DI and actions

The facade is the recommended default, not the only way in. Three entry points run the same code: the Authentication facade (shortest), the manager RoundlyConsulting\Auth\AuthenticationManager — the facade’s root, a container singleton — injected through the constructor (same API, explicit dependency, no static calls), and actions in RoundlyConsulting\Auth\Actions\* (single-purpose classes with execute(), for composing into your own actions, jobs and commands).

Inject the manager

use RoundlyConsulting\Auth\AuthenticationManager;
use RoundlyConsulting\Auth\Enums\InvalidationReason;

final class ResetSupportPassword
{
    public function __construct(private AuthenticationManager $authentication) {}

    public function __invoke(User $user, string $password): void
    {
        $this->authentication->guard('users')->passwords()->set($user, $password, InvalidationReason::Security);
    }
}

Call an action

Host-facing actions take the guard name first and refuse an account, invitation or passkey of another guard before anything is written:

use RoundlyConsulting\Auth\Actions\Account\LockAccount;
use RoundlyConsulting\Auth\Actions\Invitations\ResendInvitation;
use RoundlyConsulting\Auth\Actions\Passwords\SetPassword;
use RoundlyConsulting\Auth\Enums\InvalidationReason;

// The raw actions — the same code path; the guard name comes first.
app(SetPassword::class)->execute('users', $user, $temporaryPassword, InvalidationReason::Security);
app(LockAccount::class)->execute('users', $user, 3600);
app(ResendInvitation::class)->execute('users', $invitation);   // another guard's invitation → InvitationNotFound

Facade method → action

• The facade, the manager and the package controllers resolve actions from the container, so all three run the same code.
• Actions tagged @internal are building blocks of these flows, not API: the login pipeline (CompleteFirstFactor, CompleteLogin, EnsureAccountCanLogin, ResolveRequiredSteps, StartLoginChallenge, AssessLoginRisk, DetectNewDevice, RecordLoginActivity), the challenge engine (AdvanceChallenge, FinalizeChallenge, FindActiveChallenge, InvalidateChallenge, RecordChallengeFailure), the four OneTimeTokens actions, VerifyPassword, CreateAccount (replace it through registration.creator), EnforceSessionLimit, BuildAccessTokenRequest and IssueTokenPair (issue through issueTokens(), which also fires TokensIssued).
• Actions take the same DTOs as the facade, from RoundlyConsulting\Auth\DataTransferObjects — PasswordCredentials, SessionContext, CurrentToken, RegistrationData, InvitationData, AcceptInvitationData, ChallengeFactorData, ReauthenticationData, ChangePasswordData, PasswordResetData, EmailChangeData and LocaleData.