@effect-auth/core 0.1.0-alpha.15 → 0.1.0-alpha.18

package/dist/AuthFlow.d.ts

@@ -1,15 +1,21 @@
 import { Context, Data, Duration, Effect, Layer, Redacted } from "effect";
+import type { AuthenticationEvidence } from "./Assurance.js";
 import { Challenge } from "./Challenge.js";
 import type { ChallengeService } from "./Challenge.js";
 import type { CryptoService } from "./Crypto.js";
-import type { OAuthProviderId, UnixMillis } from "./Identifiers.js";
-import { AuthFlowId, ChallengeId, Email, UserId } from "./Identifiers.js";
+import type { IdentityId, OAuthProviderId } from "./Identifiers.js";
+import { AuthFlowId, ChallengeId, UnixMillis, UserId } from "./Identifiers.js";
+import type { IdentityKind } from "./Identity.js";
 import { LoginApprovalReview } from "./LoginApproval.js";
 import type { LoginApprovalChannel, LoginApprovalFlowService, LoginApprovalFlowStartError, LoginApprovalIntent, LoginApprovalPolicyService, LoginApprovalReason, LoginApprovalReviewError, LoginApprovalReviewService, LoginApprovalSessionBinding, LoginDeviceContext } from "./LoginApproval.js";
 import type { LoginNotificationService } from "./LoginNotification.js";
 import type { LoginRequestContext, LoginRiskContext, LoginRiskEngineService, LoginRiskError } from "./LoginRisk.js";
+import type { PasskeyCredentialManagementError, PasskeyCredentialManagementService } from "./Passkey.js";
+import type { RecoveryCodeManagementError, RecoveryCodeManagementService } from "./RecoveryCode.js";
+import type { RecoveryRequirementPolicyService } from "./RecoveryPolicy.js";
 import { Sessions } from "./Sessions.js";
-import type { AuthAssuranceLevel, AuthMethodReference, IssuedSession, SessionCreateError, SessionClaims, SessionsService } from "./Sessions.js";
+import type { AuthAssuranceLevel, AuthMethodReference, IssuedSession, SessionCreateError, SessionClaims, SessionsService, PreparedSession } from "./Sessions.js";
+import type { TotpFactorManagementError, TotpFactorManagementService } from "./Totp.js";
 import type { TrustedDeviceError, TrustedDeviceService } from "./TrustedDevice.js";
 export type AuthMethod = "password" | "email-otp" | "magic-link" | "passkey" | "oauth" | "totp" | "backup-code" | (string & {});
 export type EmailVerificationSessionMode = "allow-unverified" | "limited-session";
@@ -30,51 +36,124 @@ export interface EmailVerificationSessionPolicyService {
 declare const EmailVerificationSessionPolicy_base: Context.ServiceClass<EmailVerificationSessionPolicy, "auth/EmailVerificationSessionPolicy", EmailVerificationSessionPolicyService>;
 export declare class EmailVerificationSessionPolicy extends EmailVerificationSessionPolicy_base {
 }
-export declare namespace EmailVerificationSessionPolicy {
-    const make: (service: EmailVerificationSessionPolicyService) => EmailVerificationSessionPolicyService;
-}
 export declare const makeEmailVerificationSessionPolicy: (options?: EmailVerificationSessionPolicyOptions) => EmailVerificationSessionPolicyService;
 export declare const EmailVerificationSessionPolicyLive: (options?: EmailVerificationSessionPolicyOptions) => Layer.Layer<EmailVerificationSessionPolicy, never, never>;
 export interface MfaFactor {
     readonly type: "totp" | "backup-code" | "passkey" | (string & {});
 }
+export type MfaRequirementMode = "disabled" | "when-factors-present";
+export interface MfaRequirementPolicyInput<Method extends AuthMethod = AuthMethod> extends PrimaryFactorResult<Method> {
+    readonly factors: readonly MfaFactor[];
+    readonly risk?: LoginRiskContext;
+}
+export type MfaRequirementPolicyDecision = {
+    readonly _tag: "Continue";
+} | {
+    readonly _tag: "RequireMfa";
+    readonly factors: readonly MfaFactor[];
+};
+export interface MfaRequirementPolicyOptions {
+    readonly mode?: MfaRequirementMode;
+    readonly methods?: readonly AuthMethod[];
+}
+export interface MfaRequirementPolicyService {
+    readonly decide: <Method extends AuthMethod>(input: MfaRequirementPolicyInput<Method>) => Effect.Effect<MfaRequirementPolicyDecision>;
+}
+declare const MfaRequirementPolicy_base: Context.ServiceClass<MfaRequirementPolicy, "auth/MfaRequirementPolicy", MfaRequirementPolicyService>;
+export declare class MfaRequirementPolicy extends MfaRequirementPolicy_base {
+}
+export declare const defaultMfaRequirementMethods: readonly ["password", "email-otp", "magic-link", "oauth"];
+export declare const makeMfaRequirementPolicy: (options?: MfaRequirementPolicyOptions) => MfaRequirementPolicyService;
+export declare const MfaRequirementPolicyLive: (options?: MfaRequirementPolicyOptions) => Layer.Layer<MfaRequirementPolicy, never, never>;
 export interface PrimaryFactorResult<Method extends AuthMethod = AuthMethod> {
     readonly userId: UserId;
-    readonly email?: Email;
+    readonly identity?: AuthenticatedIdentityContext;
+    readonly emailDestination?: EmailDestinationContext;
     readonly intent?: LoginApprovalIntent;
     readonly method: Method;
-    readonly amr: readonly AuthMethodReference[];
-    readonly aal: AuthAssuranceLevel;
+    readonly evidence: readonly AuthenticationEvidence[];
     readonly claims?: SessionClaims;
     readonly device?: LoginDeviceContext;
     readonly trustedDeviceToken?: Redacted.Redacted<string>;
+    readonly deviceKey?: string;
+    readonly locationKey?: string;
     readonly request?: LoginRequestContext;
+    readonly risk?: LoginRiskContext;
     readonly metadata?: Readonly<Record<string, unknown>>;
 }
+export interface AuthFlowRequireMfaInput<Method extends AuthMethod = AuthMethod> extends PrimaryFactorResult<Method> {
+    readonly factors: readonly MfaFactor[];
+    readonly ttl?: Duration.Duration;
+    readonly secret?: Redacted.Redacted<string>;
+}
 export interface MfaCompleteInput {
     readonly flowId: AuthFlowId;
     readonly userId?: UserId;
     readonly method: AuthMethod;
-    readonly amr?: readonly AuthMethodReference[];
-    readonly aal?: AuthAssuranceLevel;
+    readonly evidence: AuthenticationEvidence;
     readonly secret?: Redacted.Redacted<string>;
     readonly now?: UnixMillis;
     readonly metadata?: Readonly<Record<string, unknown>>;
 }
 export interface AuthFlowCompleteInput<Method extends AuthMethod = AuthMethod> {
     readonly userId: UserId;
-    readonly email?: Email;
+    readonly identity?: AuthenticatedIdentityContext;
+    readonly emailDestination?: EmailDestinationContext;
     readonly intent?: LoginApprovalIntent;
     readonly method: Method;
-    readonly amr: readonly AuthMethodReference[];
-    readonly aal: AuthAssuranceLevel;
+    readonly evidence: readonly AuthenticationEvidence[];
     readonly claims?: SessionClaims;
     readonly device?: LoginDeviceContext;
+    readonly deviceKey?: string;
+    readonly locationKey?: string;
     readonly request?: LoginRequestContext;
     readonly risk?: LoginRiskContext;
-    readonly mfaVerifiedAt?: UnixMillis;
     readonly metadata?: Readonly<Record<string, unknown>>;
 }
+export interface AuthFlowDerivedInput<Method extends AuthMethod = AuthMethod> extends AuthFlowCompleteInput<Method> {
+    readonly amr: readonly AuthMethodReference[];
+    readonly aal: AuthAssuranceLevel;
+    readonly primaryEstablished: boolean;
+    readonly recoveryRemediation: boolean;
+    readonly mfaVerifiedAt?: UnixMillis;
+}
+export interface AuthenticatedIdentityContext {
+    readonly identityId: IdentityId;
+    readonly kind: IdentityKind;
+    readonly verified: boolean;
+}
+export interface EmailDestinationContext {
+    readonly identityId: IdentityId;
+    readonly email: import("./Identifiers.js").Email;
+}
+export type AuthFlowPipelinePhase = "before-risk" | "after-risk" | "before-mfa" | "after-mfa" | "before-login-approval";
+export interface AuthFlowPipelineContext {
+    readonly phase: AuthFlowPipelinePhase;
+    readonly input: AuthFlowDerivedInput;
+    readonly mfaSatisfied: boolean;
+}
+export type AuthFlowPipelineDecision = {
+    readonly _tag: "Continue";
+} | {
+    readonly _tag: "PolicyDenied";
+    readonly reason?: string;
+};
+export interface AuthFlowPipelineService {
+    readonly advance: (context: AuthFlowPipelineContext) => Effect.Effect<AuthFlowPipelineDecision>;
+}
+declare const AuthFlowPipeline_base: Context.ServiceClass<AuthFlowPipeline, "auth/AuthFlowPipeline", AuthFlowPipelineService>;
+export declare class AuthFlowPipeline extends AuthFlowPipeline_base {
+}
+export declare namespace AuthFlowPipeline {
+    const continueWith: () => AuthFlowPipelineDecision;
+    const deny: (reason?: string) => AuthFlowPipelineDecision;
+}
+export interface AuthFlowPipelineStage {
+    readonly phases?: readonly AuthFlowPipelinePhase[];
+    readonly run: (context: AuthFlowPipelineContext) => Effect.Effect<AuthFlowPipelineDecision>;
+}
+export declare const makeAuthFlowPipeline: (stages?: readonly AuthFlowPipelineStage[]) => AuthFlowPipelineService;
+export declare const AuthFlowPipelineLive: (stages?: readonly AuthFlowPipelineStage[]) => Layer.Layer<AuthFlowPipeline, never, never>;
 export type AuthResult = Data.TaggedEnum<{
     Authenticated: {
         readonly session: IssuedSession;
@@ -86,7 +165,7 @@ export type AuthResult = Data.TaggedEnum<{
     RequiresEmailVerification: {
         readonly flowId: AuthFlowId;
         readonly userId?: UserId;
-        readonly email?: Email;
+        readonly identityId: IdentityId;
     };
     RequiresLoginApproval: {
         readonly flowId: AuthFlowId;
@@ -112,67 +191,35 @@ export type AuthResult = Data.TaggedEnum<{
     };
 }>;
 export declare const AuthResult: {
-    readonly Authenticated: Data.TaggedEnum.ConstructorFrom<{
+    readonly $is: <Tag extends "AccountDisabled" | "Authenticated" | "InvalidCredentials" | "PolicyDenied" | "RequiresEmailVerification" | "RequiresExplicitLinking" | "RequiresLoginApproval" | "RequiresMfa" | "RequiresPasskeyEnrollment">(tag: Tag) => (u: unknown) => u is Extract<{
+        readonly _tag: "AccountDisabled";
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
         readonly _tag: "Authenticated";
         readonly session: IssuedSession;
-    }, "_tag">;
-    readonly RequiresMfa: Data.TaggedEnum.ConstructorFrom<{
-        readonly _tag: "RequiresMfa";
-        readonly flowId: AuthFlowId;
-        readonly factors: readonly MfaFactor[];
-    }, "_tag">;
-    readonly RequiresEmailVerification: Data.TaggedEnum.ConstructorFrom<{
-        readonly _tag: "RequiresEmailVerification";
-        readonly flowId: AuthFlowId;
-        readonly userId?: UserId | undefined;
-        readonly email?: Email | undefined;
-    }, "_tag">;
-    readonly RequiresLoginApproval: Data.TaggedEnum.ConstructorFrom<{
-        readonly _tag: "RequiresLoginApproval";
-        readonly flowId: AuthFlowId;
-        readonly approvalChallengeId: ChallengeId;
-        readonly channel: LoginApprovalChannel;
-        readonly sessionBinding: LoginApprovalSessionBinding;
-        readonly sameDeviceRequired: boolean;
-        readonly reason: LoginApprovalReason;
-        readonly expiresAt: UnixMillis;
-        readonly sameDeviceSecret?: Redacted.Redacted<string> | undefined;
-    }, "_tag">;
-    readonly RequiresPasskeyEnrollment: Data.TaggedEnum.ConstructorFrom<{
-        readonly _tag: "RequiresPasskeyEnrollment";
-        readonly flowId: AuthFlowId;
-    }, "_tag">;
-    readonly RequiresExplicitLinking: Data.TaggedEnum.ConstructorFrom<{
-        readonly _tag: "RequiresExplicitLinking";
-        readonly flowId: AuthFlowId;
-        readonly provider: OAuthProviderId;
-    }, "_tag">;
-    readonly InvalidCredentials: Data.TaggedEnum.ConstructorFrom<{
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
         readonly _tag: "InvalidCredentials";
-    }, "_tag">;
-    readonly AccountDisabled: Data.TaggedEnum.ConstructorFrom<{
-        readonly _tag: "AccountDisabled";
-    }, "_tag">;
-    readonly PolicyDenied: Data.TaggedEnum.ConstructorFrom<{
+    }, {
+        readonly _tag: Tag;
+    }> | Extract<{
         readonly _tag: "PolicyDenied";
-        readonly reason?: string | undefined;
-    }, "_tag">;
-    readonly $is: <Tag extends "Authenticated" | "RequiresMfa" | "RequiresEmailVerification" | "RequiresLoginApproval" | "RequiresPasskeyEnrollment" | "RequiresExplicitLinking" | "InvalidCredentials" | "AccountDisabled" | "PolicyDenied">(tag: Tag) => (u: unknown) => u is Extract<{
-        readonly _tag: "Authenticated";
-        readonly session: IssuedSession;
+        readonly reason?: string;
     }, {
         readonly _tag: Tag;
     }> | Extract<{
-        readonly _tag: "RequiresMfa";
+        readonly _tag: "RequiresEmailVerification";
         readonly flowId: AuthFlowId;
-        readonly factors: readonly MfaFactor[];
+        readonly userId?: UserId;
+        readonly identityId: IdentityId;
     }, {
         readonly _tag: Tag;
     }> | Extract<{
-        readonly _tag: "RequiresEmailVerification";
+        readonly _tag: "RequiresExplicitLinking";
         readonly flowId: AuthFlowId;
-        readonly userId?: UserId | undefined;
-        readonly email?: Email | undefined;
+        readonly provider: OAuthProviderId;
     }, {
         readonly _tag: Tag;
     }> | Extract<{
@@ -184,93 +231,95 @@ export declare const AuthResult: {
         readonly sameDeviceRequired: boolean;
         readonly reason: LoginApprovalReason;
         readonly expiresAt: UnixMillis;
-        readonly sameDeviceSecret?: Redacted.Redacted<string> | undefined;
+        readonly sameDeviceSecret?: Redacted.Redacted<string>;
     }, {
         readonly _tag: Tag;
     }> | Extract<{
-        readonly _tag: "RequiresPasskeyEnrollment";
+        readonly _tag: "RequiresMfa";
         readonly flowId: AuthFlowId;
+        readonly factors: readonly MfaFactor[];
     }, {
         readonly _tag: Tag;
     }> | Extract<{
-        readonly _tag: "RequiresExplicitLinking";
+        readonly _tag: "RequiresPasskeyEnrollment";
         readonly flowId: AuthFlowId;
-        readonly provider: OAuthProviderId;
-    }, {
-        readonly _tag: Tag;
-    }> | Extract<{
-        readonly _tag: "InvalidCredentials";
-    }, {
-        readonly _tag: Tag;
-    }> | Extract<{
-        readonly _tag: "AccountDisabled";
-    }, {
-        readonly _tag: Tag;
-    }> | Extract<{
-        readonly _tag: "PolicyDenied";
-        readonly reason?: string | undefined;
     }, {
         readonly _tag: Tag;
     }>;
     readonly $match: {
-        <Cases extends {
-            readonly Authenticated: (args: {
-                readonly _tag: "Authenticated";
-                readonly session: IssuedSession;
-            }) => any;
-            readonly RequiresMfa: (args: {
-                readonly _tag: "RequiresMfa";
-                readonly flowId: AuthFlowId;
-                readonly factors: readonly MfaFactor[];
-            }) => any;
-            readonly RequiresEmailVerification: (args: {
-                readonly _tag: "RequiresEmailVerification";
-                readonly flowId: AuthFlowId;
-                readonly userId?: UserId | undefined;
-                readonly email?: Email | undefined;
-            }) => any;
-            readonly RequiresLoginApproval: (args: {
-                readonly _tag: "RequiresLoginApproval";
-                readonly flowId: AuthFlowId;
-                readonly approvalChallengeId: ChallengeId;
-                readonly channel: LoginApprovalChannel;
-                readonly sessionBinding: LoginApprovalSessionBinding;
-                readonly sameDeviceRequired: boolean;
-                readonly reason: LoginApprovalReason;
-                readonly expiresAt: UnixMillis;
-                readonly sameDeviceSecret?: Redacted.Redacted<string> | undefined;
-            }) => any;
-            readonly RequiresPasskeyEnrollment: (args: {
-                readonly _tag: "RequiresPasskeyEnrollment";
-                readonly flowId: AuthFlowId;
-            }) => any;
-            readonly RequiresExplicitLinking: (args: {
-                readonly _tag: "RequiresExplicitLinking";
-                readonly flowId: AuthFlowId;
-                readonly provider: OAuthProviderId;
-            }) => any;
-            readonly InvalidCredentials: (args: {
-                readonly _tag: "InvalidCredentials";
-            }) => any;
-            readonly AccountDisabled: (args: {
-                readonly _tag: "AccountDisabled";
-            }) => any;
-            readonly PolicyDenied: (args: {
-                readonly _tag: "PolicyDenied";
-                readonly reason?: string | undefined;
-            }) => any;
-        }>(cases: Cases): (value: {
+        <Cases extends { readonly [Tag in "AccountDisabled" | "Authenticated" | "InvalidCredentials" | "PolicyDenied" | "RequiresEmailVerification" | "RequiresExplicitLinking" | "RequiresLoginApproval" | "RequiresMfa" | "RequiresPasskeyEnrollment"]: (args: Extract<{
+            readonly _tag: "AccountDisabled";
+        }, {
+            readonly _tag: Tag;
+        }> | Extract<{
             readonly _tag: "Authenticated";
             readonly session: IssuedSession;
-        } | {
+        }, {
+            readonly _tag: Tag;
+        }> | Extract<{
+            readonly _tag: "InvalidCredentials";
+        }, {
+            readonly _tag: Tag;
+        }> | Extract<{
+            readonly _tag: "PolicyDenied";
+            readonly reason?: string;
+        }, {
+            readonly _tag: Tag;
+        }> | Extract<{
+            readonly _tag: "RequiresEmailVerification";
+            readonly flowId: AuthFlowId;
+            readonly userId?: UserId;
+            readonly identityId: IdentityId;
+        }, {
+            readonly _tag: Tag;
+        }> | Extract<{
+            readonly _tag: "RequiresExplicitLinking";
+            readonly flowId: AuthFlowId;
+            readonly provider: OAuthProviderId;
+        }, {
+            readonly _tag: Tag;
+        }> | Extract<{
+            readonly _tag: "RequiresLoginApproval";
+            readonly flowId: AuthFlowId;
+            readonly approvalChallengeId: ChallengeId;
+            readonly channel: LoginApprovalChannel;
+            readonly sessionBinding: LoginApprovalSessionBinding;
+            readonly sameDeviceRequired: boolean;
+            readonly reason: LoginApprovalReason;
+            readonly expiresAt: UnixMillis;
+            readonly sameDeviceSecret?: Redacted.Redacted<string>;
+        }, {
+            readonly _tag: Tag;
+        }> | Extract<{
             readonly _tag: "RequiresMfa";
             readonly flowId: AuthFlowId;
             readonly factors: readonly MfaFactor[];
+        }, {
+            readonly _tag: Tag;
+        }> | Extract<{
+            readonly _tag: "RequiresPasskeyEnrollment";
+            readonly flowId: AuthFlowId;
+        }, {
+            readonly _tag: Tag;
+        }>) => any; }>(cases: Cases): (value: {
+            readonly _tag: "AccountDisabled";
+        } | {
+            readonly _tag: "Authenticated";
+            readonly session: IssuedSession;
+        } | {
+            readonly _tag: "InvalidCredentials";
+        } | {
+            readonly _tag: "PolicyDenied";
+            readonly reason?: string;
         } | {
             readonly _tag: "RequiresEmailVerification";
             readonly flowId: AuthFlowId;
-            readonly userId?: UserId | undefined;
-            readonly email?: Email | undefined;
+            readonly userId?: UserId;
+            readonly identityId: IdentityId;
+        } | {
+            readonly _tag: "RequiresExplicitLinking";
+            readonly flowId: AuthFlowId;
+            readonly provider: OAuthProviderId;
         } | {
             readonly _tag: "RequiresLoginApproval";
             readonly flowId: AuthFlowId;
@@ -280,80 +329,88 @@ export declare const AuthResult: {
             readonly sameDeviceRequired: boolean;
             readonly reason: LoginApprovalReason;
             readonly expiresAt: UnixMillis;
-            readonly sameDeviceSecret?: Redacted.Redacted<string> | undefined;
+            readonly sameDeviceSecret?: Redacted.Redacted<string>;
         } | {
-            readonly _tag: "RequiresPasskeyEnrollment";
+            readonly _tag: "RequiresMfa";
             readonly flowId: AuthFlowId;
+            readonly factors: readonly MfaFactor[];
         } | {
+            readonly _tag: "RequiresPasskeyEnrollment";
+            readonly flowId: AuthFlowId;
+        }) => import("effect/Unify").Unify<ReturnType<Cases["AccountDisabled" | "Authenticated" | "InvalidCredentials" | "PolicyDenied" | "RequiresEmailVerification" | "RequiresExplicitLinking" | "RequiresLoginApproval" | "RequiresMfa" | "RequiresPasskeyEnrollment"]>>;
+        <Cases extends { readonly [Tag in "AccountDisabled" | "Authenticated" | "InvalidCredentials" | "PolicyDenied" | "RequiresEmailVerification" | "RequiresExplicitLinking" | "RequiresLoginApproval" | "RequiresMfa" | "RequiresPasskeyEnrollment"]: (args: Extract<{
+            readonly _tag: "AccountDisabled";
+        }, {
+            readonly _tag: Tag;
+        }> | Extract<{
+            readonly _tag: "Authenticated";
+            readonly session: IssuedSession;
+        }, {
+            readonly _tag: Tag;
+        }> | Extract<{
+            readonly _tag: "InvalidCredentials";
+        }, {
+            readonly _tag: Tag;
+        }> | Extract<{
+            readonly _tag: "PolicyDenied";
+            readonly reason?: string;
+        }, {
+            readonly _tag: Tag;
+        }> | Extract<{
+            readonly _tag: "RequiresEmailVerification";
+            readonly flowId: AuthFlowId;
+            readonly userId?: UserId;
+            readonly identityId: IdentityId;
+        }, {
+            readonly _tag: Tag;
+        }> | Extract<{
             readonly _tag: "RequiresExplicitLinking";
             readonly flowId: AuthFlowId;
             readonly provider: OAuthProviderId;
-        } | {
-            readonly _tag: "InvalidCredentials";
-        } | {
+        }, {
+            readonly _tag: Tag;
+        }> | Extract<{
+            readonly _tag: "RequiresLoginApproval";
+            readonly flowId: AuthFlowId;
+            readonly approvalChallengeId: ChallengeId;
+            readonly channel: LoginApprovalChannel;
+            readonly sessionBinding: LoginApprovalSessionBinding;
+            readonly sameDeviceRequired: boolean;
+            readonly reason: LoginApprovalReason;
+            readonly expiresAt: UnixMillis;
+            readonly sameDeviceSecret?: Redacted.Redacted<string>;
+        }, {
+            readonly _tag: Tag;
+        }> | Extract<{
+            readonly _tag: "RequiresMfa";
+            readonly flowId: AuthFlowId;
+            readonly factors: readonly MfaFactor[];
+        }, {
+            readonly _tag: Tag;
+        }> | Extract<{
+            readonly _tag: "RequiresPasskeyEnrollment";
+            readonly flowId: AuthFlowId;
+        }, {
+            readonly _tag: Tag;
+        }>) => any; }>(value: {
             readonly _tag: "AccountDisabled";
         } | {
-            readonly _tag: "PolicyDenied";
-            readonly reason?: string | undefined;
-        }) => import("effect/Unify").Unify<ReturnType<Cases["Authenticated" | "RequiresMfa" | "RequiresEmailVerification" | "RequiresLoginApproval" | "RequiresPasskeyEnrollment" | "RequiresExplicitLinking" | "InvalidCredentials" | "AccountDisabled" | "PolicyDenied"]>>;
-        <Cases extends {
-            readonly Authenticated: (args: {
-                readonly _tag: "Authenticated";
-                readonly session: IssuedSession;
-            }) => any;
-            readonly RequiresMfa: (args: {
-                readonly _tag: "RequiresMfa";
-                readonly flowId: AuthFlowId;
-                readonly factors: readonly MfaFactor[];
-            }) => any;
-            readonly RequiresEmailVerification: (args: {
-                readonly _tag: "RequiresEmailVerification";
-                readonly flowId: AuthFlowId;
-                readonly userId?: UserId | undefined;
-                readonly email?: Email | undefined;
-            }) => any;
-            readonly RequiresLoginApproval: (args: {
-                readonly _tag: "RequiresLoginApproval";
-                readonly flowId: AuthFlowId;
-                readonly approvalChallengeId: ChallengeId;
-                readonly channel: LoginApprovalChannel;
-                readonly sessionBinding: LoginApprovalSessionBinding;
-                readonly sameDeviceRequired: boolean;
-                readonly reason: LoginApprovalReason;
-                readonly expiresAt: UnixMillis;
-                readonly sameDeviceSecret?: Redacted.Redacted<string> | undefined;
-            }) => any;
-            readonly RequiresPasskeyEnrollment: (args: {
-                readonly _tag: "RequiresPasskeyEnrollment";
-                readonly flowId: AuthFlowId;
-            }) => any;
-            readonly RequiresExplicitLinking: (args: {
-                readonly _tag: "RequiresExplicitLinking";
-                readonly flowId: AuthFlowId;
-                readonly provider: OAuthProviderId;
-            }) => any;
-            readonly InvalidCredentials: (args: {
-                readonly _tag: "InvalidCredentials";
-            }) => any;
-            readonly AccountDisabled: (args: {
-                readonly _tag: "AccountDisabled";
-            }) => any;
-            readonly PolicyDenied: (args: {
-                readonly _tag: "PolicyDenied";
-                readonly reason?: string | undefined;
-            }) => any;
-        }>(value: {
             readonly _tag: "Authenticated";
             readonly session: IssuedSession;
         } | {
-            readonly _tag: "RequiresMfa";
-            readonly flowId: AuthFlowId;
-            readonly factors: readonly MfaFactor[];
+            readonly _tag: "InvalidCredentials";
+        } | {
+            readonly _tag: "PolicyDenied";
+            readonly reason?: string;
         } | {
             readonly _tag: "RequiresEmailVerification";
             readonly flowId: AuthFlowId;
-            readonly userId?: UserId | undefined;
-            readonly email?: Email | undefined;
+            readonly userId?: UserId;
+            readonly identityId: IdentityId;
+        } | {
+            readonly _tag: "RequiresExplicitLinking";
+            readonly flowId: AuthFlowId;
+            readonly provider: OAuthProviderId;
         } | {
             readonly _tag: "RequiresLoginApproval";
             readonly flowId: AuthFlowId;
@@ -363,23 +420,61 @@ export declare const AuthResult: {
             readonly sameDeviceRequired: boolean;
             readonly reason: LoginApprovalReason;
             readonly expiresAt: UnixMillis;
-            readonly sameDeviceSecret?: Redacted.Redacted<string> | undefined;
+            readonly sameDeviceSecret?: Redacted.Redacted<string>;
         } | {
-            readonly _tag: "RequiresPasskeyEnrollment";
+            readonly _tag: "RequiresMfa";
             readonly flowId: AuthFlowId;
+            readonly factors: readonly MfaFactor[];
         } | {
-            readonly _tag: "RequiresExplicitLinking";
+            readonly _tag: "RequiresPasskeyEnrollment";
             readonly flowId: AuthFlowId;
-            readonly provider: OAuthProviderId;
-        } | {
-            readonly _tag: "InvalidCredentials";
-        } | {
-            readonly _tag: "AccountDisabled";
-        } | {
-            readonly _tag: "PolicyDenied";
-            readonly reason?: string | undefined;
-        }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["Authenticated" | "RequiresMfa" | "RequiresEmailVerification" | "RequiresLoginApproval" | "RequiresPasskeyEnrollment" | "RequiresExplicitLinking" | "InvalidCredentials" | "AccountDisabled" | "PolicyDenied"]>>;
+        }, cases: Cases): import("effect/Unify").Unify<ReturnType<Cases["AccountDisabled" | "Authenticated" | "InvalidCredentials" | "PolicyDenied" | "RequiresEmailVerification" | "RequiresExplicitLinking" | "RequiresLoginApproval" | "RequiresMfa" | "RequiresPasskeyEnrollment"]>>;
     };
+    readonly AccountDisabled: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "AccountDisabled";
+    }, "_tag">;
+    readonly Authenticated: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "Authenticated";
+        readonly session: IssuedSession;
+    }, "_tag">;
+    readonly InvalidCredentials: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "InvalidCredentials";
+    }, "_tag">;
+    readonly PolicyDenied: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "PolicyDenied";
+        readonly reason?: string;
+    }, "_tag">;
+    readonly RequiresEmailVerification: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "RequiresEmailVerification";
+        readonly flowId: AuthFlowId;
+        readonly userId?: UserId;
+        readonly identityId: IdentityId;
+    }, "_tag">;
+    readonly RequiresExplicitLinking: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "RequiresExplicitLinking";
+        readonly flowId: AuthFlowId;
+        readonly provider: OAuthProviderId;
+    }, "_tag">;
+    readonly RequiresLoginApproval: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "RequiresLoginApproval";
+        readonly flowId: AuthFlowId;
+        readonly approvalChallengeId: ChallengeId;
+        readonly channel: LoginApprovalChannel;
+        readonly sessionBinding: LoginApprovalSessionBinding;
+        readonly sameDeviceRequired: boolean;
+        readonly reason: LoginApprovalReason;
+        readonly expiresAt: UnixMillis;
+        readonly sameDeviceSecret?: Redacted.Redacted<string>;
+    }, "_tag">;
+    readonly RequiresMfa: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "RequiresMfa";
+        readonly flowId: AuthFlowId;
+        readonly factors: readonly MfaFactor[];
+    }, "_tag">;
+    readonly RequiresPasskeyEnrollment: Data.TaggedEnum.ConstructorFrom<{
+        readonly _tag: "RequiresPasskeyEnrollment";
+        readonly flowId: AuthFlowId;
+    }, "_tag">;
 };
 export type AuthResultOf<Tag extends AuthResult["_tag"]> = Extract<AuthResult, {
     readonly _tag: Tag;
@@ -387,7 +482,8 @@ export type AuthResultOf<Tag extends AuthResult["_tag"]> = Extract<AuthResult, {
 export type AuthenticatedResult = AuthResultOf<"Authenticated">;
 type CommonPrimaryFactorResult = AuthResultOf<"Authenticated" | "RequiresMfa" | "RequiresEmailVerification" | "RequiresLoginApproval" | "RequiresPasskeyEnrollment" | "PolicyDenied">;
 export type AuthFlowPrimaryFactorResult<Method extends AuthMethod = AuthMethod> = CommonPrimaryFactorResult | (Method extends "oauth" ? AuthResultOf<"RequiresExplicitLinking"> : never);
-export type AuthFlowMfaResult = AuthResultOf<"Authenticated" | "PolicyDenied">;
+export type AuthFlowMfaResult = AuthResultOf<"Authenticated" | "RequiresLoginApproval" | "PolicyDenied">;
+export type AuthFlowRequireMfaResult = AuthResultOf<"RequiresMfa" | "PolicyDenied">;
 declare const AuthFlowStateError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "AuthFlowStateError";
 } & Readonly<A>;
@@ -399,6 +495,7 @@ export declare class AuthFlowStateError extends AuthFlowStateError_base<{
 export interface AuthFlowStateStartInput<Method extends AuthMethod = AuthMethod> extends AuthFlowCompleteInput<Method> {
     readonly ttl?: Duration.Duration;
     readonly secret?: Redacted.Redacted<string>;
+    readonly factors?: readonly MfaFactor[];
     readonly metadata?: Readonly<Record<string, unknown>>;
 }
 export interface StartedAuthFlowState {
@@ -408,6 +505,7 @@ export interface StartedAuthFlowState {
 }
 export interface ConsumedAuthFlowState<Method extends AuthMethod = AuthMethod> extends AuthFlowCompleteInput<Method> {
     readonly flowId: AuthFlowId;
+    readonly factors?: readonly MfaFactor[];
     readonly metadata?: Readonly<Record<string, unknown>>;
 }
 export interface InspectedAuthFlowState<Method extends AuthMethod = AuthMethod> extends ConsumedAuthFlowState<Method> {
@@ -421,9 +519,6 @@ export interface AuthFlowStateService {
 declare const AuthFlowState_base: Context.ServiceClass<AuthFlowState, "auth/AuthFlowState", AuthFlowStateService>;
 export declare class AuthFlowState extends AuthFlowState_base {
 }
-export declare namespace AuthFlowState {
-    const make: (service: AuthFlowStateService) => AuthFlowStateService;
-}
 export interface AuthFlowStateOptions {
     readonly ttl?: Duration.Duration;
 }
@@ -434,21 +529,29 @@ export declare const defaultAuthFlowStateTtl: Duration.Duration;
 export declare const makeAuthFlowState: (dependencies: AuthFlowStateDependencies) => AuthFlowStateService;
 export declare const AuthFlowStateLive: (options?: AuthFlowStateOptions) => Layer.Layer<AuthFlowState, never, Challenge>;
 export type AuthFlowCompleteError = SessionCreateError;
-export type AuthFlowMfaError = AuthFlowStateError | AuthFlowCompleteError;
-export type AuthFlowPrimaryFactorError = AuthFlowCompleteError | TrustedDeviceError | LoginRiskError | AuthFlowStateError | LoginApprovalReviewError | LoginApprovalFlowStartError;
+export type AuthFlowFinalize = (input: AuthFlowCompleteInput) => Effect.Effect<AuthenticatedResult | AuthResultOf<"PolicyDenied">, AuthFlowCompleteError>;
+export type AuthFlowMfaError = AuthFlowPrimaryFactorError;
+export type AuthFlowRequireMfaError = AuthFlowCompleteError | AuthFlowStateError | TrustedDeviceError;
+export type AuthFlowPrimaryFactorError = AuthFlowCompleteError | TrustedDeviceError | LoginRiskError | TotpFactorManagementError | RecoveryCodeManagementError | PasskeyCredentialManagementError | AuthFlowStateError | LoginApprovalReviewError | LoginApprovalFlowStartError;
 export type AuthFlowError = AuthFlowPrimaryFactorError;
+export type AuthFlowPreparedMfaResult = {
+    readonly _tag: "PreparedAuthenticated";
+    readonly prepared: PreparedSession;
+    readonly notify: Effect.Effect<void>;
+} | {
+    readonly _tag: "PreparedLoginApproval";
+    readonly complete: Effect.Effect<AuthResultOf<"RequiresLoginApproval" | "PolicyDenied">, AuthFlowMfaError>;
+} | AuthResultOf<"PolicyDenied">;
 export interface AuthFlowService {
     readonly startPrimaryFactor: <Method extends AuthMethod>(input: PrimaryFactorResult<Method>) => Effect.Effect<AuthFlowPrimaryFactorResult<Method>, AuthFlowPrimaryFactorError>;
+    readonly requireMfa: <Method extends AuthMethod>(input: AuthFlowRequireMfaInput<Method>) => Effect.Effect<AuthFlowRequireMfaResult, AuthFlowRequireMfaError>;
     readonly completePrimaryFactor: <Method extends AuthMethod>(input: PrimaryFactorResult<Method>) => Effect.Effect<AuthFlowPrimaryFactorResult<Method>, AuthFlowPrimaryFactorError>;
     readonly completeMfa: (input: MfaCompleteInput) => Effect.Effect<AuthFlowMfaResult, AuthFlowMfaError>;
-    readonly complete: <Method extends AuthMethod>(input: AuthFlowCompleteInput<Method>) => Effect.Effect<AuthenticatedResult, AuthFlowCompleteError>;
+    readonly prepareMfa?: (input: MfaCompleteInput) => Effect.Effect<AuthFlowPreparedMfaResult, AuthFlowMfaError>;
 }
 declare const AuthFlow_base: Context.ServiceClass<AuthFlow, "auth/AuthFlow", AuthFlowService>;
 export declare class AuthFlow extends AuthFlow_base {
 }
-export declare namespace AuthFlow {
-    const make: (service: AuthFlowService) => AuthFlowService;
-}
 export interface LoginApprovalFinalizeInput {
     readonly flowId: AuthFlowId;
     readonly approvalChallengeId: ChallengeId;
@@ -462,19 +565,21 @@ export interface LoginApprovalFinalizeService {
 declare const LoginApprovalFinalize_base: Context.ServiceClass<LoginApprovalFinalize, "auth/LoginApprovalFinalize", LoginApprovalFinalizeService>;
 export declare class LoginApprovalFinalize extends LoginApprovalFinalize_base {
 }
-export declare namespace LoginApprovalFinalize {
-    const make: (service: LoginApprovalFinalizeService) => LoginApprovalFinalizeService;
-}
 export interface LoginApprovalFinalizeDependencies {
     readonly loginApprovalReview: LoginApprovalReviewService;
     readonly authFlowState: AuthFlowStateService;
-    readonly authFlow: AuthFlowService;
+    readonly finalizeAuthFlow: AuthFlowFinalize;
 }
 export declare const makeLoginApprovalFinalize: (dependencies: LoginApprovalFinalizeDependencies) => LoginApprovalFinalizeService;
-export declare const LoginApprovalFinalizeLive: Layer.Layer<LoginApprovalFinalize, never, LoginApprovalReview | AuthFlowState | AuthFlow>;
+export declare const LoginApprovalFinalizeLive: Layer.Layer<LoginApprovalFinalize, never, AuthFlowState | LoginApprovalReview | Sessions>;
 export interface AuthFlowDependencies {
     readonly sessions: SessionsService;
+    readonly pipeline?: AuthFlowPipelineService;
     readonly emailVerificationSessionPolicy?: EmailVerificationSessionPolicyService;
+    readonly mfaRequirementPolicy?: MfaRequirementPolicyService;
+    readonly totpFactorManagement?: TotpFactorManagementService;
+    readonly recoveryCodeManagement?: RecoveryCodeManagementService;
+    readonly passkeyCredentialManagement?: PasskeyCredentialManagementService;
     readonly loginApprovalPolicy?: LoginApprovalPolicyService;
     readonly loginApprovalFlow?: LoginApprovalFlowService;
     readonly authFlowState?: AuthFlowStateService;
@@ -483,10 +588,11 @@ export interface AuthFlowDependencies {
     readonly loginRiskEngine?: LoginRiskEngineService;
     readonly loginApprovalReview?: LoginApprovalReviewService;
     readonly loginNotification?: LoginNotificationService;
+    readonly recoveryRequirementPolicy?: RecoveryRequirementPolicyService;
     readonly loginApprovalSameDeviceSecretBytes?: number;
 }
 export declare const makeAuthFlow: (dependencies: AuthFlowDependencies) => AuthFlowService;
 export declare const AuthFlowLive: Layer.Layer<AuthFlow, never, Sessions>;
-export declare const AuthFlowLiveWithEmailVerificationPolicy: (options?: EmailVerificationSessionPolicyOptions) => Layer.Layer<AuthFlow, never, Sessions>;
+export declare const AuthFlowWithEmailVerificationPolicyLive: (options?: EmailVerificationSessionPolicyOptions) => Layer.Layer<AuthFlow, never, Sessions>;
 export {};
 //# sourceMappingURL=AuthFlow.d.ts.map