Render typed managed auth errors

[masnwilliams]

summary

• render typed challenge outcomes with specific titles and context-neutral descriptions
• distinguish rejected authenticator codes from invalid usernames or passwords
• add a patch changeset and focused error-display tests

dependency

kernel/kernel#3666 is merged and deployed. The component remains backward-compatible because unknown and older codes retain their current fallback behavior.

validation

• bun test
• bun run typecheck
• bun run format:check
• bun run build

---

Note

Low Risk
UI-only error copy and a small exported helper; no auth or API behavior changes, with backward-compatible fallbacks for unknown codes.

Overview
StepError now maps new managed-auth errorCode values to dedicated titles and descriptions instead of falling back to generic error copy.

Adds display entries for challenge-style outcomes (totp_required, sms_code_required, email_code_required, account_choice_required, customer_input_required, external_action_required) with neutral wording that avoids “reauth” framing, plus totp_code_rejected with recovery guidance distinct from credentials_invalid.

Exports errorDisplayForCode for lookup and adds unit tests; unknown codes still use the existing localization fallback. Patch changeset for @onkernel/managed-auth-react.

^{Reviewed by Cursor Bugbot for commit 02be4ec. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
managed-auth-react-demo	Ready	Preview	Aug 31, 2026 1:34am

[akxue]

reviewed — looks good overall, one blocking copy change:

Blocking

• packages/managed-auth-react/src/components/StepError.tsx:44-48 — "Additional customer input is required" reads as internal jargon to the end user seeing this error screen. Suggest "Additional information is required before login can continue." to keep it clean.

Nits

• packages/managed-auth-react/src/components/StepError.test.tsx:27 — not.toEqual(errorDisplayForCode("credentials_invalid")) would also pass if credentials_invalid were missing from the map (both undefined); a truthiness assert on it would pin the distinction more tightly.