@effect-auth/core 0.1.0-alpha.7 → 0.1.0-alpha.8

package/dist/KyselyStorage.js

@@ -1,1383 +0,0 @@
-import { Effect, Layer, Option, Redacted } from "effect";
-import { ApiKeyId, ApiKeyPrefix, ApiKeySecretHash, ApiKeyStore, ApiKeyStoreError, } from "./ApiKey.js";
-import { AuthFlowId, ChallengeId, CredentialId, Email, OAuthAccountId, OAuthProviderId, SessionId, UnixMillis, UserId, } from "./Identifiers.js";
-import { JwtError, JwtRevocationStore } from "./Jwt.js";
-import { LoginApprovalReviewError, LoginApprovalReviewStore, } from "./LoginApproval.js";
-import { LoginRiskContext, LoginRiskSignal } from "./LoginRisk.js";
-import { OAuthAccountStore, OAuthAccountStoreError, } from "./OAuth.js";
-import { PasskeyCredentialId, PasskeyCredentialStore, PasskeyCredentialStoreError, } from "./Passkey.js";
-import { RecoveryCodeHash, RecoveryCodeStore, RecoveryCodeStoreError, } from "./RecoveryCode.js";
-import { RefreshTokenFamilyId, RefreshTokenId, RefreshTokenSecretHash, RefreshTokenStore, RefreshTokenStoreError, } from "./RefreshToken.js";
-import { CredentialStore, SessionStore, StorageError, UserStore, VerificationStore, } from "./Storage.js";
-import { TotpFactorStore, TotpFactorStoreError, TotpSecret, } from "./Totp.js";
-import { TrustedDeviceError, TrustedDeviceStore } from "./TrustedDevice.js";
-const jsonEncode = (value) => value === undefined ? null : JSON.stringify(value);
-const jsonDecode = (value) => value === null ? undefined : JSON.parse(value);
-const optionalUnixMillis = (value) => value === null ? undefined : UnixMillis(Number(value));
-const decodeAmr = (value) => JSON.parse(value);
-const omitUndefined = (record) => Object.fromEntries(Object.entries(record).filter(([, value]) => value !== undefined));
-const sessionMetadataEnvelopeKey = "__effectAuthSession";
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const isLoginRiskLevel = (value) => value === "unknown" ||
-    value === "low" ||
-    value === "medium" ||
-    value === "high" ||
-    value === "critical";
-const decodeLoginRiskSignal = (value) => {
-    const record = isRecord(value) ? value : {};
-    const level = isLoginRiskLevel(record.level) ? record.level : undefined;
-    return LoginRiskSignal.make({
-        type: typeof record.type === "string" ? record.type : "unknown",
-        ...(level === undefined ? {} : { level }),
-        ...(isRecord(record.metadata) ? { metadata: record.metadata } : {}),
-    });
-};
-const decodeLoginRiskContext = (value) => {
-    const decoded = jsonDecode(value);
-    if (!isRecord(decoded)) {
-        return undefined;
-    }
-    return LoginRiskContext.make({
-        level: isLoginRiskLevel(decoded.level) ? decoded.level : "unknown",
-        signals: Array.isArray(decoded.signals)
-            ? decoded.signals.map(decodeLoginRiskSignal)
-            : [],
-        ...(isRecord(decoded.metadata) ? { metadata: decoded.metadata } : {}),
-    });
-};
-const encodeLoginRiskSignal = (signal) => omitUndefined({
-    type: signal.type,
-    level: signal.level,
-    metadata: signal.metadata,
-});
-const encodeLoginRiskContext = (risk) => risk === undefined
-    ? null
-    : jsonEncode(omitUndefined({
-        level: risk.level,
-        signals: risk.signals.map(encodeLoginRiskSignal),
-        metadata: risk.metadata,
-    }));
-const decodeSessionMetadata = (value) => {
-    const decoded = jsonDecode(value);
-    const envelope = isRecord(decoded)
-        ? decoded[sessionMetadataEnvelopeKey]
-        : undefined;
-    if (!isRecord(envelope) || envelope.version !== 1) {
-        return omitUndefined({
-            metadata: decoded,
-        });
-    }
-    return omitUndefined({
-        metadata: envelope.metadata,
-        claims: envelope.claims,
-    });
-};
-const encodeSessionMetadata = (row) => {
-    if (row.claims === undefined) {
-        return jsonEncode(row.metadata);
-    }
-    return jsonEncode({
-        [sessionMetadataEnvelopeKey]: omitUndefined({
-            version: 1,
-            metadata: row.metadata,
-            claims: row.claims,
-        }),
-    });
-};
-const decodeUserRow = (row) => omitUndefined({
-    id: UserId(row.id),
-    email: Email(row.email),
-    emailVerified: row.email_verified === 1,
-    createdAt: UnixMillis(Number(row.created_at)),
-    updatedAt: UnixMillis(Number(row.updated_at)),
-    disabledAt: optionalUnixMillis(row.disabled_at),
-    metadata: jsonDecode(row.metadata),
-});
-const decodePasswordCredentialRow = (row) => omitUndefined({
-    id: CredentialId(row.id),
-    userId: UserId(row.user_id),
-    passwordHash: row.password_hash ?? "",
-    createdAt: UnixMillis(Number(row.created_at)),
-    updatedAt: UnixMillis(Number(row.updated_at)),
-    revokedAt: optionalUnixMillis(row.revoked_at),
-    metadata: jsonDecode(row.metadata),
-});
-const decodeSessionRow = (row) => {
-    const sessionMetadata = decodeSessionMetadata(row.metadata);
-    return omitUndefined({
-        id: SessionId(row.id),
-        userId: UserId(row.user_id),
-        secretHash: row.secret_hash,
-        createdAt: UnixMillis(Number(row.created_at)),
-        expiresAt: UnixMillis(Number(row.expires_at)),
-        authTime: UnixMillis(Number(row.auth_time)),
-        aal: row.aal,
-        amr: decodeAmr(row.amr),
-        mfaVerifiedAt: optionalUnixMillis(row.mfa_verified_at),
-        metadata: sessionMetadata.metadata,
-        claims: sessionMetadata.claims,
-        revokedAt: optionalUnixMillis(row.revoked_at),
-        lastSeenAt: optionalUnixMillis(row.last_seen_at),
-        rotatedAt: optionalUnixMillis(row.rotated_at),
-    });
-};
-const decodeVerificationRow = (row) => omitUndefined({
-    id: ChallengeId(row.id),
-    type: row.type,
-    subject: row.subject,
-    secretHash: row.secret_hash === null ? undefined : row.secret_hash,
-    createdAt: UnixMillis(Number(row.created_at)),
-    expiresAt: UnixMillis(Number(row.expires_at)),
-    metadata: jsonDecode(row.metadata),
-    consumedAt: optionalUnixMillis(row.consumed_at),
-});
-const decodeLoginApprovalReviewRow = (row) => omitUndefined({
-    approvalChallengeId: ChallengeId(row.approval_challenge_id),
-    flowId: AuthFlowId(row.flow_id),
-    userId: UserId(row.user_id),
-    channel: row.channel,
-    reason: row.reason,
-    sessionBinding: row.session_binding,
-    sameDeviceRequired: row.same_device_required === 1,
-    status: row.status,
-    createdAt: UnixMillis(Number(row.created_at)),
-    expiresAt: UnixMillis(Number(row.expires_at)),
-    reviewedAt: optionalUnixMillis(row.reviewed_at),
-    reviewedBy: row.reviewed_by === null
-        ? undefined
-        : row.reviewed_by,
-    deniedReason: row.denied_reason === null ? undefined : row.denied_reason,
-    risk: decodeLoginRiskContext(row.risk),
-    metadata: jsonDecode(row.metadata),
-    reviewMetadata: jsonDecode(row.review_metadata),
-});
-const decodeTrustedDeviceRow = (row) => omitUndefined({
-    userId: UserId(row.user_id),
-    tokenHash: row.token_hash,
-    createdAt: UnixMillis(Number(row.created_at)),
-    lastSeenAt: UnixMillis(Number(row.last_seen_at)),
-    expiresAt: UnixMillis(Number(row.expires_at)),
-    metadata: jsonDecode(row.metadata),
-});
-const decodePasskeyTransports = (value) => value === null ? undefined : JSON.parse(value);
-const decodePasskeyCredentialRow = (row) => omitUndefined({
-    id: CredentialId(row.id),
-    userId: UserId(row.user_id),
-    credentialId: PasskeyCredentialId(row.credential_id),
-    publicKey: row.public_key,
-    signCount: Number(row.sign_count),
-    transports: decodePasskeyTransports(row.transports),
-    backedUp: row.backed_up === null ? undefined : row.backed_up === 1,
-    createdAt: UnixMillis(Number(row.created_at)),
-    lastUsedAt: optionalUnixMillis(row.last_used_at),
-    revokedAt: optionalUnixMillis(row.revoked_at),
-    metadata: jsonDecode(row.metadata),
-});
-const decodeTotpFactorRow = (row) => omitUndefined({
-    id: CredentialId(row.id),
-    userId: UserId(row.user_id),
-    secret: Redacted.make(TotpSecret(row.secret)),
-    algorithm: row.algorithm,
-    digits: Number(row.digits),
-    period: Number(row.period),
-    createdAt: UnixMillis(Number(row.created_at)),
-    confirmedAt: optionalUnixMillis(row.confirmed_at),
-    lastUsedAt: optionalUnixMillis(row.last_used_at),
-    revokedAt: optionalUnixMillis(row.revoked_at),
-    metadata: jsonDecode(row.metadata),
-});
-const decodeRecoveryCodeRow = (row) => omitUndefined({
-    id: CredentialId(row.id),
-    userId: UserId(row.user_id),
-    codeHash: RecoveryCodeHash(row.code_hash),
-    createdAt: UnixMillis(Number(row.created_at)),
-    usedAt: optionalUnixMillis(row.used_at),
-    revokedAt: optionalUnixMillis(row.revoked_at),
-    metadata: jsonDecode(row.metadata),
-});
-const decodeApiKeyScopes = (value) => JSON.parse(value);
-const decodeApiKeyRow = (row) => omitUndefined({
-    id: ApiKeyId(row.id),
-    userId: UserId(row.user_id),
-    prefix: ApiKeyPrefix(row.prefix),
-    secretHash: ApiKeySecretHash(row.secret_hash),
-    scopes: decodeApiKeyScopes(row.scopes),
-    createdAt: UnixMillis(Number(row.created_at)),
-    expiresAt: optionalUnixMillis(row.expires_at),
-    lastUsedAt: optionalUnixMillis(row.last_used_at),
-    revokedAt: optionalUnixMillis(row.revoked_at),
-    metadata: jsonDecode(row.metadata),
-});
-const decodeRefreshTokenRow = (row) => omitUndefined({
-    id: RefreshTokenId(row.id),
-    familyId: RefreshTokenFamilyId(row.family_id),
-    userId: UserId(row.user_id),
-    secretHash: RefreshTokenSecretHash(row.secret_hash),
-    createdAt: UnixMillis(Number(row.created_at)),
-    expiresAt: UnixMillis(Number(row.expires_at)),
-    lastUsedAt: optionalUnixMillis(row.last_used_at),
-    rotatedAt: optionalUnixMillis(row.rotated_at),
-    replacedById: row.replaced_by_id === null ? undefined : RefreshTokenId(row.replaced_by_id),
-    revokedAt: optionalUnixMillis(row.revoked_at),
-    reuseDetectedAt: optionalUnixMillis(row.reuse_detected_at),
-    metadata: jsonDecode(row.metadata),
-});
-const decodeJwtRevocationRow = (row) => omitUndefined({
-    jwtId: row.jwt_id,
-    revokedAt: UnixMillis(Number(row.revoked_at)),
-    expiresAt: optionalUnixMillis(row.expires_at),
-    reason: row.reason ?? undefined,
-});
-const decodeOAuthAccountRow = (row) => omitUndefined({
-    id: OAuthAccountId(row.id),
-    providerId: OAuthProviderId(row.provider_id),
-    providerAccountId: row.provider_account_id,
-    userId: UserId(row.user_id),
-    email: row.email === null ? undefined : Email(row.email),
-    emailVerified: row.email_verified === null ? undefined : row.email_verified === 1,
-    createdAt: UnixMillis(Number(row.created_at)),
-    updatedAt: UnixMillis(Number(row.updated_at)),
-    unlinkedAt: optionalUnixMillis(row.unlinked_at),
-    metadata: jsonDecode(row.metadata),
-});
-const sessionInsert = (row) => ({
-    id: row.id,
-    user_id: row.userId,
-    secret_hash: row.secretHash,
-    created_at: Number(row.createdAt),
-    expires_at: Number(row.expiresAt),
-    auth_time: Number(row.authTime),
-    aal: row.aal,
-    amr: JSON.stringify(row.amr),
-    mfa_verified_at: row.mfaVerifiedAt === undefined ? null : Number(row.mfaVerifiedAt),
-    metadata: encodeSessionMetadata(row),
-    revoked_at: null,
-    last_seen_at: null,
-    rotated_at: null,
-});
-const userInsert = (row) => ({
-    id: row.id,
-    email: row.email,
-    email_verified: row.emailVerified ? 1 : 0,
-    created_at: Number(row.createdAt),
-    updated_at: Number(row.updatedAt),
-    disabled_at: row.disabledAt === undefined ? null : Number(row.disabledAt),
-    metadata: jsonEncode(row.metadata),
-});
-const passwordCredentialInsert = (row) => ({
-    id: row.id,
-    user_id: row.userId,
-    type: "password",
-    password_hash: row.passwordHash,
-    created_at: Number(row.createdAt),
-    updated_at: Number(row.updatedAt),
-    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
-    metadata: jsonEncode(row.metadata),
-});
-const verificationInsert = (row) => ({
-    id: row.id,
-    type: row.type,
-    subject: row.subject,
-    secret_hash: row.secretHash ?? null,
-    created_at: Number(row.createdAt),
-    expires_at: Number(row.expiresAt),
-    metadata: jsonEncode(row.metadata),
-    consumed_at: null,
-});
-const loginApprovalReviewInsert = (row) => ({
-    approval_challenge_id: row.approvalChallengeId,
-    flow_id: row.flowId,
-    user_id: row.userId,
-    channel: row.channel,
-    reason: row.reason,
-    session_binding: row.sessionBinding,
-    same_device_required: row.sameDeviceRequired ? 1 : 0,
-    status: row.status,
-    created_at: Number(row.createdAt),
-    expires_at: Number(row.expiresAt),
-    reviewed_at: row.reviewedAt === undefined ? null : Number(row.reviewedAt),
-    reviewed_by: row.reviewedBy ?? null,
-    denied_reason: row.deniedReason ?? null,
-    risk: encodeLoginRiskContext(row.risk),
-    metadata: jsonEncode(row.metadata),
-    review_metadata: jsonEncode(row.reviewMetadata),
-});
-const trustedDeviceInsert = (input, createdAt) => ({
-    user_id: input.userId,
-    token_hash: input.tokenHash,
-    created_at: Number(createdAt),
-    last_seen_at: Number(input.now),
-    expires_at: Number(input.expiresAt),
-    metadata: jsonEncode(input.metadata),
-});
-const passkeyCredentialInsert = (row) => ({
-    id: row.id,
-    user_id: row.userId,
-    credential_id: row.credentialId,
-    public_key: row.publicKey,
-    sign_count: row.signCount,
-    transports: jsonEncode(row.transports),
-    backed_up: row.backedUp === undefined ? null : row.backedUp ? 1 : 0,
-    created_at: Number(row.createdAt),
-    last_used_at: row.lastUsedAt === undefined ? null : Number(row.lastUsedAt),
-    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
-    metadata: jsonEncode(row.metadata),
-});
-const totpFactorInsert = (row) => ({
-    id: row.id,
-    user_id: row.userId,
-    secret: Redacted.value(row.secret),
-    algorithm: row.algorithm,
-    digits: row.digits,
-    period: row.period,
-    created_at: Number(row.createdAt),
-    confirmed_at: row.confirmedAt === undefined ? null : Number(row.confirmedAt),
-    last_used_at: row.lastUsedAt === undefined ? null : Number(row.lastUsedAt),
-    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
-    metadata: jsonEncode(row.metadata),
-});
-const recoveryCodeInsert = (row) => ({
-    id: row.id,
-    user_id: row.userId,
-    code_hash: row.codeHash,
-    created_at: Number(row.createdAt),
-    used_at: row.usedAt === undefined ? null : Number(row.usedAt),
-    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
-    metadata: jsonEncode(row.metadata),
-});
-const apiKeyInsert = (row) => ({
-    id: row.id,
-    user_id: row.userId,
-    prefix: row.prefix,
-    secret_hash: row.secretHash,
-    scopes: JSON.stringify(row.scopes),
-    created_at: Number(row.createdAt),
-    expires_at: row.expiresAt === undefined ? null : Number(row.expiresAt),
-    last_used_at: row.lastUsedAt === undefined ? null : Number(row.lastUsedAt),
-    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
-    metadata: jsonEncode(row.metadata),
-});
-const refreshTokenInsert = (row) => ({
-    id: row.id,
-    family_id: row.familyId,
-    user_id: row.userId,
-    secret_hash: row.secretHash,
-    created_at: Number(row.createdAt),
-    expires_at: Number(row.expiresAt),
-    last_used_at: row.lastUsedAt === undefined ? null : Number(row.lastUsedAt),
-    rotated_at: row.rotatedAt === undefined ? null : Number(row.rotatedAt),
-    replaced_by_id: row.replacedById ?? null,
-    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
-    reuse_detected_at: row.reuseDetectedAt === undefined ? null : Number(row.reuseDetectedAt),
-    metadata: jsonEncode(row.metadata),
-});
-const jwtRevocationInsert = (row) => ({
-    jwt_id: row.jwtId,
-    revoked_at: Number(row.revokedAt),
-    expires_at: row.expiresAt === undefined ? null : Number(row.expiresAt),
-    reason: row.reason ?? null,
-});
-const oauthAccountInsert = (row) => ({
-    id: row.id,
-    provider_id: row.providerId,
-    provider_account_id: row.providerAccountId,
-    user_id: row.userId,
-    email: row.email ?? null,
-    email_verified: row.emailVerified === undefined ? null : row.emailVerified ? 1 : 0,
-    created_at: Number(row.createdAt),
-    updated_at: Number(row.updatedAt),
-    unlinked_at: row.unlinkedAt === undefined ? null : Number(row.unlinkedAt),
-    metadata: jsonEncode(row.metadata),
-});
-const kyselyError = (entity, operation, cause) => StorageError.fromUnknown(entity, operation, cause);
-const runKysely = (entity, operation, evaluate) => Effect.tryPromise({
-    try: evaluate,
-    catch: (cause) => kyselyError(entity, operation, cause),
-});
-const loginApprovalReviewStoreError = (operation, cause) => new LoginApprovalReviewError({
-    message: `Login approval review ${operation} failed`,
-    cause,
-});
-const runLoginApprovalReviewKysely = (operation, evaluate) => Effect.tryPromise({
-    try: evaluate,
-    catch: (cause) => loginApprovalReviewStoreError(operation, cause),
-});
-const trustedDeviceStoreError = (operation, cause) => new TrustedDeviceError({
-    operation,
-    message: `Trusted device ${operation} failed`,
-    cause,
-});
-const runTrustedDeviceKysely = (operation, evaluate) => Effect.tryPromise({
-    try: evaluate,
-    catch: (cause) => trustedDeviceStoreError(operation, cause),
-});
-const passkeyCredentialStoreError = (operation, cause) => new PasskeyCredentialStoreError({
-    operation,
-    message: `Passkey credential ${operation} failed`,
-    cause,
-});
-const runPasskeyCredentialKysely = (operation, evaluate) => Effect.tryPromise({
-    try: evaluate,
-    catch: (cause) => passkeyCredentialStoreError(operation, cause),
-});
-const totpFactorStoreError = (operation, cause) => new TotpFactorStoreError({
-    operation,
-    message: `TOTP factor ${operation} failed`,
-    cause,
-});
-const runTotpFactorKysely = (operation, evaluate) => Effect.tryPromise({
-    try: evaluate,
-    catch: (cause) => totpFactorStoreError(operation, cause),
-});
-const recoveryCodeStoreError = (operation, cause) => new RecoveryCodeStoreError({
-    operation,
-    message: `Recovery code ${operation} failed`,
-    cause,
-});
-const runRecoveryCodeKysely = (operation, evaluate) => Effect.tryPromise({
-    try: evaluate,
-    catch: (cause) => recoveryCodeStoreError(operation, cause),
-});
-const apiKeyStoreError = (operation, cause) => new ApiKeyStoreError({
-    operation,
-    message: `API key ${operation} failed`,
-    cause,
-});
-const runApiKeyKysely = (operation, evaluate) => Effect.tryPromise({
-    try: evaluate,
-    catch: (cause) => apiKeyStoreError(operation, cause),
-});
-const refreshTokenStoreError = (operation, cause) => new RefreshTokenStoreError({
-    operation,
-    message: `Refresh token ${operation} failed`,
-    cause,
-});
-const runRefreshTokenKysely = (operation, evaluate) => Effect.tryPromise({
-    try: evaluate,
-    catch: (cause) => refreshTokenStoreError(operation, cause),
-});
-const jwtRevocationStoreError = (operation, cause) => new JwtError({
-    operation: "revocation",
-    message: `JWT revocation ${operation} failed`,
-    cause,
-});
-const runJwtRevocationKysely = (operation, evaluate) => Effect.tryPromise({
-    try: evaluate,
-    catch: (cause) => jwtRevocationStoreError(operation, cause),
-});
-const oauthAccountStoreError = (operation, cause) => new OAuthAccountStoreError({
-    operation,
-    message: `OAuth account ${operation} failed`,
-    cause,
-});
-const runOAuthAccountKysely = (operation, evaluate) => Effect.tryPromise({
-    try: evaluate,
-    catch: (cause) => oauthAccountStoreError(operation, cause),
-});
-const asAuthDb = (db) => db;
-const findUserById = (db, id, operation = "find") => {
-    const authDb = asAuthDb(db);
-    return runKysely("user", operation, async () => {
-        const row = await authDb
-            .selectFrom("auth_user")
-            .selectAll()
-            .where("id", "=", id)
-            .executeTakeFirst();
-        return row === undefined
-            ? Option.none()
-            : Option.some(decodeUserRow(row));
-    });
-};
-const findUserByEmail = (db, email, operation = "find") => {
-    const authDb = asAuthDb(db);
-    return runKysely("user", operation, async () => {
-        const row = await authDb
-            .selectFrom("auth_user")
-            .selectAll()
-            .where("email", "=", email)
-            .executeTakeFirst();
-        return row === undefined
-            ? Option.none()
-            : Option.some(decodeUserRow(row));
-    });
-};
-const findPasswordCredentialByUserId = (db, userId, operation = "find") => {
-    const authDb = asAuthDb(db);
-    return runKysely("credential", operation, async () => {
-        const row = await authDb
-            .selectFrom("auth_credential")
-            .selectAll()
-            .where("user_id", "=", userId)
-            .where("type", "=", "password")
-            .executeTakeFirst();
-        return row === undefined
-            ? Option.none()
-            : Option.some(decodePasswordCredentialRow(row));
-    });
-};
-const findSessionById = (db, id, operation = "find") => {
-    const authDb = asAuthDb(db);
-    return runKysely("session", operation, async () => {
-        const row = await authDb
-            .selectFrom("auth_session")
-            .selectAll()
-            .where("id", "=", id)
-            .executeTakeFirst();
-        return row === undefined
-            ? Option.none()
-            : Option.some(decodeSessionRow(row));
-    });
-};
-const listSessionsByUser = (db, input, operation = "listByUser") => {
-    const authDb = asAuthDb(db);
-    return runKysely("session", operation, async () => {
-        const rows = await authDb
-            .selectFrom("auth_session")
-            .selectAll()
-            .where("user_id", "=", input.userId)
-            .execute();
-        return rows.map(decodeSessionRow);
-    });
-};
-const findVerificationById = (db, id, operation = "find") => {
-    const authDb = asAuthDb(db);
-    return runKysely("verification", operation, async () => {
-        const row = await authDb
-            .selectFrom("auth_verification")
-            .selectAll()
-            .where("id", "=", id)
-            .executeTakeFirst();
-        return row === undefined
-            ? Option.none()
-            : Option.some(decodeVerificationRow(row));
-    });
-};
-const findLoginApprovalReviewByApprovalChallengeId = (db, input, operation = "find") => {
-    const authDb = asAuthDb(db);
-    return runLoginApprovalReviewKysely(operation, async () => {
-        const row = await authDb
-            .selectFrom("auth_login_approval_review")
-            .selectAll()
-            .where("approval_challenge_id", "=", input.approvalChallengeId)
-            .executeTakeFirst();
-        return row === undefined
-            ? Option.none()
-            : Option.some(decodeLoginApprovalReviewRow(row));
-    });
-};
-const findTrustedDevice = (db, input, operation = "status") => {
-    const authDb = asAuthDb(db);
-    return runTrustedDeviceKysely(operation, async () => {
-        const row = await authDb
-            .selectFrom("auth_trusted_device")
-            .selectAll()
-            .where("user_id", "=", input.userId)
-            .where("token_hash", "=", input.tokenHash)
-            .where("expires_at", ">", Number(input.now))
-            .executeTakeFirst();
-        return row === undefined
-            ? Option.none()
-            : Option.some(decodeTrustedDeviceRow(row));
-    });
-};
-export const makeKyselyUserStore = (db) => {
-    const authDb = asAuthDb(db);
-    return UserStore.make({
-        findById: (id) => findUserById(db, id),
-        findByEmail: (email) => findUserByEmail(db, email),
-        insert: (row) => runKysely("user", "insert", async () => {
-            await authDb
-                .insertInto("auth_user")
-                .values(userInsert(row))
-                .executeTakeFirst();
-        }),
-        markEmailVerified: (input) => runKysely("user", "markEmailVerified", () => authDb
-            .updateTable("auth_user")
-            .set({
-            email_verified: 1,
-            updated_at: Number(input.updatedAt),
-        })
-            .where("id", "=", input.userId)
-            .executeTakeFirst()).pipe(Effect.flatMap((result) => Number(result.numUpdatedRows) > 0
-            ? findUserById(db, input.userId, "markEmailVerified")
-            : Effect.succeed(Option.none()))),
-    });
-};
-export const makeKyselyCredentialStore = (db) => {
-    const authDb = asAuthDb(db);
-    return CredentialStore.make({
-        findPasswordByUserId: (userId) => findPasswordCredentialByUserId(db, userId),
-        insertPassword: (row) => runKysely("credential", "insert", async () => {
-            await authDb
-                .insertInto("auth_credential")
-                .values(passwordCredentialInsert(row))
-                .executeTakeFirst();
-        }),
-        updatePassword: (input) => runKysely("credential", "updatePassword", () => authDb
-            .updateTable("auth_credential")
-            .set({
-            password_hash: input.passwordHash,
-            updated_at: Number(input.updatedAt),
-        })
-            .where("user_id", "=", input.userId)
-            .where("type", "=", "password")
-            .where("revoked_at", "is", null)
-            .executeTakeFirst()).pipe(Effect.flatMap((result) => Number(result.numUpdatedRows) > 0
-            ? findPasswordCredentialByUserId(db, input.userId, "updatePassword")
-            : Effect.succeed(Option.none()))),
-    });
-};
-export const makeKyselySessionStore = (db) => {
-    const authDb = asAuthDb(db);
-    return SessionStore.make({
-        findById: (id) => findSessionById(db, id),
-        listByUser: (input) => listSessionsByUser(db, input),
-        insert: (row) => runKysely("session", "insert", async () => {
-            await authDb
-                .insertInto("auth_session")
-                .values(sessionInsert(row))
-                .executeTakeFirst();
-        }),
-        refresh: (input) => {
-            const update = {
-                expires_at: Number(input.expiresAt),
-            };
-            if (input.lastSeenAt !== undefined) {
-                update.last_seen_at = Number(input.lastSeenAt);
-            }
-            return runKysely("session", "refresh", () => authDb
-                .updateTable("auth_session")
-                .set(update)
-                .where("id", "=", input.sessionId)
-                .executeTakeFirst()).pipe(Effect.flatMap((result) => Number(result.numUpdatedRows) > 0
-                ? findSessionById(db, input.sessionId, "refresh")
-                : Effect.succeed(Option.none())));
-        },
-        rotate: (input) => {
-            const update = {
-                secret_hash: input.secretHash,
-                rotated_at: Number(input.rotatedAt),
-            };
-            if (input.expiresAt !== undefined) {
-                update.expires_at = Number(input.expiresAt);
-            }
-            return runKysely("session", "rotate", () => authDb
-                .updateTable("auth_session")
-                .set(update)
-                .where("id", "=", input.sessionId)
-                .executeTakeFirst()).pipe(Effect.flatMap((result) => Number(result.numUpdatedRows) > 0
-                ? findSessionById(db, input.sessionId, "rotate")
-                : Effect.succeed(Option.none())));
-        },
-        updateClaims: (input) => findSessionById(db, input.sessionId, "updateClaims").pipe(Effect.flatMap((rowOption) => {
-            if (Option.isNone(rowOption)) {
-                return Effect.succeed(Option.none());
-            }
-            return runKysely("session", "updateClaims", () => authDb
-                .updateTable("auth_session")
-                .set({
-                ...(input.aal === undefined ? {} : { aal: input.aal }),
-                ...(input.amr === undefined
-                    ? {}
-                    : { amr: JSON.stringify(input.amr) }),
-                ...(input.mfaVerifiedAt === undefined
-                    ? {}
-                    : { mfa_verified_at: Number(input.mfaVerifiedAt) }),
-                metadata: encodeSessionMetadata({
-                    ...rowOption.value,
-                    claims: input.claims ?? rowOption.value.claims,
-                }),
-            })
-                .where("id", "=", input.sessionId)
-                .executeTakeFirst()).pipe(Effect.flatMap((result) => Number(result.numUpdatedRows) > 0
-                ? findSessionById(db, input.sessionId, "updateClaims")
-                : Effect.succeed(Option.none())));
-        })),
-        revoke: (input) => runKysely("session", "revoke", async () => {
-            await authDb
-                .updateTable("auth_session")
-                .set({ revoked_at: Number(input.revokedAt) })
-                .where("id", "=", input.sessionId)
-                .executeTakeFirst();
-        }),
-        revokeAllForUser: (input) => runKysely("session", "revokeAllForUser", async () => {
-            await authDb
-                .updateTable("auth_session")
-                .set({ revoked_at: Number(input.revokedAt) })
-                .where("user_id", "=", input.userId)
-                .executeTakeFirst();
-        }),
-    });
-};
-export const makeKyselyVerificationStore = (db) => {
-    const authDb = asAuthDb(db);
-    return VerificationStore.make({
-        findById: (id) => findVerificationById(db, id),
-        insert: (row) => runKysely("verification", "insert", async () => {
-            await authDb
-                .insertInto("auth_verification")
-                .values(verificationInsert(row))
-                .executeTakeFirst();
-        }),
-        consume: (input) => {
-            let query = authDb
-                .updateTable("auth_verification")
-                .set({ consumed_at: Number(input.consumedAt) })
-                .where("id", "=", input.id)
-                .where("consumed_at", "is", null)
-                .where("expires_at", ">", Number(input.consumedAt));
-            if (input.type !== undefined) {
-                query = query.where("type", "=", input.type);
-            }
-            return runKysely("verification", "consume", () => query.executeTakeFirst()).pipe(Effect.flatMap((result) => Number(result.numUpdatedRows) > 0
-                ? findVerificationById(db, input.id, "consume")
-                : Effect.succeed(Option.none())));
-        },
-        deleteExpired: (input) => runKysely("verification", "deleteExpired", async () => {
-            if (input.limit === undefined) {
-                const result = await authDb
-                    .deleteFrom("auth_verification")
-                    .where("expires_at", "<=", Number(input.now))
-                    .executeTakeFirst();
-                return Number(result.numDeletedRows);
-            }
-            const rows = await authDb
-                .selectFrom("auth_verification")
-                .select("id")
-                .where("expires_at", "<=", Number(input.now))
-                .limit(input.limit)
-                .execute();
-            if (rows.length === 0) {
-                return 0;
-            }
-            const result = await authDb
-                .deleteFrom("auth_verification")
-                .where("id", "in", rows.map((row) => row.id))
-                .executeTakeFirst();
-            return Number(result.numDeletedRows);
-        }),
-    });
-};
-export const makeKyselyLoginApprovalReviewStore = (db) => {
-    const authDb = asAuthDb(db);
-    return LoginApprovalReviewStore.make({
-        insertPending: (input) => runLoginApprovalReviewKysely("insert", async () => {
-            await authDb
-                .insertInto("auth_login_approval_review")
-                .values(loginApprovalReviewInsert(input))
-                .executeTakeFirst();
-            return input;
-        }),
-        findByApprovalChallengeId: (input) => findLoginApprovalReviewByApprovalChallengeId(db, input),
-        approve: (input) => runLoginApprovalReviewKysely("approve", () => authDb
-            .updateTable("auth_login_approval_review")
-            .set({
-            status: "approved",
-            reviewed_at: Number(input.reviewedAt),
-            reviewed_by: input.reviewedBy ?? null,
-            review_metadata: jsonEncode(input.metadata),
-        })
-            .where("approval_challenge_id", "=", input.approvalChallengeId)
-            .where("status", "=", "pending")
-            .executeTakeFirst()).pipe(Effect.flatMap((result) => Number(result.numUpdatedRows) > 0
-            ? findLoginApprovalReviewByApprovalChallengeId(db, input, "approve")
-            : Effect.succeed(Option.none()))),
-        deny: (input) => runLoginApprovalReviewKysely("deny", () => authDb
-            .updateTable("auth_login_approval_review")
-            .set({
-            status: "denied",
-            reviewed_at: Number(input.reviewedAt),
-            reviewed_by: input.reviewedBy ?? null,
-            denied_reason: input.reason ?? null,
-            review_metadata: jsonEncode(input.metadata),
-        })
-            .where("approval_challenge_id", "=", input.approvalChallengeId)
-            .where("status", "=", "pending")
-            .executeTakeFirst()).pipe(Effect.flatMap((result) => Number(result.numUpdatedRows) > 0
-            ? findLoginApprovalReviewByApprovalChallengeId(db, input, "deny")
-            : Effect.succeed(Option.none()))),
-    });
-};
-export const makeKyselyTrustedDeviceStore = (db) => {
-    const authDb = asAuthDb(db);
-    return TrustedDeviceStore.make({
-        find: (input) => findTrustedDevice(db, input),
-        upsert: (input) => runTrustedDeviceKysely("trust", async () => {
-            const existing = await authDb
-                .selectFrom("auth_trusted_device")
-                .selectAll()
-                .where("user_id", "=", input.userId)
-                .where("token_hash", "=", input.tokenHash)
-                .executeTakeFirst();
-            const existingRow = existing === undefined ? undefined : decodeTrustedDeviceRow(existing);
-            await (existingRow === undefined
-                ? authDb
-                    .insertInto("auth_trusted_device")
-                    .values(trustedDeviceInsert(input, input.now))
-                : authDb
-                    .updateTable("auth_trusted_device")
-                    .set({
-                    last_seen_at: Number(input.now),
-                    expires_at: Number(input.expiresAt),
-                    metadata: jsonEncode(input.metadata ?? existingRow.metadata),
-                })
-                    .where("user_id", "=", input.userId)
-                    .where("token_hash", "=", input.tokenHash)).executeTakeFirst();
-            const row = await authDb
-                .selectFrom("auth_trusted_device")
-                .selectAll()
-                .where("user_id", "=", input.userId)
-                .where("token_hash", "=", input.tokenHash)
-                .executeTakeFirstOrThrow();
-            return decodeTrustedDeviceRow(row);
-        }),
-    });
-};
-export const makeKyselyPasskeyCredentialStore = (db) => {
-    const authDb = asAuthDb(db);
-    return PasskeyCredentialStore.make({
-        insert: (row) => runPasskeyCredentialKysely("insert", () => authDb
-            .insertInto("auth_passkey_credential")
-            .values(passkeyCredentialInsert(row))
-            .executeTakeFirst()).pipe(Effect.asVoid),
-        findByCredentialId: (credentialId) => runPasskeyCredentialKysely("find", () => authDb
-            .selectFrom("auth_passkey_credential")
-            .selectAll()
-            .where("credential_id", "=", credentialId)
-            .executeTakeFirst()).pipe(Effect.map((row) => row === undefined
-            ? Option.none()
-            : Option.some(decodePasskeyCredentialRow(row)))),
-        listByUser: (input) => runPasskeyCredentialKysely("list", () => {
-            let query = authDb
-                .selectFrom("auth_passkey_credential")
-                .selectAll()
-                .where("user_id", "=", input.userId);
-            if (input.includeRevoked !== true) {
-                query = query.where("revoked_at", "is", null);
-            }
-            return query.execute();
-        }).pipe(Effect.map((rows) => rows.map(decodePasskeyCredentialRow))),
-        updateSignCount: (input) => runPasskeyCredentialKysely("update-sign-count", () => authDb
-            .updateTable("auth_passkey_credential")
-            .set({
-            sign_count: input.signCount,
-            last_used_at: Number(input.lastUsedAt),
-            ...(input.metadata === undefined
-                ? {}
-                : { metadata: jsonEncode(input.metadata) }),
-        })
-            .where("credential_id", "=", input.credentialId)
-            .where("revoked_at", "is", null)
-            .executeTakeFirst()).pipe(Effect.flatMap(() => runPasskeyCredentialKysely("find", () => authDb
-            .selectFrom("auth_passkey_credential")
-            .selectAll()
-            .where("credential_id", "=", input.credentialId)
-            .where("revoked_at", "is", null)
-            .executeTakeFirst())), Effect.map((row) => row === undefined
-            ? Option.none()
-            : Option.some(decodePasskeyCredentialRow(row)))),
-        revoke: (input) => runPasskeyCredentialKysely("revoke", async () => {
-            const metadata = input.reason === undefined
-                ? undefined
-                : await authDb
-                    .selectFrom("auth_passkey_credential")
-                    .select("metadata")
-                    .where("credential_id", "=", input.credentialId)
-                    .executeTakeFirst()
-                    .then((row) => {
-                    const existingMetadata = jsonDecode(row?.metadata ?? null);
-                    return jsonEncode({
-                        ...(isRecord(existingMetadata) ? existingMetadata : {}),
-                        revokeReason: input.reason,
-                    });
-                });
-            return authDb
-                .updateTable("auth_passkey_credential")
-                .set({
-                revoked_at: Number(input.revokedAt),
-                ...(metadata === undefined ? {} : { metadata }),
-            })
-                .where("credential_id", "=", input.credentialId)
-                .executeTakeFirst();
-        }).pipe(Effect.asVoid),
-    });
-};
-export const makeKyselyTotpFactorStore = (db) => {
-    const authDb = asAuthDb(db);
-    return TotpFactorStore.make({
-        insert: (row) => runTotpFactorKysely("insert", () => authDb
-            .insertInto("auth_totp_factor")
-            .values(totpFactorInsert(row))
-            .executeTakeFirst()).pipe(Effect.asVoid),
-        findById: (id) => runTotpFactorKysely("find", () => authDb
-            .selectFrom("auth_totp_factor")
-            .selectAll()
-            .where("id", "=", id)
-            .executeTakeFirst()).pipe(Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeTotpFactorRow(row)))),
-        listByUser: (input) => runTotpFactorKysely("list", () => {
-            let query = authDb
-                .selectFrom("auth_totp_factor")
-                .selectAll()
-                .where("user_id", "=", input.userId);
-            if (input.includeRevoked !== true) {
-                query = query.where("revoked_at", "is", null);
-            }
-            if (input.includeUnconfirmed !== true) {
-                query = query.where("confirmed_at", "is not", null);
-            }
-            return query.execute();
-        }).pipe(Effect.map((rows) => rows.map(decodeTotpFactorRow))),
-        confirm: (input) => runTotpFactorKysely("confirm", () => authDb
-            .updateTable("auth_totp_factor")
-            .set({
-            confirmed_at: Number(input.confirmedAt),
-            ...(input.metadata === undefined
-                ? {}
-                : { metadata: jsonEncode(input.metadata) }),
-        })
-            .where("id", "=", input.id)
-            .where("revoked_at", "is", null)
-            .executeTakeFirst()).pipe(Effect.flatMap(() => runTotpFactorKysely("find", () => authDb
-            .selectFrom("auth_totp_factor")
-            .selectAll()
-            .where("id", "=", input.id)
-            .where("revoked_at", "is", null)
-            .executeTakeFirst())), Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeTotpFactorRow(row)))),
-        markUsed: (input) => runTotpFactorKysely("mark-used", () => authDb
-            .updateTable("auth_totp_factor")
-            .set({
-            last_used_at: Number(input.lastUsedAt),
-            ...(input.metadata === undefined
-                ? {}
-                : { metadata: jsonEncode(input.metadata) }),
-        })
-            .where("id", "=", input.id)
-            .where("revoked_at", "is", null)
-            .where("confirmed_at", "is not", null)
-            .executeTakeFirst()).pipe(Effect.flatMap(() => runTotpFactorKysely("find", () => authDb
-            .selectFrom("auth_totp_factor")
-            .selectAll()
-            .where("id", "=", input.id)
-            .where("revoked_at", "is", null)
-            .where("confirmed_at", "is not", null)
-            .executeTakeFirst())), Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeTotpFactorRow(row)))),
-        revoke: (input) => runTotpFactorKysely("revoke", async () => {
-            const metadata = input.reason === undefined
-                ? undefined
-                : await authDb
-                    .selectFrom("auth_totp_factor")
-                    .select("metadata")
-                    .where("id", "=", input.id)
-                    .executeTakeFirst()
-                    .then((row) => {
-                    const existingMetadata = jsonDecode(row?.metadata ?? null);
-                    return jsonEncode({
-                        ...(isRecord(existingMetadata) ? existingMetadata : {}),
-                        revokeReason: input.reason,
-                    });
-                });
-            return authDb
-                .updateTable("auth_totp_factor")
-                .set({
-                revoked_at: Number(input.revokedAt),
-                ...(metadata === undefined ? {} : { metadata }),
-            })
-                .where("id", "=", input.id)
-                .executeTakeFirst();
-        }).pipe(Effect.asVoid),
-    });
-};
-export const makeKyselyRecoveryCodeStore = (db) => {
-    const authDb = asAuthDb(db);
-    return RecoveryCodeStore.make({
-        insertMany: (rows) => rows.length === 0
-            ? Effect.void
-            : runRecoveryCodeKysely("insert", () => authDb
-                .insertInto("auth_recovery_code")
-                .values(rows.map(recoveryCodeInsert))
-                .execute()).pipe(Effect.asVoid),
-        findById: (id) => runRecoveryCodeKysely("find", () => authDb
-            .selectFrom("auth_recovery_code")
-            .selectAll()
-            .where("id", "=", id)
-            .executeTakeFirst()).pipe(Effect.map((row) => row === undefined
-            ? Option.none()
-            : Option.some(decodeRecoveryCodeRow(row)))),
-        listByUser: (input) => runRecoveryCodeKysely("list", () => {
-            let query = authDb
-                .selectFrom("auth_recovery_code")
-                .selectAll()
-                .where("user_id", "=", input.userId);
-            if (input.includeUsed !== true) {
-                query = query.where("used_at", "is", null);
-            }
-            if (input.includeRevoked !== true) {
-                query = query.where("revoked_at", "is", null);
-            }
-            return query.execute();
-        }).pipe(Effect.map((rows) => rows.map(decodeRecoveryCodeRow))),
-        markUsed: (input) => runRecoveryCodeKysely("mark-used", async () => {
-            const result = await authDb
-                .updateTable("auth_recovery_code")
-                .set({
-                used_at: Number(input.usedAt),
-                ...(input.metadata === undefined
-                    ? {}
-                    : { metadata: jsonEncode(input.metadata) }),
-            })
-                .where("id", "=", input.id)
-                .where("used_at", "is", null)
-                .where("revoked_at", "is", null)
-                .executeTakeFirst();
-            if (Number(result.numUpdatedRows) === 0) {
-                return undefined;
-            }
-            return authDb
-                .selectFrom("auth_recovery_code")
-                .selectAll()
-                .where("id", "=", input.id)
-                .executeTakeFirst();
-        }).pipe(Effect.map((row) => row === undefined
-            ? Option.none()
-            : Option.some(decodeRecoveryCodeRow(row)))),
-        revoke: (input) => runRecoveryCodeKysely("revoke", async () => {
-            const metadata = input.reason === undefined
-                ? undefined
-                : await authDb
-                    .selectFrom("auth_recovery_code")
-                    .select("metadata")
-                    .where("id", "=", input.id)
-                    .executeTakeFirst()
-                    .then((row) => {
-                    const existingMetadata = jsonDecode(row?.metadata ?? null);
-                    return jsonEncode({
-                        ...(isRecord(existingMetadata) ? existingMetadata : {}),
-                        revokeReason: input.reason,
-                    });
-                });
-            return authDb
-                .updateTable("auth_recovery_code")
-                .set({
-                revoked_at: Number(input.revokedAt),
-                ...(metadata === undefined ? {} : { metadata }),
-            })
-                .where("id", "=", input.id)
-                .executeTakeFirst();
-        }).pipe(Effect.asVoid),
-    });
-};
-export const makeKyselyApiKeyStore = (db) => {
-    const authDb = asAuthDb(db);
-    return ApiKeyStore.make({
-        insert: (row) => runApiKeyKysely("insert", () => authDb.insertInto("auth_api_key").values(apiKeyInsert(row)).executeTakeFirst()).pipe(Effect.asVoid),
-        findById: (id) => runApiKeyKysely("find", () => authDb
-            .selectFrom("auth_api_key")
-            .selectAll()
-            .where("id", "=", id)
-            .executeTakeFirst()).pipe(Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeApiKeyRow(row)))),
-        findByPrefix: (prefix) => runApiKeyKysely("find", () => authDb
-            .selectFrom("auth_api_key")
-            .selectAll()
-            .where("prefix", "=", prefix)
-            .executeTakeFirst()).pipe(Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeApiKeyRow(row)))),
-        listByUser: (input) => runApiKeyKysely("list", () => {
-            let query = authDb
-                .selectFrom("auth_api_key")
-                .selectAll()
-                .where("user_id", "=", input.userId);
-            if (input.includeRevoked !== true) {
-                query = query.where("revoked_at", "is", null);
-            }
-            return query.execute();
-        }).pipe(Effect.map((rows) => rows.map(decodeApiKeyRow))),
-        markUsed: (input) => runApiKeyKysely("mark-used", async () => {
-            const result = await authDb
-                .updateTable("auth_api_key")
-                .set({
-                last_used_at: Number(input.lastUsedAt),
-                ...(input.metadata === undefined
-                    ? {}
-                    : { metadata: jsonEncode(input.metadata) }),
-            })
-                .where("id", "=", input.id)
-                .where("revoked_at", "is", null)
-                .executeTakeFirst();
-            if (Number(result.numUpdatedRows) === 0) {
-                return undefined;
-            }
-            return authDb
-                .selectFrom("auth_api_key")
-                .selectAll()
-                .where("id", "=", input.id)
-                .executeTakeFirst();
-        }).pipe(Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeApiKeyRow(row)))),
-        revoke: (input) => runApiKeyKysely("revoke", async () => {
-            const metadata = input.reason === undefined
-                ? undefined
-                : await authDb
-                    .selectFrom("auth_api_key")
-                    .select("metadata")
-                    .where("id", "=", input.id)
-                    .executeTakeFirst()
-                    .then((row) => {
-                    const existingMetadata = jsonDecode(row?.metadata ?? null);
-                    return jsonEncode({
-                        ...(isRecord(existingMetadata) ? existingMetadata : {}),
-                        revokeReason: input.reason,
-                    });
-                });
-            return authDb
-                .updateTable("auth_api_key")
-                .set({
-                revoked_at: Number(input.revokedAt),
-                ...(metadata === undefined ? {} : { metadata }),
-            })
-                .where("id", "=", input.id)
-                .executeTakeFirst();
-        }).pipe(Effect.asVoid),
-    });
-};
-export const makeKyselyRefreshTokenStore = (db) => {
-    const authDb = asAuthDb(db);
-    const metadataWithReason = (metadata, key, reason) => {
-        if (reason === undefined) {
-            return metadata;
-        }
-        const existing = jsonDecode(metadata);
-        return jsonEncode({
-            ...(isRecord(existing) ? existing : {}),
-            [key]: reason,
-        });
-    };
-    return RefreshTokenStore.make({
-        insert: (row) => runRefreshTokenKysely("insert", () => authDb
-            .insertInto("auth_refresh_token")
-            .values(refreshTokenInsert(row))
-            .executeTakeFirst()).pipe(Effect.asVoid),
-        findById: (id) => runRefreshTokenKysely("find", () => authDb
-            .selectFrom("auth_refresh_token")
-            .selectAll()
-            .where("id", "=", id)
-            .executeTakeFirst()).pipe(Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeRefreshTokenRow(row)))),
-        findBySecretHash: (hash) => runRefreshTokenKysely("find", () => authDb
-            .selectFrom("auth_refresh_token")
-            .selectAll()
-            .where("secret_hash", "=", hash)
-            .executeTakeFirst()).pipe(Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeRefreshTokenRow(row)))),
-        listByUser: (input) => runRefreshTokenKysely("list", () => {
-            let query = authDb
-                .selectFrom("auth_refresh_token")
-                .selectAll()
-                .where("user_id", "=", input.userId);
-            if (input.includeRevoked !== true) {
-                query = query.where("revoked_at", "is", null);
-            }
-            return query.execute();
-        }).pipe(Effect.map((rows) => rows.map(decodeRefreshTokenRow))),
-        listByFamily: (input) => runRefreshTokenKysely("list", () => {
-            let query = authDb
-                .selectFrom("auth_refresh_token")
-                .selectAll()
-                .where("family_id", "=", input.familyId);
-            if (input.includeRevoked !== true) {
-                query = query.where("revoked_at", "is", null);
-            }
-            return query.execute();
-        }).pipe(Effect.map((rows) => rows.map(decodeRefreshTokenRow))),
-        rotate: (input) => runRefreshTokenKysely("rotate", async () => authDb.transaction().execute(async (transaction) => {
-            const tx = transaction;
-            const updated = await tx
-                .updateTable("auth_refresh_token")
-                .set({
-                last_used_at: Number(input.rotatedAt),
-                rotated_at: Number(input.rotatedAt),
-                replaced_by_id: input.replacement.id,
-            })
-                .where("id", "=", input.id)
-                .where("rotated_at", "is", null)
-                .where("revoked_at", "is", null)
-                .executeTakeFirst();
-            if (Number(updated.numUpdatedRows) === 0) {
-                return undefined;
-            }
-            await tx
-                .insertInto("auth_refresh_token")
-                .values(refreshTokenInsert(input.replacement))
-                .executeTakeFirst();
-            const previous = await tx
-                .selectFrom("auth_refresh_token")
-                .selectAll()
-                .where("id", "=", input.id)
-                .executeTakeFirst();
-            const replacement = await tx
-                .selectFrom("auth_refresh_token")
-                .selectAll()
-                .where("id", "=", input.replacement.id)
-                .executeTakeFirst();
-            return previous === undefined || replacement === undefined
-                ? undefined
-                : {
-                    previous: decodeRefreshTokenRow(previous),
-                    replacement: decodeRefreshTokenRow(replacement),
-                };
-        })).pipe(Effect.map((row) => (row === undefined ? Option.none() : Option.some(row)))),
-        markReuseDetected: (input) => runRefreshTokenKysely("reuse", async () => {
-            const result = await authDb
-                .updateTable("auth_refresh_token")
-                .set({ reuse_detected_at: Number(input.reuseDetectedAt) })
-                .where("id", "=", input.id)
-                .executeTakeFirst();
-            if (Number(result.numUpdatedRows) === 0) {
-                return undefined;
-            }
-            return authDb
-                .selectFrom("auth_refresh_token")
-                .selectAll()
-                .where("id", "=", input.id)
-                .executeTakeFirst();
-        }).pipe(Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeRefreshTokenRow(row)))),
-        revoke: (input) => runRefreshTokenKysely("revoke", async () => {
-            const row = await authDb
-                .selectFrom("auth_refresh_token")
-                .select(["metadata"])
-                .where("id", "=", input.id)
-                .executeTakeFirst();
-            return authDb
-                .updateTable("auth_refresh_token")
-                .set({
-                revoked_at: Number(input.revokedAt),
-                metadata: metadataWithReason(row?.metadata ?? null, "revokeReason", input.reason),
-            })
-                .where("id", "=", input.id)
-                .executeTakeFirst();
-        }).pipe(Effect.asVoid),
-        revokeFamily: (input) => runRefreshTokenKysely("revoke", async () => {
-            const rows = await authDb
-                .selectFrom("auth_refresh_token")
-                .select(["id", "metadata"])
-                .where("family_id", "=", input.familyId)
-                .execute();
-            await Promise.all(rows.map((row) => authDb
-                .updateTable("auth_refresh_token")
-                .set({
-                revoked_at: Number(input.revokedAt),
-                metadata: metadataWithReason(row.metadata, "familyRevokeReason", input.reason),
-            })
-                .where("id", "=", row.id)
-                .executeTakeFirst()));
-        }).pipe(Effect.asVoid),
-    });
-};
-export const makeKyselyJwtRevocationStore = (db) => {
-    const authDb = asAuthDb(db);
-    return JwtRevocationStore.make({
-        revoke: (record) => runJwtRevocationKysely("revoke", async () => {
-            const row = jwtRevocationInsert(record);
-            const updated = await authDb
-                .updateTable("auth_jwt_revocation")
-                .set({
-                revoked_at: row.revoked_at,
-                expires_at: row.expires_at,
-                reason: row.reason,
-            })
-                .where("jwt_id", "=", record.jwtId)
-                .executeTakeFirst();
-            if (Number(updated.numUpdatedRows) === 0) {
-                await authDb
-                    .insertInto("auth_jwt_revocation")
-                    .values(row)
-                    .executeTakeFirst();
-            }
-        }).pipe(Effect.asVoid),
-        find: (jwtId) => runJwtRevocationKysely("find", () => authDb
-            .selectFrom("auth_jwt_revocation")
-            .selectAll()
-            .where("jwt_id", "=", jwtId)
-            .executeTakeFirst()).pipe(Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeJwtRevocationRow(row)))),
-    });
-};
-export const makeKyselyOAuthAccountStore = (db) => {
-    const authDb = asAuthDb(db);
-    const metadataWithReason = (metadata, reason) => {
-        if (reason === undefined) {
-            return metadata;
-        }
-        const existing = jsonDecode(metadata);
-        return jsonEncode({
-            ...(isRecord(existing) ? existing : {}),
-            unlinkReason: reason,
-        });
-    };
-    const activeFilter = (query, includeUnlinked) => includeUnlinked === true ? query : query.where("unlinked_at", "is", null);
-    return OAuthAccountStore.make({
-        insert: (row) => runOAuthAccountKysely("insert", () => authDb
-            .insertInto("auth_oauth_account")
-            .values(oauthAccountInsert(row))
-            .executeTakeFirst()).pipe(Effect.asVoid),
-        findById: (id) => runOAuthAccountKysely("find", () => authDb
-            .selectFrom("auth_oauth_account")
-            .selectAll()
-            .where("id", "=", id)
-            .executeTakeFirst()).pipe(Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeOAuthAccountRow(row)))),
-        findByProviderAccount: (input) => runOAuthAccountKysely("find", () => {
-            const query = authDb
-                .selectFrom("auth_oauth_account")
-                .selectAll()
-                .where("provider_id", "=", input.providerId)
-                .where("provider_account_id", "=", input.providerAccountId);
-            return activeFilter(query, input.includeUnlinked).executeTakeFirst();
-        }).pipe(Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeOAuthAccountRow(row)))),
-        listByUser: (input) => runOAuthAccountKysely("list", () => {
-            const query = authDb
-                .selectFrom("auth_oauth_account")
-                .selectAll()
-                .where("user_id", "=", input.userId);
-            return activeFilter(query, input.includeUnlinked).execute();
-        }).pipe(Effect.map((rows) => rows.map(decodeOAuthAccountRow))),
-        unlink: (input) => runOAuthAccountKysely("unlink", async () => {
-            const current = await authDb
-                .selectFrom("auth_oauth_account")
-                .select(["id", "metadata"])
-                .where("provider_id", "=", input.providerId)
-                .where("provider_account_id", "=", input.providerAccountId)
-                .where("unlinked_at", "is", null)
-                .executeTakeFirst();
-            if (current === undefined) {
-                return undefined;
-            }
-            const updated = await authDb
-                .updateTable("auth_oauth_account")
-                .set({
-                unlinked_at: Number(input.unlinkedAt),
-                metadata: metadataWithReason(current.metadata, input.reason),
-            })
-                .where("id", "=", current.id)
-                .executeTakeFirst();
-            if (Number(updated.numUpdatedRows) === 0) {
-                return undefined;
-            }
-            return authDb
-                .selectFrom("auth_oauth_account")
-                .selectAll()
-                .where("id", "=", current.id)
-                .executeTakeFirst();
-        }).pipe(Effect.map((row) => row === undefined ? Option.none() : Option.some(decodeOAuthAccountRow(row)))),
-    });
-};
-export const makeKyselyStorage = (db) => ({
-    userStore: makeKyselyUserStore(db),
-    credentialStore: makeKyselyCredentialStore(db),
-    sessionStore: makeKyselySessionStore(db),
-    verificationStore: makeKyselyVerificationStore(db),
-    loginApprovalReviewStore: makeKyselyLoginApprovalReviewStore(db),
-    trustedDeviceStore: makeKyselyTrustedDeviceStore(db),
-    passkeyCredentialStore: makeKyselyPasskeyCredentialStore(db),
-    totpFactorStore: makeKyselyTotpFactorStore(db),
-    recoveryCodeStore: makeKyselyRecoveryCodeStore(db),
-    apiKeyStore: makeKyselyApiKeyStore(db),
-    refreshTokenStore: makeKyselyRefreshTokenStore(db),
-    jwtRevocationStore: makeKyselyJwtRevocationStore(db),
-    oauthAccountStore: makeKyselyOAuthAccountStore(db),
-});
-export const KyselyAuthStorageLive = (db) => Layer.mergeAll(Layer.succeed(UserStore)(makeKyselyUserStore(db)), Layer.succeed(CredentialStore)(makeKyselyCredentialStore(db)), Layer.succeed(SessionStore)(makeKyselySessionStore(db)), Layer.succeed(VerificationStore)(makeKyselyVerificationStore(db)), Layer.succeed(LoginApprovalReviewStore)(makeKyselyLoginApprovalReviewStore(db)), Layer.succeed(TrustedDeviceStore)(makeKyselyTrustedDeviceStore(db)), Layer.succeed(PasskeyCredentialStore)(makeKyselyPasskeyCredentialStore(db)), Layer.succeed(TotpFactorStore)(makeKyselyTotpFactorStore(db)), Layer.succeed(RecoveryCodeStore)(makeKyselyRecoveryCodeStore(db)), Layer.succeed(ApiKeyStore)(makeKyselyApiKeyStore(db)), Layer.succeed(RefreshTokenStore)(makeKyselyRefreshTokenStore(db)), Layer.succeed(JwtRevocationStore)(makeKyselyJwtRevocationStore(db)), Layer.succeed(OAuthAccountStore)(makeKyselyOAuthAccountStore(db)));
-//# sourceMappingURL=KyselyStorage.js.map