@effect-auth/core 0.1.0-alpha.18 → 0.1.0-alpha.19

package/dist/EffectQbSqliteStorage.js

@@ -13,6 +13,7 @@ import { JwtError, JwtRevocationStore } from "./Jwt.js";
 import { LoginApprovalReviewError, LoginApprovalReviewStore, } from "./LoginApproval.js";
 import { LoginRiskContext, LoginRiskHistory, LoginRiskHistoryError, LoginRiskSignal, maxLoginRiskLevel, } from "./LoginRisk.js";
 import { OAuthAccountStore, OAuthAccountStoreError, OAuthIdentityBridgeConflictError, OAuthIdentityBridgeStore, OAuthIdentityBridgeStoreError, OAuthAuthorizationCodeStore, OAuthAuthorizationCodeStoreError, OAuthClientStore, OAuthClientStoreError, OAuthConsentStore, OAuthConsentStoreError, OAuthClientSecretHash, OAuthClientSecretPrefix, OAuthClientSecretStore, OAuthClientSecretStoreError, OAuthCodeChallenge, OAuthProviderModeTokenStore, OAuthProviderModeTokenStoreError, OAuthProviderTokenVault, OAuthProviderTokenVaultError, } from "./OAuth.js";
+import { OAuthDeviceAuthorizationId, OAuthDeviceAuthorizationStore, OAuthDeviceAuthorizationStoreError, OAuthDeviceCodeTokenCommitStore, OAuthDeviceCodeTokenCommitStoreError, } from "./OAuthDeviceAuthorization.js";
 import { PasskeyCredentialId, PasskeyCredentialStore, PasskeyCredentialStoreError, } from "./Passkey.js";
 import { canonicalPermissionScope, normalizePermissionDefinitionListLimit, PermissionStore, PermissionStoreError, } from "./Permission.js";
 import { RecoveryCodeHash, RecoveryCodeLoginCommitStore, RecoveryCodeLoginCommitStoreError, RecoveryCodeStore, RecoveryCodeStoreError, RecoveryCodeSessionRotateStore, RecoveryCodeSessionRotateStoreError, } from "./RecoveryCode.js";
@@ -277,6 +278,25 @@ const makeAuthOAuthAuthorizationCodeTable = (name) => Table.make(name, {
     consumed_at: Column.int().pipe(Column.nullable),
     metadata: Column.text().pipe(Column.nullable),
 });
+const makeAuthOAuthDeviceAuthorizationTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    device_code_hash: Column.text().pipe(Column.unique),
+    user_code_hash: Column.text().pipe(Column.unique),
+    client_id: Column.text(),
+    requested_scopes: Column.text(),
+    granted_scopes: Column.text().pipe(Column.nullable),
+    subject: Column.text().pipe(Column.nullable),
+    status: Column.text(),
+    issued_at: Column.int(),
+    expires_at: Column.int(),
+    poll_interval_seconds: Column.int(),
+    next_poll_at: Column.int(),
+    last_polled_at: Column.int().pipe(Column.nullable),
+    approved_at: Column.int().pipe(Column.nullable),
+    denied_at: Column.int().pipe(Column.nullable),
+    consumed_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
 const makeAuthOAuthClientSecretTable = (name) => Table.make(name, {
     prefix: Column.text(),
     client_id: Column.text(),
@@ -439,6 +459,16 @@ const queryChanges = () => Query.call("changes");
 const queryChangedOne = () => queryEq(queryChanges(), 1);
 const queryWithoutNullRefinement = (value) => Query.cast(value, value[Scalar.TypeId].dbType);
 const queryIn = (value, first, ...rest) => Query.in(value, first, ...rest);
+const sqliteCastLike = (value, column) => Query.cast(value, column[Scalar.TypeId].dbType);
+const sqliteIncrementByFive = (value) => Query.call("length", Query.concat(Query.call("printf", "%.*c", value, "x"), "xxxxx"));
+const sqliteUnixMillisAfterSeconds = (now, seconds, textColumn, millisColumn) => {
+    const secondsText = sqliteCastLike(seconds, textColumn);
+    const modifier = Query.concat("+", secondsText, " seconds");
+    const epochSeconds = Query.call("strftime", "%s", new Date(Number(now)).toISOString(), modifier);
+    const fractionalSeconds = Query.call("strftime", "%f", new Date(Number(now)).toISOString(), modifier);
+    const milliseconds = Query.call("substr", fractionalSeconds, -3);
+    return sqliteCastLike(Query.concat(epochSeconds, milliseconds), millisColumn);
+};
 const aliasTable = (table, alias) => Table.alias(table, alias);
 const aliasColumn = (table, column) => table[boundColumnName(column)];
 const queryAstTypeId = Symbol.for("effect-qb/QueryAst");
@@ -923,6 +953,42 @@ const decodeDefaultOAuthAuthorizationCodeRow = (row) => omitUndefined({
 const decodeOAuthAuthorizationCodeRow = (tables, row) => tables.oauthAuthorizationCode.decode === undefined
     ? decodeDefaultOAuthAuthorizationCodeRow(row)
     : tables.oauthAuthorizationCode.decode(row);
+const decodeDefaultOAuthDeviceAuthorizationRow = (row) => {
+    const base = omitUndefined({
+        id: OAuthDeviceAuthorizationId(row.id),
+        deviceCodeHash: row.deviceCodeHash,
+        userCodeHash: row.userCodeHash,
+        clientId: OAuthClientId(row.clientId),
+        requestedScopes: decodeStringArray(row.requestedScopes),
+        issuedAt: UnixMillis(Number(row.issuedAt)),
+        expiresAt: UnixMillis(Number(row.expiresAt)),
+        pollIntervalSeconds: Number(row.pollIntervalSeconds),
+        nextPollAt: UnixMillis(Number(row.nextPollAt)),
+        lastPolledAt: optionalUnixMillis(row.lastPolledAt),
+        metadata: jsonDecode(row.metadata),
+    });
+    if (row.status === "approved") {
+        return {
+            ...base,
+            status: "approved",
+            subject: row.subject ?? "",
+            grantedScopes: decodeStringArray(row.grantedScopes),
+            approvedAt: UnixMillis(Number(row.approvedAt)),
+            ...omitUndefined({ consumedAt: optionalUnixMillis(row.consumedAt) }),
+        };
+    }
+    if (row.status === "denied") {
+        return {
+            ...base,
+            status: "denied",
+            deniedAt: UnixMillis(Number(row.deniedAt)),
+        };
+    }
+    return { ...base, status: "pending" };
+};
+const decodeOAuthDeviceAuthorizationRow = (table, row) => table.decode === undefined
+    ? decodeDefaultOAuthDeviceAuthorizationRow(row)
+    : table.decode(row);
 const decodeDefaultOAuthClientSecretRow = (row) => omitUndefined({
     prefix: OAuthClientSecretPrefix(row.prefix),
     clientId: OAuthClientId(row.clientId),
@@ -1526,6 +1592,37 @@ const oauthAuthorizationCodeValues = (record) => ({
 const oauthAuthorizationCodeMarkConsumed = (input) => ({
     consumed_at: Number(input.consumedAt),
 });
+const oauthDeviceAuthorizationValues = (record) => ({
+    id: record.id,
+    device_code_hash: record.deviceCodeHash,
+    user_code_hash: record.userCodeHash,
+    client_id: record.clientId,
+    requested_scopes: JSON.stringify(record.requestedScopes),
+    granted_scopes: null,
+    subject: null,
+    status: "pending",
+    issued_at: Number(record.issuedAt),
+    expires_at: Number(record.expiresAt),
+    poll_interval_seconds: record.pollIntervalSeconds,
+    next_poll_at: Number(record.nextPollAt),
+    last_polled_at: record.lastPolledAt === undefined ? null : Number(record.lastPolledAt),
+    approved_at: null,
+    denied_at: null,
+    consumed_at: null,
+    metadata: jsonEncode(record.metadata),
+});
+const oauthDeviceAuthorizationApprove = (input) => omitUndefined({
+    status: "approved",
+    subject: input.subject,
+    granted_scopes: JSON.stringify(input.grantedScopes),
+    approved_at: Number(input.decidedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
+const oauthDeviceAuthorizationDeny = (input) => omitUndefined({
+    status: "denied",
+    denied_at: Number(input.decidedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
 const oauthClientSecretValues = (record) => ({
     prefix: record.prefix,
     client_id: record.clientId,
@@ -1767,6 +1864,7 @@ const makeInternalAuthSqliteTables = (names = {}) => {
     const oauthClient = makeAuthOAuthClientTable(authSqliteTableName(names.oauthClient, "auth_oauth_client"));
     const oauthConsent = makeAuthOAuthConsentTable(authSqliteTableName(names.oauthConsent, "auth_oauth_consent"));
     const oauthAuthorizationCode = makeAuthOAuthAuthorizationCodeTable(authSqliteTableName(names.oauthAuthorizationCode, "auth_oauth_authorization_code"));
+    const oauthDeviceAuthorization = makeAuthOAuthDeviceAuthorizationTable(authSqliteTableName(names.oauthDeviceAuthorization, "auth_oauth_device_authorization"));
     const oauthClientSecret = makeAuthOAuthClientSecretTable(authSqliteTableName(names.oauthClientSecret, "auth_oauth_client_secret"));
     const oauthProviderModeToken = makeAuthOAuthProviderModeTokenTable(authSqliteTableName(names.oauthProviderModeToken, "auth_oauth_provider_mode_token"));
     const oauthProviderTokenVault = makeAuthOAuthProviderTokenVaultTable(names.oauthProviderTokenVault ?? "auth_oauth_provider_token_vault");
@@ -2123,6 +2221,31 @@ const makeInternalAuthSqliteTables = (names = {}) => {
             update: oauthAuthorizationCodeValues,
             markConsumed: oauthAuthorizationCodeMarkConsumed,
         },
+        oauthDeviceAuthorization: {
+            table: oauthDeviceAuthorization,
+            select: {
+                id: oauthDeviceAuthorization.id,
+                deviceCodeHash: oauthDeviceAuthorization.device_code_hash,
+                userCodeHash: oauthDeviceAuthorization.user_code_hash,
+                clientId: oauthDeviceAuthorization.client_id,
+                requestedScopes: oauthDeviceAuthorization.requested_scopes,
+                grantedScopes: oauthDeviceAuthorization.granted_scopes,
+                subject: oauthDeviceAuthorization.subject,
+                status: oauthDeviceAuthorization.status,
+                issuedAt: oauthDeviceAuthorization.issued_at,
+                expiresAt: oauthDeviceAuthorization.expires_at,
+                pollIntervalSeconds: oauthDeviceAuthorization.poll_interval_seconds,
+                nextPollAt: oauthDeviceAuthorization.next_poll_at,
+                lastPolledAt: oauthDeviceAuthorization.last_polled_at,
+                approvedAt: oauthDeviceAuthorization.approved_at,
+                deniedAt: oauthDeviceAuthorization.denied_at,
+                consumedAt: oauthDeviceAuthorization.consumed_at,
+                metadata: oauthDeviceAuthorization.metadata,
+            },
+            insert: oauthDeviceAuthorizationValues,
+            approve: oauthDeviceAuthorizationApprove,
+            deny: oauthDeviceAuthorizationDeny,
+        },
         oauthClientSecret: {
             table: oauthClientSecret,
             select: {
@@ -2355,6 +2478,8 @@ const selectOAuthAccountColumns = (tables) => tables.oauthAccount.select;
 const selectOAuthClientColumns = (tables) => tables.oauthClient.select;
 const selectOAuthConsentColumns = (tables) => tables.oauthConsent.select;
 const selectOAuthAuthorizationCodeColumns = (tables) => tables.oauthAuthorizationCode.select;
+const oauthDeviceAuthorizationTable = (tables) => tables.oauthDeviceAuthorization ?? authSqliteTables.oauthDeviceAuthorization;
+const selectOAuthDeviceAuthorizationColumns = (tables) => oauthDeviceAuthorizationTable(tables).select;
 const selectOAuthClientSecretColumns = (tables) => tables.oauthClientSecret.select;
 const selectOAuthProviderModeTokenColumns = (tables) => tables.oauthProviderModeToken.select;
 const selectOAuthProviderTokenVaultColumns = (tables) => tables.oauthProviderTokenVault.select;
@@ -2441,6 +2566,11 @@ const oauthAuthorizationCodeStoreError = (operation, cause) => new OAuthAuthoriz
     message: `OAuth authorization code ${operation} failed`,
     cause,
 });
+const oauthDeviceAuthorizationStoreError = (operation, cause) => new OAuthDeviceAuthorizationStoreError({
+    operation,
+    message: `OAuth device authorization ${operation} failed`,
+    cause,
+});
 const oauthClientSecretStoreError = (operation, cause) => new OAuthClientSecretStoreError({
     operation,
     message: `OAuth client secret ${operation} failed`,
@@ -3791,6 +3921,210 @@ export const makeEffectQbSqliteOAuthAuthorizationCodeStore = (executor, options
         })),
     });
 };
+export const makeEffectQbSqliteOAuthDeviceAuthorizationStore = (executor, atomic, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    const mapping = oauthDeviceAuthorizationTable(tables);
+    const selection = selectOAuthDeviceAuthorizationColumns(tables);
+    const decode = (row) => decodeOAuthDeviceAuthorizationRow(mapping, row);
+    const find = (column, value, operation) => executePlan(executor, Query.select(selection).pipe(Query.from(mapping.table), Query.where(queryEq(column, value)))).pipe(Effect.mapError((cause) => oauthDeviceAuthorizationStoreError(operation, cause)), Effect.flatMap((rows) => Effect.try({
+        try: () => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decode(rows[0])),
+        catch: (cause) => oauthDeviceAuthorizationStoreError(operation, cause),
+    })));
+    return OAuthDeviceAuthorizationStore.of({
+        insert: (record) => executePlan(executor, queryInsert(mapping.table, mutationValues(mapping.insert(record))).pipe(Query.returning({ id: mapping.select.id }))).pipe(Effect.as(true), Effect.catch((error) => sqliteConstraintDiscriminator(error)
+            ? Effect.succeed(false)
+            : Effect.fail(oauthDeviceAuthorizationStoreError("insert", error)))),
+        findByDeviceCodeHash: (input) => find(mapping.select.deviceCodeHash, input.deviceCodeHash, "find-by-device-code-hash"),
+        findByUserCodeHash: (input) => find(mapping.select.userCodeHash, input.userCodeHash, "find-by-user-code-hash"),
+        findById: (id) => find(mapping.select.id, id, "find-by-id"),
+        decide: (input) => {
+            const updatePlan = queryUpdate(mapping.table, mutationValues(input.decision === "approve"
+                ? mapping.approve(input)
+                : mapping.deny(input))).pipe(Query.where(queryEq(mapping.select.id, input.id)), Query.where(queryEq(mapping.select.status, "pending")), Query.where(queryGt(mapping.select.expiresAt, Number(input.decidedAt))), Query.returning(selection));
+            const classifyPlan = Query.select(selection).pipe(Query.from(mapping.table), Query.where(queryEq(mapping.select.id, input.id)));
+            return executeAtomicPlans(atomic, [
+                updatePlan,
+                classifyPlan,
+            ]).pipe(Effect.mapError((cause) => oauthDeviceAuthorizationStoreError("decide", cause)), Effect.flatMap(([updated, selected]) => Effect.try({
+                try: () => {
+                    const changed = updated[0];
+                    if (changed !== undefined) {
+                        const record = decode(changed);
+                        return record.status === "approved"
+                            ? { status: "approved", record }
+                            : {
+                                status: "denied",
+                                record: record,
+                            };
+                    }
+                    const row = selected[0];
+                    if (row === undefined) {
+                        return { status: "missing" };
+                    }
+                    const record = decode(row);
+                    if (Number(input.decidedAt) >= Number(record.expiresAt)) {
+                        return { status: "expired", record };
+                    }
+                    if (record.status === "pending") {
+                        return { status: "expired", record };
+                    }
+                    return { status: "already_decided", record };
+                },
+                catch: (cause) => oauthDeviceAuthorizationStoreError("decide", cause),
+            })));
+        },
+        poll: (input) => {
+            const active = [
+                queryEq(mapping.select.deviceCodeHash, input.deviceCodeHash),
+                queryEq(mapping.select.clientId, input.clientId),
+                queryGt(mapping.select.expiresAt, Number(input.now)),
+                queryIsNull(mapping.select.consumedAt),
+                queryIn(mapping.select.status, "pending", "approved"),
+            ];
+            const intervalColumn = boundColumnName(mapping.select.pollIntervalSeconds);
+            const nextPollColumn = boundColumnName(mapping.select.nextPollAt);
+            const lastPolledColumn = boundColumnName(mapping.select.lastPolledAt);
+            const slowedInterval = sqliteIncrementByFive(mapping.select.pollIntervalSeconds);
+            const slowPlan = queryUpdate(mapping.table, {
+                [intervalColumn]: slowedInterval,
+                [nextPollColumn]: sqliteUnixMillisAfterSeconds(input.now, slowedInterval, mapping.select.status, mapping.select.nextPollAt),
+                [lastPolledColumn]: Number(input.now),
+            }).pipe(Query.where(active[0]), Query.where(active[1]), Query.where(active[2]), Query.where(active[3]), Query.where(active[4]), Query.where(queryEq(mapping.select.status, "pending")), Query.where(queryGt(mapping.select.nextPollAt, Number(input.now))), Query.returning({
+                ...selection,
+                consumedAt: queryWithoutNullRefinement(mapping.select.consumedAt),
+            }));
+            const pendingPlan = queryUpdate(mapping.table, {
+                [nextPollColumn]: sqliteUnixMillisAfterSeconds(input.now, mapping.select.pollIntervalSeconds, mapping.select.status, mapping.select.nextPollAt),
+                [lastPolledColumn]: Number(input.now),
+            }).pipe(Query.where(active[0]), Query.where(active[1]), Query.where(active[2]), Query.where(active[3]), Query.where(active[4]), Query.where(queryEq(mapping.select.status, "pending")), Query.where(queryLte(mapping.select.nextPollAt, Number(input.now))), Query.returning(selection));
+            const classifyPlan = Query.select(selection).pipe(Query.from(mapping.table), Query.where(queryEq(mapping.select.deviceCodeHash, input.deviceCodeHash)), Query.where(queryEq(mapping.select.clientId, input.clientId)));
+            return executeAtomicPlans(atomic, [
+                slowPlan,
+                pendingPlan,
+                classifyPlan,
+            ]).pipe(Effect.mapError((cause) => oauthDeviceAuthorizationStoreError("poll", cause)), Effect.flatMap(([slowed, pending, selected]) => Effect.try({
+                try: () => {
+                    const slowRow = slowed[0];
+                    if (slowRow !== undefined) {
+                        const record = decode(slowRow);
+                        return {
+                            status: "slow_down",
+                            record,
+                            interval: record.pollIntervalSeconds,
+                        };
+                    }
+                    const pendingRow = pending[0];
+                    if (pendingRow !== undefined) {
+                        return {
+                            status: "pending",
+                            record: decode(pendingRow),
+                        };
+                    }
+                    const row = selected[0];
+                    if (row === undefined) {
+                        return { status: "missing" };
+                    }
+                    const record = decode(row);
+                    if (record.status === "approved" &&
+                        record.consumedAt !== undefined) {
+                        return {
+                            status: "already_consumed",
+                            record: record,
+                        };
+                    }
+                    if (Number(input.now) >= Number(record.expiresAt)) {
+                        return { status: "expired", record };
+                    }
+                    if (record.status === "denied") {
+                        return { status: "denied", record };
+                    }
+                    if (record.status === "approved") {
+                        return {
+                            status: "approved",
+                            record: record,
+                        };
+                    }
+                    return { status: "missing" };
+                },
+                catch: (cause) => oauthDeviceAuthorizationStoreError("poll", cause),
+            })));
+        },
+        deleteExpired: (input) => executePlan(executor, Query.delete(mapping.table).pipe(Query.where(queryLte(mapping.select.expiresAt, Number(input.beforeExpiresAt))), Query.returning({ id: mapping.select.id }))).pipe(Effect.mapError((cause) => oauthDeviceAuthorizationStoreError("delete-expired", cause)), Effect.map((rows) => rows.length)),
+    });
+};
+export const makeEffectQbSqliteOAuthDeviceCodeTokenCommitStore = (atomic, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    const authorizationTable = oauthDeviceAuthorizationTable(tables);
+    const authorizationSelection = selectOAuthDeviceAuthorizationColumns(tables);
+    const decodeAuthorization = (row) => decodeOAuthDeviceAuthorizationRow(authorizationTable, row);
+    return OAuthDeviceCodeTokenCommitStore.of({
+        commit: (input) => {
+            const { authorization } = input;
+            const nextPollColumn = boundColumnName(authorizationTable.select.nextPollAt);
+            const lastPolledColumn = boundColumnName(authorizationTable.select.lastPolledAt);
+            const consumedColumn = boundColumnName(authorizationTable.select.consumedAt);
+            const consumePlan = queryUpdate(authorizationTable.table, {
+                [consumedColumn]: Number(input.consumedAt),
+                [lastPolledColumn]: Number(input.consumedAt),
+                [nextPollColumn]: sqliteUnixMillisAfterSeconds(input.consumedAt, authorizationTable.select.pollIntervalSeconds, authorizationTable.select.status, authorizationTable.select.nextPollAt),
+            }).pipe(Query.where(queryEq(authorizationTable.select.id, authorization.id)), Query.where(queryEq(authorizationTable.select.deviceCodeHash, authorization.deviceCodeHash)), Query.where(queryEq(authorizationTable.select.userCodeHash, authorization.userCodeHash)), Query.where(queryEq(authorizationTable.select.clientId, authorization.clientId)), Query.where(queryEq(authorizationTable.select.requestedScopes, JSON.stringify(authorization.requestedScopes))), Query.where(queryEq(authorizationTable.select.status, "approved")), Query.where(queryEq(authorizationTable.select.subject, authorization.subject)), Query.where(queryEq(authorizationTable.select.grantedScopes, JSON.stringify(authorization.grantedScopes))), Query.where(queryEq(authorizationTable.select.issuedAt, Number(authorization.issuedAt))), Query.where(queryEq(authorizationTable.select.expiresAt, Number(authorization.expiresAt))), Query.where(queryEq(authorizationTable.select.pollIntervalSeconds, authorization.pollIntervalSeconds)), Query.where(queryEq(authorizationTable.select.nextPollAt, Number(authorization.nextPollAt))), Query.where(queryIsNotDistinctFrom(authorizationTable.select.lastPolledAt, authorization.lastPolledAt === undefined
+                ? null
+                : Number(authorization.lastPolledAt))), Query.where(queryEq(authorizationTable.select.approvedAt, Number(authorization.approvedAt))), Query.where(queryIsNotDistinctFrom(authorizationTable.select.metadata, jsonEncode(authorization.metadata))), Query.where(queryIsNull(authorizationTable.select.consumedAt)), Query.where(queryGt(authorizationTable.select.expiresAt, Number(input.consumedAt))), Query.returning({
+                ...authorizationSelection,
+                lastPolledAt: queryWithoutNullRefinement(authorizationTable.select.lastPolledAt),
+                consumedAt: queryWithoutNullRefinement(authorizationTable.select.consumedAt),
+            }));
+            const tokenPlans = input.tokenRecords.map((record) => queryInsertWhere(tables.oauthProviderModeToken.table, mutationValues(tables.oauthProviderModeToken.insert(record)), queryChangedOne()).pipe(Query.returning({
+                tokenHash: tables.oauthProviderModeToken.select.tokenHash,
+            })));
+            const classifyPlan = Query.select(authorizationSelection).pipe(Query.from(authorizationTable.table), Query.where(queryEq(authorizationTable.select.id, authorization.id)));
+            const plans = [
+                consumePlan,
+                ...tokenPlans,
+                classifyPlan,
+            ];
+            return executeAtomicPlans(atomic, plans).pipe(Effect.mapError((cause) => new OAuthDeviceCodeTokenCommitStoreError({
+                operation: "commit",
+                message: "Atomic OAuth device token commit failed",
+                cause,
+            })), Effect.flatMap((results) => Effect.try({
+                try: () => {
+                    const changed = results[0]?.[0];
+                    if (changed !== undefined) {
+                        return {
+                            status: "committed",
+                            record: decodeAuthorization(changed),
+                        };
+                    }
+                    const selected = results.at(-1)?.[0];
+                    if (selected === undefined) {
+                        return { status: "missing" };
+                    }
+                    const record = decodeAuthorization(selected);
+                    if (record.status === "approved" &&
+                        record.consumedAt !== undefined) {
+                        return {
+                            status: "already_consumed",
+                            record: record,
+                        };
+                    }
+                    if (record.status === "approved" &&
+                        Number(input.consumedAt) >= Number(record.expiresAt)) {
+                        return { status: "expired", record };
+                    }
+                    return { status: "missing" };
+                },
+                catch: (cause) => new OAuthDeviceCodeTokenCommitStoreError({
+                    operation: "commit",
+                    message: "Failed to decode OAuth device token commit result",
+                    cause,
+                }),
+            })));
+        },
+    });
+};
 export const makeEffectQbSqliteOAuthClientSecretStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
     return OAuthClientSecretStore.of({
@@ -4283,6 +4617,8 @@ export const makeEffectQbSqliteStorage = (executor, atomic, options = {}) => ({
     oauthClientStore: makeEffectQbSqliteOAuthClientStore(executor, options),
     oauthConsentStore: makeEffectQbSqliteOAuthConsentStore(executor, options),
     oauthAuthorizationCodeStore: makeEffectQbSqliteOAuthAuthorizationCodeStore(executor, options),
+    oauthDeviceAuthorizationStore: makeEffectQbSqliteOAuthDeviceAuthorizationStore(executor, atomic, options),
+    oauthDeviceCodeTokenCommitStore: makeEffectQbSqliteOAuthDeviceCodeTokenCommitStore(atomic, options),
     oauthClientSecretStore: makeEffectQbSqliteOAuthClientSecretStore(executor, options),
     oauthProviderModeTokenStore: makeEffectQbSqliteOAuthProviderModeTokenStore(executor, options),
     oauthProviderTokenVault: makeEffectQbSqliteOAuthProviderTokenVault(executor, options),
@@ -4292,7 +4628,7 @@ export const makeEffectQbSqliteStorage = (executor, atomic, options = {}) => ({
     webhookReplayStore: makeEffectQbSqliteWebhookReplayStore(executor, options),
     permissionStore: makeEffectQbSqlitePermissionStore(executor, options),
 });
-export const EffectQbSqliteAuthStorageLive = (executor, atomic, options = {}) => Layer.mergeAll(Layer.succeed(UserStore)(makeEffectQbSqliteUserStore(executor, options)), Layer.succeed(IdentityStore)(makeEffectQbSqliteIdentityStore(executor, atomic, options)), Layer.succeed(RegistrationStore)(makeEffectQbSqliteRegistrationStore(executor, atomic, options)), Layer.succeed(CredentialStore)(makeEffectQbSqliteCredentialStore(executor, options)), Layer.succeed(SessionStore)(makeEffectQbSqliteSessionStore(executor, options)), Layer.succeed(VerificationStore)(makeEffectQbSqliteVerificationStore(executor, options)), Layer.succeed(AuditLogStore)(makeEffectQbSqliteAuditLogStore(executor, options)), Layer.succeed(LoginApprovalReviewStore)(makeEffectQbSqliteLoginApprovalReviewStore(executor, options)), Layer.succeed(LoginRiskHistory)(makeEffectQbSqliteLoginRiskHistoryStore(executor, options)), Layer.succeed(TrustedDeviceStore)(makeEffectQbSqliteTrustedDeviceStore(executor, options)), Layer.succeed(PasskeyCredentialStore)(makeEffectQbSqlitePasskeyCredentialStore(executor, options)), Layer.succeed(TotpFactorStore)(makeEffectQbSqliteTotpFactorStore(executor, options)), Layer.succeed(TotpSessionRotateStore)(makeEffectQbSqliteTotpSessionRotateStore(executor, atomic, options)), Layer.succeed(TotpLoginCommitStore)(makeEffectQbSqliteTotpLoginCommitStore(atomic, options)), Layer.succeed(RecoveryCodeStore)(makeEffectQbSqliteRecoveryCodeStore(executor, atomic, options)), Layer.succeed(RecoveryCodeSessionRotateStore)(makeEffectQbSqliteRecoveryCodeSessionRotateStore(executor, atomic, options)), Layer.succeed(RecoveryCodeLoginCommitStore)(makeEffectQbSqliteRecoveryCodeLoginCommitStore(atomic, options)), Layer.succeed(ApiKeyStore)(makeEffectQbSqliteApiKeyStore(executor, options)), Layer.succeed(RefreshTokenStore)(makeEffectQbSqliteRefreshTokenStore(executor, atomic, options)), Layer.succeed(JwtRevocationStore)(makeEffectQbSqliteJwtRevocationStore(executor, options)), Layer.succeed(OAuthAccountStore)(makeEffectQbSqliteOAuthAccountStore(executor, options)), Layer.succeed(OAuthIdentityBridgeStore)(makeEffectQbSqliteOAuthIdentityBridgeStore(executor, atomic, options)), Layer.succeed(OAuthClientStore)(makeEffectQbSqliteOAuthClientStore(executor, options)), Layer.succeed(OAuthConsentStore)(makeEffectQbSqliteOAuthConsentStore(executor, options)), Layer.succeed(OAuthAuthorizationCodeStore)(makeEffectQbSqliteOAuthAuthorizationCodeStore(executor, options)), Layer.succeed(OAuthClientSecretStore)(makeEffectQbSqliteOAuthClientSecretStore(executor, options)), Layer.succeed(OAuthProviderModeTokenStore)(makeEffectQbSqliteOAuthProviderModeTokenStore(executor, options)), Layer.succeed(OAuthProviderTokenVault)(makeEffectQbSqliteOAuthProviderTokenVault(executor, options)), Layer.succeed(DomainVerificationStore)(makeEffectQbSqliteDomainVerificationStore(executor, options)), Layer.succeed(SecurityTimelineStore)(makeEffectQbSqliteSecurityTimelineStore(executor, options)), Layer.succeed(WebhookOutboxStore)(makeEffectQbSqliteWebhookOutboxStore(executor, options)), Layer.succeed(WebhookReplayStore)(makeEffectQbSqliteWebhookReplayStore(executor, options)), Layer.succeed(PermissionStore)(makeEffectQbSqlitePermissionStore(executor, options)));
+export const EffectQbSqliteAuthStorageLive = (executor, atomic, options = {}) => Layer.mergeAll(Layer.succeed(UserStore)(makeEffectQbSqliteUserStore(executor, options)), Layer.succeed(IdentityStore)(makeEffectQbSqliteIdentityStore(executor, atomic, options)), Layer.succeed(RegistrationStore)(makeEffectQbSqliteRegistrationStore(executor, atomic, options)), Layer.succeed(CredentialStore)(makeEffectQbSqliteCredentialStore(executor, options)), Layer.succeed(SessionStore)(makeEffectQbSqliteSessionStore(executor, options)), Layer.succeed(VerificationStore)(makeEffectQbSqliteVerificationStore(executor, options)), Layer.succeed(AuditLogStore)(makeEffectQbSqliteAuditLogStore(executor, options)), Layer.succeed(LoginApprovalReviewStore)(makeEffectQbSqliteLoginApprovalReviewStore(executor, options)), Layer.succeed(LoginRiskHistory)(makeEffectQbSqliteLoginRiskHistoryStore(executor, options)), Layer.succeed(TrustedDeviceStore)(makeEffectQbSqliteTrustedDeviceStore(executor, options)), Layer.succeed(PasskeyCredentialStore)(makeEffectQbSqlitePasskeyCredentialStore(executor, options)), Layer.succeed(TotpFactorStore)(makeEffectQbSqliteTotpFactorStore(executor, options)), Layer.succeed(TotpSessionRotateStore)(makeEffectQbSqliteTotpSessionRotateStore(executor, atomic, options)), Layer.succeed(TotpLoginCommitStore)(makeEffectQbSqliteTotpLoginCommitStore(atomic, options)), Layer.succeed(RecoveryCodeStore)(makeEffectQbSqliteRecoveryCodeStore(executor, atomic, options)), Layer.succeed(RecoveryCodeSessionRotateStore)(makeEffectQbSqliteRecoveryCodeSessionRotateStore(executor, atomic, options)), Layer.succeed(RecoveryCodeLoginCommitStore)(makeEffectQbSqliteRecoveryCodeLoginCommitStore(atomic, options)), Layer.succeed(ApiKeyStore)(makeEffectQbSqliteApiKeyStore(executor, options)), Layer.succeed(RefreshTokenStore)(makeEffectQbSqliteRefreshTokenStore(executor, atomic, options)), Layer.succeed(JwtRevocationStore)(makeEffectQbSqliteJwtRevocationStore(executor, options)), Layer.succeed(OAuthAccountStore)(makeEffectQbSqliteOAuthAccountStore(executor, options)), Layer.succeed(OAuthIdentityBridgeStore)(makeEffectQbSqliteOAuthIdentityBridgeStore(executor, atomic, options)), Layer.succeed(OAuthClientStore)(makeEffectQbSqliteOAuthClientStore(executor, options)), Layer.succeed(OAuthConsentStore)(makeEffectQbSqliteOAuthConsentStore(executor, options)), Layer.succeed(OAuthAuthorizationCodeStore)(makeEffectQbSqliteOAuthAuthorizationCodeStore(executor, options)), Layer.succeed(OAuthDeviceAuthorizationStore)(makeEffectQbSqliteOAuthDeviceAuthorizationStore(executor, atomic, options)), Layer.succeed(OAuthDeviceCodeTokenCommitStore)(makeEffectQbSqliteOAuthDeviceCodeTokenCommitStore(atomic, options)), Layer.succeed(OAuthClientSecretStore)(makeEffectQbSqliteOAuthClientSecretStore(executor, options)), Layer.succeed(OAuthProviderModeTokenStore)(makeEffectQbSqliteOAuthProviderModeTokenStore(executor, options)), Layer.succeed(OAuthProviderTokenVault)(makeEffectQbSqliteOAuthProviderTokenVault(executor, options)), Layer.succeed(DomainVerificationStore)(makeEffectQbSqliteDomainVerificationStore(executor, options)), Layer.succeed(SecurityTimelineStore)(makeEffectQbSqliteSecurityTimelineStore(executor, options)), Layer.succeed(WebhookOutboxStore)(makeEffectQbSqliteWebhookOutboxStore(executor, options)), Layer.succeed(WebhookReplayStore)(makeEffectQbSqliteWebhookReplayStore(executor, options)), Layer.succeed(PermissionStore)(makeEffectQbSqlitePermissionStore(executor, options)));
 export const makeD1EffectQbSqliteExecutor = (database) => Executor.make({
     driver: Executor.driver((query) => Effect.tryPromise({
         try: () => database