@spfn/auth 0.3.0-beta.2 → 0.3.0-beta.21

package/dist/errors.d.ts

@@ -1,4 +1,4 @@
-import { ConflictError, ForbiddenError, NotFoundError, UnauthorizedError, ValidationError, ErrorRegistry } from '@spfn/core/errors';
+import { ConflictError, ForbiddenError, NotFoundError, ValidationError, UnauthorizedError, HttpError, ErrorRegistry } from '@spfn/core/errors';
 
 /**
  * Authentication & Authorization Error Classes
@@ -199,6 +199,25 @@ declare class InvalidKeyFingerprintError extends ValidationError {
         details?: Record<string, any>;
     });
 }
+/**
+ * Key Algorithm Mismatch Error (400)
+ *
+ * Thrown when the submitted public key's SPKI type is not the one its declared
+ * algorithm needs — a P-256 EC key declared RS256, an RSA key declared ES256, a
+ * curve other than P-256 declared ES256, or bytes that are no SPKI key at all.
+ *
+ * The algorithm is stored beside the key and read back at proof verification;
+ * nothing re-derives it from the key material. So a mismatch accepted here
+ * surfaces only after the device believes it is enrolled, on every request it
+ * then makes. It is refused at registration instead, wherever key material is
+ * stored: register, login, rotate, invitation acceptance and device start.
+ */
+declare class KeyAlgorithmMismatchError extends ValidationError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
 /**
  * Key Not Found Error (404)
  *
@@ -212,6 +231,95 @@ declare class KeyNotFoundError extends NotFoundError {
         details?: Record<string, any>;
     });
 }
+/**
+ * Revoke-All Link Error (404)
+ *
+ * Thrown when a signed sign-out-everywhere link cannot be acted on: unknown,
+ * expired, already spent, superseded by a newer one, issued against a key
+ * generation that has since moved, or belonging to an account that is not
+ * active.
+ *
+ * One error for every one of those, and the same body for each. Telling an
+ * expired link from an unknown one would tell whoever is holding a random value
+ * that it named a real outstanding link, and the sibling link flows refuse the
+ * same way for the same reason. The specific cause is logged.
+ *
+ * 404 rather than the 401 the password-reset link answers with: there is no
+ * credential here to have been wrong. The address the mail went to is the proof,
+ * and what the caller presented either names an outstanding link or names
+ * nothing.
+ */
+declare class RevokeAllLinkError extends NotFoundError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * Device Auth Not Found Error (404)
+ *
+ * Thrown when a device-code operation names a code the server cannot act on: one
+ * that was never issued, and one whose record has already been consumed.
+ *
+ * Those two are answered identically on purpose. A consumed record is a login
+ * that finished, and saying so would tell whoever holds the code that it was
+ * real — which is the difference between guessing at random and knowing a guess
+ * landed. Every route that accepts a code is rate limited for the same reason.
+ */
+declare class DeviceAuthNotFoundError extends NotFoundError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * Device Auth Expired Error (400)
+ *
+ * Thrown when a device-code operation names a record whose TTL has run out,
+ * whatever state it is in. The waiting device starts again; the approver is told
+ * the code on the other screen is stale.
+ *
+ * 400 rather than 401: on the approve and deny routes the caller's own session is
+ * fine, and answering 401 would send a signed-in user to a login screen over a
+ * code that simply sat too long.
+ */
+declare class DeviceAuthExpiredError extends ValidationError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * Device Auth Already Handled Error (409)
+ *
+ * Thrown when an approve, deny or info call names a record that has already been
+ * approved or denied. A decision on a device is made once — a second approval
+ * would let one code be answered twice, and re-approving a record the owner
+ * denied would undo the refusal.
+ *
+ * This is also what the loser of two concurrent approvals sees, since the
+ * transition names the state it moves from and only one call can match it.
+ */
+declare class DeviceAuthAlreadyHandledError extends ConflictError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * Device Auth Denied Error (403)
+ *
+ * Thrown when the waiting device polls a record its owner refused. Distinct from
+ * a pending answer, and distinct from a code that does not exist: the device
+ * asked a person and the person said no, so it should stop polling and say so
+ * rather than time out looking like a network fault.
+ */
+declare class DeviceAuthDeniedError extends ForbiddenError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
 /**
  * Nonce Key Binding Error (400)
  *
@@ -244,6 +352,73 @@ declare class NativeSignInUnsupportedError extends ValidationError {
         details?: Record<string, any>;
     });
 }
+/**
+ * Invalid Signup Link Error (400)
+ *
+ * Thrown when an emailed signup confirmation link is unknown, expired, already
+ * consumed, or superseded by a newer request for the same address.
+ *
+ * One error for all four states, on purpose. Distinguishing "expired" from
+ * "unknown" tells a caller holding a random token whether it named a real
+ * pending signup, which is exactly the enumeration the request step avoids. The
+ * specific reason is logged.
+ */
+declare class InvalidSignupLinkError extends ValidationError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * Invalid Signup Setup Session Error (401)
+ *
+ * Thrown when the password-setup session backing a verified-email signup is
+ * missing, unknown, expired, superseded or already used.
+ *
+ * One error for every one of those, on purpose: telling a caller which of them
+ * applies tells them whether an address is mid-signup, which is the same
+ * enumeration the request step is careful not to leak.
+ */
+declare class InvalidSignupSetupSessionError extends UnauthorizedError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * Password Reset Link Error (401)
+ *
+ * Thrown when an emailed password reset link is unknown, expired, already
+ * consumed, superseded by a newer request, or belongs to an account that is no
+ * longer active.
+ *
+ * One error for every one of those, on purpose. Distinguishing "expired" from
+ * "unknown" tells a caller holding a random token whether it named a real
+ * pending reset, which is exactly the enumeration the request step avoids. The
+ * specific reason is logged.
+ */
+declare class PasswordResetLinkError extends UnauthorizedError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * Password Reset Session Error (401)
+ *
+ * Thrown when the password-setup session backing a reset is missing, unknown,
+ * expired, superseded or already used.
+ *
+ * One error for every one of those, for the same reason the link error is one
+ * error: which of them applies tells a caller whether an account is mid-reset,
+ * and that is the enumeration the request step is careful not to leak.
+ */
+declare class PasswordResetSessionError extends UnauthorizedError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
 /**
  * Unverified Email Link Error (400)
  *
@@ -335,6 +510,182 @@ declare class InsufficientRoleError extends ForbiddenError {
         details?: Record<string, any>;
     });
 }
+/**
+ * Passkey Challenge Error (401)
+ *
+ * Thrown when the challenge a WebAuthn ceremony presents is unknown, expired,
+ * already spent, minted for the other ceremony, or minted for another account.
+ *
+ * One error for all five, on purpose. Telling a caller which applies tells them
+ * whether a challenge they did not mint exists and what it was for, and the
+ * remedy is the same in every case: start the ceremony again.
+ */
+declare class PasskeyChallengeError extends UnauthorizedError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * Passkey Verification Error (401)
+ *
+ * Thrown when an assertion or attestation does not verify: wrong origin, wrong
+ * rpId, a bad signature, a regressed signature counter — or, on login, a
+ * credential that is unknown or has been revoked.
+ *
+ * Those last two share this error with the cryptographic failures deliberately.
+ * A distinct "no such passkey" would answer, to anyone holding a credential id,
+ * whether it is enrolled here — and a revoked credential answering differently
+ * from an unknown one would say the account once had it.
+ */
+declare class PasskeyVerificationError extends UnauthorizedError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * Passkey Not Found Error (404)
+ *
+ * Thrown when a management operation names a passkey the caller does not own,
+ * or one already revoked. Every lookup is owner-scoped, so the answer is only
+ * ever "not yours" and says nothing about other accounts.
+ */
+declare class PasskeyNotFoundError extends NotFoundError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * Passkey Already Registered Error (409)
+ *
+ * Thrown when the credential presented for enrollment is already on file for
+ * some account — including one that revoked it. A credential id is reserved for
+ * good once used, so this is also the answer to re-enrolling one's own revoked
+ * passkey.
+ */
+declare class PasskeyAlreadyRegisteredError extends ConflictError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * Recent Authentication Required Error (403)
+ *
+ * Thrown when enrolling or revoking a passkey from a session that proved itself
+ * too long ago and carried no password. Clients branch on `code` to know to
+ * prompt for the password rather than to show a generic refusal, so the code is
+ * a stable field rather than a message they would have to match on.
+ */
+declare class RecentAuthenticationRequiredError extends ForbiddenError {
+    readonly code = "RECENT_AUTH_REQUIRED";
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * Last Recovery Credential Error (409)
+ *
+ * Thrown when revoking a passkey would leave the account with no way back in:
+ * no other live passkey, no password, and no linked social account. There is no
+ * password reset in this package, so that state is not recoverable by support
+ * either — the refusal is the only thing standing between the owner and a
+ * locked account.
+ *
+ * Clients branch on `code` to offer "set a password first" instead of a generic
+ * refusal.
+ */
+declare class LastRecoveryCredentialError extends ConflictError {
+    readonly code = "LAST_RECOVERY_CREDENTIAL";
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * Passkey Config Error (500)
+ *
+ * Thrown at boot when the passkey relying-party configuration cannot be honoured
+ * — an origin that is not https outside localhost, an origin off the rpId, an
+ * unsupported user-verification value.
+ *
+ * A refusal at boot rather than at the first ceremony: every one of these makes
+ * every passkey operation fail, and the drift is between environments, so the
+ * deploy that introduces it is where it has to surface.
+ */
+declare class PasskeyConfigError extends HttpError {
+    constructor(data: {
+        message: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * OAuth2 Unknown Client Error (400)
+ *
+ * Thrown by the API authorize endpoints when `client_id` names no registered
+ * client. One of the two refusals that must NOT be turned into a redirect: with
+ * no client there is no registered redirect URI, so the only place left to send
+ * the error is the one the request supplied — which is exactly the open redirect
+ * this rule exists to close. The consent screen shows it instead.
+ */
+declare class OAuth2UnknownClientError extends ValidationError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * OAuth2 Redirect URI Mismatch Error (400)
+ *
+ * Thrown when `redirect_uri` is not one the client registered. The second
+ * non-redirectable refusal, for the same reason as the first: redirecting the
+ * error to an unregistered URI is the attack.
+ */
+declare class OAuth2RedirectUriMismatchError extends ValidationError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * OAuth2 Authorize Redirect Error (400)
+ *
+ * Every other authorize-time refusal — `invalid_request`, `invalid_scope`,
+ * `invalid_target`, `access_denied`. The client and its redirect URI are both
+ * known by the time these are decided, so RFC 6749 §4.1.2.1 says the error goes
+ * back to the client as query parameters on that URI rather than to the person.
+ *
+ * The API cannot perform that redirect — it is answering the web app's consent
+ * handler, not the browser — so it carries the pieces in `details` and the
+ * handler builds the 302. `redirectUri` is the registered-and-matched value, not
+ * the raw parameter, which is what makes it safe to send somebody to.
+ */
+declare class OAuth2AuthorizeRedirectError extends ValidationError {
+    constructor(data: {
+        error: string;
+        redirectUri: string;
+        state?: string;
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * OAuth2 Grant Not Found Error (404)
+ *
+ * Thrown by `DELETE /_auth/oauth2/grants/:id` when the caller owns no live grant
+ * of that id. A grant belonging to somebody else answers the same way as one
+ * that never existed — the id is a number in a URL, and telling the two apart
+ * would let anyone count other people's connected clients.
+ */
+declare class OAuth2GrantNotFoundError extends NotFoundError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
 
 type authErrors_AccountAlreadyExistsError = AccountAlreadyExistsError;
 declare const authErrors_AccountAlreadyExistsError: typeof AccountAlreadyExistsError;
@@ -346,6 +697,14 @@ type authErrors_DeletionAlreadyRequestedError = DeletionAlreadyRequestedError;
 declare const authErrors_DeletionAlreadyRequestedError: typeof DeletionAlreadyRequestedError;
 type authErrors_DeletionNotRequestedError = DeletionNotRequestedError;
 declare const authErrors_DeletionNotRequestedError: typeof DeletionNotRequestedError;
+type authErrors_DeviceAuthAlreadyHandledError = DeviceAuthAlreadyHandledError;
+declare const authErrors_DeviceAuthAlreadyHandledError: typeof DeviceAuthAlreadyHandledError;
+type authErrors_DeviceAuthDeniedError = DeviceAuthDeniedError;
+declare const authErrors_DeviceAuthDeniedError: typeof DeviceAuthDeniedError;
+type authErrors_DeviceAuthExpiredError = DeviceAuthExpiredError;
+declare const authErrors_DeviceAuthExpiredError: typeof DeviceAuthExpiredError;
+type authErrors_DeviceAuthNotFoundError = DeviceAuthNotFoundError;
+declare const authErrors_DeviceAuthNotFoundError: typeof DeviceAuthNotFoundError;
 type authErrors_ImmediateDeletionNotAllowedError = ImmediateDeletionNotAllowedError;
 declare const authErrors_ImmediateDeletionNotAllowedError: typeof ImmediateDeletionNotAllowedError;
 type authErrors_InsufficientPermissionsError = InsufficientPermissionsError;
@@ -356,6 +715,10 @@ type authErrors_InvalidCredentialsError = InvalidCredentialsError;
 declare const authErrors_InvalidCredentialsError: typeof InvalidCredentialsError;
 type authErrors_InvalidKeyFingerprintError = InvalidKeyFingerprintError;
 declare const authErrors_InvalidKeyFingerprintError: typeof InvalidKeyFingerprintError;
+type authErrors_InvalidSignupLinkError = InvalidSignupLinkError;
+declare const authErrors_InvalidSignupLinkError: typeof InvalidSignupLinkError;
+type authErrors_InvalidSignupSetupSessionError = InvalidSignupSetupSessionError;
+declare const authErrors_InvalidSignupSetupSessionError: typeof InvalidSignupSetupSessionError;
 type authErrors_InvalidSocialTokenError = InvalidSocialTokenError;
 declare const authErrors_InvalidSocialTokenError: typeof InvalidSocialTokenError;
 type authErrors_InvalidTokenError = InvalidTokenError;
@@ -364,20 +727,50 @@ type authErrors_InvalidVerificationCodeError = InvalidVerificationCodeError;
 declare const authErrors_InvalidVerificationCodeError: typeof InvalidVerificationCodeError;
 type authErrors_InvalidVerificationTokenError = InvalidVerificationTokenError;
 declare const authErrors_InvalidVerificationTokenError: typeof InvalidVerificationTokenError;
+type authErrors_KeyAlgorithmMismatchError = KeyAlgorithmMismatchError;
+declare const authErrors_KeyAlgorithmMismatchError: typeof KeyAlgorithmMismatchError;
 type authErrors_KeyExpiredError = KeyExpiredError;
 declare const authErrors_KeyExpiredError: typeof KeyExpiredError;
 type authErrors_KeyIdAlreadyRegisteredError = KeyIdAlreadyRegisteredError;
 declare const authErrors_KeyIdAlreadyRegisteredError: typeof KeyIdAlreadyRegisteredError;
 type authErrors_KeyNotFoundError = KeyNotFoundError;
 declare const authErrors_KeyNotFoundError: typeof KeyNotFoundError;
+type authErrors_LastRecoveryCredentialError = LastRecoveryCredentialError;
+declare const authErrors_LastRecoveryCredentialError: typeof LastRecoveryCredentialError;
 type authErrors_NativeSignInUnsupportedError = NativeSignInUnsupportedError;
 declare const authErrors_NativeSignInUnsupportedError: typeof NativeSignInUnsupportedError;
 type authErrors_NonceKeyBindingError = NonceKeyBindingError;
 declare const authErrors_NonceKeyBindingError: typeof NonceKeyBindingError;
+type authErrors_OAuth2AuthorizeRedirectError = OAuth2AuthorizeRedirectError;
+declare const authErrors_OAuth2AuthorizeRedirectError: typeof OAuth2AuthorizeRedirectError;
+type authErrors_OAuth2GrantNotFoundError = OAuth2GrantNotFoundError;
+declare const authErrors_OAuth2GrantNotFoundError: typeof OAuth2GrantNotFoundError;
+type authErrors_OAuth2RedirectUriMismatchError = OAuth2RedirectUriMismatchError;
+declare const authErrors_OAuth2RedirectUriMismatchError: typeof OAuth2RedirectUriMismatchError;
+type authErrors_OAuth2UnknownClientError = OAuth2UnknownClientError;
+declare const authErrors_OAuth2UnknownClientError: typeof OAuth2UnknownClientError;
+type authErrors_PasskeyAlreadyRegisteredError = PasskeyAlreadyRegisteredError;
+declare const authErrors_PasskeyAlreadyRegisteredError: typeof PasskeyAlreadyRegisteredError;
+type authErrors_PasskeyChallengeError = PasskeyChallengeError;
+declare const authErrors_PasskeyChallengeError: typeof PasskeyChallengeError;
+type authErrors_PasskeyConfigError = PasskeyConfigError;
+declare const authErrors_PasskeyConfigError: typeof PasskeyConfigError;
+type authErrors_PasskeyNotFoundError = PasskeyNotFoundError;
+declare const authErrors_PasskeyNotFoundError: typeof PasskeyNotFoundError;
+type authErrors_PasskeyVerificationError = PasskeyVerificationError;
+declare const authErrors_PasskeyVerificationError: typeof PasskeyVerificationError;
+type authErrors_PasswordResetLinkError = PasswordResetLinkError;
+declare const authErrors_PasswordResetLinkError: typeof PasswordResetLinkError;
+type authErrors_PasswordResetSessionError = PasswordResetSessionError;
+declare const authErrors_PasswordResetSessionError: typeof PasswordResetSessionError;
+type authErrors_RecentAuthenticationRequiredError = RecentAuthenticationRequiredError;
+declare const authErrors_RecentAuthenticationRequiredError: typeof RecentAuthenticationRequiredError;
 type authErrors_RegistrationRejectedError = RegistrationRejectedError;
 declare const authErrors_RegistrationRejectedError: typeof RegistrationRejectedError;
 type authErrors_ReservedUsernameError = ReservedUsernameError;
 declare const authErrors_ReservedUsernameError: typeof ReservedUsernameError;
+type authErrors_RevokeAllLinkError = RevokeAllLinkError;
+declare const authErrors_RevokeAllLinkError: typeof RevokeAllLinkError;
 type authErrors_TokenExpiredError = TokenExpiredError;
 declare const authErrors_TokenExpiredError: typeof TokenExpiredError;
 type authErrors_UnverifiedEmailLinkError = UnverifiedEmailLinkError;
@@ -389,7 +782,7 @@ declare const authErrors_VerificationTokenPurposeMismatchError: typeof Verificat
 type authErrors_VerificationTokenTargetMismatchError = VerificationTokenTargetMismatchError;
 declare const authErrors_VerificationTokenTargetMismatchError: typeof VerificationTokenTargetMismatchError;
 declare namespace authErrors {
-  export { authErrors_AccountAlreadyExistsError as AccountAlreadyExistsError, authErrors_AccountDisabledError as AccountDisabledError, authErrors_AccountPendingDeletionError as AccountPendingDeletionError, authErrors_DeletionAlreadyRequestedError as DeletionAlreadyRequestedError, authErrors_DeletionNotRequestedError as DeletionNotRequestedError, authErrors_ImmediateDeletionNotAllowedError as ImmediateDeletionNotAllowedError, authErrors_InsufficientPermissionsError as InsufficientPermissionsError, authErrors_InsufficientRoleError as InsufficientRoleError, authErrors_InvalidCredentialsError as InvalidCredentialsError, authErrors_InvalidKeyFingerprintError as InvalidKeyFingerprintError, authErrors_InvalidSocialTokenError as InvalidSocialTokenError, authErrors_InvalidTokenError as InvalidTokenError, authErrors_InvalidVerificationCodeError as InvalidVerificationCodeError, authErrors_InvalidVerificationTokenError as InvalidVerificationTokenError, authErrors_KeyExpiredError as KeyExpiredError, authErrors_KeyIdAlreadyRegisteredError as KeyIdAlreadyRegisteredError, authErrors_KeyNotFoundError as KeyNotFoundError, authErrors_NativeSignInUnsupportedError as NativeSignInUnsupportedError, authErrors_NonceKeyBindingError as NonceKeyBindingError, authErrors_RegistrationRejectedError as RegistrationRejectedError, authErrors_ReservedUsernameError as ReservedUsernameError, authErrors_TokenExpiredError as TokenExpiredError, authErrors_UnverifiedEmailLinkError as UnverifiedEmailLinkError, authErrors_UsernameAlreadyTakenError as UsernameAlreadyTakenError, authErrors_VerificationTokenPurposeMismatchError as VerificationTokenPurposeMismatchError, authErrors_VerificationTokenTargetMismatchError as VerificationTokenTargetMismatchError };
+  export { authErrors_AccountAlreadyExistsError as AccountAlreadyExistsError, authErrors_AccountDisabledError as AccountDisabledError, authErrors_AccountPendingDeletionError as AccountPendingDeletionError, authErrors_DeletionAlreadyRequestedError as DeletionAlreadyRequestedError, authErrors_DeletionNotRequestedError as DeletionNotRequestedError, authErrors_DeviceAuthAlreadyHandledError as DeviceAuthAlreadyHandledError, authErrors_DeviceAuthDeniedError as DeviceAuthDeniedError, authErrors_DeviceAuthExpiredError as DeviceAuthExpiredError, authErrors_DeviceAuthNotFoundError as DeviceAuthNotFoundError, authErrors_ImmediateDeletionNotAllowedError as ImmediateDeletionNotAllowedError, authErrors_InsufficientPermissionsError as InsufficientPermissionsError, authErrors_InsufficientRoleError as InsufficientRoleError, authErrors_InvalidCredentialsError as InvalidCredentialsError, authErrors_InvalidKeyFingerprintError as InvalidKeyFingerprintError, authErrors_InvalidSignupLinkError as InvalidSignupLinkError, authErrors_InvalidSignupSetupSessionError as InvalidSignupSetupSessionError, authErrors_InvalidSocialTokenError as InvalidSocialTokenError, authErrors_InvalidTokenError as InvalidTokenError, authErrors_InvalidVerificationCodeError as InvalidVerificationCodeError, authErrors_InvalidVerificationTokenError as InvalidVerificationTokenError, authErrors_KeyAlgorithmMismatchError as KeyAlgorithmMismatchError, authErrors_KeyExpiredError as KeyExpiredError, authErrors_KeyIdAlreadyRegisteredError as KeyIdAlreadyRegisteredError, authErrors_KeyNotFoundError as KeyNotFoundError, authErrors_LastRecoveryCredentialError as LastRecoveryCredentialError, authErrors_NativeSignInUnsupportedError as NativeSignInUnsupportedError, authErrors_NonceKeyBindingError as NonceKeyBindingError, authErrors_OAuth2AuthorizeRedirectError as OAuth2AuthorizeRedirectError, authErrors_OAuth2GrantNotFoundError as OAuth2GrantNotFoundError, authErrors_OAuth2RedirectUriMismatchError as OAuth2RedirectUriMismatchError, authErrors_OAuth2UnknownClientError as OAuth2UnknownClientError, authErrors_PasskeyAlreadyRegisteredError as PasskeyAlreadyRegisteredError, authErrors_PasskeyChallengeError as PasskeyChallengeError, authErrors_PasskeyConfigError as PasskeyConfigError, authErrors_PasskeyNotFoundError as PasskeyNotFoundError, authErrors_PasskeyVerificationError as PasskeyVerificationError, authErrors_PasswordResetLinkError as PasswordResetLinkError, authErrors_PasswordResetSessionError as PasswordResetSessionError, authErrors_RecentAuthenticationRequiredError as RecentAuthenticationRequiredError, authErrors_RegistrationRejectedError as RegistrationRejectedError, authErrors_ReservedUsernameError as ReservedUsernameError, authErrors_RevokeAllLinkError as RevokeAllLinkError, authErrors_TokenExpiredError as TokenExpiredError, authErrors_UnverifiedEmailLinkError as UnverifiedEmailLinkError, authErrors_UsernameAlreadyTakenError as UsernameAlreadyTakenError, authErrors_VerificationTokenPurposeMismatchError as VerificationTokenPurposeMismatchError, authErrors_VerificationTokenTargetMismatchError as VerificationTokenTargetMismatchError };
 }
 
 /**
@@ -398,4 +791,4 @@ declare namespace authErrors {
 
 declare const authErrorRegistry: ErrorRegistry;
 
-export { AccountAlreadyExistsError, AccountDisabledError, AccountPendingDeletionError, authErrors as AuthError, DeletionAlreadyRequestedError, DeletionNotRequestedError, ImmediateDeletionNotAllowedError, InsufficientPermissionsError, InsufficientRoleError, InvalidCredentialsError, InvalidKeyFingerprintError, InvalidSocialTokenError, InvalidTokenError, InvalidVerificationCodeError, InvalidVerificationTokenError, KeyExpiredError, KeyIdAlreadyRegisteredError, KeyNotFoundError, NativeSignInUnsupportedError, NonceKeyBindingError, RegistrationRejectedError, ReservedUsernameError, TokenExpiredError, UnverifiedEmailLinkError, UsernameAlreadyTakenError, VerificationTokenPurposeMismatchError, VerificationTokenTargetMismatchError, authErrorRegistry };
+export { AccountAlreadyExistsError, AccountDisabledError, AccountPendingDeletionError, authErrors as AuthError, DeletionAlreadyRequestedError, DeletionNotRequestedError, DeviceAuthAlreadyHandledError, DeviceAuthDeniedError, DeviceAuthExpiredError, DeviceAuthNotFoundError, ImmediateDeletionNotAllowedError, InsufficientPermissionsError, InsufficientRoleError, InvalidCredentialsError, InvalidKeyFingerprintError, InvalidSignupLinkError, InvalidSignupSetupSessionError, InvalidSocialTokenError, InvalidTokenError, InvalidVerificationCodeError, InvalidVerificationTokenError, KeyAlgorithmMismatchError, KeyExpiredError, KeyIdAlreadyRegisteredError, KeyNotFoundError, LastRecoveryCredentialError, NativeSignInUnsupportedError, NonceKeyBindingError, OAuth2AuthorizeRedirectError, OAuth2GrantNotFoundError, OAuth2RedirectUriMismatchError, OAuth2UnknownClientError, PasskeyAlreadyRegisteredError, PasskeyChallengeError, PasskeyConfigError, PasskeyNotFoundError, PasskeyVerificationError, PasswordResetLinkError, PasswordResetSessionError, RecentAuthenticationRequiredError, RegistrationRejectedError, ReservedUsernameError, RevokeAllLinkError, TokenExpiredError, UnverifiedEmailLinkError, UsernameAlreadyTakenError, VerificationTokenPurposeMismatchError, VerificationTokenTargetMismatchError, authErrorRegistry };