@effect-auth/core 0.1.0-alpha.7 → 0.1.0-alpha.9

package/dist/EffectQbSqliteStorage.js

@@ -1,10 +1,16 @@
-import { Data, Effect, Layer, Option } from "effect";
+import { Data, Effect, Layer, Option, Redacted } from "effect";
 import { Column, Executor, Query, Scalar, Table } from "effect-qb/sqlite";
-import { AuthFlowId, ChallengeId, CredentialId, Email, SessionId, UnixMillis, UserId, } from "./Identifiers.js";
+import { ApiKeyId, ApiKeyPrefix, ApiKeySecretHash, ApiKeyStore, ApiKeyStoreError, } from "./ApiKey.js";
+import { AuthFlowId, ChallengeId, CredentialId, Email, OAuthAccountId, OAuthProviderId, SessionId, UnixMillis, UserId, } from "./Identifiers.js";
 import { JwtError, JwtRevocationStore } from "./Jwt.js";
 import { LoginApprovalReviewError, LoginApprovalReviewStore, } from "./LoginApproval.js";
 import { LoginRiskContext, LoginRiskSignal } from "./LoginRisk.js";
+import { OAuthAccountStore, OAuthAccountStoreError, OAuthProviderTokenVault, OAuthProviderTokenVaultError, } from "./OAuth.js";
+import { PasskeyCredentialId, PasskeyCredentialStore, PasskeyCredentialStoreError, } from "./Passkey.js";
+import { RecoveryCodeHash, RecoveryCodeStore, RecoveryCodeStoreError, } from "./RecoveryCode.js";
+import { RefreshTokenFamilyId, RefreshTokenId, RefreshTokenSecretHash, RefreshTokenStore, RefreshTokenStoreError, } from "./RefreshToken.js";
 import { CredentialStore, SessionStore, StorageError, UserStore, VerificationStore, } from "./Storage.js";
+import { TotpFactorStore, TotpFactorStoreError, TotpSecret, } from "./Totp.js";
 import { TrustedDeviceError, TrustedDeviceStore } from "./TrustedDevice.js";
 export class D1EffectQbError extends Data.TaggedError("D1EffectQbError") {
 }
@@ -78,12 +84,100 @@ const makeAuthTrustedDeviceTable = (name) => Table.make(name, {
     expires_at: Column.int(),
     metadata: Column.text().pipe(Column.nullable),
 });
+const makeAuthPasskeyCredentialTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    credential_id: Column.text(),
+    public_key: Column.text(),
+    sign_count: Column.int(),
+    transports: Column.text().pipe(Column.nullable),
+    backed_up: Column.int().pipe(Column.nullable),
+    created_at: Column.int(),
+    last_used_at: Column.int().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthTotpFactorTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    secret: Column.text(),
+    algorithm: Column.text(),
+    digits: Column.int(),
+    period: Column.int(),
+    created_at: Column.int(),
+    confirmed_at: Column.int().pipe(Column.nullable),
+    last_used_at: Column.int().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthRecoveryCodeTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    code_hash: Column.text(),
+    created_at: Column.int(),
+    used_at: Column.int().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthApiKeyTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    prefix: Column.text(),
+    secret_hash: Column.text(),
+    scopes: Column.text(),
+    created_at: Column.int(),
+    expires_at: Column.int().pipe(Column.nullable),
+    last_used_at: Column.int().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthRefreshTokenTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    family_id: Column.text(),
+    user_id: Column.text(),
+    secret_hash: Column.text(),
+    created_at: Column.int(),
+    expires_at: Column.int(),
+    last_used_at: Column.int().pipe(Column.nullable),
+    rotated_at: Column.int().pipe(Column.nullable),
+    replaced_by_id: Column.text().pipe(Column.nullable),
+    revoked_at: Column.int().pipe(Column.nullable),
+    reuse_detected_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
 const makeAuthJwtRevocationTable = (name) => Table.make(name, {
     jwt_id: Column.text().pipe(Column.primaryKey),
     revoked_at: Column.int(),
     expires_at: Column.int().pipe(Column.nullable),
     reason: Column.text().pipe(Column.nullable),
 });
+const makeAuthOAuthAccountTable = (name) => Table.make(name, {
+    id: Column.text().pipe(Column.primaryKey),
+    provider_id: Column.text(),
+    provider_account_id: Column.text(),
+    user_id: Column.text(),
+    email: Column.text().pipe(Column.nullable),
+    email_verified: Column.int().pipe(Column.nullable),
+    created_at: Column.int(),
+    updated_at: Column.int(),
+    unlinked_at: Column.int().pipe(Column.nullable),
+    metadata: Column.text().pipe(Column.nullable),
+});
+const makeAuthOAuthProviderTokenVaultTable = (name) => Table.make(name, {
+    account_id: Column.text().pipe(Column.primaryKey),
+    user_id: Column.text(),
+    provider_id: Column.text(),
+    provider_account_id: Column.text(),
+    access_token_ciphertext: Column.text(),
+    refresh_token_ciphertext: Column.text().pipe(Column.nullable),
+    id_token_ciphertext: Column.text().pipe(Column.nullable),
+    token_type: Column.text(),
+    scopes: Column.text().pipe(Column.nullable),
+    expires_at: Column.int().pipe(Column.nullable),
+    updated_at: Column.int(),
+    revoked_at: Column.int().pipe(Column.nullable),
+    revocation_reason: Column.text().pipe(Column.nullable),
+});
 const authSqliteTablesTypeId = Symbol.for("@effect-auth/core/EffectQbSqliteStorage/AuthSqliteTables");
 const jsonEncode = (value) => value === undefined ? null : JSON.stringify(value);
 const jsonDecode = (value) => {
@@ -120,6 +214,7 @@ const executePlan = (executor, plan) => executor.execute(plan);
 const omitUndefined = (record) => Object.fromEntries(Object.entries(record).filter(([, value]) => value !== undefined));
 const sessionMetadataEnvelopeKey = "__effectAuthSession";
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const metadataWithReason = (metadata, key, reason) => reason === undefined ? metadata : { ...metadata, [key]: reason };
 const isLoginRiskLevel = (value) => value === "unknown" ||
     value === "low" ||
     value === "medium" ||
@@ -279,6 +374,96 @@ const decodeDefaultTrustedDeviceRow = (row) => omitUndefined({
 const decodeTrustedDeviceRow = (tables, row) => tables.trustedDevice.decode === undefined
     ? decodeDefaultTrustedDeviceRow(row)
     : tables.trustedDevice.decode(row);
+const decodePasskeyTransports = (value) => {
+    const decoded = jsonDecode(value);
+    return Array.isArray(decoded) ? decoded : undefined;
+};
+const decodeDefaultPasskeyCredentialRow = (row) => omitUndefined({
+    id: CredentialId(row.id),
+    userId: UserId(row.userId),
+    credentialId: PasskeyCredentialId(row.credentialId),
+    publicKey: row.publicKey,
+    signCount: Number(row.signCount),
+    transports: decodePasskeyTransports(row.transports),
+    backedUp: row.backedUp === null || row.backedUp === undefined
+        ? undefined
+        : decodeBoolean(row.backedUp),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    lastUsedAt: optionalUnixMillis(row.lastUsedAt),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodePasskeyCredentialRow = (tables, row) => tables.passkeyCredential.decode === undefined
+    ? decodeDefaultPasskeyCredentialRow(row)
+    : tables.passkeyCredential.decode(row);
+const decodeDefaultTotpFactorRow = (row) => omitUndefined({
+    id: CredentialId(row.id),
+    userId: UserId(row.userId),
+    secret: Redacted.make(TotpSecret(row.secret)),
+    algorithm: row.algorithm,
+    digits: Number(row.digits),
+    period: Number(row.period),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    confirmedAt: optionalUnixMillis(row.confirmedAt),
+    lastUsedAt: optionalUnixMillis(row.lastUsedAt),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeTotpFactorRow = (tables, row) => tables.totpFactor.decode === undefined
+    ? decodeDefaultTotpFactorRow(row)
+    : tables.totpFactor.decode(row);
+const decodeDefaultRecoveryCodeRow = (row) => omitUndefined({
+    id: CredentialId(row.id),
+    userId: UserId(row.userId),
+    codeHash: RecoveryCodeHash(row.codeHash),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    usedAt: optionalUnixMillis(row.usedAt),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeRecoveryCodeRow = (tables, row) => tables.recoveryCode.decode === undefined
+    ? decodeDefaultRecoveryCodeRow(row)
+    : tables.recoveryCode.decode(row);
+const decodeStringArray = (value) => {
+    const decoded = jsonDecode(value);
+    return Array.isArray(decoded) ? decoded.map(String) : [];
+};
+const decodeOptionalStringArray = (value) => {
+    const decoded = jsonDecode(value);
+    return Array.isArray(decoded) ? decoded.map(String) : undefined;
+};
+const decodeDefaultApiKeyRow = (row) => omitUndefined({
+    id: ApiKeyId(row.id),
+    userId: UserId(row.userId),
+    prefix: ApiKeyPrefix(row.prefix),
+    secretHash: ApiKeySecretHash(row.secretHash),
+    scopes: decodeStringArray(row.scopes),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    expiresAt: optionalUnixMillis(row.expiresAt),
+    lastUsedAt: optionalUnixMillis(row.lastUsedAt),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeApiKeyRow = (tables, row) => tables.apiKey.decode === undefined
+    ? decodeDefaultApiKeyRow(row)
+    : tables.apiKey.decode(row);
+const decodeDefaultRefreshTokenRow = (row) => omitUndefined({
+    id: RefreshTokenId(row.id),
+    familyId: RefreshTokenFamilyId(row.familyId),
+    userId: UserId(row.userId),
+    secretHash: RefreshTokenSecretHash(row.secretHash),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    expiresAt: UnixMillis(Number(row.expiresAt)),
+    lastUsedAt: optionalUnixMillis(row.lastUsedAt),
+    rotatedAt: optionalUnixMillis(row.rotatedAt),
+    replacedById: row.replacedById === null ? undefined : RefreshTokenId(row.replacedById),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    reuseDetectedAt: optionalUnixMillis(row.reuseDetectedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeRefreshTokenRow = (tables, row) => tables.refreshToken.decode === undefined
+    ? decodeDefaultRefreshTokenRow(row)
+    : tables.refreshToken.decode(row);
 const decodeDefaultJwtRevocationRow = (row) => omitUndefined({
     jwtId: row.jwtId,
     revokedAt: UnixMillis(Number(row.revokedAt)),
@@ -288,6 +473,53 @@ const decodeDefaultJwtRevocationRow = (row) => omitUndefined({
 const decodeJwtRevocationRow = (tables, row) => tables.jwtRevocation.decode === undefined
     ? decodeDefaultJwtRevocationRow(row)
     : tables.jwtRevocation.decode(row);
+const decodeDefaultOAuthAccountRow = (row) => omitUndefined({
+    id: OAuthAccountId(row.id),
+    providerId: OAuthProviderId(row.providerId),
+    providerAccountId: row.providerAccountId,
+    userId: UserId(row.userId),
+    email: row.email === null ? undefined : Email(row.email),
+    emailVerified: row.emailVerified === null || row.emailVerified === undefined
+        ? undefined
+        : decodeBoolean(row.emailVerified),
+    createdAt: UnixMillis(Number(row.createdAt)),
+    updatedAt: UnixMillis(Number(row.updatedAt)),
+    unlinkedAt: optionalUnixMillis(row.unlinkedAt),
+    metadata: jsonDecode(row.metadata),
+});
+const decodeOAuthAccountRow = (tables, row) => tables.oauthAccount.decode === undefined
+    ? decodeDefaultOAuthAccountRow(row)
+    : tables.oauthAccount.decode(row);
+const decodeDefaultOAuthProviderTokenVaultRow = (row) => omitUndefined({
+    accountId: OAuthAccountId(row.accountId),
+    userId: UserId(row.userId),
+    providerId: OAuthProviderId(row.providerId),
+    providerAccountId: row.providerAccountId,
+    accessTokenCiphertext: Redacted.make(row.accessTokenCiphertext),
+    refreshTokenCiphertext: row.refreshTokenCiphertext === null
+        ? undefined
+        : Redacted.make(row.refreshTokenCiphertext),
+    idTokenCiphertext: row.idTokenCiphertext === null
+        ? undefined
+        : Redacted.make(row.idTokenCiphertext),
+    tokenType: row.tokenType,
+    scopes: decodeOptionalStringArray(row.scopes),
+    expiresAt: optionalUnixMillis(row.expiresAt),
+    updatedAt: UnixMillis(Number(row.updatedAt)),
+    revokedAt: optionalUnixMillis(row.revokedAt),
+    revocationReason: row.revocationReason ?? undefined,
+});
+const decodeOAuthProviderTokenVaultRow = (tables, row) => tables.oauthProviderTokenVault.decode === undefined
+    ? decodeDefaultOAuthProviderTokenVaultRow(row)
+    : tables.oauthProviderTokenVault.decode(row);
+const providerTokenVaultTokens = (record) => omitUndefined({
+    accessTokenCiphertext: record.accessTokenCiphertext,
+    refreshTokenCiphertext: record.refreshTokenCiphertext,
+    idTokenCiphertext: record.idTokenCiphertext,
+    tokenType: record.tokenType,
+    scopes: record.scopes === undefined ? undefined : [...record.scopes],
+    expiresAt: record.expiresAt,
+});
 const userInsert = (row) => ({
     id: row.id,
     email: row.email,
@@ -408,12 +640,163 @@ const trustedDeviceUpdate = (input, existing) => ({
     expires_at: Number(input.expiresAt),
     metadata: jsonEncode(input.metadata ?? existing.metadata),
 });
+const passkeyCredentialInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    credential_id: row.credentialId,
+    public_key: row.publicKey,
+    sign_count: row.signCount,
+    transports: jsonEncode(row.transports),
+    backed_up: row.backedUp === undefined ? null : row.backedUp ? 1 : 0,
+    created_at: Number(row.createdAt),
+    last_used_at: row.lastUsedAt === undefined ? null : Number(row.lastUsedAt),
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const passkeyCredentialUpdateSignCount = (input) => omitUndefined({
+    sign_count: input.signCount,
+    last_used_at: Number(input.lastUsedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
+const passkeyCredentialRevoke = (input, row) => ({
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
+});
+const totpFactorInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    secret: Redacted.value(row.secret),
+    algorithm: row.algorithm,
+    digits: row.digits,
+    period: row.period,
+    created_at: Number(row.createdAt),
+    confirmed_at: row.confirmedAt === undefined ? null : Number(row.confirmedAt),
+    last_used_at: row.lastUsedAt === undefined ? null : Number(row.lastUsedAt),
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const totpFactorConfirm = (input) => omitUndefined({
+    confirmed_at: Number(input.confirmedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
+const totpFactorMarkUsed = (input) => omitUndefined({
+    last_used_at: Number(input.lastUsedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
+const totpFactorRevoke = (input, row) => ({
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
+});
+const recoveryCodeInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    code_hash: row.codeHash,
+    created_at: Number(row.createdAt),
+    used_at: row.usedAt === undefined ? null : Number(row.usedAt),
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const recoveryCodeMarkUsed = (input) => omitUndefined({
+    used_at: Number(input.usedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
+const recoveryCodeRevoke = (input, row) => ({
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
+});
+const apiKeyInsert = (row) => ({
+    id: row.id,
+    user_id: row.userId,
+    prefix: row.prefix,
+    secret_hash: row.secretHash,
+    scopes: JSON.stringify(row.scopes),
+    created_at: Number(row.createdAt),
+    expires_at: row.expiresAt === undefined ? null : Number(row.expiresAt),
+    last_used_at: row.lastUsedAt === undefined ? null : Number(row.lastUsedAt),
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const apiKeyMarkUsed = (input) => omitUndefined({
+    last_used_at: Number(input.lastUsedAt),
+    metadata: input.metadata === undefined ? undefined : jsonEncode(input.metadata),
+});
+const apiKeyRevoke = (input, row) => ({
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
+});
+const refreshTokenInsert = (row) => ({
+    id: row.id,
+    family_id: row.familyId,
+    user_id: row.userId,
+    secret_hash: row.secretHash,
+    created_at: Number(row.createdAt),
+    expires_at: Number(row.expiresAt),
+    last_used_at: row.lastUsedAt === undefined ? null : Number(row.lastUsedAt),
+    rotated_at: row.rotatedAt === undefined ? null : Number(row.rotatedAt),
+    replaced_by_id: row.replacedById ?? null,
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    reuse_detected_at: row.reuseDetectedAt === undefined ? null : Number(row.reuseDetectedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const refreshTokenRotate = (input) => ({
+    last_used_at: Number(input.rotatedAt),
+    rotated_at: Number(input.rotatedAt),
+    replaced_by_id: input.replacement.id,
+});
+const refreshTokenMarkReuseDetected = (input) => ({
+    reuse_detected_at: Number(input.reuseDetectedAt),
+});
+const refreshTokenRevoke = (input, row) => ({
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "revokeReason", input.reason)),
+});
+const refreshTokenRevokeFamily = (input, row) => ({
+    revoked_at: Number(input.revokedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "familyRevokeReason", input.reason)),
+});
 const jwtRevocationInsert = (record) => ({
     jwt_id: record.jwtId,
     revoked_at: Number(record.revokedAt),
     expires_at: record.expiresAt === undefined ? null : Number(record.expiresAt),
     reason: record.reason ?? null,
 });
+const oauthAccountInsert = (row) => ({
+    id: row.id,
+    provider_id: row.providerId,
+    provider_account_id: row.providerAccountId,
+    user_id: row.userId,
+    email: row.email ?? null,
+    email_verified: row.emailVerified === undefined ? null : row.emailVerified ? 1 : 0,
+    created_at: Number(row.createdAt),
+    updated_at: Number(row.updatedAt),
+    unlinked_at: row.unlinkedAt === undefined ? null : Number(row.unlinkedAt),
+    metadata: jsonEncode(row.metadata),
+});
+const oauthAccountUnlink = (input, row) => ({
+    unlinked_at: Number(input.unlinkedAt),
+    metadata: jsonEncode(metadataWithReason(row.metadata, "unlinkReason", input.reason)),
+});
+const oauthProviderTokenVaultValues = (row) => ({
+    account_id: row.accountId,
+    user_id: row.userId,
+    provider_id: row.providerId,
+    provider_account_id: row.providerAccountId,
+    access_token_ciphertext: Redacted.value(row.accessTokenCiphertext),
+    refresh_token_ciphertext: row.refreshTokenCiphertext === undefined
+        ? null
+        : Redacted.value(row.refreshTokenCiphertext),
+    id_token_ciphertext: row.idTokenCiphertext === undefined ? null : Redacted.value(row.idTokenCiphertext),
+    token_type: row.tokenType,
+    scopes: jsonEncode(row.scopes),
+    expires_at: row.expiresAt === undefined ? null : Number(row.expiresAt),
+    updated_at: Number(row.updatedAt),
+    revoked_at: row.revokedAt === undefined ? null : Number(row.revokedAt),
+    revocation_reason: row.revocationReason ?? null,
+});
+const oauthProviderTokenVaultMarkRevoked = (input) => ({
+    revoked_at: Number(input.revokedAt),
+    revocation_reason: input.reason,
+});
 const jwtRevocationUpdate = (record) => ({
     revoked_at: Number(record.revokedAt),
     expires_at: record.expiresAt === undefined ? null : Number(record.expiresAt),
@@ -426,7 +809,14 @@ const makeInternalAuthSqliteTables = (names = {}) => {
     const verification = makeAuthVerificationTable(names.verification ?? "auth_verification");
     const loginApprovalReview = makeAuthLoginApprovalReviewTable(names.loginApprovalReview ?? "auth_login_approval_review");
     const trustedDevice = makeAuthTrustedDeviceTable(names.trustedDevice ?? "auth_trusted_device");
+    const passkeyCredential = makeAuthPasskeyCredentialTable(names.passkeyCredential ?? "auth_passkey_credential");
+    const totpFactor = makeAuthTotpFactorTable(names.totpFactor ?? "auth_totp_factor");
+    const recoveryCode = makeAuthRecoveryCodeTable(names.recoveryCode ?? "auth_recovery_code");
+    const apiKey = makeAuthApiKeyTable(names.apiKey ?? "auth_api_key");
+    const refreshToken = makeAuthRefreshTokenTable(names.refreshToken ?? "auth_refresh_token");
     const jwtRevocation = makeAuthJwtRevocationTable(names.jwtRevocation ?? "auth_jwt_revocation");
+    const oauthAccount = makeAuthOAuthAccountTable(names.oauthAccount ?? "auth_oauth_account");
+    const oauthProviderTokenVault = makeAuthOAuthProviderTokenVaultTable(names.oauthProviderTokenVault ?? "auth_oauth_provider_token_vault");
     return {
         user: {
             table: user,
@@ -532,6 +922,100 @@ const makeInternalAuthSqliteTables = (names = {}) => {
             insert: trustedDeviceInsert,
             update: trustedDeviceUpdate,
         },
+        passkeyCredential: {
+            table: passkeyCredential,
+            select: {
+                id: passkeyCredential.id,
+                userId: passkeyCredential.user_id,
+                credentialId: passkeyCredential.credential_id,
+                publicKey: passkeyCredential.public_key,
+                signCount: passkeyCredential.sign_count,
+                transports: passkeyCredential.transports,
+                backedUp: passkeyCredential.backed_up,
+                createdAt: passkeyCredential.created_at,
+                lastUsedAt: passkeyCredential.last_used_at,
+                revokedAt: passkeyCredential.revoked_at,
+                metadata: passkeyCredential.metadata,
+            },
+            insert: passkeyCredentialInsert,
+            updateSignCount: passkeyCredentialUpdateSignCount,
+            revoke: passkeyCredentialRevoke,
+        },
+        totpFactor: {
+            table: totpFactor,
+            select: {
+                id: totpFactor.id,
+                userId: totpFactor.user_id,
+                secret: totpFactor.secret,
+                algorithm: totpFactor.algorithm,
+                digits: totpFactor.digits,
+                period: totpFactor.period,
+                createdAt: totpFactor.created_at,
+                confirmedAt: totpFactor.confirmed_at,
+                lastUsedAt: totpFactor.last_used_at,
+                revokedAt: totpFactor.revoked_at,
+                metadata: totpFactor.metadata,
+            },
+            insert: totpFactorInsert,
+            confirm: totpFactorConfirm,
+            markUsed: totpFactorMarkUsed,
+            revoke: totpFactorRevoke,
+        },
+        recoveryCode: {
+            table: recoveryCode,
+            select: {
+                id: recoveryCode.id,
+                userId: recoveryCode.user_id,
+                codeHash: recoveryCode.code_hash,
+                createdAt: recoveryCode.created_at,
+                usedAt: recoveryCode.used_at,
+                revokedAt: recoveryCode.revoked_at,
+                metadata: recoveryCode.metadata,
+            },
+            insert: recoveryCodeInsert,
+            markUsed: recoveryCodeMarkUsed,
+            revoke: recoveryCodeRevoke,
+        },
+        apiKey: {
+            table: apiKey,
+            select: {
+                id: apiKey.id,
+                userId: apiKey.user_id,
+                prefix: apiKey.prefix,
+                secretHash: apiKey.secret_hash,
+                scopes: apiKey.scopes,
+                createdAt: apiKey.created_at,
+                expiresAt: apiKey.expires_at,
+                lastUsedAt: apiKey.last_used_at,
+                revokedAt: apiKey.revoked_at,
+                metadata: apiKey.metadata,
+            },
+            insert: apiKeyInsert,
+            markUsed: apiKeyMarkUsed,
+            revoke: apiKeyRevoke,
+        },
+        refreshToken: {
+            table: refreshToken,
+            select: {
+                id: refreshToken.id,
+                familyId: refreshToken.family_id,
+                userId: refreshToken.user_id,
+                secretHash: refreshToken.secret_hash,
+                createdAt: refreshToken.created_at,
+                expiresAt: refreshToken.expires_at,
+                lastUsedAt: refreshToken.last_used_at,
+                rotatedAt: refreshToken.rotated_at,
+                replacedById: refreshToken.replaced_by_id,
+                revokedAt: refreshToken.revoked_at,
+                reuseDetectedAt: refreshToken.reuse_detected_at,
+                metadata: refreshToken.metadata,
+            },
+            insert: refreshTokenInsert,
+            rotate: refreshTokenRotate,
+            markReuseDetected: refreshTokenMarkReuseDetected,
+            revoke: refreshTokenRevoke,
+            revokeFamily: refreshTokenRevokeFamily,
+        },
         jwtRevocation: {
             table: jwtRevocation,
             select: {
@@ -543,6 +1027,44 @@ const makeInternalAuthSqliteTables = (names = {}) => {
             insert: jwtRevocationInsert,
             update: jwtRevocationUpdate,
         },
+        oauthAccount: {
+            table: oauthAccount,
+            select: {
+                id: oauthAccount.id,
+                providerId: oauthAccount.provider_id,
+                providerAccountId: oauthAccount.provider_account_id,
+                userId: oauthAccount.user_id,
+                email: oauthAccount.email,
+                emailVerified: oauthAccount.email_verified,
+                createdAt: oauthAccount.created_at,
+                updatedAt: oauthAccount.updated_at,
+                unlinkedAt: oauthAccount.unlinked_at,
+                metadata: oauthAccount.metadata,
+            },
+            insert: oauthAccountInsert,
+            unlink: oauthAccountUnlink,
+        },
+        oauthProviderTokenVault: {
+            table: oauthProviderTokenVault,
+            select: {
+                accountId: oauthProviderTokenVault.account_id,
+                userId: oauthProviderTokenVault.user_id,
+                providerId: oauthProviderTokenVault.provider_id,
+                providerAccountId: oauthProviderTokenVault.provider_account_id,
+                accessTokenCiphertext: oauthProviderTokenVault.access_token_ciphertext,
+                refreshTokenCiphertext: oauthProviderTokenVault.refresh_token_ciphertext,
+                idTokenCiphertext: oauthProviderTokenVault.id_token_ciphertext,
+                tokenType: oauthProviderTokenVault.token_type,
+                scopes: oauthProviderTokenVault.scopes,
+                expiresAt: oauthProviderTokenVault.expires_at,
+                updatedAt: oauthProviderTokenVault.updated_at,
+                revokedAt: oauthProviderTokenVault.revoked_at,
+                revocationReason: oauthProviderTokenVault.revocation_reason,
+            },
+            insert: oauthProviderTokenVaultValues,
+            update: oauthProviderTokenVaultValues,
+            markRevoked: oauthProviderTokenVaultMarkRevoked,
+        },
     };
 };
 const asAuthSqliteTables = (tables) => tables;
@@ -555,7 +1077,14 @@ const selectSessionColumns = (tables) => tables.session.select;
 const selectVerificationColumns = (tables) => tables.verification.select;
 const selectLoginApprovalReviewColumns = (tables) => tables.loginApprovalReview.select;
 const selectTrustedDeviceColumns = (tables) => tables.trustedDevice.select;
+const selectPasskeyCredentialColumns = (tables) => tables.passkeyCredential.select;
+const selectTotpFactorColumns = (tables) => tables.totpFactor.select;
+const selectRecoveryCodeColumns = (tables) => tables.recoveryCode.select;
+const selectApiKeyColumns = (tables) => tables.apiKey.select;
+const selectRefreshTokenColumns = (tables) => tables.refreshToken.select;
 const selectJwtRevocationColumns = (tables) => tables.jwtRevocation.select;
+const selectOAuthAccountColumns = (tables) => tables.oauthAccount.select;
+const selectOAuthProviderTokenVaultColumns = (tables) => tables.oauthProviderTokenVault.select;
 const storageError = (entity, operation, cause) => StorageError.fromUnknown(entity, operation, cause);
 const loginApprovalReviewStoreError = (operation, cause) => new LoginApprovalReviewError({
     message: `Login approval review ${operation} failed`,
@@ -566,11 +1095,46 @@ const trustedDeviceStoreError = (operation, cause) => new TrustedDeviceError({
     message: `Trusted device ${operation} failed`,
     cause,
 });
+const passkeyCredentialStoreError = (operation, cause) => new PasskeyCredentialStoreError({
+    operation,
+    message: `Passkey credential ${operation} failed`,
+    cause,
+});
+const totpFactorStoreError = (operation, cause) => new TotpFactorStoreError({
+    operation,
+    message: `TOTP factor ${operation} failed`,
+    cause,
+});
+const recoveryCodeStoreError = (operation, cause) => new RecoveryCodeStoreError({
+    operation,
+    message: `Recovery code ${operation} failed`,
+    cause,
+});
+const apiKeyStoreError = (operation, cause) => new ApiKeyStoreError({
+    operation,
+    message: `API key ${operation} failed`,
+    cause,
+});
+const refreshTokenStoreError = (operation, cause) => new RefreshTokenStoreError({
+    operation,
+    message: `Refresh token ${operation} failed`,
+    cause,
+});
 const jwtRevocationStoreError = (operation, cause) => new JwtError({
     operation: "revocation",
     message: `JWT revocation ${operation} failed`,
     cause,
 });
+const oauthAccountStoreError = (operation, cause) => new OAuthAccountStoreError({
+    operation,
+    message: `OAuth account ${operation} failed`,
+    cause,
+});
+const oauthProviderTokenVaultError = (operation, cause) => new OAuthProviderTokenVaultError({
+    operation,
+    message: `OAuth provider token vault ${operation} failed`,
+    cause,
+});
 const findUserById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectUserColumns(tables)).pipe(Query.from(tables.user.table), Query.where(queryEq(tables.user.select.id, id)))).pipe(Effect.mapError((cause) => storageError("user", operation, cause)), Effect.map((rows) => rows[0] === undefined
     ? Option.none()
     : Option.some(decodeUserRow(tables, rows[0]))));
@@ -599,6 +1163,48 @@ const findTrustedDevice = (executor, tables, input, operation = "status") => exe
 const findTrustedDeviceIncludingExpired = (executor, tables, input) => executePlan(executor, Query.select(selectTrustedDeviceColumns(tables)).pipe(Query.from(tables.trustedDevice.table), Query.where(queryEq(tables.trustedDevice.select.userId, input.userId)), Query.where(queryEq(tables.trustedDevice.select.tokenHash, input.tokenHash)))).pipe(Effect.mapError((cause) => trustedDeviceStoreError("trust", cause)), Effect.map((rows) => rows[0] === undefined
     ? Option.none()
     : Option.some(decodeTrustedDeviceRow(tables, rows[0]))));
+const findPasskeyCredentialByCredentialId = (executor, tables, credentialId, operation = "find") => executePlan(executor, Query.select(selectPasskeyCredentialColumns(tables)).pipe(Query.from(tables.passkeyCredential.table), Query.where(queryEq(tables.passkeyCredential.select.credentialId, credentialId)))).pipe(Effect.mapError((cause) => passkeyCredentialStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodePasskeyCredentialRow(tables, rows[0]))));
+const findTotpFactorById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectTotpFactorColumns(tables)).pipe(Query.from(tables.totpFactor.table), Query.where(queryEq(tables.totpFactor.select.id, id)))).pipe(Effect.mapError((cause) => totpFactorStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeTotpFactorRow(tables, rows[0]))));
+const findRecoveryCodeById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectRecoveryCodeColumns(tables)).pipe(Query.from(tables.recoveryCode.table), Query.where(queryEq(tables.recoveryCode.select.id, id)))).pipe(Effect.mapError((cause) => recoveryCodeStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeRecoveryCodeRow(tables, rows[0]))));
+const findApiKeyById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectApiKeyColumns(tables)).pipe(Query.from(tables.apiKey.table), Query.where(queryEq(tables.apiKey.select.id, id)))).pipe(Effect.mapError((cause) => apiKeyStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeApiKeyRow(tables, rows[0]))));
+const findApiKeyByPrefix = (executor, tables, prefix, operation = "find") => executePlan(executor, Query.select(selectApiKeyColumns(tables)).pipe(Query.from(tables.apiKey.table), Query.where(queryEq(tables.apiKey.select.prefix, prefix)))).pipe(Effect.mapError((cause) => apiKeyStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeApiKeyRow(tables, rows[0]))));
+const findRefreshTokenById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectRefreshTokenColumns(tables)).pipe(Query.from(tables.refreshToken.table), Query.where(queryEq(tables.refreshToken.select.id, id)))).pipe(Effect.mapError((cause) => refreshTokenStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeRefreshTokenRow(tables, rows[0]))));
+const findRefreshTokenBySecretHash = (executor, tables, hash, operation = "find") => executePlan(executor, Query.select(selectRefreshTokenColumns(tables)).pipe(Query.from(tables.refreshToken.table), Query.where(queryEq(tables.refreshToken.select.secretHash, hash)))).pipe(Effect.mapError((cause) => refreshTokenStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeRefreshTokenRow(tables, rows[0]))));
+const findOAuthAccountById = (executor, tables, id, operation = "find") => executePlan(executor, Query.select(selectOAuthAccountColumns(tables)).pipe(Query.from(tables.oauthAccount.table), Query.where(queryEq(tables.oauthAccount.select.id, id)))).pipe(Effect.mapError((cause) => oauthAccountStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+    ? Option.none()
+    : Option.some(decodeOAuthAccountRow(tables, rows[0]))));
+const findOAuthAccountByProviderAccount = (executor, tables, input, operation = "find") => {
+    const base = Query.select(selectOAuthAccountColumns(tables)).pipe(Query.from(tables.oauthAccount.table), Query.where(queryEq(tables.oauthAccount.select.providerId, input.providerId)), Query.where(queryEq(tables.oauthAccount.select.providerAccountId, input.providerAccountId)));
+    const query = input.includeUnlinked === true
+        ? base
+        : base.pipe(Query.where(queryIsNull(tables.oauthAccount.select.unlinkedAt)));
+    return executePlan(executor, query).pipe(Effect.mapError((cause) => oauthAccountStoreError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+        ? Option.none()
+        : Option.some(decodeOAuthAccountRow(tables, rows[0]))));
+};
+const findOAuthProviderTokenVaultRecordByAccountId = (executor, tables, input, operation, includeRevoked = false) => {
+    const base = Query.select(selectOAuthProviderTokenVaultColumns(tables)).pipe(Query.from(tables.oauthProviderTokenVault.table), Query.where(queryEq(tables.oauthProviderTokenVault.select.accountId, input.accountId)));
+    const query = includeRevoked
+        ? base
+        : base.pipe(Query.where(queryIsNull(tables.oauthProviderTokenVault.select.revokedAt)));
+    return executePlan(executor, query).pipe(Effect.mapError((cause) => oauthProviderTokenVaultError(operation, cause)), Effect.map((rows) => rows[0] === undefined
+        ? Option.none()
+        : Option.some(decodeOAuthProviderTokenVaultRow(tables, rows[0]))));
+};
 export const makeEffectQbSqliteUserStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
     return UserStore.make({
@@ -705,6 +1311,155 @@ export const makeEffectQbSqliteTrustedDeviceStore = (executor, options = {}) =>
             : Effect.fail(trustedDeviceStoreError("trust", "missing row")))),
     });
 };
+export const makeEffectQbSqlitePasskeyCredentialStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return PasskeyCredentialStore.make({
+        insert: (row) => executePlan(executor, queryInsert(tables.passkeyCredential.table, mutationValues(tables.passkeyCredential.insert(row)))).pipe(Effect.mapError((cause) => passkeyCredentialStoreError("insert", cause)), Effect.asVoid),
+        findByCredentialId: (credentialId) => findPasskeyCredentialByCredentialId(executor, tables, credentialId),
+        listByUser: (input) => {
+            const base = Query.select(selectPasskeyCredentialColumns(tables)).pipe(Query.from(tables.passkeyCredential.table), Query.where(queryEq(tables.passkeyCredential.select.userId, input.userId)));
+            const query = input.includeRevoked === true
+                ? base
+                : base.pipe(Query.where(queryIsNull(tables.passkeyCredential.select.revokedAt)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => passkeyCredentialStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodePasskeyCredentialRow(tables, row))));
+        },
+        updateSignCount: (input) => executePlan(executor, queryUpdate(tables.passkeyCredential.table, mutationValues(tables.passkeyCredential.updateSignCount(input))).pipe(Query.where(queryEq(tables.passkeyCredential.select.credentialId, input.credentialId)), Query.where(queryIsNull(tables.passkeyCredential.select.revokedAt)), Query.returning(selectPasskeyCredentialColumns(tables)))).pipe(Effect.mapError((cause) => passkeyCredentialStoreError("update-sign-count", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodePasskeyCredentialRow(tables, rows[0])))),
+        revoke: (input) => findPasskeyCredentialByCredentialId(executor, tables, input.credentialId, "revoke").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.void;
+            }
+            return executePlan(executor, queryUpdate(tables.passkeyCredential.table, mutationValues(tables.passkeyCredential.revoke(input, row.value))).pipe(Query.where(queryEq(tables.passkeyCredential.select.credentialId, input.credentialId)))).pipe(Effect.mapError((cause) => passkeyCredentialStoreError("revoke", cause)), Effect.asVoid);
+        })),
+    });
+};
+export const makeEffectQbSqliteTotpFactorStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return TotpFactorStore.make({
+        insert: (row) => executePlan(executor, queryInsert(tables.totpFactor.table, mutationValues(tables.totpFactor.insert(row)))).pipe(Effect.mapError((cause) => totpFactorStoreError("insert", cause)), Effect.asVoid),
+        findById: (id) => findTotpFactorById(executor, tables, id),
+        listByUser: (input) => {
+            const byUser = Query.select(selectTotpFactorColumns(tables)).pipe(Query.from(tables.totpFactor.table), Query.where(queryEq(tables.totpFactor.select.userId, input.userId)));
+            const byRevoked = input.includeRevoked === true
+                ? byUser
+                : byUser.pipe(Query.where(queryIsNull(tables.totpFactor.select.revokedAt)));
+            const query = input.includeUnconfirmed === true
+                ? byRevoked
+                : byRevoked.pipe(Query.where(queryGt(tables.totpFactor.select.confirmedAt, 0)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => totpFactorStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeTotpFactorRow(tables, row))));
+        },
+        confirm: (input) => executePlan(executor, queryUpdate(tables.totpFactor.table, mutationValues(tables.totpFactor.confirm(input))).pipe(Query.where(queryEq(tables.totpFactor.select.id, input.id)), Query.where(queryIsNull(tables.totpFactor.select.revokedAt)), Query.returning(selectTotpFactorColumns(tables)))).pipe(Effect.mapError((cause) => totpFactorStoreError("confirm", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeTotpFactorRow(tables, rows[0])))),
+        markUsed: (input) => executePlan(executor, queryUpdate(tables.totpFactor.table, mutationValues(tables.totpFactor.markUsed(input))).pipe(Query.where(queryEq(tables.totpFactor.select.id, input.id)), Query.where(queryIsNull(tables.totpFactor.select.revokedAt)), Query.where(queryGt(tables.totpFactor.select.confirmedAt, 0)), Query.returning(selectTotpFactorColumns(tables)))).pipe(Effect.mapError((cause) => totpFactorStoreError("mark-used", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeTotpFactorRow(tables, rows[0])))),
+        revoke: (input) => findTotpFactorById(executor, tables, input.id, "revoke").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.void;
+            }
+            return executePlan(executor, queryUpdate(tables.totpFactor.table, mutationValues(tables.totpFactor.revoke(input, row.value))).pipe(Query.where(queryEq(tables.totpFactor.select.id, input.id)))).pipe(Effect.mapError((cause) => totpFactorStoreError("revoke", cause)), Effect.asVoid);
+        })),
+    });
+};
+export const makeEffectQbSqliteRecoveryCodeStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return RecoveryCodeStore.make({
+        insertMany: (rows) => Effect.forEach(rows, (row) => executePlan(executor, queryInsert(tables.recoveryCode.table, mutationValues(tables.recoveryCode.insert(row)))).pipe(Effect.mapError((cause) => recoveryCodeStoreError("insert", cause)), Effect.asVoid), { discard: true }),
+        findById: (id) => findRecoveryCodeById(executor, tables, id),
+        listByUser: (input) => {
+            const byUser = Query.select(selectRecoveryCodeColumns(tables)).pipe(Query.from(tables.recoveryCode.table), Query.where(queryEq(tables.recoveryCode.select.userId, input.userId)));
+            const byUsed = input.includeUsed === true
+                ? byUser
+                : byUser.pipe(Query.where(queryIsNull(tables.recoveryCode.select.usedAt)));
+            const query = input.includeRevoked === true
+                ? byUsed
+                : byUsed.pipe(Query.where(queryIsNull(tables.recoveryCode.select.revokedAt)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => recoveryCodeStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeRecoveryCodeRow(tables, row))));
+        },
+        markUsed: (input) => executePlan(executor, queryUpdate(tables.recoveryCode.table, mutationValues(tables.recoveryCode.markUsed(input))).pipe(Query.where(queryEq(tables.recoveryCode.select.id, input.id)), Query.where(queryIsNull(tables.recoveryCode.select.usedAt)), Query.where(queryIsNull(tables.recoveryCode.select.revokedAt)), Query.returning({ id: tables.recoveryCode.select.id }))).pipe(Effect.mapError((cause) => recoveryCodeStoreError("mark-used", cause)), Effect.flatMap((rows) => rows[0] === undefined
+            ? Effect.succeed(Option.none())
+            : findRecoveryCodeById(executor, tables, input.id, "mark-used"))),
+        revoke: (input) => findRecoveryCodeById(executor, tables, input.id, "revoke").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.void;
+            }
+            return executePlan(executor, queryUpdate(tables.recoveryCode.table, mutationValues(tables.recoveryCode.revoke(input, row.value))).pipe(Query.where(queryEq(tables.recoveryCode.select.id, input.id)))).pipe(Effect.mapError((cause) => recoveryCodeStoreError("revoke", cause)), Effect.asVoid);
+        })),
+    });
+};
+export const makeEffectQbSqliteApiKeyStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return ApiKeyStore.make({
+        insert: (row) => executePlan(executor, queryInsert(tables.apiKey.table, mutationValues(tables.apiKey.insert(row)))).pipe(Effect.mapError((cause) => apiKeyStoreError("insert", cause)), Effect.asVoid),
+        findById: (id) => findApiKeyById(executor, tables, id),
+        findByPrefix: (prefix) => findApiKeyByPrefix(executor, tables, prefix),
+        listByUser: (input) => {
+            const base = Query.select(selectApiKeyColumns(tables)).pipe(Query.from(tables.apiKey.table), Query.where(queryEq(tables.apiKey.select.userId, input.userId)));
+            const query = input.includeRevoked === true
+                ? base
+                : base.pipe(Query.where(queryIsNull(tables.apiKey.select.revokedAt)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => apiKeyStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeApiKeyRow(tables, row))));
+        },
+        markUsed: (input) => executePlan(executor, queryUpdate(tables.apiKey.table, mutationValues(tables.apiKey.markUsed(input))).pipe(Query.where(queryEq(tables.apiKey.select.id, input.id)), Query.where(queryIsNull(tables.apiKey.select.revokedAt)), Query.returning(selectApiKeyColumns(tables)))).pipe(Effect.mapError((cause) => apiKeyStoreError("mark-used", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeApiKeyRow(tables, rows[0])))),
+        revoke: (input) => findApiKeyById(executor, tables, input.id, "revoke").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.void;
+            }
+            return executePlan(executor, queryUpdate(tables.apiKey.table, mutationValues(tables.apiKey.revoke(input, row.value))).pipe(Query.where(queryEq(tables.apiKey.select.id, input.id)))).pipe(Effect.mapError((cause) => apiKeyStoreError("revoke", cause)), Effect.asVoid);
+        })),
+    });
+};
+export const makeEffectQbSqliteRefreshTokenStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return RefreshTokenStore.make({
+        insert: (row) => executePlan(executor, queryInsert(tables.refreshToken.table, mutationValues(tables.refreshToken.insert(row)))).pipe(Effect.mapError((cause) => refreshTokenStoreError("insert", cause)), Effect.asVoid),
+        findById: (id) => findRefreshTokenById(executor, tables, id),
+        findBySecretHash: (hash) => findRefreshTokenBySecretHash(executor, tables, hash),
+        listByUser: (input) => {
+            const base = Query.select(selectRefreshTokenColumns(tables)).pipe(Query.from(tables.refreshToken.table), Query.where(queryEq(tables.refreshToken.select.userId, input.userId)));
+            const query = input.includeRevoked === true
+                ? base
+                : base.pipe(Query.where(queryIsNull(tables.refreshToken.select.revokedAt)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => refreshTokenStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeRefreshTokenRow(tables, row))));
+        },
+        listByFamily: (input) => {
+            const base = Query.select(selectRefreshTokenColumns(tables)).pipe(Query.from(tables.refreshToken.table), Query.where(queryEq(tables.refreshToken.select.familyId, input.familyId)));
+            const query = input.includeRevoked === true
+                ? base
+                : base.pipe(Query.where(queryIsNull(tables.refreshToken.select.revokedAt)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => refreshTokenStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeRefreshTokenRow(tables, row))));
+        },
+        rotate: (input) => executePlan(executor, queryUpdate(tables.refreshToken.table, mutationValues(tables.refreshToken.rotate(input))).pipe(Query.where(queryEq(tables.refreshToken.select.id, input.id)), Query.where(queryIsNull(tables.refreshToken.select.rotatedAt)), Query.where(queryIsNull(tables.refreshToken.select.revokedAt)), Query.returning({ id: tables.refreshToken.select.id }))).pipe(Effect.mapError((cause) => refreshTokenStoreError("rotate", cause)), Effect.flatMap((rows) => {
+            const [updated] = rows;
+            if (updated === undefined) {
+                return Effect.succeed(Option.none());
+            }
+            return findRefreshTokenById(executor, tables, RefreshTokenId(updated.id), "rotate").pipe(Effect.flatMap((previous) => {
+                if (Option.isNone(previous)) {
+                    return Effect.succeed(Option.none());
+                }
+                return executePlan(executor, queryInsert(tables.refreshToken.table, mutationValues(tables.refreshToken.insert(input.replacement)))).pipe(Effect.mapError((cause) => refreshTokenStoreError("rotate", cause)), Effect.as(Option.some({
+                    previous: previous.value,
+                    replacement: input.replacement,
+                })));
+            }));
+        })),
+        markReuseDetected: (input) => executePlan(executor, queryUpdate(tables.refreshToken.table, mutationValues(tables.refreshToken.markReuseDetected(input))).pipe(Query.where(queryEq(tables.refreshToken.select.id, input.id)), Query.returning(selectRefreshTokenColumns(tables)))).pipe(Effect.mapError((cause) => refreshTokenStoreError("reuse", cause)), Effect.map((rows) => rows[0] === undefined
+            ? Option.none()
+            : Option.some(decodeRefreshTokenRow(tables, rows[0])))),
+        revoke: (input) => findRefreshTokenById(executor, tables, input.id, "revoke").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.void;
+            }
+            return executePlan(executor, queryUpdate(tables.refreshToken.table, mutationValues(tables.refreshToken.revoke(input, row.value))).pipe(Query.where(queryEq(tables.refreshToken.select.id, input.id)))).pipe(Effect.mapError((cause) => refreshTokenStoreError("revoke", cause)), Effect.asVoid);
+        })),
+        revokeFamily: (input) => executePlan(executor, Query.select(selectRefreshTokenColumns(tables)).pipe(Query.from(tables.refreshToken.table), Query.where(queryEq(tables.refreshToken.select.familyId, input.familyId)))).pipe(Effect.mapError((cause) => refreshTokenStoreError("revoke", cause)), Effect.flatMap((rows) => Effect.forEach(rows.map((row) => decodeRefreshTokenRow(tables, row)), (row) => executePlan(executor, queryUpdate(tables.refreshToken.table, mutationValues(tables.refreshToken.revokeFamily(input, row))).pipe(Query.where(queryEq(tables.refreshToken.select.id, row.id)))).pipe(Effect.mapError((cause) => refreshTokenStoreError("revoke", cause)), Effect.asVoid), { discard: true }))),
+    });
+};
 export const makeEffectQbSqliteJwtRevocationStore = (executor, options = {}) => {
     const tables = options.tables ?? authSqliteTables;
     return JwtRevocationStore.make({
@@ -719,6 +1474,57 @@ export const makeEffectQbSqliteJwtRevocationStore = (executor, options = {}) =>
         find: (jwtId) => findJwtRevocation(executor, tables, jwtId),
     });
 };
+export const makeEffectQbSqliteOAuthAccountStore = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return OAuthAccountStore.make({
+        insert: (row) => executePlan(executor, queryInsert(tables.oauthAccount.table, mutationValues(tables.oauthAccount.insert(row)))).pipe(Effect.mapError((cause) => oauthAccountStoreError("insert", cause)), Effect.asVoid),
+        findById: (id) => findOAuthAccountById(executor, tables, id),
+        findByProviderAccount: (input) => findOAuthAccountByProviderAccount(executor, tables, input),
+        listByUser: (input) => {
+            const base = Query.select(selectOAuthAccountColumns(tables)).pipe(Query.from(tables.oauthAccount.table), Query.where(queryEq(tables.oauthAccount.select.userId, input.userId)));
+            const query = input.includeUnlinked === true
+                ? base
+                : base.pipe(Query.where(queryIsNull(tables.oauthAccount.select.unlinkedAt)));
+            return executePlan(executor, query).pipe(Effect.mapError((cause) => oauthAccountStoreError("list", cause)), Effect.map((rows) => rows.map((row) => decodeOAuthAccountRow(tables, row))));
+        },
+        unlink: (input) => findOAuthAccountByProviderAccount(executor, tables, {
+            providerId: input.providerId,
+            providerAccountId: input.providerAccountId,
+        }, "unlink").pipe(Effect.flatMap((row) => {
+            if (Option.isNone(row)) {
+                return Effect.succeed(Option.none());
+            }
+            return executePlan(executor, queryUpdate(tables.oauthAccount.table, mutationValues(tables.oauthAccount.unlink(input, row.value))).pipe(Query.where(queryEq(tables.oauthAccount.select.id, row.value.id)), Query.returning(selectOAuthAccountColumns(tables)))).pipe(Effect.mapError((cause) => oauthAccountStoreError("unlink", cause)), Effect.map((rows) => rows[0] === undefined
+                ? Option.none()
+                : Option.some(decodeOAuthAccountRow(tables, rows[0]))));
+        })),
+    });
+};
+export const makeEffectQbSqliteOAuthProviderTokenVault = (executor, options = {}) => {
+    const tables = options.tables ?? authSqliteTables;
+    return OAuthProviderTokenVault.make({
+        upsert: (record) => findOAuthProviderTokenVaultRecordByAccountId(executor, tables, { accountId: record.accountId }, "upsert", true).pipe(Effect.flatMap((existing) => Option.isNone(existing)
+            ? executePlan(executor, queryInsert(tables.oauthProviderTokenVault.table, mutationValues(tables.oauthProviderTokenVault.insert(record))))
+            : executePlan(executor, queryUpdate(tables.oauthProviderTokenVault.table, mutationValues(tables.oauthProviderTokenVault.update(record))).pipe(Query.where(queryEq(tables.oauthProviderTokenVault.select.accountId, record.accountId))))), Effect.mapError((cause) => cause instanceof OAuthProviderTokenVaultError
+            ? cause
+            : oauthProviderTokenVaultError("upsert", cause)), Effect.asVoid),
+        refreshTokenForAccount: (input) => findOAuthProviderTokenVaultRecordByAccountId(executor, tables, input, "refresh-token").pipe(Effect.map((row) => Option.isNone(row) || row.value.refreshTokenCiphertext === undefined
+            ? Option.none()
+            : Option.some(row.value.refreshTokenCiphertext))),
+        tokensForAccount: (input) => findOAuthProviderTokenVaultRecordByAccountId(executor, tables, input, "tokens").pipe(Effect.map((row) => Option.isNone(row)
+            ? Option.none()
+            : Option.some(providerTokenVaultTokens(row.value)))),
+        markRevoked: (input) => executePlan(executor, queryUpdate(tables.oauthProviderTokenVault.table, mutationValues(tables.oauthProviderTokenVault.markRevoked(input))).pipe(Query.where(queryEq(tables.oauthProviderTokenVault.select.accountId, input.accountId)), Query.returning({
+            accountId: tables.oauthProviderTokenVault.select.accountId,
+        }))).pipe(Effect.mapError((cause) => oauthProviderTokenVaultError("mark-revoked", cause)), Effect.flatMap((rows) => {
+            const [updated] = rows;
+            if (updated === undefined) {
+                return Effect.succeed(Option.none());
+            }
+            return findOAuthProviderTokenVaultRecordByAccountId(executor, tables, { accountId: OAuthAccountId(updated.accountId) }, "mark-revoked", true);
+        })),
+    });
+};
 export const makeEffectQbSqliteStorage = (executor, options = {}) => ({
     userStore: makeEffectQbSqliteUserStore(executor, options),
     credentialStore: makeEffectQbSqliteCredentialStore(executor, options),
@@ -726,9 +1532,16 @@ export const makeEffectQbSqliteStorage = (executor, options = {}) => ({
     verificationStore: makeEffectQbSqliteVerificationStore(executor, options),
     loginApprovalReviewStore: makeEffectQbSqliteLoginApprovalReviewStore(executor, options),
     trustedDeviceStore: makeEffectQbSqliteTrustedDeviceStore(executor, options),
+    passkeyCredentialStore: makeEffectQbSqlitePasskeyCredentialStore(executor, options),
+    totpFactorStore: makeEffectQbSqliteTotpFactorStore(executor, options),
+    recoveryCodeStore: makeEffectQbSqliteRecoveryCodeStore(executor, options),
+    apiKeyStore: makeEffectQbSqliteApiKeyStore(executor, options),
+    refreshTokenStore: makeEffectQbSqliteRefreshTokenStore(executor, options),
     jwtRevocationStore: makeEffectQbSqliteJwtRevocationStore(executor, options),
+    oauthAccountStore: makeEffectQbSqliteOAuthAccountStore(executor, options),
+    oauthProviderTokenVault: makeEffectQbSqliteOAuthProviderTokenVault(executor, options),
 });
-export const EffectQbSqliteAuthStorageLive = (executor, options = {}) => Layer.mergeAll(Layer.succeed(UserStore)(makeEffectQbSqliteUserStore(executor, options)), Layer.succeed(CredentialStore)(makeEffectQbSqliteCredentialStore(executor, options)), Layer.succeed(SessionStore)(makeEffectQbSqliteSessionStore(executor, options)), Layer.succeed(VerificationStore)(makeEffectQbSqliteVerificationStore(executor, options)), Layer.succeed(LoginApprovalReviewStore)(makeEffectQbSqliteLoginApprovalReviewStore(executor, options)), Layer.succeed(TrustedDeviceStore)(makeEffectQbSqliteTrustedDeviceStore(executor, options)), Layer.succeed(JwtRevocationStore)(makeEffectQbSqliteJwtRevocationStore(executor, options)));
+export const EffectQbSqliteAuthStorageLive = (executor, options = {}) => Layer.mergeAll(Layer.succeed(UserStore)(makeEffectQbSqliteUserStore(executor, options)), Layer.succeed(CredentialStore)(makeEffectQbSqliteCredentialStore(executor, options)), Layer.succeed(SessionStore)(makeEffectQbSqliteSessionStore(executor, options)), Layer.succeed(VerificationStore)(makeEffectQbSqliteVerificationStore(executor, options)), Layer.succeed(LoginApprovalReviewStore)(makeEffectQbSqliteLoginApprovalReviewStore(executor, options)), Layer.succeed(TrustedDeviceStore)(makeEffectQbSqliteTrustedDeviceStore(executor, options)), Layer.succeed(PasskeyCredentialStore)(makeEffectQbSqlitePasskeyCredentialStore(executor, options)), Layer.succeed(TotpFactorStore)(makeEffectQbSqliteTotpFactorStore(executor, options)), Layer.succeed(RecoveryCodeStore)(makeEffectQbSqliteRecoveryCodeStore(executor, options)), Layer.succeed(ApiKeyStore)(makeEffectQbSqliteApiKeyStore(executor, options)), Layer.succeed(RefreshTokenStore)(makeEffectQbSqliteRefreshTokenStore(executor, options)), Layer.succeed(JwtRevocationStore)(makeEffectQbSqliteJwtRevocationStore(executor, options)), Layer.succeed(OAuthAccountStore)(makeEffectQbSqliteOAuthAccountStore(executor, options)), Layer.succeed(OAuthProviderTokenVault)(makeEffectQbSqliteOAuthProviderTokenVault(executor, options)));
 export const makeD1EffectQbSqliteExecutor = (database) => Executor.make({
     driver: Executor.driver((query) => Effect.tryPromise({
         try: () => database