@effect-auth/core 0.1.0-alpha.16 → 0.1.0-alpha.19

package/dist/SqliteStorageSchemaData.js

@@ -0,0 +1,508 @@
+// Selective fresh baseline derived from the maintained SQLite migrations through 0029.
+// Historical data-copy and table-rebuild statements are intentionally excluded.
+export const sqliteAuthStorageSchema = `create table auth_user (
+  id text primary key,
+  created_at integer not null,
+  updated_at integer not null,
+  disabled_at integer,
+  metadata text
+);
+
+create table auth_user_identity (
+  id text primary key,
+  user_id text not null,
+  scope_type text not null,
+  scope_id text not null,
+  kind text not null,
+  value text not null,
+  normalized_value text not null,
+  verified_at integer,
+  is_primary_login integer not null,
+  created_at integer not null,
+  updated_at integer not null,
+  revoked_at integer,
+  replaced_by_id text,
+  metadata text
+);
+create unique index auth_user_identity_active_value_idx on auth_user_identity (scope_type, scope_id, kind, normalized_value) where revoked_at is null;
+create index auth_user_identity_user_id_idx on auth_user_identity (user_id);
+create index auth_user_identity_replaced_by_id_idx on auth_user_identity (replaced_by_id);
+create unique index auth_user_identity_active_primary_idx on auth_user_identity (user_id) where revoked_at is null and is_primary_login = 1;
+
+create table auth_credential (
+  id text primary key,
+  user_id text not null,
+  type text not null,
+  password_hash text,
+  created_at integer not null,
+  updated_at integer not null,
+  revoked_at integer,
+  metadata text
+);
+create index auth_credential_user_id_idx on auth_credential (user_id);
+create unique index auth_credential_user_type_idx on auth_credential (user_id, type);
+
+create table auth_session (
+  id text primary key,
+  user_id text not null,
+  secret_hash text not null,
+  created_at integer not null,
+  expires_at integer not null,
+  auth_time integer not null,
+  authentication_events text not null,
+  aal text not null,
+  amr text not null,
+  mfa_verified_at integer,
+  metadata text,
+  revoked_at integer,
+  last_seen_at integer,
+  rotated_at integer
+);
+create index auth_session_user_id_idx on auth_session (user_id);
+create index auth_session_expires_at_idx on auth_session (expires_at);
+
+create table auth_verification (
+  id text primary key,
+  type text not null,
+  subject text not null,
+  secret_hash text,
+  created_at integer not null,
+  expires_at integer not null,
+  metadata text,
+  consumed_at integer
+);
+create index auth_verification_type_subject_idx on auth_verification (type, subject);
+create index auth_verification_expires_at_idx on auth_verification (expires_at);
+
+create table auth_totp_factor (
+  id text primary key,
+  user_id text not null,
+  secret text not null,
+  algorithm text not null,
+  digits integer not null,
+  period integer not null,
+  created_at integer not null,
+  confirmed_at integer,
+  last_used_at integer,
+  last_accepted_counter integer,
+  revoked_at integer,
+  metadata text
+);
+create index auth_totp_factor_user_id_idx on auth_totp_factor (user_id);
+create index auth_totp_factor_confirmed_at_idx on auth_totp_factor (confirmed_at);
+create index auth_totp_factor_revoked_at_idx on auth_totp_factor (revoked_at);
+
+create table auth_recovery_code (
+  id text primary key,
+  user_id text not null,
+  code_hash text not null,
+  created_at integer not null,
+  used_at integer,
+  revoked_at integer,
+  metadata text
+);
+create index auth_recovery_code_user_id_idx on auth_recovery_code (user_id);
+create index auth_recovery_code_used_at_idx on auth_recovery_code (used_at);
+create index auth_recovery_code_revoked_at_idx on auth_recovery_code (revoked_at);
+
+create table auth_refresh_token (
+  id text primary key,
+  family_id text not null,
+  user_id text not null,
+  secret_hash text not null,
+  created_at integer not null,
+  expires_at integer not null,
+  last_used_at integer,
+  rotated_at integer,
+  replaced_by_id text,
+  revoked_at integer,
+  reuse_detected_at integer,
+  metadata text
+);
+create unique index auth_refresh_token_secret_hash_idx on auth_refresh_token (secret_hash);
+create index auth_refresh_token_family_id_idx on auth_refresh_token (family_id);
+create index auth_refresh_token_user_id_idx on auth_refresh_token (user_id);
+create index auth_refresh_token_expires_at_idx on auth_refresh_token (expires_at);
+create index auth_refresh_token_rotated_at_idx on auth_refresh_token (rotated_at);
+create index auth_refresh_token_revoked_at_idx on auth_refresh_token (revoked_at);
+
+create table auth_oauth_account (
+  id text primary key,
+  provider_id text not null,
+  provider_account_id text not null,
+  user_id text not null,
+  email text,
+  email_verified integer,
+  created_at integer not null,
+  updated_at integer not null,
+  unlinked_at integer,
+  metadata text
+);
+create unique index auth_oauth_account_provider_account_idx on auth_oauth_account (provider_id, provider_account_id);
+create index auth_oauth_account_user_id_idx on auth_oauth_account (user_id);
+create index auth_oauth_account_unlinked_at_idx on auth_oauth_account (unlinked_at);
+
+create table auth_passkey_credential (
+  id text primary key,
+  user_id text not null,
+  credential_id text not null,
+  public_key text not null,
+  sign_count integer not null,
+  transports text,
+  backed_up integer,
+  created_at integer not null,
+  last_used_at integer,
+  revoked_at integer,
+  metadata text
+);
+create unique index auth_passkey_credential_credential_id_idx on auth_passkey_credential (credential_id);
+create index auth_passkey_credential_user_id_idx on auth_passkey_credential (user_id);
+create index auth_passkey_credential_revoked_at_idx on auth_passkey_credential (revoked_at);
+
+create table auth_api_key (
+  id text primary key,
+  user_id text not null,
+  prefix text not null,
+  secret_hash text not null,
+  scopes text not null,
+  created_at integer not null,
+  expires_at integer,
+  last_used_at integer,
+  revoked_at integer,
+  metadata text
+);
+create unique index auth_api_key_prefix_idx on auth_api_key (prefix);
+create index auth_api_key_user_id_idx on auth_api_key (user_id);
+create index auth_api_key_expires_at_idx on auth_api_key (expires_at);
+create index auth_api_key_revoked_at_idx on auth_api_key (revoked_at);
+
+create table auth_jwt_revocation (
+  jwt_id text primary key,
+  revoked_at integer not null,
+  expires_at integer,
+  reason text
+);
+create index auth_jwt_revocation_expires_at_idx on auth_jwt_revocation (expires_at);
+
+create table auth_audit_log (
+  storage_id integer primary key autoincrement,
+  id text,
+  type text not null,
+  user_id text,
+  actor_user_id text,
+  occurred_at integer not null,
+  request_ip_hash text,
+  request_user_agent_hash text,
+  event text not null,
+  created_at integer not null
+);
+create index auth_audit_log_id_idx on auth_audit_log (id);
+create index auth_audit_log_user_occurred_at_idx on auth_audit_log (user_id, occurred_at);
+create index auth_audit_log_actor_user_occurred_at_idx on auth_audit_log (actor_user_id, occurred_at);
+create index auth_audit_log_type_occurred_at_idx on auth_audit_log (type, occurred_at);
+create index auth_audit_log_occurred_at_idx on auth_audit_log (occurred_at);
+
+create table auth_login_approval_review (
+  approval_challenge_id text primary key,
+  flow_id text not null,
+  user_id text not null,
+  channel text not null,
+  reason text not null,
+  session_binding text not null,
+  same_device_required integer not null,
+  status text not null,
+  created_at integer not null,
+  expires_at integer not null,
+  reviewed_at integer,
+  reviewed_by text,
+  denied_reason text,
+  risk text,
+  metadata text,
+  review_metadata text
+);
+create index auth_login_approval_review_flow_id_idx on auth_login_approval_review (flow_id);
+create index auth_login_approval_review_user_id_idx on auth_login_approval_review (user_id);
+create index auth_login_approval_review_status_expires_at_idx on auth_login_approval_review (status, expires_at);
+
+create table auth_login_risk_history (
+  id text primary key,
+  user_id text not null,
+  occurred_at integer not null,
+  outcome text not null,
+  method text not null,
+  amr text not null,
+  aal text not null,
+  device_status text not null,
+  device_key text,
+  location_key text,
+  country text,
+  region text,
+  latitude_micro integer,
+  longitude_micro integer,
+  risk_level text,
+  created_at integer not null
+);
+create index auth_login_risk_history_user_occurred_at_idx on auth_login_risk_history (user_id, occurred_at);
+create index auth_login_risk_history_user_device_key_idx on auth_login_risk_history (user_id, device_key);
+create index auth_login_risk_history_user_location_key_idx on auth_login_risk_history (user_id, location_key);
+create index auth_login_risk_history_occurred_at_idx on auth_login_risk_history (occurred_at);
+
+create table auth_trusted_device (
+  user_id text not null,
+  token_hash text not null,
+  created_at integer not null,
+  last_seen_at integer not null,
+  expires_at integer not null,
+  metadata text,
+  primary key (user_id, token_hash)
+);
+create index auth_trusted_device_user_id_idx on auth_trusted_device (user_id);
+create index auth_trusted_device_expires_at_idx on auth_trusted_device (expires_at);
+
+create table auth_webhook_outbox (
+  id text primary key,
+  endpoint_key text not null,
+  event text not null,
+  status text not null,
+  attempts integer not null,
+  next_attempt_at integer not null,
+  created_at integer not null,
+  updated_at integer not null,
+  delivered_at integer,
+  last_error text
+);
+create index auth_webhook_outbox_due_idx on auth_webhook_outbox (next_attempt_at, status);
+create index auth_webhook_outbox_endpoint_due_idx on auth_webhook_outbox (endpoint_key, next_attempt_at);
+create index auth_webhook_outbox_status_idx on auth_webhook_outbox (status);
+
+create table auth_webhook_replay (
+  id text primary key,
+  expires_at integer not null,
+  created_at integer not null
+);
+create index auth_webhook_replay_expires_at_idx on auth_webhook_replay (expires_at);
+
+create table auth_domain_verification (
+  id text primary key,
+  owner_id text not null,
+  domain text not null,
+  proof_method text not null,
+  proof_token text not null,
+  status text not null,
+  created_at integer not null,
+  expires_at integer not null,
+  verified_at integer,
+  revoked_at integer,
+  last_checked_at integer,
+  metadata text
+);
+create unique index auth_domain_verification_owner_domain_idx on auth_domain_verification (owner_id, domain);
+create index auth_domain_verification_domain_idx on auth_domain_verification (domain);
+create index auth_domain_verification_status_expires_at_idx on auth_domain_verification (status, expires_at);
+
+create table auth_security_timeline (
+  id text primary key,
+  user_id text not null,
+  type text not null,
+  category text not null,
+  severity text not null,
+  occurred_at integer not null,
+  summary text not null,
+  actor text,
+  request text,
+  metadata text
+);
+create index auth_security_timeline_user_occurred_at_idx on auth_security_timeline (user_id, occurred_at);
+create index auth_security_timeline_type_idx on auth_security_timeline (type);
+create index auth_security_timeline_category_idx on auth_security_timeline (category);
+
+create table auth_oauth_client (
+  id text primary key,
+  type text not null,
+  status text not null,
+  name text,
+  redirect_uris text not null,
+  allowed_grant_types text not null,
+  allowed_response_types text not null,
+  allowed_scopes text,
+  created_at integer,
+  updated_at integer,
+  metadata text
+);
+create index auth_oauth_client_status_idx on auth_oauth_client (status);
+
+create table auth_oauth_consent (
+  id text primary key,
+  user_id text not null,
+  client_id text not null,
+  scopes text not null,
+  granted_at integer not null,
+  expires_at integer,
+  revoked_at integer,
+  metadata text
+);
+create unique index auth_oauth_consent_user_client_idx on auth_oauth_consent (user_id, client_id);
+create index auth_oauth_consent_user_id_idx on auth_oauth_consent (user_id);
+create index auth_oauth_consent_expires_at_idx on auth_oauth_consent (expires_at);
+create index auth_oauth_consent_revoked_at_idx on auth_oauth_consent (revoked_at);
+
+create table auth_oauth_authorization_code (
+  code_hash text primary key,
+  client_id text not null,
+  subject text not null,
+  redirect_uri text not null,
+  scopes text not null,
+  code_challenge text,
+  code_challenge_method text,
+  issued_at integer not null,
+  expires_at integer not null,
+  consumed_at integer,
+  metadata text
+);
+create index auth_oauth_authorization_code_client_expires_at_idx on auth_oauth_authorization_code (client_id, expires_at);
+create index auth_oauth_authorization_code_expires_at_idx on auth_oauth_authorization_code (expires_at);
+create index auth_oauth_authorization_code_consumed_at_idx on auth_oauth_authorization_code (consumed_at);
+
+create table auth_oauth_client_secret (
+  prefix text not null,
+  client_id text not null,
+  secret_hash text not null,
+  authentication_methods text not null,
+  created_at integer not null,
+  expires_at integer,
+  last_used_at integer,
+  revoked_at integer,
+  metadata text,
+  primary key (client_id, prefix)
+);
+
+create table auth_oauth_provider_mode_token (
+  token_hash text primary key,
+  token_type text not null,
+  client_id text not null,
+  subject text not null,
+  scopes text not null,
+  issued_at integer not null,
+  expires_at integer not null,
+  issuer text,
+  audience text,
+  jwt_id text,
+  revoked_at integer,
+  revocation_reason text,
+  rotated_at integer,
+  replaced_by_token_hash text,
+  metadata text
+);
+create index auth_oauth_provider_mode_token_client_expires_at_idx on auth_oauth_provider_mode_token (client_id, expires_at);
+create index auth_oauth_provider_mode_token_subject_idx on auth_oauth_provider_mode_token (subject);
+create index auth_oauth_provider_mode_token_expires_at_idx on auth_oauth_provider_mode_token (expires_at);
+create index auth_oauth_provider_mode_token_revoked_at_idx on auth_oauth_provider_mode_token (revoked_at);
+create index auth_oauth_provider_mode_token_rotated_at_idx on auth_oauth_provider_mode_token (rotated_at);
+create index auth_oauth_provider_mode_token_jwt_id_idx on auth_oauth_provider_mode_token (jwt_id);
+
+create table auth_oauth_provider_token_vault (
+  account_id text primary key,
+  user_id text not null,
+  provider_id text not null,
+  provider_account_id text not null,
+  access_token_ciphertext text not null,
+  refresh_token_ciphertext text,
+  id_token_ciphertext text,
+  token_type text not null,
+  scopes text,
+  expires_at integer,
+  updated_at integer not null,
+  revoked_at integer,
+  revocation_reason text
+);
+create index auth_oauth_provider_token_vault_user_id_idx on auth_oauth_provider_token_vault (user_id);
+create index auth_oauth_provider_token_vault_provider_account_idx on auth_oauth_provider_token_vault (provider_id, provider_account_id);
+create index auth_oauth_provider_token_vault_expires_at_idx on auth_oauth_provider_token_vault (expires_at);
+create index auth_oauth_provider_token_vault_revoked_at_idx on auth_oauth_provider_token_vault (revoked_at);
+
+create table auth_permission_definition (
+  id text primary key,
+  description text,
+  scope_type_present integer not null,
+  scope_type text not null,
+  created_at integer not null,
+  updated_at integer not null,
+  disabled_at integer,
+  deleted_at integer
+);
+
+create table auth_role_definition (
+  id text primary key,
+  description text,
+  created_at integer not null,
+  updated_at integer not null,
+  disabled_at integer,
+  deleted_at integer
+);
+
+create table auth_permission_grant (
+  subject_type text not null,
+  subject_id text not null,
+  permission_id text not null,
+  scope_type text not null,
+  scope_id_present integer not null,
+  scope_id text not null,
+  expires_at integer,
+  metadata text,
+  revoked_at integer,
+  primary key (subject_type, subject_id, permission_id, scope_type, scope_id_present, scope_id)
+);
+create index auth_permission_grant_check_idx on auth_permission_grant (subject_type, subject_id, permission_id, revoked_at, expires_at);
+
+create table auth_role_grant (
+  subject_type text not null,
+  subject_id text not null,
+  role_id text not null,
+  scope_type text not null,
+  scope_id_present integer not null,
+  scope_id text not null,
+  expires_at integer,
+  metadata text,
+  revoked_at integer,
+  primary key (subject_type, subject_id, role_id, scope_type, scope_id_present, scope_id)
+);
+create index auth_role_grant_check_idx on auth_role_grant (subject_type, subject_id, role_id, revoked_at, expires_at);
+
+create table auth_role_permission (
+  role_id text not null,
+  permission_id text not null,
+  scope_type_present integer not null,
+  scope_type text not null,
+  primary key (role_id, permission_id, scope_type_present, scope_type)
+);
+create index auth_role_permission_check_idx on auth_role_permission (permission_id, role_id, scope_type_present, scope_type);
+
+create table auth_oauth_device_authorization (
+  id text primary key,
+  device_code_hash text not null unique,
+  user_code_hash text not null unique,
+  client_id text not null,
+  requested_scopes text not null check (json_valid(requested_scopes) and json_type(requested_scopes) = 'array'),
+  granted_scopes text check (granted_scopes is null or (json_valid(granted_scopes) and json_type(granted_scopes) = 'array')),
+  subject text,
+  status text not null check (status in ('pending', 'approved', 'denied')),
+  issued_at integer not null,
+  expires_at integer not null,
+  poll_interval_seconds integer not null check (poll_interval_seconds > 0),
+  next_poll_at integer not null,
+  last_polled_at integer,
+  approved_at integer,
+  denied_at integer,
+  consumed_at integer,
+  metadata text check (metadata is null or (json_valid(metadata) and json_type(metadata) = 'object')),
+  check (
+    (status = 'pending' and granted_scopes is null and subject is null and approved_at is null and denied_at is null and consumed_at is null)
+    or (status = 'approved' and granted_scopes is not null and subject is not null and approved_at is not null and denied_at is null)
+    or (status = 'denied' and granted_scopes is null and subject is null and approved_at is null and denied_at is not null and consumed_at is null)
+  )
+);
+create index auth_oauth_device_authorization_expires_at_idx on auth_oauth_device_authorization (expires_at);
+create index auth_oauth_device_authorization_client_status_expires_at_idx on auth_oauth_device_authorization (client_id, status, expires_at);
+create index auth_oauth_device_authorization_status_expires_at_idx on auth_oauth_device_authorization (status, expires_at);
+`;
+//# sourceMappingURL=SqliteStorageSchemaData.js.map

package/dist/SqliteStorageSchemaData.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SqliteStorageSchemaData.js","sourceRoot":"","sources":["../src/SqliteStorageSchemaData.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,gFAAgF;AAChF,MAAM,CAAC,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwftC,CAAC"}

package/dist/StepUp.d.ts

@@ -1,9 +1,14 @@
-import { Duration, Effect } from "effect";
-import type { PolicyId } from "./Identifiers.js";
-import { AuthzError } from "./Policy.js";
+import { Context, Duration, Effect, Layer } from "effect";
+import { type CustomEvidencePolicyError } from "./Assurance.js";
+import type { CredentialId, PolicyId, UserId } from "./Identifiers.js";
+import type { PasskeyCredentialInfo, PasskeyCredentialManagementService } from "./Passkey.js";
+import { AuthorizationError } from "./Policy.js";
+import type { RecoveryCodeManagementService } from "./RecoveryCode.js";
 import { CurrentSession } from "./Sessions.js";
-import type { AuthAssuranceLevel, CurrentSessionShape, SessionRequirement } from "./Sessions.js";
-export type StepUpReason = "aal-too-low" | "auth-too-old" | "session-requirement-unsatisfied";
+import type { AuthAssuranceLevel, AuthMethodReference, CurrentSessionShape, SessionRequirement } from "./Sessions.js";
+import type { CredentialStoreService } from "./Storage.js";
+import type { TotpFactorManagementService } from "./Totp.js";
+export type StepUpReason = "aal-too-low" | "amr-missing" | "auth-too-old" | "step-up-alternative-unsatisfied" | "session-requirement-unsatisfied";
 export interface StepUpRequirement {
     readonly aal?: AuthAssuranceLevel;
     readonly maxAge?: Duration.Duration;
@@ -13,17 +18,97 @@ export interface StepUpFailureDetail {
     readonly reason: StepUpReason;
     readonly requiredAal?: AuthAssuranceLevel;
     readonly currentAal?: AuthAssuranceLevel;
+    readonly method?: AuthMethodReference;
     readonly maxAgeMillis?: number;
     readonly authAgeMillis?: number;
     readonly requirement?: SessionRequirement;
 }
+export type StepUpCapability = "password" | "passkey" | "totp" | "recovery-code" | "aal1-capable" | "aal2-capable" | "aal3-capable" | (string & {});
+export type StepUpCapabilityMatcher = StepUpCapability | readonly StepUpCapability[];
+export interface StepUpCapabilitiesListInput {
+    readonly userId: UserId;
+}
+declare const StepUpCapabilityError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "StepUpCapabilityError";
+} & Readonly<A>;
+export declare class StepUpCapabilityError extends StepUpCapabilityError_base<{
+    readonly message: string;
+    readonly cause?: unknown;
+}> {
+}
+export interface StepUpCapabilitiesService {
+    readonly listForUser: (input: StepUpCapabilitiesListInput) => Effect.Effect<readonly StepUpCapability[], StepUpCapabilityError>;
+}
+declare const StepUpCapabilities_base: Context.ServiceClass<StepUpCapabilities, "auth/StepUpCapabilities", StepUpCapabilitiesService>;
+export declare class StepUpCapabilities extends StepUpCapabilities_base {
+}
+export interface StepUpCapabilitiesDependencies {
+    readonly credentials?: CredentialStoreService;
+    readonly passkeyCredentialManagement?: PasskeyCredentialManagementService;
+    readonly totpFactorManagement?: TotpFactorManagementService;
+    readonly recoveryCodeManagement?: RecoveryCodeManagementService;
+    readonly passkeySupportsAal2?: (credential: PasskeyCredentialInfo) => boolean;
+}
+export interface StepUpPredicateOptions {
+    readonly maxAge?: Duration.Duration;
+}
+export type StepUpPredicate = {
+    readonly _tag: "Aal";
+    readonly aal: AuthAssuranceLevel;
+    readonly maxAge?: Duration.Duration;
+} | {
+    readonly _tag: "Amr";
+    readonly method: AuthMethodReference;
+    readonly maxAge?: Duration.Duration;
+} | {
+    readonly _tag: "Factor";
+    readonly method: AuthMethodReference;
+    readonly factorId: CredentialId;
+    readonly maxAge?: Duration.Duration;
+} | {
+    readonly _tag: "Every";
+    readonly requirements: readonly StepUpPredicate[];
+} | {
+    readonly _tag: "OneOf";
+    readonly requirements: readonly StepUpPredicate[];
+};
+export interface SessionStepUpPolicy {
+    readonly _tag: "SessionStepUpPolicy";
+    readonly require: StepUpPredicate;
+    readonly maxAge?: Duration.Duration;
+    readonly noSessionRequirements?: readonly SessionRequirement[];
+}
+export type StepUpPolicy = StepUpRequirement | SessionStepUpPolicy;
+export type AdaptiveStepUpRule = {
+    readonly _tag: "Available";
+    readonly capabilities: readonly StepUpCapability[];
+    readonly policy: StepUpPolicy;
+} | {
+    readonly _tag: "Allow";
+} | {
+    readonly _tag: "Deny";
+    readonly reason: string;
+};
+export interface AdaptiveStepUpPolicy {
+    readonly _tag: "AdaptiveStepUpPolicy";
+    readonly rules: readonly AdaptiveStepUpRule[];
+}
+export type AnyStepUpPolicy = StepUpPolicy | AdaptiveStepUpPolicy;
 export type StepUpDecision = {
     readonly _tag: "Satisfied";
     readonly session: CurrentSessionShape;
+    readonly capabilities?: readonly StepUpCapability[];
 } | {
     readonly _tag: "Required";
     readonly session: CurrentSessionShape;
     readonly failures: readonly StepUpFailureDetail[];
+    readonly capabilities?: readonly StepUpCapability[];
+};
+export type AdaptiveStepUpDecision = StepUpDecision | {
+    readonly _tag: "Denied";
+    readonly session: CurrentSessionShape;
+    readonly reason: string;
+    readonly capabilities?: readonly StepUpCapability[];
 };
 declare const StepUpRequired_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "StepUpRequired";
@@ -31,14 +116,50 @@ declare const StepUpRequired_base: new <A extends Record<string, any> = {}>(args
 export declare class StepUpRequired extends StepUpRequired_base<{
     readonly failures: readonly StepUpFailureDetail[];
     readonly session: CurrentSessionShape;
+    readonly capabilities?: readonly StepUpCapability[];
+}> {
+}
+declare const StepUpDenied_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "StepUpDenied";
+} & Readonly<A>;
+export declare class StepUpDenied extends StepUpDenied_base<{
+    readonly reason: string;
+    readonly session: CurrentSessionShape;
+    readonly capabilities?: readonly StepUpCapability[];
 }> {
 }
+export declare const makeStepUpCapabilities: (dependencies: StepUpCapabilitiesDependencies) => StepUpCapabilitiesService;
+export declare const StepUpCapabilitiesLive: Layer.Layer<StepUpCapabilities, never, never>;
 export declare const aalAtLeast: (actual: AuthAssuranceLevel, minimum: AuthAssuranceLevel) => boolean;
-export declare const checkStepUp: (requirement: StepUpRequirement) => Effect.Effect<StepUpDecision, never, CurrentSession>;
-export declare const requireStepUp: (requirement: StepUpRequirement) => Effect.Effect<void, StepUpRequired, CurrentSession>;
-export declare const requireAal: (aal: AuthAssuranceLevel) => Effect.Effect<void, StepUpRequired, CurrentSession>;
-export declare const requireFresh: (maxAge: Duration.Duration) => Effect.Effect<void, StepUpRequired, CurrentSession>;
-export declare const requireNoSessionRequirements: (...requirements: readonly SessionRequirement[]) => Effect.Effect<void, StepUpRequired, CurrentSession>;
-export declare const toPolicy: (requirement: StepUpRequirement, policyId?: PolicyId) => Effect.Effect<void, AuthzError, CurrentSession>;
+export declare const checkStepUp: (requirement: StepUpRequirement) => Effect.Effect<StepUpDecision, CustomEvidencePolicyError, CurrentSession>;
+export declare const aal: (requiredAal: AuthAssuranceLevel, options?: StepUpPredicateOptions) => StepUpPredicate;
+export declare const amr: (method: AuthMethodReference, options?: StepUpPredicateOptions) => StepUpPredicate;
+export declare const factor: (method: AuthMethodReference, factorId: CredentialId, options?: StepUpPredicateOptions) => StepUpPredicate;
+export declare const every: (...requirements: readonly StepUpPredicate[]) => StepUpPredicate;
+export declare const oneOf: (...requirements: readonly StepUpPredicate[]) => StepUpPredicate;
+export declare const available: (capabilities: StepUpCapabilityMatcher, policy: StepUpPolicy) => AdaptiveStepUpRule;
+export declare const allow: () => AdaptiveStepUpRule;
+export declare const deny: (reason?: string) => AdaptiveStepUpRule;
+export declare const adaptive: (rules: readonly AdaptiveStepUpRule[]) => AdaptiveStepUpPolicy;
+export declare const session: (input: {
+    readonly require: StepUpPredicate;
+    readonly maxAge?: Duration.Duration;
+    readonly noSessionRequirements?: readonly SessionRequirement[];
+}) => SessionStepUpPolicy;
+export declare const isAdaptiveStepUpPolicy: (policy: AnyStepUpPolicy) => policy is AdaptiveStepUpPolicy;
+export declare const checkPolicy: (policy: StepUpPolicy) => Effect.Effect<StepUpDecision, CustomEvidencePolicyError, CurrentSession>;
+export declare const checkAdaptivePolicy: (policy: AdaptiveStepUpPolicy) => Effect.Effect<AdaptiveStepUpDecision, StepUpCapabilityError | CustomEvidencePolicyError, CurrentSession | StepUpCapabilities>;
+export declare const checkAnyPolicy: (policy: AnyStepUpPolicy) => Effect.Effect<AdaptiveStepUpDecision, StepUpCapabilityError | CustomEvidencePolicyError, CurrentSession | StepUpCapabilities>;
+export declare const requireStepUp: (requirement: StepUpRequirement) => Effect.Effect<void, StepUpRequired | CustomEvidencePolicyError, CurrentSession>;
+export declare const requirePolicy: (policy: StepUpPolicy) => Effect.Effect<void, StepUpRequired | CustomEvidencePolicyError, CurrentSession>;
+export declare const requireAdaptivePolicy: (policy: AdaptiveStepUpPolicy) => Effect.Effect<void, StepUpRequired | StepUpDenied | StepUpCapabilityError | CustomEvidencePolicyError, CurrentSession | StepUpCapabilities>;
+export declare const requireAnyPolicy: (policy: AnyStepUpPolicy) => Effect.Effect<void, StepUpRequired | StepUpDenied | StepUpCapabilityError | CustomEvidencePolicyError, CurrentSession | StepUpCapabilities>;
+export declare function toGuard(policy: StepUpPolicy): Effect.Effect<void, StepUpRequired | CustomEvidencePolicyError, CurrentSession>;
+export declare function toGuard(policy: AdaptiveStepUpPolicy): Effect.Effect<void, StepUpRequired | StepUpDenied | StepUpCapabilityError | CustomEvidencePolicyError, CurrentSession | StepUpCapabilities>;
+export declare const requireAal: (requiredAal: AuthAssuranceLevel) => Effect.Effect<void, StepUpRequired | CustomEvidencePolicyError, CurrentSession>;
+export declare const requireFresh: (maxAge: Duration.Duration) => Effect.Effect<void, StepUpRequired | CustomEvidencePolicyError, CurrentSession>;
+export declare const requireNoSessionRequirements: (...requirements: readonly SessionRequirement[]) => Effect.Effect<void, StepUpRequired | CustomEvidencePolicyError, CurrentSession>;
+export declare function toPolicy(requirement: StepUpPolicy, policyId?: PolicyId): Effect.Effect<void, AuthorizationError | CustomEvidencePolicyError, CurrentSession>;
+export declare function toPolicy(requirement: AdaptiveStepUpPolicy, policyId?: PolicyId): Effect.Effect<void, AuthorizationError | CustomEvidencePolicyError, CurrentSession | StepUpCapabilities>;
 export {};
 //# sourceMappingURL=StepUp.d.ts.map