@effect-auth/core 0.1.0-alpha.2 → 0.1.0-alpha.4

package/dist/EffectQbSqliteStorage.js

@@ -1,7 +1,11 @@
 import { Data, Effect, Layer, Option } from "effect";
-import { Column, Executor, Query, Table } from "effect-qb/sqlite";
-import { ChallengeId, CredentialId, Email, SessionId, UnixMillis, UserId, } from "./Identifiers.js";
+import { Column, Executor, Query, Scalar, Table } from "effect-qb/sqlite";
+import { AuthFlowId, ChallengeId, CredentialId, Email, SessionId, UnixMillis, UserId, } from "./Identifiers.js";
+import { JwtError, JwtRevocationStore } from "./Jwt.js";
+import { LoginApprovalReviewError, LoginApprovalReviewStore, } from "./LoginApproval.js";
+import { LoginRiskContext, LoginRiskSignal } from "./LoginRisk.js";
 import { CredentialStore, SessionStore, StorageError, UserStore, VerificationStore, } from "./Storage.js";
+import { TrustedDeviceError, TrustedDeviceStore } from "./TrustedDevice.js";
 export class D1EffectQbError extends Data.TaggedError("D1EffectQbError") {
 }
 const makeAuthUserTable = (name) => Table.make(name, {
@@ -48,6 +52,38 @@ const makeAuthVerificationTable = (name) => Table.make(name, {
     metadata: Column.text().pipe(Column.nullable),
     consumed_at: Column.int().pipe(Column.nullable),
 });
+const makeAuthLoginApprovalReviewTable = (name) => Table.make(name, {
+    approval_challenge_id: Column.text().pipe(Column.primaryKey),
+    flow_id: Column.text(),
+    user_id: Column.text(),
+    channel: Column.text(),
+    reason: Column.text(),
+    session_binding: Column.text(),
+    same_device_required: Column.int(),
+    status: Column.text(),
+    created_at: Column.int(),
+    expires_at: Column.int(),
+    reviewed_at: Column.int().pipe(Column.nullable),
+    reviewed_by: Column.text().pipe(Column.nullable),
+    denied_reason: Column.text().pipe(Column.nullable),
+    risk: Column.text().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+    review_metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthTrustedDeviceTable = (name) => Table.make(name, {
+    user_id: Column.text(),
+    token_hash: Column.text(),
+    created_at: Column.int(),
+    last_seen_at: Column.int(),
+    expires_at: Column.int(),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthJwtRevocationTable = (name) => Table.make(name, {
+    jwt_id: Column.text().pipe(Column.primaryKey),
+    revoked_at: Column.int(),
+    expires_at: Column.int().pipe(Column.nullable),
+    reason: Column.text().pipe(Column.nullable),
+});
 const authSqliteTablesTypeId = Symbol.for("@effect-auth/core/EffectQbSqliteStorage/AuthSqliteTables");
 const jsonEncode = (value) => value === undefined ? null : JSON.stringify(value);
 const jsonDecode = (value) => {
@@ -73,14 +109,8 @@ const decodeBoolean = (value) => {
     return value !== null && value !== undefined;
 };
 const mutationValues = (value) => value;
-// Concrete effect-qb table generics are erased after `defineEffectQbAuthTables`;
-// mapping definitions keep typed encoders at the app boundary.
-const querySelect = (selection) => Query.select(selection);
-const queryReturning = (selection) => Query.returning(selection);
-const queryFrom = (table) => Query.from(table);
 const queryInsert = (table, values) => Query.insert(table, values);
 const queryUpdate = (table, values) => Query.update(table, values);
-const queryDelete = (table) => Query.delete(table);
 const queryEq = (left, right) => Query.eq(left, right);
 const queryGt = (left, right) => Query.gt(left, right);
 const queryLte = (left, right) => Query.lte(left, right);
@@ -90,6 +120,45 @@ const executePlan = (executor, plan) => executor.execute(plan);
 const omitUndefined = (record) => Object.fromEntries(Object.entries(record).filter(([, value]) => value !== undefined));
 const sessionMetadataEnvelopeKey = "__effectAuthSession";
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isLoginRiskLevel = (value) => value === "unknown" ||
+    value === "low" ||
+    value === "medium" ||
+    value === "high" ||
+    value === "critical";
+const decodeLoginRiskSignal = (value) => {
+    const record = isRecord(value) ? value : {};
+    const level = isLoginRiskLevel(record.level) ? record.level : undefined;
+    return LoginRiskSignal.make({
+        type: typeof record.type === "string" ? record.type : "unknown",
+        ...(level === undefined ? {} : { level }),
+        ...(isRecord(record.metadata) ? { metadata: record.metadata } : {}),
+    });
+};
+const decodeLoginRiskContext = (value) => {
+    const decoded = jsonDecode(value);
+    if (!isRecord(decoded)) {
+        return undefined;
+    }
+    return LoginRiskContext.make({
+        level: isLoginRiskLevel(decoded.level) ? decoded.level : "unknown",
+        signals: Array.isArray(decoded.signals)
+            ? decoded.signals.map(decodeLoginRiskSignal)
+            : [],
+        ...(isRecord(decoded.metadata) ? { metadata: decoded.metadata } : {}),
+    });
+};
+const encodeLoginRiskSignal = (signal) => omitUndefined({
+    type: signal.type,
+    level: signal.level,
+    metadata: signal.metadata,
+});
+const encodeLoginRiskContext = (risk) => risk === undefined
+    ? null
+    : jsonEncode(omitUndefined({
+        level: risk.level,
+        signals: risk.signals.map(encodeLoginRiskSignal),
+        metadata: risk.metadata,
+    }));
 const decodeSessionMetadata = (value) => {
     const decoded = jsonDecode(value);
     const envelope = isRecord(decoded)
@@ -176,6 +245,49 @@ const decodeDefaultVerificationRow = (row) => omitUndefined({
 const decodeVerificationRow = (tables, row) => tables.verification.decode === undefined
     ? decodeDefaultVerificationRow(row)
     : tables.verification.decode(row);
+const decodeDefaultLoginApprovalReviewRow = (row) => omitUndefined({
+    approvalChallengeId: ChallengeId(row.approvalChallengeId),
+    flowId: AuthFlowId(row.flowId),
+    userId: UserId(row.userId),
+    channel: row.channel,
+    reason: row.reason,
+    sessionBinding: row.sessionBinding,
+    sameDeviceRequired: decodeBoolean(row.sameDeviceRequired),
+    status: row.status,
+    createdAt: UnixMillis(Number(row.createdAt)),
+    expiresAt: UnixMillis(Number(row.expiresAt)),
+    reviewedAt: optionalUnixMillis(row.reviewedAt),
+    reviewedBy: row.reviewedBy === null
+        ? undefined
+        : row.reviewedBy,
+    deniedReason: row.deniedReason === null ? undefined : row.deniedReason,
+    risk: decodeLoginRiskContext(row.risk),
+    metadata: jsonDecode(row.metadata),
+    reviewMetadata: jsonDecode(row.reviewMetadata),
+});
+const decodeLoginApprovalReviewRow = (tables, row) => tables.loginApprovalReview.decode === undefined
+    ? decodeDefaultLoginApprovalReviewRow(row)
+    : tables.loginApprovalReview.decode(row);
+const decodeDefaultTrustedDeviceRow = (row) => omitUndefined({
+    userId: UserId(row.userId),
+    tokenHash: row.tokenHash,
+    createdAt: UnixMillis(Number(row.createdAt)),
+    lastSeenAt: UnixMillis(Number(row.lastSeenAt)),
+    expiresAt: UnixMillis(Number(row.expiresAt)),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeTrustedDeviceRow = (tables, row) => tables.trustedDevice.decode === undefined
+    ? decodeDefaultTrustedDeviceRow(row)
+    : tables.trustedDevice.decode(row);
+const decodeDefaultJwtRevocationRow = (row) => omitUndefined({
+    jwtId: row.jwtId,
+    revokedAt: UnixMillis(Number(row.revokedAt)),
+    expiresAt: optionalUnixMillis(row.expiresAt),
+    reason: row.reason ?? undefined,
+});
+const decodeJwtRevocationRow = (tables, row) => tables.jwtRevocation.decode === undefined
+    ? decodeDefaultJwtRevocationRow(row)
+    : tables.jwtRevocation.decode(row);
 const userInsert = (row) => ({
     id: row.id,
     email: row.email,
@@ -195,6 +307,10 @@ const passwordCredentialInsert = (row) => ({
     revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
     metadata: jsonEncode(row.metadata),
 });
+const passwordCredentialUpdatePassword = (input) => ({
+    password_hash: input.passwordHash,
+    updated_at: Number(input.updatedAt),
+});
 const sessionInsert = (row) => ({
     id: row.id,
     user_id: row.userId,
@@ -220,6 +336,24 @@ const verificationInsert = (row) => ({
     metadata: jsonEncode(row.metadata),
     consumed_at: null,
 });
+const loginApprovalReviewInsert = (row) => ({
+    approval_challenge_id: row.approvalChallengeId,
+    flow_id: row.flowId,
+    user_id: row.userId,
+    channel: row.channel,
+    reason: row.reason,
+    session_binding: row.sessionBinding,
+    same_device_required: row.sameDeviceRequired ? 1 : 0,
+    status: row.status,
+    created_at: Number(row.createdAt),
+    expires_at: Number(row.expiresAt),
+    reviewed_at: row.reviewedAt === undefined ? null : Number(row.reviewedAt),
+    reviewed_by: row.reviewedBy ?? null,
+    denied_reason: row.deniedReason ?? null,
+    risk: encodeLoginRiskContext(row.risk),
+    metadata: jsonEncode(row.metadata),
+    review_metadata: jsonEncode(row.reviewMetadata),
+});
 const userMarkEmailVerifiedUpdate = (input) => ({
     email_verified: 1,
     updated_at: Number(input.updatedAt),
@@ -233,10 +367,13 @@ const sessionRotateUpdate = (input) => omitUndefined({
     rotated_at: Number(input.rotatedAt),
     expires_at: input.expiresAt === undefined ? undefined : Number(input.expiresAt),
 });
-const sessionUpdateClaimsUpdate = (row, input) => ({
+const sessionUpdateClaimsUpdate = (row, input) => omitUndefined({
+    aal: input.aal,
+    amr: input.amr === undefined ? undefined : JSON.stringify(input.amr),
+    mfa_verified_at: input.mfaVerifiedAt === undefined ? undefined : Number(input.mfaVerifiedAt),
     metadata: encodeSessionMetadata({
         ...row,
-        claims: input.claims,
+        claims: input.claims ?? row.claims,
     }),
 });
 const sessionRevokeUpdate = (input) => ({
@@ -245,11 +382,51 @@ const sessionRevokeUpdate = (input) => ({
 const verificationConsumeUpdate = (input) => ({
     consumed_at: Number(input.consumedAt),
 });
+const loginApprovalReviewApproveUpdate = (input) => ({
+    status: "approved",
+    reviewed_at: Number(input.reviewedAt),
+    reviewed_by: input.reviewedBy ?? null,
+    review_metadata: jsonEncode(input.metadata),
+});
+const loginApprovalReviewDenyUpdate = (input) => ({
+    status: "denied",
+    reviewed_at: Number(input.reviewedAt),
+    reviewed_by: input.reviewedBy ?? null,
+    denied_reason: input.reason ?? null,
+    review_metadata: jsonEncode(input.metadata),
+});
+const trustedDeviceInsert = (input, createdAt) => ({
+    user_id: input.userId,
+    token_hash: input.tokenHash,
+    created_at: Number(createdAt),
+    last_seen_at: Number(input.now),
+    expires_at: Number(input.expiresAt),
+    metadata: jsonEncode(input.metadata),
+});
+const trustedDeviceUpdate = (input, existing) => ({
+    last_seen_at: Number(input.now),
+    expires_at: Number(input.expiresAt),
+    metadata: jsonEncode(input.metadata ?? existing.metadata),
+});
+const jwtRevocationInsert = (record) => ({
+    jwt_id: record.jwtId,
+    revoked_at: Number(record.revokedAt),
+    expires_at: record.expiresAt === undefined ? null : Number(record.expiresAt),
+    reason: record.reason ?? null,
+});
+const jwtRevocationUpdate = (record) => ({
+    revoked_at: Number(record.revokedAt),
+    expires_at: record.expiresAt === undefined ? null : Number(record.expiresAt),
+    reason: record.reason ?? null,
+});
 const makeInternalAuthSqliteTables = (names = {}) => {
     const user = makeAuthUserTable(names.user ?? "auth_user");
     const credential = makeAuthCredentialTable(names.credential ?? "auth_credential");
     const session = makeAuthSessionTable(names.session ?? "auth_session");
     const verification = makeAuthVerificationTable(names.verification ?? "auth_verification");
+    const loginApprovalReview = makeAuthLoginApprovalReviewTable(names.loginApprovalReview ?? "auth_login_approval_review");
+    const trustedDevice = makeAuthTrustedDeviceTable(names.trustedDevice ?? "auth_trusted_device");
+    const jwtRevocation = makeAuthJwtRevocationTable(names.jwtRevocation ?? "auth_jwt_revocation");
     return {
         user: {
             table: user,
@@ -278,6 +455,7 @@ const makeInternalAuthSqliteTables = (names = {}) => {
                 metadata: credential.metadata,
             },
             insertPassword: passwordCredentialInsert,
+            updatePassword: passwordCredentialUpdatePassword,
         },
         session: {
             table: session,
@@ -317,6 +495,54 @@ const makeInternalAuthSqliteTables = (names = {}) => {
             insert: verificationInsert,
             consume: verificationConsumeUpdate,
         },
+        loginApprovalReview: {
+            table: loginApprovalReview,
+            select: {
+                approvalChallengeId: loginApprovalReview.approval_challenge_id,
+                flowId: loginApprovalReview.flow_id,
+                userId: loginApprovalReview.user_id,
+                channel: loginApprovalReview.channel,
+                reason: loginApprovalReview.reason,
+                sessionBinding: loginApprovalReview.session_binding,
+                sameDeviceRequired: loginApprovalReview.same_device_required,
+                status: loginApprovalReview.status,
+                createdAt: loginApprovalReview.created_at,
+                expiresAt: loginApprovalReview.expires_at,
+                reviewedAt: loginApprovalReview.reviewed_at,
+                reviewedBy: loginApprovalReview.reviewed_by,
+                deniedReason: loginApprovalReview.denied_reason,
+                risk: loginApprovalReview.risk,
+                metadata: loginApprovalReview.metadata,
+                reviewMetadata: loginApprovalReview.review_metadata,
+            },
+            insertPending: loginApprovalReviewInsert,
+            approve: loginApprovalReviewApproveUpdate,
+            deny: loginApprovalReviewDenyUpdate,
+        },
+        trustedDevice: {
+            table: trustedDevice,
+            select: {
+                userId: trustedDevice.user_id,
+                tokenHash: trustedDevice.token_hash,
+                createdAt: trustedDevice.created_at,
+                lastSeenAt: trustedDevice.last_seen_at,
+                expiresAt: trustedDevice.expires_at,
+                metadata: trustedDevice.metadata,
+            },
+            insert: trustedDeviceInsert,
+            update: trustedDeviceUpdate,
+        },
+        jwtRevocation: {
+            table: jwtRevocation,
+            select: {
+                jwtId: jwtRevocation.jwt_id,
+                revokedAt: jwtRevocation.revoked_at,
+                expiresAt: jwtRevocation.expires_at,
+                reason: jwtRevocation.reason,
+            },
+            insert: jwtRevocationInsert,
+            update: jwtRevocationUpdate,
+        },
     };
 };
 const asAuthSqliteTables = (tables) => tables;
@@ -327,30 +553,59 @@ const selectUserColumns = (tables) => tables.user.select;
 const selectCredentialColumns = (tables) => tables.credential.select;
 const selectSessionColumns = (tables) => tables.session.select;
 const selectVerificationColumns = (tables) => tables.verification.select;
+const selectLoginApprovalReviewColumns = (tables) => tables.loginApprovalReview.select;
+const selectTrustedDeviceColumns = (tables) => tables.trustedDevice.select;
+const selectJwtRevocationColumns = (tables) => tables.jwtRevocation.select;
 const storageError = (entity, operation, cause) => StorageError.fromUnknown(entity, operation, cause);
-const runEffectQb = (entity, operation, effect) => Effect.mapError(effect, (cause) => storageError(entity, operation, cause));
-const findUserById = (executor, tables, id, operation = "find") => runEffectQb("user", operation, executePlan(executor, querySelect(selectUserColumns(tables)).pipe(queryFrom(tables.user.table), Query.where(queryEq(tables.user.select.id, id))))).pipe(Effect.map((rows) => rows[0] === undefined
+const loginApprovalReviewStoreError = (operation, cause) => new LoginApprovalReviewError({
+    message: `Login approval review ${operation} failed`,
+    cause,
+});
+const trustedDeviceStoreError = (operation, cause) => new TrustedDeviceError({
+    operation,
+    message: `Trusted device ${operation} failed`,
+    cause,
+});
+const jwtRevocationStoreError = (operation, cause) => new JwtError({
+    operation: "revocation",
+    message: `JWT revocation ${operation} failed`,
+    cause,
+});
+const findUserById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectUserColumns(tables)).pipe(Query.from(tables.user.table), Query.where(queryEq(tables.user.select.id, id)))).pipe(Effect.mapError((cause) => storageError("user", operation, cause)), Effect.map((rows) => rows[0] === undefined
     ? Option.none()
     : Option.some(decodeUserRow(tables, rows[0]))));
-const findUserByEmail = (executor, tables, email, operation = "find") => runEffectQb("user", operation, executePlan(executor, querySelect(selectUserColumns(tables)).pipe(queryFrom(tables.user.table), Query.where(queryEq(tables.user.select.email, email))))).pipe(Effect.map((rows) => rows[0] === undefined
+const findUserByEmail = (executor, tables, email, operation = "find") => executePlan(executor, Query.select(selectUserColumns(tables)).pipe(Query.from(tables.user.table), Query.where(queryEq(tables.user.select.email, email)))).pipe(Effect.mapError((cause) => storageError("user", operation, cause)), Effect.map((rows) => rows[0] === undefined
     ? Option.none()
     : Option.some(decodeUserRow(tables, rows[0]))));
-const findPasswordCredentialByUserId = (executor, tables, userId, operation = "find") => runEffectQb("credential", operation, executePlan(executor, querySelect(selectCredentialColumns(tables)).pipe(queryFrom(tables.credential.table), Query.where(queryEq(tables.credential.select.userId, userId)), Query.where(queryEq(tables.credential.select.type, "password"))))).pipe(Effect.map((rows) => rows[0] === undefined
+const findPasswordCredentialByUserId = (executor, tables, userId, operation = "find") => executePlan(executor, Query.select(selectCredentialColumns(tables)).pipe(Query.from(tables.credential.table), Query.where(queryEq(tables.credential.select.userId, userId)), Query.where(queryEq(tables.credential.select.type, "password")))).pipe(Effect.mapError((cause) => storageError("credential", operation, cause)), Effect.map((rows) => rows[0] === undefined
     ? Option.none()
     : Option.some(decodePasswordCredentialRow(tables, rows[0]))));
-const findSessionById = (executor, tables, id, operation = "find") => runEffectQb("session", operation, executePlan(executor, querySelect(selectSessionColumns(tables)).pipe(queryFrom(tables.session.table), Query.where(queryEq(tables.session.select.id, id))))).pipe(Effect.map((rows) => rows[0] === undefined
+const findJwtRevocation = (executor, tables, jwtId, operation = "find") => executePlan(executor, Query.select(selectJwtRevocationColumns(tables)).pipe(Query.from(tables.jwtRevocation.table), Query.where(queryEq(tables.jwtRevocation.select.jwtId, jwtId)))).pipe(Effect.mapError((cause) => jwtRevocationStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeJwtRevocationRow(tables, rows[0]))));
+const findSessionById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectSessionColumns(tables)).pipe(Query.from(tables.session.table), Query.where(queryEq(tables.session.select.id, id)))).pipe(Effect.mapError((cause) => storageError("session", operation, cause)), Effect.map((rows) => rows[0] === undefined
     ? Option.none()
     : Option.some(decodeSessionRow(tables, rows[0]))));
-const findVerificationById = (executor, tables, id, operation = "find") => runEffectQb("verification", operation, executePlan(executor, querySelect(selectVerificationColumns(tables)).pipe(queryFrom(tables.verification.table), Query.where(queryEq(tables.verification.select.id, id))))).pipe(Effect.map((rows) => rows[0] === undefined
+const listSessionsByUser = (executor, tables, input, operation = "listByUser") => executePlan(executor, Query.select(selectSessionColumns(tables)).pipe(Query.from(tables.session.table), Query.where(queryEq(tables.session.select.userId, input.userId)))).pipe(Effect.mapError((cause) => storageError("session", operation, cause)), Effect.map((rows) => rows.map((row) => decodeSessionRow(tables, row))));
+const findVerificationById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectVerificationColumns(tables)).pipe(Query.from(tables.verification.table), Query.where(queryEq(tables.verification.select.id, id)))).pipe(Effect.mapError((cause) => storageError("verification", operation, cause)), Effect.map((rows) => rows[0] === undefined
     ? Option.none()
     : Option.some(decodeVerificationRow(tables, rows[0]))));
+const findLoginApprovalReviewByApprovalChallengeId = (executor, tables, input, operation = "find") => executePlan(executor, Query.select(selectLoginApprovalReviewColumns(tables)).pipe(Query.from(tables.loginApprovalReview.table), Query.where(queryEq(tables.loginApprovalReview.select.approvalChallengeId, input.approvalChallengeId)))).pipe(Effect.mapError((cause) => loginApprovalReviewStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeLoginApprovalReviewRow(tables, rows[0]))));
+const findTrustedDevice = (executor, tables, input, operation = "status") => executePlan(executor, Query.select(selectTrustedDeviceColumns(tables)).pipe(Query.from(tables.trustedDevice.table), Query.where(queryEq(tables.trustedDevice.select.userId, input.userId)), Query.where(queryEq(tables.trustedDevice.select.tokenHash, input.tokenHash)), Query.where(queryGt(tables.trustedDevice.select.expiresAt, Number(input.now))))).pipe(Effect.mapError((cause) => trustedDeviceStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeTrustedDeviceRow(tables, rows[0]))));
+const findTrustedDeviceIncludingExpired = (executor, tables, input) => executePlan(executor, Query.select(selectTrustedDeviceColumns(tables)).pipe(Query.from(tables.trustedDevice.table), Query.where(queryEq(tables.trustedDevice.select.userId, input.userId)), Query.where(queryEq(tables.trustedDevice.select.tokenHash, input.tokenHash)))).pipe(Effect.mapError((cause) => trustedDeviceStoreError("trust", cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeTrustedDeviceRow(tables, rows[0]))));
 export const makeEffectQbSqliteUserStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
     return UserStore.make({
         findById: (id) => findUserById(executor, tables, id),
         findByEmail: (email) => findUserByEmail(executor, tables, email),
-        insert: (row) => runEffectQb("user", "insert", executePlan(executor, queryInsert(tables.user.table, mutationValues(tables.user.insert(row))))).pipe(Effect.asVoid),
-        markEmailVerified: (input) => runEffectQb("user", "markEmailVerified", executePlan(executor, queryUpdate(tables.user.table, mutationValues(tables.user.markEmailVerified(input))).pipe(Query.where(queryEq(tables.user.select.id, input.userId)), queryReturning(selectUserColumns(tables))))).pipe(Effect.map((rows) => rows[0] === undefined
+        insert: (row) => executePlan(executor, queryInsert(tables.user.table, mutationValues(tables.user.insert(row)))).pipe(Effect.mapError((cause) => storageError("user", "insert", cause)), Effect.asVoid),
+        markEmailVerified: (input) => executePlan(executor, queryUpdate(tables.user.table, mutationValues(tables.user.markEmailVerified(input))).pipe(Query.where(queryEq(tables.user.select.id, input.userId)), Query.returning(selectUserColumns(tables)))).pipe(Effect.mapError((cause) => storageError("user", "markEmailVerified", cause)), Effect.map((rows) => rows[0] === undefined
             ? Option.none()
             : Option.some(decodeUserRow(tables, rows[0])))),
     });
@@ -359,23 +614,27 @@ export const makeEffectQbSqliteCredentialStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
     return CredentialStore.make({
         findPasswordByUserId: (userId) => findPasswordCredentialByUserId(executor, tables, userId),
-        insertPassword: (row) => runEffectQb("credential", "insert", executePlan(executor, queryInsert(tables.credential.table, mutationValues(tables.credential.insertPassword(row))))).pipe(Effect.asVoid),
+        insertPassword: (row) => executePlan(executor, queryInsert(tables.credential.table, mutationValues(tables.credential.insertPassword(row)))).pipe(Effect.mapError((cause) => storageError("credential", "insert", cause)), Effect.asVoid),
+        updatePassword: (input) => executePlan(executor, queryUpdate(tables.credential.table, mutationValues(tables.credential.updatePassword(input))).pipe(Query.where(queryEq(tables.credential.select.userId, input.userId)), Query.where(queryEq(tables.credential.select.type, "password")), Query.where(queryIsNull(tables.credential.select.revokedAt)), Query.returning({ id: tables.credential.select.id }))).pipe(Effect.mapError((cause) => storageError("credential", "updatePassword", cause)), Effect.flatMap((rows) => rows[0] === undefined
+            ? Effect.succeed(Option.none())
+            : findPasswordCredentialByUserId(executor, tables, input.userId, "updatePassword"))),
     });
 };
 export const makeEffectQbSqliteSessionStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
     return SessionStore.make({
         findById: (id) => findSessionById(executor, tables, id),
-        insert: (row) => runEffectQb("session", "insert", executePlan(executor, queryInsert(tables.session.table, mutationValues(tables.session.insert(row))))).pipe(Effect.asVoid),
+        listByUser: (input) => listSessionsByUser(executor, tables, input),
+        insert: (row) => executePlan(executor, queryInsert(tables.session.table, mutationValues(tables.session.insert(row)))).pipe(Effect.mapError((cause) => storageError("session", "insert", cause)), Effect.asVoid),
         refresh: (input) => {
-            const query = queryUpdate(tables.session.table, mutationValues(tables.session.refresh(input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), queryReturning(selectSessionColumns(tables)));
-            return runEffectQb("session", "refresh", executePlan(executor, query)).pipe(Effect.map((rows) => rows[0] === undefined
+            const query = queryUpdate(tables.session.table, mutationValues(tables.session.refresh(input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), Query.returning(selectSessionColumns(tables)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => storageError("session", "refresh", cause)), Effect.map((rows) => rows[0] === undefined
                 ? Option.none()
                 : Option.some(decodeSessionRow(tables, rows[0]))));
         },
         rotate: (input) => {
-            const query = queryUpdate(tables.session.table, mutationValues(tables.session.rotate(input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), queryReturning(selectSessionColumns(tables)));
-            return runEffectQb("session", "rotate", executePlan(executor, query)).pipe(Effect.map((rows) => rows[0] === undefined
+            const query = queryUpdate(tables.session.table, mutationValues(tables.session.rotate(input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), Query.returning(selectSessionColumns(tables)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => storageError("session", "rotate", cause)), Effect.map((rows) => rows[0] === undefined
                 ? Option.none()
                 : Option.some(decodeSessionRow(tables, rows[0]))));
         },
@@ -383,49 +642,93 @@ export const makeEffectQbSqliteSessionStore = (executor, options = {}) => {
             if (Option.isNone(rowOption)) {
                 return Effect.succeed(Option.none());
             }
-            return runEffectQb("session", "updateClaims", executePlan(executor, queryUpdate(tables.session.table, mutationValues(tables.session.updateClaims(rowOption.value, input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), queryReturning(selectSessionColumns(tables))))).pipe(Effect.map((rows) => rows[0] === undefined
+            return executePlan(executor, queryUpdate(tables.session.table, mutationValues(tables.session.updateClaims(rowOption.value, input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)), Query.returning(selectSessionColumns(tables)))).pipe(Effect.mapError((cause) => storageError("session", "updateClaims", cause)), Effect.map((rows) => rows[0] === undefined
                 ? Option.none()
                 : Option.some(decodeSessionRow(tables, rows[0]))));
         })),
-        revoke: (input) => runEffectQb("session", "revoke", executePlan(executor, queryUpdate(tables.session.table, mutationValues(tables.session.revoke(input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId))))).pipe(Effect.asVoid),
-        revokeAllForUser: (input) => runEffectQb("session", "revokeAllForUser", executePlan(executor, queryUpdate(tables.session.table, mutationValues(tables.session.revoke(input))).pipe(Query.where(queryEq(tables.session.select.userId, input.userId))))).pipe(Effect.asVoid),
+        revoke: (input) => executePlan(executor, queryUpdate(tables.session.table, mutationValues(tables.session.revoke(input))).pipe(Query.where(queryEq(tables.session.select.id, input.sessionId)))).pipe(Effect.mapError((cause) => storageError("session", "revoke", cause)), Effect.asVoid),
+        revokeAllForUser: (input) => executePlan(executor, queryUpdate(tables.session.table, mutationValues(tables.session.revoke(input))).pipe(Query.where(queryEq(tables.session.select.userId, input.userId)))).pipe(Effect.mapError((cause) => storageError("session", "revokeAllForUser", cause)), Effect.asVoid),
     });
 };
 export const makeEffectQbSqliteVerificationStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
     return VerificationStore.make({
         findById: (id) => findVerificationById(executor, tables, id),
-        insert: (row) => runEffectQb("verification", "insert", executePlan(executor, queryInsert(tables.verification.table, mutationValues(tables.verification.insert(row))))).pipe(Effect.asVoid),
+        insert: (row) => executePlan(executor, queryInsert(tables.verification.table, mutationValues(tables.verification.insert(row)))).pipe(Effect.mapError((cause) => storageError("verification", "insert", cause)), Effect.asVoid),
         consume: (input) => {
             const base = queryUpdate(tables.verification.table, mutationValues(tables.verification.consume(input))).pipe(Query.where(queryEq(tables.verification.select.id, input.id)), Query.where(queryIsNull(tables.verification.select.consumedAt)), Query.where(queryGt(tables.verification.select.expiresAt, Number(input.consumedAt))));
             const plan = input.type === undefined
                 ? base
                 : base.pipe(Query.where(queryEq(tables.verification.select.type, input.type)));
-            return runEffectQb("verification", "consume", executePlan(executor, plan.pipe(queryReturning({ id: tables.verification.select.id })))).pipe(Effect.flatMap((rows) => rows[0] === undefined
+            return executePlan(executor, plan.pipe(Query.returning({ id: tables.verification.select.id }))).pipe(Effect.mapError((cause) => storageError("verification", "consume", cause)), Effect.flatMap((rows) => rows[0] === undefined
                 ? Effect.succeed(Option.none())
                 : findVerificationById(executor, tables, input.id, "consume")));
         },
         deleteExpired: (input) => {
             if (input.limit === undefined) {
-                return runEffectQb("verification", "deleteExpired", executePlan(executor, queryDelete(tables.verification.table).pipe(Query.where(queryLte(tables.verification.select.expiresAt, Number(input.now))), queryReturning({ id: tables.verification.select.id })))).pipe(Effect.map((rows) => rows.length));
+                return executePlan(executor, Query.delete(tables.verification.table).pipe(Query.where(queryLte(tables.verification.select.expiresAt, Number(input.now))), Query.returning({ id: tables.verification.select.id }))).pipe(Effect.mapError((cause) => storageError("verification", "deleteExpired", cause)), Effect.map((rows) => rows.length));
             }
-            return runEffectQb("verification", "deleteExpired", executePlan(executor, querySelect({ id: tables.verification.select.id }).pipe(queryFrom(tables.verification.table), Query.where(queryLte(tables.verification.select.expiresAt, Number(input.now))), Query.limit(input.limit)))).pipe(Effect.flatMap((rows) => {
+            return executePlan(executor, Query.select({ id: tables.verification.select.id }).pipe(Query.from(tables.verification.table), Query.where(queryLte(tables.verification.select.expiresAt, Number(input.now))), Query.limit(input.limit))).pipe(Effect.mapError((cause) => storageError("verification", "deleteExpired", cause)), Effect.flatMap((rows) => {
                 const [first, ...rest] = rows.map((row) => row.id);
                 if (first === undefined) {
                     return Effect.succeed(0);
                 }
-                return runEffectQb("verification", "deleteExpired", executePlan(executor, queryDelete(tables.verification.table).pipe(Query.where(queryIn(tables.verification.select.id, first, ...rest)), queryReturning({ id: tables.verification.select.id })))).pipe(Effect.map((deleted) => deleted.length));
+                return executePlan(executor, Query.delete(tables.verification.table).pipe(Query.where(queryIn(tables.verification.select.id, first, ...rest)), Query.returning({ id: tables.verification.select.id }))).pipe(Effect.mapError((cause) => storageError("verification", "deleteExpired", cause)), Effect.map((deleted) => deleted.length));
             }));
         },
     });
 };
+export const makeEffectQbSqliteLoginApprovalReviewStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return LoginApprovalReviewStore.make({
+        insertPending: (input) => executePlan(executor, queryInsert(tables.loginApprovalReview.table, mutationValues(tables.loginApprovalReview.insertPending(input)))).pipe(Effect.mapError((cause) => loginApprovalReviewStoreError("insert", cause)), Effect.as(input)),
+        findByApprovalChallengeId: (input) => findLoginApprovalReviewByApprovalChallengeId(executor, tables, input),
+        approve: (input) => executePlan(executor, queryUpdate(tables.loginApprovalReview.table, mutationValues(tables.loginApprovalReview.approve(input))).pipe(Query.where(queryEq(tables.loginApprovalReview.select.approvalChallengeId, input.approvalChallengeId)), Query.where(queryEq(tables.loginApprovalReview.select.status, "pending")), Query.returning(selectLoginApprovalReviewColumns(tables)))).pipe(Effect.mapError((cause) => loginApprovalReviewStoreError("approve", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeLoginApprovalReviewRow(tables, rows[0])))),
+        deny: (input) => executePlan(executor, queryUpdate(tables.loginApprovalReview.table, mutationValues(tables.loginApprovalReview.deny(input))).pipe(Query.where(queryEq(tables.loginApprovalReview.select.approvalChallengeId, input.approvalChallengeId)), Query.where(queryEq(tables.loginApprovalReview.select.status, "pending")), Query.returning(selectLoginApprovalReviewColumns(tables)))).pipe(Effect.mapError((cause) => loginApprovalReviewStoreError("deny", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeLoginApprovalReviewRow(tables, rows[0])))),
+    });
+};
+export const makeEffectQbSqliteTrustedDeviceStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return TrustedDeviceStore.make({
+        find: (input) => findTrustedDevice(executor, tables, input),
+        upsert: (input) => findTrustedDeviceIncludingExpired(executor, tables, input).pipe(Effect.flatMap((existing) => {
+            if (Option.isNone(existing)) {
+                return executePlan(executor, queryInsert(tables.trustedDevice.table, mutationValues(tables.trustedDevice.insert(input, input.now)))).pipe(Effect.mapError((cause) => trustedDeviceStoreError("trust", cause)), Effect.asVoid);
+            }
+            return executePlan(executor, queryUpdate(tables.trustedDevice.table, mutationValues(tables.trustedDevice.update(input, existing.value))).pipe(Query.where(queryEq(tables.trustedDevice.select.userId, input.userId)), Query.where(queryEq(tables.trustedDevice.select.tokenHash, input.tokenHash)))).pipe(Effect.mapError((cause) => trustedDeviceStoreError("trust", cause)), Effect.asVoid);
+        }), Effect.flatMap(() => findTrustedDeviceIncludingExpired(executor, tables, input)), Effect.flatMap((stored) => Option.isSome(stored)
+            ? Effect.succeed(stored.value)
+            : Effect.fail(trustedDeviceStoreError("trust", "missing row")))),
+    });
+};
+export const makeEffectQbSqliteJwtRevocationStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return JwtRevocationStore.make({
+        revoke: (record) => findJwtRevocation(executor, tables, record.jwtId, "revoke").pipe(Effect.flatMap((existing) => {
+            if (Option.isNone(existing)) {
+                return executePlan(executor, queryInsert(tables.jwtRevocation.table, mutationValues(tables.jwtRevocation.insert(record))));
+            }
+            return executePlan(executor, queryUpdate(tables.jwtRevocation.table, mutationValues(tables.jwtRevocation.update(record))).pipe(Query.where(queryEq(tables.jwtRevocation.select.jwtId, record.jwtId))));
+        }), Effect.mapError((cause) => cause instanceof JwtError
+            ? cause
+            : jwtRevocationStoreError("revoke", cause)), Effect.asVoid),
+        find: (jwtId) => findJwtRevocation(executor, tables, jwtId),
+    });
+};
 export const makeEffectQbSqliteStorage = (executor, options = {}) => ({
     userStore: makeEffectQbSqliteUserStore(executor, options),
     credentialStore: makeEffectQbSqliteCredentialStore(executor, options),
     sessionStore: makeEffectQbSqliteSessionStore(executor, options),
     verificationStore: makeEffectQbSqliteVerificationStore(executor, options),
+    loginApprovalReviewStore: makeEffectQbSqliteLoginApprovalReviewStore(executor, options),
+    trustedDeviceStore: makeEffectQbSqliteTrustedDeviceStore(executor, options),
+    jwtRevocationStore: makeEffectQbSqliteJwtRevocationStore(executor, options),
 });
-export const EffectQbSqliteAuthStorageLive = (executor, options = {}) => Layer.mergeAll(Layer.succeed(UserStore)(makeEffectQbSqliteUserStore(executor, options)), Layer.succeed(CredentialStore)(makeEffectQbSqliteCredentialStore(executor, options)), Layer.succeed(SessionStore)(makeEffectQbSqliteSessionStore(executor, options)), Layer.succeed(VerificationStore)(makeEffectQbSqliteVerificationStore(executor, options)));
+export const EffectQbSqliteAuthStorageLive = (executor, options = {}) => Layer.mergeAll(Layer.succeed(UserStore)(makeEffectQbSqliteUserStore(executor, options)), Layer.succeed(CredentialStore)(makeEffectQbSqliteCredentialStore(executor, options)), Layer.succeed(SessionStore)(makeEffectQbSqliteSessionStore(executor, options)), Layer.succeed(VerificationStore)(makeEffectQbSqliteVerificationStore(executor, options)), Layer.succeed(LoginApprovalReviewStore)(makeEffectQbSqliteLoginApprovalReviewStore(executor, options)), Layer.succeed(TrustedDeviceStore)(makeEffectQbSqliteTrustedDeviceStore(executor, options)), Layer.succeed(JwtRevocationStore)(makeEffectQbSqliteJwtRevocationStore(executor, options)));
 export const makeD1EffectQbSqliteExecutor = (database) => Executor.make({
     driver: Executor.driver((query) => Effect.tryPromise({
         try: () => database