X_MFA_REQUIRED

password proven, second factor outstanding

the user has TOTP enrolled, and login() / completeOAuthLogin() throw before any session is written. meta.challenge is a sealed, five-minute credential for the second leg — meta, never cause: both public surfaces publish cause and drop meta, so the sign-in handler decides how it travels

catch X_MFA_REQUIRED in your sign-in handler, hand error.meta.challenge to the caller, and finish with await completeMfa(auth, challenge, code). No route ships. A wrong code is X_UNAUTHENTICATED and stays counted against the account, address and tenant buckets; past rateLimit.maxAttempts it is X_ACCOUNT_LOCKED. Sealing needs the app's master key — X_SEAL_KEY_MISSING without one