canceledAtEmailPrompt and canceledAtOtpPrompt were closure booleans set inside prompt callbacks to detect user cancellation after the fact. Fragile if authenticate ever retries prompts or changes order. In the command context both prompt functions are always provided, so AuthError(NO_TOKEN) unambiguously means the user declined to enter required input. Check the error code directly instead.