@sixb/pg 0.1.6 → 0.1.8

package/src/agents/runs.ts

@@ -1,4 +1,10 @@
-import { assertAgentRunExecution } from "@sixb/core/internal/agent-run-storage-provider"
+import {
+  assertAgentRunExecution,
+  assertConversationAgentRunSpec,
+  assertCreateSubagentRunInput,
+  assertSubagentRunResult,
+  subagentRunMatchesCreateInput,
+} from "@sixb/core/internal/agent-run-storage-provider"
 import { normalizeRequesterGroupIds } from "@sixb/core/internal/auth"
 import { serializeSixbFailure } from "@sixb/core/internal/errors"
 import {
@@ -7,7 +13,9 @@ import {
   type AgentRunStore,
   AgentStorageError,
   type ConfirmAgentRunExecutionOwnershipInput,
+  type ConversationAgentRunRecord,
   type CreateAgentRunInput,
+  type CreateSubagentRunInput,
   type ExecutionStorage,
   type FinishAgentRunInput,
   type FinishQueuedAgentRunInput,
@@ -15,6 +23,7 @@ import {
   type ListAgentRunsResult,
   type ReclaimAgentRunInput,
   type StartAgentRunInput,
+  type SubagentRunRecord,
 } from "@sixb/core/storage"
 import type { SQLClient, SqlParameter } from "../pg-client"
 import { appendRunListFilters, hasEmptyStatuses, queryRunList } from "../run-list-query"
@@ -30,14 +39,14 @@ export class PgAgentRunStore implements AgentRunStore {
     private readonly executions: ExecutionStorage
   ) {}
 
-  async create(input: CreateAgentRunInput): Promise<AgentRunRecord> {
+  async create(input: CreateAgentRunInput): Promise<ConversationAgentRunRecord> {
+    assertConversationAgentRunSpec(input.spec, "SixbPg")
     const createdAt = input.createdAt ?? new Date()
     await assertAgentRunExecution({
       executions: this.executions,
       projectId: input.projectId,
       executionId: input.executionId,
       runId: input.id,
-      agentId: input.agentId,
     })
 
     try {
@@ -54,7 +63,6 @@ export class PgAgentRunStore implements AgentRunStore {
             `[SixbPg] Agent thread '${input.threadId}' not found for project '${input.projectId}'.`
           )
         }
-
         if (thread.active_run_id !== null) {
           throw new AgentStorageError(
             "active_run_exists",
@@ -67,9 +75,10 @@ export class PgAgentRunStore implements AgentRunStore {
             project_id,
             id,
             execution_id,
+            kind,
             thread_id,
-            agent_id,
             trigger_message_id,
+            spec,
             requester_group_ids,
             status,
             attempt,
@@ -78,9 +87,10 @@ export class PgAgentRunStore implements AgentRunStore {
             ${input.projectId},
             ${input.id},
             ${input.executionId},
+            ${"conversation"},
             ${input.threadId},
-            ${input.agentId},
             ${input.triggerMessageId},
+            ${JSON.stringify(input.spec)}::text::jsonb,
             ${JSON.stringify(normalizeRequesterGroupIds(input.requesterGroupIds))}::text::jsonb,
             ${"queued"},
             ${0},
@@ -94,7 +104,11 @@ export class PgAgentRunStore implements AgentRunStore {
           WHERE project_id = ${input.projectId} AND id = ${input.threadId}
         `
 
-        return rowToRunRecord(row)
+        const created = rowToRunRecord(row)
+        if (created.kind !== "conversation") {
+          throw new Error(`[SixbPg] Agent run insert '${input.id}' returned the wrong run kind.`)
+        }
+        return created
       })
     } catch (error) {
       if (isUniqueViolation(error)) {
@@ -108,6 +122,108 @@ export class PgAgentRunStore implements AgentRunStore {
     }
   }
 
+  async createSubagent(input: CreateSubagentRunInput): Promise<SubagentRunRecord> {
+    assertCreateSubagentRunInput(input, "SixbPg")
+    const execution = await assertAgentRunExecution({
+      executions: this.executions,
+      projectId: input.projectId,
+      executionId: input.executionId,
+      runId: input.id,
+    })
+
+    try {
+      return await runPgTransaction(this.sql, async (tx) => {
+        const [parent] = await tx<AgentRunRow[]>`
+          SELECT * FROM agent_runs
+          WHERE project_id = ${input.projectId} AND id = ${input.parentRunId}
+          FOR UPDATE
+        `
+        if (!parent || parent.kind !== "conversation") {
+          throw new AgentStorageError(
+            "run_not_found",
+            `[SixbPg] Parent Agent run '${input.parentRunId}' was not found.`
+          )
+        }
+
+        const [existingRow] = await tx<AgentRunRow[]>`
+          SELECT * FROM agent_runs
+          WHERE project_id = ${input.projectId} AND id = ${input.id}
+        `
+        if (existingRow) {
+          const existing = rowToRunRecord(existingRow)
+          if (subagentRunMatchesCreateInput(existing, input)) return existing
+          throw new AgentStorageError(
+            "duplicate_id",
+            `[SixbPg] Subagent run '${input.id}' already exists with different immutable inputs.`
+          )
+        }
+        if (parent.status !== "running") {
+          throw new AgentStorageError(
+            "invalid_state",
+            `[SixbPg] Parent Agent run '${parent.id}' is not running (status '${parent.status}').`
+          )
+        }
+        if (
+          execution.source.type !== "execution" ||
+          execution.source.executionId !== parent.execution_id
+        ) {
+          throw new AgentStorageError(
+            "invalid_input",
+            `[SixbPg] Subagent execution '${execution.id}' is not a child of parent execution '${parent.execution_id}'.`
+          )
+        }
+        if (parent.execution_token !== input.parentExecutionToken) {
+          throw new AgentStorageError(
+            "execution_lost",
+            `[SixbPg] Parent Agent run '${parent.id}' is no longer owned by this execution.`
+          )
+        }
+        const parentRecord = rowToRunRecord(parent)
+
+        const [countRow] = await tx<{ count: string | number }[]>`
+          SELECT COUNT(*)::bigint AS count FROM agent_runs
+          WHERE project_id = ${input.projectId}
+            AND parent_run_id = ${input.parentRunId}
+            AND status IN (${"queued"}, ${"running"})
+        `
+        const activeChildren = Number(countRow?.count ?? 0)
+        if (activeChildren >= input.maxActiveChildren) {
+          throw new AgentStorageError(
+            "active_child_limit",
+            `[SixbPg] Agent run '${parent.id}' already has ${activeChildren} active subagents.`
+          )
+        }
+
+        const [row] = await tx<AgentRunRow[]>`
+          INSERT INTO agent_runs (
+            project_id, id, execution_id, kind, parent_run_id, spawn_key, spec,
+            requester_group_ids, status, attempt, created_at
+          ) VALUES (
+            ${input.projectId}, ${input.id}, ${input.executionId}, ${"subagent"},
+            ${input.parentRunId}, ${input.spawnKey},
+            ${JSON.stringify(input.spec)}::text::jsonb,
+            ${JSON.stringify(parentRecord.requesterGroupIds)}::text::jsonb,
+            ${"queued"}, ${0}, ${input.createdAt ?? new Date()}
+          )
+          RETURNING *
+        `
+        const created = rowToRunRecord(row)
+        if (created.kind !== "subagent") {
+          throw new Error(`[SixbPg] Subagent insert '${input.id}' returned the wrong run kind.`)
+        }
+        return created
+      })
+    } catch (error) {
+      if (isUniqueViolation(error)) {
+        throw new AgentStorageError(
+          "duplicate_id",
+          `[SixbPg] Subagent run '${input.id}' conflicts with an existing durable spawn.`
+        )
+      }
+      throw error
+    }
+  }
+
   async start(input: StartAgentRunInput): Promise<AgentRunRecord> {
     const startedAt = input.startedAt ?? new Date()
     return runPgTransaction(this.sql, async (tx) => {
@@ -198,6 +314,20 @@ export class PgAgentRunStore implements AgentRunStore {
     return runPgTransaction(this.sql, async (tx) => {
       const run = await this.lockRunning(tx, input.projectId, input.id)
 
+      if (input.status === "succeeded" && run.kind === "subagent") {
+        assertSubagentRunResult(input.result, run.id, "SixbPg")
+      }
+      if (
+        input.status === "succeeded" &&
+        run.kind === "conversation" &&
+        input.result !== undefined
+      ) {
+        throw new AgentStorageError(
+          "invalid_input",
+          `[SixbPg] Conversational Agent run '${run.id}' cannot persist a subagent result.`
+        )
+      }
+
       if (run.execution_token !== input.executionToken) {
         throw new AgentStorageError(
           "execution_lost",
@@ -213,6 +343,7 @@ export class PgAgentRunStore implements AgentRunStore {
           finish_reason = ${input.finishReason ?? null},
           error = ${errorValue}::text::jsonb,
           diagnostics = ${input.diagnostics === undefined ? null : JSON.stringify(input.diagnostics)}::text::jsonb,
+          result = ${input.status === "succeeded" && input.result !== undefined ? JSON.stringify(input.result) : null}::text::jsonb,
           execution_token = ${null},
           execution_queue_lease_expires_at = ${null},
           completed_at = ${completedAt}
@@ -262,7 +393,7 @@ export class PgAgentRunStore implements AgentRunStore {
   }
 
   async list(input: ListAgentRunsInput): Promise<ListAgentRunsResult> {
-    if (hasEmptyStatuses(input)) {
+    if (hasEmptyStatuses(input) || input.kinds?.length === 0) {
       return { runs: [], hasMore: false, total: 0 }
     }
 
@@ -270,14 +401,19 @@ export class PgAgentRunStore implements AgentRunStore {
     const params: SqlParameter[] = [input.projectId]
     let index = 2
 
+    if (input.kinds) {
+      whereClauses.push(`kind = ANY($${index++}::text[])`)
+      params.push(input.kinds as string[])
+    }
+
     if (input.threadId) {
       whereClauses.push(`thread_id = $${index++}`)
       params.push(input.threadId)
     }
 
-    if (input.agentId) {
-      whereClauses.push(`agent_id = $${index++}`)
-      params.push(input.agentId)
+    if (input.parentRunId) {
+      whereClauses.push(`parent_run_id = $${index++}`)
+      params.push(input.parentRunId)
     }
 
     index = appendRunListFilters(
@@ -336,6 +472,7 @@ export class PgAgentRunStore implements AgentRunStore {
   }
 
   private async releaseThread(sql: SQLClient, run: AgentRunRow, completedAt: Date): Promise<void> {
+    if (run.kind !== "conversation") return
     await sql`
       UPDATE agent_threads SET active_run_id = ${null}, updated_at = ${completedAt}
       WHERE project_id = ${run.project_id} AND id = ${run.thread_id} AND active_run_id = ${run.id}

package/src/agents/threads.ts

@@ -23,7 +23,6 @@ export class PgAgentThreadStore implements AgentThreadStore {
         INSERT INTO agent_threads (
           project_id,
           id,
-          agent_id,
           owner_principal_type,
           owner_principal_id,
           title,
@@ -33,7 +32,6 @@ export class PgAgentThreadStore implements AgentThreadStore {
         ) VALUES (
           ${input.projectId},
           ${input.id},
-          ${input.agentId},
           ${input.ownerPrincipal.type},
           ${input.ownerPrincipal.id},
           ${input.title ?? null},
@@ -66,10 +64,7 @@ export class PgAgentThreadStore implements AgentThreadStore {
   }
 
   async list(input: ListAgentThreadsInput): Promise<ListAgentThreadsResult> {
-    if (
-      (input.statuses !== undefined && input.statuses.length === 0) ||
-      (input.agentIds !== undefined && input.agentIds.length === 0)
-    ) {
+    if (input.statuses !== undefined && input.statuses.length === 0) {
       return { threads: [], hasMore: false, total: 0 }
     }
 
@@ -77,17 +72,6 @@ export class PgAgentThreadStore implements AgentThreadStore {
     const params: SqlParameter[] = [input.projectId]
     let index = 2
 
-    if (input.agentId) {
-      whereClauses.push(`agent_id = $${index++}`)
-      params.push(input.agentId)
-    }
-
-    if (input.agentIds) {
-      const placeholders = input.agentIds.map(() => `$${index++}`)
-      whereClauses.push(`agent_id IN (${placeholders.join(", ")})`)
-      params.push(...input.agentIds)
-    }
-
     if (input.statuses) {
       const placeholders = input.statuses.map(() => `$${index++}`)
       whereClauses.push(`status IN (${placeholders.join(", ")})`)

package/src/ai-cost-groups.ts

@@ -0,0 +1,102 @@
+import {
+  type AiModelCallGroupRow,
+  aiModelCallGroupFragmentFromRow,
+  buildAiModelCallGroupsFromFragments,
+  normalizeAiModelCallAccountingQuery,
+} from "@sixb/core/internal/ai-cost-storage-provider"
+import type { ListAiModelCallGroupsInput, ListAiModelCallGroupsResult } from "@sixb/core/storage"
+import type { PgStoreClient } from "./transactions"
+
+/** Paginate initiating executions, then aggregate their matching calls without loading usage payloads. */
+export async function listAiModelCallGroups(
+  sql: PgStoreClient,
+  input: ListAiModelCallGroupsInput
+): Promise<ListAiModelCallGroupsResult> {
+  const query = normalizeAiModelCallAccountingQuery(input)
+  const parameters = [
+    query.projectId,
+    query.from.toISOString(),
+    query.to.toISOString(),
+    query.providerId ?? null,
+    query.modelId ?? null,
+    query.valuationStatus ?? null,
+  ]
+  const [count] = await sql.unsafe<{ total: string }[]>(COUNT_SQL, parameters)
+  const rows = await sql.unsafe<AiModelCallGroupRow[]>(PAGE_SQL, [
+    ...parameters,
+    query.limit,
+    query.offset,
+  ])
+  const total = Number(count?.total)
+  if (!Number.isSafeInteger(total) || total < 0)
+    throw new RangeError("[Sixb] Invalid model-call group count.")
+  const items = buildAiModelCallGroupsFromFragments(rows.map(aiModelCallGroupFragmentFromRow))
+  return { items, total, hasMore: query.offset + items.length < total }
+}
+
+const FILTERED_SQL = `
+WITH filtered AS (
+  SELECT COALESCE(root_agent.execution_id, usage.execution_id) AS root_execution_id,
+    usage.execution_id, usage.provider_id, usage.requested_model_id, usage.occurred_at,
+    usage.total_tokens,
+    COALESCE(cost.status, 'unvalued') AS valuation_status,
+    cost.currency AS amount_currency, cost.amount_nanos,
+    root_agent.id AS root_agent_run_id,
+    root_agent.thread_id AS root_thread_id,
+    direct_agent.kind AS direct_kind,
+    direct_agent.id AS direct_run_id,
+    direct_agent.parent_run_id AS parent_run_id,
+    workflow_node.node_id AS workflow_agent_step_id,
+    workflow_agent.node_run_id AS workflow_node_run_id,
+    workflow_node.workflow_id AS workflow_id,
+    workflow_node.workflow_run_id AS workflow_run_id
+  FROM ai_model_call_usage AS usage
+  LEFT JOIN agent_runs AS direct_agent
+    ON direct_agent.project_id = usage.project_id AND direct_agent.execution_id = usage.execution_id
+  LEFT JOIN agent_runs AS root_agent
+    ON root_agent.project_id = usage.project_id
+    AND root_agent.id = COALESCE(direct_agent.parent_run_id, direct_agent.id)
+  LEFT JOIN workflow_agent_node_runs AS workflow_agent
+    ON workflow_agent.project_id = usage.project_id AND workflow_agent.execution_id = usage.execution_id
+  LEFT JOIN workflow_node_runs AS workflow_node
+    ON workflow_node.project_id = workflow_agent.project_id AND workflow_node.id = workflow_agent.node_run_id
+  LEFT JOIN ai_model_call_valuations AS cost
+    ON cost.project_id = usage.project_id AND cost.usage_record_id = usage.id
+  WHERE usage.project_id = $1
+    AND usage.occurred_at >= $2::timestamptz
+    AND usage.occurred_at < $3::timestamptz
+    AND ($4::text IS NULL OR usage.provider_id = $4)
+    AND ($5::text IS NULL OR usage.requested_model_id = $5)
+    AND ($6::text IS NULL OR COALESCE(cost.status, 'unvalued') = $6)
+), roots AS (
+  SELECT root_execution_id, MAX(occurred_at) AS last_call_at
+  FROM filtered GROUP BY root_execution_id
+)
+`
+const COUNT_SQL = `${FILTERED_SQL} SELECT CAST(COUNT(*) AS TEXT) AS total FROM roots`
+const PAGE_SQL = `${FILTERED_SQL}, page AS (
+  SELECT root_execution_id FROM roots
+  ORDER BY last_call_at DESC, root_execution_id COLLATE "C" ASC LIMIT $7 OFFSET $8
+)
+SELECT filtered.root_execution_id, execution_id, provider_id, requested_model_id,
+  MIN(occurred_at) AS first_call_at, MAX(occurred_at) AS last_call_at,
+  CAST(COUNT(*) AS TEXT) AS call_count,
+  CAST(COUNT(total_tokens) AS TEXT) AS token_count,
+  CAST(SUM(total_tokens) AS TEXT) AS total_tokens,
+  valuation_status, amount_currency,
+  CAST(SUM(amount_nanos / 1000000000000) AS TEXT) AS amount_high,
+  CAST(SUM((amount_nanos / 1000000) % 1000000) AS TEXT) AS amount_middle,
+  CAST(SUM(amount_nanos % 1000000) AS TEXT) AS amount_low,
+  MAX(root_agent_run_id) AS root_agent_run_id,
+  MAX(root_thread_id) AS root_thread_id,
+  MAX(direct_kind) AS direct_kind,
+  MAX(direct_run_id) AS direct_run_id,
+  MAX(parent_run_id) AS parent_run_id,
+  MAX(workflow_agent_step_id) AS workflow_agent_step_id,
+  MAX(workflow_node_run_id) AS workflow_node_run_id,
+  MAX(workflow_id) AS workflow_id,
+  MAX(workflow_run_id) AS workflow_run_id
+FROM filtered JOIN page ON page.root_execution_id = filtered.root_execution_id
+GROUP BY filtered.root_execution_id, execution_id, provider_id, requested_model_id,
+  valuation_status, amount_currency
+`

package/src/auth-storage/auth-storage.ts

@@ -1,8 +1,11 @@
 import type {
   AuthStorage,
+  CompleteDeviceAuthorizationInput,
+  CompleteDeviceAuthorizationResult,
   CompleteMagicLinkSignInInput,
   CompleteOidcSignInInput,
   CompleteSignInResult,
+  DeviceAuthorizationRecord,
   GroupMembershipRecord,
   InvitationRecord,
   SessionRecord,
@@ -19,6 +22,10 @@ import {
   runPgTransaction,
 } from "../transactions"
 import { PgAuthAccessTokenStore } from "./access-tokens"
+import {
+  getPgDeviceAuthorizationById,
+  PgAuthDeviceAuthorizationStore,
+} from "./device-authorizations"
 import { PgAuthGroupMembershipStore } from "./group-memberships"
 import { PgAuthUserIdentityStore } from "./identities"
 import { PgAuthInvitationStore } from "./invitations"
@@ -77,6 +84,7 @@ export class PgAuthStorage implements AuthStorage {
   readonly groupMemberships: PgAuthGroupMembershipStore
   readonly magicLinks: PgAuthMagicLinkStore
   readonly oidcAuthorizationAttempts: PgAuthOidcAuthorizationAttemptStore
+  readonly deviceAuthorizations: PgAuthDeviceAuthorizationStore
 
   constructor(options: PgAuthStorageOptions) {
     this.sql = options.sql
@@ -90,6 +98,43 @@ export class PgAuthStorage implements AuthStorage {
     this.groupMemberships = new PgAuthGroupMembershipStore(this.sql)
     this.magicLinks = new PgAuthMagicLinkStore(this.sql)
     this.oidcAuthorizationAttempts = new PgAuthOidcAuthorizationAttemptStore(this.sql)
+    this.deviceAuthorizations = new PgAuthDeviceAuthorizationStore(this.sql)
+  }
+
+  async completeDeviceAuthorization(
+    input: CompleteDeviceAuthorizationInput
+  ): Promise<CompleteDeviceAuthorizationResult> {
+    return runPgTransaction(this.sql, async (tx) => {
+      const authorization = await getPgDeviceAuthorizationById(tx, input.projectId, input.id)
+      if (!authorization) {
+        throw new AuthStorageError(
+          "missing_device_authorization",
+          `[Sixb] Device authorization '${input.id}' not found for project '${input.projectId}'.`
+        )
+      }
+      assertCompletableDeviceAuthorization(authorization, input)
+      const accessToken = await new PgAuthAccessTokenStore(tx).create(input.accessToken)
+      const [consumed] = await tx`
+        UPDATE auth_device_authorizations
+        SET status = 'consumed', consumed_at = ${input.completedAt}
+        WHERE project_id = ${input.projectId} AND id = ${input.id} AND status = 'approved'
+        RETURNING *
+      `
+      if (!consumed) {
+        throw new AuthStorageError(
+          "invalid_device_authorization",
+          "[Sixb] Device authorization was already consumed."
+        )
+      }
+      return {
+        authorization: {
+          ...authorization,
+          status: "consumed" as const,
+          consumedAt: new Date(input.completedAt),
+        },
+        accessToken,
+      }
+    })
   }
 
   async completeMagicLinkSignIn(
@@ -796,3 +841,42 @@ function assertSignInSessionAudience(
     `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`
   )
 }
+
+function assertCompletableDeviceAuthorization(
+  authorization: DeviceAuthorizationRecord,
+  input: CompleteDeviceAuthorizationInput
+): void {
+  if (authorization.deviceCodeHash !== input.deviceCodeHash) {
+    throw new AuthStorageError(
+      "invalid_device_authorization",
+      "[Sixb] Invalid device authorization."
+    )
+  }
+  if (authorization.status === "pending") {
+    throw new AuthStorageError(
+      "pending_device_authorization",
+      "[Sixb] Device authorization is pending."
+    )
+  }
+  if (authorization.status === "denied") {
+    throw new AuthStorageError(
+      "device_authorization_denied",
+      "[Sixb] Device authorization was denied."
+    )
+  }
+  if (
+    authorization.status !== "approved" ||
+    authorization.expiresAt <= input.completedAt ||
+    !authorization.approvedUserId ||
+    !authorization.approvedSessionId ||
+    input.accessToken.projectId !== input.projectId ||
+    input.accessToken.subjectType !== "user" ||
+    input.accessToken.subjectId !== authorization.approvedUserId ||
+    input.accessToken.createdBySessionId !== authorization.approvedSessionId
+  ) {
+    throw new AuthStorageError(
+      "invalid_device_authorization",
+      "[Sixb] Device authorization is invalid."
+    )
+  }
+}

package/src/auth-storage/device-authorizations.ts

@@ -0,0 +1,131 @@
+import type {
+  AuthDeviceAuthorizationStore,
+  CreateDeviceAuthorizationInput,
+  DeviceAuthorizationRecord,
+} from "@sixb/core/storage"
+import { AuthStorageError, MAX_PENDING_DEVICE_AUTHORIZATIONS } from "@sixb/core/storage"
+import {
+  authLockKey,
+  lockAdvisoryKeys,
+  type PgStoreClient,
+  runPgTransaction,
+} from "../transactions"
+import type { PgAuthDeviceAuthorizationRow } from "./rows"
+import { rowToDeviceAuthorizationRecord } from "./rows"
+import { assertNonEmpty, mapUniqueConstraintError } from "./shared"
+
+export class PgAuthDeviceAuthorizationStore implements AuthDeviceAuthorizationStore {
+  constructor(private readonly sql: PgStoreClient) {}
+
+  async create(input: CreateDeviceAuthorizationInput): Promise<DeviceAuthorizationRecord> {
+    return runPgTransaction(this.sql, async (tx) => {
+      await lockAdvisoryKeys(tx, [authLockKey("device-authorizations", input.projectId)])
+      await tx`
+        DELETE FROM auth_device_authorizations
+        WHERE project_id = ${input.projectId} AND expires_at <= ${input.createdAt}
+      `
+      const [pending] = await tx<{ readonly count: string | number }[]>`
+        SELECT COUNT(*)::bigint AS count FROM auth_device_authorizations
+        WHERE project_id = ${input.projectId} AND status = 'pending'
+      `
+      if (Number(pending?.count ?? 0) >= MAX_PENDING_DEVICE_AUTHORIZATIONS) {
+        throw new AuthStorageError(
+          "device_authorization_limit_exceeded",
+          `[Sixb] Project '${input.projectId}' has too many pending device authorizations.`
+        )
+      }
+      try {
+        const [row] = await tx<PgAuthDeviceAuthorizationRow[]>`
+        INSERT INTO auth_device_authorizations (
+          project_id, id, device_code_hash, user_code, client_name, token_name,
+          token_expires_at, status, created_at, expires_at
+        ) VALUES (
+          ${assertNonEmpty(input.projectId, "Project id")},
+          ${assertNonEmpty(input.id, "Device authorization id")},
+          ${assertNonEmpty(input.deviceCodeHash, "Device code hash")},
+          ${assertNonEmpty(input.userCode, "User code")},
+          ${assertNonEmpty(input.clientName, "Client name")},
+          ${assertNonEmpty(input.tokenName, "Token name")},
+          ${input.tokenExpiresAt}, 'pending', ${input.createdAt}, ${input.expiresAt}
+        ) RETURNING *
+      `
+        return rowToDeviceAuthorizationRecord(row)
+      } catch (error) {
+        mapUniqueConstraintError(
+          error,
+          "duplicate_device_authorization",
+          `[Sixb] Device authorization '${input.id}' already exists for project '${input.projectId}'.`
+        )
+      }
+    })
+  }
+
+  async getById(params: { readonly projectId: string; readonly id: string }) {
+    return getPgDeviceAuthorizationById(this.sql, params.projectId, params.id)
+  }
+
+  async getByUserCode(params: { readonly projectId: string; readonly userCode: string }) {
+    const [row] = await this.sql<PgAuthDeviceAuthorizationRow[]>`
+      SELECT * FROM auth_device_authorizations
+      WHERE project_id = ${params.projectId} AND user_code = ${params.userCode}
+    `
+    return row ? rowToDeviceAuthorizationRecord(row) : null
+  }
+
+  async approve(params: {
+    readonly projectId: string
+    readonly id: string
+    readonly userId: string
+    readonly sessionId: string
+    readonly approvedAt: Date
+  }) {
+    const [row] = await this.sql<PgAuthDeviceAuthorizationRow[]>`
+      UPDATE auth_device_authorizations
+      SET status = 'approved', approved_user_id = ${params.userId},
+          approved_session_id = ${params.sessionId}, approved_at = ${params.approvedAt}
+      WHERE project_id = ${params.projectId} AND id = ${params.id}
+        AND status = 'pending' AND expires_at > ${params.approvedAt}
+        AND EXISTS (
+          SELECT 1 FROM auth_sessions
+          WHERE project_id = ${params.projectId} AND id = ${params.sessionId}
+            AND user_id = ${params.userId} AND revoked_at IS NULL
+            AND expires_at > ${params.approvedAt}
+            AND (absolute_expires_at IS NULL OR absolute_expires_at > ${params.approvedAt})
+        )
+      RETURNING *
+    `
+    if (!row) throw invalidTransition(params.id, params.projectId)
+    return rowToDeviceAuthorizationRecord(row)
+  }
+
+  async deny(params: { readonly projectId: string; readonly id: string; readonly deniedAt: Date }) {
+    const [row] = await this.sql<PgAuthDeviceAuthorizationRow[]>`
+      UPDATE auth_device_authorizations
+      SET status = 'denied', denied_at = ${params.deniedAt}
+      WHERE project_id = ${params.projectId} AND id = ${params.id}
+        AND status = 'pending' AND expires_at > ${params.deniedAt}
+      RETURNING *
+    `
+    if (!row) throw invalidTransition(params.id, params.projectId)
+    return rowToDeviceAuthorizationRecord(row)
+  }
+}
+
+export async function getPgDeviceAuthorizationById(
+  sql: PgStoreClient,
+  projectId: string,
+  id: string
+) {
+  const [row] = await sql<PgAuthDeviceAuthorizationRow[]>`
+    SELECT * FROM auth_device_authorizations
+    WHERE project_id = ${projectId} AND id = ${id}
+  `
+  return row ? rowToDeviceAuthorizationRecord(row) : null
+}
+
+function invalidTransition(id: string, projectId: string): AuthStorageError {
+  return new AuthStorageError(
+    "invalid_device_authorization",
+    `[Sixb] Device authorization '${id}' is no longer pending for project '${projectId}'.`
+  )
+}