@yielded/auth-persistence 0.1.0-beta.30 → 0.1.0-beta.32

package/src/internal/phone-native.ts

@@ -428,7 +428,7 @@ export const makeNativePhoneServices = Effect.fnUntraced(function* (
               const requirement =
                 yield* Schema.decodeEffect(AuthenticationRequirement)(originalRequirement);
 
-              if (!passwordEvidenceSatisfiedAt(evidence, requirement, captured.now))
+              if (!(yield* passwordEvidenceSatisfiedAt(evidence, requirement, captured.now)))
                 return yield* rejected();
             }
             if (evidence.proofs.length === 0) return yield* rejected();

package/src/internal/registration.ts

@@ -1,12 +1,10 @@
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
-import type { LoginIdentifier } from "@yielded/auth/Identity";
 import { PasswordUnavailable } from "@yielded/auth/Password";
-import type { SubjectId } from "@yielded/auth/Schema";
 import { SecurityRevision } from "@yielded/auth/Sessions";
 import { type Context, Crypto, Effect, Schema, Option, Cause } from "effect";
 import { SqlClient } from "effect/sql/SqlClient";
 
-import { PersistenceConfigurationError } from "./configuration";
+import { PersistenceConfigurationError, type SubjectProvisioning } from "./configuration";
 import { randomId } from "./crypto";
 import type { AnyPasswordPersistenceMapping } from "./models/password-model";
 import type { NativeSqlTables } from "./native-sql-table";
@@ -15,13 +13,9 @@ import {
   PasswordIdentifierTaken,
 } from "./password-registration-native";
 import type { PasswordRegistrationAuthority } from "./registration-contract";
-import { makeSqlCommitExecutor, CurrentSqlCommit } from "./sql-commit";
+import { makeSqlCommitExecutor, CurrentSqlCommit, SqlBatchCommit } from "./sql-commit";
 
-type CreateSubject = (input: {
-  readonly requestId: string;
-  readonly identifier: LoginIdentifier;
-  readonly registration: unknown;
-}) => Effect.Effect<SubjectId, PasswordUnavailable>;
+const SubjectValues = Schema.Record(Schema.String, Schema.Unknown);
 
 /** Application provisioning and the unverified identifier/password binding share
  * one physical owner. Identifier uniqueness arbitrates registration; correlation
@@ -34,49 +28,56 @@ export const makeRegistrationAuthority = Effect.fnUntraced(function* <R>(
 ): Effect.fn.Return<
   PasswordRegistrationAuthority<unknown>,
   PersistenceConfigurationError,
-  LifecycleHooks | SqlClient | Crypto.Crypto | R
+  LifecycleHooks | SqlClient | Crypto.Crypto | SqlBatchCommit | R
 > {
   const sql = (yield* SqlClient).withoutTransforms();
   const crypto = yield* Crypto.Crypto;
   const executor = yield* makeSqlCommitExecutor(() => PasswordUnavailable.make({}));
   const parent = yield* Effect.serviceOption(CurrentSqlCommit);
-  const store = yield* makeNativePasswordRegistrationStore(tables, mapping);
+  const batch = yield* SqlBatchCommit;
+  const store = yield* makeNativePasswordRegistrationStore(tables, mapping, batch !== undefined);
   // The strategy has already decoded its registration Schema. Only its callback
   // signature is erased by the heterogeneous strategy service map.
-  const creators = (yield* provisioning) as Readonly<Record<string, CreateSubject>>;
+  const creators = (yield* provisioning) as Readonly<Record<string, SubjectProvisioning<unknown>>>;
   const createSubject = creators[strategy];
 
   if (createSubject === undefined)
     return yield* PersistenceConfigurationError.make({
       reason: `Missing subject provisioning for ${strategy}`,
     });
+  if (batch !== undefined && typeof createSubject === "function")
+    return yield* PersistenceConfigurationError.make({
+      reason: `D1 subject provisioning for ${strategy} requires { values }; return the new subject row instead of inserting it`,
+    });
   const s = mapping.subject;
   const subject = tables(s.table);
   const lock = sql.onDialectOrElse({ sqlite: () => sql``, orElse: () => sql`for update` });
 
   const run = <A, E, R2>(work: Effect.Effect<A, E, R2>, suppressed: Effect.Effect<A, E, R2>) =>
-    Option.isSome(parent)
-      ? executor.run(work)
-      : executor
-          .operation(
-            work.pipe(
-              Effect.mapError((error) =>
-                error instanceof PasswordIdentifierTaken ? error : PasswordUnavailable.make({}),
+    batch !== undefined
+      ? executor.batch(work).pipe(Effect.provideService(SqlBatchCommit, batch))
+      : Option.isSome(parent)
+        ? executor.run(work)
+        : executor
+            .operation(
+              work.pipe(
+                Effect.mapError((error) =>
+                  error instanceof PasswordIdentifierTaken ? error : PasswordUnavailable.make({}),
+                ),
               ),
-            ),
-          )
-          .pipe(
-            Effect.catchCause((cause) =>
-              cause.reasons.length > 0 &&
-              cause.reasons.every(
-                (reason) =>
-                  Cause.isFailReason(reason) && reason.error instanceof PasswordIdentifierTaken,
-              )
-                ? executor.run(suppressed, "statement")
-                : Effect.failCause(cause),
-            ),
-            Effect.mapError(() => PasswordUnavailable.make({})),
-          );
+            )
+            .pipe(
+              Effect.catchCause((cause) =>
+                cause.reasons.length > 0 &&
+                cause.reasons.every(
+                  (reason) =>
+                    Cause.isFailReason(reason) && reason.error instanceof PasswordIdentifierTaken,
+                )
+                  ? executor.run(suppressed, "statement")
+                  : Effect.failCause(cause),
+              ),
+              Effect.mapError(() => PasswordUnavailable.make({})),
+            );
 
   return {
     register: (input, project) =>
@@ -86,26 +87,38 @@ export const makeRegistrationAuthority = Effect.fnUntraced(function* <R>(
             ? executor.run(store.prepare({ _tag: "Suppressed" }, project), "statement")
             : run(
                 Effect.gen(function* () {
-                  const subjectId = yield* createSubject({
+                  const provisioningInput = {
                     requestId: input.requestId,
                     identifier: input.identifier,
                     registration: input.registration,
-                  });
+                  };
 
-                  const nativeId = yield* mapping.subjectId.toNative(subjectId);
+                  const row = yield* Effect.gen(function* () {
+                    if (typeof createSubject !== "function")
+                      return yield* createSubject
+                        .values(provisioningInput)
+                        .pipe(Effect.flatMap(Schema.decodeEffect(SubjectValues)));
+                    const subjectId = yield* createSubject(provisioningInput);
+                    const nativeId = yield* mapping.subjectId.toNative(subjectId);
 
-                  const rows =
-                    yield* sql`select ${subject.fields("registration_subject_")} from ${subject.name} where ${subject.column(s.id)} = ${subject.value(s.id, nativeId)} limit 2 ${lock}`;
+                    const rows =
+                      yield* sql`select ${subject.fields("registration_subject_")} from ${subject.name} where ${subject.column(s.id)} = ${subject.value(s.id, nativeId)} limit 2 ${lock}`;
 
-                  if (rows.length !== 1) return yield* PasswordUnavailable.make({});
-                  const row = subject.decode(rows[0]!, "registration_subject_");
+                    if (rows.length !== 1) return yield* PasswordUnavailable.make({});
+
+                    return subject.decode(rows[0]!, "registration_subject_");
+                  });
 
                   if (!s.isActiveStatus(row[s.status])) return yield* PasswordUnavailable.make({});
+                  const subjectId = yield* mapping.subjectId.toSubject(row[s.id]);
 
                   const securityRevision = yield* Schema.decodeUnknownEffect(SecurityRevision)(
                     row[s.securityRevision],
                   );
 
+                  if (typeof createSubject !== "function")
+                    yield* store.stage(sql`${subject.insert(row)}`);
+
                   const identifierRevision = SecurityRevision.make(yield* randomId);
                   const credentialId = yield* randomId;
                   const credentialRevision = SecurityRevision.make(yield* randomId);

package/src/internal/session-native-authority.ts

@@ -1,4 +1,5 @@
 import { type LifecycleHooks } from "@yielded/auth/Hooks";
+import { AuthenticationClock } from "@yielded/auth/Operations";
 import {
   type AuthenticationAuthority,
   StaleAuthentication,
@@ -51,11 +52,14 @@ export const sessionEvidenceDeadline = Effect.fnUntraced(function* (
   if (!assessed.satisfied) return yield* StaleAuthentication.make({});
 
   const boundaries = [
-    ...new Set(
-      evidence.proofs.map(
+    ...new Set([
+      ...evidence.proofs.map(
         (proof) => DateTime.toEpochMillis(proof.verifiedAt) + requirement.maximumAgeMillis,
       ),
-    ),
+      ...(evidence.completionExpiresAt === undefined
+        ? []
+        : [DateTime.toEpochMillis(evidence.completionExpiresAt)]),
+    ]),
   ]
     .filter((n) => n > now)
     .sort((a, b) => a - b);
@@ -139,11 +143,12 @@ export const makeNativeAuthenticationAuthorityServices = Effect.fnUntraced(funct
   });
 
   const native = <A, E, R>(work: Effect.Effect<A, E, R>) =>
-    batch === undefined
+    (batch === undefined
       ? executor.operation(normalizeSessionOperation(work))
       : executor
           .operationBatch(normalizeSessionOperation(work))
-          .pipe(Effect.provideService(SqlBatchCommit, batch));
+          .pipe(Effect.provideService(SqlBatchCommit, batch))
+    ).pipe(Effect.provideService(AuthenticationClock, state.clockPolicy));
 
   const authenticationAuthority: AuthenticationAuthority["Service"] = {
     capture: (subjectId, credentialIds) =>
@@ -183,10 +188,20 @@ export const makeNativeAuthenticationAuthorityServices = Effect.fnUntraced(funct
             current.now,
           );
 
-          const expires = DateTime.toEpochMillis(input.expiresAt),
+          const issued = DateTime.toEpochMillis(input.issuedAt),
+            expires = DateTime.toEpochMillis(input.expiresAt),
             absolute = DateTime.toEpochMillis(input.absoluteExpiresAt);
 
-          if (current.now >= expires || expires > absolute)
+          if (
+            Math.max(issued, DateTime.toEpochMillis(input.now)) - current.now >
+              state.clockPolicy.futureToleranceMillis ||
+            input.evidence.proofs.some(
+              (proof) => DateTime.toEpochMillis(proof.verifiedAt) > issued,
+            ) ||
+            issued >= expires ||
+            current.now >= expires ||
+            expires > absolute
+          )
             return yield* StaleAuthentication.make({});
 
           const pendingExpiry =
@@ -195,7 +210,9 @@ export const makeNativeAuthenticationAuthorityServices = Effect.fnUntraced(funct
               : yield* consume(input.pending, input.evidence, current.native);
 
           const deadline = Math.min(assessment.validUntil, expires, pendingExpiry ?? Infinity);
-          const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;
+
+          yield* state.guardPolicy(current);
+          const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${now} >= ${current.now} and ${now} < ${deadline}`;
 
           if (batch !== undefined) {
             yield* appendSqlBatchStatement(sqlBatchAssertion(sql, condition));
@@ -224,6 +241,7 @@ export const makeNativeAuthenticationAuthorityServices = Effect.fnUntraced(funct
                   if (rows.length !== 1) return yield* PendingAuthenticationInvalid.make({});
                 }
               }).pipe(
+                Effect.provideService(AuthenticationClock, state.clockPolicy),
                 Effect.mapError((cause) =>
                   PersistenceMappingError.make({ operation: "decode", cause }),
                 ),

package/src/internal/session-native-login.ts

@@ -1,10 +1,12 @@
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
+import { AuthenticationClock } from "@yielded/auth/Operations";
 import {
   PendingAuthenticationInvalid,
   StaleAuthentication,
   SessionConflict,
   type PendingAuthentication,
   type PendingAuthenticationRecord,
+  type SessionUnavailable,
 } from "@yielded/auth/Sessions";
 import { DateTime, Effect, Option } from "effect";
 import type { SqlClient } from "effect/sql/SqlClient";
@@ -46,7 +48,7 @@ export const makeNativePendingAuthenticationServices = Effect.fnUntraced(functio
   mapping: NativePendingAuthenticationMapping<Claims>,
 ): Effect.fn.Return<
   { readonly pendingAuthentication: PendingAuthentication<Claims> },
-  never,
+  SessionUnavailable,
   SqlClient | LifecycleHooks | SqlBatchCommit
 > {
   const batch = yield* SqlBatchCommit;
@@ -67,11 +69,12 @@ export const makeNativePendingAuthenticationServices = Effect.fnUntraced(functio
     work: Effect.Effect<A, E, R>,
     mode: "transaction" | "statement" = "transaction",
   ) =>
-    batch === undefined
+    (batch === undefined
       ? executor.operation(normalizeSessionOperation(work), mode)
       : executor
           .operationBatch(normalizeSessionOperation(work))
-          .pipe(Effect.provideService(SqlBatchCommit, batch));
+          .pipe(Effect.provideService(SqlBatchCommit, batch))
+    ).pipe(Effect.provideService(AuthenticationClock, state.clockPolicy));
 
   const verifyPayload = Effect.fnUntraced(function* (
     stored: import("./session-native-pending").StoredSessionPending,
@@ -129,7 +132,9 @@ export const makeNativePendingAuthenticationServices = Effect.fnUntraced(functio
 
           const record: PendingAuthenticationRecord<Claims> = { ...input, version };
           const snapshot = yield* mapping.login.encode(record);
-          const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${state.policyCondition(current.row, current.native)} and ${now} >= ${current.now} and ${now} < ${expires}`;
+
+          yield* state.guardPolicy(current);
+          const condition = sql`${state.authorityCondition(current.revision, current.native)} and ${now} >= ${current.now} and ${now} < ${expires}`;
 
           if (batch !== undefined)
             yield* appendSqlBatchStatement(sqlBatchAssertion(sql, condition));

package/src/internal/session-native-pending-read.ts

@@ -1,4 +1,4 @@
-import type { TokenDigest } from "@yielded/auth/Schema";
+import type { SubjectId, TokenDigest } from "@yielded/auth/Schema";
 import type { PendingAuthenticationKind } from "@yielded/auth/Sessions";
 import { Effect } from "effect";
 
@@ -6,13 +6,15 @@ import type { NativeSqlTables } from "./native-sql-table";
 import { makeNativeSessionPending } from "./session-native-pending";
 import {
   makeNativeSessionAuthorityState,
+  sessionInvariant,
+  sessionUnavailable,
   type NativeSessionAuthorityMapping,
 } from "./session-native-state";
 import { exactSqlText } from "./sql-change";
+import { canJoinTextColumns } from "./storage-validation";
 
-/** Both semantic pending ports use the same kind-bound physical snapshot.
- * Distinct native ID encodings use their own bound reads; joined rows still
- * validate each decoded owner before returning current policy. */
+/** Both ports re-read the pending row with current authority in one snapshot.
+ * Discovery only selects the independently bound owner for incompatible IDs. */
 export const makeNativeSessionPendingReader = Effect.fnUntraced(function* (
   tables: NativeSqlTables,
   mapping: NativeSessionAuthorityMapping & Parameters<typeof makeNativeSessionPending>[1],
@@ -21,47 +23,58 @@ export const makeNativeSessionPendingReader = Effect.fnUntraced(function* (
   const state = yield* makeNativeSessionAuthorityState(tables, mapping, batch);
   const pending = yield* makeNativeSessionPending(tables, mapping, batch);
 
+  const joinedIds = yield* canJoinTextColumns([
+    pending.table.unencodedTextColumn?.(pending.p.subjectId),
+    state.subject.unencodedTextColumn?.(mapping.subject.id),
+    state.credential.unencodedTextColumn?.(mapping.credential.subjectId),
+  ]).pipe(Effect.mapError(sessionUnavailable));
+
   const read = Effect.fnUntraced(function* (kind: PendingAuthenticationKind, digest: TokenDigest) {
     const { sql, now } = state,
       { p, table } = pending;
 
-    const compatible =
-      table.unencodedTextColumn?.(p.subjectId) !== undefined &&
-      state.subject.unencodedTextColumn?.(mapping.subject.id) !== undefined &&
-      state.credential.unencodedTextColumn?.(mapping.credential.subjectId) !== undefined;
+    let discoveredSubjectId: SubjectId | undefined;
+    let nativeId: unknown;
 
-    if (compatible) {
-      const pt = table.as("authentication_pending"),
-        st = state.joinedSubject,
-        ct = state.joinedCredential,
-        s = mapping.subject,
-        c = mapping.credential;
+    if (!joinedIds) {
+      const selected = yield* pending.read(kind, digest);
 
-      const rows =
-        yield* sql`select ${pt.fields("p_")}, ${st.fields("s_")}, ${ct.fields("c_")}, ${now} as engine_now from ${pt.name} join ${st.name} on ${exactSqlText(sql, st.column(s.id), pt.column(p.subjectId))} and ${state.activeSubject(st)} left join ${ct.name} on ${exactSqlText(sql, ct.column(c.subjectId), pt.column(p.subjectId))} and ${state.activeCredential(ct)} where ${pending.predicate(pt, kind, digest)} limit 65`;
+      if (selected === undefined) return undefined;
+      discoveredSubjectId = selected.record.subjectId;
+      nativeId = yield* mapping.subjectId.toNative(discoveredSubjectId);
+    }
 
-      if (rows[0] === undefined) return undefined;
-      const record = yield* pending.decode(kind, pt.decode(rows[0], "p_"));
-      const owner = yield* mapping.subjectId.toNative(record.subjectId);
+    const pt = table.as("authentication_pending"),
+      st = state.joinedSubject,
+      ct = state.joinedCredential,
+      s = mapping.subject,
+      c = mapping.credential;
 
-      const authority = yield* state.decode(
-        record.subjectId,
-        owner,
-        st.decode(rows[0], "s_"),
-        rows.map((row) => ct.decode(row, "c_")),
-        rows[0].engine_now,
-      );
+    const bindOwner = (table: typeof pt, key: string) =>
+      joinedIds
+        ? exactSqlText(sql, table.column(key), pt.column(p.subjectId))
+        : state.id(table, key, nativeId);
 
-      return authority === undefined ? undefined : { record, authority };
-    }
-    const selected = yield* pending.read(kind, digest);
+    const rows =
+      yield* sql`select ${pt.fields("p_")}, ${st.fields("s_")}, ${ct.fields("c_")}, ${now} as engine_now from ${pt.name} join ${st.name} on ${bindOwner(st, s.id)} and ${state.activeSubject(st)} left join ${ct.name} on ${bindOwner(ct, c.subjectId)} and ${state.activeCredential(ct)} where ${pending.predicate(pt, kind, digest)}${joinedIds ? sql`` : sql` and ${bindOwner(pt, p.subjectId)}`} limit 65`;
+
+    if (rows[0] === undefined) return undefined;
+    const record = yield* pending.decode(kind, pt.decode(rows[0], "p_"));
+
+    sessionInvariant(joinedIds || record.subjectId === discoveredSubjectId);
+    const owner = yield* mapping.subjectId.toNative(record.subjectId);
 
-    if (selected === undefined) return undefined;
-    const authority = yield* state.read(selected.record.subjectId);
+    const authority = yield* state.decode(
+      record.subjectId,
+      owner,
+      rows[0],
+      rows.map((row) => ct.decode(row, "c_")),
+      rows[0].engine_now,
+    );
 
-    return authority === undefined || authority.now >= selected.record.expiresAtMillis
+    return authority === undefined || authority.now >= record.expiresAtMillis
       ? undefined
-      : { record: selected.record, authority };
+      : { record, authority };
   });
 
   return { state, pending, read };

package/src/internal/session-native-record.ts

@@ -1,3 +1,4 @@
+import { AuthenticationClock } from "@yielded/auth/Operations";
 import { TokenDigest } from "@yielded/auth/Schema";
 import {
   SessionId,
@@ -50,14 +51,14 @@ export const makeConditionalSqlInsert = Effect.fnUntraced(function* () {
   };
 });
 
-/** Security columns identify the row and own its live time bounds. In particular
- * issuedAt may be assigned by UPDATE's database clock without rewriting a JSON
- * copy of prepared metadata. Claims/provenance decoding remains consumer-owned. */
+/** Security columns own live time bounds and commit-time issuedAt adjustments,
+ * independently of prepared JSON metadata. Claims/provenance decoding remains consumer-owned. */
 export const makeNativeSessionRecords = Effect.fnUntraced(function* <Claims>(
   tables: NativeSqlTables,
   mapping: NativeSessionRecordMapping<Claims>,
 ) {
   const sql = (yield* SqlClient).withoutTransforms();
+  const { futureToleranceMillis } = yield* AuthenticationClock;
 
   const s = mapping.session,
     table = tables(s.table),
@@ -71,7 +72,8 @@ export const makeNativeSessionRecords = Effect.fnUntraced(function* <Claims>(
 
   const live = (t: SqlTable) =>
     sql.and([
-      sql`${millis(t, s.issuedAt)} <= ${now}`,
+      sql`${millis(t, s.issuedAt)} <= ${now} + ${futureToleranceMillis}`,
+      sql`${millis(t, s.issuedAt)} < ${millis(t, s.expiresAt)}`,
       sql`${millis(t, s.expiresAt)} > ${now}`,
       sql`${millis(t, s.absoluteExpiresAt)} >= ${millis(t, s.expiresAt)}`,
     ]);

package/src/internal/session-native-state.ts

@@ -1,3 +1,4 @@
+import { AuthenticationClock } from "@yielded/auth/Operations";
 import { reportAuthFailure } from "@yielded/auth/Persistence";
 import type { SubjectId } from "@yielded/auth/Schema";
 import {
@@ -14,12 +15,13 @@ import {
 } from "@yielded/auth/Sessions";
 import { Cause, Effect, Schema, DateTime } from "effect";
 import { SqlClient } from "effect/sql/SqlClient";
-import type { Fragment } from "effect/sql/Statement";
+import { fragment, parameter, type Fragment } from "effect/sql/Statement";
 
 import { PersistenceMappingError } from "./mapping-error";
 import type { SessionAuthorityTables, SessionExecution } from "./models/session-model";
-import type { NativeSqlTables, SqlTable } from "./native-sql-table";
+import { nativeSqlAlias, type NativeSqlTables, type SqlTable } from "./native-sql-table";
 import { anySqlCondition, exactSqlText } from "./sql-change";
+import { guardSqlitePolicy, type SqlitePolicyValue } from "./sqlite-policy-guard";
 import type { AnyTableModel } from "./table-model";
 
 export const sessionUnavailable = () => SessionUnavailable.make({});
@@ -72,6 +74,7 @@ export type NativeSessionAuthorityMapping = SessionAuthorityTables<
 export interface NativeSessionAuthority {
   readonly native: unknown;
   readonly row: Record<string, unknown>;
+  readonly policyValues: ReadonlyArray<SqlitePolicyValue>;
   readonly revision: AuthenticationRevision;
   readonly requirement: AuthenticationRequirement;
   readonly now: number;
@@ -96,6 +99,7 @@ export const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (
   batch = false,
 ) {
   const sql = (yield* SqlClient).withoutTransforms();
+  const clockPolicy = yield* AuthenticationClock;
 
   const s = mapping.subject,
     c = mapping.credential;
@@ -133,13 +137,15 @@ export const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (
   const decode = Effect.fnUntraced(function* (
     subjectId: SubjectId,
     native: unknown,
-    row: Record<string, unknown>,
+    projected: Record<string, unknown>,
     factors: ReadonlyArray<Record<string, unknown>>,
     instant: unknown,
   ): Effect.fn.Return<
     NativeSessionAuthority | undefined,
     PersistenceMappingError | Schema.SchemaError
   > {
+    const row = subject.decode(projected, "s_");
+
     sessionInvariant((yield* mapping.subjectId.toSubject(row[s.id])) === subjectId);
     if (!s.isActiveStatus(row[s.status])) return undefined;
     const credentials: { credentialId: string; revision: string }[] = [];
@@ -161,6 +167,16 @@ export const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (
     return {
       native,
       row,
+      // Compare the selected SQL representation, without round-tripping through
+      // application codecs (for example, JSON whitespace or date precision).
+      policyValues: batch
+        ? (s.requirementColumns ?? []).map((key) => ({
+            column: subject.selectedColumn(key),
+            value: fragment([
+              parameter(projected[nativeSqlAlias("s_", subject.keys.indexOf(key))]),
+            ]),
+          }))
+        : [],
       revision: yield* Schema.decodeUnknownEffect(AuthenticationRevision)({
         subjectId,
         securityRevision: row[s.securityRevision],
@@ -188,7 +204,7 @@ export const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (
       return yield* decode(
         subjectId,
         native,
-        subject.decode(owners[0], "s_"),
+        owners[0],
         factors.map((row) => credential.decode(row, "c_")),
         owners[0].engine_now,
       );
@@ -202,18 +218,23 @@ export const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (
     return yield* decode(
       subjectId,
       native,
-      joinedSubject.decode(rows[0], "s_"),
+      rows[0],
       rows.map((row) => joinedCredential.decode(row, "c_")),
       rows[0].engine_now,
     );
   });
 
-  const policyCondition = (row: Record<string, unknown>, native: unknown): Fragment => {
-    if (!batch) return sql`1 = 1`;
+  const guardPolicy = Effect.fnUntraced(function* (current: NativeSessionAuthority) {
+    if (!batch) return;
     sessionInvariant(s.requirementColumns !== undefined);
 
-    return sql`exists(select 1 from ${subject.name} where ${id(subject, s.id, native)} and ${sql.and(s.requirementColumns.map((key) => (row[key] === null ? sql`${subject.column(key)} is null` : typeof row[key] === "string" ? exact(subject, key, row[key]) : id(subject, key, row[key]))))})`;
-  };
+    yield* guardSqlitePolicy({
+      name: "session-subject-policy",
+      table: subject.name,
+      owner: id(subject, s.id, current.native),
+      values: current.policyValues,
+    });
+  });
 
   const authorityCondition = (revision: AuthenticationRevision, native: unknown): Fragment =>
     sql.and([
@@ -227,6 +248,7 @@ export const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (
 
   return {
     sql,
+    clockPolicy,
     subject,
     credential,
     joinedSubject,
@@ -242,7 +264,7 @@ export const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (
     decode,
     read,
     authorityCondition,
-    policyCondition,
+    guardPolicy,
   };
 });