@effect-auth/core 0.1.0-alpha.2 → 0.1.0-alpha.4

package/dist/KyselyStorage.js

@@ -1,6 +1,15 @@
-import { Effect, Layer, Option } from "effect";
-import { ChallengeId, CredentialId, Email, SessionId, UnixMillis, UserId, } from "./Identifiers.js";
+import { Effect, Layer, Option, Redacted } from "effect";
+import { ApiKeyId, ApiKeyPrefix, ApiKeySecretHash, ApiKeyStore, ApiKeyStoreError, } from "./ApiKey.js";
+import { AuthFlowId, ChallengeId, CredentialId, Email, SessionId, UnixMillis, UserId, } from "./Identifiers.js";
+import { JwtError, JwtRevocationStore } from "./Jwt.js";
+import { LoginApprovalReviewError, LoginApprovalReviewStore, } from "./LoginApproval.js";
+import { LoginRiskContext, LoginRiskSignal } from "./LoginRisk.js";
+import { PasskeyCredentialId, PasskeyCredentialStore, PasskeyCredentialStoreError, } from "./Passkey.js";
+import { RecoveryCodeHash, RecoveryCodeStore, RecoveryCodeStoreError, } from "./RecoveryCode.js";
+import { RefreshTokenFamilyId, RefreshTokenId, RefreshTokenSecretHash, RefreshTokenStore, RefreshTokenStoreError, } from "./RefreshToken.js";
 import { CredentialStore, SessionStore, StorageError, UserStore, VerificationStore, } from "./Storage.js";
+import { TotpFactorStore, TotpFactorStoreError, TotpSecret, } from "./Totp.js";
+import { TrustedDeviceError, TrustedDeviceStore } from "./TrustedDevice.js";
 const jsonEncode = (value) => value === undefined ? null : JSON.stringify(value);
 const jsonDecode = (value) => value === null ? undefined : JSON.parse(value);
 const optionalUnixMillis = (value) => value === null ? undefined : UnixMillis(Number(value));
@@ -8,6 +17,45 @@ const decodeAmr = (value) => JSON.parse(value);
 const omitUndefined = (record) => Object.fromEntries(Object.entries(record).filter(([, value]) => value !== undefined));
 const sessionMetadataEnvelopeKey = "__effectAuthSession";
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isLoginRiskLevel = (value) => value === "unknown" ||
+    value === "low" ||
+    value === "medium" ||
+    value === "high" ||
+    value === "critical";
+const decodeLoginRiskSignal = (value) => {
+    const record = isRecord(value) ? value : {};
+    const level = isLoginRiskLevel(record.level) ? record.level : undefined;
+    return LoginRiskSignal.make({
+        type: typeof record.type === "string" ? record.type : "unknown",
+        ...(level === undefined ? {} : { level }),
+        ...(isRecord(record.metadata) ? { metadata: record.metadata } : {}),
+    });
+};
+const decodeLoginRiskContext = (value) => {
+    const decoded = jsonDecode(value);
+    if (!isRecord(decoded)) {
+        return undefined;
+    }
+    return LoginRiskContext.make({
+        level: isLoginRiskLevel(decoded.level) ? decoded.level : "unknown",
+        signals: Array.isArray(decoded.signals)
+            ? decoded.signals.map(decodeLoginRiskSignal)
+            : [],
+        ...(isRecord(decoded.metadata) ? { metadata: decoded.metadata } : {}),
+    });
+};
+const encodeLoginRiskSignal = (signal) => omitUndefined({
+    type: signal.type,
+    level: signal.level,
+    metadata: signal.metadata,
+});
+const encodeLoginRiskContext = (risk) => risk === undefined
+    ? null
+    : jsonEncode(omitUndefined({
+        level: risk.level,
+        signals: risk.signals.map(encodeLoginRiskSignal),
+        metadata: risk.metadata,
+    }));
 const decodeSessionMetadata = (value) => {
     const decoded = jsonDecode(value);
     const envelope = isRecord(decoded)
@@ -82,6 +130,103 @@ const decodeVerificationRow = (row) => omitUndefined({
     metadata: jsonDecode(row.metadata),
     consumedAt: optionalUnixMillis(row.consumed_at),
 });
+const decodeLoginApprovalReviewRow = (row) => omitUndefined({
+    approvalChallengeId: ChallengeId(row.approval_challenge_id),
+    flowId: AuthFlowId(row.flow_id),
+    userId: UserId(row.user_id),
+    channel: row.channel,
+    reason: row.reason,
+    sessionBinding: row.session_binding,
+    sameDeviceRequired: row.same_device_required === 1,
+    status: row.status,
+    createdAt: UnixMillis(Number(row.created_at)),
+    expiresAt: UnixMillis(Number(row.expires_at)),
+    reviewedAt: optionalUnixMillis(row.reviewed_at),
+    reviewedBy: row.reviewed_by === null
+        ? undefined
+        : row.reviewed_by,
+    deniedReason: row.denied_reason === null ? undefined : row.denied_reason,
+    risk: decodeLoginRiskContext(row.risk),
+    metadata: jsonDecode(row.metadata),
+    reviewMetadata: jsonDecode(row.review_metadata),
+});
+const decodeTrustedDeviceRow = (row) => omitUndefined({
+    userId: UserId(row.user_id),
+    tokenHash: row.token_hash,
+    createdAt: UnixMillis(Number(row.created_at)),
+    lastSeenAt: UnixMillis(Number(row.last_seen_at)),
+    expiresAt: UnixMillis(Number(row.expires_at)),
+    metadata: jsonDecode(row.metadata),
+});
+const decodePasskeyTransports = (value) => value === null ? undefined : JSON.parse(value);
+const decodePasskeyCredentialRow = (row) => omitUndefined({
+    id: CredentialId(row.id),
+    userId: UserId(row.user_id),
+    credentialId: PasskeyCredentialId(row.credential_id),
+    publicKey: row.public_key,
+    signCount: Number(row.sign_count),
+    transports: decodePasskeyTransports(row.transports),
+    backedUp: row.backed_up === null ? undefined : row.backed_up === 1,
+    createdAt: UnixMillis(Number(row.created_at)),
+    lastUsedAt: optionalUnixMillis(row.last_used_at),
+    revokedAt: optionalUnixMillis(row.revoked_at),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeTotpFactorRow = (row) => omitUndefined({
+    id: CredentialId(row.id),
+    userId: UserId(row.user_id),
+    secret: Redacted.make(TotpSecret(row.secret)),
+    algorithm: row.algorithm,
+    digits: Number(row.digits),
+    period: Number(row.period),
+    createdAt: UnixMillis(Number(row.created_at)),
+    confirmedAt: optionalUnixMillis(row.confirmed_at),
+    lastUsedAt: optionalUnixMillis(row.last_used_at),
+    revokedAt: optionalUnixMillis(row.revoked_at),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeRecoveryCodeRow = (row) => omitUndefined({
+    id: CredentialId(row.id),
+    userId: UserId(row.user_id),
+    codeHash: RecoveryCodeHash(row.code_hash),
+    createdAt: UnixMillis(Number(row.created_at)),
+    usedAt: optionalUnixMillis(row.used_at),
+    revokedAt: optionalUnixMillis(row.revoked_at),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeApiKeyScopes = (value) => JSON.parse(value);
+const decodeApiKeyRow = (row) => omitUndefined({
+    id: ApiKeyId(row.id),
+    userId: UserId(row.user_id),
+    prefix: ApiKeyPrefix(row.prefix),
+    secretHash: ApiKeySecretHash(row.secret_hash),
+    scopes: decodeApiKeyScopes(row.scopes),
+    createdAt: UnixMillis(Number(row.created_at)),
+    expiresAt: optionalUnixMillis(row.expires_at),
+    lastUsedAt: optionalUnixMillis(row.last_used_at),
+    revokedAt: optionalUnixMillis(row.revoked_at),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeRefreshTokenRow = (row) => omitUndefined({
+    id: RefreshTokenId(row.id),
+    familyId: RefreshTokenFamilyId(row.family_id),
+    userId: UserId(row.user_id),
+    secretHash: RefreshTokenSecretHash(row.secret_hash),
+    createdAt: UnixMillis(Number(row.created_at)),
+    expiresAt: UnixMillis(Number(row.expires_at)),
+    lastUsedAt: optionalUnixMillis(row.last_used_at),
+    rotatedAt: optionalUnixMillis(row.rotated_at),
+    replacedById: row.replaced_by_id === null ? undefined : RefreshTokenId(row.replaced_by_id),
+    revokedAt: optionalUnixMillis(row.revoked_at),
+    reuseDetectedAt: optionalUnixMillis(row.reuse_detected_at),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeJwtRevocationRow = (row) => omitUndefined({
+    jwtId: row.jwt_id,
+    revokedAt: UnixMillis(Number(row.revoked_at)),
+    expiresAt: optionalUnixMillis(row.expires_at),
+    reason: row.reason ?? undefined,
+});
 const sessionInsert = (row) => ({
     id: row.id,
     user_id: row.userId,
@@ -126,11 +271,175 @@ const verificationInsert = (row) => ({
     metadata: jsonEncode(row.metadata),
     consumed_at: null,
 });
+const loginApprovalReviewInsert = (row) => ({
+    approval_challenge_id: row.approvalChallengeId,
+    flow_id: row.flowId,
+    user_id: row.userId,
+    channel: row.channel,
+    reason: row.reason,
+    session_binding: row.sessionBinding,
+    same_device_required: row.sameDeviceRequired ? 1 : 0,
+    status: row.status,
+    created_at: Number(row.createdAt),
+    expires_at: Number(row.expiresAt),
+    reviewed_at: row.reviewedAt === undefined ? null : Number(row.reviewedAt),
+    reviewed_by: row.reviewedBy ?? null,
+    denied_reason: row.deniedReason ?? null,
+    risk: encodeLoginRiskContext(row.risk),
+    metadata: jsonEncode(row.metadata),
+    review_metadata: jsonEncode(row.reviewMetadata),
+});
+const trustedDeviceInsert = (input, createdAt) => ({
+    user_id: input.userId,
+    token_hash: input.tokenHash,
+    created_at: Number(createdAt),
+    last_seen_at: Number(input.now),
+    expires_at: Number(input.expiresAt),
+    metadata: jsonEncode(input.metadata),
+});
+const passkeyCredentialInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    credential_id: row.credentialId,
+    public_key: row.publicKey,
+    sign_count: row.signCount,
+    transports: jsonEncode(row.transports),
+    backed_up: row.backedUp === undefined ? null : row.backedUp ? 1 : 0,
+    created_at: Number(row.createdAt),
+    last_used_at: row.lastUsedAt === undefined ? null : Number(row.lastUsedAt),
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const totpFactorInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    secret: Redacted.value(row.secret),
+    algorithm: row.algorithm,
+    digits: row.digits,
+    period: row.period,
+    created_at: Number(row.createdAt),
+    confirmed_at: row.confirmedAt === undefined ? null : Number(row.confirmedAt),
+    last_used_at: row.lastUsedAt === undefined ? null : Number(row.lastUsedAt),
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const recoveryCodeInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    code_hash: row.codeHash,
+    created_at: Number(row.createdAt),
+    used_at: row.usedAt === undefined ? null : Number(row.usedAt),
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const apiKeyInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    prefix: row.prefix,
+    secret_hash: row.secretHash,
+    scopes: JSON.stringify(row.scopes),
+    created_at: Number(row.createdAt),
+    expires_at: row.expiresAt === undefined ? null : Number(row.expiresAt),
+    last_used_at: row.lastUsedAt === undefined ? null : Number(row.lastUsedAt),
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const refreshTokenInsert = (row) => ({
+    id: row.id,
+    family_id: row.familyId,
+    user_id: row.userId,
+    secret_hash: row.secretHash,
+    created_at: Number(row.createdAt),
+    expires_at: Number(row.expiresAt),
+    last_used_at: row.lastUsedAt === undefined ? null : Number(row.lastUsedAt),
+    rotated_at: row.rotatedAt === undefined ? null : Number(row.rotatedAt),
+    replaced_by_id: row.replacedById ?? null,
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    reuse_detected_at: row.reuseDetectedAt === undefined ? null : Number(row.reuseDetectedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const jwtRevocationInsert = (row) => ({
+    jwt_id: row.jwtId,
+    revoked_at: Number(row.revokedAt),
+    expires_at: row.expiresAt === undefined ? null : Number(row.expiresAt),
+    reason: row.reason ?? null,
+});
 const kyselyError = (entity, operation, cause) => StorageError.fromUnknown(entity, operation, cause);
 const runKysely = (entity, operation, evaluate) => Effect.tryPromise({
     try: evaluate,
     catch: (cause) => kyselyError(entity, operation, cause),
 });
+const loginApprovalReviewStoreError = (operation, cause) => new LoginApprovalReviewError({
+    message: `Login approval review ${operation} failed`,
+    cause,
+});
+const runLoginApprovalReviewKysely = (operation, evaluate) => Effect.tryPromise({
+    try: evaluate,
+    catch: (cause) => loginApprovalReviewStoreError(operation, cause),
+});
+const trustedDeviceStoreError = (operation, cause) => new TrustedDeviceError({
+    operation,
+    message: `Trusted device ${operation} failed`,
+    cause,
+});
+const runTrustedDeviceKysely = (operation, evaluate) => Effect.tryPromise({
+    try: evaluate,
+    catch: (cause) => trustedDeviceStoreError(operation, cause),
+});
+const passkeyCredentialStoreError = (operation, cause) => new PasskeyCredentialStoreError({
+    operation,
+    message: `Passkey credential ${operation} failed`,
+    cause,
+});
+const runPasskeyCredentialKysely = (operation, evaluate) => Effect.tryPromise({
+    try: evaluate,
+    catch: (cause) => passkeyCredentialStoreError(operation, cause),
+});
+const totpFactorStoreError = (operation, cause) => new TotpFactorStoreError({
+    operation,
+    message: `TOTP factor ${operation} failed`,
+    cause,
+});
+const runTotpFactorKysely = (operation, evaluate) => Effect.tryPromise({
+    try: evaluate,
+    catch: (cause) => totpFactorStoreError(operation, cause),
+});
+const recoveryCodeStoreError = (operation, cause) => new RecoveryCodeStoreError({
+    operation,
+    message: `Recovery code ${operation} failed`,
+    cause,
+});
+const runRecoveryCodeKysely = (operation, evaluate) => Effect.tryPromise({
+    try: evaluate,
+    catch: (cause) => recoveryCodeStoreError(operation, cause),
+});
+const apiKeyStoreError = (operation, cause) => new ApiKeyStoreError({
+    operation,
+    message: `API key ${operation} failed`,
+    cause,
+});
+const runApiKeyKysely = (operation, evaluate) => Effect.tryPromise({
+    try: evaluate,
+    catch: (cause) => apiKeyStoreError(operation, cause),
+});
+const refreshTokenStoreError = (operation, cause) => new RefreshTokenStoreError({
+    operation,
+    message: `Refresh token ${operation} failed`,
+    cause,
+});
+const runRefreshTokenKysely = (operation, evaluate) => Effect.tryPromise({
+    try: evaluate,
+    catch: (cause) => refreshTokenStoreError(operation, cause),
+});
+const jwtRevocationStoreError = (operation, cause) => new JwtError({
+    operation: "revocation",
+    message: `JWT revocation ${operation} failed`,
+    cause,
+});
+const runJwtRevocationKysely = (operation, evaluate) => Effect.tryPromise({
+    try: evaluate,
+    catch: (cause) => jwtRevocationStoreError(operation, cause),
+});
 const asAuthDb = (db) => db;
 const findUserById = (db, id, operation = "find") => {
     const authDb = asAuthDb(db);
@@ -185,6 +494,17 @@ const findSessionById = (db, id, operation = "find") => {
             : Option.some(decodeSessionRow(row));
     });
 };
+const listSessionsByUser = (db, input, operation = "listByUser") => {
+    const authDb = asAuthDb(db);
+    return runKysely("session", operation, async () => {
+        const rows = await authDb
+            .selectFrom("auth_session")
+            .selectAll()
+            .where("user_id", "=", input.userId)
+            .execute();
+        return rows.map(decodeSessionRow);
+    });
+};
 const findVerificationById = (db, id, operation = "find") => {
     const authDb = asAuthDb(db);
     return runKysely("verification", operation, async () => {
@@ -198,6 +518,34 @@ const findVerificationById = (db, id, operation = "find") => {
             : Option.some(decodeVerificationRow(row));
     });
 };
+const findLoginApprovalReviewByApprovalChallengeId = (db, input, operation = "find") => {
+    const authDb = asAuthDb(db);
+    return runLoginApprovalReviewKysely(operation, async () => {
+        const row = await authDb
+            .selectFrom("auth_login_approval_review")
+            .selectAll()
+            .where("approval_challenge_id", "=", input.approvalChallengeId)
+            .executeTakeFirst();
+        return row === undefined
+            ? Option.none()
+            : Option.some(decodeLoginApprovalReviewRow(row));
+    });
+};
+const findTrustedDevice = (db, input, operation = "status") => {
+    const authDb = asAuthDb(db);
+    return runTrustedDeviceKysely(operation, async () => {
+        const row = await authDb
+            .selectFrom("auth_trusted_device")
+            .selectAll()
+            .where("user_id", "=", input.userId)
+            .where("token_hash", "=", input.tokenHash)
+            .where("expires_at", ">", Number(input.now))
+            .executeTakeFirst();
+        return row === undefined
+            ? Option.none()
+            : Option.some(decodeTrustedDeviceRow(row));
+    });
+};
 export const makeKyselyUserStore = (db) => {
     const authDb = asAuthDb(db);
     return UserStore.make({
@@ -231,12 +579,25 @@ export const makeKyselyCredentialStore = (db) => {
                 .values(passwordCredentialInsert(row))
                 .executeTakeFirst();
         }),
+        updatePassword: (input) => runKysely("credential", "updatePassword", () => authDb
+            .updateTable("auth_credential")
+            .set({
+            password_hash: input.passwordHash,
+            updated_at: Number(input.updatedAt),
+        })
+            .where("user_id", "=", input.userId)
+            .where("type", "=", "password")
+            .where("revoked_at", "is", null)
+            .executeTakeFirst()).pipe(Effect.flatMap((result) => Number(result.numUpdatedRows) > 0
+            ? findPasswordCredentialByUserId(db, input.userId, "updatePassword")
+            : Effect.succeed(Option.none()))),
     });
 };
 export const makeKyselySessionStore = (db) => {
     const authDb = asAuthDb(db);
     return SessionStore.make({
         findById: (id) => findSessionById(db, id),
+        listByUser: (input) => listSessionsByUser(db, input),
         insert: (row) => runKysely("session", "insert", async () => {
             await authDb
                 .insertInto("auth_session")
@@ -281,9 +642,16 @@ export const makeKyselySessionStore = (db) => {
             return runKysely("session", "updateClaims", () => authDb
                 .updateTable("auth_session")
                 .set({
+                ...(input.aal === undefined ? {} : { aal: input.aal }),
+                ...(input.amr === undefined
+                    ? {}
+                    : { amr: JSON.stringify(input.amr) }),
+                ...(input.mfaVerifiedAt === undefined
+                    ? {}
+                    : { mfa_verified_at: Number(input.mfaVerifiedAt) }),
                 metadata: encodeSessionMetadata({
                     ...rowOption.value,
-                    claims: input.claims,
+                    claims: input.claims ?? rowOption.value.claims,
                 }),
             })
                 .where("id", "=", input.sessionId)
@@ -356,11 +724,557 @@ export const makeKyselyVerificationStore = (db) => {
         }),
     });
 };
+export const makeKyselyLoginApprovalReviewStore = (db) => {
+    const authDb = asAuthDb(db);
+    return LoginApprovalReviewStore.make({
+        insertPending: (input) => runLoginApprovalReviewKysely("insert", async () => {
+            await authDb
+                .insertInto("auth_login_approval_review")
+                .values(loginApprovalReviewInsert(input))
+                .executeTakeFirst();
+            return input;
+        }),
+        findByApprovalChallengeId: (input) => findLoginApprovalReviewByApprovalChallengeId(db, input),
+        approve: (input) => runLoginApprovalReviewKysely("approve", () => authDb
+            .updateTable("auth_login_approval_review")
+            .set({
+            status: "approved",
+            reviewed_at: Number(input.reviewedAt),
+            reviewed_by: input.reviewedBy ?? null,
+            review_metadata: jsonEncode(input.metadata),
+        })
+            .where("approval_challenge_id", "=", input.approvalChallengeId)
+            .where("status", "=", "pending")
+            .executeTakeFirst()).pipe(Effect.flatMap((result) => Number(result.numUpdatedRows) > 0
+            ? findLoginApprovalReviewByApprovalChallengeId(db, input, "approve")
+            : Effect.succeed(Option.none()))),
+        deny: (input) => runLoginApprovalReviewKysely("deny", () => authDb
+            .updateTable("auth_login_approval_review")
+            .set({
+            status: "denied",
+            reviewed_at: Number(input.reviewedAt),
+            reviewed_by: input.reviewedBy ?? null,
+            denied_reason: input.reason ?? null,
+            review_metadata: jsonEncode(input.metadata),
+        })
+            .where("approval_challenge_id", "=", input.approvalChallengeId)
+            .where("status", "=", "pending")
+            .executeTakeFirst()).pipe(Effect.flatMap((result) => Number(result.numUpdatedRows) > 0
+            ? findLoginApprovalReviewByApprovalChallengeId(db, input, "deny")
+            : Effect.succeed(Option.none()))),
+    });
+};
+export const makeKyselyTrustedDeviceStore = (db) => {
+    const authDb = asAuthDb(db);
+    return TrustedDeviceStore.make({
+        find: (input) => findTrustedDevice(db, input),
+        upsert: (input) => runTrustedDeviceKysely("trust", async () => {
+            const existing = await authDb
+                .selectFrom("auth_trusted_device")
+                .selectAll()
+                .where("user_id", "=", input.userId)
+                .where("token_hash", "=", input.tokenHash)
+                .executeTakeFirst();
+            const existingRow = existing === undefined ? undefined : decodeTrustedDeviceRow(existing);
+            await (existingRow === undefined
+                ? authDb
+                    .insertInto("auth_trusted_device")
+                    .values(trustedDeviceInsert(input, input.now))
+                : authDb
+                    .updateTable("auth_trusted_device")
+                    .set({
+                    last_seen_at: Number(input.now),
+                    expires_at: Number(input.expiresAt),
+                    metadata: jsonEncode(input.metadata ?? existingRow.metadata),
+                })
+                    .where("user_id", "=", input.userId)
+                    .where("token_hash", "=", input.tokenHash)).executeTakeFirst();
+            const row = await authDb
+                .selectFrom("auth_trusted_device")
+                .selectAll()
+                .where("user_id", "=", input.userId)
+                .where("token_hash", "=", input.tokenHash)
+                .executeTakeFirstOrThrow();
+            return decodeTrustedDeviceRow(row);
+        }),
+    });
+};
+export const makeKyselyPasskeyCredentialStore = (db) => {
+    const authDb = asAuthDb(db);
+    return PasskeyCredentialStore.make({
+        insert: (row) => runPasskeyCredentialKysely("insert", () => authDb
+            .insertInto("auth_passkey_credential")
+            .values(passkeyCredentialInsert(row))
+            .executeTakeFirst()).pipe(Effect.asVoid),
+        findByCredentialId: (credentialId) => runPasskeyCredentialKysely("find", () => authDb
+            .selectFrom("auth_passkey_credential")
+            .selectAll()
+            .where("credential_id", "=", credentialId)
+            .executeTakeFirst()).pipe(Effect.map((row) => row === undefined
+            ? Option.none()
+            : Option.some(decodePasskeyCredentialRow(row)))),
+        listByUser: (input) => runPasskeyCredentialKysely("list", () => {
+            let query = authDb
+                .selectFrom("auth_passkey_credential")
+                .selectAll()
+                .where("user_id", "=", input.userId);
+            if (input.includeRevoked !== true) {
+                query = query.where("revoked_at", "is", null);
+            }
+            return query.execute();
+        }).pipe(Effect.map((rows) => rows.map(decodePasskeyCredentialRow))),
+        updateSignCount: (input) => runPasskeyCredentialKysely("update-sign-count", () => authDb
+            .updateTable("auth_passkey_credential")
+            .set({
+            sign_count: input.signCount,
+            last_used_at: Number(input.lastUsedAt),
+            ...(input.metadata === undefined
+                ? {}
+                : { metadata: jsonEncode(input.metadata) }),
+        })
+            .where("credential_id", "=", input.credentialId)
+            .where("revoked_at", "is", null)
+            .executeTakeFirst()).pipe(Effect.flatMap(() => runPasskeyCredentialKysely("find", () => authDb
+            .selectFrom("auth_passkey_credential")
+            .selectAll()
+            .where("credential_id", "=", input.credentialId)
+            .where("revoked_at", "is", null)
+            .executeTakeFirst())), Effect.map((row) => row === undefined
+            ? Option.none()
+            : Option.some(decodePasskeyCredentialRow(row)))),
+        revoke: (input) => runPasskeyCredentialKysely("revoke", async () => {
+            const metadata = input.reason === undefined
+                ? undefined
+                : await authDb
+                    .selectFrom("auth_passkey_credential")
+                    .select("metadata")
+                    .where("credential_id", "=", input.credentialId)
+                    .executeTakeFirst()
+                    .then((row) => {
+                    const existingMetadata = jsonDecode(row?.metadata ?? null);
+                    return jsonEncode({
+                        ...(isRecord(existingMetadata) ? existingMetadata : {}),
+                        revokeReason: input.reason,
+                    });
+                });
+            return authDb
+                .updateTable("auth_passkey_credential")
+                .set({
+                revoked_at: Number(input.revokedAt),
+                ...(metadata === undefined ? {} : { metadata }),
+            })
+                .where("credential_id", "=", input.credentialId)
+                .executeTakeFirst();
+        }).pipe(Effect.asVoid),
+    });
+};
+export const makeKyselyTotpFactorStore = (db) => {
+    const authDb = asAuthDb(db);
+    return TotpFactorStore.make({
+        insert: (row) => runTotpFactorKysely("insert", () => authDb
+            .insertInto("auth_totp_factor")
+            .values(totpFactorInsert(row))
+            .executeTakeFirst()).pipe(Effect.asVoid),
+        findById: (id) => runTotpFactorKysely("find", () => authDb
+            .selectFrom("auth_totp_factor")
+            .selectAll()
+            .where("id", "=", id)
+            .executeTakeFirst()).pipe(Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeTotpFactorRow(row)))),
+        listByUser: (input) => runTotpFactorKysely("list", () => {
+            let query = authDb
+                .selectFrom("auth_totp_factor")
+                .selectAll()
+                .where("user_id", "=", input.userId);
+            if (input.includeRevoked !== true) {
+                query = query.where("revoked_at", "is", null);
+            }
+            if (input.includeUnconfirmed !== true) {
+                query = query.where("confirmed_at", "is not", null);
+            }
+            return query.execute();
+        }).pipe(Effect.map((rows) => rows.map(decodeTotpFactorRow))),
+        confirm: (input) => runTotpFactorKysely("confirm", () => authDb
+            .updateTable("auth_totp_factor")
+            .set({
+            confirmed_at: Number(input.confirmedAt),
+            ...(input.metadata === undefined
+                ? {}
+                : { metadata: jsonEncode(input.metadata) }),
+        })
+            .where("id", "=", input.id)
+            .where("revoked_at", "is", null)
+            .executeTakeFirst()).pipe(Effect.flatMap(() => runTotpFactorKysely("find", () => authDb
+            .selectFrom("auth_totp_factor")
+            .selectAll()
+            .where("id", "=", input.id)
+            .where("revoked_at", "is", null)
+            .executeTakeFirst())), Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeTotpFactorRow(row)))),
+        markUsed: (input) => runTotpFactorKysely("mark-used", () => authDb
+            .updateTable("auth_totp_factor")
+            .set({
+            last_used_at: Number(input.lastUsedAt),
+            ...(input.metadata === undefined
+                ? {}
+                : { metadata: jsonEncode(input.metadata) }),
+        })
+            .where("id", "=", input.id)
+            .where("revoked_at", "is", null)
+            .where("confirmed_at", "is not", null)
+            .executeTakeFirst()).pipe(Effect.flatMap(() => runTotpFactorKysely("find", () => authDb
+            .selectFrom("auth_totp_factor")
+            .selectAll()
+            .where("id", "=", input.id)
+            .where("revoked_at", "is", null)
+            .where("confirmed_at", "is not", null)
+            .executeTakeFirst())), Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeTotpFactorRow(row)))),
+        revoke: (input) => runTotpFactorKysely("revoke", async () => {
+            const metadata = input.reason === undefined
+                ? undefined
+                : await authDb
+                    .selectFrom("auth_totp_factor")
+                    .select("metadata")
+                    .where("id", "=", input.id)
+                    .executeTakeFirst()
+                    .then((row) => {
+                    const existingMetadata = jsonDecode(row?.metadata ?? null);
+                    return jsonEncode({
+                        ...(isRecord(existingMetadata) ? existingMetadata : {}),
+                        revokeReason: input.reason,
+                    });
+                });
+            return authDb
+                .updateTable("auth_totp_factor")
+                .set({
+                revoked_at: Number(input.revokedAt),
+                ...(metadata === undefined ? {} : { metadata }),
+            })
+                .where("id", "=", input.id)
+                .executeTakeFirst();
+        }).pipe(Effect.asVoid),
+    });
+};
+export const makeKyselyRecoveryCodeStore = (db) => {
+    const authDb = asAuthDb(db);
+    return RecoveryCodeStore.make({
+        insertMany: (rows) => rows.length === 0
+            ? Effect.void
+            : runRecoveryCodeKysely("insert", () => authDb
+                .insertInto("auth_recovery_code")
+                .values(rows.map(recoveryCodeInsert))
+                .execute()).pipe(Effect.asVoid),
+        findById: (id) => runRecoveryCodeKysely("find", () => authDb
+            .selectFrom("auth_recovery_code")
+            .selectAll()
+            .where("id", "=", id)
+            .executeTakeFirst()).pipe(Effect.map((row) => row === undefined
+            ? Option.none()
+            : Option.some(decodeRecoveryCodeRow(row)))),
+        listByUser: (input) => runRecoveryCodeKysely("list", () => {
+            let query = authDb
+                .selectFrom("auth_recovery_code")
+                .selectAll()
+                .where("user_id", "=", input.userId);
+            if (input.includeUsed !== true) {
+                query = query.where("used_at", "is", null);
+            }
+            if (input.includeRevoked !== true) {
+                query = query.where("revoked_at", "is", null);
+            }
+            return query.execute();
+        }).pipe(Effect.map((rows) => rows.map(decodeRecoveryCodeRow))),
+        markUsed: (input) => runRecoveryCodeKysely("mark-used", async () => {
+            const result = await authDb
+                .updateTable("auth_recovery_code")
+                .set({
+                used_at: Number(input.usedAt),
+                ...(input.metadata === undefined
+                    ? {}
+                    : { metadata: jsonEncode(input.metadata) }),
+            })
+                .where("id", "=", input.id)
+                .where("used_at", "is", null)
+                .where("revoked_at", "is", null)
+                .executeTakeFirst();
+            if (Number(result.numUpdatedRows) === 0) {
+                return undefined;
+            }
+            return authDb
+                .selectFrom("auth_recovery_code")
+                .selectAll()
+                .where("id", "=", input.id)
+                .executeTakeFirst();
+        }).pipe(Effect.map((row) => row === undefined
+            ? Option.none()
+            : Option.some(decodeRecoveryCodeRow(row)))),
+        revoke: (input) => runRecoveryCodeKysely("revoke", async () => {
+            const metadata = input.reason === undefined
+                ? undefined
+                : await authDb
+                    .selectFrom("auth_recovery_code")
+                    .select("metadata")
+                    .where("id", "=", input.id)
+                    .executeTakeFirst()
+                    .then((row) => {
+                    const existingMetadata = jsonDecode(row?.metadata ?? null);
+                    return jsonEncode({
+                        ...(isRecord(existingMetadata) ? existingMetadata : {}),
+                        revokeReason: input.reason,
+                    });
+                });
+            return authDb
+                .updateTable("auth_recovery_code")
+                .set({
+                revoked_at: Number(input.revokedAt),
+                ...(metadata === undefined ? {} : { metadata }),
+            })
+                .where("id", "=", input.id)
+                .executeTakeFirst();
+        }).pipe(Effect.asVoid),
+    });
+};
+export const makeKyselyApiKeyStore = (db) => {
+    const authDb = asAuthDb(db);
+    return ApiKeyStore.make({
+        insert: (row) => runApiKeyKysely("insert", () => authDb.insertInto("auth_api_key").values(apiKeyInsert(row)).executeTakeFirst()).pipe(Effect.asVoid),
+        findById: (id) => runApiKeyKysely("find", () => authDb
+            .selectFrom("auth_api_key")
+            .selectAll()
+            .where("id", "=", id)
+            .executeTakeFirst()).pipe(Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeApiKeyRow(row)))),
+        findByPrefix: (prefix) => runApiKeyKysely("find", () => authDb
+            .selectFrom("auth_api_key")
+            .selectAll()
+            .where("prefix", "=", prefix)
+            .executeTakeFirst()).pipe(Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeApiKeyRow(row)))),
+        listByUser: (input) => runApiKeyKysely("list", () => {
+            let query = authDb
+                .selectFrom("auth_api_key")
+                .selectAll()
+                .where("user_id", "=", input.userId);
+            if (input.includeRevoked !== true) {
+                query = query.where("revoked_at", "is", null);
+            }
+            return query.execute();
+        }).pipe(Effect.map((rows) => rows.map(decodeApiKeyRow))),
+        markUsed: (input) => runApiKeyKysely("mark-used", async () => {
+            const result = await authDb
+                .updateTable("auth_api_key")
+                .set({
+                last_used_at: Number(input.lastUsedAt),
+                ...(input.metadata === undefined
+                    ? {}
+                    : { metadata: jsonEncode(input.metadata) }),
+            })
+                .where("id", "=", input.id)
+                .where("revoked_at", "is", null)
+                .executeTakeFirst();
+            if (Number(result.numUpdatedRows) === 0) {
+                return undefined;
+            }
+            return authDb
+                .selectFrom("auth_api_key")
+                .selectAll()
+                .where("id", "=", input.id)
+                .executeTakeFirst();
+        }).pipe(Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeApiKeyRow(row)))),
+        revoke: (input) => runApiKeyKysely("revoke", async () => {
+            const metadata = input.reason === undefined
+                ? undefined
+                : await authDb
+                    .selectFrom("auth_api_key")
+                    .select("metadata")
+                    .where("id", "=", input.id)
+                    .executeTakeFirst()
+                    .then((row) => {
+                    const existingMetadata = jsonDecode(row?.metadata ?? null);
+                    return jsonEncode({
+                        ...(isRecord(existingMetadata) ? existingMetadata : {}),
+                        revokeReason: input.reason,
+                    });
+                });
+            return authDb
+                .updateTable("auth_api_key")
+                .set({
+                revoked_at: Number(input.revokedAt),
+                ...(metadata === undefined ? {} : { metadata }),
+            })
+                .where("id", "=", input.id)
+                .executeTakeFirst();
+        }).pipe(Effect.asVoid),
+    });
+};
+export const makeKyselyRefreshTokenStore = (db) => {
+    const authDb = asAuthDb(db);
+    const metadataWithReason = (metadata, key, reason) => {
+        if (reason === undefined) {
+            return metadata;
+        }
+        const existing = jsonDecode(metadata);
+        return jsonEncode({
+            ...(isRecord(existing) ? existing : {}),
+            [key]: reason,
+        });
+    };
+    return RefreshTokenStore.make({
+        insert: (row) => runRefreshTokenKysely("insert", () => authDb
+            .insertInto("auth_refresh_token")
+            .values(refreshTokenInsert(row))
+            .executeTakeFirst()).pipe(Effect.asVoid),
+        findById: (id) => runRefreshTokenKysely("find", () => authDb
+            .selectFrom("auth_refresh_token")
+            .selectAll()
+            .where("id", "=", id)
+            .executeTakeFirst()).pipe(Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeRefreshTokenRow(row)))),
+        findBySecretHash: (hash) => runRefreshTokenKysely("find", () => authDb
+            .selectFrom("auth_refresh_token")
+            .selectAll()
+            .where("secret_hash", "=", hash)
+            .executeTakeFirst()).pipe(Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeRefreshTokenRow(row)))),
+        listByUser: (input) => runRefreshTokenKysely("list", () => {
+            let query = authDb
+                .selectFrom("auth_refresh_token")
+                .selectAll()
+                .where("user_id", "=", input.userId);
+            if (input.includeRevoked !== true) {
+                query = query.where("revoked_at", "is", null);
+            }
+            return query.execute();
+        }).pipe(Effect.map((rows) => rows.map(decodeRefreshTokenRow))),
+        listByFamily: (input) => runRefreshTokenKysely("list", () => {
+            let query = authDb
+                .selectFrom("auth_refresh_token")
+                .selectAll()
+                .where("family_id", "=", input.familyId);
+            if (input.includeRevoked !== true) {
+                query = query.where("revoked_at", "is", null);
+            }
+            return query.execute();
+        }).pipe(Effect.map((rows) => rows.map(decodeRefreshTokenRow))),
+        rotate: (input) => runRefreshTokenKysely("rotate", async () => authDb.transaction().execute(async (transaction) => {
+            const tx = transaction;
+            const updated = await tx
+                .updateTable("auth_refresh_token")
+                .set({
+                last_used_at: Number(input.rotatedAt),
+                rotated_at: Number(input.rotatedAt),
+                replaced_by_id: input.replacement.id,
+            })
+                .where("id", "=", input.id)
+                .where("rotated_at", "is", null)
+                .where("revoked_at", "is", null)
+                .executeTakeFirst();
+            if (Number(updated.numUpdatedRows) === 0) {
+                return undefined;
+            }
+            await tx
+                .insertInto("auth_refresh_token")
+                .values(refreshTokenInsert(input.replacement))
+                .executeTakeFirst();
+            const previous = await tx
+                .selectFrom("auth_refresh_token")
+                .selectAll()
+                .where("id", "=", input.id)
+                .executeTakeFirst();
+            const replacement = await tx
+                .selectFrom("auth_refresh_token")
+                .selectAll()
+                .where("id", "=", input.replacement.id)
+                .executeTakeFirst();
+            return previous === undefined || replacement === undefined
+                ? undefined
+                : {
+                    previous: decodeRefreshTokenRow(previous),
+                    replacement: decodeRefreshTokenRow(replacement),
+                };
+        })).pipe(Effect.map((row) => (row === undefined ? Option.none() : Option.some(row)))),
+        markReuseDetected: (input) => runRefreshTokenKysely("reuse", async () => {
+            const result = await authDb
+                .updateTable("auth_refresh_token")
+                .set({ reuse_detected_at: Number(input.reuseDetectedAt) })
+                .where("id", "=", input.id)
+                .executeTakeFirst();
+            if (Number(result.numUpdatedRows) === 0) {
+                return undefined;
+            }
+            return authDb
+                .selectFrom("auth_refresh_token")
+                .selectAll()
+                .where("id", "=", input.id)
+                .executeTakeFirst();
+        }).pipe(Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeRefreshTokenRow(row)))),
+        revoke: (input) => runRefreshTokenKysely("revoke", async () => {
+            const row = await authDb
+                .selectFrom("auth_refresh_token")
+                .select(["metadata"])
+                .where("id", "=", input.id)
+                .executeTakeFirst();
+            return authDb
+                .updateTable("auth_refresh_token")
+                .set({
+                revoked_at: Number(input.revokedAt),
+                metadata: metadataWithReason(row?.metadata ?? null, "revokeReason", input.reason),
+            })
+                .where("id", "=", input.id)
+                .executeTakeFirst();
+        }).pipe(Effect.asVoid),
+        revokeFamily: (input) => runRefreshTokenKysely("revoke", async () => {
+            const rows = await authDb
+                .selectFrom("auth_refresh_token")
+                .select(["id", "metadata"])
+                .where("family_id", "=", input.familyId)
+                .execute();
+            await Promise.all(rows.map((row) => authDb
+                .updateTable("auth_refresh_token")
+                .set({
+                revoked_at: Number(input.revokedAt),
+                metadata: metadataWithReason(row.metadata, "familyRevokeReason", input.reason),
+            })
+                .where("id", "=", row.id)
+                .executeTakeFirst()));
+        }).pipe(Effect.asVoid),
+    });
+};
+export const makeKyselyJwtRevocationStore = (db) => {
+    const authDb = asAuthDb(db);
+    return JwtRevocationStore.make({
+        revoke: (record) => runJwtRevocationKysely("revoke", async () => {
+            const row = jwtRevocationInsert(record);
+            const updated = await authDb
+                .updateTable("auth_jwt_revocation")
+                .set({
+                revoked_at: row.revoked_at,
+                expires_at: row.expires_at,
+                reason: row.reason,
+            })
+                .where("jwt_id", "=", record.jwtId)
+                .executeTakeFirst();
+            if (Number(updated.numUpdatedRows) === 0) {
+                await authDb
+                    .insertInto("auth_jwt_revocation")
+                    .values(row)
+                    .executeTakeFirst();
+            }
+        }).pipe(Effect.asVoid),
+        find: (jwtId) => runJwtRevocationKysely("find", () => authDb
+            .selectFrom("auth_jwt_revocation")
+            .selectAll()
+            .where("jwt_id", "=", jwtId)
+            .executeTakeFirst()).pipe(Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeJwtRevocationRow(row)))),
+    });
+};
 export const makeKyselyStorage = (db) => ({
     userStore: makeKyselyUserStore(db),
     credentialStore: makeKyselyCredentialStore(db),
     sessionStore: makeKyselySessionStore(db),
     verificationStore: makeKyselyVerificationStore(db),
+    loginApprovalReviewStore: makeKyselyLoginApprovalReviewStore(db),
+    trustedDeviceStore: makeKyselyTrustedDeviceStore(db),
+    passkeyCredentialStore: makeKyselyPasskeyCredentialStore(db),
+    totpFactorStore: makeKyselyTotpFactorStore(db),
+    recoveryCodeStore: makeKyselyRecoveryCodeStore(db),
+    apiKeyStore: makeKyselyApiKeyStore(db),
+    refreshTokenStore: makeKyselyRefreshTokenStore(db),
+    jwtRevocationStore: makeKyselyJwtRevocationStore(db),
 });
-export const KyselyAuthStorageLive = (db) => Layer.mergeAll(Layer.succeed(UserStore)(makeKyselyUserStore(db)), Layer.succeed(CredentialStore)(makeKyselyCredentialStore(db)), Layer.succeed(SessionStore)(makeKyselySessionStore(db)), Layer.succeed(VerificationStore)(makeKyselyVerificationStore(db)));
+export const KyselyAuthStorageLive = (db) => Layer.mergeAll(Layer.succeed(UserStore)(makeKyselyUserStore(db)), Layer.succeed(CredentialStore)(makeKyselyCredentialStore(db)), Layer.succeed(SessionStore)(makeKyselySessionStore(db)), Layer.succeed(VerificationStore)(makeKyselyVerificationStore(db)), Layer.succeed(LoginApprovalReviewStore)(makeKyselyLoginApprovalReviewStore(db)), Layer.succeed(TrustedDeviceStore)(makeKyselyTrustedDeviceStore(db)), Layer.succeed(PasskeyCredentialStore)(makeKyselyPasskeyCredentialStore(db)), Layer.succeed(TotpFactorStore)(makeKyselyTotpFactorStore(db)), Layer.succeed(RecoveryCodeStore)(makeKyselyRecoveryCodeStore(db)), Layer.succeed(ApiKeyStore)(makeKyselyApiKeyStore(db)), Layer.succeed(RefreshTokenStore)(makeKyselyRefreshTokenStore(db)), Layer.succeed(JwtRevocationStore)(makeKyselyJwtRevocationStore(db)));
 //# sourceMappingURL=KyselyStorage.js.map