Render typed managed auth errors

[masnwilliams]

summary

• render typed challenge outcomes with specific titles and context-neutral descriptions
• distinguish rejected authenticator codes from invalid usernames or passwords
• add a patch changeset and focused error-display tests

dependency

kernel/kernel#3666 is merged and deployed. The component remains backward-compatible because unknown and older codes retain their current fallback behavior.

validation

• bun test
• bun run typecheck
• bun run format:check
• bun run build

---

Note

Low Risk
UI-only error messaging in the managed-auth React package; unknown error codes keep prior fallback behavior.

Overview
StepError now maps new managed-auth errorCode values to dedicated titles and descriptions instead of falling back to generic error copy.

Adds display entries for MFA/challenge blockers (totp_required, sms_code_required, email_code_required, account_choice_required, customer_input_required, external_action_required) with context-neutral wording, plus totp_code_rejected with recovery guidance that is separate from credentials_invalid.

Exports errorDisplayForCode for lookup and wires StepError through it; unknown codes still use the existing localized fallback. Includes unit tests for the new copy and a patch changeset for @onkernel/managed-auth-react.

^{Reviewed by Cursor Bugbot for commit 35469c1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
managed-auth-react-demo	Ready	Preview	Sep 2, 2026 5:14pm UTC

[akxue]

reviewed — looks good overall, one blocking copy change:

Blocking

• packages/managed-auth-react/src/components/StepError.tsx:44-48 — "Additional customer input is required" reads as internal jargon to the end user seeing this error screen. Suggest "Additional information is required before login can continue." to keep it clean.

Nits

• packages/managed-auth-react/src/components/StepError.test.tsx:27 — not.toEqual(errorDisplayForCode("credentials_invalid")) would also pass if credentials_invalid were missing from the map (both undefined); a truthiness assert on it would pin the distinction more tightly.