@yielded/auth-persistence 0.1.0-beta.31 → 0.1.0-beta.32

package/src/internal/session-native-record.ts

@@ -1,3 +1,4 @@
+import { AuthenticationClock } from "@yielded/auth/Operations";
 import { TokenDigest } from "@yielded/auth/Schema";
 import {
   SessionId,
@@ -50,14 +51,14 @@ export const makeConditionalSqlInsert = Effect.fnUntraced(function* () {
   };
 });
 
-/** Security columns identify the row and own its live time bounds. In particular
- * issuedAt may be assigned by UPDATE's database clock without rewriting a JSON
- * copy of prepared metadata. Claims/provenance decoding remains consumer-owned. */
+/** Security columns own live time bounds and commit-time issuedAt adjustments,
+ * independently of prepared JSON metadata. Claims/provenance decoding remains consumer-owned. */
 export const makeNativeSessionRecords = Effect.fnUntraced(function* <Claims>(
   tables: NativeSqlTables,
   mapping: NativeSessionRecordMapping<Claims>,
 ) {
   const sql = (yield* SqlClient).withoutTransforms();
+  const { futureToleranceMillis } = yield* AuthenticationClock;
 
   const s = mapping.session,
     table = tables(s.table),
@@ -71,7 +72,8 @@ export const makeNativeSessionRecords = Effect.fnUntraced(function* <Claims>(
 
   const live = (t: SqlTable) =>
     sql.and([
-      sql`${millis(t, s.issuedAt)} <= ${now}`,
+      sql`${millis(t, s.issuedAt)} <= ${now} + ${futureToleranceMillis}`,
+      sql`${millis(t, s.issuedAt)} < ${millis(t, s.expiresAt)}`,
       sql`${millis(t, s.expiresAt)} > ${now}`,
       sql`${millis(t, s.absoluteExpiresAt)} >= ${millis(t, s.expiresAt)}`,
     ]);

package/src/internal/session-native-state.ts

@@ -1,3 +1,4 @@
+import { AuthenticationClock } from "@yielded/auth/Operations";
 import { reportAuthFailure } from "@yielded/auth/Persistence";
 import type { SubjectId } from "@yielded/auth/Schema";
 import {
@@ -98,6 +99,7 @@ export const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (
   batch = false,
 ) {
   const sql = (yield* SqlClient).withoutTransforms();
+  const clockPolicy = yield* AuthenticationClock;
 
   const s = mapping.subject,
     c = mapping.credential;
@@ -246,6 +248,7 @@ export const makeNativeSessionAuthorityState = Effect.fnUntraced(function* (
 
   return {
     sql,
+    clockPolicy,
     subject,
     credential,
     joinedSubject,

package/src/internal/session-native-stateful.ts

@@ -1,4 +1,5 @@
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
+import { AuthenticationClock } from "@yielded/auth/Operations";
 import {
   SessionConflict,
   SessionInvalid,
@@ -10,6 +11,7 @@ import {
   type StatefulSessionPersistence,
   type StatefulSessionRecord,
   type SessionRepository,
+  type SessionUnavailable,
 } from "@yielded/auth/Sessions";
 import { DateTime, Effect, Option, Schema } from "effect";
 import type { SqlClient } from "effect/sql/SqlClient";
@@ -43,6 +45,7 @@ import {
   registerSqlBatchPostcondition,
   registerSqlPostcondition,
 } from "./sql-commit";
+import { canJoinTextColumns, withStorageValidation } from "./storage-validation";
 import type { AnyTableModel } from "./table-model";
 
 export type NativeStatefulSessionMapping<Claims> = StatefulSessionMapping<
@@ -63,7 +66,7 @@ export const makeNativeStatefulSessionServices = Effect.fnUntraced(function* <Cl
     readonly statefulSessionPersistence: StatefulSessionPersistence<Claims>;
     readonly sessionRepository: SessionRepository;
   },
-  never,
+  SessionUnavailable,
   SqlClient | LifecycleHooks | SqlBatchCommit
 > {
   const batch = yield* SqlBatchCommit;
@@ -89,11 +92,12 @@ export const makeNativeStatefulSessionServices = Effect.fnUntraced(function* <Cl
     work: Effect.Effect<A, E, R>,
     mode: "transaction" | "statement" = "transaction",
   ) =>
-    batch === undefined
+    (batch === undefined
       ? executor.operation(normalizeSessionOperation(work), mode)
       : executor
           .operationBatch(normalizeSessionOperation(work))
-          .pipe(Effect.provideService(SqlBatchCommit, batch));
+          .pipe(Effect.provideService(SqlBatchCommit, batch))
+    ).pipe(Effect.provideService(AuthenticationClock, state.clockPolicy));
 
   const stage = Effect.fnUntraced(function* (statement: Fragment, expected?: number) {
     if (batch !== undefined) {
@@ -118,6 +122,7 @@ export const makeNativeStatefulSessionServices = Effect.fnUntraced(function* <Cl
 
           sessionInvariant(rows.length === 1);
         }).pipe(
+          Effect.provideService(AuthenticationClock, state.clockPolicy),
           Effect.mapError((cause) => PersistenceMappingError.make({ operation: "decode", cause })),
         ),
       });
@@ -139,47 +144,63 @@ export const makeNativeStatefulSessionServices = Effect.fnUntraced(function* <Cl
       ),
     );
 
+  const [joinedIds, joinedRevisions] = yield* Effect.forEach(
+    [
+      [
+        table.unencodedTextColumn?.(s.subjectId),
+        state.subject.unencodedTextColumn?.(mapping.subject.id),
+      ],
+      [
+        table.unencodedTextColumn?.(s.securityRevision),
+        state.subject.unencodedTextColumn?.(mapping.subject.securityRevision),
+      ],
+    ],
+    canJoinTextColumns,
+  ).pipe(withStorageValidation, Effect.mapError(sessionUnavailable));
+
   const verify = Effect.fnUntraced(function* (digest: StatefulSessionRecord<Claims>["digest"]) {
     const subject = state.subject.as("verified_subject"),
       session = table.as("verified_session"),
       owner = mapping.subject;
 
-    if (
-      table.unencodedTextColumn?.(s.subjectId) !== undefined &&
-      state.subject.unencodedTextColumn?.(owner.id) !== undefined
-    ) {
-      const rows =
-        yield* sql`select ${session.fields("session_")}, ${subject.fields("subject_")} from ${session.name} join ${subject.name} on ${exactSqlText(sql, subject.column(owner.id), session.column(s.subjectId))} and ${state.activeSubject(subject)} and ${exactSqlText(sql, subject.column(owner.securityRevision), session.column(s.securityRevision))} where ${exact(session, s.digest, digest)} and ${live(session)} limit 2`;
-
-      sessionInvariant(rows.length <= 1);
-      if (rows[0] === undefined) return undefined;
-      const record = yield* records.decode(session.decode(rows[0], "session_"));
-      const decoded = subject.decode(rows[0], "subject_");
+    let discoveredSubjectId: StatefulSessionRecord<Claims>["subjectId"] | undefined;
+    let nativeSubject: unknown;
 
-      sessionInvariant(
-        (yield* mapping.subjectId.toSubject(decoded[owner.id])) === record.subjectId &&
-          decoded[owner.securityRevision] === record.securityRevision &&
-          owner.isActiveStatus(decoded[owner.status]),
-      );
+    if (!joinedIds) {
+      const discovered = yield* records.read(digest);
 
-      return record;
+      if (discovered === undefined) return undefined;
+      discoveredSubjectId = discovered.subjectId;
+      nativeSubject = yield* mapping.subjectId.toNative(discoveredSubjectId);
     }
-    const record = yield* records.read(digest);
 
-    if (record === undefined) return undefined;
-    const nativeSubject = yield* mapping.subjectId.toNative(record.subjectId);
+    const owns = joinedIds
+      ? exactSqlText(sql, subject.column(owner.id), session.column(s.subjectId))
+      : sql`${state.id(subject, owner.id, nativeSubject)} and ${state.id(session, s.subjectId, nativeSubject)}`;
+
+    const revision = joinedRevisions
+      ? exactSqlText(
+          sql,
+          subject.column(owner.securityRevision),
+          session.column(s.securityRevision),
+        )
+      : sql`true`;
 
     const rows =
-      yield* sql`select ${subject.fields("subject_")} from ${subject.name} where ${state.id(subject, owner.id, nativeSubject)} and ${state.activeSubject(subject)} and ${state.exact(subject, owner.securityRevision, record.securityRevision)} and ${now} < ${DateTime.toEpochMillis(record.expiresAt)} limit 2`;
+      yield* sql`select ${session.fields("session_")}, ${subject.fields("subject_")} from ${session.name} join ${subject.name} on ${owns} and ${state.activeSubject(subject)} and ${revision} where ${exact(session, s.digest, digest)} and ${live(session)} limit 2`;
 
     sessionInvariant(rows.length <= 1);
     if (rows[0] === undefined) return undefined;
+    const record = yield* records.decode(session.decode(rows[0], "session_"));
+    const decoded = subject.decode(rows[0], "subject_");
+
     sessionInvariant(
-      (yield* mapping.subjectId.toSubject(subject.decode(rows[0], "subject_")[owner.id])) ===
-        record.subjectId,
+      (joinedIds || record.subjectId === discoveredSubjectId) &&
+        (yield* mapping.subjectId.toSubject(decoded[owner.id])) === record.subjectId &&
+        owner.isActiveStatus(decoded[owner.status]),
     );
 
-    return record;
+    return decoded[owner.securityRevision] === record.securityRevision ? record : undefined;
   });
 
   const persistence: StatefulSessionPersistence<Claims> = {
@@ -201,10 +222,21 @@ export const makeNativeStatefulSessionServices = Effect.fnUntraced(function* <Cl
               current.now,
             );
 
-            const expires = DateTime.toEpochMillis(input.session.expiresAt),
+            const issued = Math.max(
+                current.now,
+                DateTime.toEpochMillis(input.now),
+                DateTime.toEpochMillis(input.session.issuedAt),
+                ...input.evidence.proofs.map((proof) => DateTime.toEpochMillis(proof.verifiedAt)),
+              ),
+              expires = DateTime.toEpochMillis(input.session.expiresAt),
               absolute = DateTime.toEpochMillis(input.session.absoluteExpiresAt);
 
-            if (current.now >= expires || expires > absolute)
+            if (
+              issued - current.now > state.clockPolicy.futureToleranceMillis ||
+              issued >= expires ||
+              current.now >= expires ||
+              expires > absolute
+            )
               return yield* StaleAuthentication.make({});
             let pendingExpiry = Infinity;
 
@@ -250,14 +282,10 @@ export const makeNativeStatefulSessionServices = Effect.fnUntraced(function* <Cl
               sessionId,
               subjectId: current.revision.subjectId,
               securityRevision: current.revision.securityRevision,
-              assurance:
-                input.handoffSourceSessionId === undefined
-                  ? assessment.assessed.assurance
-                  : input.session.assurance,
               provenance: yield* snapshotSessionAuthenticationProvenance({
                 evidence: input.evidence,
               }),
-              issuedAt: DateTime.makeUnsafe(current.now),
+              issuedAt: DateTime.makeUnsafe(issued),
             };
 
             const deadline = Math.min(expires, assessment.validUntil, pendingExpiry);
@@ -303,6 +331,7 @@ export const makeNativeStatefulSessionServices = Effect.fnUntraced(function* <Cl
                     authority.now,
                   );
                 }).pipe(
+                  Effect.provideService(AuthenticationClock, state.clockPolicy),
                   Effect.mapError((cause) =>
                     PersistenceMappingError.make({ operation: "decode", cause }),
                   ),
@@ -326,10 +355,15 @@ export const makeNativeStatefulSessionServices = Effect.fnUntraced(function* <Cl
         classify(
           Effect.gen(function* () {
             const absolute = DateTime.toEpochMillis(input.record.absoluteExpiresAt),
-              expires = DateTime.toEpochMillis(input.nextExpiresAt);
+              expires = DateTime.toEpochMillis(input.nextExpiresAt),
+              preparedAt = Math.max(
+                DateTime.toEpochMillis(input.now),
+                DateTime.toEpochMillis(input.record.issuedAt),
+              );
 
             if (
               expires > absolute ||
+              preparedAt >= expires ||
               input.nextDigest === input.record.digest ||
               input.nextCredentialVersion === input.record.credentialVersion
             )
@@ -350,17 +384,21 @@ export const makeNativeStatefulSessionServices = Effect.fnUntraced(function* <Cl
               digest: input.nextDigest,
               credentialVersion: input.nextCredentialVersion,
               expiresAt: input.nextExpiresAt,
-              issuedAt: DateTime.makeUnsafe(sampled),
+              issuedAt: DateTime.makeUnsafe(Math.max(sampled, preparedAt)),
             };
 
             const values = {
               ...s.encodeRotation(prepared),
               [s.digest]: prepared.digest,
-              [s.issuedAt]: tables.expression(mapping.clock.fromMillis(now)),
+              [s.issuedAt]: tables.expression(
+                mapping.clock.fromMillis(
+                  sql`case when ${now} >= ${preparedAt} then ${now} else ${preparedAt} end`,
+                ),
+              ),
               [s.expiresAt]: s.encodeInstant(prepared.expiresAt),
             };
 
-            const condition = sql`${yield* records.owner(input.record)} and ${live(table)} and ${now} < ${expires} and ${records.millis(table, s.absoluteExpiresAt)} = ${absolute}`;
+            const condition = sql`${yield* records.owner(input.record)} and ${live(table)} and ${preparedAt} <= ${now} + ${state.clockPolicy.futureToleranceMillis} and ${now} < ${expires} and ${records.millis(table, s.absoluteExpiresAt)} = ${absolute}`;
             const update = sql`${table.update(values)} where ${condition}`;
             let record = prepared;
 
@@ -486,26 +524,81 @@ export const makeNativeStatefulSessionServices = Effect.fnUntraced(function* <Cl
                   yield* Schema.decodeEffect(SessionId)(input.cursor),
                 );
 
-          const rows =
-            yield* sql`select ${list.fields("session_")}, ${st.fields("subject_")} from ${list.name} join ${st.name} on ${state.id(st, owner.id, nativeSubject)} and ${state.activeSubject(st)} and ${exactSqlText(sql, st.column(owner.securityRevision), list.column(s.securityRevision))} where ${state.id(list, s.subjectId, nativeSubject)} and ${live(list)}${cursor === undefined ? sql`` : sql` and ${list.column(s.sessionId)} > ${list.value(s.sessionId, cursor)}`} order by ${list.column(s.sessionId)} limit ${input.limit + 1}`;
+          let revision: StatefulSessionRecord<Claims>["securityRevision"] | undefined;
+
+          // Bind both revisions in SQL so stale rows cannot consume a page.
+          if (!joinedRevisions) {
+            const subjects =
+              yield* sql`select ${st.fields("subject_")} from ${st.name} where ${state.id(st, owner.id, nativeSubject)} and ${state.activeSubject(st)} limit 2`;
+
+            sessionInvariant(subjects.length <= 1);
+            if (subjects[0] === undefined) return { sessions: [] };
+            const subject = st.decode(subjects[0], "subject_");
+
+            sessionInvariant(
+              (yield* mapping.subjectId.toSubject(subject[owner.id])) === input.subjectId,
+            );
+            revision = yield* Schema.decodeUnknownEffect(SessionMetadata.fields.securityRevision)(
+              subject[owner.securityRevision],
+            );
+          }
+
+          // Keep the owner in the page snapshot even when its discovered revision changed.
+          // Retry that read once; continued authority changes are not pagination exhaustion.
+          for (let attempt = 0; attempt < 2; attempt++) {
+            const currentRevision = joinedRevisions
+              ? exactSqlText(
+                  sql,
+                  st.column(owner.securityRevision),
+                  list.column(s.securityRevision),
+                )
+              : sql`${state.exact(st, owner.securityRevision, revision)} and ${exact(list, s.securityRevision, revision)}`;
+
+            const rows =
+              yield* sql`select ${list.fields("session_")}, ${st.fields("subject_")}, ${list.column(s.subjectId)} as session_owner from ${st.name} left join ${list.name} on ${state.id(list, s.subjectId, nativeSubject)} and ${currentRevision} and ${live(list)}${cursor === undefined ? sql`` : sql` and ${list.column(s.sessionId)} > ${list.value(s.sessionId, cursor)}`} where ${state.id(st, owner.id, nativeSubject)} and ${state.activeSubject(st)} order by ${list.column(s.sessionId)} limit ${input.limit + 1}`;
+
+            const first = rows[0];
 
-          const decoded = yield* Effect.forEach(rows.slice(0, input.limit), (row) =>
-            Effect.gen(function* () {
-              const record = yield* records.decode(list.decode(row, "session_"));
+            if (first === undefined) return { sessions: [] };
+            if (!joinedRevisions) {
+              const subject = st.decode(first, "subject_");
 
               sessionInvariant(
-                record.subjectId === input.subjectId &&
-                  (yield* mapping.subjectId.toSubject(st.decode(row, "subject_")[owner.id])) ===
-                    input.subjectId,
+                (yield* mapping.subjectId.toSubject(subject[owner.id])) === input.subjectId,
               );
 
-              return yield* Schema.decodeEffect(Schema.toType(SessionMetadata))(record);
-            }),
-          );
+              const current = yield* Schema.decodeUnknownEffect(
+                SessionMetadata.fields.securityRevision,
+              )(subject[owner.securityRevision]);
+
+              if (current !== revision) {
+                revision = current;
+                continue;
+              }
+            }
+            if (first.session_owner === null) return { sessions: [] };
+
+            const decoded = yield* Effect.forEach(rows.slice(0, input.limit), (row) =>
+              Effect.gen(function* () {
+                const record = yield* records.decode(list.decode(row, "session_"));
+                const subject = st.decode(row, "subject_");
+
+                sessionInvariant(
+                  record.subjectId === input.subjectId &&
+                    (yield* mapping.subjectId.toSubject(subject[owner.id])) === input.subjectId &&
+                    subject[owner.securityRevision] === record.securityRevision,
+                );
+
+                return yield* Schema.decodeEffect(Schema.toType(SessionMetadata))(record);
+              }),
+            );
+
+            const nextCursor = rows.length > input.limit ? decoded.at(-1)?.sessionId : undefined;
 
-          const nextCursor = rows.length > input.limit ? decoded.at(-1)?.sessionId : undefined;
+            return { sessions: decoded, ...(nextCursor === undefined ? {} : { nextCursor }) };
+          }
 
-          return { sessions: decoded, ...(nextCursor === undefined ? {} : { nextCursor }) };
+          return yield* sessionUnavailable();
         }),
       ),
   };

package/src/internal/session-native-step-up.ts

@@ -1,15 +1,15 @@
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
-import { AuthenticationAssurance } from "@yielded/auth/Operations";
+import { AuthenticationClock } from "@yielded/auth/Operations";
 import {
   SessionConflict,
   SessionStepUpInvalid,
   StaleAuthentication,
-  SessionMetadata,
   type SessionStepUpPersistence,
   type SessionStepUpIntent,
   type StatefulSessionRecord,
+  type SessionUnavailable,
 } from "@yielded/auth/Sessions";
-import { DateTime, Effect, Option, Schema } from "effect";
+import { DateTime, Effect, Option } from "effect";
 import type { SqlClient } from "effect/sql/SqlClient";
 import type { Fragment } from "effect/sql/Statement";
 
@@ -58,14 +58,12 @@ export type NativeSessionStepUpMapping<Claims> = SessionStepUpMapping<
   unknown
 >;
 
-const assuranceJson = Schema.encodeSync(Schema.fromJsonString(SessionMetadata.fields.assurance));
-
 export const makeNativeSessionStepUpServices = Effect.fnUntraced(function* <Claims>(
   tables: NativeSqlTables,
   mapping: NativeSessionStepUpMapping<Claims>,
 ): Effect.fn.Return<
   { readonly sessionStepUpPersistence: SessionStepUpPersistence<Claims> },
-  never,
+  SessionUnavailable,
   SqlClient | LifecycleHooks | SqlBatchCommit
 > {
   const batch = yield* SqlBatchCommit;
@@ -92,11 +90,12 @@ export const makeNativeSessionStepUpServices = Effect.fnUntraced(function* <Clai
     work: Effect.Effect<A, E, R>,
     mode: "transaction" | "statement" = "transaction",
   ) =>
-    batch === undefined
+    (batch === undefined
       ? executor.operation(normalizeSessionOperation(work), mode)
       : executor
           .operationBatch(normalizeSessionOperation(work))
-          .pipe(Effect.provideService(SqlBatchCommit, batch));
+          .pipe(Effect.provideService(SqlBatchCommit, batch))
+    ).pipe(Effect.provideService(AuthenticationClock, state.clockPolicy));
 
   const decode = Effect.fnUntraced(function* (stored: StoredSessionPending) {
     const intent = yield* decodeStepUpIntent(stored.snapshot);
@@ -118,7 +117,7 @@ export const makeNativeSessionStepUpServices = Effect.fnUntraced(function* <Clai
     intent: Omit<SessionStepUpIntent, "version">,
     instant: number,
   ) {
-    if (!stepUpIntentLive(intent, mapping.source.kind, DateTime.makeUnsafe(instant)))
+    if (!(yield* stepUpIntentLive(intent, mapping.source.kind, DateTime.makeUnsafe(instant))))
       return undefined;
     const subject = yield* mapping.subjectId.toNative(intent.revision.subjectId);
 
@@ -178,6 +177,7 @@ export const makeNativeSessionStepUpServices = Effect.fnUntraced(function* <Clai
         check: Effect.gen(function* () {
           sessionInvariant((yield* sql`select 1 where ${condition}`).length === 1);
         }).pipe(
+          Effect.provideService(AuthenticationClock, state.clockPolicy),
           Effect.mapError((cause) => PersistenceMappingError.make({ operation: "decode", cause })),
         ),
       });
@@ -212,7 +212,7 @@ export const makeNativeSessionStepUpServices = Effect.fnUntraced(function* <Clai
             snapshot = yield* encodeStepUpIntent(intent);
 
           yield* state.guardPolicy(current);
-          const condition = sql`${state.authorityCondition(intent.revision, current.native)} and ${original.condition} and ${now} >= ${DateTime.toEpochMillis(intent.sourceAuthenticatedAt)} and ${now} < ${DateTime.toEpochMillis(intent.expiresAt)}`;
+          const condition = sql`${state.authorityCondition(intent.revision, current.native)} and ${original.condition} and ${now} >= ${current.now} and ${DateTime.toEpochMillis(intent.sourceAuthenticatedAt)} <= ${now} + ${state.clockPolicy.futureToleranceMillis} and ${now} < ${DateTime.toEpochMillis(intent.expiresAt)}`;
 
           yield* pending
             .insert(
@@ -258,7 +258,11 @@ export const makeNativeSessionStepUpServices = Effect.fnUntraced(function* <Clai
 
             if (
               !sameSessionRevision(current.revision, intent.revision) ||
-              !stepUpIntentLive(intent, mapping.source.kind, DateTime.makeUnsafe(current.now))
+              !(yield* stepUpIntentLive(
+                intent,
+                mapping.source.kind,
+                DateTime.makeUnsafe(current.now),
+              ))
             )
               return undefined;
 
@@ -268,6 +272,7 @@ export const makeNativeSessionStepUpServices = Effect.fnUntraced(function* <Clai
           }),
         )
         .pipe(
+          Effect.provideService(AuthenticationClock, state.clockPolicy),
           Effect.flatMap((value) =>
             value === undefined
               ? Effect.fail(SessionStepUpInvalid.make({}))
@@ -313,20 +318,16 @@ export const makeNativeSessionStepUpServices = Effect.fnUntraced(function* <Clai
               return yield* SessionStepUpInvalid.make({});
           }
 
-          const base = yield* sessionEvidenceDeadline(evidence, current.requirement, current.now),
+          const prepared = yield* sessionEvidenceDeadline(
+              evidence,
+              plan.baseRequirement,
+              current.now,
+            ),
+            base = yield* sessionEvidenceDeadline(evidence, current.requirement, current.now),
             profile = yield* sessionEvidenceDeadline(evidence, intent.requirement, current.now);
 
-          if (
-            assuranceJson(
-              AuthenticationAssurance.make({
-                ...base.assessed.assurance,
-                authenticatedAt: profile.assessed.assurance.authenticatedAt,
-              }),
-            ) !== assuranceJson(replacement.inspection.session.assurance)
-          )
-            return yield* SessionStepUpInvalid.make({});
-
           const deadline = Math.min(
+            prepared.validUntil,
             base.validUntil,
             profile.validUntil,
             DateTime.toEpochMillis(intent.expiresAt),
@@ -335,7 +336,8 @@ export const makeNativeSessionStepUpServices = Effect.fnUntraced(function* <Clai
 
           if (
             current.now >= deadline ||
-            DateTime.toEpochMillis(replacement.inspection.session.issuedAt) > current.now ||
+            DateTime.toEpochMillis(replacement.inspection.session.issuedAt) - current.now >
+              state.clockPolicy.futureToleranceMillis ||
             DateTime.toEpochMillis(replacement.inspection.session.expiresAt) >
               DateTime.toEpochMillis(intent.sourceAbsoluteExpiresAt)
           )
@@ -430,6 +432,7 @@ export const makeNativeSessionStepUpServices = Effect.fnUntraced(function* <Clai
                 sessionInvariant(
                   actual !== undefined && sameSessionRevision(actual.revision, evidence.revision),
                 );
+                yield* sessionEvidenceDeadline(evidence, plan.baseRequirement, actual.now);
                 yield* sessionEvidenceDeadline(evidence, actual.requirement, actual.now);
                 yield* sessionEvidenceDeadline(evidence, intent.requirement, actual.now);
                 if (replacementRecord !== undefined && records !== undefined) {
@@ -438,6 +441,7 @@ export const makeNativeSessionStepUpServices = Effect.fnUntraced(function* <Clai
                   sessionInvariant(row !== undefined && sameSessionRecord(row, replacementRecord));
                 }
               }).pipe(
+                Effect.provideService(AuthenticationClock, state.clockPolicy),
                 Effect.mapError((cause) =>
                   PersistenceMappingError.make({ operation: "decode", cause }),
                 ),

package/src/internal/session-native-validity.ts

@@ -1,4 +1,5 @@
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
+import { AuthenticationClock } from "@yielded/auth/Operations";
 import {
   SessionInvalid,
   StaleAuthentication,
@@ -46,6 +47,7 @@ export const makeNativeSignedSessionValidityServices = Effect.fnUntraced(functio
   SqlClient | LifecycleHooks | SqlBatchCommit
 > {
   const batch = yield* SqlBatchCommit;
+  const { futureToleranceMillis } = yield* AuthenticationClock;
 
   const sql = (yield* SqlClient).withoutTransforms(),
     executor = yield* makeSqlCommitExecutor(sessionUnavailable);
@@ -113,7 +115,7 @@ export const makeNativeSignedSessionValidityServices = Effect.fnUntraced(functio
               nativeSession = yield* mapping.sessionId.toNative(record.sessionId);
 
             const rows =
-              yield* sql`select ${subject.fields("subject_")} from ${subject.name} where ${id(subject, s.id, nativeSubject)} and ${id(subject, s.status, s.activeStatusValue)} and ${exact(subject, s.securityRevision, record.securityRevision)} and ${now} >= ${DateTime.toEpochMillis(record.issuedAt)} and ${now} < ${DateTime.toEpochMillis(record.expiresAt)} and ${DateTime.toEpochMillis(record.expiresAt)} <= ${DateTime.toEpochMillis(record.absoluteExpiresAt)} and not exists(select 1 from ${tombstone.name} where ${key(nativeSubject, nativeSession)}) limit 2`;
+              yield* sql`select ${subject.fields("subject_")} from ${subject.name} where ${id(subject, s.id, nativeSubject)} and ${id(subject, s.status, s.activeStatusValue)} and ${exact(subject, s.securityRevision, record.securityRevision)} and ${DateTime.toEpochMillis(record.issuedAt)} <= ${now} + ${futureToleranceMillis} and ${DateTime.toEpochMillis(record.issuedAt)} < ${DateTime.toEpochMillis(record.expiresAt)} and ${now} < ${DateTime.toEpochMillis(record.expiresAt)} and ${DateTime.toEpochMillis(record.expiresAt)} <= ${DateTime.toEpochMillis(record.absoluteExpiresAt)} and not exists(select 1 from ${tombstone.name} where ${key(nativeSubject, nativeSession)}) limit 2`;
 
             sessionInvariant(rows.length <= 1);
             if (rows[0] === undefined) return false;

package/src/internal/sql-authority.ts

@@ -1,4 +1,5 @@
 import type { LifecycleHooks } from "@yielded/auth/Hooks";
+import { reportAuthDiagnostic } from "@yielded/auth/Persistence";
 import { SessionUnavailable, type AuthenticationAuthority } from "@yielded/auth/Sessions";
 import { Effect } from "effect";
 import { SqlClient } from "effect/sql";
@@ -32,10 +33,13 @@ export const makeAuthenticationAuthorityServices = Effect.fnUntraced(function* <
 > {
   const sql = yield* SqlClient.SqlClient;
 
-  if (!sql.onDialectOrElse({ pg: () => true, sqlite: () => true, orElse: () => false }))
+  if (!sql.onDialectOrElse({ pg: () => true, sqlite: () => true, orElse: () => false })) {
+    yield* reportAuthDiagnostic("persistence-validation", "configuration");
+
     return yield* PersistenceConfigurationError.make({
       reason: "Authentication authority requires PostgreSQL or SQLite",
     });
+  }
   yield* validateSqlStorage(mapping).pipe(Effect.mapError(() => SessionUnavailable.make({})));
 
   // Erase mapped native ID callback variance, never decoded authentication data.