    latitude: row.latitudeMicro === null
+        ? undefined
+        : Number(row.latitudeMicro) / 1_000_000,
     longitude: row.longitudeMicro === null
         ? undefined
         : Number(row.longitudeMicro) / 1_000_000,
@@ -546,7 +739,9 @@ const decodeTrustedDeviceRow = (tables, row) => tables.trustedDevice.decode ===
     : tables.trustedDevice.decode(row);
 const decodePasskeyTransports = (value) => {
     const decoded = jsonDecode(value);
-    return Array.isArray(decoded) ? decoded : undefined;
+    return Array.isArray(decoded)
+        ? decoded
+        : undefined;
 };
 const decodeDefaultPasskeyCredentialRow = (row) => omitUndefined({
     id: CredentialId(row.id),
@@ -576,6 +771,9 @@ const decodeDefaultTotpFactorRow = (row) => omitUndefined({
     createdAt: UnixMillis(Number(row.createdAt)),
     confirmedAt: optionalUnixMillis(row.confirmedAt),
     lastUsedAt: optionalUnixMillis(row.lastUsedAt),
+    lastAcceptedCounter: row.lastAcceptedCounter === null
+        ? undefined
+        : Number(row.lastAcceptedCounter),
     revokedAt: optionalUnixMillis(row.revokedAt),
     metadata: jsonDecode(row.metadata),
 });
@@ -712,7 +910,8 @@ const decodeOAuthConsentRow = (tables, row) => tables.oauthConsent.decode === un
     : tables.oauthConsent.decode(row);
 const oauthConsentCoversScopes = (record, scopes = []) => scopes.every((scope) => record.scopes.includes(scope));
 const isOAuthConsentActive = (record, input) => record.revokedAt === undefined &&
-    (record.expiresAt === undefined || Number(record.expiresAt) > Number(input.now)) &&
+    (record.expiresAt === undefined ||
+        Number(record.expiresAt) > Number(input.now)) &&
     oauthConsentCoversScopes(record, input.scopes);
 const oauthClientRedirectUriValidationResult = (client, input) => {
     if (client === undefined) {
@@ -740,7 +939,9 @@ const decodeDefaultOAuthAuthorizationCodeRow = (row) => omitUndefined({
     subject: row.subject,
     redirectUri: row.redirectUri,
     scopes: decodeStringArray(row.scopes),
-    codeChallenge: row.codeChallenge === null ? undefined : OAuthCodeChallenge(row.codeChallenge),
+    codeChallenge: row.codeChallenge === null
+        ? undefined
+        : OAuthCodeChallenge(row.codeChallenge),
     codeChallengeMethod: row.codeChallengeMethod === null
         ? undefined
         : row.codeChallengeMethod,
@@ -752,6 +953,42 @@ const decodeDefaultOAuthAuthorizationCodeRow = (row) => omitUndefined({
 const decodeOAuthAuthorizationCodeRow = (tables, row) => tables.oauthAuthorizationCode.decode === undefined
     ? decodeDefaultOAuthAuthorizationCodeRow(row)
     : tables.oauthAuthorizationCode.decode(row);
+const decodeDefaultOAuthDeviceAuthorizationRow = (row) => {
+    const base = omitUndefined({
+        id: OAuthDeviceAuthorizationId(row.id),
+        deviceCodeHash: row.deviceCodeHash,
+        userCodeHash: row.userCodeHash,
+        clientId: OAuthClientId(row.clientId),
+        requestedScopes: decodeStringArray(row.requestedScopes),
+        issuedAt: UnixMillis(Number(row.issuedAt)),
+        expiresAt: UnixMillis(Number(row.expiresAt)),
+        pollIntervalSeconds: Number(row.pollIntervalSeconds),
+        nextPollAt: UnixMillis(Number(row.nextPollAt)),
+        lastPolledAt: optionalUnixMillis(row.lastPolledAt),
+        metadata: jsonDecode(row.metadata),
+    });
+    if (row.status === "approved") {
+        return {
+            ...base,
+            status: "approved",
+            subject: row.subject ?? "",
+            grantedScopes: decodeStringArray(row.grantedScopes),
+            approvedAt: UnixMillis(Number(row.approvedAt)),
+            ...omitUndefined({ consumedAt: optionalUnixMillis(row.consumedAt) }),
+        };
+    }
+    if (row.status === "denied") {
+        return {
+            ...base,
+            status: "denied",
+            deniedAt: UnixMillis(Number(row.deniedAt)),
+        };
+    }
+    return { ...base, status: "pending" };
+};
+const decodeOAuthDeviceAuthorizationRow = (table, row) => table.decode === undefined
+    ? decodeDefaultOAuthDeviceAuthorizationRow(row)
+    : table.decode(row);
 const decodeDefaultOAuthClientSecretRow = (row) => omitUndefined({
     prefix: OAuthClientSecretPrefix(row.prefix),
     clientId: OAuthClientId(row.clientId),
@@ -840,6 +1077,82 @@ const decodeDefaultWebhookOutboxRecord = (row) => omitUndefined({
 const decodeWebhookOutboxRecord = (tables, row) => tables.webhookOutbox.decode === undefined
     ? decodeDefaultWebhookOutboxRecord(row)
     : tables.webhookOutbox.decode(row);
+const decodeDefaultPermissionDefinition = (row) => omitUndefined({
+    id: PermissionId(row.id),
+    description: row.description ?? undefined,
+    scopeType: decodeBoolean(row.scopeTypePresent) ? row.scopeType : undefined,
+    createdAt: UnixMillis(Number(row.createdAt)),
+    updatedAt: UnixMillis(Number(row.updatedAt)),
+    disabledAt: optionalUnixMillis(row.disabledAt),
+    deletedAt: optionalUnixMillis(row.deletedAt),
+});
+const decodePermissionDefinition = (tables, row) => tables.permissionDefinition.decode === undefined
+    ? decodeDefaultPermissionDefinition(row)
+    : tables.permissionDefinition.decode(row);
+const decodeDefaultRoleDefinition = (row) => omitUndefined({
+    id: RoleId(row.id),
+    description: row.description ?? undefined,
+    createdAt: UnixMillis(Number(row.createdAt)),
+    updatedAt: UnixMillis(Number(row.updatedAt)),
+    disabledAt: optionalUnixMillis(row.disabledAt),
+    deletedAt: optionalUnixMillis(row.deletedAt),
+});
+const decodeRoleDefinition = (tables, row) => tables.roleDefinition.decode === undefined
+    ? decodeDefaultRoleDefinition(row)
+    : tables.roleDefinition.decode(row);
+const decodePermissionScope = (scopeType, scopeIdPresent, scopeId) => {
+    const hasId = decodeBoolean(scopeIdPresent);
+    if (scopeType === "global" && !hasId) {
+        return undefined;
+    }
+    return hasId ? { type: scopeType, id: scopeId } : { type: scopeType };
+};
+const decodeDefaultPermissionGrant = (row) => omitUndefined({
+    subject: { type: row.subjectType, id: row.subjectId },
+    permission: PermissionId(row.permissionId),
+    scope: decodePermissionScope(row.scopeType, row.scopeIdPresent, row.scopeId),
+    expiresAt: optionalUnixMillis(row.expiresAt),
+    metadata: jsonDecode(row.metadata),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+});
+const decodePermissionGrant = (tables, row) => {
+    const decoded = tables.permissionGrant.decode === undefined
+        ? decodeDefaultPermissionGrant(row)
+        : tables.permissionGrant.decode(row);
+    const { scope: _scope, ...withoutScope } = decoded;
+    const scope = canonicalPermissionScope(decoded.scope);
+    return {
+        ...withoutScope,
+        ...(scope === undefined ? {} : { scope }),
+    };
+};
+const decodeDefaultRoleGrant = (row) => omitUndefined({
+    subject: { type: row.subjectType, id: row.subjectId },
+    role: RoleId(row.roleId),
+    scope: decodePermissionScope(row.scopeType, row.scopeIdPresent, row.scopeId),
+    expiresAt: optionalUnixMillis(row.expiresAt),
+    metadata: jsonDecode(row.metadata),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+});
+const decodeRoleGrant = (tables, row) => {
+    const decoded = tables.roleGrant.decode === undefined
+        ? decodeDefaultRoleGrant(row)
+        : tables.roleGrant.decode(row);
+    const { scope: _scope, ...withoutScope } = decoded;
+    const scope = canonicalPermissionScope(decoded.scope);
+    return {
+        ...withoutScope,
+        ...(scope === undefined ? {} : { scope }),
+    };
+};
+const decodeDefaultRolePermission = (row) => omitUndefined({
+    role: RoleId(row.roleId),
+    permission: PermissionId(row.permissionId),
+    scopeType: decodeBoolean(row.scopeTypePresent) ? row.scopeType : undefined,
+});
+const decodeRolePermission = (tables, row) => tables.rolePermission.decode === undefined
+    ? decodeDefaultRolePermission(row)
+    : tables.rolePermission.decode(row);
 const providerTokenVaultTokens = (record) => omitUndefined({
     accessTokenCiphertext: record.accessTokenCiphertext,
     refreshTokenCiphertext: record.refreshTokenCiphertext,
@@ -850,13 +1163,50 @@ const providerTokenVaultTokens = (record) => omitUndefined({
 });
 const userInsert = (row) => ({
     id: row.id,
-    email: row.email,
-    email_verified: row.emailVerified ? 1 : 0,
     created_at: Number(row.createdAt),
     updated_at: Number(row.updatedAt),
     disabled_at: row.disabledAt === undefined ? null : Number(row.disabledAt),
     metadata: jsonEncode(row.metadata),
 });
+const identityScopeId = (scope) => scope.type === "global" ? "global" : scope.tenantId;
+const userIdentityInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    scope_type: row.scope.type,
+    scope_id: identityScopeId(row.scope),
+    kind: row.kind,
+    value: row.value,
+    normalized_value: row.normalizedValue,
+    verified_at: row.verifiedAt === undefined ? null : Number(row.verifiedAt),
+    is_primary_login: row.isPrimaryLogin === true ? 1 : 0,
+    created_at: Number(row.createdAt),
+    updated_at: Number(row.createdAt),
+    revoked_at: null,
+    replaced_by_id: null,
+    metadata: jsonEncode(row.metadata),
+});
+const userIdentityVerify = (input) => ({
+    verified_at: Number(input.verifiedAt),
+    updated_at: Number(input.verifiedAt),
+});
+const userIdentitySetPrimary = (input, primary) => ({
+    is_primary_login: primary ? 1 : 0,
+    updated_at: Number(input.updatedAt),
+});
+const userIdentityReplace = (input) => ({
+    is_primary_login: 0,
+    revoked_at: Number(input.replacedAt),
+    replaced_by_id: input.replacement.id,
+    updated_at: Number(input.replacedAt),
+});
+const userIdentityRevoke = (input, _row, metadata) => ({
+    is_primary_login: 0,
+    revoked_at: Number(input.revokedAt),
+    updated_at: Number(input.revokedAt),
+    metadata: input.reason === undefined
+        ? metadata
+        : Query.call("json_set", Query.coalesce(metadata, "{}"), "$.revokeReason", input.reason),
+});
 const passwordCredentialInsert = (row) => ({
     id: row.id,
     user_id: row.userId,
@@ -871,21 +1221,40 @@ const passwordCredentialUpdatePassword = (input) => ({
     password_hash: input.passwordHash,
     updated_at: Number(input.updatedAt),
 });
-const sessionInsert = (row) => ({
-    id: row.id,
-    user_id: row.userId,
-    secret_hash: row.secretHash,
-    created_at: Number(row.createdAt),
-    expires_at: Number(row.expiresAt),
-    auth_time: Number(row.authTime),
-    aal: row.aal,
-    amr: JSON.stringify(row.amr),
-    mfa_verified_at: row.mfaVerifiedAt === undefined ? null : Number(row.mfaVerifiedAt),
-    metadata: encodeSessionMetadata(row),
-    revoked_at: null,
-    last_seen_at: null,
-    rotated_at: null,
-});
+const assertSessionAssurance = (row) => {
+    const authenticationEvents = parseAuthenticationEvents(row.authenticationEvents);
+    // Sessions owns registry-aware validation for custom evidence.
+    if (authenticationEvents.some((event) => event.type === "custom")) {
+        return;
+    }
+    const assurance = deriveAssurance(authenticationEvents);
+    if (assurance.authenticatedAt === undefined ||
+        row.aal !== assurance.level ||
+        JSON.stringify(row.amr) !== JSON.stringify(assurance.amr) ||
+        row.mfaVerifiedAt !== deriveMfaVerifiedAt(authenticationEvents) ||
+        Number(row.authTime) !== Number(assurance.authenticatedAt)) {
+        throw new Error("Session assurance summary does not match authentication events");
+    }
+};
+const sessionInsert = (row) => {
+    assertSessionAssurance(row);
+    return {
+        id: row.id,
+        user_id: row.userId,
+        secret_hash: row.secretHash,
+        created_at: Number(row.createdAt),
+        expires_at: Number(row.expiresAt),
+        auth_time: Number(row.authTime),
+        authentication_events: JSON.stringify(row.authenticationEvents),
+        aal: row.aal,
+        amr: JSON.stringify(row.amr),
+        mfa_verified_at: row.mfaVerifiedAt === undefined ? null : Number(row.mfaVerifiedAt),
+        metadata: encodeSessionMetadata(row),
+        revoked_at: null,
+        last_seen_at: null,
+        rotated_at: null,
+    };
+};
 const verificationInsert = (row) => ({
     id: row.id,
     type: row.type,
@@ -946,10 +1315,6 @@ const loginRiskHistoryInsert = (row) => ({
     risk_level: row.riskLevel ?? null,
     created_at: Number(row.createdAt),
 });
-const userMarkEmailVerifiedUpdate = (input) => ({
-    email_verified: 1,
-    updated_at: Number(input.updatedAt),
-});
 const sessionRefreshUpdate = (input) => omitUndefined({
     expires_at: Number(input.expiresAt),
     last_seen_at: input.lastSeenAt === undefined ? undefined : Number(input.lastSeenAt),
@@ -960,14 +1325,28 @@ const sessionRotateUpdate = (input) => omitUndefined({
     expires_at: input.expiresAt === undefined ? undefined : Number(input.expiresAt),
 });
 const sessionUpdateClaimsUpdate = (row, input) => omitUndefined({
-    aal: input.aal,
-    amr: input.amr === undefined ? undefined : JSON.stringify(input.amr),
-    mfa_verified_at: input.mfaVerifiedAt === undefined ? undefined : Number(input.mfaVerifiedAt),
     metadata: encodeSessionMetadata({
         ...row,
         claims: input.claims ?? row.claims,
     }),
 });
+const sessionAppendEvidenceUpdate = (input) => {
+    assertSessionAssurance(input);
+    return {
+        authentication_events: JSON.stringify(input.authenticationEvents),
+        auth_time: Number(input.authTime),
+        aal: input.aal,
+        amr: JSON.stringify(input.amr),
+        mfa_verified_at: input.mfaVerifiedAt === undefined ? null : Number(input.mfaVerifiedAt),
+    };
+};
+const sessionAssureAndRotateUpdate = (row, input) => ({
+    ...sessionAppendEvidenceUpdate(input),
+    ...sessionRotateUpdate(input),
+    ...(input.claims === undefined
+        ? {}
+        : { metadata: encodeSessionMetadata({ ...row, claims: input.claims }) }),
+});
 const sessionRevokeUpdate = (input) => ({
     revoked_at: Number(input.revokedAt),
 });
@@ -1032,6 +1411,7 @@ const totpFactorInsert = (row) => ({
     created_at: Number(row.createdAt),
     confirmed_at: row.confirmedAt === undefined ? null : Number(row.confirmedAt),
     last_used_at: row.lastUsedAt === undefined ? null : Number(row.lastUsedAt),
+    last_accepted_counter: row.lastAcceptedCounter ?? null,
     revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
     metadata: jsonEncode(row.metadata),
 });
@@ -1039,8 +1419,9 @@ const totpFactorConfirm = (input) => omitUndefined({
     confirmed_at: Number(input.confirmedAt),
     metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
 });
-const totpFactorMarkUsed = (input) => omitUndefined({
+const totpFactorAcceptCounter = (input) => omitUndefined({
     last_used_at: Number(input.lastUsedAt),
+    last_accepted_counter: input.counter,
     metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
 });
 const totpFactorRevoke = (input, row) => ({
@@ -1060,6 +1441,14 @@ const recoveryCodeMarkUsed = (input) => omitUndefined({
     used_at: Number(input.usedAt),
     metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
 });
+const recoveryCodeReplaceActive = (input, metadata) => ({
+    revoked_at: Number(input.revokedAt),
+    ...(input.revokeReason === undefined
+        ? {}
+        : {
+            metadata: Query.call("json_set", Query.coalesce(metadata, "{}"), "$.revokeReason", input.revokeReason),
+        }),
+});
 const recoveryCodeRevoke = (input, row) => ({
     revoked_at: Number(input.revokedAt),
     metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
@@ -1145,7 +1534,9 @@ const oauthProviderTokenVaultValues = (row) => ({
     refresh_token_ciphertext: row.refreshTokenCiphertext === undefined
         ? null
         : Redacted.value(row.refreshTokenCiphertext),
-    id_token_ciphertext: row.idTokenCiphertext === undefined ? null : Redacted.value(row.idTokenCiphertext),
+    id_token_ciphertext: row.idTokenCiphertext === undefined
+        ? null
+        : Redacted.value(row.idTokenCiphertext),
     token_type: row.tokenType,
     scopes: jsonEncode(row.scopes),
     expires_at: row.expiresAt === undefined ? null : Number(row.expiresAt),
@@ -1201,6 +1592,37 @@ const oauthAuthorizationCodeValues = (record) => ({
 const oauthAuthorizationCodeMarkConsumed = (input) => ({
     consumed_at: Number(input.consumedAt),
 });
+const oauthDeviceAuthorizationValues = (record) => ({
+    id: record.id,
+    device_code_hash: record.deviceCodeHash,
+    user_code_hash: record.userCodeHash,
+    client_id: record.clientId,
+    requested_scopes: JSON.stringify(record.requestedScopes),
+    granted_scopes: null,
+    subject: null,
+    status: "pending",
+    issued_at: Number(record.issuedAt),
+    expires_at: Number(record.expiresAt),
+    poll_interval_seconds: record.pollIntervalSeconds,
+    next_poll_at: Number(record.nextPollAt),
+    last_polled_at: record.lastPolledAt === undefined ? null : Number(record.lastPolledAt),
+    approved_at: null,
+    denied_at: null,
+    consumed_at: null,
+    metadata: jsonEncode(record.metadata),
+});
+const oauthDeviceAuthorizationApprove = (input) => omitUndefined({
+    status: "approved",
+    subject: input.subject,
+    granted_scopes: JSON.stringify(input.grantedScopes),
+    approved_at: Number(input.decidedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
+const oauthDeviceAuthorizationDeny = (input) => omitUndefined({
+    status: "denied",
+    denied_at: Number(input.decidedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
 const oauthClientSecretValues = (record) => ({
     prefix: record.prefix,
     client_id: record.clientId,
@@ -1321,6 +1743,101 @@ const webhookReplayUpdate = (input) => ({
     expires_at: Number(input.expiresAt),
     created_at: Number(input.now),
 });
+const permissionScopeValues = (scope) => ({
+    scope_type: scope?.type ?? "global",
+    scope_id_present: scope?.id === undefined ? 0 : 1,
+    scope_id: scope?.id ?? "",
+});
+const permissionGrantValues = (input) => ({
+    subject_type: input.subject.type,
+    subject_id: input.subject.id,
+    permission_id: input.permission,
+    ...permissionScopeValues(input.scope),
+    expires_at: input.expiresAt === undefined ? null : Number(input.expiresAt),
+    metadata: jsonEncode(input.metadata),
+    revoked_at: null,
+});
+const permissionGrantUpdate = (input) => ({
+    expires_at: input.expiresAt === undefined ? null : Number(input.expiresAt),
+    metadata: jsonEncode(input.metadata),
+    revoked_at: null,
+});
+const permissionGrantRevoke = (_input, revokedAt) => ({ revoked_at: Number(revokedAt) });
+const roleGrantValues = (input) => ({
+    subject_type: input.subject.type,
+    subject_id: input.subject.id,
+    role_id: input.role,
+    ...permissionScopeValues(input.scope),
+    expires_at: input.expiresAt === undefined ? null : Number(input.expiresAt),
+    metadata: jsonEncode(input.metadata),
+    revoked_at: null,
+});
+const roleGrantUpdate = (input) => ({
+    expires_at: input.expiresAt === undefined ? null : Number(input.expiresAt),
+    metadata: jsonEncode(input.metadata),
+    revoked_at: null,
+});
+const roleGrantRevoke = (_input, revokedAt) => ({
+    revoked_at: Number(revokedAt),
+});
+const rolePermissionValues = (input) => ({
+    role_id: input.role,
+    permission_id: input.permission,
+    scope_type_present: input.scopeType === undefined ? 0 : 1,
+    scope_type: input.scopeType ?? "",
+});
+const permissionDefinitionValues = (definition) => ({
+    id: definition.id,
+    description: definition.description ?? null,
+    scope_type_present: definition.scopeType === undefined ? 0 : 1,
+    scope_type: definition.scopeType ?? "",
+    created_at: Number(definition.createdAt),
+    updated_at: Number(definition.updatedAt),
+    disabled_at: definition.disabledAt === undefined ? null : Number(definition.disabledAt),
+    deleted_at: definition.deletedAt === undefined ? null : Number(definition.deletedAt),
+});
+const permissionDefinitionUpdate = (input) => ({
+    ...(input.description === undefined
+        ? {}
+        : { description: input.description }),
+    ...(input.scopeType === undefined
+        ? {}
+        : {
+            scope_type_present: input.scopeType === null ? 0 : 1,
+            scope_type: input.scopeType ?? "",
+        }),
+    updated_at: Number(input.updatedAt),
+});
+const permissionDefinitionSetDisabled = (input) => ({
+    disabled_at: input.disabledAt === undefined ? null : Number(input.disabledAt),
+    updated_at: Number(input.updatedAt),
+});
+const permissionDefinitionDelete = (input) => ({
+    deleted_at: Number(input.deletedAt),
+    updated_at: Number(input.updatedAt),
+});
+const roleDefinitionValues = (definition) => ({
+    id: definition.id,
+    description: definition.description ?? null,
+    created_at: Number(definition.createdAt),
+    updated_at: Number(definition.updatedAt),
+    disabled_at: definition.disabledAt === undefined ? null : Number(definition.disabledAt),
+    deleted_at: definition.deletedAt === undefined ? null : Number(definition.deletedAt),
+});
+const roleDefinitionUpdate = (input) => ({
+    ...(input.description === undefined
+        ? {}
+        : { description: input.description }),
+    updated_at: Number(input.updatedAt),
+});
+const roleDefinitionSetDisabled = (input) => ({
+    disabled_at: input.disabledAt === undefined ? null : Number(input.disabledAt),
+    updated_at: Number(input.updatedAt),
+});
+const roleDefinitionDelete = (input) => ({
+    deleted_at: Number(input.deletedAt),
+    updated_at: Number(input.updatedAt),
+});
 const jwtRevocationUpdate = (record) => ({
     revoked_at: Number(record.revokedAt),
     expires_at: record.expiresAt === undefined ? null : Number(record.expiresAt),
@@ -1329,6 +1846,7 @@ const jwtRevocationUpdate = (record) => ({
 const authSqliteTableName = (name, defaultName) => name ?? defaultName;
 const makeInternalAuthSqliteTables = (names = {}) => {
     const user = makeAuthUserTable(names.user ?? "auth_user");
+    const identity = makeAuthUserIdentityTable(names.identity ?? "auth_user_identity");
     const credential = makeAuthCredentialTable(names.credential ?? "auth_credential");
     const session = makeAuthSessionTable(names.session ?? "auth_session");
     const verification = makeAuthVerificationTable(names.verification ?? "auth_verification");
@@ -1346,6 +1864,7 @@ const makeInternalAuthSqliteTables = (names = {}) => {
     const oauthClient = makeAuthOAuthClientTable(authSqliteTableName(names.oauthClient, "auth_oauth_client"));
     const oauthConsent = makeAuthOAuthConsentTable(authSqliteTableName(names.oauthConsent, "auth_oauth_consent"));
     const oauthAuthorizationCode = makeAuthOAuthAuthorizationCodeTable(authSqliteTableName(names.oauthAuthorizationCode, "auth_oauth_authorization_code"));
+    const oauthDeviceAuthorization = makeAuthOAuthDeviceAuthorizationTable(authSqliteTableName(names.oauthDeviceAuthorization, "auth_oauth_device_authorization"));
     const oauthClientSecret = makeAuthOAuthClientSecretTable(authSqliteTableName(names.oauthClientSecret, "auth_oauth_client_secret"));
     const oauthProviderModeToken = makeAuthOAuthProviderModeTokenTable(authSqliteTableName(names.oauthProviderModeToken, "auth_oauth_provider_mode_token"));
     const oauthProviderTokenVault = makeAuthOAuthProviderTokenVaultTable(names.oauthProviderTokenVault ?? "auth_oauth_provider_token_vault");
@@ -1353,20 +1872,46 @@ const makeInternalAuthSqliteTables = (names = {}) => {
     const securityTimeline = makeAuthSecurityTimelineTable(names.securityTimeline ?? "auth_security_timeline");
     const webhookOutbox = makeAuthWebhookOutboxTable(names.webhookOutbox ?? "auth_webhook_outbox");
     const webhookReplay = makeAuthWebhookReplayTable(names.webhookReplay ?? "auth_webhook_replay");
+    const permissionDefinition = makeAuthPermissionDefinitionTable(names.permissionDefinition ?? "auth_permission_definition");
+    const roleDefinition = makeAuthRoleDefinitionTable(names.roleDefinition ?? "auth_role_definition");
+    const permissionGrant = makeAuthPermissionGrantTable(names.permissionGrant ?? "auth_permission_grant");
+    const roleGrant = makeAuthRoleGrantTable(names.roleGrant ?? "auth_role_grant");
+    const rolePermission = makeAuthRolePermissionTable(names.rolePermission ?? "auth_role_permission");
     return {
         user: {
             table: user,
             select: {
                 id: user.id,
-                email: user.email,
-                emailVerified: user.email_verified,
                 createdAt: user.created_at,
                 updatedAt: user.updated_at,
                 disabledAt: user.disabled_at,
                 metadata: user.metadata,
             },
             insert: userInsert,
-            markEmailVerified: userMarkEmailVerifiedUpdate,
+        },
+        identity: {
+            table: identity,
+            select: {
+                id: identity.id,
+                userId: identity.user_id,
+                scopeType: identity.scope_type,
+                scopeId: identity.scope_id,
+                kind: identity.kind,
+                value: identity.value,
+                normalizedValue: identity.normalized_value,
+                verifiedAt: identity.verified_at,
+                isPrimaryLogin: identity.is_primary_login,
+                createdAt: identity.created_at,
+                updatedAt: identity.updated_at,
+                revokedAt: identity.revoked_at,
+                replacedById: identity.replaced_by_id,
+                metadata: identity.metadata,
+            },
+            insert: userIdentityInsert,
+            verify: userIdentityVerify,
+            setPrimary: userIdentitySetPrimary,
+            replace: userIdentityReplace,
+            revoke: userIdentityRevoke,
         },
         credential: {
             table: credential,
@@ -1392,6 +1937,7 @@ const makeInternalAuthSqliteTables = (names = {}) => {
                 createdAt: session.created_at,
                 expiresAt: session.expires_at,
                 authTime: session.auth_time,
+                authenticationEvents: session.authentication_events,
                 aal: session.aal,
                 amr: session.amr,
                 mfaVerifiedAt: session.mfa_verified_at,
@@ -1404,6 +1950,8 @@ const makeInternalAuthSqliteTables = (names = {}) => {
             refresh: sessionRefreshUpdate,
             rotate: sessionRotateUpdate,
             updateClaims: sessionUpdateClaimsUpdate,
+            appendEvidence: sessionAppendEvidenceUpdate,
+            assureAndRotate: sessionAssureAndRotateUpdate,
             revoke: sessionRevokeUpdate,
         },
         verification: {
@@ -1424,6 +1972,7 @@ const makeInternalAuthSqliteTables = (names = {}) => {
         auditLog: {
             table: auditLog,
             select: {
+                storageOrder: auditLog.storage_id,
                 id: auditLog.id,
                 type: auditLog.type,
                 userId: auditLog.user_id,
@@ -1526,12 +2075,13 @@ const makeInternalAuthSqliteTables = (names = {}) => {
                 createdAt: totpFactor.created_at,
                 confirmedAt: totpFactor.confirmed_at,
                 lastUsedAt: totpFactor.last_used_at,
+                lastAcceptedCounter: totpFactor.last_accepted_counter,
                 revokedAt: totpFactor.revoked_at,
                 metadata: totpFactor.metadata,
             },
             insert: totpFactorInsert,
             confirm: totpFactorConfirm,
-            markUsed: totpFactorMarkUsed,
+            acceptCounter: totpFactorAcceptCounter,
             revoke: totpFactorRevoke,
         },
         recoveryCode: {
@@ -1547,6 +2097,7 @@ const makeInternalAuthSqliteTables = (names = {}) => {
             },
             insert: recoveryCodeInsert,
             markUsed: recoveryCodeMarkUsed,
+            replaceActive: recoveryCodeReplaceActive,
             revoke: recoveryCodeRevoke,
         },
         apiKey: {
@@ -1670,6 +2221,31 @@ const makeInternalAuthSqliteTables = (names = {}) => {
             update: oauthAuthorizationCodeValues,
             markConsumed: oauthAuthorizationCodeMarkConsumed,
         },
+        oauthDeviceAuthorization: {
+            table: oauthDeviceAuthorization,
+            select: {
+                id: oauthDeviceAuthorization.id,
+                deviceCodeHash: oauthDeviceAuthorization.device_code_hash,
+                userCodeHash: oauthDeviceAuthorization.user_code_hash,
+                clientId: oauthDeviceAuthorization.client_id,
+                requestedScopes: oauthDeviceAuthorization.requested_scopes,
+                grantedScopes: oauthDeviceAuthorization.granted_scopes,
+                subject: oauthDeviceAuthorization.subject,
+                status: oauthDeviceAuthorization.status,
+                issuedAt: oauthDeviceAuthorization.issued_at,
+                expiresAt: oauthDeviceAuthorization.expires_at,
+                pollIntervalSeconds: oauthDeviceAuthorization.poll_interval_seconds,
+                nextPollAt: oauthDeviceAuthorization.next_poll_at,
+                lastPolledAt: oauthDeviceAuthorization.last_polled_at,
+                approvedAt: oauthDeviceAuthorization.approved_at,
+                deniedAt: oauthDeviceAuthorization.denied_at,
+                consumedAt: oauthDeviceAuthorization.consumed_at,
+                metadata: oauthDeviceAuthorization.metadata,
+            },
+            insert: oauthDeviceAuthorizationValues,
+            approve: oauthDeviceAuthorizationApprove,
+            deny: oauthDeviceAuthorizationDeny,
+        },
         oauthClientSecret: {
             table: oauthClientSecret,
             select: {
@@ -1799,6 +2375,84 @@ const makeInternalAuthSqliteTables = (names = {}) => {
             insert: webhookReplayInsert,
             update: webhookReplayUpdate,
         },
+        permissionDefinition: {
+            table: permissionDefinition,
+            conflictTarget: "id",
+            select: {
+                id: permissionDefinition.id,
+                description: permissionDefinition.description,
+                scopeTypePresent: permissionDefinition.scope_type_present,
+                scopeType: permissionDefinition.scope_type,
+                createdAt: permissionDefinition.created_at,
+                updatedAt: permissionDefinition.updated_at,
+                disabledAt: permissionDefinition.disabled_at,
+                deletedAt: permissionDefinition.deleted_at,
+            },
+            insert: permissionDefinitionValues,
+            update: permissionDefinitionUpdate,
+            setDisabled: permissionDefinitionSetDisabled,
+            delete: permissionDefinitionDelete,
+        },
+        roleDefinition: {
+            table: roleDefinition,
+            conflictTarget: "id",
+            select: {
+                id: roleDefinition.id,
+                description: roleDefinition.description,
+                createdAt: roleDefinition.created_at,
+                updatedAt: roleDefinition.updated_at,
+                disabledAt: roleDefinition.disabled_at,
+                deletedAt: roleDefinition.deleted_at,
+            },
+            insert: roleDefinitionValues,
+            update: roleDefinitionUpdate,
+            setDisabled: roleDefinitionSetDisabled,
+            delete: roleDefinitionDelete,
+        },
+        permissionGrant: {
+            table: permissionGrant,
+            select: {
+                subjectType: permissionGrant.subject_type,
+                subjectId: permissionGrant.subject_id,
+                permissionId: permissionGrant.permission_id,
+                scopeType: permissionGrant.scope_type,
+                scopeIdPresent: permissionGrant.scope_id_present,
+                scopeId: permissionGrant.scope_id,
+                expiresAt: permissionGrant.expires_at,
+                metadata: permissionGrant.metadata,
+                revokedAt: permissionGrant.revoked_at,
+            },
+            insert: permissionGrantValues,
+            update: permissionGrantUpdate,
+            revoke: permissionGrantRevoke,
+        },
+        roleGrant: {
+            table: roleGrant,
+            select: {
+                subjectType: roleGrant.subject_type,
+                subjectId: roleGrant.subject_id,
+                roleId: roleGrant.role_id,
+                scopeType: roleGrant.scope_type,
+                scopeIdPresent: roleGrant.scope_id_present,
+                scopeId: roleGrant.scope_id,
+                expiresAt: roleGrant.expires_at,
+                metadata: roleGrant.metadata,
+                revokedAt: roleGrant.revoked_at,
+            },
+            insert: roleGrantValues,
+            update: roleGrantUpdate,
+            revoke: roleGrantRevoke,
+        },
+        rolePermission: {
+            table: rolePermission,
+            select: {
+                roleId: rolePermission.role_id,
+                permissionId: rolePermission.permission_id,
+                scopeTypePresent: rolePermission.scope_type_present,
+                scopeType: rolePermission.scope_type,
+            },
+            insert: rolePermissionValues,
+        },
     };
 };
 const asAuthSqliteTables = (tables) => tables;
@@ -1806,6 +2460,7 @@ export const defineEffectQbAuthTables = (tables) => asAuthSqliteTables(tables);
 export const makeAuthSqliteTables = (names = {}) => asAuthSqliteTables(makeInternalAuthSqliteTables(names));
 export const authSqliteTables = makeAuthSqliteTables();
 const selectUserColumns = (tables) => tables.user.select;
+const selectIdentityColumns = (tables) => tables.identity.select;
 const selectCredentialColumns = (tables) => tables.credential.select;
 const selectSessionColumns = (tables) => tables.session.select;
 const selectVerificationColumns = (tables) => tables.verification.select;
@@ -1823,6 +2478,8 @@ const selectOAuthAccountColumns = (tables) => tables.oauthAccount.select;
 const selectOAuthClientColumns = (tables) => tables.oauthClient.select;
 const selectOAuthConsentColumns = (tables) => tables.oauthConsent.select;
 const selectOAuthAuthorizationCodeColumns = (tables) => tables.oauthAuthorizationCode.select;
+const oauthDeviceAuthorizationTable = (tables) => tables.oauthDeviceAuthorization ?? authSqliteTables.oauthDeviceAuthorization;
+const selectOAuthDeviceAuthorizationColumns = (tables) => oauthDeviceAuthorizationTable(tables).select;
 const selectOAuthClientSecretColumns = (tables) => tables.oauthClientSecret.select;
 const selectOAuthProviderModeTokenColumns = (tables) => tables.oauthProviderModeToken.select;
 const selectOAuthProviderTokenVaultColumns = (tables) => tables.oauthProviderTokenVault.select;
@@ -1830,7 +2487,16 @@ const selectDomainVerificationColumns = (tables) => tables.domainVerification.se
 const selectSecurityTimelineColumns = (tables) => tables.securityTimeline.select;
 const selectWebhookOutboxColumns = (tables) => tables.webhookOutbox.select;
 const selectWebhookReplayColumns = (tables) => tables.webhookReplay.select;
+const selectPermissionDefinitionColumns = (tables) => tables.permissionDefinition.select;
+const selectRoleDefinitionColumns = (tables) => tables.roleDefinition.select;
+const selectPermissionGrantColumns = (tables) => tables.permissionGrant.select;
+const selectRoleGrantColumns = (tables) => tables.roleGrant.select;
+const selectRolePermissionColumns = (tables) => tables.rolePermission.select;
 const storageError = (entity, operation, cause) => StorageError.fromUnknown(entity, operation, cause);
+const decodeSessionResult = (operation, decode) => Effect.try({
+    try: decode,
+    catch: (cause) => storageError("session", operation, cause),
+});
 const auditLogStoreError = (operation, cause) => new AuditLogStoreError({
     operation,
     message: `Audit log ${operation} failed`,
@@ -1900,6 +2566,11 @@ const oauthAuthorizationCodeStoreError = (operation, cause) => new OAuthAuthoriz
     message: `OAuth authorization code ${operation} failed`,
     cause,
 });
+const oauthDeviceAuthorizationStoreError = (operation, cause) => new OAuthDeviceAuthorizationStoreError({
+    operation,
+    message: `OAuth device authorization ${operation} failed`,
+    cause,
+});
 const oauthClientSecretStoreError = (operation, cause) => new OAuthClientSecretStoreError({
     operation,
     message: `OAuth client secret ${operation} failed`,
@@ -1935,22 +2606,36 @@ const webhookReplayStoreError = (operation, cause) => new WebhookReplayStoreErro
     message: `Webhook replay ${operation} failed`,
     cause,
 });
+const permissionStoreError = (operation, cause) => new PermissionStoreError({
+    operation,
+    message: `Permission store ${operation} failed`,
+    cause,
+});
 const findUserById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectUserColumns(tables)).pipe(Query.from(tables.user.table), Query.where(queryEq(tables.user.select.id, id)))).pipe(Effect.mapError((cause) => storageError("user", operation, cause)), Effect.map((rows) => rows[0] === undefined
     ? Option.none()
     : Option.some(decodeUserRow(tables, rows[0]))));
-const findUserByEmail = (executor, tables, email, operation = "find") => executePlan(executor, Query.select(selectUserColumns(tables)).pipe(Query.from(tables.user.table), Query.where(queryEq(tables.user.select.email, email)))).pipe(Effect.mapError((cause) => storageError("user", operation, cause)), Effect.map((rows) => rows[0] === undefined
+const findIdentity = (executor, tables, where, operation = "find") => executePlan(executor, where.reduce((query, [column, value]) => query.pipe(Query.where(queryEq(column, value))), Query.select(selectIdentityColumns(tables)).pipe(Query.from(tables.identity.table)))).pipe(Effect.mapError((cause) => storageError("identity", operation, cause)), Effect.map((rows) => rows[0] === undefined
     ? Option.none()
-    : Option.some(decodeUserRow(tables, rows[0]))));
+    : Option.some(decodeUserIdentityRow(tables, rows[0]))));
 const findPasswordCredentialByUserId = (executor, tables, userId, operation = "find") => executePlan(executor, Query.select(selectCredentialColumns(tables)).pipe(Query.from(tables.credential.table), Query.where(queryEq(tables.credential.select.userId, userId)), Query.where(queryEq(tables.credential.select.type, "password")))).pipe(Effect.mapError((cause) => storageError("credential", operation, cause)), Effect.map((rows) => rows[0] === undefined
     ? Option.none()
     : Option.some(decodePasswordCredentialRow(tables, rows[0]))));
 const findJwtRevocation = (executor, tables, jwtId, operation = "find") => executePlan(executor, Query.select(selectJwtRevocationColumns(tables)).pipe(Query.from(tables.jwtRevocation.table), Query.where(queryEq(tables.jwtRevocation.select.jwtId, jwtId)))).pipe(Effect.mapError((cause) => jwtRevocationStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
     ? Option.none()
     : Option.some(decodeJwtRevocationRow(tables, rows[0]))));
-const findSessionById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectSessionColumns(tables)).pipe(Query.from(tables.session.table), Query.where(queryEq(tables.session.select.id, id)))).pipe(Effect.mapError((cause) => storageError("session", operation, cause)), Effect.map((rows) => rows[0] === undefined
+const findSessionById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectSessionColumns(tables)).pipe(Query.from(tables.session.table), Query.where(queryEq(tables.session.select.id, id)))).pipe(Effect.mapError((cause) => storageError("session", operation, cause)), Effect.flatMap((rows) => decodeSessionResult(operation, () => rows[0] === undefined
     ? Option.none()
-    : Option.some(decodeSessionRow(tables, rows[0]))));
-const listSessionsByUser = (executor, tables, input, operation = "listByUser") => executePlan(executor, Query.select(selectSessionColumns(tables)).pipe(Query.from(tables.session.table), Query.where(queryEq(tables.session.select.userId, input.userId)))).pipe(Effect.mapError((cause) => storageError("session", operation, cause)), Effect.map((rows) => rows.map((row) => decodeSessionRow(tables, row))));
+    : Option.some(decodeSessionRow(tables, rows[0])))));
+const findSessionForMutation = (executor, tables, id, operation) => executePlan(executor, Query.select(selectSessionColumns(tables)).pipe(Query.from(tables.session.table), Query.where(queryEq(tables.session.select.id, id)))).pipe(Effect.mapError((cause) => storageError("session", operation, cause)), Effect.flatMap((rows) => decodeSessionResult(operation, () => {
+    const [selected] = rows;
+    return selected === undefined
+        ? Option.none()
+        : Option.some({
+            row: decodeSessionRow(tables, selected),
+            authenticationEvents: selected.authenticationEvents,
+        });
+})));
+const listSessionsByUser = (executor, tables, input, operation = "listByUser") => executePlan(executor, Query.select(selectSessionColumns(tables)).pipe(Query.from(tables.session.table), Query.where(queryEq(tables.session.select.userId, input.userId)))).pipe(Effect.mapError((cause) => storageError("session", operation, cause)), Effect.flatMap((rows) => decodeSessionResult(operation, () => rows.map((row) => decodeSessionRow(tables, row)))));
 const findVerificationById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectVerificationColumns(tables)).pipe(Query.from(tables.verification.table), Query.where(queryEq(tables.verification.select.id, id)))).pipe(Effect.mapError((cause) => storageError("verification", operation, cause)), Effect.map((rows) => rows[0] === undefined
     ? Option.none()
     : Option.some(decodeVerificationRow(tables, rows[0]))));
@@ -2022,7 +2707,9 @@ const findOAuthClientSecretByClientIdAndPrefix = (executor, tables, input, opera
 const findOAuthProviderModeTokenByHash = (executor, tables, input, operation = "find") => executePlan(executor, Query.select(selectOAuthProviderModeTokenColumns(tables)).pipe(Query.from(tables.oauthProviderModeToken.table), Query.where(queryEq(tables.oauthProviderModeToken.select.tokenHash, input.tokenHash)))).pipe(Effect.mapError((cause) => oauthProviderModeTokenStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
     ? Option.none()
     : Option.some(decodeOAuthProviderModeTokenRow(tables, rows[0]))));
-const deleteOAuthProviderModeTokenRowsBefore = (executor, tables, column, before) => executePlan(executor, Query.delete(tables.oauthProviderModeToken.table).pipe(Query.where(queryLt(column, Number(before))), Query.returning({ tokenHash: tables.oauthProviderModeToken.select.tokenHash }))).pipe(Effect.map((rows) => rows.length));
+const deleteOAuthProviderModeTokenRowsBefore = (executor, tables, column, before) => executePlan(executor, Query.delete(tables.oauthProviderModeToken.table).pipe(Query.where(queryLt(column, Number(before))), Query.returning({
+    tokenHash: tables.oauthProviderModeToken.select.tokenHash,
+}))).pipe(Effect.map((rows) => rows.length));
 const deleteOAuthProviderModeRetiredTokens = (executor, tables, input) => Effect.gen(function* () {
     const expiredDeleted = input.beforeExpiresAt === undefined
         ? 0
@@ -2096,7 +2783,14 @@ const listAuditLogRecords = (executor, tables, input = {}) => {
     const query = input.types === undefined
         ? byOccurredAt
         : byOccurredAt.pipe(Query.where(queryIn(tables.auditLog.select.type, input.types[0], ...input.types.slice(1))));
-    return executePlan(executor, query).pipe(Effect.mapError((cause) => auditLogStoreError("list", cause)), Effect.map((rows) => filterAuditLogEvents(rows.map((row) => decodeAuditLogEvent(tables, row)), input)));
+    let ordered = query.pipe(Query.orderBy(tables.auditLog.select.occurredAt, "desc"), Query.orderBy(Query.coalesce(tables.auditLog.select.id, Query.literal("")), "desc"));
+    if (tables.auditLog.select.storageOrder !== undefined) {
+        ordered = ordered.pipe(Query.orderBy(tables.auditLog.select.storageOrder, "asc"));
+    }
+    return executePlan(executor, ordered).pipe(Effect.mapError((cause) => auditLogStoreError("list", cause)), Effect.flatMap((rows) => Effect.try({
+        try: () => filterAuditLogEvents(rows.map((row) => decodeAuditLogEvent(tables, row)), input),
+        catch: (cause) => auditLogStoreError("list", cause),
+    })));
 };
 const deleteAuditLogRecordsBefore = (executor, tables, input) => {
     const base = Query.delete(tables.auditLog.table).pipe(Query.where(queryLt(tables.auditLog.select.occurredAt, Number(input.beforeOccurredAt))));
@@ -2132,7 +2826,9 @@ const distanceKm = (first, second) => {
         Math.cos(firstLatitude) *
             Math.cos(secondLatitude) *
             Math.sin(longitudeDelta / 2) ** 2;
-    return (2 * earthRadiusKm * Math.atan2(Math.sqrt(haversine), Math.sqrt(1 - haversine)));
+    return (2 *
+        earthRadiusKm *
+        Math.atan2(Math.sqrt(haversine), Math.sqrt(1 - haversine)));
 };
 const hasCoordinates = (value) => value.latitude !== undefined &&
     Number.isFinite(value.latitude) &&
@@ -2215,18 +2911,287 @@ const deleteLoginRiskHistoryRecordsBefore = (executor, tables, input) => {
 };
 export const makeEffectQbSqliteUserStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return UserStore.make({
+    return UserStore.of({
         findById: (id) => findUserById(executor, tables, id),
-        findByEmail: (email) => findUserByEmail(executor, tables, email),
         insert: (row) => executePlan(executor, queryInsert(tables.user.table, mutationValues(tables.user.insert(row)))).pipe(Effect.mapError((cause) => storageError("user", "insert", cause)), Effect.asVoid),
-        markEmailVerified: (input) => executePlan(executor, queryUpdate(tables.user.table, mutationValues(tables.user.markEmailVerified(input))).pipe(Query.where(queryEq(tables.user.select.id, input.userId)), Query.returning(selectUserColumns(tables)))).pipe(Effect.mapError((cause) => storageError("user", "markEmailVerified", cause)), Effect.map((rows) => rows[0] === undefined
+    });
+};
+const identityConflict = (row) => new IdentityConflictError({
+    scope: row.scope,
+    kind: row.kind,
+    normalizedValue: row.normalizedValue,
+});
+const sqliteConstraintDiscriminator = (cause) => {
+    const pending = [cause];
+    const seen = new Set();
+    while (pending.length > 0) {
+        const current = pending.pop();
+        if (current === undefined || current === null || seen.has(current)) {
+            continue;
+        }
+        seen.add(current);
+        if (typeof current === "string") {
+            if (current === "UniqueViolation" ||
+                /\bUNIQUE constraint failed\b/i.test(current) ||
+                /\bPRIMARY KEY constraint failed\b/i.test(current)) {
+                return true;
+            }
+            continue;
+        }
+        if (typeof current !== "object") {
+            continue;
+        }
+        const record = current;
+        const { code, errno, message, name, _tag } = record;
+        if (_tag === "UniqueViolation" || name === "UniqueViolation") {
+            return true;
+        }
+        if (code === "SQLITE_CONSTRAINT_UNIQUE" ||
+            code === "SQLITE_CONSTRAINT_PRIMARYKEY") {
+            return true;
+        }
+        if (errno === 2067 || errno === 1555) {
+            return true;
+        }
+        if (typeof message === "string" &&
+            (/\bUNIQUE constraint failed\b/i.test(message) ||
+                /\bPRIMARY KEY constraint failed\b/i.test(message))) {
+            return true;
+        }
+        pending.push(record.cause, record.reason, record.error, record.raw);
+        if (Array.isArray(record.failures)) {
+            pending.push(...record.failures);
+        }
+        if (Array.isArray(record.reasons)) {
+            pending.push(...record.reasons);
+        }
+    }
+    return false;
+};
+const isAtomicExecuteConflict = (cause, statement) => cause instanceof AtomicPlanError &&
+    cause.phase === "execute" &&
+    cause.statement === statement &&
+    sqliteConstraintDiscriminator(cause.cause) === true;
+export const makeEffectQbSqliteIdentityStore = (executor, atomic, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    const byId = (id, operation = "find") => findIdentity(executor, tables, [[tables.identity.select.id, id]], operation);
+    const insert = (row) => executePlan(executor, queryInsert(tables.identity.table, mutationValues(tables.identity.insert(row)))).pipe(Effect.mapError(() => identityConflict(row)), Effect.asVoid);
+    return IdentityStore.of({
+        findById: byId,
+        findByKindAndNormalizedValue: (input) => executePlan(executor, Query.select(selectIdentityColumns(tables)).pipe(Query.from(tables.identity.table), Query.where(queryEq(tables.identity.select.scopeType, input.scope.type)), Query.where(queryEq(tables.identity.select.scopeId, identityScopeId(input.scope))), Query.where(queryEq(tables.identity.select.kind, input.kind)), Query.where(queryEq(tables.identity.select.normalizedValue, input.normalizedValue)), Query.where(queryIsNull(tables.identity.select.revokedAt)))).pipe(Effect.mapError((cause) => storageError("identity", "find", cause)), Effect.map((rows) => rows[0] === undefined
             ? Option.none()
-            : Option.some(decodeUserRow(tables, rows[0])))),
+            : Option.some(decodeUserIdentityRow(tables, rows[0])))),
+        listByUser: (input) => {
+            let query = Query.select(selectIdentityColumns(tables)).pipe(Query.from(tables.identity.table), Query.where(queryEq(tables.identity.select.userId, input.userId)));
+            if (input.includeRevoked !== true) {
+                query = query.pipe(Query.where(queryIsNull(tables.identity.select.revokedAt)));
+            }
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => storageError("identity", "find", cause)), Effect.map((rows) => rows.map((row) => decodeUserIdentityRow(tables, row))));
+        },
+        insert,
+        markVerified: (input) => executePlan(executor, queryUpdate(tables.identity.table, mutationValues(tables.identity.verify(input))).pipe(Query.where(queryEq(tables.identity.select.id, input.id)), Query.where(queryEq(tables.identity.select.normalizedValue, input.expectedNormalizedValue)), Query.where(queryIsNull(tables.identity.select.revokedAt)), Query.returning(selectIdentityColumns(tables)))).pipe(Effect.mapError((cause) => storageError("identity", "update", cause)), Effect.map((rows) => rows[0]
+            ? Option.some(decodeUserIdentityRow(tables, rows[0]))
+            : Option.none())),
+        setPrimaryLogin: (input) => {
+            const candidate = aliasTable(tables.identity.table, "primary_candidate");
+            const candidateColumn = (column) => aliasColumn(candidate, column);
+            const candidateExists = queryExists(Query.select({ value: Query.literal(1) }).pipe(Query.from(candidate), Query.where(queryEq(candidateColumn(tables.identity.select.id), input.identityId)), Query.where(queryEq(candidateColumn(tables.identity.select.userId), input.userId)), Query.where(queryEq(candidateColumn(tables.identity.select.updatedAt), Number(input.expectedUpdatedAt))), Query.where(queryIsNull(candidateColumn(tables.identity.select.revokedAt))), Query.where(queryOr(queryNeq(candidateColumn(tables.identity.select.kind), "email"), queryIsNotNull(candidateColumn(tables.identity.select.verifiedAt))))));
+            const primaryColumnName = boundColumnName(tables.identity.select.isPrimaryLogin);
+            const values = {
+                ...mutationValues(tables.identity.setPrimary(input, false)),
+                [primaryColumnName]: Query.case()
+                    .when(queryEq(tables.identity.select.id, input.identityId), targetMutationExpression(tables.identity.table, primaryColumnName, 1))
+                    .else(targetMutationExpression(tables.identity.table, primaryColumnName, 0)),
+            };
+            const plan = queryUpdate(tables.identity.table, values).pipe(Query.where(queryEq(tables.identity.select.userId, input.userId)), Query.where(queryIsNull(tables.identity.select.revokedAt)), Query.where(candidateExists), Query.returning(selectIdentityColumns(tables)));
+            return executeAtomicPlans(atomic, [plan]).pipe(Effect.mapError((cause) => storageError("identity", "update", cause)), Effect.map(([rows]) => {
+                const selected = rows.find((row) => row.id === input.identityId);
+                return selected === undefined
+                    ? Option.none()
+                    : Option.some(decodeUserIdentityRow(tables, selected));
+            }));
+        },
+        replace: (input) => byId(input.id, "update").pipe(Effect.flatMap((found) => {
+            if (Option.isNone(found) ||
+                found.value.userId !== input.userId ||
+                input.replacement.userId !== input.userId) {
+                return Effect.succeed(Option.none());
+            }
+            const row = {
+                ...input.replacement,
+                isPrimaryLogin: input.replacement.isPrimaryLogin ?? found.value.isPrimaryLogin,
+            };
+            const active = aliasTable(tables.identity.table, "active_identity");
+            const activeColumn = (column) => aliasColumn(active, column);
+            const usableCount = queryScalar(Query.select({
+                count: Query.count(activeColumn(tables.identity.select.id)),
+            }).pipe(Query.from(active), Query.where(queryEq(activeColumn(tables.identity.select.userId), input.userId)), Query.where(queryIsNull(activeColumn(tables.identity.select.revokedAt))), Query.where(queryOr(queryNeq(activeColumn(tables.identity.select.kind), "email"), queryIsNotNull(activeColumn(tables.identity.select.verifiedAt))))));
+            const updatePlanBase = queryUpdate(tables.identity.table, mutationValues(tables.identity.replace(input))).pipe(Query.where(queryEq(tables.identity.select.id, input.id)), Query.where(queryEq(tables.identity.select.userId, input.userId)), Query.where(queryEq(tables.identity.select.updatedAt, Number(input.expectedUpdatedAt))), Query.where(queryIsNull(tables.identity.select.revokedAt)));
+            const updatePlan = (isIdentityLoginEligible(found.value) &&
+                !isIdentityLoginEligible(row)
+                ? updatePlanBase.pipe(Query.where(queryGt(usableCount, 1)))
+                : updatePlanBase).pipe(Query.returning({
+                ...selectIdentityColumns(tables),
+                revokedAt: queryWithoutNullRefinement(tables.identity.select.revokedAt),
+                replacedById: queryWithoutNullRefinement(tables.identity.select.replacedById),
+            }));
+            const insertPlan = queryInsertWhere(tables.identity.table, mutationValues(tables.identity.insert(row)), queryChangedOne()).pipe(Query.returning(selectIdentityColumns(tables)));
+            return executeAtomicPlans(atomic, [
+                updatePlan,
+                insertPlan,
+            ]).pipe(Effect.mapError((cause) => isAtomicExecuteConflict(cause, 1)
+                ? identityConflict(row)
+                : storageError("identity", "update", cause)), Effect.map(([updated, inserted]) => inserted[0] === undefined || updated[0] === undefined
+                ? Option.none()
+                : Option.some({
+                    previous: decodeUserIdentityRow(tables, updated[0]),
+                    replacement: decodeUserIdentityRow(tables, inserted[0]),
+                })));
+        })),
+        revoke: (input) => byId(input.id, "update").pipe(Effect.flatMap((found) => {
+            if (Option.isNone(found)) {
+                return Effect.succeed(Option.none());
+            }
+            const active = aliasTable(tables.identity.table, "active_identity");
+            const activeColumn = (column) => aliasColumn(active, column);
+            const usableCount = queryScalar(Query.select({
+                count: Query.count(activeColumn(tables.identity.select.id)),
+            }).pipe(Query.from(active), Query.where(queryEq(activeColumn(tables.identity.select.userId), input.userId)), Query.where(queryIsNull(activeColumn(tables.identity.select.revokedAt))), Query.where(queryOr(queryNeq(activeColumn(tables.identity.select.kind), "email"), queryIsNotNull(activeColumn(tables.identity.select.verifiedAt))))));
+            const revokeValues = mutationValues(tables.identity.revoke(input, found.value, tables.identity.select.metadata));
+            const revokePlan = queryUpdate(tables.identity.table, revokeValues).pipe(Query.where(queryEq(tables.identity.select.id, input.id)), Query.where(queryEq(tables.identity.select.userId, input.userId)), Query.where(queryEq(tables.identity.select.updatedAt, Number(input.expectedUpdatedAt))), Query.where(queryIsNull(tables.identity.select.revokedAt)), Query.where(queryOr(queryAnd(queryEq(tables.identity.select.kind, "email"), queryIsNull(tables.identity.select.verifiedAt)), queryGt(usableCount, 1))), Query.returning({
+                ...selectIdentityColumns(tables),
+                revokedAt: queryWithoutNullRefinement(tables.identity.select.revokedAt),
+                metadata: queryWithoutNullRefinement(tables.identity.select.metadata),
+            }));
+            const next = aliasTable(tables.identity.table, "next_identity");
+            const nextColumn = (column) => aliasColumn(next, column);
+            const nextId = queryScalar(Query.select({ id: nextColumn(tables.identity.select.id) }).pipe(Query.from(next), Query.where(queryEq(nextColumn(tables.identity.select.userId), input.userId)), Query.where(queryIsNull(nextColumn(tables.identity.select.revokedAt))), Query.where(queryOr(queryNeq(nextColumn(tables.identity.select.kind), "email"), queryIsNotNull(nextColumn(tables.identity.select.verifiedAt)))), Query.orderBy(nextColumn(tables.identity.select.createdAt), "asc"), Query.orderBy(nextColumn(tables.identity.select.id), "asc"), Query.limit(1)));
+            const primary = aliasTable(tables.identity.table, "existing_primary");
+            const primaryColumn = (column) => aliasColumn(primary, column);
+            const primaryExists = queryExists(Query.select({ value: Query.literal(1) }).pipe(Query.from(primary), Query.where(queryEq(primaryColumn(tables.identity.select.userId), input.userId)), Query.where(queryIsNull(primaryColumn(tables.identity.select.revokedAt))), Query.where(queryEq(primaryColumn(tables.identity.select.isPrimaryLogin), 1))));
+            const promotePlan = queryUpdate(tables.identity.table, mutationValues(tables.identity.setPrimary({
+                userId: input.userId,
+                identityId: input.id,
+                expectedUpdatedAt: input.expectedUpdatedAt,
+                updatedAt: input.revokedAt,
+            }, true))).pipe(Query.where(queryEq(tables.identity.select.id, nextId)), Query.where(queryNot(primaryExists)), Query.where(queryChangedOne()));
+            return executeAtomicPlans(atomic, [
+                revokePlan,
+                promotePlan,
+            ]).pipe(Effect.mapError((cause) => storageError("identity", "update", cause)), Effect.map(([rows]) => rows[0] === undefined
+                ? Option.none()
+                : Option.some(decodeUserIdentityRow(tables, rows[0]))));
+        })),
+    });
+};
+export const makeEffectQbSqliteRegistrationStore = (executor, atomic, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    const identityStore = makeEffectQbSqliteIdentityStore(executor, atomic, options);
+    const credentialStore = makeEffectQbSqliteCredentialStore(executor, options);
+    const classify = (input, cause) => {
+        const failure = () => Effect.fail(new RegistrationFailureError({
+            message: "Atomic registration failed",
+            cause,
+        }));
+        if (cause instanceof AtomicPlanError && cause.phase !== "execute") {
+            return failure();
+        }
+        const statement = cause instanceof AtomicPlanError ? (cause.statement ?? -1) : -1;
+        if (statement >= 0 && !isAtomicExecuteConflict(cause, statement)) {
+            return failure();
+        }
+        if (statement < 0) {
+            return Effect.gen(function* () {
+                if (Option.isSome(yield* findUserById(executor, options.tables ?? authSqliteTables, input.user.id))) {
+                    return yield* new RegistrationConflictError({ reason: "user-id" });
+                }
+                if (Option.isSome(yield* identityStore.findById(input.identity.id))) {
+                    return yield* new RegistrationConflictError({
+                        reason: "identity-id",
+                    });
+                }
+                if (Option.isSome(yield* identityStore.findByKindAndNormalizedValue({
+                    scope: input.identity.scope,
+                    kind: input.identity.kind,
+                    normalizedValue: input.identity.normalizedValue,
+                }))) {
+                    return yield* new RegistrationConflictError({
+                        reason: "identity-value",
+                    });
+                }
+                if (input.passwordCredential !== undefined) {
+                    const credential = yield* credentialStore.findPasswordByUserId(input.user.id);
+                    if (Option.isSome(credential)) {
+                        return yield* new RegistrationConflictError({
+                            reason: credential.value.id === input.passwordCredential.id
+                                ? "credential-id"
+                                : "password-credential",
+                        });
+                    }
+                }
+                return yield* new RegistrationFailureError({
+                    message: "Atomic registration failed",
+                    cause,
+                });
+            }).pipe(Effect.catch((error) => error instanceof RegistrationConflictError ||
+                error instanceof RegistrationFailureError
+                ? Effect.fail(error)
+                : Effect.fail(new RegistrationFailureError({
+                    message: "Registration conflict classification failed",
+                    cause: error,
+                }))));
+        }
+        if (statement === 0) {
+            return Effect.fail(new RegistrationConflictError({ reason: "user-id" }));
+        }
+        if (statement === 1) {
+            return identityStore.findById(input.identity.id).pipe(Effect.flatMap((found) => Option.isSome(found)
+                ? Effect.fail(new RegistrationConflictError({ reason: "identity-id" }))
+                : Effect.fail(new RegistrationConflictError({ reason: "identity-value" }))), Effect.catch(() => Effect.fail(new RegistrationConflictError({ reason: "identity-value" }))));
+        }
+        if (statement === 2 && input.passwordCredential !== undefined) {
+            return credentialStore.findPasswordByUserId(input.user.id).pipe(Effect.flatMap((found) => Effect.fail(new RegistrationConflictError({
+                reason: Option.isSome(found) &&
+                    found.value.id === input.passwordCredential?.id
+                    ? "credential-id"
+                    : "password-credential",
+            }))), Effect.catch(() => Effect.fail(new RegistrationConflictError({ reason: "password-credential" }))));
+        }
+        return failure();
+    };
+    return RegistrationStore.of({
+        create: (input) => {
+            if (input.identity.userId !== input.user.id ||
+                (input.passwordCredential !== undefined &&
+                    input.passwordCredential.userId !== input.user.id)) {
+                return Effect.fail(new RegistrationConflictError({ reason: "user-id" }));
+            }
+            const userPlan = queryInsert(tables.user.table, mutationValues(tables.user.insert(input.user)));
+            const identityPlan = queryInsert(tables.identity.table, mutationValues(tables.identity.insert(input.identity)));
+            const plans = input.passwordCredential === undefined
+                ? [userPlan, identityPlan]
+                : [
+                    userPlan,
+                    identityPlan,
+                    queryInsert(tables.credential.table, mutationValues(tables.credential.insertPassword(input.passwordCredential))),
+                ];
+            return atomic.execute(plans).pipe(Effect.map(() => ({
+                user: input.user,
+                identity: {
+                    ...input.identity,
+                    isPrimaryLogin: input.identity.isPrimaryLogin ?? false,
+                    updatedAt: input.identity.createdAt,
+                },
+                ...(input.passwordCredential === undefined
+                    ? {}
+                    : { passwordCredential: input.passwordCredential }),
+            })), Effect.catch((error) => classify(input, error)));
+        },
     });
 };
 export const makeEffectQbSqliteCredentialStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return CredentialStore.make({
+    return CredentialStore.of({
         findPasswordByUserId: (userId) => findPasswordCredentialByUserId(executor, tables, userId),
         insertPassword: (row) => executePlan(executor, queryInsert(tables.credential.table, mutationValues(tables.credential.insertPassword(row)))).pipe(Effect.mapError((cause) => storageError("credential", "insert", cause)), Effect.asVoid),
         updatePassword: (input) => executePlan(executor, queryUpdate(tables.credential.table, mutationValues(tables.credential.updatePassword(input))).pipe(Query.where(queryEq(tables.credential.select.userId, input.userId)), Query.where(queryEq(tables.credential.select.type, "password")), Query.where(queryIsNull(tables.credential.select.revokedAt)), Query.returning({ id: tables.credential.select.id }))).pipe(Effect.mapError((cause) => storageError("credential", "updatePassword", cause)), Effect.flatMap((rows) => rows[0] === undefined
@@ -2236,29 +3201,44 @@ export const makeEffectQbSqliteCredentialStore = (executor, options = {}) => {
 };
 export const makeEffectQbSqliteSessionStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return SessionStore.make({
+    return SessionStore.of({
         findById: (id) => findSessionById(executor, tables, id),
         listByUser: (input) => listSessionsByUser(executor, tables, input),
-        insert: (row) => executePlan(executor, queryInsert(tables.session.table, mutationValues(tables.session.insert(row)))).pipe(Effect.mapError((cause) => storageError("session", "insert", cause)), Effect.asVoid),
-        refresh: (input) => {
-            const query = queryUpdate(tables.session.table, mutationValues(tables.session.refresh(input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), Query.returning(selectSessionColumns(tables)));
-            return executePlan(executor, query).pipe(Effect.mapError((cause) => storageError("session", "refresh", cause)), Effect.map((rows) => rows[0] === undefined
+        insert: (row) => decodeSessionResult("insert", () => parseAuthenticationEvents(row.authenticationEvents)).pipe(Effect.flatMap(() => executePlan(executor, queryInsert(tables.session.table, mutationValues(tables.session.insert(row))))), Effect.mapError((cause) => storageError("session", "insert", cause)), Effect.asVoid),
+        refresh: (input) => findSessionForMutation(executor, tables, input.sessionId, "refresh").pipe(Effect.flatMap((existing) => Option.isNone(existing)
+            ? Effect.succeed(Option.none())
+            : executePlan(executor, queryUpdate(tables.session.table, mutationValues(tables.session.refresh(input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), Query.where(queryEq(tables.session.select.authenticationEvents, existing.value.authenticationEvents)), Query.returning(selectSessionColumns(tables)))).pipe(Effect.mapError((cause) => storageError("session", "refresh", cause)), Effect.flatMap((rows) => decodeSessionResult("refresh", () => rows[0] === undefined
                 ? Option.none()
-                : Option.some(decodeSessionRow(tables, rows[0]))));
-        },
-        rotate: (input) => {
-            const query = queryUpdate(tables.session.table, mutationValues(tables.session.rotate(input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), Query.returning(selectSessionColumns(tables)));
-            return executePlan(executor, query).pipe(Effect.mapError((cause) => storageError("session", "rotate", cause)), Effect.map((rows) => rows[0] === undefined
+                : Option.some(decodeSessionRow(tables, rows[0]))))))),
+        rotate: (input) => findSessionForMutation(executor, tables, input.sessionId, "rotate").pipe(Effect.flatMap((existing) => Option.isNone(existing)
+            ? Effect.succeed(Option.none())
+            : executePlan(executor, queryUpdate(tables.session.table, mutationValues(tables.session.rotate(input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), Query.where(queryEq(tables.session.select.authenticationEvents, existing.value.authenticationEvents)), Query.returning(selectSessionColumns(tables)))).pipe(Effect.mapError((cause) => storageError("session", "rotate", cause)), Effect.flatMap((rows) => decodeSessionResult("rotate", () => rows[0] === undefined
                 ? Option.none()
-                : Option.some(decodeSessionRow(tables, rows[0]))));
-        },
-        updateClaims: (input) => findSessionById(executor, tables, input.sessionId, "updateClaims").pipe(Effect.flatMap((rowOption) => {
+                : Option.some(decodeSessionRow(tables, rows[0]))))))),
+        updateClaims: (input) => findSessionForMutation(executor, tables, input.sessionId, "updateClaims").pipe(Effect.flatMap((selected) => {
+            if (Option.isNone(selected)) {
+                return Effect.succeed(Option.none());
+            }
+            return executePlan(executor, queryUpdate(tables.session.table, mutationValues(tables.session.updateClaims(selected.value.row, input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), Query.where(queryEq(tables.session.select.authenticationEvents, selected.value.authenticationEvents)), Query.returning(selectSessionColumns(tables)))).pipe(Effect.mapError((cause) => storageError("session", "updateClaims", cause)), Effect.flatMap((rows) => decodeSessionResult("updateClaims", () => rows[0] === undefined
+                ? Option.none()
+                : Option.some(decodeSessionRow(tables, rows[0])))));
+        })),
+        appendEvidence: (input) => decodeSessionResult("appendEvidence", () => parseAuthenticationEvents(input.authenticationEvents)).pipe(Effect.flatMap((authenticationEvents) => findSessionForMutation(executor, tables, input.sessionId, "appendEvidence").pipe(Effect.flatMap((existing) => Option.isNone(existing)
+            ? Effect.succeed(Option.none())
+            : executePlan(executor, queryUpdate(tables.session.table, mutationValues(tables.session.appendEvidence({
+                ...input,
+                authenticationEvents,
+            }))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), Query.where(queryEq(tables.session.select.authenticationEvents, existing.value.authenticationEvents)), Query.returning(selectSessionColumns(tables)))).pipe(Effect.mapError((cause) => storageError("session", "appendEvidence", cause)), Effect.flatMap((rows) => decodeSessionResult("appendEvidence", () => rows[0] === undefined
+                ? Option.none()
+                : Option.some(decodeSessionRow(tables, rows[0]))))))))),
+        assureAndRotate: (input) => decodeSessionResult("assureAndRotate", () => parseAuthenticationEvents(input.authenticationEvents)).pipe(Effect.flatMap(() => findSessionById(executor, tables, input.sessionId, "assureAndRotate")), Effect.flatMap((rowOption) => {
             if (Option.isNone(rowOption)) {
                 return Effect.succeed(Option.none());
             }
-            return executePlan(executor, queryUpdate(tables.session.table, mutationValues(tables.session.updateClaims(rowOption.value, input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), Query.returning(selectSessionColumns(tables)))).pipe(Effect.mapError((cause) => storageError("session", "updateClaims", cause)), Effect.map((rows) => rows[0] === undefined
+            const query = queryUpdate(tables.session.table, mutationValues(tables.session.assureAndRotate(rowOption.value, input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), Query.where(queryEq(tables.session.select.secretHash, input.expectedSecretHash)), Query.where(queryEq(tables.session.select.authenticationEvents, JSON.stringify(input.expectedAuthenticationEvents))), Query.where(queryIsNull(tables.session.select.revokedAt)), Query.where(queryGt(tables.session.select.expiresAt, Number(input.now))), Query.returning(selectSessionColumns(tables)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => storageError("session", "assureAndRotate", cause)), Effect.flatMap((rows) => decodeSessionResult("assureAndRotate", () => rows[0] === undefined
                 ? Option.none()
-                : Option.some(decodeSessionRow(tables, rows[0]))));
+                : Option.some(decodeSessionRow(tables, rows[0])))));
         })),
         revoke: (input) => executePlan(executor, queryUpdate(tables.session.table, mutationValues(tables.session.revoke(input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)))).pipe(Effect.mapError((cause) => storageError("session", "revoke", cause)), Effect.asVoid),
         revokeAllForUser: (input) => executePlan(executor, queryUpdate(tables.session.table, mutationValues(tables.session.revoke(input))).pipe(Query.where(queryEq(tables.session.select.userId, input.userId)))).pipe(Effect.mapError((cause) => storageError("session", "revokeAllForUser", cause)), Effect.asVoid),
@@ -2266,7 +3246,7 @@ export const makeEffectQbSqliteSessionStore = (executor, options = {}) => {
 };
 export const makeEffectQbSqliteVerificationStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return VerificationStore.make({
+    return VerificationStore.of({
         findById: (id) => findVerificationById(executor, tables, id),
         insert: (row) => executePlan(executor, queryInsert(tables.verification.table, mutationValues(tables.verification.insert(row)))).pipe(Effect.mapError((cause) => storageError("verification", "insert", cause)), Effect.asVoid),
         consume: (input) => {
@@ -2294,10 +3274,13 @@ export const makeEffectQbSqliteVerificationStore = (executor, options = {}) => {
 };
 export const makeEffectQbSqliteAuditLogStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return AuditLogStore.make({
-        insert: (event) => Effect.gen(function* () {
+    return AuditLogStore.of({
+        insertMany: (events) => Effect.gen(function* () {
+            if (events.length === 0) {
+                return;
+            }
             const createdAt = yield* currentUnixMillis;
-            yield* executePlan(executor, queryInsert(tables.auditLog.table, mutationValues(tables.auditLog.insert(event, createdAt)))).pipe(Effect.mapError((cause) => auditLogStoreError("insert", cause)), Effect.asVoid);
+            yield* executePlan(executor, queryInsertMany(tables.auditLog.table, events.map((event) => mutationValues(tables.auditLog.insert(event, createdAt))))).pipe(Effect.mapError((cause) => auditLogStoreError("insertMany", cause)), Effect.asVoid);
         }),
         list: (input = {}) => listAuditLogRecords(executor, tables, input),
         deleteBefore: (input) => deleteAuditLogRecordsBefore(executor, tables, input),
@@ -2305,7 +3288,7 @@ export const makeEffectQbSqliteAuditLogStore = (executor, options = {}) => {
 };
 export const makeEffectQbSqliteLoginApprovalReviewStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return LoginApprovalReviewStore.make({
+    return LoginApprovalReviewStore.of({
         insertPending: (input) => executePlan(executor, queryInsert(tables.loginApprovalReview.table, mutationValues(tables.loginApprovalReview.insertPending(input)))).pipe(Effect.mapError((cause) => loginApprovalReviewStoreError("insert", cause)), Effect.as(input)),
         findByApprovalChallengeId: (input) => findLoginApprovalReviewByApprovalChallengeId(executor, tables, input),
         approve: (input) => executePlan(executor, queryUpdate(tables.loginApprovalReview.table, mutationValues(tables.loginApprovalReview.approve(input))).pipe(Query.where(queryEq(tables.loginApprovalReview.select.approvalChallengeId, input.approvalChallengeId)), Query.where(queryEq(tables.loginApprovalReview.select.status, "pending")), Query.returning(selectLoginApprovalReviewColumns(tables)))).pipe(Effect.mapError((cause) => loginApprovalReviewStoreError("approve", cause)), Effect.map((rows) => rows[0] === undefined
@@ -2318,7 +3301,7 @@ export const makeEffectQbSqliteLoginApprovalReviewStore = (executor, options = {
 };
 export const makeEffectQbSqliteLoginRiskHistoryStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return LoginRiskHistory.make({
+    return LoginRiskHistory.of({
         lookup: (input) => lookupLoginRiskHistory(executor, tables, input, options.loginRiskHistory),
         record: (input) => Effect.gen(function* () {
             const createdAt = input.createdAt ?? (yield* currentUnixMillis);
@@ -2329,15 +3312,21 @@ export const makeEffectQbSqliteLoginRiskHistoryStore = (executor, options = {})
 };
 export const makeEffectQbSqliteTrustedDeviceStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return TrustedDeviceStore.make({
+    const updateExisting = (input, existing) => executePlan(executor, queryUpdate(tables.trustedDevice.table, mutationValues(tables.trustedDevice.update(input, existing))).pipe(Query.where(queryEq(tables.trustedDevice.select.userId, input.userId)), Query.where(queryEq(tables.trustedDevice.select.tokenHash, input.tokenHash)), Query.where(queryLte(tables.trustedDevice.select.lastSeenAt, Number(input.now))))).pipe(Effect.mapError((cause) => trustedDeviceStoreError("trust", cause)), Effect.asVoid);
+    const updateAfterInsertConflict = (input, originalError) => findTrustedDeviceIncludingExpired(executor, tables, input).pipe(Effect.flatMap((existing) => Option.isSome(existing)
+        ? updateExisting(input, existing.value)
+        : Effect.fail(trustedDeviceStoreError("trust", originalError))));
+    return TrustedDeviceStore.of({
         find: (input) => findTrustedDevice(executor, tables, input),
         listForUser: (input) => listTrustedDevicesForUser(executor, tables, input),
         revokeForUser: (input) => executePlan(executor, Query.delete(tables.trustedDevice.table).pipe(Query.where(queryEq(tables.trustedDevice.select.userId, input.userId)), Query.where(queryEq(tables.trustedDevice.select.tokenHash, input.tokenHash)))).pipe(Effect.mapError((cause) => trustedDeviceStoreError("revoke", cause)), Effect.asVoid),
         upsert: (input) => findTrustedDeviceIncludingExpired(executor, tables, input).pipe(Effect.flatMap((existing) => {
             if (Option.isNone(existing)) {
-                return executePlan(executor, queryInsert(tables.trustedDevice.table, mutationValues(tables.trustedDevice.insert(input, input.now)))).pipe(Effect.mapError((cause) => trustedDeviceStoreError("trust", cause)), Effect.asVoid);
+                return executePlan(executor, queryInsert(tables.trustedDevice.table, mutationValues(tables.trustedDevice.insert(input, input.now)))).pipe(Effect.catch((error) => sqliteConstraintDiscriminator(error)
+                    ? updateAfterInsertConflict(input, error)
+                    : Effect.fail(trustedDeviceStoreError("trust", error))), Effect.asVoid);
             }
-            return executePlan(executor, queryUpdate(tables.trustedDevice.table, mutationValues(tables.trustedDevice.update(input, existing.value))).pipe(Query.where(queryEq(tables.trustedDevice.select.userId, input.userId)), Query.where(queryEq(tables.trustedDevice.select.tokenHash, input.tokenHash)))).pipe(Effect.mapError((cause) => trustedDeviceStoreError("trust", cause)), Effect.asVoid);
+            return updateExisting(input, existing.value);
         }), Effect.flatMap(() => findTrustedDeviceIncludingExpired(executor, tables, input)), Effect.flatMap((stored) => Option.isSome(stored)
             ? Effect.succeed(stored.value)
             : Effect.fail(trustedDeviceStoreError("trust", "missing row")))),
@@ -2345,7 +3334,7 @@ export const makeEffectQbSqliteTrustedDeviceStore = (executor, options = {}) =>
 };
 export const makeEffectQbSqlitePasskeyCredentialStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return PasskeyCredentialStore.make({
+    return PasskeyCredentialStore.of({
         insert: (row) => executePlan(executor, queryInsert(tables.passkeyCredential.table, mutationValues(tables.passkeyCredential.insert(row)))).pipe(Effect.mapError((cause) => passkeyCredentialStoreError("insert", cause)), Effect.asVoid),
         findByCredentialId: (credentialId) => findPasskeyCredentialByCredentialId(executor, tables, credentialId),
         listByUser: (input) => {
@@ -2355,7 +3344,7 @@ export const makeEffectQbSqlitePasskeyCredentialStore = (executor, options = {})
                 : base.pipe(Query.where(queryIsNull(tables.passkeyCredential.select.revokedAt)));
             return executePlan(executor, query).pipe(Effect.mapError((cause) => passkeyCredentialStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodePasskeyCredentialRow(tables, row))));
         },
-        updateSignCount: (input) => executePlan(executor, queryUpdate(tables.passkeyCredential.table, mutationValues(tables.passkeyCredential.updateSignCount(input))).pipe(Query.where(queryEq(tables.passkeyCredential.select.credentialId, input.credentialId)), Query.where(queryIsNull(tables.passkeyCredential.select.revokedAt)), Query.returning(selectPasskeyCredentialColumns(tables)))).pipe(Effect.mapError((cause) => passkeyCredentialStoreError("update-sign-count", cause)), Effect.map((rows) => rows[0] === undefined
+        updateSignCount: (input) => executePlan(executor, queryUpdate(tables.passkeyCredential.table, mutationValues(tables.passkeyCredential.updateSignCount(input))).pipe(Query.where(queryEq(tables.passkeyCredential.select.credentialId, input.credentialId)), Query.where(queryEq(tables.passkeyCredential.select.signCount, input.expectedSignCount)), Query.where(queryIsNull(tables.passkeyCredential.select.revokedAt)), Query.returning(selectPasskeyCredentialColumns(tables)))).pipe(Effect.mapError((cause) => passkeyCredentialStoreError("update-sign-count", cause)), Effect.map((rows) => rows[0] === undefined
             ? Option.none()
             : Option.some(decodePasskeyCredentialRow(tables, rows[0])))),
         revoke: (input) => findPasskeyCredentialByCredentialId(executor, tables, input.credentialId, "revoke").pipe(Effect.flatMap((row) => {
@@ -2368,7 +3357,7 @@ export const makeEffectQbSqlitePasskeyCredentialStore = (executor, options = {})
 };
 export const makeEffectQbSqliteTotpFactorStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return TotpFactorStore.make({
+    return TotpFactorStore.of({
         insert: (row) => executePlan(executor, queryInsert(tables.totpFactor.table, mutationValues(tables.totpFactor.insert(row)))).pipe(Effect.mapError((cause) => totpFactorStoreError("insert", cause)), Effect.asVoid),
         findById: (id) => findTotpFactorById(executor, tables, id),
         listByUser: (input) => {
@@ -2384,9 +3373,35 @@ export const makeEffectQbSqliteTotpFactorStore = (executor, options = {}) => {
         confirm: (input) => executePlan(executor, queryUpdate(tables.totpFactor.table, mutationValues(tables.totpFactor.confirm(input))).pipe(Query.where(queryEq(tables.totpFactor.select.id, input.id)), Query.where(queryIsNull(tables.totpFactor.select.revokedAt)), Query.returning(selectTotpFactorColumns(tables)))).pipe(Effect.mapError((cause) => totpFactorStoreError("confirm", cause)), Effect.map((rows) => rows[0] === undefined
             ? Option.none()
             : Option.some(decodeTotpFactorRow(tables, rows[0])))),
-        markUsed: (input) => executePlan(executor, queryUpdate(tables.totpFactor.table, mutationValues(tables.totpFactor.markUsed(input))).pipe(Query.where(queryEq(tables.totpFactor.select.id, input.id)), Query.where(queryIsNull(tables.totpFactor.select.revokedAt)), Query.where(queryGt(tables.totpFactor.select.confirmedAt, 0)), Query.returning(selectTotpFactorColumns(tables)))).pipe(Effect.mapError((cause) => totpFactorStoreError("mark-used", cause)), Effect.map((rows) => rows[0] === undefined
-            ? Option.none()
-            : Option.some(decodeTotpFactorRow(tables, rows[0])))),
+        acceptCounter: (input) => {
+            const attempt = (initial) => executePlan(executor, queryUpdate(tables.totpFactor.table, mutationValues(tables.totpFactor.acceptCounter(input))).pipe(Query.where(queryEq(tables.totpFactor.select.id, input.id)), Query.where(queryIsNull(tables.totpFactor.select.revokedAt)), Query.where(queryGt(tables.totpFactor.select.confirmedAt, 0)), Query.where(initial
+                ? queryIsNull(tables.totpFactor.select.lastAcceptedCounter)
+                : queryLt(tables.totpFactor.select.lastAcceptedCounter, input.counter)), Query.returning({ id: tables.totpFactor.select.id })));
+            return Effect.gen(function* () {
+                let rows = yield* attempt(true).pipe(Effect.mapError((cause) => totpFactorStoreError("accept-counter", cause)));
+                if (rows[0] === undefined) {
+                    rows = yield* attempt(false).pipe(Effect.mapError((cause) => totpFactorStoreError("accept-counter", cause)));
+                }
+                if (rows[0] !== undefined) {
+                    const factor = yield* findTotpFactorById(executor, tables, input.id, "accept-counter");
+                    if (Option.isNone(factor)) {
+                        return { _tag: "Unavailable" };
+                    }
+                    return {
+                        _tag: "Accepted",
+                        factor: factor.value,
+                    };
+                }
+                const factor = yield* findTotpFactorById(executor, tables, input.id, "accept-counter");
+                return Option.isSome(factor) &&
+                    factor.value.confirmedAt !== undefined &&
+                    factor.value.revokedAt === undefined &&
+                    factor.value.lastAcceptedCounter !== undefined &&
+                    factor.value.lastAcceptedCounter >= input.counter
+                    ? { _tag: "Replay" }
+                    : { _tag: "Unavailable" };
+            });
+        },
         revoke: (input) => findTotpFactorById(executor, tables, input.id, "revoke").pipe(Effect.flatMap((row) => {
             if (Option.isNone(row)) {
                 return Effect.void;
@@ -2395,9 +3410,9 @@ export const makeEffectQbSqliteTotpFactorStore = (executor, options = {}) => {
         })),
     });
 };
-export const makeEffectQbSqliteRecoveryCodeStore = (executor, options = {}) => {
+export const makeEffectQbSqliteRecoveryCodeStore = (executor, atomic, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return RecoveryCodeStore.make({
+    return RecoveryCodeStore.of({
         insertMany: (rows) => Effect.forEach(rows, (row) => executePlan(executor, queryInsert(tables.recoveryCode.table, mutationValues(tables.recoveryCode.insert(row)))).pipe(Effect.mapError((cause) => recoveryCodeStoreError("insert", cause)), Effect.asVoid), { discard: true }),
         findById: (id) => findRecoveryCodeById(executor, tables, id),
         listByUser: (input) => {
@@ -2413,6 +3428,13 @@ export const makeEffectQbSqliteRecoveryCodeStore = (executor, options = {}) => {
         markUsed: (input) => executePlan(executor, queryUpdate(tables.recoveryCode.table, mutationValues(tables.recoveryCode.markUsed(input))).pipe(Query.where(queryEq(tables.recoveryCode.select.id, input.id)), Query.where(queryIsNull(tables.recoveryCode.select.usedAt)), Query.where(queryIsNull(tables.recoveryCode.select.revokedAt)), Query.returning({ id: tables.recoveryCode.select.id }))).pipe(Effect.mapError((cause) => recoveryCodeStoreError("mark-used", cause)), Effect.flatMap((rows) => rows[0] === undefined
             ? Effect.succeed(Option.none())
             : findRecoveryCodeById(executor, tables, input.id, "mark-used"))),
+        replaceActiveForUser: (input) => {
+            const plans = [
+                queryUpdate(tables.recoveryCode.table, mutationValues(tables.recoveryCode.replaceActive(input, tables.recoveryCode.select.metadata))).pipe(Query.where(queryEq(tables.recoveryCode.select.userId, input.userId)), Query.where(queryIsNull(tables.recoveryCode.select.usedAt)), Query.where(queryIsNull(tables.recoveryCode.select.revokedAt))),
+                ...input.rows.map((row) => queryInsert(tables.recoveryCode.table, mutationValues(tables.recoveryCode.insert(row)))),
+            ];
+            return atomic.execute(plans).pipe(Effect.mapError((cause) => recoveryCodeStoreError("replace-active", cause)), Effect.asVoid);
+        },
         revoke: (input) => findRecoveryCodeById(executor, tables, input.id, "revoke").pipe(Effect.flatMap((row) => {
             if (Option.isNone(row)) {
                 return Effect.void;
@@ -2421,9 +3443,219 @@ export const makeEffectQbSqliteRecoveryCodeStore = (executor, options = {}) => {
         })),
     });
 };
+export const makeEffectQbSqliteRecoveryCodeSessionRotateStore = (executor, atomic, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return RecoveryCodeSessionRotateStore.of({
+        consumeAndRotate: (input) => findSessionById(executor, tables, input.sessionId, "assureAndRotate").pipe(Effect.flatMap((current) => {
+            if (Option.isNone(current) || current.value.userId !== input.userId) {
+                return Effect.succeed(Option.none());
+            }
+            try {
+                assertSessionAssurance(input);
+            }
+            catch (error) {
+                return Effect.fail(new RecoveryCodeSessionRotateStoreError({
+                    message: "Session assurance validation failed",
+                    cause: error,
+                }));
+            }
+            const metadata = input.claims === undefined
+                ? undefined
+                : encodeSessionMetadata({
+                    ...current.value,
+                    claims: input.claims,
+                });
+            const sessionExists = queryExists(Query.select({ value: Query.literal(1) }).pipe(Query.from(tables.session.table), Query.where(queryEq(tables.session.select.id, input.sessionId)), Query.where(queryEq(tables.session.select.userId, input.userId)), Query.where(queryEq(tables.session.select.secretHash, input.expectedSecretHash)), Query.where(queryEq(tables.session.select.authenticationEvents, JSON.stringify(input.expectedAuthenticationEvents))), Query.where(queryIsNull(tables.session.select.revokedAt)), Query.where(queryGt(tables.session.select.expiresAt, Number(input.now)))));
+            const consumePlan = queryUpdate(tables.recoveryCode.table, mutationValues(tables.recoveryCode.markUsed({
+                id: input.codeId,
+                usedAt: input.usedAt,
+                ...(input.codeMetadata === undefined
+                    ? {}
+                    : { metadata: input.codeMetadata }),
+            }))).pipe(Query.where(queryEq(tables.recoveryCode.select.id, input.codeId)), Query.where(queryEq(tables.recoveryCode.select.userId, input.userId)), Query.where(queryIsNull(tables.recoveryCode.select.usedAt)), Query.where(queryIsNull(tables.recoveryCode.select.revokedAt)), Query.where(sessionExists));
+            const sessionValues = mutationValues(tables.session.assureAndRotate(current.value, input));
+            if (metadata !== undefined) {
+                sessionValues[boundColumnName(tables.session.select.metadata)] =
+                    metadata;
+            }
+            const rotatePlan = queryUpdate(tables.session.table, sessionValues).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), Query.where(queryEq(tables.session.select.userId, input.userId)), Query.where(queryEq(tables.session.select.secretHash, input.expectedSecretHash)), Query.where(queryEq(tables.session.select.authenticationEvents, JSON.stringify(input.expectedAuthenticationEvents))), Query.where(queryIsNull(tables.session.select.revokedAt)), Query.where(queryGt(tables.session.select.expiresAt, Number(input.now))), Query.where(queryChangedOne()), Query.returning({ id: tables.session.select.id }));
+            return executeAtomicPlans(atomic, [
+                consumePlan,
+                rotatePlan,
+            ]).pipe(Effect.mapError((cause) => new RecoveryCodeSessionRotateStoreError({
+                message: "Atomic recovery session rotation failed",
+                cause,
+            })), Effect.flatMap((results) => results[1].length === 0
+                ? Effect.succeed(Option.none())
+                : findSessionById(executor, tables, input.sessionId, "assureAndRotate").pipe(Effect.mapError((cause) => new RecoveryCodeSessionRotateStoreError({
+                    message: "Failed to load rotated session",
+                    cause,
+                })))));
+        }), Effect.mapError((cause) => cause instanceof RecoveryCodeSessionRotateStoreError
+            ? cause
+            : new RecoveryCodeSessionRotateStoreError({
+                message: "Failed to load current session",
+                cause,
+            }))),
+    });
+};
+export const makeEffectQbSqliteTotpSessionRotateStore = (executor, atomic, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return TotpSessionRotateStore.of({
+        acceptAndRotate: (input) => findSessionById(executor, tables, input.sessionId, "assureAndRotate").pipe(Effect.flatMap((current) => {
+            if (Option.isNone(current) || current.value.userId !== input.userId) {
+                return Effect.succeed(Option.none());
+            }
+            try {
+                assertSessionAssurance(input);
+            }
+            catch (error) {
+                return Effect.fail(new TotpSessionRotateStoreError({
+                    message: "Session assurance validation failed",
+                    cause: error,
+                }));
+            }
+            const metadata = input.claims === undefined
+                ? undefined
+                : encodeSessionMetadata({
+                    ...current.value,
+                    claims: input.claims,
+                });
+            const sessionExists = queryExists(Query.select({ value: Query.literal(1) }).pipe(Query.from(tables.session.table), Query.where(queryEq(tables.session.select.id, input.sessionId)), Query.where(queryEq(tables.session.select.userId, input.userId)), Query.where(queryEq(tables.session.select.secretHash, input.expectedSecretHash)), Query.where(queryEq(tables.session.select.authenticationEvents, JSON.stringify(input.expectedAuthenticationEvents))), Query.where(queryIsNull(tables.session.select.revokedAt)), Query.where(queryGt(tables.session.select.expiresAt, Number(input.now)))));
+            const acceptPlan = queryUpdate(tables.totpFactor.table, mutationValues(tables.totpFactor.acceptCounter({
+                id: input.factorId,
+                counter: input.counter,
+                lastUsedAt: input.lastUsedAt,
+                ...(input.factorMetadata === undefined
+                    ? {}
+                    : { metadata: input.factorMetadata }),
+            }))).pipe(Query.where(queryEq(tables.totpFactor.select.id, input.factorId)), Query.where(queryEq(tables.totpFactor.select.userId, input.userId)), Query.where(queryIsNotNull(tables.totpFactor.select.confirmedAt)), Query.where(queryIsNull(tables.totpFactor.select.revokedAt)), Query.where(queryOr(queryIsNull(tables.totpFactor.select.lastAcceptedCounter), queryLt(tables.totpFactor.select.lastAcceptedCounter, input.counter))), Query.where(sessionExists));
+            const sessionValues = mutationValues(tables.session.assureAndRotate(current.value, input));
+            if (metadata !== undefined) {
+                sessionValues[boundColumnName(tables.session.select.metadata)] =
+                    metadata;
+            }
+            const rotatePlan = queryUpdate(tables.session.table, sessionValues).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), Query.where(queryEq(tables.session.select.userId, input.userId)), Query.where(queryEq(tables.session.select.secretHash, input.expectedSecretHash)), Query.where(queryEq(tables.session.select.authenticationEvents, JSON.stringify(input.expectedAuthenticationEvents))), Query.where(queryIsNull(tables.session.select.revokedAt)), Query.where(queryGt(tables.session.select.expiresAt, Number(input.now))), Query.where(queryChangedOne()), Query.returning({ id: tables.session.select.id }));
+            return executeAtomicPlans(atomic, [
+                acceptPlan,
+                rotatePlan,
+            ]).pipe(Effect.mapError((cause) => new TotpSessionRotateStoreError({
+                message: "Atomic TOTP session rotation failed",
+                cause,
+            })), Effect.flatMap((results) => results[1].length === 0
+                ? Effect.succeed(Option.none())
+                : findSessionById(executor, tables, input.sessionId, "assureAndRotate").pipe(Effect.mapError((cause) => new TotpSessionRotateStoreError({
+                    message: "Failed to load rotated session",
+                    cause,
+                })))));
+        }), Effect.mapError((cause) => cause instanceof TotpSessionRotateStoreError
+            ? cause
+            : new TotpSessionRotateStoreError({
+                message: "Failed to load current session",
+                cause,
+            }))),
+    });
+};
+export const makeEffectQbSqliteTotpLoginCommitStore = (atomic, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return TotpLoginCommitStore.of({
+        commit: (input) => {
+            const { verification, session } = input;
+            if (verification.type !== "auth-flow-state" ||
+                verification.subject !== input.userId ||
+                (session === undefined && input.continuation !== "login-approval") ||
+                (session !== undefined && input.continuation !== undefined) ||
+                (session !== undefined && session.userId !== input.userId)) {
+                return Effect.succeed(false);
+            }
+            const factorExists = queryExists(Query.select({ value: Query.literal(1) }).pipe(Query.from(tables.totpFactor.table), Query.where(queryEq(tables.totpFactor.select.id, input.factorId)), Query.where(queryEq(tables.totpFactor.select.userId, input.userId)), Query.where(queryIsNotNull(tables.totpFactor.select.confirmedAt)), Query.where(queryIsNull(tables.totpFactor.select.revokedAt)), Query.where(queryOr(queryIsNull(tables.totpFactor.select.lastAcceptedCounter), queryLt(tables.totpFactor.select.lastAcceptedCounter, input.counter)))));
+            const verificationPlan = queryUpdate(tables.verification.table, mutationValues(tables.verification.consume({
+                id: verification.id,
+                type: verification.type,
+                consumedAt: input.consumedAt,
+            }))).pipe(Query.where(queryEq(tables.verification.select.id, verification.id)), Query.where(queryEq(tables.verification.select.type, verification.type)), Query.where(queryEq(tables.verification.select.subject, verification.subject)), Query.where(queryIsNotDistinctFrom(tables.verification.select.secretHash, verification.secretHash ?? null)), Query.where(queryEq(tables.verification.select.createdAt, Number(verification.createdAt))), Query.where(queryEq(tables.verification.select.expiresAt, Number(verification.expiresAt))), Query.where(queryIsNotDistinctFrom(tables.verification.select.metadata, jsonEncode(verification.metadata))), Query.where(queryIsNull(tables.verification.select.consumedAt)), Query.where(queryGt(tables.verification.select.expiresAt, Number(input.consumedAt))), Query.where(factorExists));
+            const factorPlan = queryUpdate(tables.totpFactor.table, mutationValues(tables.totpFactor.acceptCounter({
+                id: input.factorId,
+                counter: input.counter,
+                lastUsedAt: input.lastUsedAt,
+                ...(input.factorMetadata === undefined
+                    ? {}
+                    : { metadata: input.factorMetadata }),
+            }))).pipe(Query.where(queryEq(tables.totpFactor.select.id, input.factorId)), Query.where(queryEq(tables.totpFactor.select.userId, input.userId)), Query.where(queryIsNotNull(tables.totpFactor.select.confirmedAt)), Query.where(queryIsNull(tables.totpFactor.select.revokedAt)), Query.where(queryOr(queryIsNull(tables.totpFactor.select.lastAcceptedCounter), queryLt(tables.totpFactor.select.lastAcceptedCounter, input.counter))), Query.where(queryChangedOne()), Query.returning({ id: tables.totpFactor.select.id }));
+            if (session === undefined) {
+                return executeAtomicPlans(atomic, [
+                    verificationPlan,
+                    factorPlan,
+                ]).pipe(Effect.map((results) => results[1].length === 1), Effect.mapError((cause) => new TotpLoginCommitStoreError({
+                    message: "Atomic TOTP login commit failed",
+                    cause,
+                })));
+            }
+            const sessionExists = queryExists(Query.select({ value: Query.literal(1) }).pipe(Query.from(tables.session.table), Query.where(queryEq(tables.session.select.id, session.id))));
+            const sessionVerificationPlan = verificationPlan.pipe(Query.where(queryNot(sessionExists)));
+            const sessionPlan = queryInsertWhere(tables.session.table, mutationValues(tables.session.insert(session)), queryChangedOne()).pipe(Query.returning({ id: tables.session.select.id }));
+            return executeAtomicPlans(atomic, [
+                sessionVerificationPlan,
+                factorPlan,
+                sessionPlan,
+            ]).pipe(Effect.map((results) => results[2].length === 1), Effect.mapError((cause) => new TotpLoginCommitStoreError({
+                message: "Atomic TOTP login commit failed",
+                cause,
+            })));
+        },
+    });
+};
+export const makeEffectQbSqliteRecoveryCodeLoginCommitStore = (atomic, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return RecoveryCodeLoginCommitStore.of({
+        commit: (input) => {
+            const { verification, session } = input;
+            if (verification.type !== "auth-flow-state" ||
+                verification.subject !== input.userId ||
+                (session === undefined && input.continuation !== "login-approval") ||
+                (session !== undefined && input.continuation !== undefined) ||
+                (session !== undefined && session.userId !== input.userId)) {
+                return Effect.succeed(false);
+            }
+            const codeExists = queryExists(Query.select({ value: Query.literal(1) }).pipe(Query.from(tables.recoveryCode.table), Query.where(queryEq(tables.recoveryCode.select.id, input.codeId)), Query.where(queryEq(tables.recoveryCode.select.userId, input.userId)), Query.where(queryIsNull(tables.recoveryCode.select.usedAt)), Query.where(queryIsNull(tables.recoveryCode.select.revokedAt))));
+            const verificationPlan = queryUpdate(tables.verification.table, mutationValues(tables.verification.consume({
+                id: verification.id,
+                type: verification.type,
+                consumedAt: input.consumedAt,
+            }))).pipe(Query.where(queryEq(tables.verification.select.id, verification.id)), Query.where(queryEq(tables.verification.select.type, verification.type)), Query.where(queryEq(tables.verification.select.subject, verification.subject)), Query.where(queryIsNotDistinctFrom(tables.verification.select.secretHash, verification.secretHash ?? null)), Query.where(queryEq(tables.verification.select.createdAt, Number(verification.createdAt))), Query.where(queryEq(tables.verification.select.expiresAt, Number(verification.expiresAt))), Query.where(queryIsNotDistinctFrom(tables.verification.select.metadata, jsonEncode(verification.metadata))), Query.where(queryIsNull(tables.verification.select.consumedAt)), Query.where(queryGt(tables.verification.select.expiresAt, Number(input.consumedAt))), Query.where(codeExists));
+            const codePlan = queryUpdate(tables.recoveryCode.table, mutationValues(tables.recoveryCode.markUsed({
+                id: input.codeId,
+                usedAt: input.usedAt,
+                ...(input.codeMetadata === undefined
+                    ? {}
+                    : { metadata: input.codeMetadata }),
+            }))).pipe(Query.where(queryEq(tables.recoveryCode.select.id, input.codeId)), Query.where(queryEq(tables.recoveryCode.select.userId, input.userId)), Query.where(queryIsNull(tables.recoveryCode.select.usedAt)), Query.where(queryIsNull(tables.recoveryCode.select.revokedAt)), Query.where(queryChangedOne()), Query.returning({ id: tables.recoveryCode.select.id }));
+            if (session === undefined) {
+                return executeAtomicPlans(atomic, [
+                    verificationPlan,
+                    codePlan,
+                ]).pipe(Effect.map((results) => results[1].length === 1), Effect.mapError((cause) => new RecoveryCodeLoginCommitStoreError({
+                    message: "Atomic recovery-code login commit failed",
+                    cause,
+                })));
+            }
+            const sessionExists = queryExists(Query.select({ value: Query.literal(1) }).pipe(Query.from(tables.session.table), Query.where(queryEq(tables.session.select.id, session.id))));
+            const sessionVerificationPlan = verificationPlan.pipe(Query.where(queryNot(sessionExists)));
+            const sessionPlan = queryInsertWhere(tables.session.table, mutationValues(tables.session.insert(session)), queryChangedOne()).pipe(Query.returning({ id: tables.session.select.id }));
+            return executeAtomicPlans(atomic, [
+                sessionVerificationPlan,
+                codePlan,
+                sessionPlan,
+            ]).pipe(Effect.map((results) => results[2].length === 1), Effect.mapError((cause) => new RecoveryCodeLoginCommitStoreError({
+                message: "Atomic recovery-code login commit failed",
+                cause,
+            })));
+        },
+    });
+};
 export const makeEffectQbSqliteApiKeyStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return ApiKeyStore.make({
+    return ApiKeyStore.of({
         insert: (row) => executePlan(executor, queryInsert(tables.apiKey.table, mutationValues(tables.apiKey.insert(row)))).pipe(Effect.mapError((cause) => apiKeyStoreError("insert", cause)), Effect.asVoid),
         findById: (id) => findApiKeyById(executor, tables, id),
         findByPrefix: (prefix) => findApiKeyByPrefix(executor, tables, prefix),
@@ -2445,9 +3677,9 @@ export const makeEffectQbSqliteApiKeyStore = (executor, options = {}) => {
         })),
     });
 };
-export const makeEffectQbSqliteRefreshTokenStore = (executor, options = {}) => {
+export const makeEffectQbSqliteRefreshTokenStore = (executor, atomic, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return RefreshTokenStore.make({
+    return RefreshTokenStore.of({
         insert: (row) => executePlan(executor, queryInsert(tables.refreshToken.table, mutationValues(tables.refreshToken.insert(row)))).pipe(Effect.mapError((cause) => refreshTokenStoreError("insert", cause)), Effect.asVoid),
         findById: (id) => findRefreshTokenById(executor, tables, id),
         findBySecretHash: (hash) => findRefreshTokenBySecretHash(executor, tables, hash),
@@ -2465,21 +3697,28 @@ export const makeEffectQbSqliteRefreshTokenStore = (executor, options = {}) => {
                 : base.pipe(Query.where(queryIsNull(tables.refreshToken.select.revokedAt)));
             return executePlan(executor, query).pipe(Effect.mapError((cause) => refreshTokenStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeRefreshTokenRow(tables, row))));
         },
-        rotate: (input) => executePlan(executor, queryUpdate(tables.refreshToken.table, mutationValues(tables.refreshToken.rotate(input))).pipe(Query.where(queryEq(tables.refreshToken.select.id, input.id)), Query.where(queryIsNull(tables.refreshToken.select.rotatedAt)), Query.where(queryIsNull(tables.refreshToken.select.revokedAt)), Query.returning({ id: tables.refreshToken.select.id }))).pipe(Effect.mapError((cause) => refreshTokenStoreError("rotate", cause)), Effect.flatMap((rows) => {
-            const [updated] = rows;
-            if (updated === undefined) {
-                return Effect.succeed(Option.none());
-            }
-            return findRefreshTokenById(executor, tables, RefreshTokenId(updated.id), "rotate").pipe(Effect.flatMap((previous) => {
-                if (Option.isNone(previous)) {
-                    return Effect.succeed(Option.none());
-                }
-                return executePlan(executor, queryInsert(tables.refreshToken.table, mutationValues(tables.refreshToken.insert(input.replacement)))).pipe(Effect.mapError((cause) => refreshTokenStoreError("rotate", cause)), Effect.as(Option.some({
-                    previous: previous.value,
-                    replacement: input.replacement,
-                })));
+        rotate: (input) => {
+            const { replacement } = input;
+            const rotatePlan = queryUpdate(tables.refreshToken.table, mutationValues(tables.refreshToken.rotate(input))).pipe(Query.where(queryEq(tables.refreshToken.select.id, input.id)), Query.where(queryIsNull(tables.refreshToken.select.rotatedAt)), Query.where(queryIsNull(tables.refreshToken.select.revokedAt)), Query.returning({
+                ...selectRefreshTokenColumns(tables),
+                lastUsedAt: queryWithoutNullRefinement(tables.refreshToken.select.lastUsedAt),
+                rotatedAt: queryWithoutNullRefinement(tables.refreshToken.select.rotatedAt),
+                replacedById: queryWithoutNullRefinement(tables.refreshToken.select.replacedById),
             }));
-        })),
+            const replacementPlan = queryInsertWhere(tables.refreshToken.table, mutationValues(tables.refreshToken.insert(replacement)), queryChangedOne()).pipe(Query.returning({ id: tables.refreshToken.select.id }));
+            return executeAtomicPlans(atomic, [
+                rotatePlan,
+                replacementPlan,
+            ]).pipe(Effect.mapError((cause) => refreshTokenStoreError("rotate", cause)), Effect.map(([previousRows, replacementRows]) => {
+                const [previous] = previousRows;
+                return previous === undefined || replacementRows.length === 0
+                    ? Option.none()
+                    : Option.some({
+                        previous: decodeRefreshTokenRow(tables, previous),
+                        replacement,
+                    });
+            }));
+        },
         markReuseDetected: (input) => executePlan(executor, queryUpdate(tables.refreshToken.table, mutationValues(tables.refreshToken.markReuseDetected(input))).pipe(Query.where(queryEq(tables.refreshToken.select.id, input.id)), Query.returning(selectRefreshTokenColumns(tables)))).pipe(Effect.mapError((cause) => refreshTokenStoreError("reuse", cause)), Effect.map((rows) => rows[0] === undefined
             ? Option.none()
             : Option.some(decodeRefreshTokenRow(tables, rows[0])))),
@@ -2494,7 +3733,7 @@ export const makeEffectQbSqliteRefreshTokenStore = (executor, options = {}) => {
 };
 export const makeEffectQbSqliteJwtRevocationStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return JwtRevocationStore.make({
+    return JwtRevocationStore.of({
         revoke: (record) => findJwtRevocation(executor, tables, record.jwtId, "revoke").pipe(Effect.flatMap((existing) => {
             if (Option.isNone(existing)) {
                 return executePlan(executor, queryInsert(tables.jwtRevocation.table, mutationValues(tables.jwtRevocation.insert(record))));
@@ -2508,7 +3747,7 @@ export const makeEffectQbSqliteJwtRevocationStore = (executor, options = {}) =>
 };
 export const makeEffectQbSqliteOAuthAccountStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return OAuthAccountStore.make({
+    return OAuthAccountStore.of({
         insert: (row) => executePlan(executor, queryInsert(tables.oauthAccount.table, mutationValues(tables.oauthAccount.insert(row)))).pipe(Effect.mapError((cause) => oauthAccountStoreError("insert", cause)), Effect.asVoid),
         findById: (id) => findOAuthAccountById(executor, tables, id),
         findByProviderAccount: (input) => findOAuthAccountByProviderAccount(executor, tables, input),
@@ -2532,9 +3771,90 @@ export const makeEffectQbSqliteOAuthAccountStore = (executor, options = {}) => {
         })),
     });
 };
+export const makeEffectQbSqliteOAuthIdentityBridgeStore = (executor, atomic, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    const identities = makeEffectQbSqliteIdentityStore(executor, atomic, options);
+    const accounts = makeEffectQbSqliteOAuthAccountStore(executor, options);
+    const classify = (input, cause) => Effect.gen(function* () {
+        if (Option.isSome(yield* findUserById(executor, tables, input.user.id))) {
+            return yield* new OAuthIdentityBridgeConflictError({
+                reason: "user-id",
+            });
+        }
+        if (input.identity !== undefined) {
+            if (Option.isSome(yield* identities.findById(input.identity.id))) {
+                return yield* new OAuthIdentityBridgeConflictError({
+                    reason: "identity-id",
+                });
+            }
+            if (Option.isSome(yield* identities.findByKindAndNormalizedValue({
+                scope: input.identity.scope,
+                kind: input.identity.kind,
+                normalizedValue: input.identity.normalizedValue,
+            }))) {
+                return yield* new OAuthIdentityBridgeConflictError({
+                    reason: "identity-value",
+                });
+            }
+        }
+        if (Option.isSome(yield* accounts.findById(input.account.id))) {
+            return yield* new OAuthIdentityBridgeConflictError({
+                reason: "oauth-account-id",
+            });
+        }
+        if (Option.isSome(yield* accounts.findByProviderAccount({
+            providerId: input.account.providerId,
+            providerAccountId: input.account.providerAccountId,
+            includeUnlinked: true,
+        }))) {
+            return yield* new OAuthIdentityBridgeConflictError({
+                reason: "provider-account",
+            });
+        }
+        return yield* new OAuthIdentityBridgeStoreError({
+            message: "Atomic OAuth identity creation failed",
+            cause,
+        });
+    }).pipe(Effect.catch((error) => error instanceof OAuthIdentityBridgeConflictError ||
+        error instanceof OAuthIdentityBridgeStoreError
+        ? Effect.fail(error)
+        : Effect.fail(new OAuthIdentityBridgeStoreError({
+            message: "OAuth identity conflict classification failed",
+            cause: error,
+        }))));
+    return OAuthIdentityBridgeStore.of({
+        create: (input) => {
+            if (input.account.userId !== input.user.id ||
+                (input.identity !== undefined &&
+                    input.identity.userId !== input.user.id)) {
+                return Effect.fail(new OAuthIdentityBridgeConflictError({ reason: "user-id" }));
+            }
+            const plans = [
+                queryInsert(tables.user.table, mutationValues(tables.user.insert(input.user))),
+            ];
+            if (input.identity !== undefined) {
+                plans.push(queryInsert(tables.identity.table, mutationValues(tables.identity.insert(input.identity))));
+            }
+            plans.push(queryInsert(tables.oauthAccount.table, mutationValues(tables.oauthAccount.insert(input.account))));
+            return atomic.execute(plans).pipe(Effect.map(() => ({
+                user: input.user,
+                ...(input.identity === undefined
+                    ? {}
+                    : {
+                        identity: {
+                            ...input.identity,
+                            isPrimaryLogin: input.identity.isPrimaryLogin ?? false,
+                            updatedAt: input.identity.createdAt,
+                        },
+                    }),
+                account: input.account,
+            })), Effect.catch((error) => classify(input, error)));
+        },
+    });
+};
 export const makeEffectQbSqliteOAuthClientStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return OAuthClientStore.make({
+    return OAuthClientStore.of({
         upsert: (record) => executePlan(executor, queryInsert(tables.oauthClient.table, mutationValues(tables.oauthClient.insert(record))).pipe(Query.onConflict("id", {
             update: mutationValues(tables.oauthClient.update(record)),
         }))).pipe(Effect.mapError((cause) => oauthClientStoreError("upsert", cause)), Effect.asVoid),
@@ -2551,7 +3871,7 @@ export const makeEffectQbSqliteOAuthClientStore = (executor, options = {}) => {
 };
 export const makeEffectQbSqliteOAuthConsentStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return OAuthConsentStore.make({
+    return OAuthConsentStore.of({
         upsert: (record) => executePlan(executor, queryInsert(tables.oauthConsent.table, mutationValues(tables.oauthConsent.insert(record))).pipe(Query.onConflict("id", {
             update: mutationValues(tables.oauthConsent.update(record)),
         }))).pipe(Effect.mapError((cause) => oauthConsentStoreError("upsert", cause)), Effect.asVoid),
@@ -2575,12 +3895,14 @@ export const makeEffectQbSqliteOAuthConsentStore = (executor, options = {}) => {
 };
 export const makeEffectQbSqliteOAuthAuthorizationCodeStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return OAuthAuthorizationCodeStore.make({
+    return OAuthAuthorizationCodeStore.of({
         upsert: (record) => executePlan(executor, queryInsert(tables.oauthAuthorizationCode.table, mutationValues(tables.oauthAuthorizationCode.insert(record))).pipe(Query.onConflict("code_hash", {
             update: mutationValues(tables.oauthAuthorizationCode.update(record)),
         }))).pipe(Effect.mapError((cause) => oauthAuthorizationCodeStoreError("upsert", cause)), Effect.asVoid),
         findByHash: (input) => findOAuthAuthorizationCodeByHash(executor, tables, input),
-        markConsumed: (input) => executePlan(executor, queryUpdate(tables.oauthAuthorizationCode.table, mutationValues(tables.oauthAuthorizationCode.markConsumed(input))).pipe(Query.where(queryEq(tables.oauthAuthorizationCode.select.codeHash, input.codeHash)), Query.where(queryIsNull(tables.oauthAuthorizationCode.select.consumedAt)), Query.returning({ codeHash: tables.oauthAuthorizationCode.select.codeHash }))).pipe(Effect.mapError((cause) => oauthAuthorizationCodeStoreError("mark-consumed", cause)), Effect.flatMap((rows) => {
+        markConsumed: (input) => executePlan(executor, queryUpdate(tables.oauthAuthorizationCode.table, mutationValues(tables.oauthAuthorizationCode.markConsumed(input))).pipe(Query.where(queryEq(tables.oauthAuthorizationCode.select.codeHash, input.codeHash)), Query.where(queryIsNull(tables.oauthAuthorizationCode.select.consumedAt)), Query.returning({
+            codeHash: tables.oauthAuthorizationCode.select.codeHash,
+        }))).pipe(Effect.mapError((cause) => oauthAuthorizationCodeStoreError("mark-consumed", cause)), Effect.flatMap((rows) => {
             const [consumed] = rows;
             if (consumed !== undefined) {
                 return findOAuthAuthorizationCodeByHash(executor, tables, { codeHash: consumed.codeHash }, "mark-consumed").pipe(Effect.map((record) => Option.isNone(record)
@@ -2599,10 +3921,214 @@ export const makeEffectQbSqliteOAuthAuthorizationCodeStore = (executor, options
         })),
     });
 };
+export const makeEffectQbSqliteOAuthDeviceAuthorizationStore = (executor, atomic, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    const mapping = oauthDeviceAuthorizationTable(tables);
+    const selection = selectOAuthDeviceAuthorizationColumns(tables);
+    const decode = (row) => decodeOAuthDeviceAuthorizationRow(mapping, row);
+    const find = (column, value, operation) => executePlan(executor, Query.select(selection).pipe(Query.from(mapping.table), Query.where(queryEq(column, value)))).pipe(Effect.mapError((cause) => oauthDeviceAuthorizationStoreError(operation, cause)), Effect.flatMap((rows) => Effect.try({
+        try: () => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decode(rows[0])),
+        catch: (cause) => oauthDeviceAuthorizationStoreError(operation, cause),
+    })));
+    return OAuthDeviceAuthorizationStore.of({
+        insert: (record) => executePlan(executor, queryInsert(mapping.table, mutationValues(mapping.insert(record))).pipe(Query.returning({ id: mapping.select.id }))).pipe(Effect.as(true), Effect.catch((error) => sqliteConstraintDiscriminator(error)
+            ? Effect.succeed(false)
+            : Effect.fail(oauthDeviceAuthorizationStoreError("insert", error)))),
+        findByDeviceCodeHash: (input) => find(mapping.select.deviceCodeHash, input.deviceCodeHash, "find-by-device-code-hash"),
+        findByUserCodeHash: (input) => find(mapping.select.userCodeHash, input.userCodeHash, "find-by-user-code-hash"),
+        findById: (id) => find(mapping.select.id, id, "find-by-id"),
+        decide: (input) => {
+            const updatePlan = queryUpdate(mapping.table, mutationValues(input.decision === "approve"
+                ? mapping.approve(input)
+                : mapping.deny(input))).pipe(Query.where(queryEq(mapping.select.id, input.id)), Query.where(queryEq(mapping.select.status, "pending")), Query.where(queryGt(mapping.select.expiresAt, Number(input.decidedAt))), Query.returning(selection));
+            const classifyPlan = Query.select(selection).pipe(Query.from(mapping.table), Query.where(queryEq(mapping.select.id, input.id)));
+            return executeAtomicPlans(atomic, [
+                updatePlan,
+                classifyPlan,
+            ]).pipe(Effect.mapError((cause) => oauthDeviceAuthorizationStoreError("decide", cause)), Effect.flatMap(([updated, selected]) => Effect.try({
+                try: () => {
+                    const changed = updated[0];
+                    if (changed !== undefined) {
+                        const record = decode(changed);
+                        return record.status === "approved"
+                            ? { status: "approved", record }
+                            : {
+                                status: "denied",
+                                record: record,
+                            };
+                    }
+                    const row = selected[0];
+                    if (row === undefined) {
+                        return { status: "missing" };
+                    }
+                    const record = decode(row);
+                    if (Number(input.decidedAt) >= Number(record.expiresAt)) {
+                        return { status: "expired", record };
+                    }
+                    if (record.status === "pending") {
+                        return { status: "expired", record };
+                    }
+                    return { status: "already_decided", record };
+                },
+                catch: (cause) => oauthDeviceAuthorizationStoreError("decide", cause),
+            })));
+        },
+        poll: (input) => {
+            const active = [
+                queryEq(mapping.select.deviceCodeHash, input.deviceCodeHash),
+                queryEq(mapping.select.clientId, input.clientId),
+                queryGt(mapping.select.expiresAt, Number(input.now)),
+                queryIsNull(mapping.select.consumedAt),
+                queryIn(mapping.select.status, "pending", "approved"),
+            ];
+            const intervalColumn = boundColumnName(mapping.select.pollIntervalSeconds);
+            const nextPollColumn = boundColumnName(mapping.select.nextPollAt);
+            const lastPolledColumn = boundColumnName(mapping.select.lastPolledAt);
+            const slowedInterval = sqliteIncrementByFive(mapping.select.pollIntervalSeconds);
+            const slowPlan = queryUpdate(mapping.table, {
+                [intervalColumn]: slowedInterval,
+                [nextPollColumn]: sqliteUnixMillisAfterSeconds(input.now, slowedInterval, mapping.select.status, mapping.select.nextPollAt),
+                [lastPolledColumn]: Number(input.now),
+            }).pipe(Query.where(active[0]), Query.where(active[1]), Query.where(active[2]), Query.where(active[3]), Query.where(active[4]), Query.where(queryEq(mapping.select.status, "pending")), Query.where(queryGt(mapping.select.nextPollAt, Number(input.now))), Query.returning({
+                ...selection,
+                consumedAt: queryWithoutNullRefinement(mapping.select.consumedAt),
+            }));
+            const pendingPlan = queryUpdate(mapping.table, {
+                [nextPollColumn]: sqliteUnixMillisAfterSeconds(input.now, mapping.select.pollIntervalSeconds, mapping.select.status, mapping.select.nextPollAt),
+                [lastPolledColumn]: Number(input.now),
+            }).pipe(Query.where(active[0]), Query.where(active[1]), Query.where(active[2]), Query.where(active[3]), Query.where(active[4]), Query.where(queryEq(mapping.select.status, "pending")), Query.where(queryLte(mapping.select.nextPollAt, Number(input.now))), Query.returning(selection));
+            const classifyPlan = Query.select(selection).pipe(Query.from(mapping.table), Query.where(queryEq(mapping.select.deviceCodeHash, input.deviceCodeHash)), Query.where(queryEq(mapping.select.clientId, input.clientId)));
+            return executeAtomicPlans(atomic, [
+                slowPlan,
+                pendingPlan,
+                classifyPlan,
+            ]).pipe(Effect.mapError((cause) => oauthDeviceAuthorizationStoreError("poll", cause)), Effect.flatMap(([slowed, pending, selected]) => Effect.try({
+                try: () => {
+                    const slowRow = slowed[0];
+                    if (slowRow !== undefined) {
+                        const record = decode(slowRow);
+                        return {
+                            status: "slow_down",
+                            record,
+                            interval: record.pollIntervalSeconds,
+                        };
+                    }
+                    const pendingRow = pending[0];
+                    if (pendingRow !== undefined) {
+                        return {
+                            status: "pending",
+                            record: decode(pendingRow),
+                        };
+                    }
+                    const row = selected[0];
+                    if (row === undefined) {
+                        return { status: "missing" };
+                    }
+                    const record = decode(row);
+                    if (record.status === "approved" &&
+                        record.consumedAt !== undefined) {
+                        return {
+                            status: "already_consumed",
+                            record: record,
+                        };
+                    }
+                    if (Number(input.now) >= Number(record.expiresAt)) {
+                        return { status: "expired", record };
+                    }
+                    if (record.status === "denied") {
+                        return { status: "denied", record };
+                    }
+                    if (record.status === "approved") {
+                        return {
+                            status: "approved",
+                            record: record,
+                        };
+                    }
+                    return { status: "missing" };
+                },
+                catch: (cause) => oauthDeviceAuthorizationStoreError("poll", cause),
+            })));
+        },
+        deleteExpired: (input) => executePlan(executor, Query.delete(mapping.table).pipe(Query.where(queryLte(mapping.select.expiresAt, Number(input.beforeExpiresAt))), Query.returning({ id: mapping.select.id }))).pipe(Effect.mapError((cause) => oauthDeviceAuthorizationStoreError("delete-expired", cause)), Effect.map((rows) => rows.length)),
+    });
+};
+export const makeEffectQbSqliteOAuthDeviceCodeTokenCommitStore = (atomic, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    const authorizationTable = oauthDeviceAuthorizationTable(tables);
+    const authorizationSelection = selectOAuthDeviceAuthorizationColumns(tables);
+    const decodeAuthorization = (row) => decodeOAuthDeviceAuthorizationRow(authorizationTable, row);
+    return OAuthDeviceCodeTokenCommitStore.of({
+        commit: (input) => {
+            const { authorization } = input;
+            const nextPollColumn = boundColumnName(authorizationTable.select.nextPollAt);
+            const lastPolledColumn = boundColumnName(authorizationTable.select.lastPolledAt);
+            const consumedColumn = boundColumnName(authorizationTable.select.consumedAt);
+            const consumePlan = queryUpdate(authorizationTable.table, {
+                [consumedColumn]: Number(input.consumedAt),
+                [lastPolledColumn]: Number(input.consumedAt),
+                [nextPollColumn]: sqliteUnixMillisAfterSeconds(input.consumedAt, authorizationTable.select.pollIntervalSeconds, authorizationTable.select.status, authorizationTable.select.nextPollAt),
+            }).pipe(Query.where(queryEq(authorizationTable.select.id, authorization.id)), Query.where(queryEq(authorizationTable.select.deviceCodeHash, authorization.deviceCodeHash)), Query.where(queryEq(authorizationTable.select.userCodeHash, authorization.userCodeHash)), Query.where(queryEq(authorizationTable.select.clientId, authorization.clientId)), Query.where(queryEq(authorizationTable.select.requestedScopes, JSON.stringify(authorization.requestedScopes))), Query.where(queryEq(authorizationTable.select.status, "approved")), Query.where(queryEq(authorizationTable.select.subject, authorization.subject)), Query.where(queryEq(authorizationTable.select.grantedScopes, JSON.stringify(authorization.grantedScopes))), Query.where(queryEq(authorizationTable.select.issuedAt, Number(authorization.issuedAt))), Query.where(queryEq(authorizationTable.select.expiresAt, Number(authorization.expiresAt))), Query.where(queryEq(authorizationTable.select.pollIntervalSeconds, authorization.pollIntervalSeconds)), Query.where(queryEq(authorizationTable.select.nextPollAt, Number(authorization.nextPollAt))), Query.where(queryIsNotDistinctFrom(authorizationTable.select.lastPolledAt, authorization.lastPolledAt === undefined
+                ? null
+                : Number(authorization.lastPolledAt))), Query.where(queryEq(authorizationTable.select.approvedAt, Number(authorization.approvedAt))), Query.where(queryIsNotDistinctFrom(authorizationTable.select.metadata, jsonEncode(authorization.metadata))), Query.where(queryIsNull(authorizationTable.select.consumedAt)), Query.where(queryGt(authorizationTable.select.expiresAt, Number(input.consumedAt))), Query.returning({
+                ...authorizationSelection,
+                lastPolledAt: queryWithoutNullRefinement(authorizationTable.select.lastPolledAt),
+                consumedAt: queryWithoutNullRefinement(authorizationTable.select.consumedAt),
+            }));
+            const tokenPlans = input.tokenRecords.map((record) => queryInsertWhere(tables.oauthProviderModeToken.table, mutationValues(tables.oauthProviderModeToken.insert(record)), queryChangedOne()).pipe(Query.returning({
+                tokenHash: tables.oauthProviderModeToken.select.tokenHash,
+            })));
+            const classifyPlan = Query.select(authorizationSelection).pipe(Query.from(authorizationTable.table), Query.where(queryEq(authorizationTable.select.id, authorization.id)));
+            const plans = [
+                consumePlan,
+                ...tokenPlans,
+                classifyPlan,
+            ];
+            return executeAtomicPlans(atomic, plans).pipe(Effect.mapError((cause) => new OAuthDeviceCodeTokenCommitStoreError({
+                operation: "commit",
+                message: "Atomic OAuth device token commit failed",
+                cause,
+            })), Effect.flatMap((results) => Effect.try({
+                try: () => {
+                    const changed = results[0]?.[0];
+                    if (changed !== undefined) {
+                        return {
+                            status: "committed",
+                            record: decodeAuthorization(changed),
+                        };
+                    }
+                    const selected = results.at(-1)?.[0];
+                    if (selected === undefined) {
+                        return { status: "missing" };
+                    }
+                    const record = decodeAuthorization(selected);
+                    if (record.status === "approved" &&
+                        record.consumedAt !== undefined) {
+                        return {
+                            status: "already_consumed",
+                            record: record,
+                        };
+                    }
+                    if (record.status === "approved" &&
+                        Number(input.consumedAt) >= Number(record.expiresAt)) {
+                        return { status: "expired", record };
+                    }
+                    return { status: "missing" };
+                },
+                catch: (cause) => new OAuthDeviceCodeTokenCommitStoreError({
+                    operation: "commit",
+                    message: "Failed to decode OAuth device token commit result",
+                    cause,
+                }),
+            })));
+        },
+    });
+};
 export const makeEffectQbSqliteOAuthClientSecretStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return OAuthClientSecretStore.make({
-        upsert: (record) => executePlan(executor, queryInsert(tables.oauthClientSecret.table, mutationValues(tables.oauthClientSecret.insert(record))).pipe(Query.onConflict("prefix", {
+    return OAuthClientSecretStore.of({
+        upsert: (record) => executePlan(executor, queryInsert(tables.oauthClientSecret.table, mutationValues(tables.oauthClientSecret.insert(record))).pipe(Query.onConflict(["client_id", "prefix"], {
             update: mutationValues(tables.oauthClientSecret.update(record)),
         }))).pipe(Effect.mapError((cause) => oauthClientSecretStoreError("upsert", cause)), Effect.asVoid),
         findByClientIdAndPrefix: (input) => findOAuthClientSecretByClientIdAndPrefix(executor, tables, input),
@@ -2621,7 +4147,7 @@ export const makeEffectQbSqliteOAuthClientSecretStore = (executor, options = {})
 };
 export const makeEffectQbSqliteOAuthProviderModeTokenStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return OAuthProviderModeTokenStore.make({
+    return OAuthProviderModeTokenStore.of({
         upsert: (record) => executePlan(executor, queryInsert(tables.oauthProviderModeToken.table, mutationValues(tables.oauthProviderModeToken.insert(record))).pipe(Query.onConflict("token_hash", {
             update: mutationValues(tables.oauthProviderModeToken.update(record)),
         }))).pipe(Effect.mapError((cause) => oauthProviderModeTokenStoreError("upsert", cause)), Effect.asVoid),
@@ -2646,7 +4172,7 @@ export const makeEffectQbSqliteOAuthProviderModeTokenStore = (executor, options
 };
 export const makeEffectQbSqliteOAuthProviderTokenVault = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return OAuthProviderTokenVault.make({
+    return OAuthProviderTokenVault.of({
         upsert: (record) => findOAuthProviderTokenVaultRecordByAccountId(executor, tables, { accountId: record.accountId }, "upsert", true).pipe(Effect.flatMap((existing) => Option.isNone(existing)
             ? executePlan(executor, queryInsert(tables.oauthProviderTokenVault.table, mutationValues(tables.oauthProviderTokenVault.insert(record))))
             : executePlan(executor, queryUpdate(tables.oauthProviderTokenVault.table, mutationValues(tables.oauthProviderTokenVault.update(record))).pipe(Query.where(queryEq(tables.oauthProviderTokenVault.select.accountId, record.accountId))))), Effect.mapError((cause) => cause instanceof OAuthProviderTokenVaultError
@@ -2671,7 +4197,7 @@ export const makeEffectQbSqliteOAuthProviderTokenVault = (executor, options = {}
 };
 export const makeEffectQbSqliteDomainVerificationStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return DomainVerificationStore.make({
+    return DomainVerificationStore.of({
         upsert: (record) => findDomainVerificationByOwnerAndDomain(executor, tables, { ownerId: record.ownerId, domain: record.domain }, "upsert").pipe(Effect.flatMap((existing) => Option.isNone(existing)
             ? executePlan(executor, queryInsert(tables.domainVerification.table, mutationValues(tables.domainVerification.insert(record))))
             : executePlan(executor, queryUpdate(tables.domainVerification.table, mutationValues(tables.domainVerification.update(record))).pipe(Query.where(queryEq(tables.domainVerification.select.ownerId, record.ownerId)), Query.where(queryEq(tables.domainVerification.select.domain, record.domain))))), Effect.mapError((cause) => cause instanceof DomainVerificationStoreError
@@ -2683,8 +4209,8 @@ export const makeEffectQbSqliteDomainVerificationStore = (executor, options = {}
             const base = Query.select(selectDomainVerificationColumns(tables)).pipe(Query.from(tables.domainVerification.table), Query.where(queryEq(tables.domainVerification.select.ownerId, input.ownerId)));
             const query = input.includeRevoked === true
                 ? base
-                : base.pipe(Query.where(queryIsNull(tables.domainVerification.select.revokedAt)));
-            return executePlan(executor, query).pipe(Effect.mapError((cause) => domainVerificationStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeDomainVerificationRecord(tables, row))));
+                : base.pipe(Query.where(queryNeq(tables.domainVerification.select.status, "revoked")));
+            return executePlan(executor, query.pipe(Query.orderBy(tables.domainVerification.select.createdAt, "asc"), Query.orderBy(tables.domainVerification.select.id, "asc"))).pipe(Effect.mapError((cause) => domainVerificationStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeDomainVerificationRecord(tables, row))));
         },
         markVerified: (input) => executePlan(executor, queryUpdate(tables.domainVerification.table, mutationValues(tables.domainVerification.markVerified(input))).pipe(Query.where(queryEq(tables.domainVerification.select.id, input.id)), Query.where(queryEq(tables.domainVerification.select.status, "pending")), Query.returning(selectDomainVerificationColumns(tables)))).pipe(Effect.mapError((cause) => domainVerificationStoreError("mark-verified", cause)), Effect.map((rows) => rows[0] === undefined
             ? Option.none()
@@ -2699,7 +4225,7 @@ export const makeEffectQbSqliteDomainVerificationStore = (executor, options = {}
 };
 export const makeEffectQbSqliteSecurityTimelineStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return SecurityTimelineStore.make({
+    return SecurityTimelineStore.of({
         insert: (event) => executePlan(executor, queryInsert(tables.securityTimeline.table, mutationValues(tables.securityTimeline.insert(event)))).pipe(Effect.mapError((cause) => securityTimelineStoreError("insert", cause)), Effect.asVoid),
         listByUser: (input) => listSecurityTimelineByUser(executor, tables, input),
         deleteBefore: (input) => deleteSecurityTimelineBefore(executor, tables, input),
@@ -2707,7 +4233,7 @@ export const makeEffectQbSqliteSecurityTimelineStore = (executor, options = {})
 };
 export const makeEffectQbSqliteWebhookOutboxStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return WebhookOutboxStore.make({
+    return WebhookOutboxStore.of({
         enqueue: (input) => Effect.gen(function* () {
             const now = input.now ?? (yield* currentUnixMillis);
             const record = {
@@ -2726,7 +4252,8 @@ export const makeEffectQbSqliteWebhookOutboxStore = (executor, options = {}) =>
         claimDue: (input) => claimDueWebhookOutboxRecords(executor, tables, input),
         markDelivered: (input) => Effect.gen(function* () {
             const existing = yield* findWebhookOutboxRecordById(executor, tables, input.id, "markDelivered");
-            if (Option.isNone(existing) || existing.value.status === "dead_lettered") {
+            if (Option.isNone(existing) ||
+                existing.value.status === "dead_lettered") {
                 return;
             }
             const deliveredAt = input.deliveredAt ?? (yield* currentUnixMillis);
@@ -2764,7 +4291,7 @@ export const makeEffectQbSqliteWebhookOutboxStore = (executor, options = {}) =>
 };
 export const makeEffectQbSqliteWebhookReplayStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
-    return WebhookReplayStore.make({
+    return WebhookReplayStore.of({
         claim: (input) => Effect.gen(function* () {
             const now = input.now ?? (yield* currentUnixMillis);
             const claim = { ...input, now };
@@ -2777,8 +4304,297 @@ export const makeEffectQbSqliteWebhookReplayStore = (executor, options = {}) =>
         deleteExpired: (input = {}) => deleteExpiredWebhookReplayRecords(executor, tables, input),
     });
 };
-export const makeEffectQbSqliteStorage = (executor, options = {}) => ({
+const permissionScopeKey = (scope) => [
+    scope?.type ?? "global",
+    scope?.id === undefined ? 0 : 1,
+    scope?.id ?? "",
+];
+const comparePermissionText = (left, right) => left === right
+    ? 0
+    : left === undefined
+        ? -1
+        : right === undefined
+            ? 1
+            : left < right
+                ? -1
+                : 1;
+const comparePermissionScopes = (left, right) => {
+    if (left === undefined || right === undefined) {
+        return left === right ? 0 : left === undefined ? -1 : 1;
+    }
+    return (comparePermissionText(left.type, right.type) ||
+        comparePermissionText(left.id, right.id));
+};
+const permissionScopesMatchExactly = (left, right) => {
+    const [leftType, leftIdPresent, leftId] = permissionScopeKey(left);
+    const [rightType, rightIdPresent, rightId] = permissionScopeKey(right);
+    return (leftType === rightType &&
+        leftIdPresent === rightIdPresent &&
+        leftId === rightId);
+};
+const permissionGrantIsActive = (grant, at) => grant.revokedAt === undefined &&
+    (grant.expiresAt === undefined || Number(grant.expiresAt) > Number(at));
+const comparePermissionGrantRecords = (left, right) => comparePermissionText(left.subject.type, right.subject.type) ||
+    comparePermissionText(left.subject.id, right.subject.id) ||
+    comparePermissionText(left.permission, right.permission) ||
+    comparePermissionScopes(left.scope, right.scope);
+const compareRoleGrantRecords = (left, right) => comparePermissionText(left.subject.type, right.subject.type) ||
+    comparePermissionText(left.subject.id, right.subject.id) ||
+    comparePermissionText(left.role, right.role) ||
+    comparePermissionScopes(left.scope, right.scope);
+const compareRolePermissionRecords = (left, right) => comparePermissionText(left.role, right.role) ||
+    comparePermissionText(left.permission, right.permission) ||
+    comparePermissionText(left.scopeType, right.scopeType);
+export const makeEffectQbSqlitePermissionStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    const permissionGrantWhere = (input) => {
+        const { scope: _scope, ...withoutScope } = input;
+        const scope = canonicalPermissionScope(input.scope);
+        const canonicalInput = {
+            ...withoutScope,
+            ...(scope === undefined ? {} : { scope }),
+        };
+        const [scopeType, scopeIdPresent, scopeId] = permissionScopeKey(scope);
+        return queryUpdate(tables.permissionGrant.table, mutationValues(tables.permissionGrant.revoke(canonicalInput, input.revokedAt ?? UnixMillis(Date.now())))).pipe(Query.where(queryEq(tables.permissionGrant.select.subjectType, input.subject.type)), Query.where(queryEq(tables.permissionGrant.select.subjectId, input.subject.id)), Query.where(queryEq(tables.permissionGrant.select.permissionId, input.permission)), Query.where(queryEq(tables.permissionGrant.select.scopeType, scopeType)), Query.where(queryEq(tables.permissionGrant.select.scopeIdPresent, scopeIdPresent)), Query.where(queryEq(tables.permissionGrant.select.scopeId, scopeId)));
+    };
+    const roleGrantWhere = (input) => {
+        const { scope: _scope, ...withoutScope } = input;
+        const scope = canonicalPermissionScope(input.scope);
+        const canonicalInput = {
+            ...withoutScope,
+            ...(scope === undefined ? {} : { scope }),
+        };
+        const [scopeType, scopeIdPresent, scopeId] = permissionScopeKey(scope);
+        return queryUpdate(tables.roleGrant.table, mutationValues(tables.roleGrant.revoke(canonicalInput, input.revokedAt ?? UnixMillis(Date.now())))).pipe(Query.where(queryEq(tables.roleGrant.select.subjectType, input.subject.type)), Query.where(queryEq(tables.roleGrant.select.subjectId, input.subject.id)), Query.where(queryEq(tables.roleGrant.select.roleId, input.role)), Query.where(queryEq(tables.roleGrant.select.scopeType, scopeType)), Query.where(queryEq(tables.roleGrant.select.scopeIdPresent, scopeIdPresent)), Query.where(queryEq(tables.roleGrant.select.scopeId, scopeId)));
+    };
+    const checkResult = (operation, allowed) => executePlan(executor, Query.select({ allowed: allowed })).pipe(Effect.mapError((cause) => permissionStoreError(operation, cause)), Effect.map((rows) => decodeBoolean(rows[0]?.allowed)));
+    const findPermissionDefinition = (id, operation = "find_permission_definition") => executePlan(executor, Query.select(selectPermissionDefinitionColumns(tables)).pipe(Query.from(tables.permissionDefinition.table), Query.where(queryEq(tables.permissionDefinition.select.id, id)))).pipe(Effect.mapError((cause) => permissionStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+        ? Option.none()
+        : Option.some(decodePermissionDefinition(tables, rows[0]))));
+    const findRoleDefinition = (id, operation = "find_role_definition") => executePlan(executor, Query.select(selectRoleDefinitionColumns(tables)).pipe(Query.from(tables.roleDefinition.table), Query.where(queryEq(tables.roleDefinition.select.id, id)))).pipe(Effect.mapError((cause) => permissionStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+        ? Option.none()
+        : Option.some(decodeRoleDefinition(tables, rows[0]))));
+    const mutatePermissionDefinition = (operation, input, values) => {
+        const returning = operation === "delete_permission_definition"
+            ? {
+                ...selectPermissionDefinitionColumns(tables),
+                deletedAt: queryWithoutNullRefinement(tables.permissionDefinition.select.deletedAt),
+            }
+            : selectPermissionDefinitionColumns(tables);
+        return executePlan(executor, queryUpdate(tables.permissionDefinition.table, mutationValues(values)).pipe(Query.where(queryEq(tables.permissionDefinition.select.id, input.id)), Query.where(queryEq(tables.permissionDefinition.select.updatedAt, Number(input.expectedUpdatedAt))), Query.where(queryIsNull(tables.permissionDefinition.select.deletedAt)), Query.returning(returning))).pipe(Effect.mapError((cause) => permissionStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodePermissionDefinition(tables, rows[0]))));
+    };
+    const mutateRoleDefinition = (operation, input, values) => {
+        const returning = operation === "delete_role_definition"
+            ? {
+                ...selectRoleDefinitionColumns(tables),
+                deletedAt: queryWithoutNullRefinement(tables.roleDefinition.select.deletedAt),
+            }
+            : selectRoleDefinitionColumns(tables);
+        return executePlan(executor, queryUpdate(tables.roleDefinition.table, mutationValues(values)).pipe(Query.where(queryEq(tables.roleDefinition.select.id, input.id)), Query.where(queryEq(tables.roleDefinition.select.updatedAt, Number(input.expectedUpdatedAt))), Query.where(queryIsNull(tables.roleDefinition.select.deletedAt)), Query.returning(returning))).pipe(Effect.mapError((cause) => permissionStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeRoleDefinition(tables, rows[0]))));
+    };
+    return PermissionStore.of({
+        createPermissionDefinition: (definition) => executePlan(executor, queryInsert(tables.permissionDefinition.table, mutationValues(tables.permissionDefinition.insert(definition))).pipe(SqliteQuery.onConflict(tables.permissionDefinition.conflictTarget), Query.returning(selectPermissionDefinitionColumns(tables)))).pipe(Effect.mapError((cause) => permissionStoreError("create_permission_definition", cause)), Effect.map((rows) => rows.length > 0)),
+        findPermissionDefinition: (id) => findPermissionDefinition(id),
+        listPermissionDefinitions: (input = {}) => {
+            const base = Query.select(selectPermissionDefinitionColumns(tables)).pipe(Query.from(tables.permissionDefinition.table));
+            const withoutDisabled = input.includeDisabled === true
+                ? base
+                : base.pipe(Query.where(queryIsNull(tables.permissionDefinition.select.disabledAt)));
+            const withoutDeleted = input.includeDeleted === true
+                ? withoutDisabled
+                : withoutDisabled.pipe(Query.where(queryIsNull(tables.permissionDefinition.select.deletedAt)));
+            const after = input.after === undefined
+                ? withoutDeleted
+                : withoutDeleted.pipe(Query.where(queryGt(tables.permissionDefinition.select.id, input.after)));
+            const query = after.pipe(Query.orderBy(tables.permissionDefinition.select.id, "asc"), Query.limit(normalizePermissionDefinitionListLimit(input.limit)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => permissionStoreError("list_permission_definitions", cause)), Effect.map((rows) => rows.map((row) => decodePermissionDefinition(tables, row))));
+        },
+        updatePermissionDefinition: (input) => mutatePermissionDefinition("update_permission_definition", input, tables.permissionDefinition.update(input)),
+        setPermissionDefinitionDisabled: (input) => mutatePermissionDefinition("set_permission_definition_disabled", input, tables.permissionDefinition.setDisabled(input)),
+        deletePermissionDefinition: (input) => mutatePermissionDefinition("delete_permission_definition", input, tables.permissionDefinition.delete(input)),
+        createRoleDefinition: (definition) => executePlan(executor, queryInsert(tables.roleDefinition.table, mutationValues(tables.roleDefinition.insert(definition))).pipe(SqliteQuery.onConflict(tables.roleDefinition.conflictTarget), Query.returning(selectRoleDefinitionColumns(tables)))).pipe(Effect.mapError((cause) => permissionStoreError("create_role_definition", cause)), Effect.map((rows) => rows.length > 0)),
+        findRoleDefinition: (id) => findRoleDefinition(id),
+        listRoleDefinitions: (input = {}) => {
+            const base = Query.select(selectRoleDefinitionColumns(tables)).pipe(Query.from(tables.roleDefinition.table));
+            const withoutDisabled = input.includeDisabled === true
+                ? base
+                : base.pipe(Query.where(queryIsNull(tables.roleDefinition.select.disabledAt)));
+            const query = input.includeDeleted === true
+                ? withoutDisabled
+                : withoutDisabled.pipe(Query.where(queryIsNull(tables.roleDefinition.select.deletedAt)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => permissionStoreError("list_role_definitions", cause)), Effect.map((rows) => rows
+                .map((row) => decodeRoleDefinition(tables, row))
+                .sort((left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0)));
+        },
+        updateRoleDefinition: (input) => mutateRoleDefinition("update_role_definition", input, tables.roleDefinition.update(input)),
+        setRoleDefinitionDisabled: (input) => mutateRoleDefinition("set_role_definition_disabled", input, tables.roleDefinition.setDisabled(input)),
+        deleteRoleDefinition: (input) => mutateRoleDefinition("delete_role_definition", input, tables.roleDefinition.delete(input)),
+        grantPermission: (input) => Effect.suspend(() => {
+            const { scope: _scope, ...withoutScope } = input;
+            const scope = canonicalPermissionScope(input.scope);
+            const grant = {
+                ...withoutScope,
+                ...(scope === undefined ? {} : { scope }),
+            };
+            return executePlan(executor, queryInsert(tables.permissionGrant.table, mutationValues(tables.permissionGrant.insert(grant))).pipe(SqliteQuery.onConflict([
+                "subject_type",
+                "subject_id",
+                "permission_id",
+                "scope_type",
+                "scope_id_present",
+                "scope_id",
+            ], { update: mutationValues(tables.permissionGrant.update(grant)) }))).pipe(Effect.mapError((cause) => permissionStoreError("grant_permission", cause)), Effect.asVoid);
+        }),
+        revokePermission: (input) => Effect.suspend(() => executePlan(executor, permissionGrantWhere(input)).pipe(Effect.mapError((cause) => permissionStoreError("revoke_permission", cause)), Effect.asVoid)),
+        listPermissionGrants: (input = {}) => Effect.suspend(() => {
+            const at = input.at ?? UnixMillis(Date.now());
+            const activity = input.activity ?? "active";
+            const base = Query.select(selectPermissionGrantColumns(tables)).pipe(Query.from(tables.permissionGrant.table));
+            const bySubjectType = input.subject === undefined
+                ? base
+                : base.pipe(Query.where(queryEq(tables.permissionGrant.select.subjectType, input.subject.type)));
+            const bySubject = input.subject === undefined
+                ? bySubjectType
+                : bySubjectType.pipe(Query.where(queryEq(tables.permissionGrant.select.subjectId, input.subject.id)));
+            const byPermission = input.permission === undefined
+                ? bySubject
+                : bySubject.pipe(Query.where(queryEq(tables.permissionGrant.select.permissionId, input.permission)));
+            const [scopeType, scopeIdPresent, scopeId] = permissionScopeKey(input.scope);
+            const query = input.scope === undefined
+                ? byPermission
+                : byPermission.pipe(Query.where(queryEq(tables.permissionGrant.select.scopeType, scopeType)), Query.where(queryEq(tables.permissionGrant.select.scopeIdPresent, scopeIdPresent)), Query.where(queryEq(tables.permissionGrant.select.scopeId, scopeId)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => permissionStoreError("list_permission_grants", cause)), Effect.flatMap((rows) => Effect.try({
+                try: () => rows
+                    .map((row) => decodePermissionGrant(tables, row))
+                    .filter((grant) => (input.subject === undefined ||
+                    (grant.subject.type === input.subject.type &&
+                        grant.subject.id === input.subject.id)) &&
+                    (input.permission === undefined ||
+                        grant.permission === input.permission) &&
+                    (input.scope === undefined ||
+                        permissionScopesMatchExactly(grant.scope, input.scope)) &&
+                    (activity === "all" ||
+                        permissionGrantIsActive(grant, at) ===
+                            (activity === "active")))
+                    .sort(comparePermissionGrantRecords),
+                catch: (cause) => permissionStoreError("list_permission_grants", cause),
+            })));
+        }),
+        grantRole: (input) => Effect.suspend(() => {
+            const { scope: _scope, ...withoutScope } = input;
+            const scope = canonicalPermissionScope(input.scope);
+            const grant = {
+                ...withoutScope,
+                ...(scope === undefined ? {} : { scope }),
+            };
+            return executePlan(executor, queryInsert(tables.roleGrant.table, mutationValues(tables.roleGrant.insert(grant))).pipe(SqliteQuery.onConflict([
+                "subject_type",
+                "subject_id",
+                "role_id",
+                "scope_type",
+                "scope_id_present",
+                "scope_id",
+            ], { update: mutationValues(tables.roleGrant.update(grant)) }))).pipe(Effect.mapError((cause) => permissionStoreError("grant_role", cause)), Effect.asVoid);
+        }),
+        revokeRole: (input) => Effect.suspend(() => executePlan(executor, roleGrantWhere(input)).pipe(Effect.mapError((cause) => permissionStoreError("revoke_role", cause)), Effect.asVoid)),
+        listRoleGrants: (input = {}) => Effect.suspend(() => {
+            const at = input.at ?? UnixMillis(Date.now());
+            const activity = input.activity ?? "active";
+            const base = Query.select(selectRoleGrantColumns(tables)).pipe(Query.from(tables.roleGrant.table));
+            const bySubjectType = input.subject === undefined
+                ? base
+                : base.pipe(Query.where(queryEq(tables.roleGrant.select.subjectType, input.subject.type)));
+            const bySubject = input.subject === undefined
+                ? bySubjectType
+                : bySubjectType.pipe(Query.where(queryEq(tables.roleGrant.select.subjectId, input.subject.id)));
+            const byRole = input.role === undefined
+                ? bySubject
+                : bySubject.pipe(Query.where(queryEq(tables.roleGrant.select.roleId, input.role)));
+            const [scopeType, scopeIdPresent, scopeId] = permissionScopeKey(input.scope);
+            const query = input.scope === undefined
+                ? byRole
+                : byRole.pipe(Query.where(queryEq(tables.roleGrant.select.scopeType, scopeType)), Query.where(queryEq(tables.roleGrant.select.scopeIdPresent, scopeIdPresent)), Query.where(queryEq(tables.roleGrant.select.scopeId, scopeId)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => permissionStoreError("list_role_grants", cause)), Effect.flatMap((rows) => Effect.try({
+                try: () => rows
+                    .map((row) => decodeRoleGrant(tables, row))
+                    .filter((grant) => (input.subject === undefined ||
+                    (grant.subject.type === input.subject.type &&
+                        grant.subject.id === input.subject.id)) &&
+                    (input.role === undefined || grant.role === input.role) &&
+                    (input.scope === undefined ||
+                        permissionScopesMatchExactly(grant.scope, input.scope)) &&
+                    (activity === "all" ||
+                        permissionGrantIsActive(grant, at) ===
+                            (activity === "active")))
+                    .sort(compareRoleGrantRecords),
+                catch: (cause) => permissionStoreError("list_role_grants", cause),
+            })));
+        }),
+        assignRolePermission: (input) => executePlan(executor, queryInsert(tables.rolePermission.table, mutationValues(tables.rolePermission.insert(input))).pipe(SqliteQuery.onConflict([
+            "role_id",
+            "permission_id",
+            "scope_type_present",
+            "scope_type",
+        ]))).pipe(Effect.mapError((cause) => permissionStoreError("assign_role_permission", cause)), Effect.asVoid),
+        removeRolePermission: (input) => executePlan(executor, Query.delete(tables.rolePermission.table).pipe(Query.where(queryEq(tables.rolePermission.select.roleId, input.role)), Query.where(queryEq(tables.rolePermission.select.permissionId, input.permission)), Query.where(queryEq(tables.rolePermission.select.scopeTypePresent, input.scopeType === undefined ? 0 : 1)), Query.where(queryEq(tables.rolePermission.select.scopeType, input.scopeType ?? "")))).pipe(Effect.mapError((cause) => permissionStoreError("remove_role_permission", cause)), Effect.asVoid),
+        listRolePermissions: (input = {}) => {
+            const base = Query.select(selectRolePermissionColumns(tables)).pipe(Query.from(tables.rolePermission.table));
+            const byRole = input.role === undefined
+                ? base
+                : base.pipe(Query.where(queryEq(tables.rolePermission.select.roleId, input.role)));
+            const byPermission = input.permission === undefined
+                ? byRole
+                : byRole.pipe(Query.where(queryEq(tables.rolePermission.select.permissionId, input.permission)));
+            const byScopePresence = input.scopeType === undefined
+                ? byPermission
+                : byPermission.pipe(Query.where(queryEq(tables.rolePermission.select.scopeTypePresent, input.scopeType === null ? 0 : 1)));
+            const query = input.scopeType === undefined || input.scopeType === null
+                ? byScopePresence
+                : byScopePresence.pipe(Query.where(queryEq(tables.rolePermission.select.scopeType, input.scopeType)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => permissionStoreError("list_role_permissions", cause)), Effect.flatMap((rows) => Effect.try({
+                try: () => rows
+                    .map((row) => decodeRolePermission(tables, row))
+                    .filter((rolePermission) => (input.role === undefined ||
+                    rolePermission.role === input.role) &&
+                    (input.permission === undefined ||
+                        rolePermission.permission === input.permission) &&
+                    (input.scopeType === undefined ||
+                        (input.scopeType === null
+                            ? rolePermission.scopeType === undefined
+                            : rolePermission.scopeType === input.scopeType)))
+                    .sort(compareRolePermissionRecords),
+                catch: (cause) => permissionStoreError("list_role_permissions", cause),
+            })));
+        },
+        hasPermission: (input) => Effect.suspend(() => {
+            const now = Date.now();
+            const [scopeType, scopeIdPresent, scopeId] = permissionScopeKey(input.scope);
+            const permissionScope = queryOr(queryAnd(queryEq(tables.permissionGrant.select.scopeType, "global"), queryEq(tables.permissionGrant.select.scopeIdPresent, 0)), queryAnd(queryEq(tables.permissionGrant.select.scopeType, scopeType), queryEq(tables.permissionGrant.select.scopeIdPresent, scopeIdPresent), queryEq(tables.permissionGrant.select.scopeId, scopeId)));
+            const direct = queryExists(Query.select({ value: Query.literal(1) }).pipe(Query.from(tables.permissionGrant.table), Query.where(queryEq(tables.permissionGrant.select.subjectType, input.subject.type)), Query.where(queryEq(tables.permissionGrant.select.subjectId, input.subject.id)), Query.where(queryEq(tables.permissionGrant.select.permissionId, input.permission)), Query.where(queryIsNull(tables.permissionGrant.select.revokedAt)), Query.where(queryOr(queryIsNull(tables.permissionGrant.select.expiresAt), queryGt(tables.permissionGrant.select.expiresAt, now))), Query.where(permissionScope)));
+            const roleGrant = aliasTable(tables.roleGrant.table, "role_grant");
+            const roleGrantColumn = (column) => aliasColumn(roleGrant, column);
+            const rolePermission = aliasTable(tables.rolePermission.table, "role_permission");
+            const rolePermissionColumn = (column) => aliasColumn(rolePermission, column);
+            const rolePermissionExists = queryExists(Query.select({ value: Query.literal(1) }).pipe(Query.from(rolePermission), Query.where(queryEq(rolePermissionColumn(tables.rolePermission.select.roleId), roleGrantColumn(tables.roleGrant.select.roleId))), Query.where(queryEq(rolePermissionColumn(tables.rolePermission.select.permissionId), input.permission)), Query.where(queryOr(queryEq(rolePermissionColumn(tables.rolePermission.select.scopeTypePresent), 0), queryAnd(queryEq(rolePermissionColumn(tables.rolePermission.select.scopeTypePresent), 1), queryEq(rolePermissionColumn(tables.rolePermission.select.scopeType), scopeType))))));
+            const role = queryExists(Query.select({ value: Query.literal(1) }).pipe(Query.from(roleGrant), Query.where(queryEq(roleGrantColumn(tables.roleGrant.select.subjectType), input.subject.type)), Query.where(queryEq(roleGrantColumn(tables.roleGrant.select.subjectId), input.subject.id)), Query.where(queryIsNull(roleGrantColumn(tables.roleGrant.select.revokedAt))), Query.where(queryOr(queryIsNull(roleGrantColumn(tables.roleGrant.select.expiresAt)), queryGt(roleGrantColumn(tables.roleGrant.select.expiresAt), now))), Query.where(queryOr(queryAnd(queryEq(roleGrantColumn(tables.roleGrant.select.scopeType), "global"), queryEq(roleGrantColumn(tables.roleGrant.select.scopeIdPresent), 0)), queryAnd(queryEq(roleGrantColumn(tables.roleGrant.select.scopeType), scopeType), queryEq(roleGrantColumn(tables.roleGrant.select.scopeIdPresent), scopeIdPresent), queryEq(roleGrantColumn(tables.roleGrant.select.scopeId), scopeId)))), Query.where(rolePermissionExists)));
+            return checkResult("has_permission", queryOr(direct, role));
+        }),
+        hasRole: (input) => Effect.suspend(() => {
+            const now = Date.now();
+            const [scopeType, scopeIdPresent, scopeId] = permissionScopeKey(input.scope);
+            const allowed = queryExists(Query.select({ value: Query.literal(1) }).pipe(Query.from(tables.roleGrant.table), Query.where(queryEq(tables.roleGrant.select.subjectType, input.subject.type)), Query.where(queryEq(tables.roleGrant.select.subjectId, input.subject.id)), Query.where(queryEq(tables.roleGrant.select.roleId, input.role)), Query.where(queryIsNull(tables.roleGrant.select.revokedAt)), Query.where(queryOr(queryIsNull(tables.roleGrant.select.expiresAt), queryGt(tables.roleGrant.select.expiresAt, now))), Query.where(queryOr(queryAnd(queryEq(tables.roleGrant.select.scopeType, "global"), queryEq(tables.roleGrant.select.scopeIdPresent, 0)), queryAnd(queryEq(tables.roleGrant.select.scopeType, scopeType), queryEq(tables.roleGrant.select.scopeIdPresent, scopeIdPresent), queryEq(tables.roleGrant.select.scopeId, scopeId))))));
+            return checkResult("has_role", allowed);
+        }),
+    });
+};
+export const makeEffectQbSqliteStorage = (executor, atomic, options = {}) => ({
     userStore: makeEffectQbSqliteUserStore(executor, options),
+    identityStore: makeEffectQbSqliteIdentityStore(executor, atomic, options),
+    registrationStore: makeEffectQbSqliteRegistrationStore(executor, atomic, options),
     credentialStore: makeEffectQbSqliteCredentialStore(executor, options),
     sessionStore: makeEffectQbSqliteSessionStore(executor, options),
     verificationStore: makeEffectQbSqliteVerificationStore(executor, options),
@@ -2788,14 +4604,21 @@ export const makeEffectQbSqliteStorage = (executor, options = {}) => ({
     trustedDeviceStore: makeEffectQbSqliteTrustedDeviceStore(executor, options),
     passkeyCredentialStore: makeEffectQbSqlitePasskeyCredentialStore(executor, options),
     totpFactorStore: makeEffectQbSqliteTotpFactorStore(executor, options),
-    recoveryCodeStore: makeEffectQbSqliteRecoveryCodeStore(executor, options),
+    totpSessionRotateStore: makeEffectQbSqliteTotpSessionRotateStore(executor, atomic, options),
+    totpLoginCommitStore: makeEffectQbSqliteTotpLoginCommitStore(atomic, options),
+    recoveryCodeStore: makeEffectQbSqliteRecoveryCodeStore(executor, atomic, options),
+    recoveryCodeSessionRotateStore: makeEffectQbSqliteRecoveryCodeSessionRotateStore(executor, atomic, options),
+    recoveryCodeLoginCommitStore: makeEffectQbSqliteRecoveryCodeLoginCommitStore(atomic, options),
     apiKeyStore: makeEffectQbSqliteApiKeyStore(executor, options),
-    refreshTokenStore: makeEffectQbSqliteRefreshTokenStore(executor, options),
+    refreshTokenStore: makeEffectQbSqliteRefreshTokenStore(executor, atomic, options),
     jwtRevocationStore: makeEffectQbSqliteJwtRevocationStore(executor, options),
     oauthAccountStore: makeEffectQbSqliteOAuthAccountStore(executor, options),
+    oauthIdentityBridgeStore: makeEffectQbSqliteOAuthIdentityBridgeStore(executor, atomic, options),
     oauthClientStore: makeEffectQbSqliteOAuthClientStore(executor, options),
     oauthConsentStore: makeEffectQbSqliteOAuthConsentStore(executor, options),
     oauthAuthorizationCodeStore: makeEffectQbSqliteOAuthAuthorizationCodeStore(executor, options),
+    oauthDeviceAuthorizationStore: makeEffectQbSqliteOAuthDeviceAuthorizationStore(executor, atomic, options),
+    oauthDeviceCodeTokenCommitStore: makeEffectQbSqliteOAuthDeviceCodeTokenCommitStore(atomic, options),
     oauthClientSecretStore: makeEffectQbSqliteOAuthClientSecretStore(executor, options),
     oauthProviderModeTokenStore: makeEffectQbSqliteOAuthProviderModeTokenStore(executor, options),
     oauthProviderTokenVault: makeEffectQbSqliteOAuthProviderTokenVault(executor, options),
@@ -2803,8 +4626,9 @@ export const makeEffectQbSqliteStorage = (executor, options = {}) => ({
     securityTimelineStore: makeEffectQbSqliteSecurityTimelineStore(executor, options),
     webhookOutboxStore: makeEffectQbSqliteWebhookOutboxStore(executor, options),
     webhookReplayStore: makeEffectQbSqliteWebhookReplayStore(executor, options),
+    permissionStore: makeEffectQbSqlitePermissionStore(executor, options),
 });
-export const EffectQbSqliteAuthStorageLive = (executor, options = {}) => Layer.mergeAll(Layer.succeed(UserStore)(makeEffectQbSqliteUserStore(executor, options)), Layer.succeed(CredentialStore)(makeEffectQbSqliteCredentialStore(executor, options)), Layer.succeed(SessionStore)(makeEffectQbSqliteSessionStore(executor, options)), Layer.succeed(VerificationStore)(makeEffectQbSqliteVerificationStore(executor, options)), Layer.succeed(AuditLogStore)(makeEffectQbSqliteAuditLogStore(executor, options)), Layer.succeed(LoginApprovalReviewStore)(makeEffectQbSqliteLoginApprovalReviewStore(executor, options)), Layer.succeed(LoginRiskHistory)(makeEffectQbSqliteLoginRiskHistoryStore(executor, options)), Layer.succeed(TrustedDeviceStore)(makeEffectQbSqliteTrustedDeviceStore(executor, options)), Layer.succeed(PasskeyCredentialStore)(makeEffectQbSqlitePasskeyCredentialStore(executor, options)), Layer.succeed(TotpFactorStore)(makeEffectQbSqliteTotpFactorStore(executor, options)), Layer.succeed(RecoveryCodeStore)(makeEffectQbSqliteRecoveryCodeStore(executor, options)), Layer.succeed(ApiKeyStore)(makeEffectQbSqliteApiKeyStore(executor, options)), Layer.succeed(RefreshTokenStore)(makeEffectQbSqliteRefreshTokenStore(executor, options)), Layer.succeed(JwtRevocationStore)(makeEffectQbSqliteJwtRevocationStore(executor, options)), Layer.succeed(OAuthAccountStore)(makeEffectQbSqliteOAuthAccountStore(executor, options)), Layer.succeed(OAuthClientStore)(makeEffectQbSqliteOAuthClientStore(executor, options)), Layer.succeed(OAuthConsentStore)(makeEffectQbSqliteOAuthConsentStore(executor, options)), Layer.succeed(OAuthAuthorizationCodeStore)(makeEffectQbSqliteOAuthAuthorizationCodeStore(executor, options)), Layer.succeed(OAuthClientSecretStore)(makeEffectQbSqliteOAuthClientSecretStore(executor, options)), Layer.succeed(OAuthProviderModeTokenStore)(makeEffectQbSqliteOAuthProviderModeTokenStore(executor, options)), Layer.succeed(OAuthProviderTokenVault)(makeEffectQbSqliteOAuthProviderTokenVault(executor, options)), Layer.succeed(DomainVerificationStore)(makeEffectQbSqliteDomainVerificationStore(executor, options)), Layer.succeed(SecurityTimelineStore)(makeEffectQbSqliteSecurityTimelineStore(executor, options)), Layer.succeed(WebhookOutboxStore)(makeEffectQbSqliteWebhookOutboxStore(executor, options)), Layer.succeed(WebhookReplayStore)(makeEffectQbSqliteWebhookReplayStore(executor, options)));
+export const EffectQbSqliteAuthStorageLive = (executor, atomic, options = {}) => Layer.mergeAll(Layer.succeed(UserStore)(makeEffectQbSqliteUserStore(executor, options)), Layer.succeed(IdentityStore)(makeEffectQbSqliteIdentityStore(executor, atomic, options)), Layer.succeed(RegistrationStore)(makeEffectQbSqliteRegistrationStore(executor, atomic, options)), Layer.succeed(CredentialStore)(makeEffectQbSqliteCredentialStore(executor, options)), Layer.succeed(SessionStore)(makeEffectQbSqliteSessionStore(executor, options)), Layer.succeed(VerificationStore)(makeEffectQbSqliteVerificationStore(executor, options)), Layer.succeed(AuditLogStore)(makeEffectQbSqliteAuditLogStore(executor, options)), Layer.succeed(LoginApprovalReviewStore)(makeEffectQbSqliteLoginApprovalReviewStore(executor, options)), Layer.succeed(LoginRiskHistory)(makeEffectQbSqliteLoginRiskHistoryStore(executor, options)), Layer.succeed(TrustedDeviceStore)(makeEffectQbSqliteTrustedDeviceStore(executor, options)), Layer.succeed(PasskeyCredentialStore)(makeEffectQbSqlitePasskeyCredentialStore(executor, options)), Layer.succeed(TotpFactorStore)(makeEffectQbSqliteTotpFactorStore(executor, options)), Layer.succeed(TotpSessionRotateStore)(makeEffectQbSqliteTotpSessionRotateStore(executor, atomic, options)), Layer.succeed(TotpLoginCommitStore)(makeEffectQbSqliteTotpLoginCommitStore(atomic, options)), Layer.succeed(RecoveryCodeStore)(makeEffectQbSqliteRecoveryCodeStore(executor, atomic, options)), Layer.succeed(RecoveryCodeSessionRotateStore)(makeEffectQbSqliteRecoveryCodeSessionRotateStore(executor, atomic, options)), Layer.succeed(RecoveryCodeLoginCommitStore)(makeEffectQbSqliteRecoveryCodeLoginCommitStore(atomic, options)), Layer.succeed(ApiKeyStore)(makeEffectQbSqliteApiKeyStore(executor, options)), Layer.succeed(RefreshTokenStore)(makeEffectQbSqliteRefreshTokenStore(executor, atomic, options)), Layer.succeed(JwtRevocationStore)(makeEffectQbSqliteJwtRevocationStore(executor, options)), Layer.succeed(OAuthAccountStore)(makeEffectQbSqliteOAuthAccountStore(executor, options)), Layer.succeed(OAuthIdentityBridgeStore)(makeEffectQbSqliteOAuthIdentityBridgeStore(executor, atomic, options)), Layer.succeed(OAuthClientStore)(makeEffectQbSqliteOAuthClientStore(executor, options)), Layer.succeed(OAuthConsentStore)(makeEffectQbSqliteOAuthConsentStore(executor, options)), Layer.succeed(OAuthAuthorizationCodeStore)(makeEffectQbSqliteOAuthAuthorizationCodeStore(executor, options)), Layer.succeed(OAuthDeviceAuthorizationStore)(makeEffectQbSqliteOAuthDeviceAuthorizationStore(executor, atomic, options)), Layer.succeed(OAuthDeviceCodeTokenCommitStore)(makeEffectQbSqliteOAuthDeviceCodeTokenCommitStore(atomic, options)), Layer.succeed(OAuthClientSecretStore)(makeEffectQbSqliteOAuthClientSecretStore(executor, options)), Layer.succeed(OAuthProviderModeTokenStore)(makeEffectQbSqliteOAuthProviderModeTokenStore(executor, options)), Layer.succeed(OAuthProviderTokenVault)(makeEffectQbSqliteOAuthProviderTokenVault(executor, options)), Layer.succeed(DomainVerificationStore)(makeEffectQbSqliteDomainVerificationStore(executor, options)), Layer.succeed(SecurityTimelineStore)(makeEffectQbSqliteSecurityTimelineStore(executor, options)), Layer.succeed(WebhookOutboxStore)(makeEffectQbSqliteWebhookOutboxStore(executor, options)), Layer.succeed(WebhookReplayStore)(makeEffectQbSqliteWebhookReplayStore(executor, options)), Layer.succeed(PermissionStore)(makeEffectQbSqlitePermissionStore(executor, options)));
 export const makeD1EffectQbSqliteExecutor = (database) => Executor.make({
     driver: Executor.driver((query) => Effect.tryPromise({
         try: () => database
@@ -2821,5 +4645,110 @@ export const makeD1EffectQbSqliteExecutor = (database) => Executor.make({
         return Effect.succeed([...(result.results ?? [])]);
     }))),
 });
-export const D1EffectQbSqliteAuthStorageLive = (database, options = {}) => EffectQbSqliteAuthStorageLive(makeD1EffectQbSqliteExecutor(database), options);
+export const makeD1EffectQbSqliteAtomicPlanExecutor = (database) => {
+    const execute = (plans) => {
+        if (plans.length === 0) {
+            return Effect.succeed([]);
+        }
+        return Effect.try({
+            try: () => plans.map((plan, statement) => {
+                try {
+                    return {
+                        plan,
+                        rendered: Renderer.sqlite.render(plan),
+                    };
+                }
+                catch (error) {
+                    throw new AtomicPlanError({
+                        statement,
+                        phase: "render",
+                        commitState: "not-committed",
+                        cause: error,
+                    });
+                }
+            }),
+            catch: (cause) => cause instanceof AtomicPlanError
+                ? cause
+                : new AtomicPlanError({
+                    phase: "render",
+                    commitState: "not-committed",
+                    cause,
+                }),
+        }).pipe(Effect.flatMap((renderedPlans) => Effect.tryPromise({
+            try: () => {
+                const statements = renderedPlans.map(({ rendered }, statement) => {
+                    try {
+                        return database.prepare(rendered.sql).bind(...rendered.params);
+                    }
+                    catch (error) {
+                        throw new AtomicPlanError({
+                            statement,
+                            phase: "prepare",
+                            commitState: "not-committed",
+                            cause: error,
+                        });
+                    }
+                });
+                return database.batch(statements);
+            },
+            catch: (cause) => cause instanceof AtomicPlanError
+                ? cause
+                : new AtomicPlanError({
+                    phase: "execute",
+                    commitState: "unknown",
+                    cause,
+                }),
+        }).pipe(Effect.flatMap((results) => {
+            const failed = results.findIndex((result) => result.success === false || result.error !== undefined);
+            if (failed !== -1) {
+                return Effect.fail(new AtomicPlanError({
+                    statement: failed,
+                    phase: "execute",
+                    commitState: "not-committed",
+                    cause: results[failed]?.error,
+                }));
+            }
+            if (results.length !== renderedPlans.length) {
+                return Effect.fail(new AtomicPlanError({
+                    phase: "execute",
+                    commitState: "unknown",
+                    cause: new Error(`D1 batch returned ${results.length} results for ${renderedPlans.length} statements`),
+                }));
+            }
+            return Effect.try({
+                try: () => results.map((result, statement) => {
+                    const entry = renderedPlans[statement];
+                    if (entry === undefined) {
+                        throw new AtomicPlanError({
+                            statement,
+                            phase: "decode",
+                            commitState: "committed",
+                            cause: new Error("Missing rendered atomic plan"),
+                        });
+                    }
+                    try {
+                        return EffectQbExecutor.decodeRows(entry.rendered, entry.plan, [...(result.results ?? [])], { driverMode: "raw" });
+                    }
+                    catch (error) {
+                        throw new AtomicPlanError({
+                            statement,
+                            phase: "decode",
+                            commitState: "committed",
+                            cause: error,
+                        });
+                    }
+                }),
+                catch: (cause) => cause instanceof AtomicPlanError
+                    ? cause
+                    : new AtomicPlanError({
+                        phase: "decode",
+                        commitState: "committed",
+                        cause,
+                    }),
+            });
+        }))));
+    };
+    return { dialect: "sqlite", execute };
+};
+export const D1EffectQbSqliteAuthStorageLive = (database, options = {}) => EffectQbSqliteAuthStorageLive(makeD1EffectQbSqliteExecutor(database), makeD1EffectQbSqliteAtomicPlanExecutor(database), options);
 //# sourceMappingURL=EffectQbSqliteStorage.js.map