@spfn/auth 0.3.0-beta.22 → 0.3.0-beta.24

package/dist/errors.d.ts

@@ -1,4 +1,4 @@
-import { ConflictError, ForbiddenError, NotFoundError, ValidationError, UnauthorizedError, HttpError, ErrorRegistry } from '@spfn/core/errors';
+import { ConflictError, ForbiddenError, NotFoundError, ValidationError, UnauthorizedError, HttpError, BadRequestError, InternalServerError, ErrorRegistry } from '@spfn/core/errors';
 
 /**
  * Authentication & Authorization Error Classes
@@ -605,6 +605,106 @@ declare class LastRecoveryCredentialError extends ConflictError {
         details?: Record<string, any>;
     });
 }
+/**
+ * Session Renewal Required Error (401)
+ *
+ * Minted by the Next.js proxy, not by the backend: a bound session whose key has
+ * run out, on a request the proxy therefore does not forward. The browser's
+ * answer is to run the passkey ceremony `renewSession()` wraps and retry, which
+ * is the one thing a copied cookie cannot do.
+ *
+ * Registered here so the proxy's 401 arrives as this class rather than as a bare
+ * `ApiError` — the refusal is one an app branches on, and `err instanceof` is
+ * how every other branch in this package is written.
+ */
+declare class SessionRenewalRequiredError extends UnauthorizedError {
+    readonly code = "SESSION_RENEWAL_REQUIRED";
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * Session Renewal Refused Error (401)
+ *
+ * The one answer `session/renew/options` and `session/renew/verify` give to every
+ * refusal: a key id that names nothing, someone else's key, an unbound key, a
+ * revoked key, a key past its renewal grace, an inactive account, a spent
+ * challenge, an assertion that did not verify, a passkey belonging to another
+ * account.
+ *
+ * One answer on purpose. The routes are public — they have to be, since the
+ * session they repair is the one that stopped working — and a refusal that
+ * varied would tell an unauthenticated caller whether a key id is live, which is
+ * exactly what the cookie-copying adversary holds and would want confirmed.
+ */
+declare class SessionRenewalRefusedError extends UnauthorizedError {
+    readonly code = "SESSION_RENEWAL_REFUSED";
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * Session Context Changed Error (401)
+ *
+ * Minted by the Next.js proxy: a bound session presented from a different
+ * browser family than the one it was sealed from. Browsers do not share cookie
+ * jars, so a session that moves between two of them moved because somebody
+ * copied it — this is the only defence that acts before the bound key runs out,
+ * and it is the reason the three session cookies are cleared with the refusal.
+ *
+ * Only for bound sessions, and only when the request carried a `user-agent` at
+ * all. An absent one is no signal rather than a different family: a server
+ * component calling the RPC proxy sends none.
+ */
+declare class SessionContextChangedError extends UnauthorizedError {
+    readonly code = "SESSION_CONTEXT_CHANGED";
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * Session Binding Unavailable Error (400)
+ *
+ * Thrown when an account asks to bind its session on a deployment where the
+ * backend cannot tell a request through the trusted Next.js proxy from a direct
+ * one — `proxy-guard` unconfigured, so `clientType` is never `'web'`.
+ *
+ * A configuration refusal rather than a security one, which is why it is a 400
+ * and why the message names what to set: with nothing to distinguish the proxy,
+ * every key would be registered unbound and the setting would be a switch that
+ * reports success and protects nothing.
+ */
+declare class SessionBindingUnavailableError extends BadRequestError {
+    readonly code = "SESSION_BINDING_UNAVAILABLE";
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * Session Reseal Failed Error (500)
+ *
+ * Minted by the Next.js proxy when a binding change committed on the backend but
+ * the session cookie could not be re-sealed to match it.
+ *
+ * Answered instead of the route's 200, which is the point: the setting has moved
+ * and the cookie has not, and the two disagreeing is the state the whole feature
+ * is built to avoid — a bound key with a cookie that says unbound is cleared as
+ * an ordinary expired session a day later, and an unbound key with a cookie that
+ * says bound asks for a renewal the backend will refuse. The three session
+ * cookies go with this refusal, so the repair is a sign-in, which mints a cookie
+ * that agrees with the row.
+ */
+declare class SessionResealFailedError extends InternalServerError {
+    readonly code = "SESSION_RESEAL_FAILED";
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
 /**
  * Passkey Config Error (500)
  *
@@ -686,6 +786,91 @@ declare class OAuth2GrantNotFoundError extends NotFoundError {
         details?: Record<string, any>;
     });
 }
+/**
+ * MFA Already Enrolled Error (409)
+ *
+ * Thrown when `totp/enroll` is called on an account whose TOTP is already
+ * confirmed. Replacing a working second factor is `disable` followed by a fresh
+ * enrolment, both step-up gated — an enrol that quietly overwrote a confirmed
+ * secret would be a way to swap someone's authenticator for your own.
+ */
+declare class MfaAlreadyEnrolledError extends ConflictError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * MFA Not Enrolled Error (400)
+ *
+ * Thrown when a call needs an enrolment that is not there: `totp/confirm` with
+ * no pending secret — including the row its own five failed attempts deleted —
+ * or `recovery/regenerate` on an account with no second factor. `disable` is
+ * deliberately not one of them; it answers 204 either way, because "make sure
+ * MFA is off" has already succeeded.
+ */
+declare class MfaNotEnrolledError extends ValidationError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * MFA Verification Failed Error (401)
+ *
+ * Thrown when a submitted code does not verify: a wrong or stale TOTP, a code
+ * from a step already spent, a recovery code that is used, from an older
+ * generation or another account's, or an assertion from a passkey the owner
+ * never marked as a second factor.
+ *
+ * One body for all of them. Which one applies describes state the caller is
+ * guessing at, and the remedy — look at the authenticator again — is the same.
+ */
+declare class MfaVerificationFailedError extends UnauthorizedError {
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * Step Up Required Error (403)
+ *
+ * Thrown when an enrolled account asks for a sensitive change from a device
+ * whose second factor was last verified longer ago than the step-up window. A
+ * stolen session alone therefore cannot change a password, sign every device
+ * out, or take the second factor off.
+ *
+ * 403 and not 401, on the same reasoning as `RecentAuthenticationRequiredError`,
+ * which it sits beside: a 401 on an authenticated route is what a web client
+ * reads as "the session is gone", so it would sign the user out instead of
+ * asking for a code. Clients branch on `code` to send the user to
+ * `POST /_auth/mfa/step-up` and retry.
+ */
+declare class StepUpRequiredError extends ForbiddenError {
+    readonly code = "STEP_UP_REQUIRED";
+    constructor(data?: {
+        message?: string;
+        details?: Record<string, any>;
+    });
+}
+/**
+ * MFA Config Error (500)
+ *
+ * Thrown when the at-rest keyring cannot serve a second factor:
+ * `SPFN_AUTH_TOKEN_ENCRYPTION_KEYS` is unset, or a stored secret names a key id
+ * that has been dropped from it.
+ *
+ * Deliberately not the 401 a wrong code gets. The two have nothing in common: a
+ * wrong code is one person looking at the wrong line of their authenticator,
+ * and a broken keyring is every enrolled user locked out at once by a deploy.
+ * An operator has to be able to tell them apart from the response alone.
+ */
+declare class MfaConfigError extends HttpError {
+    constructor(data: {
+        message: string;
+        details?: Record<string, any>;
+    });
+}
 
 type authErrors_AccountAlreadyExistsError = AccountAlreadyExistsError;
 declare const authErrors_AccountAlreadyExistsError: typeof AccountAlreadyExistsError;
@@ -737,6 +922,14 @@ type authErrors_KeyNotFoundError = KeyNotFoundError;
 declare const authErrors_KeyNotFoundError: typeof KeyNotFoundError;
 type authErrors_LastRecoveryCredentialError = LastRecoveryCredentialError;
 declare const authErrors_LastRecoveryCredentialError: typeof LastRecoveryCredentialError;
+type authErrors_MfaAlreadyEnrolledError = MfaAlreadyEnrolledError;
+declare const authErrors_MfaAlreadyEnrolledError: typeof MfaAlreadyEnrolledError;
+type authErrors_MfaConfigError = MfaConfigError;
+declare const authErrors_MfaConfigError: typeof MfaConfigError;
+type authErrors_MfaNotEnrolledError = MfaNotEnrolledError;
+declare const authErrors_MfaNotEnrolledError: typeof MfaNotEnrolledError;
+type authErrors_MfaVerificationFailedError = MfaVerificationFailedError;
+declare const authErrors_MfaVerificationFailedError: typeof MfaVerificationFailedError;
 type authErrors_NativeSignInUnsupportedError = NativeSignInUnsupportedError;
 declare const authErrors_NativeSignInUnsupportedError: typeof NativeSignInUnsupportedError;
 type authErrors_NonceKeyBindingError = NonceKeyBindingError;
@@ -771,6 +964,18 @@ type authErrors_ReservedUsernameError = ReservedUsernameError;
 declare const authErrors_ReservedUsernameError: typeof ReservedUsernameError;
 type authErrors_RevokeAllLinkError = RevokeAllLinkError;
 declare const authErrors_RevokeAllLinkError: typeof RevokeAllLinkError;
+type authErrors_SessionBindingUnavailableError = SessionBindingUnavailableError;
+declare const authErrors_SessionBindingUnavailableError: typeof SessionBindingUnavailableError;
+type authErrors_SessionContextChangedError = SessionContextChangedError;
+declare const authErrors_SessionContextChangedError: typeof SessionContextChangedError;
+type authErrors_SessionRenewalRefusedError = SessionRenewalRefusedError;
+declare const authErrors_SessionRenewalRefusedError: typeof SessionRenewalRefusedError;
+type authErrors_SessionRenewalRequiredError = SessionRenewalRequiredError;
+declare const authErrors_SessionRenewalRequiredError: typeof SessionRenewalRequiredError;
+type authErrors_SessionResealFailedError = SessionResealFailedError;
+declare const authErrors_SessionResealFailedError: typeof SessionResealFailedError;
+type authErrors_StepUpRequiredError = StepUpRequiredError;
+declare const authErrors_StepUpRequiredError: typeof StepUpRequiredError;
 type authErrors_TokenExpiredError = TokenExpiredError;
 declare const authErrors_TokenExpiredError: typeof TokenExpiredError;
 type authErrors_UnverifiedEmailLinkError = UnverifiedEmailLinkError;
@@ -782,7 +987,7 @@ declare const authErrors_VerificationTokenPurposeMismatchError: typeof Verificat
 type authErrors_VerificationTokenTargetMismatchError = VerificationTokenTargetMismatchError;
 declare const authErrors_VerificationTokenTargetMismatchError: typeof VerificationTokenTargetMismatchError;
 declare namespace authErrors {
-  export { authErrors_AccountAlreadyExistsError as AccountAlreadyExistsError, authErrors_AccountDisabledError as AccountDisabledError, authErrors_AccountPendingDeletionError as AccountPendingDeletionError, authErrors_DeletionAlreadyRequestedError as DeletionAlreadyRequestedError, authErrors_DeletionNotRequestedError as DeletionNotRequestedError, authErrors_DeviceAuthAlreadyHandledError as DeviceAuthAlreadyHandledError, authErrors_DeviceAuthDeniedError as DeviceAuthDeniedError, authErrors_DeviceAuthExpiredError as DeviceAuthExpiredError, authErrors_DeviceAuthNotFoundError as DeviceAuthNotFoundError, authErrors_ImmediateDeletionNotAllowedError as ImmediateDeletionNotAllowedError, authErrors_InsufficientPermissionsError as InsufficientPermissionsError, authErrors_InsufficientRoleError as InsufficientRoleError, authErrors_InvalidCredentialsError as InvalidCredentialsError, authErrors_InvalidKeyFingerprintError as InvalidKeyFingerprintError, authErrors_InvalidSignupLinkError as InvalidSignupLinkError, authErrors_InvalidSignupSetupSessionError as InvalidSignupSetupSessionError, authErrors_InvalidSocialTokenError as InvalidSocialTokenError, authErrors_InvalidTokenError as InvalidTokenError, authErrors_InvalidVerificationCodeError as InvalidVerificationCodeError, authErrors_InvalidVerificationTokenError as InvalidVerificationTokenError, authErrors_KeyAlgorithmMismatchError as KeyAlgorithmMismatchError, authErrors_KeyExpiredError as KeyExpiredError, authErrors_KeyIdAlreadyRegisteredError as KeyIdAlreadyRegisteredError, authErrors_KeyNotFoundError as KeyNotFoundError, authErrors_LastRecoveryCredentialError as LastRecoveryCredentialError, authErrors_NativeSignInUnsupportedError as NativeSignInUnsupportedError, authErrors_NonceKeyBindingError as NonceKeyBindingError, authErrors_OAuth2AuthorizeRedirectError as OAuth2AuthorizeRedirectError, authErrors_OAuth2GrantNotFoundError as OAuth2GrantNotFoundError, authErrors_OAuth2RedirectUriMismatchError as OAuth2RedirectUriMismatchError, authErrors_OAuth2UnknownClientError as OAuth2UnknownClientError, authErrors_PasskeyAlreadyRegisteredError as PasskeyAlreadyRegisteredError, authErrors_PasskeyChallengeError as PasskeyChallengeError, authErrors_PasskeyConfigError as PasskeyConfigError, authErrors_PasskeyNotFoundError as PasskeyNotFoundError, authErrors_PasskeyVerificationError as PasskeyVerificationError, authErrors_PasswordResetLinkError as PasswordResetLinkError, authErrors_PasswordResetSessionError as PasswordResetSessionError, authErrors_RecentAuthenticationRequiredError as RecentAuthenticationRequiredError, authErrors_RegistrationRejectedError as RegistrationRejectedError, authErrors_ReservedUsernameError as ReservedUsernameError, authErrors_RevokeAllLinkError as RevokeAllLinkError, authErrors_TokenExpiredError as TokenExpiredError, authErrors_UnverifiedEmailLinkError as UnverifiedEmailLinkError, authErrors_UsernameAlreadyTakenError as UsernameAlreadyTakenError, authErrors_VerificationTokenPurposeMismatchError as VerificationTokenPurposeMismatchError, authErrors_VerificationTokenTargetMismatchError as VerificationTokenTargetMismatchError };
+  export { authErrors_AccountAlreadyExistsError as AccountAlreadyExistsError, authErrors_AccountDisabledError as AccountDisabledError, authErrors_AccountPendingDeletionError as AccountPendingDeletionError, authErrors_DeletionAlreadyRequestedError as DeletionAlreadyRequestedError, authErrors_DeletionNotRequestedError as DeletionNotRequestedError, authErrors_DeviceAuthAlreadyHandledError as DeviceAuthAlreadyHandledError, authErrors_DeviceAuthDeniedError as DeviceAuthDeniedError, authErrors_DeviceAuthExpiredError as DeviceAuthExpiredError, authErrors_DeviceAuthNotFoundError as DeviceAuthNotFoundError, authErrors_ImmediateDeletionNotAllowedError as ImmediateDeletionNotAllowedError, authErrors_InsufficientPermissionsError as InsufficientPermissionsError, authErrors_InsufficientRoleError as InsufficientRoleError, authErrors_InvalidCredentialsError as InvalidCredentialsError, authErrors_InvalidKeyFingerprintError as InvalidKeyFingerprintError, authErrors_InvalidSignupLinkError as InvalidSignupLinkError, authErrors_InvalidSignupSetupSessionError as InvalidSignupSetupSessionError, authErrors_InvalidSocialTokenError as InvalidSocialTokenError, authErrors_InvalidTokenError as InvalidTokenError, authErrors_InvalidVerificationCodeError as InvalidVerificationCodeError, authErrors_InvalidVerificationTokenError as InvalidVerificationTokenError, authErrors_KeyAlgorithmMismatchError as KeyAlgorithmMismatchError, authErrors_KeyExpiredError as KeyExpiredError, authErrors_KeyIdAlreadyRegisteredError as KeyIdAlreadyRegisteredError, authErrors_KeyNotFoundError as KeyNotFoundError, authErrors_LastRecoveryCredentialError as LastRecoveryCredentialError, authErrors_MfaAlreadyEnrolledError as MfaAlreadyEnrolledError, authErrors_MfaConfigError as MfaConfigError, authErrors_MfaNotEnrolledError as MfaNotEnrolledError, authErrors_MfaVerificationFailedError as MfaVerificationFailedError, authErrors_NativeSignInUnsupportedError as NativeSignInUnsupportedError, authErrors_NonceKeyBindingError as NonceKeyBindingError, authErrors_OAuth2AuthorizeRedirectError as OAuth2AuthorizeRedirectError, authErrors_OAuth2GrantNotFoundError as OAuth2GrantNotFoundError, authErrors_OAuth2RedirectUriMismatchError as OAuth2RedirectUriMismatchError, authErrors_OAuth2UnknownClientError as OAuth2UnknownClientError, authErrors_PasskeyAlreadyRegisteredError as PasskeyAlreadyRegisteredError, authErrors_PasskeyChallengeError as PasskeyChallengeError, authErrors_PasskeyConfigError as PasskeyConfigError, authErrors_PasskeyNotFoundError as PasskeyNotFoundError, authErrors_PasskeyVerificationError as PasskeyVerificationError, authErrors_PasswordResetLinkError as PasswordResetLinkError, authErrors_PasswordResetSessionError as PasswordResetSessionError, authErrors_RecentAuthenticationRequiredError as RecentAuthenticationRequiredError, authErrors_RegistrationRejectedError as RegistrationRejectedError, authErrors_ReservedUsernameError as ReservedUsernameError, authErrors_RevokeAllLinkError as RevokeAllLinkError, authErrors_SessionBindingUnavailableError as SessionBindingUnavailableError, authErrors_SessionContextChangedError as SessionContextChangedError, authErrors_SessionRenewalRefusedError as SessionRenewalRefusedError, authErrors_SessionRenewalRequiredError as SessionRenewalRequiredError, authErrors_SessionResealFailedError as SessionResealFailedError, authErrors_StepUpRequiredError as StepUpRequiredError, authErrors_TokenExpiredError as TokenExpiredError, authErrors_UnverifiedEmailLinkError as UnverifiedEmailLinkError, authErrors_UsernameAlreadyTakenError as UsernameAlreadyTakenError, authErrors_VerificationTokenPurposeMismatchError as VerificationTokenPurposeMismatchError, authErrors_VerificationTokenTargetMismatchError as VerificationTokenTargetMismatchError };
 }
 
 /**
@@ -791,4 +996,4 @@ declare namespace authErrors {
 
 declare const authErrorRegistry: ErrorRegistry;
 
-export { AccountAlreadyExistsError, AccountDisabledError, AccountPendingDeletionError, authErrors as AuthError, DeletionAlreadyRequestedError, DeletionNotRequestedError, DeviceAuthAlreadyHandledError, DeviceAuthDeniedError, DeviceAuthExpiredError, DeviceAuthNotFoundError, ImmediateDeletionNotAllowedError, InsufficientPermissionsError, InsufficientRoleError, InvalidCredentialsError, InvalidKeyFingerprintError, InvalidSignupLinkError, InvalidSignupSetupSessionError, InvalidSocialTokenError, InvalidTokenError, InvalidVerificationCodeError, InvalidVerificationTokenError, KeyAlgorithmMismatchError, KeyExpiredError, KeyIdAlreadyRegisteredError, KeyNotFoundError, LastRecoveryCredentialError, NativeSignInUnsupportedError, NonceKeyBindingError, OAuth2AuthorizeRedirectError, OAuth2GrantNotFoundError, OAuth2RedirectUriMismatchError, OAuth2UnknownClientError, PasskeyAlreadyRegisteredError, PasskeyChallengeError, PasskeyConfigError, PasskeyNotFoundError, PasskeyVerificationError, PasswordResetLinkError, PasswordResetSessionError, RecentAuthenticationRequiredError, RegistrationRejectedError, ReservedUsernameError, RevokeAllLinkError, TokenExpiredError, UnverifiedEmailLinkError, UsernameAlreadyTakenError, VerificationTokenPurposeMismatchError, VerificationTokenTargetMismatchError, authErrorRegistry };
+export { AccountAlreadyExistsError, AccountDisabledError, AccountPendingDeletionError, authErrors as AuthError, DeletionAlreadyRequestedError, DeletionNotRequestedError, DeviceAuthAlreadyHandledError, DeviceAuthDeniedError, DeviceAuthExpiredError, DeviceAuthNotFoundError, ImmediateDeletionNotAllowedError, InsufficientPermissionsError, InsufficientRoleError, InvalidCredentialsError, InvalidKeyFingerprintError, InvalidSignupLinkError, InvalidSignupSetupSessionError, InvalidSocialTokenError, InvalidTokenError, InvalidVerificationCodeError, InvalidVerificationTokenError, KeyAlgorithmMismatchError, KeyExpiredError, KeyIdAlreadyRegisteredError, KeyNotFoundError, LastRecoveryCredentialError, MfaAlreadyEnrolledError, MfaConfigError, MfaNotEnrolledError, MfaVerificationFailedError, NativeSignInUnsupportedError, NonceKeyBindingError, OAuth2AuthorizeRedirectError, OAuth2GrantNotFoundError, OAuth2RedirectUriMismatchError, OAuth2UnknownClientError, PasskeyAlreadyRegisteredError, PasskeyChallengeError, PasskeyConfigError, PasskeyNotFoundError, PasskeyVerificationError, PasswordResetLinkError, PasswordResetSessionError, RecentAuthenticationRequiredError, RegistrationRejectedError, ReservedUsernameError, RevokeAllLinkError, SessionBindingUnavailableError, SessionContextChangedError, SessionRenewalRefusedError, SessionRenewalRequiredError, SessionResealFailedError, StepUpRequiredError, TokenExpiredError, UnverifiedEmailLinkError, UsernameAlreadyTakenError, VerificationTokenPurposeMismatchError, VerificationTokenTargetMismatchError, authErrorRegistry };

package/dist/errors.js

@@ -35,6 +35,10 @@ __export(auth_errors_exports, {
   KeyIdAlreadyRegisteredError: () => KeyIdAlreadyRegisteredError,
   KeyNotFoundError: () => KeyNotFoundError,
   LastRecoveryCredentialError: () => LastRecoveryCredentialError,
+  MfaAlreadyEnrolledError: () => MfaAlreadyEnrolledError,
+  MfaConfigError: () => MfaConfigError,
+  MfaNotEnrolledError: () => MfaNotEnrolledError,
+  MfaVerificationFailedError: () => MfaVerificationFailedError,
   NativeSignInUnsupportedError: () => NativeSignInUnsupportedError,
   NonceKeyBindingError: () => NonceKeyBindingError,
   OAuth2AuthorizeRedirectError: () => OAuth2AuthorizeRedirectError,
@@ -52,6 +56,12 @@ __export(auth_errors_exports, {
   RegistrationRejectedError: () => RegistrationRejectedError,
   ReservedUsernameError: () => ReservedUsernameError,
   RevokeAllLinkError: () => RevokeAllLinkError,
+  SessionBindingUnavailableError: () => SessionBindingUnavailableError,
+  SessionContextChangedError: () => SessionContextChangedError,
+  SessionRenewalRefusedError: () => SessionRenewalRefusedError,
+  SessionRenewalRequiredError: () => SessionRenewalRequiredError,
+  SessionResealFailedError: () => SessionResealFailedError,
+  StepUpRequiredError: () => StepUpRequiredError,
   TokenExpiredError: () => TokenExpiredError,
   UnverifiedEmailLinkError: () => UnverifiedEmailLinkError,
   UsernameAlreadyTakenError: () => UsernameAlreadyTakenError,
@@ -59,12 +69,14 @@ __export(auth_errors_exports, {
   VerificationTokenTargetMismatchError: () => VerificationTokenTargetMismatchError
 });
 import {
+  BadRequestError,
   ValidationError,
   UnauthorizedError,
   ForbiddenError,
   ConflictError,
   NotFoundError,
-  HttpError
+  HttpError,
+  InternalServerError
 } from "@spfn/core/errors";
 var InvalidCredentialsError = class extends UnauthorizedError {
   constructor(data = {}) {
@@ -413,6 +425,56 @@ var LastRecoveryCredentialError = class extends ConflictError {
     this.name = "LastRecoveryCredentialError";
   }
 };
+var SessionRenewalRequiredError = class extends UnauthorizedError {
+  code = "SESSION_RENEWAL_REQUIRED";
+  constructor(data = {}) {
+    super({
+      message: data.message || "This session needs renewing. Confirm with your passkey to continue.",
+      details: data.details
+    });
+    this.name = "SessionRenewalRequiredError";
+  }
+};
+var SessionRenewalRefusedError = class extends UnauthorizedError {
+  code = "SESSION_RENEWAL_REFUSED";
+  constructor(data = {}) {
+    super({
+      message: data.message || "This session cannot be renewed. Sign in again.",
+      details: data.details
+    });
+    this.name = "SessionRenewalRefusedError";
+  }
+};
+var SessionContextChangedError = class extends UnauthorizedError {
+  code = "SESSION_CONTEXT_CHANGED";
+  constructor(data = {}) {
+    super({
+      message: data.message || "This session was started in a different browser. Sign in again.",
+      details: data.details
+    });
+    this.name = "SessionContextChangedError";
+  }
+};
+var SessionBindingUnavailableError = class extends BadRequestError {
+  code = "SESSION_BINDING_UNAVAILABLE";
+  constructor(data = {}) {
+    super({
+      message: data.message || "Session binding needs a deployment where the backend can recognise the Next.js proxy. Configure proxy-guard (SPFN_PROXY_SIGNATURE_KEYS) and try again.",
+      details: data.details
+    });
+    this.name = "SessionBindingUnavailableError";
+  }
+};
+var SessionResealFailedError = class extends InternalServerError {
+  code = "SESSION_RESEAL_FAILED";
+  constructor(data = {}) {
+    super({
+      message: data.message || "The setting was changed but this session could not be updated. Sign in again.",
+      details: data.details
+    });
+    this.name = "SessionResealFailedError";
+  }
+};
 var PasskeyConfigError = class extends HttpError {
   constructor(data) {
     super({
@@ -461,6 +523,53 @@ var OAuth2GrantNotFoundError = class extends NotFoundError {
     this.name = "OAuth2GrantNotFoundError";
   }
 };
+var MfaAlreadyEnrolledError = class extends ConflictError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "A second factor is already enrolled on this account",
+      details: data.details
+    });
+    this.name = "MfaAlreadyEnrolledError";
+  }
+};
+var MfaNotEnrolledError = class extends ValidationError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "No second-factor enrolment is in progress on this account",
+      details: data.details
+    });
+    this.name = "MfaNotEnrolledError";
+  }
+};
+var MfaVerificationFailedError = class extends UnauthorizedError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "That code did not verify",
+      details: data.details
+    });
+    this.name = "MfaVerificationFailedError";
+  }
+};
+var StepUpRequiredError = class extends ForbiddenError {
+  code = "STEP_UP_REQUIRED";
+  constructor(data = {}) {
+    super({
+      message: data.message || "Confirm your second factor before making this change.",
+      details: data.details
+    });
+    this.name = "StepUpRequiredError";
+  }
+};
+var MfaConfigError = class extends HttpError {
+  constructor(data) {
+    super({
+      message: data.message,
+      statusCode: 500,
+      details: data.details
+    });
+    this.name = "MfaConfigError";
+  }
+};
 
 // src/errors/index.ts
 var authErrorRegistry = new ErrorRegistry();
@@ -508,10 +617,20 @@ authErrorRegistry.append([
   RecentAuthenticationRequiredError,
   LastRecoveryCredentialError,
   PasskeyConfigError,
+  SessionBindingUnavailableError,
+  SessionRenewalRequiredError,
+  SessionRenewalRefusedError,
+  SessionContextChangedError,
+  SessionResealFailedError,
   OAuth2UnknownClientError,
   OAuth2RedirectUriMismatchError,
   OAuth2AuthorizeRedirectError,
-  OAuth2GrantNotFoundError
+  OAuth2GrantNotFoundError,
+  MfaAlreadyEnrolledError,
+  MfaNotEnrolledError,
+  MfaVerificationFailedError,
+  StepUpRequiredError,
+  MfaConfigError
 ]);
 export {
   AccountAlreadyExistsError,
@@ -540,6 +659,10 @@ export {
   KeyIdAlreadyRegisteredError,
   KeyNotFoundError,
   LastRecoveryCredentialError,
+  MfaAlreadyEnrolledError,
+  MfaConfigError,
+  MfaNotEnrolledError,
+  MfaVerificationFailedError,
   NativeSignInUnsupportedError,
   NonceKeyBindingError,
   OAuth2AuthorizeRedirectError,
@@ -557,6 +680,12 @@ export {
   RegistrationRejectedError,
   ReservedUsernameError,
   RevokeAllLinkError,
+  SessionBindingUnavailableError,
+  SessionContextChangedError,
+  SessionRenewalRefusedError,
+  SessionRenewalRequiredError,
+  SessionResealFailedError,
+  StepUpRequiredError,
   TokenExpiredError,
   UnverifiedEmailLinkError,
   UsernameAlreadyTakenError,