@yielded/auth-persistence 0.1.0-beta.31 → 0.1.0-beta.32

package/src/internal/persistence.ts

@@ -1,6 +1,12 @@
 import { EmailAddressPersistence, EmailUnavailable } from "@yielded/auth/Email";
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
 import { hasCommitScope } from "@yielded/auth/Hooks";
+import {
+  OAuthConnectedPersistence,
+  OAuthConnectedRevocations,
+  OAuthSignInPersistence,
+  OAuthUnavailable,
+} from "@yielded/auth/OAuth";
 import {
   PasskeyCredentials,
   PasskeyManagementPersistence,
@@ -8,7 +14,7 @@ import {
   PasskeyUnavailable,
 } from "@yielded/auth/Passkey";
 import { PasswordPersistence, PasswordUnavailable } from "@yielded/auth/Password";
-import { hooksLayer } from "@yielded/auth/Persistence";
+import { hooksLayer, reportAuthDiagnostic } from "@yielded/auth/Persistence";
 import { PhoneSignInTargets, PhoneOtpUnavailable } from "@yielded/auth/PhoneOtp";
 import { ProofPersistence, ProofUnavailable } from "@yielded/auth/Proofs";
 import { AuthenticationAuthority, SessionUnavailable } from "@yielded/auth/Sessions";
@@ -30,10 +36,12 @@ import {
   type SubjectOptions,
   type PasskeyFeature,
   type PasskeyRequirement,
+  type OAuthFeature,
 } from "./configuration";
 import { makeNativeEmailAddressServices } from "./email-native";
 import { PersistenceMappingError } from "./mapping-error";
 import type { NativeSqlTables } from "./native-sql-table";
+import { makeManagedOAuth } from "./oauth-managed";
 import { makeManagedPasskeys } from "./passkey-managed";
 import { makeNativePasswordServices } from "./password-native";
 import { makeComposedPhoneTargets } from "./phone-composed";
@@ -88,6 +96,11 @@ const timestampKeys = new Set([
   "deadline",
   "occurredAt",
   "dedupUntil",
+  "binderExpiresAt",
+  "refreshClaimedAt",
+  "refreshClaimExpiresAt",
+  "claimedAt",
+  "claimExpiresAt",
 ]);
 
 export const createPersistence = <T extends object, R, Database extends object = object>(
@@ -96,27 +109,46 @@ export const createPersistence = <T extends object, R, Database extends object =
   const make = <C extends ClaimsCodec, const Id extends string, const A extends Definition<C, Id>>(
     auth: A & Definition<C, Id>,
   ) => {
-    const features = Object.values(auth.strategies).map((strategy) => strategy.persistence);
-    const phone = features.some((feature) => feature?.kind === "phone");
-    const password = features.some((feature) => feature?.kind === "password");
+    const features = Object.values(auth.strategies).flatMap((strategy) =>
+      strategy.persistence === undefined ? [] : [strategy.persistence],
+    );
+
+    const phone = features.some((feature) => feature.kind === "phone");
+    const password = features.some((feature) => feature.kind === "password");
 
     const passkeys = features.filter(
-      (feature): feature is PasskeyFeature => feature?.kind === "passkey",
+      (feature): feature is PasskeyFeature => feature.kind === "passkey",
     );
 
+    const oauth = features.filter((feature): feature is OAuthFeature => feature?.kind === "oauth");
+    const oauthSignIn = oauth.some((feature) => feature.signIn);
+    const oauthConnected = oauth.some((feature) => feature.connected !== undefined);
+    const stateful = auth.sessionMode === "stateful";
+
+    const stateless =
+      auth.sessionMode === "stateless" &&
+      features.length > 0 &&
+      features.every((feature) => feature?.kind === "oauth");
+
     const management = features.some(
-      (feature) => feature?.kind === "password" && feature.management,
+      (feature) => feature.kind === "password" && feature.management,
     );
 
-    const email = features.some((feature) => feature?.kind === "email" && feature.addresses);
+    const email = features.some((feature) => feature.kind === "email" && feature.addresses);
     const proofs = phone || management || email;
 
-    const roles: StorageRole[] = ["identifiers", "credentials", "sessions", "pending"];
+    const roles: StorageRole[] = ["identifiers", "credentials"];
 
+    if (stateful) roles.push("sessions");
+    roles.push("pending");
     if (password) roles.push("passwords");
     if (email) roles.push("emailCredentials");
     if (passkeys.length > 0) roles.push("passkeyCredentials", "passkeyFlows");
     if (proofs) roles.push("proofs");
+    if (oauth.length > 0) roles.push("oauthIdentities", "oauthCredentials");
+    if (oauthSignIn) roles.push("oauthSignInFlows");
+    if (oauthConnected)
+      roles.push("oauthConnectedFlows", "oauthConnectedGrants", "oauthConnectedRevocations");
 
     const ConfigKey = Context.Service<
       ConfigId<A["namespace"]>,
@@ -248,12 +280,9 @@ export const createPersistence = <T extends object, R, Database extends object =
 
           if (dialect === undefined)
             return yield* configError("Use an explicit adapter for this SQL dialect");
-          if (auth.sessionMode !== "stateful")
-            return yield* configError("The composed layer currently requires stateful sessions");
           if (
             features.some(
               (feature) =>
-                feature === undefined ||
                 ("lifecycle" in feature && feature.lifecycle) ||
                 (feature.kind === "email" && !feature.addresses),
             )
@@ -287,17 +316,19 @@ export const createPersistence = <T extends object, R, Database extends object =
           yield* validateStorageBatch(dialect, validations);
           const nativeTables = backend.nativeTables(database);
           const mappings = yield* makeMappings(storage, nativeTables);
-          const sessionMapping = mappings.sessions(auth.claims, auth.sessions.moduleId);
-          const pendingMapping = mappings.pending(auth.claims, auth.sessions.moduleId);
 
-          const sessionServices = yield* makeNativeStatefulSessionServices(
-            nativeTables,
-            sessionMapping,
-          );
+          const sessionMapping = stateful
+            ? mappings.sessions(auth.claims, auth.sessions.moduleId)
+            : undefined;
+
+          const pendingMapping = mappings.pending(auth.claims, auth.sessions.moduleId);
 
           const { authenticationAuthority } = yield* makeNativeAuthenticationAuthorityServices(
             nativeTables,
-            sessionMapping,
+            sessionMapping ?? {
+              ...pendingMapping,
+              pending: { pending: pendingMapping.pending, login: pendingMapping.login },
+            },
           );
 
           const { pendingAuthentication } = yield* makeNativePendingAuthenticationServices(
@@ -309,12 +340,15 @@ export const createPersistence = <T extends object, R, Database extends object =
             nativeTables,
             {
               ...pendingMapping,
-              source: {
-                kind: "Stateful",
-                session: sessionMapping.session,
-                sessionId: sessionMapping.sessionId,
-                constraints: { sessionDigest: "unique(session.digest)" },
-              },
+              source:
+                sessionMapping === undefined
+                  ? { kind: "StatelessSigned" }
+                  : {
+                      kind: "Stateful",
+                      session: sessionMapping.session,
+                      sessionId: sessionMapping.sessionId,
+                      constraints: { sessionDigest: "unique(session.digest)" },
+                    },
             },
           );
 
@@ -327,16 +361,26 @@ export const createPersistence = <T extends object, R, Database extends object =
             AuthenticationAuthority,
             authenticationAuthority,
           ).pipe(
-            Context.add(
-              auth.sessions.StatefulSessionPersistence,
-              sessionServices.statefulSessionPersistence,
-            ),
-            Context.add(auth.sessions.SessionRepository, sessionServices.sessionRepository),
             Context.add(auth.sessions.PendingAuthentication, pendingAuthentication),
             Context.add(auth.sessions.SessionStepUpPersistence, sessionStepUpPersistence),
             Context.add(auth.sessions.SessionCleanup, sessionCleanup),
           );
 
+          if (sessionMapping !== undefined) {
+            const sessionServices = yield* makeNativeStatefulSessionServices(
+              nativeTables,
+              sessionMapping,
+            );
+
+            context = context.pipe(
+              Context.add(
+                auth.sessions.StatefulSessionPersistence,
+                sessionServices.statefulSessionPersistence,
+              ),
+              Context.add(auth.sessions.SessionRepository, sessionServices.sessionRepository),
+            );
+          }
+
           const proofMapping = proofs ? mappings.proofs() : undefined;
 
           if (proofMapping !== undefined) {
@@ -395,9 +439,7 @@ export const createPersistence = <T extends object, R, Database extends object =
                 backend.nativeTables(database),
                 storage,
                 mappings.proofs(),
-                features.flatMap((feature) =>
-                  feature?.kind === "phone" ? [feature.moduleId] : [],
-                ),
+                features.flatMap((feature) => (feature.kind === "phone" ? [feature.moduleId] : [])),
               ),
             );
 
@@ -410,7 +452,7 @@ export const createPersistence = <T extends object, R, Database extends object =
                 dialect,
                 features: passkeys,
                 passwordModules: features.flatMap((feature) =>
-                  feature?.kind === "password" ? [feature.moduleId] : [],
+                  feature.kind === "password" ? [feature.moduleId] : [],
                 ),
               },
               backend.nativeTables(database),
@@ -427,21 +469,27 @@ export const createPersistence = <T extends object, R, Database extends object =
             context = Context.merge(context, yield* services);
           }
 
+          if (oauth.length > 0)
+            context = Context.merge(context, yield* makeManagedOAuth(storage, nativeTables, oauth));
+
           // The checked capability metadata above determines exactly these service keys.
           return context as Context.Context<Ports<C, Id, A>>;
         }).pipe(Effect.provideService(SqlBatchCommit, backend.batch?.(database))),
-      ).pipe(
-        withStorageValidation,
-        Effect.mapError((error) =>
-          Schema.is(PersistenceConfigurationError)(error)
-            ? error
-            : configError("Cannot acquire SQL persistence"),
-        ),
-      ),
+      ).pipe(withStorageValidation),
     ).pipe(Layer.provide(hooksLayer));
 
     const layer = Layer.effectContext(
       Effect.gen(function* () {
+        if (!stateful && !stateless) {
+          if (auth.sessionMode === "stateless")
+            return yield* configError(
+              "Composed stateless sessions support only OAuth strategies; use explicit persistence for other strategies",
+            );
+
+          return yield* configError(
+            "Composed persistence supports stateful or OAuth-only stateless sessions; state-assisted validity and other session modes require explicit persistence",
+          );
+        }
         const scope = yield* Effect.scope;
         const captured = yield* Effect.context<Layer.Services<typeof services>>();
         const client = Context.get(captured, SqlClient.SqlClient);
@@ -465,7 +513,22 @@ export const createPersistence = <T extends object, R, Database extends object =
             if (yield* hasCommitScope) return yield* Effect.fail(unavailable());
             yield* requireStandalone(unavailable, client.transactionService);
           }
-          const acquired = yield* initialize.pipe(Effect.mapError(unavailable));
+
+          // Observe the cached failure in this invocation, not the captured setup context.
+          const acquired = yield* initialize.pipe(
+            Effect.tapError((error) =>
+              reportAuthDiagnostic(
+                "persistence-initialization",
+                Schema.is(PersistenceConfigurationError)(error)
+                  ? "configuration"
+                  : Schema.is(PersistenceMappingError)(error)
+                    ? "mapping"
+                    : "unavailable",
+              ),
+            ),
+            Effect.mapError(unavailable),
+          );
+
           const value = Context.getOrUndefined(acquired, key);
 
           return value === undefined ? yield* Effect.fail(unavailable()) : value;
@@ -475,18 +538,6 @@ export const createPersistence = <T extends object, R, Database extends object =
         const authority = service(AuthenticationAuthority, sessionUnavailable, false);
         const authorityMutation = service(AuthenticationAuthority, sessionUnavailable);
 
-        const sessions = service(
-          auth.sessions.StatefulSessionPersistence,
-          sessionUnavailable,
-          false,
-        );
-
-        const sessionMutations = service(
-          auth.sessions.StatefulSessionPersistence,
-          sessionUnavailable,
-        );
-
-        const repository = service(auth.sessions.SessionRepository, sessionUnavailable, false);
         const pendingRead = service(auth.sessions.PendingAuthentication, sessionUnavailable, false);
         const pendingMutation = service(auth.sessions.PendingAuthentication, sessionUnavailable);
 
@@ -506,22 +557,6 @@ export const createPersistence = <T extends object, R, Database extends object =
           approve: (input, prepare) =>
             Effect.flatMap(authorityMutation, (s) => s.approve(input, prepare)),
         }).pipe(
-          Context.add(auth.sessions.StatefulSessionPersistence, {
-            establish: (input, prepare) =>
-              Effect.flatMap(sessionMutations, (s) => s.establish(input, prepare)),
-            verify: (input) => Effect.flatMap(sessions, (s) => s.verify(input)),
-            rotate: (input, prepare) =>
-              Effect.flatMap(sessionMutations, (s) => s.rotate(input, prepare)),
-            revokeDigest: (digest, prepare) =>
-              Effect.flatMap(sessionMutations, (s) => s.revokeDigest(digest, prepare)),
-            revoke: (input, prepare) =>
-              Effect.flatMap(sessionMutations, (s) => s.revoke(input, prepare)),
-            revokeAll: (input, prepare) =>
-              Effect.flatMap(sessionMutations, (s) => s.revokeAll(input, prepare)),
-          }),
-          Context.add(auth.sessions.SessionRepository, {
-            list: (input) => Effect.flatMap(repository, (s) => s.list(input)),
-          }),
           Context.add(auth.sessions.PendingAuthentication, {
             create: (input, now, prepare) =>
               Effect.flatMap(pendingMutation, (s) => s.create(input, now, prepare)),
@@ -543,6 +578,40 @@ export const createPersistence = <T extends object, R, Database extends object =
           }),
         );
 
+        if (stateful) {
+          const sessions = service(
+            auth.sessions.StatefulSessionPersistence,
+            sessionUnavailable,
+            false,
+          );
+
+          const sessionMutations = service(
+            auth.sessions.StatefulSessionPersistence,
+            sessionUnavailable,
+          );
+
+          const repository = service(auth.sessions.SessionRepository, sessionUnavailable, false);
+
+          context = context.pipe(
+            Context.add(auth.sessions.StatefulSessionPersistence, {
+              establish: (input, prepare) =>
+                Effect.flatMap(sessionMutations, (s) => s.establish(input, prepare)),
+              verify: (input) => Effect.flatMap(sessions, (s) => s.verify(input)),
+              rotate: (input, prepare) =>
+                Effect.flatMap(sessionMutations, (s) => s.rotate(input, prepare)),
+              revokeDigest: (digest, prepare) =>
+                Effect.flatMap(sessionMutations, (s) => s.revokeDigest(digest, prepare)),
+              revoke: (input, prepare) =>
+                Effect.flatMap(sessionMutations, (s) => s.revoke(input, prepare)),
+              revokeAll: (input, prepare) =>
+                Effect.flatMap(sessionMutations, (s) => s.revokeAll(input, prepare)),
+            }),
+            Context.add(auth.sessions.SessionRepository, {
+              list: (input) => Effect.flatMap(repository, (s) => s.list(input)),
+            }),
+          );
+        }
+
         if (proofs) {
           const persistence = service(ProofPersistence, () => ProofUnavailable.make({}));
 
@@ -653,6 +722,83 @@ export const createPersistence = <T extends object, R, Database extends object =
           }
         }
 
+        const oauthUnavailable = () => OAuthUnavailable.make({});
+
+        function oauthService<I, S>(
+          key: Context.Key<I, S>,
+          moduleId: string,
+          capability: "signIn" | "connected",
+        ): Effect.Effect<S, OAuthUnavailable> {
+          const enabled = oauth.some(
+            (feature) =>
+              feature.moduleId === moduleId &&
+              (capability === "signIn" ? feature.signIn : feature.connected !== undefined),
+          );
+
+          return enabled ? service(key, oauthUnavailable) : Effect.fail(oauthUnavailable());
+        }
+
+        if (oauthSignIn) {
+          const persistence = (moduleId: string) =>
+            oauthService(OAuthSignInPersistence, moduleId, "signIn");
+
+          context = Context.add(context, OAuthSignInPersistence, {
+            issue: (input, prepare) =>
+              Effect.flatMap(persistence(input.context.moduleId), (s) => s.issue(input, prepare)),
+            consume: (input, prepare) =>
+              Effect.flatMap(persistence(input.moduleId), (s) => s.consume(input, prepare)),
+            resolve: (input) =>
+              Effect.flatMap(persistence(input.moduleId), (s) => s.resolve(input)),
+            cleanup: (input, prepare) =>
+              Effect.flatMap(persistence(input.moduleId), (s) => s.cleanup(input, prepare)),
+          });
+        }
+        if (oauthConnected) {
+          const persistence = (moduleId: string) =>
+            oauthService(OAuthConnectedPersistence, moduleId, "connected");
+
+          const revocations = (moduleId: string) =>
+            oauthService(OAuthConnectedRevocations, moduleId, "connected");
+
+          context = context.pipe(
+            Context.add(OAuthConnectedPersistence, {
+              read: (input) => Effect.flatMap(persistence(input.moduleId), (s) => s.read(input)),
+              issue: (input, prepare) =>
+                Effect.flatMap(persistence(input.context.moduleId), (s) => s.issue(input, prepare)),
+              consume: (input, prepare) =>
+                Effect.flatMap(persistence(input.moduleId), (s) => s.consume(input, prepare)),
+              settle: (input, prepare) =>
+                Effect.flatMap(persistence(input.grant.context.moduleId), (s) =>
+                  s.settle(input, prepare),
+                ),
+              list: (input) =>
+                Effect.flatMap(persistence(input.authorization.moduleId), (s) => s.list(input)),
+              disconnect: (input, prepare) =>
+                Effect.flatMap(persistence(input.key.moduleId), (s) =>
+                  s.disconnect(input, prepare),
+                ),
+              claimRefresh: (input, prepare) =>
+                Effect.flatMap(persistence(input.grant.context.moduleId), (s) =>
+                  s.claimRefresh(input, prepare),
+                ),
+              settleRefresh: (input, prepare) =>
+                Effect.flatMap(persistence(input.claim.grant.context.moduleId), (s) =>
+                  s.settleRefresh(input, prepare),
+                ),
+              cleanup: (input, prepare) =>
+                Effect.flatMap(persistence(input.moduleId), (s) => s.cleanup(input, prepare)),
+            }),
+            Context.add(OAuthConnectedRevocations, {
+              claim: (input, prepare) =>
+                Effect.flatMap(revocations(input.moduleId), (s) => s.claim(input, prepare)),
+              settle: (input, prepare) =>
+                Effect.flatMap(revocations(input.claim.job.grant.context.moduleId), (s) =>
+                  s.settle(input, prepare),
+                ),
+            }),
+          );
+        }
+
         // Match the same capability-selected service keys as the acquired graph.
         return context as Context.Context<Ports<C, Id, A>>;
       }),

package/src/internal/phone-native.ts

@@ -428,7 +428,7 @@ export const makeNativePhoneServices = Effect.fnUntraced(function* (
               const requirement =
                 yield* Schema.decodeEffect(AuthenticationRequirement)(originalRequirement);
 
-              if (!passwordEvidenceSatisfiedAt(evidence, requirement, captured.now))
+              if (!(yield* passwordEvidenceSatisfiedAt(evidence, requirement, captured.now)))
                 return yield* rejected();
             }
             if (evidence.proofs.length === 0) return yield* rejected();

package/src/internal/session-native-authority.ts

@@ -1,4 +1,5 @@
 import { type LifecycleHooks } from "@yielded/auth/Hooks";
+import { AuthenticationClock } from "@yielded/auth/Operations";
 import {
   type AuthenticationAuthority,
   StaleAuthentication,
@@ -51,11 +52,14 @@ export const sessionEvidenceDeadline = Effect.fnUntraced(function* (
   if (!assessed.satisfied) return yield* StaleAuthentication.make({});
 
   const boundaries = [
-    ...new Set(
-      evidence.proofs.map(
+    ...new Set([
+      ...evidence.proofs.map(
         (proof) => DateTime.toEpochMillis(proof.verifiedAt) + requirement.maximumAgeMillis,
       ),
-    ),
+      ...(evidence.completionExpiresAt === undefined
+        ? []
+        : [DateTime.toEpochMillis(evidence.completionExpiresAt)]),
+    ]),
   ]
     .filter((n) => n > now)
     .sort((a, b) => a - b);
@@ -139,11 +143,12 @@ export const makeNativeAuthenticationAuthorityServices = Effect.fnUntraced(funct
   });
 
   const native = <A, E, R>(work: Effect.Effect<A, E, R>) =>
-    batch === undefined
+    (batch === undefined
       ? executor.operation(normalizeSessionOperation(work))
       : executor
           .operationBatch(normalizeSessionOperation(work))
-          .pipe(Effect.provideService(SqlBatchCommit, batch));
+          .pipe(Effect.provideService(SqlBatchCommit, batch))
+    ).pipe(Effect.provideService(AuthenticationClock, state.clockPolicy));
 
   const authenticationAuthority: AuthenticationAuthority["Service"] = {
     capture: (subjectId, credentialIds) =>
@@ -183,10 +188,20 @@ export const makeNativeAuthenticationAuthorityServices = Effect.fnUntraced(funct
             current.now,
           );
 
-          const expires = DateTime.toEpochMillis(input.expiresAt),
+          const issued = DateTime.toEpochMillis(input.issuedAt),
+            expires = DateTime.toEpochMillis(input.expiresAt),
             absolute = DateTime.toEpochMillis(input.absoluteExpiresAt);
 
-          if (current.now >= expires || expires > absolute)
+          if (
+            Math.max(issued, DateTime.toEpochMillis(input.now)) - current.now >
+              state.clockPolicy.futureToleranceMillis ||
+            input.evidence.proofs.some(
+              (proof) => DateTime.toEpochMillis(proof.verifiedAt) > issued,
+            ) ||
+            issued >= expires ||
+            current.now >= expires ||
+            expires > absolute
+          )
             return yield* StaleAuthentication.make({});
 
           const pendingExpiry =
@@ -226,6 +241,7 @@ export const makeNativeAuthenticationAuthorityServices = Effect.fnUntraced(funct
                   if (rows.length !== 1) return yield* PendingAuthenticationInvalid.make({});
                 }
               }).pipe(
+                Effect.provideService(AuthenticationClock, state.clockPolicy),
                 Effect.mapError((cause) =>
                   PersistenceMappingError.make({ operation: "decode", cause }),
                 ),

package/src/internal/session-native-login.ts

@@ -1,10 +1,12 @@
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
+import { AuthenticationClock } from "@yielded/auth/Operations";
 import {
   PendingAuthenticationInvalid,
   StaleAuthentication,
   SessionConflict,
   type PendingAuthentication,
   type PendingAuthenticationRecord,
+  type SessionUnavailable,
 } from "@yielded/auth/Sessions";
 import { DateTime, Effect, Option } from "effect";
 import type { SqlClient } from "effect/sql/SqlClient";
@@ -46,7 +48,7 @@ export const makeNativePendingAuthenticationServices = Effect.fnUntraced(functio
   mapping: NativePendingAuthenticationMapping<Claims>,
 ): Effect.fn.Return<
   { readonly pendingAuthentication: PendingAuthentication<Claims> },
-  never,
+  SessionUnavailable,
   SqlClient | LifecycleHooks | SqlBatchCommit
 > {
   const batch = yield* SqlBatchCommit;
@@ -67,11 +69,12 @@ export const makeNativePendingAuthenticationServices = Effect.fnUntraced(functio
     work: Effect.Effect<A, E, R>,
     mode: "transaction" | "statement" = "transaction",
   ) =>
-    batch === undefined
+    (batch === undefined
       ? executor.operation(normalizeSessionOperation(work), mode)
       : executor
           .operationBatch(normalizeSessionOperation(work))
-          .pipe(Effect.provideService(SqlBatchCommit, batch));
+          .pipe(Effect.provideService(SqlBatchCommit, batch))
+    ).pipe(Effect.provideService(AuthenticationClock, state.clockPolicy));
 
   const verifyPayload = Effect.fnUntraced(function* (
     stored: import("./session-native-pending").StoredSessionPending,

package/src/internal/session-native-pending-read.ts

@@ -1,4 +1,4 @@
-import type { TokenDigest } from "@yielded/auth/Schema";
+import type { SubjectId, TokenDigest } from "@yielded/auth/Schema";
 import type { PendingAuthenticationKind } from "@yielded/auth/Sessions";
 import { Effect } from "effect";
 
@@ -6,13 +6,15 @@ import type { NativeSqlTables } from "./native-sql-table";
 import { makeNativeSessionPending } from "./session-native-pending";
 import {
   makeNativeSessionAuthorityState,
+  sessionInvariant,
+  sessionUnavailable,
   type NativeSessionAuthorityMapping,
 } from "./session-native-state";
 import { exactSqlText } from "./sql-change";
+import { canJoinTextColumns } from "./storage-validation";
 
-/** Both semantic pending ports use the same kind-bound physical snapshot.
- * Distinct native ID encodings use their own bound reads; joined rows still
- * validate each decoded owner before returning current policy. */
+/** Both ports re-read the pending row with current authority in one snapshot.
+ * Discovery only selects the independently bound owner for incompatible IDs. */
 export const makeNativeSessionPendingReader = Effect.fnUntraced(function* (
   tables: NativeSqlTables,
   mapping: NativeSessionAuthorityMapping & Parameters<typeof makeNativeSessionPending>[1],
@@ -21,47 +23,58 @@ export const makeNativeSessionPendingReader = Effect.fnUntraced(function* (
   const state = yield* makeNativeSessionAuthorityState(tables, mapping, batch);
   const pending = yield* makeNativeSessionPending(tables, mapping, batch);
 
+  const joinedIds = yield* canJoinTextColumns([
+    pending.table.unencodedTextColumn?.(pending.p.subjectId),
+    state.subject.unencodedTextColumn?.(mapping.subject.id),
+    state.credential.unencodedTextColumn?.(mapping.credential.subjectId),
+  ]).pipe(Effect.mapError(sessionUnavailable));
+
   const read = Effect.fnUntraced(function* (kind: PendingAuthenticationKind, digest: TokenDigest) {
     const { sql, now } = state,
       { p, table } = pending;
 
-    const compatible =
-      table.unencodedTextColumn?.(p.subjectId) !== undefined &&
-      state.subject.unencodedTextColumn?.(mapping.subject.id) !== undefined &&
-      state.credential.unencodedTextColumn?.(mapping.credential.subjectId) !== undefined;
+    let discoveredSubjectId: SubjectId | undefined;
+    let nativeId: unknown;
 
-    if (compatible) {
-      const pt = table.as("authentication_pending"),
-        st = state.joinedSubject,
-        ct = state.joinedCredential,
-        s = mapping.subject,
-        c = mapping.credential;
+    if (!joinedIds) {
+      const selected = yield* pending.read(kind, digest);
 
-      const rows =
-        yield* sql`select ${pt.fields("p_")}, ${st.fields("s_")}, ${ct.fields("c_")}, ${now} as engine_now from ${pt.name} join ${st.name} on ${exactSqlText(sql, st.column(s.id), pt.column(p.subjectId))} and ${state.activeSubject(st)} left join ${ct.name} on ${exactSqlText(sql, ct.column(c.subjectId), pt.column(p.subjectId))} and ${state.activeCredential(ct)} where ${pending.predicate(pt, kind, digest)} limit 65`;
+      if (selected === undefined) return undefined;
+      discoveredSubjectId = selected.record.subjectId;
+      nativeId = yield* mapping.subjectId.toNative(discoveredSubjectId);
+    }
 
-      if (rows[0] === undefined) return undefined;
-      const record = yield* pending.decode(kind, pt.decode(rows[0], "p_"));
-      const owner = yield* mapping.subjectId.toNative(record.subjectId);
+    const pt = table.as("authentication_pending"),
+      st = state.joinedSubject,
+      ct = state.joinedCredential,
+      s = mapping.subject,
+      c = mapping.credential;
 
-      const authority = yield* state.decode(
-        record.subjectId,
-        owner,
-        rows[0],
-        rows.map((row) => ct.decode(row, "c_")),
-        rows[0].engine_now,
-      );
+    const bindOwner = (table: typeof pt, key: string) =>
+      joinedIds
+        ? exactSqlText(sql, table.column(key), pt.column(p.subjectId))
+        : state.id(table, key, nativeId);
 
-      return authority === undefined ? undefined : { record, authority };
-    }
-    const selected = yield* pending.read(kind, digest);
+    const rows =
+      yield* sql`select ${pt.fields("p_")}, ${st.fields("s_")}, ${ct.fields("c_")}, ${now} as engine_now from ${pt.name} join ${st.name} on ${bindOwner(st, s.id)} and ${state.activeSubject(st)} left join ${ct.name} on ${bindOwner(ct, c.subjectId)} and ${state.activeCredential(ct)} where ${pending.predicate(pt, kind, digest)}${joinedIds ? sql`` : sql` and ${bindOwner(pt, p.subjectId)}`} limit 65`;
+
+    if (rows[0] === undefined) return undefined;
+    const record = yield* pending.decode(kind, pt.decode(rows[0], "p_"));
+
+    sessionInvariant(joinedIds || record.subjectId === discoveredSubjectId);
+    const owner = yield* mapping.subjectId.toNative(record.subjectId);
 
-    if (selected === undefined) return undefined;
-    const authority = yield* state.read(selected.record.subjectId);
+    const authority = yield* state.decode(
+      record.subjectId,
+      owner,
+      rows[0],
+      rows.map((row) => ct.decode(row, "c_")),
+      rows[0].engine_now,
+    );
 
-    return authority === undefined || authority.now >= selected.record.expiresAtMillis
+    return authority === undefined || authority.now >= record.expiresAtMillis
       ? undefined
-      : { record: selected.record, authority };
+      : { record, authority };
   });
 
   return { state, pending, read };