@effect-auth/core 0.1.0-alpha.16 → 0.1.0-alpha.18

package/dist/AuthFlow.js

@@ -1,21 +1,24 @@
 // oxlint-disable complexity
 import { Context, Data, Duration, Effect, Layer, Option, Redacted, } from "effect";
+import { parseAuthenticationEvents } from "./Assurance.js";
 import { AuthEmailVerificationSessionPolicyConfig } from "./AuthConfig.js";
 import { Challenge } from "./Challenge.js";
 import { Crypto } from "./Crypto.js";
-import { AuthFlowId, ChallengeId, Email, UserId } from "./Identifiers.js";
+import { AuthFlowId, ChallengeId, UnixMillis, UserId } from "./Identifiers.js";
 import { currentUnixMillis } from "./Internal.js";
+import { AuthFlowFinalizer, AuthFlowFinalizerLive, makeAuthFlowTerminal, } from "./internal/AuthFlowFinalizer.js";
 import { LoginApprovalFlow, LoginApprovalPolicy, LoginApprovalReview, makeLoginApprovalPolicy, unknownLoginDeviceContext, } from "./LoginApproval.js";
 import { LoginNotification } from "./LoginNotification.js";
 import { LoginRiskEngine, defaultLoginRiskContext, makeLoginRiskEngineNoop, } from "./LoginRisk.js";
+import { PasskeyCredentialManagement } from "./Passkey.js";
+import { RecoveryCodeManagement } from "./RecoveryCode.js";
+import { RecoveryRequirementPolicy } from "./RecoveryPolicy.js";
 import { Sessions, sessionRequestMetadataKey } from "./Sessions.js";
+import { TotpFactorManagement } from "./Totp.js";
 import { TrustedDevice } from "./TrustedDevice.js";
 export const defaultLoginApprovalSameDeviceSecretBytes = 32;
 export class EmailVerificationSessionPolicy extends Context.Service()("auth/EmailVerificationSessionPolicy") {
 }
-(function (EmailVerificationSessionPolicy) {
-    EmailVerificationSessionPolicy.make = (service) => EmailVerificationSessionPolicy.of(service);
-})(EmailVerificationSessionPolicy || (EmailVerificationSessionPolicy = {}));
 const addEmailVerificationRequirement = (requirements) => requirements?.includes("email_verification") === true
     ? requirements
     : [...(requirements ?? []), "email_verification"];
@@ -23,40 +26,40 @@ const removeEmailVerificationRequirement = (requirements) => {
     const filtered = requirements?.filter((requirement) => requirement !== "email_verification");
     return filtered?.length === 0 ? undefined : filtered;
 };
-const withEmailVerified = (claims, emailVerified) => {
+const withVerifiedIdentityKind = (claims, kind) => {
     const { requirements: _requirements, ...rest } = claims ?? {};
-    const requirements = emailVerified
+    const requirements = kind === "email"
         ? removeEmailVerificationRequirement(claims?.requirements)
         : claims?.requirements;
+    const verifiedIdentityKinds = claims?.verifiedIdentityKinds?.includes(kind)
+        ? claims.verifiedIdentityKinds
+        : [...(claims?.verifiedIdentityKinds ?? []), kind];
     return {
         ...rest,
-        emailVerified,
+        verifiedIdentityKinds,
         ...(requirements === undefined ? {} : { requirements }),
     };
 };
 const withEmailVerificationRequirement = (claims) => ({
     ...claims,
-    emailVerified: false,
     requirements: addEmailVerificationRequirement(claims?.requirements),
 });
 export const makeEmailVerificationSessionPolicy = (options = {}) => {
     const mode = options.mode ?? "allow-unverified";
-    return EmailVerificationSessionPolicy.make({
+    return EmailVerificationSessionPolicy.of({
         decide: Effect.fn("auth.email_verification_session_policy.decide")(function* (input) {
-            const emailVerified = input.claims?.emailVerified;
-            if (emailVerified !== false) {
+            const emailVerified = input.claims?.verifiedIdentityKinds?.includes("email");
+            if (emailVerified === true) {
                 return {
                     _tag: "CreateSession",
-                    claims: emailVerified === true
-                        ? withEmailVerified(input.claims, true)
-                        : input.claims,
+                    claims: withVerifiedIdentityKind(input.claims, "email"),
                 };
             }
             switch (mode) {
                 case "allow-unverified": {
                     return {
                         _tag: "CreateSession",
-                        claims: withEmailVerified(input.claims, false),
+                        claims: input.claims,
                     };
                 }
                 case "limited-session": {
@@ -70,35 +73,119 @@ export const makeEmailVerificationSessionPolicy = (options = {}) => {
     });
 };
 export const EmailVerificationSessionPolicyLive = (options) => Layer.succeed(EmailVerificationSessionPolicy)(makeEmailVerificationSessionPolicy(options));
+export class MfaRequirementPolicy extends Context.Service()("auth/MfaRequirementPolicy") {
+}
+export const defaultMfaRequirementMethods = [
+    "password",
+    "email-otp",
+    "magic-link",
+    "oauth",
+];
+export const makeMfaRequirementPolicy = (options = {}) => {
+    const mode = options.mode ?? "when-factors-present";
+    const methods = new Set(options.methods ?? defaultMfaRequirementMethods);
+    return MfaRequirementPolicy.of({
+        decide: Effect.fn("auth.mfa_requirement_policy.decide")(function* (input) {
+            if (mode === "disabled" ||
+                input.intent === "sign-up" ||
+                !methods.has(input.method) ||
+                input.factors.length === 0) {
+                return { _tag: "Continue" };
+            }
+            return {
+                _tag: "RequireMfa",
+                factors: input.factors,
+            };
+        }),
+    });
+};
+export const MfaRequirementPolicyLive = (options) => Layer.succeed(MfaRequirementPolicy)(makeMfaRequirementPolicy(options));
+export class AuthFlowPipeline extends Context.Service()("auth/AuthFlowPipeline") {
+}
+(function (AuthFlowPipeline) {
+    AuthFlowPipeline.continueWith = () => ({
+        _tag: "Continue",
+    });
+    AuthFlowPipeline.deny = (reason) => ({
+        _tag: "PolicyDenied",
+        ...(reason === undefined ? {} : { reason }),
+    });
+})(AuthFlowPipeline || (AuthFlowPipeline = {}));
+export const makeAuthFlowPipeline = (stages = []) => AuthFlowPipeline.of({
+    advance: (initial) => Effect.gen(function* () {
+        for (const stage of stages) {
+            if (stage.phases !== undefined &&
+                !stage.phases.includes(initial.phase)) {
+                continue;
+            }
+            const decision = yield* stage.run(initial);
+            if (decision._tag === "PolicyDenied") {
+                return decision;
+            }
+        }
+        return AuthFlowPipeline.continueWith();
+    }),
+});
+export const AuthFlowPipelineLive = (stages = []) => Layer.succeed(AuthFlowPipeline)(makeAuthFlowPipeline(stages));
 export const AuthResult = Data.taggedEnum();
 export class AuthFlowStateError extends Data.TaggedError("AuthFlowStateError") {
 }
 export class AuthFlowState extends Context.Service()("auth/AuthFlowState") {
 }
-(function (AuthFlowState) {
-    AuthFlowState.make = (service) => AuthFlowState.of(service);
-})(AuthFlowState || (AuthFlowState = {}));
 export const defaultAuthFlowStateTtl = Duration.minutes(10);
-const flowStateMetadata = (input) => ({
-    ...input.metadata,
-    method: input.method,
-    amr: input.amr,
-    aal: input.aal,
-    ...(input.email === undefined ? {} : { email: input.email }),
-    ...(input.intent === undefined ? {} : { intent: input.intent }),
-    ...(input.device === undefined ? {} : { deviceStatus: input.device.status }),
-    ...(input.claims === undefined ? {} : { claims: input.claims }),
-});
+const mfaFactorsMetadataKey = "__authMfaFactors";
+const applicationFlowStateMetadata = (metadata) => {
+    if (metadata === undefined) {
+        return undefined;
+    }
+    const { method: _method, evidence: _evidence, identity: _identity, emailDestination: _emailDestination, intent: _intent, deviceStatus: _deviceStatus, deviceKey: _deviceKey, locationKey: _locationKey, claims: _claims, [sessionRequestMetadataKey]: _request, [mfaFactorsMetadataKey]: _mfaFactors, ...rest } = metadata;
+    return Object.keys(rest).length === 0 ? undefined : rest;
+};
+const flowStateMetadata = (input) => {
+    const metadata = applicationFlowStateMetadata(input.metadata);
+    return {
+        ...metadata,
+        ...(input.request === undefined
+            ? {}
+            : { [sessionRequestMetadataKey]: input.request }),
+        method: input.method,
+        evidence: input.evidence,
+        ...(input.identity === undefined ? {} : { identity: input.identity }),
+        ...(input.emailDestination === undefined
+            ? {}
+            : { emailDestination: input.emailDestination }),
+        ...(input.intent === undefined ? {} : { intent: input.intent }),
+        ...(input.device === undefined
+            ? {}
+            : { deviceStatus: input.device.status }),
+        ...(input.deviceKey === undefined ? {} : { deviceKey: input.deviceKey }),
+        ...(input.locationKey === undefined
+            ? {}
+            : { locationKey: input.locationKey }),
+        ...(input.claims === undefined ? {} : { claims: input.claims }),
+        ...(input.factors === undefined
+            ? {}
+            : { [mfaFactorsMetadataKey]: input.factors }),
+    };
+};
 const metadataString = (metadata, key) => {
     const value = metadata?.[key];
     return typeof value === "string" && value.length > 0 ? value : undefined;
 };
-const metadataStringArray = (metadata, key) => {
-    const value = metadata?.[key];
-    return Array.isArray(value) && value.every((item) => typeof item === "string")
+const loginRequestContextFromMetadata = (metadata) => {
+    const value = metadata?.[sessionRequestMetadataKey];
+    return typeof value === "object" && value !== null && !Array.isArray(value)
         ? value
         : undefined;
 };
+const metadataEvidence = (metadata) => {
+    try {
+        return parseAuthenticationEvents(metadata?.evidence);
+    }
+    catch {
+        return undefined;
+    }
+};
 const metadataClaims = (metadata) => {
     const value = metadata?.claims;
     if (value === undefined) {
@@ -109,8 +196,18 @@ const metadataClaims = (metadata) => {
     }
     const shape = value;
     const { requirements } = shape;
-    if (shape.emailVerified !== undefined &&
-        typeof shape.emailVerified !== "boolean") {
+    if (shape.verifiedIdentityKinds !== undefined &&
+        (!Array.isArray(shape.verifiedIdentityKinds) ||
+            !shape.verifiedIdentityKinds.every((item) => typeof item === "string"))) {
+        return undefined;
+    }
+    const recoveryEnrollment = shape.recoveryEnrollment;
+    if (recoveryEnrollment !== undefined &&
+        (typeof recoveryEnrollment !== "object" ||
+            recoveryEnrollment === null ||
+            !Array.isArray(recoveryEnrollment.allowed) ||
+            recoveryEnrollment.allowed.length === 0 ||
+            !recoveryEnrollment.allowed.every((item) => typeof item === "string"))) {
         return undefined;
     }
     if (requirements !== undefined &&
@@ -119,16 +216,49 @@ const metadataClaims = (metadata) => {
         return undefined;
     }
     return {
-        ...(shape.emailVerified === undefined
+        ...(shape.verifiedIdentityKinds === undefined
             ? {}
-            : { emailVerified: shape.emailVerified }),
+            : {
+                verifiedIdentityKinds: shape.verifiedIdentityKinds,
+            }),
         ...(requirements === undefined ? {} : { requirements }),
+        ...(recoveryEnrollment === undefined
+            ? {}
+            : {
+                recoveryEnrollment: {
+                    allowed: recoveryEnrollment.allowed,
+                },
+            }),
     };
 };
-const metadataAal = (metadata) => {
-    const value = metadataString(metadata, "aal");
-    return value === "aal1" || value === "aal2" || value === "aal3"
-        ? value
+const metadataIdentity = (metadata) => {
+    const value = metadata?.identity;
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    const identity = value;
+    return typeof identity.identityId === "string" &&
+        typeof identity.kind === "string" &&
+        typeof identity.verified === "boolean"
+        ? {
+            identityId: identity.identityId,
+            kind: identity.kind,
+            verified: identity.verified,
+        }
+        : undefined;
+};
+const metadataEmailDestination = (metadata) => {
+    const value = metadata?.emailDestination;
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    const destination = value;
+    return typeof destination.identityId === "string" &&
+        typeof destination.email === "string"
+        ? {
+            identityId: destination.identityId,
+            email: destination.email,
+        }
         : undefined;
 };
 const metadataIntent = (metadata) => {
@@ -141,34 +271,45 @@ const metadataDevice = (metadata) => {
         ? { status: value }
         : undefined;
 };
-const appMetadata = (metadata) => {
-    if (metadata === undefined) {
-        return undefined;
-    }
-    const { method: _method, amr: _amr, aal: _aal, email: _email, intent: _intent, deviceStatus: _deviceStatus, claims: _claims, ...rest } = metadata;
-    return Object.keys(rest).length === 0 ? undefined : rest;
-};
+const metadataKey = (metadata, key) => metadataString(metadata, key);
+const appMetadata = applicationFlowStateMetadata;
 const authFlowStateFromChallenge = (flowId, verified) => Effect.gen(function* () {
     const method = metadataString(verified.metadata, "method");
-    const amr = metadataStringArray(verified.metadata, "amr");
-    const aal = metadataAal(verified.metadata);
-    const email = metadataString(verified.metadata, "email");
+    const evidence = metadataEvidence(verified.metadata);
+    const identity = metadataIdentity(verified.metadata);
+    const emailDestination = metadataEmailDestination(verified.metadata);
     const intent = metadataIntent(verified.metadata);
     const device = metadataDevice(verified.metadata);
+    const deviceKey = metadataKey(verified.metadata, "deviceKey");
+    const locationKey = metadataKey(verified.metadata, "locationKey");
     const claims = metadataClaims(verified.metadata);
+    const request = loginRequestContextFromMetadata(verified.metadata);
+    const rawFactors = verified.metadata?.[mfaFactorsMetadataKey];
+    let factors;
+    if (rawFactors !== undefined) {
+        if (!Array.isArray(rawFactors) ||
+            rawFactors.length === 0 ||
+            !rawFactors.every((factor) => typeof factor === "object" &&
+                factor !== null &&
+                !Array.isArray(factor) &&
+                typeof factor.type === "string" &&
+                factor.type.length > 0)) {
+            return yield* new AuthFlowStateError({
+                message: "Auth flow state has invalid MFA factor metadata",
+            });
+        }
+        factors = rawFactors.map((factor) => ({
+            type: factor.type,
+        }));
+    }
     if (method === undefined) {
         return yield* new AuthFlowStateError({
             message: "Auth flow state is missing method metadata",
         });
     }
-    if (amr === undefined) {
-        return yield* new AuthFlowStateError({
-            message: "Auth flow state is missing AMR metadata",
-        });
-    }
-    if (aal === undefined) {
+    if (evidence === undefined) {
         return yield* new AuthFlowStateError({
-            message: "Auth flow state is missing AAL metadata",
+            message: "Auth flow state has invalid evidence metadata",
         });
     }
     if (verified.metadata?.claims !== undefined && claims === undefined) {
@@ -179,19 +320,23 @@ const authFlowStateFromChallenge = (flowId, verified) => Effect.gen(function* ()
     return {
         flowId,
         userId: UserId(verified.subject),
-        ...(email === undefined ? {} : { email: Email(email) }),
+        ...(identity === undefined ? {} : { identity }),
+        ...(emailDestination === undefined ? {} : { emailDestination }),
         ...(intent === undefined ? {} : { intent }),
         method,
-        amr,
-        aal,
+        evidence,
         ...(device === undefined ? {} : { device }),
+        ...(deviceKey === undefined ? {} : { deviceKey }),
+        ...(locationKey === undefined ? {} : { locationKey }),
         ...(claims === undefined ? {} : { claims }),
+        ...(request === undefined ? {} : { request }),
+        ...(factors === undefined ? {} : { factors }),
         metadata: appMetadata(verified.metadata),
     };
 });
 export const makeAuthFlowState = (dependencies) => {
     const ttl = dependencies.ttl ?? defaultAuthFlowStateTtl;
-    return AuthFlowState.make({
+    return AuthFlowState.of({
         start: Effect.fn("auth.auth_flow_state.start")(function* (input) {
             const issued = yield* dependencies.challenge
                 .issue({
@@ -252,16 +397,10 @@ export const AuthFlowStateLive = (options) => Layer.effect(AuthFlowState)(Effect
 }));
 export class AuthFlow extends Context.Service()("auth/AuthFlow") {
 }
-(function (AuthFlow) {
-    AuthFlow.make = (service) => AuthFlow.of(service);
-})(AuthFlow || (AuthFlow = {}));
 export class LoginApprovalFinalize extends Context.Service()("auth/LoginApprovalFinalize") {
 }
-(function (LoginApprovalFinalize) {
-    LoginApprovalFinalize.make = (service) => LoginApprovalFinalize.of(service);
-})(LoginApprovalFinalize || (LoginApprovalFinalize = {}));
 const loginApprovalFinalizeDenied = (reason) => AuthResult.PolicyDenied({ reason });
-export const makeLoginApprovalFinalize = (dependencies) => LoginApprovalFinalize.make({
+export const makeLoginApprovalFinalize = (dependencies) => LoginApprovalFinalize.of({
     complete: Effect.fn("auth.login_approval_finalize.complete")(function* (input) {
         const recordOption = yield* dependencies.loginApprovalReview.status({
             approvalChallengeId: input.approvalChallengeId,
@@ -287,19 +426,19 @@ export const makeLoginApprovalFinalize = (dependencies) => LoginApprovalFinalize
         if (consumed.userId !== record.userId) {
             return loginApprovalFinalizeDenied("Invalid login approval review");
         }
-        return yield* dependencies.authFlow.complete(consumed);
+        return yield* dependencies.finalizeAuthFlow(consumed);
     }),
 });
-export const LoginApprovalFinalizeLive = Layer.effect(LoginApprovalFinalize)(Effect.gen(function* () {
+export const LoginApprovalFinalizeLive = Layer.effect(LoginApprovalFinalize, Effect.gen(function* () {
     const loginApprovalReview = yield* LoginApprovalReview;
     const authFlowState = yield* AuthFlowState;
-    const authFlow = yield* AuthFlow;
+    const authFlowFinalizer = yield* AuthFlowFinalizer;
     return makeLoginApprovalFinalize({
         loginApprovalReview,
         authFlowState,
-        authFlow,
+        finalizeAuthFlow: authFlowFinalizer.complete,
     });
-}));
+})).pipe(Layer.provide(AuthFlowFinalizerLive));
 const loginApprovalFlowIdMetadata = (flowId, metadata) => ({
     ...metadata,
     flowId,
@@ -319,61 +458,15 @@ const mergeMetadata = (left, right) => {
     }
     return { ...left, ...right };
 };
-const aalRank = {
-    aal1: 1,
-    aal2: 2,
-    aal3: 3,
-};
-const strongerAal = (left, right) => (aalRank[left] >= aalRank[right] ? left : right);
-const authMethodReference = (method) => {
-    switch (method) {
-        case "password": {
-            return "pwd";
-        }
-        case "email-otp": {
-            return "otp";
-        }
-        case "magic-link": {
-            return "magic_link";
-        }
-        case "backup-code": {
-            return "backup_code";
-        }
-        default: {
-            return method;
-        }
-    }
-};
-const appendAuthMethods = (current, methods) => {
-    const next = [...current];
-    for (const method of methods) {
-        if (!next.includes(method)) {
-            next.push(method);
-        }
-    }
-    return next;
-};
-const loginNotificationSession = (session) => ({
-    sessionId: session.sessionId,
-    userId: session.userId,
-    authTime: session.authTime,
-    expiresAt: session.expiresAt,
-    aal: session.aal,
-    amr: session.amr,
-    ...(session.claims === undefined ? {} : { claims: session.claims }),
-});
-const loginRequestContextFromMetadata = (metadata) => {
-    const value = metadata?.[sessionRequestMetadataKey];
-    return typeof value === "object" && value !== null && !Array.isArray(value)
-        ? value
-        : undefined;
-};
 const loginApprovalNotConfigured = () => AuthResult.PolicyDenied({
     reason: "Login approval is not configured",
 });
 const loginApprovalEmailMissing = () => AuthResult.PolicyDenied({
     reason: "Login approval requires an email address",
 });
+const loginApprovalIdentityNotBound = () => AuthResult.PolicyDenied({
+    reason: "Login approval identity verification is not bound to an email identity",
+});
 const loginApprovalSameDeviceNotConfigured = () => AuthResult.PolicyDenied({
     reason: "Login approval same-device binding is not configured",
 });
@@ -386,7 +479,39 @@ const mfaFlowStateNotConfigured = () => AuthResult.PolicyDenied({
 const mfaFlowUserMismatch = () => AuthResult.PolicyDenied({
     reason: "MFA flow user mismatch",
 });
+const mfaFlowFactorNotAllowed = () => AuthResult.PolicyDenied({
+    reason: "MFA factor is not allowed for this flow",
+});
+const completedMfaFactorType = (input) => {
+    if (input.method === "totp") {
+        return input.evidence.type === "totp" ? "totp" : undefined;
+    }
+    if (input.method === "backup-code") {
+        return input.evidence.type === "recovery_code" ? "backup-code" : undefined;
+    }
+    if (input.method === "passkey") {
+        return input.evidence.type === "passkey" &&
+            input.evidence.userVerification === "verified"
+            ? "passkey"
+            : undefined;
+    }
+    return undefined;
+};
+const authFlowStateAllowsMfa = (state, input) => {
+    const factorType = completedMfaFactorType(input);
+    return (factorType !== undefined &&
+        state.factors?.some((factor) => factor.type === factorType) === true);
+};
+const primaryFactorNotEstablished = () => AuthResult.PolicyDenied({
+    reason: "Authentication evidence did not establish a primary factor",
+});
 const optionalLoginApprovalDependencies = Effect.gen(function* () {
+    const pipeline = yield* Effect.serviceOption(AuthFlowPipeline);
+    const emailVerificationSessionPolicy = yield* Effect.serviceOption(EmailVerificationSessionPolicy);
+    const mfaRequirementPolicy = yield* Effect.serviceOption(MfaRequirementPolicy);
+    const totpFactorManagement = yield* Effect.serviceOption(TotpFactorManagement);
+    const recoveryCodeManagement = yield* Effect.serviceOption(RecoveryCodeManagement);
+    const passkeyCredentialManagement = yield* Effect.serviceOption(PasskeyCredentialManagement);
     const loginApprovalPolicy = yield* Effect.serviceOption(LoginApprovalPolicy);
     const loginApprovalFlow = yield* Effect.serviceOption(LoginApprovalFlow);
     const authFlowState = yield* Effect.serviceOption(AuthFlowState);
@@ -395,7 +520,24 @@ const optionalLoginApprovalDependencies = Effect.gen(function* () {
     const loginRiskEngine = yield* Effect.serviceOption(LoginRiskEngine);
     const loginApprovalReview = yield* Effect.serviceOption(LoginApprovalReview);
     const loginNotification = yield* Effect.serviceOption(LoginNotification);
+    const recoveryRequirementPolicy = yield* Effect.serviceOption(RecoveryRequirementPolicy);
     return {
+        ...(Option.isSome(pipeline) ? { pipeline: pipeline.value } : {}),
+        ...(Option.isSome(emailVerificationSessionPolicy)
+            ? { emailVerificationSessionPolicy: emailVerificationSessionPolicy.value }
+            : {}),
+        ...(Option.isSome(mfaRequirementPolicy)
+            ? { mfaRequirementPolicy: mfaRequirementPolicy.value }
+            : {}),
+        ...(Option.isSome(totpFactorManagement)
+            ? { totpFactorManagement: totpFactorManagement.value }
+            : {}),
+        ...(Option.isSome(recoveryCodeManagement)
+            ? { recoveryCodeManagement: recoveryCodeManagement.value }
+            : {}),
+        ...(Option.isSome(passkeyCredentialManagement)
+            ? { passkeyCredentialManagement: passkeyCredentialManagement.value }
+            : {}),
         ...(Option.isSome(loginApprovalPolicy)
             ? { loginApprovalPolicy: loginApprovalPolicy.value }
             : {}),
@@ -418,15 +560,22 @@ const optionalLoginApprovalDependencies = Effect.gen(function* () {
         ...(Option.isSome(loginNotification)
             ? { loginNotification: loginNotification.value }
             : {}),
+        ...(Option.isSome(recoveryRequirementPolicy)
+            ? { recoveryRequirementPolicy: recoveryRequirementPolicy.value }
+            : {}),
     };
 });
 export const makeAuthFlow = (dependencies) => {
     const emailVerificationSessionPolicy = dependencies.emailVerificationSessionPolicy ??
         makeEmailVerificationSessionPolicy();
+    const mfaRequirementPolicy = dependencies.mfaRequirementPolicy ?? makeMfaRequirementPolicy();
     const loginApprovalPolicy = dependencies.loginApprovalPolicy ?? makeLoginApprovalPolicy();
     const loginRiskEngine = dependencies.loginRiskEngine ?? makeLoginRiskEngineNoop();
+    const pipeline = dependencies.pipeline ?? makeAuthFlowPipeline();
     const loginApprovalSameDeviceSecretBytes = dependencies.loginApprovalSameDeviceSecretBytes ??
         defaultLoginApprovalSameDeviceSecretBytes;
+    const flowTerminal = makeAuthFlowTerminal(dependencies);
+    const deriveFlowInput = flowTerminal.derive;
     const resolveDevice = (input) => {
         if (input.device !== undefined) {
             return Effect.succeed(input.device);
@@ -439,79 +588,223 @@ export const makeAuthFlow = (dependencies) => {
             token: input.trustedDeviceToken,
         });
     };
-    const notifyLogin = (input, session) => dependencies.loginNotification === undefined
-        ? Effect.void
-        : dependencies.loginNotification
-            .notify({
-            userId: input.userId,
-            ...(input.email === undefined ? {} : { email: input.email }),
-            ...(input.intent === undefined ? {} : { intent: input.intent }),
-            method: input.method,
-            amr: input.amr,
-            aal: input.aal,
-            session: loginNotificationSession(session),
-            device: input.device ?? unknownLoginDeviceContext,
-            risk: input.risk ?? defaultLoginRiskContext,
-            request: input.request ?? loginRequestContextFromMetadata(input.metadata),
-            ...(input.metadata === undefined ? {} : { metadata: input.metadata }),
-        })
-            .pipe(Effect.catchCause(() => Effect.void));
-    const complete = Effect.fn("auth.auth_flow.complete")(function* (input) {
-        yield* Effect.annotateCurrentSpan({
-            "auth.method": input.method,
-            "auth.aal": input.aal,
-            "auth.amr_count": input.amr.length,
+    const detectMfaFactors = (input) => Effect.gen(function* () {
+        const factors = [];
+        if (dependencies.totpFactorManagement !== undefined &&
+            !input.amr.includes("totp")) {
+            const totpFactors = yield* dependencies.totpFactorManagement.listForUser({
+                userId: input.userId,
+            });
+            if (totpFactors.length > 0) {
+                factors.push({ type: "totp" });
+            }
+        }
+        if (dependencies.recoveryCodeManagement !== undefined &&
+            !input.amr.includes("recovery_code")) {
+            const recoveryCodes = yield* dependencies.recoveryCodeManagement.listForUser({
+                userId: input.userId,
+            });
+            if (recoveryCodes.length > 0) {
+                factors.push({ type: "backup-code" });
+            }
+        }
+        if (dependencies.passkeyCredentialManagement !== undefined &&
+            !input.amr.includes("passkey")) {
+            const credentials = yield* dependencies.passkeyCredentialManagement.listForUser({
+                userId: input.userId,
+            });
+            if (credentials.length > 0) {
+                factors.push({ type: "passkey" });
+            }
+        }
+        return factors;
+    });
+    const requireMfaIfNeeded = (input) => Effect.gen(function* () {
+        const factors = yield* detectMfaFactors(input);
+        const decision = yield* mfaRequirementPolicy.decide({
+            ...input,
+            factors,
         });
-        const session = yield* dependencies.sessions.create({
-            userId: input.userId,
-            method: input.method,
-            amr: input.amr,
-            aal: input.aal,
-            claims: input.claims,
-            ...(input.mfaVerifiedAt === undefined
+        return decision._tag === "RequireMfa"
+            ? Option.some(yield* requireMfa({
+                ...input,
+                factors: decision.factors,
+            }))
+            : Option.none();
+    });
+    const requireMfa = Effect.fn("auth.auth_flow.require_mfa")(function* (input) {
+        if (dependencies.authFlowState === undefined) {
+            yield* Effect.annotateCurrentSpan("auth.result", "PolicyDenied");
+            return mfaFlowStateNotConfigured();
+        }
+        const derived = yield* deriveFlowInput(input);
+        if (!derived.primaryEstablished) {
+            yield* Effect.annotateCurrentSpan("auth.result", "PolicyDenied");
+            return primaryFactorNotEstablished();
+        }
+        const emailVerificationDecision = yield* emailVerificationSessionPolicy.decide({
+            claims: derived.claims,
+        });
+        const metadata = sessionMetadata(applicationFlowStateMetadata(derived.metadata), derived.request);
+        const device = yield* resolveDevice(derived);
+        const flowState = yield* dependencies.authFlowState.start({
+            userId: derived.userId,
+            method: derived.method,
+            evidence: derived.evidence,
+            ...(derived.identity === undefined ? {} : { identity: derived.identity }),
+            ...(derived.emailDestination === undefined
                 ? {}
-                : { mfaVerifiedAt: input.mfaVerifiedAt }),
-            metadata: input.metadata,
+                : { emailDestination: derived.emailDestination }),
+            ...(derived.intent === undefined ? {} : { intent: derived.intent }),
+            device,
+            ...(derived.deviceKey === undefined
+                ? {}
+                : { deviceKey: derived.deviceKey }),
+            ...(derived.locationKey === undefined
+                ? {}
+                : { locationKey: derived.locationKey }),
+            ...(derived.request === undefined ? {} : { request: derived.request }),
+            claims: emailVerificationDecision.claims,
+            ...(input.secret === undefined ? {} : { secret: input.secret }),
+            ...(input.ttl === undefined ? {} : { ttl: input.ttl }),
+            factors: input.factors,
+            ...(metadata === undefined ? {} : { metadata }),
+        });
+        yield* Effect.annotateCurrentSpan({
+            "auth.result": "RequiresMfa",
+            "auth.mfa.factor_count": input.factors.length,
+        });
+        return AuthResult.RequiresMfa({
+            flowId: flowState.flowId,
+            factors: input.factors,
         });
-        yield* notifyLogin(input, session);
-        yield* Effect.annotateCurrentSpan("auth.result", "Authenticated");
-        return AuthResult.Authenticated({ session });
     });
-    const completePrimaryFactor = Effect.fn("auth.auth_flow.complete_primary_factor")(function* (input) {
+    const advance = Effect.fn("auth.auth_flow.advance")(function* (initial, mfaSatisfied, terminal, handleLoginApproval, mfaMethod) {
+        let input = yield* deriveFlowInput(initial);
+        if (!input.primaryEstablished) {
+            yield* Effect.annotateCurrentSpan("auth.result", "PolicyDenied");
+            return primaryFactorNotEstablished();
+        }
+        if (mfaMethod !== undefined) {
+            yield* Effect.annotateCurrentSpan({
+                "auth.mfa.method": mfaMethod,
+                "auth.mfa.aal": input.aal,
+                "auth.mfa.amr_count": input.amr.length,
+            });
+        }
         const emailVerificationDecision = yield* emailVerificationSessionPolicy.decide({
             claims: input.claims,
         });
-        const metadata = sessionMetadata(input.metadata, input.request);
+        const metadata = sessionMetadata(applicationFlowStateMetadata(input.metadata), input.request);
         const device = yield* resolveDevice(input);
+        input = {
+            ...input,
+            claims: emailVerificationDecision.claims,
+            device,
+            ...(input.request === undefined && metadata !== undefined
+                ? { request: loginRequestContextFromMetadata(metadata) }
+                : {}),
+            ...(metadata === undefined ? {} : { metadata }),
+        };
+        const beforeRisk = yield* pipeline.advance({
+            phase: "before-risk",
+            input,
+            mfaSatisfied,
+        });
+        if (beforeRisk._tag === "PolicyDenied") {
+            return AuthResult.PolicyDenied({ reason: beforeRisk.reason });
+        }
         const risk = yield* loginRiskEngine.assess({
             userId: input.userId,
-            ...(input.email === undefined ? {} : { email: input.email }),
-            emailVerified: emailVerificationDecision.claims?.emailVerified,
+            ...(input.identity === undefined ? {} : { identity: input.identity }),
+            ...(input.emailDestination === undefined
+                ? {}
+                : { emailDestination: input.emailDestination }),
             method: input.method,
             amr: input.amr,
             aal: input.aal,
-            device,
+            device: input.device ?? unknownLoginDeviceContext,
+            ...(input.deviceKey === undefined ? {} : { deviceKey: input.deviceKey }),
+            ...(input.locationKey === undefined
+                ? {}
+                : { locationKey: input.locationKey }),
             ...(input.request === undefined ? {} : { request: input.request }),
-            ...(metadata === undefined ? {} : { metadata }),
+            ...(input.metadata === undefined ? {} : { metadata: input.metadata }),
+        });
+        input = { ...input, risk };
+        const afterRisk = yield* pipeline.advance({
+            phase: "after-risk",
+            input,
+            mfaSatisfied,
+        });
+        if (afterRisk._tag === "PolicyDenied") {
+            return AuthResult.PolicyDenied({ reason: afterRisk.reason });
+        }
+        const beforeMfa = yield* pipeline.advance({
+            phase: "before-mfa",
+            input,
+            mfaSatisfied,
+        });
+        if (beforeMfa._tag === "PolicyDenied") {
+            return AuthResult.PolicyDenied({ reason: beforeMfa.reason });
+        }
+        if (!mfaSatisfied) {
+            const mfaResult = yield* requireMfaIfNeeded({
+                ...input,
+                claims: input.claims,
+                device: input.device,
+                risk: input.risk,
+                metadata: input.metadata,
+            });
+            if (Option.isSome(mfaResult)) {
+                return mfaResult.value;
+            }
+        }
+        const afterMfa = yield* pipeline.advance({
+            phase: "after-mfa",
+            input,
+            mfaSatisfied,
         });
+        if (afterMfa._tag === "PolicyDenied") {
+            return AuthResult.PolicyDenied({ reason: afterMfa.reason });
+        }
+        const beforeLoginApproval = yield* pipeline.advance({
+            phase: "before-login-approval",
+            input,
+            mfaSatisfied,
+        });
+        if (beforeLoginApproval._tag === "PolicyDenied") {
+            return AuthResult.PolicyDenied({ reason: beforeLoginApproval.reason });
+        }
         const loginApprovalDecision = yield* loginApprovalPolicy.decide({
             ...(input.intent === undefined ? {} : { intent: input.intent }),
             userId: input.userId,
-            ...(input.email === undefined ? {} : { email: input.email }),
-            emailVerified: emailVerificationDecision.claims?.emailVerified,
+            ...(input.identity === undefined ? {} : { identity: input.identity }),
+            ...(input.emailDestination === undefined
+                ? {}
+                : { emailDestination: input.emailDestination }),
             method: input.method,
             amr: input.amr,
             aal: input.aal,
-            device,
-            risk,
-            ...(metadata === undefined ? {} : { metadata }),
+            device: input.device ?? unknownLoginDeviceContext,
+            risk: input.risk ?? defaultLoginRiskContext,
+            ...(input.metadata === undefined ? {} : { metadata: input.metadata }),
         });
         if (loginApprovalDecision._tag === "RequiresApproval") {
             if (loginApprovalDecision.channel === "email" &&
-                input.email === undefined) {
+                input.emailDestination === undefined) {
                 yield* Effect.annotateCurrentSpan("auth.result", "PolicyDenied");
                 return loginApprovalEmailMissing();
             }
+            if (loginApprovalDecision.markIdentityVerified === true &&
+                (loginApprovalDecision.channel !== "email" ||
+                    loginApprovalDecision.sessionBinding === "none" ||
+                    input.identity?.kind !== "email" ||
+                    input.emailDestination === undefined ||
+                    input.identity.identityId !== input.emailDestination.identityId)) {
+                yield* Effect.annotateCurrentSpan("auth.result", "PolicyDenied");
+                return loginApprovalIdentityNotBound();
+            }
             if (dependencies.authFlowState === undefined ||
                 dependencies.loginApprovalFlow === undefined) {
                 yield* Effect.annotateCurrentSpan("auth.result", "PolicyDenied");
@@ -523,124 +816,179 @@ export const makeAuthFlow = (dependencies) => {
                 yield* Effect.annotateCurrentSpan("auth.result", "PolicyDenied");
                 return loginApprovalReviewNotConfigured();
             }
-            let sameDeviceSecret;
-            if (loginApprovalDecision.sameDeviceRequired) {
-                if (dependencies.crypto === undefined) {
-                    yield* Effect.annotateCurrentSpan("auth.result", "PolicyDenied");
-                    return loginApprovalSameDeviceNotConfigured();
-                }
-                sameDeviceSecret = Redacted.make(yield* dependencies.crypto
-                    .randomToken(loginApprovalSameDeviceSecretBytes)
-                    .pipe(Effect.mapError((cause) => new AuthFlowStateError({
-                    message: "Failed to create login approval same-device binding",
-                    cause,
-                }))));
+            if (loginApprovalDecision.sameDeviceRequired &&
+                dependencies.crypto === undefined) {
+                yield* Effect.annotateCurrentSpan("auth.result", "PolicyDenied");
+                return loginApprovalSameDeviceNotConfigured();
             }
-            const claims = loginApprovalDecision.markEmailVerified === true
-                ? withEmailVerified(emailVerificationDecision.claims, true)
-                : emailVerificationDecision.claims;
-            const flowState = yield* dependencies.authFlowState.start({
-                userId: input.userId,
-                method: input.method,
-                amr: input.amr,
-                aal: input.aal,
-                ...(input.email === undefined ? {} : { email: input.email }),
-                ...(input.intent === undefined ? {} : { intent: input.intent }),
-                device,
-                claims,
-                secret: sameDeviceSecret,
-                ...(metadata === undefined ? {} : { metadata }),
-            });
-            const approval = yield* dependencies.loginApprovalFlow.start({
-                userId: input.userId,
-                ...(input.email === undefined ? {} : { email: input.email }),
-                channel: loginApprovalDecision.channel,
-                reason: loginApprovalDecision.reason,
-                sessionBinding: loginApprovalDecision.sessionBinding,
-                sameDeviceRequired: loginApprovalDecision.sameDeviceRequired,
-                ...(loginApprovalDecision.markEmailVerified === true
-                    ? { markEmailVerified: true }
-                    : {}),
-                risk,
-                metadata: loginApprovalFlowIdMetadata(flowState.flowId, metadata),
-            });
-            if (approval.sessionBinding === "none" &&
-                loginApprovalReview !== undefined) {
-                yield* loginApprovalReview.start({
-                    approval,
+            const approvalInput = input;
+            const completeLoginApproval = Effect.gen(function* () {
+                let sameDeviceSecret;
+                if (loginApprovalDecision.sameDeviceRequired) {
+                    sameDeviceSecret = Redacted.make(yield* dependencies
+                        .crypto.randomToken(loginApprovalSameDeviceSecretBytes)
+                        .pipe(Effect.mapError((cause) => new AuthFlowStateError({
+                        message: "Failed to create login approval same-device binding",
+                        cause,
+                    }))));
+                }
+                const claims = loginApprovalDecision.markIdentityVerified === true
+                    ? withVerifiedIdentityKind(approvalInput.claims, "email")
+                    : approvalInput.claims;
+                const flowState = yield* dependencies.authFlowState.start({
+                    userId: approvalInput.userId,
+                    method: approvalInput.method,
+                    evidence: approvalInput.evidence,
+                    ...(approvalInput.identity === undefined
+                        ? {}
+                        : { identity: approvalInput.identity }),
+                    ...(approvalInput.emailDestination === undefined
+                        ? {}
+                        : { emailDestination: approvalInput.emailDestination }),
+                    ...(approvalInput.intent === undefined
+                        ? {}
+                        : { intent: approvalInput.intent }),
+                    device: approvalInput.device,
+                    ...(approvalInput.deviceKey === undefined
+                        ? {}
+                        : { deviceKey: approvalInput.deviceKey }),
+                    ...(approvalInput.locationKey === undefined
+                        ? {}
+                        : { locationKey: approvalInput.locationKey }),
+                    ...(approvalInput.request === undefined
+                        ? {}
+                        : { request: approvalInput.request }),
+                    claims,
+                    secret: sameDeviceSecret,
+                    ...(approvalInput.metadata === undefined
+                        ? {}
+                        : { metadata: approvalInput.metadata }),
+                });
+                const approval = yield* dependencies.loginApprovalFlow.start({
+                    userId: approvalInput.userId,
+                    ...(approvalInput.emailDestination === undefined
+                        ? {}
+                        : { emailDestination: approvalInput.emailDestination }),
+                    channel: loginApprovalDecision.channel,
+                    reason: loginApprovalDecision.reason,
+                    sessionBinding: loginApprovalDecision.sessionBinding,
+                    sameDeviceRequired: loginApprovalDecision.sameDeviceRequired,
+                    ...(loginApprovalDecision.markIdentityVerified === true
+                        ? { markIdentityVerified: true }
+                        : {}),
+                    risk: approvalInput.risk ?? defaultLoginRiskContext,
+                    metadata: loginApprovalFlowIdMetadata(flowState.flowId, approvalInput.metadata),
+                });
+                if (approval.sessionBinding === "none" &&
+                    loginApprovalReview !== undefined) {
+                    yield* loginApprovalReview.start({
+                        approval,
+                        flowId: flowState.flowId,
+                        metadata: approvalInput.metadata,
+                    });
+                }
+                yield* Effect.annotateCurrentSpan({
+                    "auth.result": "RequiresLoginApproval",
+                    "auth.login_approval.reason": approval.reason,
+                    "auth.login_approval.session_binding": approval.sessionBinding,
+                    "auth.login_approval.same_device_required": approval.sameDeviceRequired,
+                });
+                return AuthResult.RequiresLoginApproval({
                     flowId: flowState.flowId,
-                    metadata,
+                    approvalChallengeId: approval.challengeId,
+                    channel: approval.channel,
+                    sessionBinding: approval.sessionBinding,
+                    sameDeviceRequired: approval.sameDeviceRequired,
+                    reason: approval.reason,
+                    expiresAt: flowState.expiresAt,
+                    ...(sameDeviceSecret === undefined ? {} : { sameDeviceSecret }),
                 });
-            }
-            yield* Effect.annotateCurrentSpan({
-                "auth.result": "RequiresLoginApproval",
-                "auth.login_approval.reason": approval.reason,
-                "auth.login_approval.session_binding": approval.sessionBinding,
-                "auth.login_approval.same_device_required": approval.sameDeviceRequired,
-            });
-            return AuthResult.RequiresLoginApproval({
-                flowId: flowState.flowId,
-                approvalChallengeId: approval.challengeId,
-                channel: approval.channel,
-                sessionBinding: approval.sessionBinding,
-                sameDeviceRequired: approval.sameDeviceRequired,
-                reason: approval.reason,
-                expiresAt: flowState.expiresAt,
-                ...(sameDeviceSecret === undefined ? {} : { sameDeviceSecret }),
             });
+            return yield* handleLoginApproval(completeLoginApproval);
         }
-        return yield* complete({
-            userId: input.userId,
-            ...(input.email === undefined ? {} : { email: input.email }),
-            ...(input.intent === undefined ? {} : { intent: input.intent }),
-            method: input.method,
-            amr: input.amr,
-            aal: input.aal,
-            device,
-            ...(input.request === undefined ? {} : { request: input.request }),
-            risk,
-            claims: emailVerificationDecision.claims,
-            metadata,
-        });
+        return yield* terminal(input);
     });
+    const completePrimaryFactor = Effect.fn("auth.auth_flow.complete_primary_factor")((input) => advance(input, false, flowTerminal.complete, (complete) => complete));
     const completeMfa = Effect.fn("auth.auth_flow.complete_mfa")(function* (input) {
         if (dependencies.authFlowState === undefined) {
             yield* Effect.annotateCurrentSpan("auth.result", "PolicyDenied");
             return mfaFlowStateNotConfigured();
         }
-        const consumed = yield* dependencies.authFlowState.consume(input.flowId, input.secret);
-        if (input.userId !== undefined && consumed.userId !== input.userId) {
+        const pending = yield* dependencies.authFlowState.inspect(input.flowId, input.secret);
+        if (input.userId !== undefined && pending.userId !== input.userId) {
             yield* Effect.annotateCurrentSpan("auth.result", "PolicyDenied");
             return mfaFlowUserMismatch();
         }
-        const mfaVerifiedAt = input.now ?? (yield* currentUnixMillis);
-        const amr = appendAuthMethods(consumed.amr, input.amr ?? [authMethodReference(input.method)]);
-        const aal = strongerAal(consumed.aal, input.aal ?? "aal2");
-        const metadata = mergeMetadata(consumed.metadata, input.metadata);
-        yield* Effect.annotateCurrentSpan({
-            "auth.result": "Authenticated",
-            "auth.mfa.method": input.method,
-            "auth.mfa.aal": aal,
-            "auth.mfa.amr_count": amr.length,
-        });
-        return yield* complete({
+        if (!authFlowStateAllowsMfa(pending, input)) {
+            yield* Effect.annotateCurrentSpan("auth.result", "PolicyDenied");
+            return mfaFlowFactorNotAllowed();
+        }
+        const consumed = yield* dependencies.authFlowState.consume(input.flowId, input.secret);
+        if (consumed.userId !== pending.userId ||
+            !authFlowStateAllowsMfa(consumed, input)) {
+            yield* Effect.annotateCurrentSpan("auth.result", "PolicyDenied");
+            return mfaFlowFactorNotAllowed();
+        }
+        const evidence = [...consumed.evidence, input.evidence];
+        const metadata = mergeMetadata(consumed.metadata, applicationFlowStateMetadata(input.metadata));
+        const result = yield* advance({
             userId: consumed.userId,
-            ...(consumed.email === undefined ? {} : { email: consumed.email }),
+            ...(consumed.identity === undefined
+                ? {}
+                : { identity: consumed.identity }),
+            ...(consumed.emailDestination === undefined
+                ? {}
+                : { emailDestination: consumed.emailDestination }),
             ...(consumed.intent === undefined ? {} : { intent: consumed.intent }),
             method: consumed.method,
-            amr,
-            aal,
+            evidence,
             ...(consumed.device === undefined ? {} : { device: consumed.device }),
+            ...(consumed.deviceKey === undefined
+                ? {}
+                : { deviceKey: consumed.deviceKey }),
+            ...(consumed.locationKey === undefined
+                ? {}
+                : { locationKey: consumed.locationKey }),
+            ...(consumed.request === undefined
+                ? {}
+                : { request: consumed.request }),
             claims: consumed.claims,
-            mfaVerifiedAt,
             metadata,
-        });
+        }, true, flowTerminal.complete, (complete) => complete, input.method);
+        return result._tag === "RequiresMfa"
+            ? AuthResult.PolicyDenied({ reason: "MFA is already satisfied" })
+            : result;
     });
-    return AuthFlow.make({
+    const prepareMfa = Effect.fn("auth.auth_flow.prepare_mfa")(function* (input) {
+        if (dependencies.authFlowState === undefined) {
+            return mfaFlowStateNotConfigured();
+        }
+        const inspected = yield* dependencies.authFlowState.inspect(input.flowId, input.secret);
+        if (input.userId !== undefined && inspected.userId !== input.userId) {
+            return mfaFlowUserMismatch();
+        }
+        if (!authFlowStateAllowsMfa(inspected, input)) {
+            return mfaFlowFactorNotAllowed();
+        }
+        const evidence = [...inspected.evidence, input.evidence];
+        const result = yield* advance({
+            ...inspected,
+            evidence,
+            metadata: mergeMetadata(inspected.metadata, applicationFlowStateMetadata(input.metadata)),
+        }, true, flowTerminal.prepare, (complete) => Effect.succeed({
+            _tag: "PreparedLoginApproval",
+            complete,
+        }), input.method);
+        return result._tag === "RequiresMfa"
+            ? AuthResult.PolicyDenied({ reason: "MFA is already satisfied" })
+            : result;
+    });
+    return AuthFlow.of({
         startPrimaryFactor: completePrimaryFactor,
+        requireMfa,
         completePrimaryFactor,
         completeMfa,
-        complete,
+        prepareMfa,
     });
 };
 export const AuthFlowLive = Layer.effect(AuthFlow)(Effect.gen(function* () {
@@ -653,13 +1001,13 @@ export const AuthFlowLive = Layer.effect(AuthFlow)(Effect.gen(function* () {
         ...loginApprovalDependencies,
     });
 }));
-export const AuthFlowLiveWithEmailVerificationPolicy = (options) => Layer.effect(AuthFlow)(Effect.gen(function* () {
+export const AuthFlowWithEmailVerificationPolicyLive = (options) => Layer.effect(AuthFlow)(Effect.gen(function* () {
     const sessions = yield* Sessions;
     const loginApprovalDependencies = yield* optionalLoginApprovalDependencies;
     return makeAuthFlow({
         sessions,
-        emailVerificationSessionPolicy: makeEmailVerificationSessionPolicy(options),
         ...loginApprovalDependencies,
+        emailVerificationSessionPolicy: makeEmailVerificationSessionPolicy(options),
     });
 }));
 //# sourceMappingURL=AuthFlow.js.map