@classic-homes/auth 1.28.0 → 1.42.0

package/README.md

@@ -96,6 +96,24 @@ async function handleLogin(email: string, password: string) {
 }
 ```
 
+Email-MFA accounts get their code by email: send it with the challenge token,
+then verify with `method: 'email'`. A cooldown (one code a minute, five an
+hour) throws `MFAChallengeEmailError` with `retryAfterSeconds`.
+
+```typescript
+import { authService, MFAChallengeEmailError } from '@classic-homes/auth';
+
+try {
+  const { email } = await authService.sendMFAChallengeEmail(mfaToken); // "jo***@example.com"
+} catch (error) {
+  if (error instanceof MFAChallengeEmailError && error.retryAfterSeconds) {
+    // Show "Resend in Ns"
+  }
+}
+
+await authService.verifyMFAChallenge({ mfaToken, code, method: 'email' });
+```
+
 To disable auto-set auth (for manual control):
 
 ```typescript

package/dist/{auth.svelte-JLSRQJAC.js → auth.svelte-XY4FQFZQ.js}

@@ -1,3 +1,3 @@
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-S3DNV7VV.js';
-import './chunk-GBYHYVXX.js';
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-MBVOLE5U.js';
+import './chunk-7AQYLLTA.js';
 import './chunk-K6TV3ZVS.js';

package/dist/{chunk-GBYHYVXX.js → chunk-7AQYLLTA.js}

@@ -1,4 +1,4 @@
-import { isInitialized, getConfig, getUserRoles, getStorage, isTokenExpired, getFetch, isValidRedirectUrl } from './chunk-K6TV3ZVS.js';
+import { isInitialized, getConfig, getUserRoles, getStorage, isTokenExpired, getFetch, isValidRedirectUrl, decodeJWT } from './chunk-K6TV3ZVS.js';
 
 // src/core/sso-state.ts
 var SSO_CLIENT_STATE_PARAM = "client_state";
@@ -96,6 +96,69 @@ var InvalidAuthResponseError = class _InvalidAuthResponseError extends Error {
     }
   }
 };
+var SessionChangedError = class _SessionChangedError extends Error {
+  constructor(message = "The session changed while this request was in flight; it was not retried.") {
+    super(message);
+    this.name = "SessionChangedError";
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, _SessionChangedError);
+    }
+  }
+};
+function isSessionChangedError(error) {
+  return error instanceof SessionChangedError || error?.name === "SessionChangedError";
+}
+var MFAChallengeEmailError = class _MFAChallengeEmailError extends Error {
+  constructor(message, status, retryAfterSeconds) {
+    super(message);
+    this.name = "MFAChallengeEmailError";
+    this.status = status;
+    this.retryAfterSeconds = retryAfterSeconds;
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, _MFAChallengeEmailError);
+    }
+  }
+};
+
+// src/core/session.ts
+var generation = 0;
+function bumpSessionGeneration() {
+  generation += 1;
+}
+function readIdentity() {
+  let parsed = {};
+  try {
+    const raw = getStorage().getItem(getConfig().storageKey ?? "classic_auth");
+    if (raw) parsed = JSON.parse(raw) ?? {};
+  } catch {
+  }
+  const accessToken = typeof parsed.accessToken === "string" ? parsed.accessToken : "";
+  const refreshToken = typeof parsed.refreshToken === "string" ? parsed.refreshToken : "";
+  const sub = accessToken ? decodeJWT(accessToken)?.sub : void 0;
+  const userId = parsed.user?.id;
+  return {
+    signedIn: accessToken !== "" || refreshToken !== "",
+    sub: typeof sub === "string" || typeof sub === "number" ? String(sub) : void 0,
+    userId: typeof userId === "string" || typeof userId === "number" ? String(userId) : void 0
+  };
+}
+function captureSession() {
+  return { generation, identity: readIdentity() };
+}
+function getSessionGeneration() {
+  return generation;
+}
+function isCurrentSession(snapshot) {
+  if (snapshot.generation !== generation) return false;
+  const then = snapshot.identity;
+  const now = readIdentity();
+  if (then.signedIn !== now.signedIn) return false;
+  if (then.sub !== void 0 && now.sub !== void 0 && then.sub !== now.sub) return false;
+  if (then.userId !== void 0 && now.userId !== void 0 && then.userId !== now.userId) {
+    return false;
+  }
+  return true;
+}
 
 // src/core/client.ts
 var DEFAULT_REFRESH_RETRY_DELAYS = [1e3, 3e3];
@@ -155,7 +218,7 @@ function writeStoredTokens(accessToken, refreshToken) {
 }
 async function syncSvelteStore(apply) {
   try {
-    const { authStore } = await import('./auth.svelte-JLSRQJAC.js');
+    const { authStore } = await import('./auth.svelte-XY4FQFZQ.js');
     apply(authStore);
   } catch {
   }
@@ -165,6 +228,7 @@ function clearStoredAuth() {
   const storage = getStorage();
   storage.removeItem(config.storageKey ?? "classic_auth");
   storage.removeItem(getSessionTokenKey());
+  bumpSessionGeneration();
 }
 async function expireSession() {
   clearStoredAuth();
@@ -234,6 +298,8 @@ function refreshSession(options = {}) {
   return refreshInflight;
 }
 async function runRefresh(options) {
+  const generation2 = getSessionGeneration();
+  const sameGeneration = () => generation2 === getSessionGeneration();
   const presented = getRefreshToken();
   if (!presented) {
     await expireSession();
@@ -243,6 +309,7 @@ async function runRefresh(options) {
     const current = getRefreshToken();
     if (current !== presented) {
       if (!current) {
+        if (!sameGeneration()) return "rejected";
         await expireSession();
         return "rejected";
       }
@@ -267,6 +334,7 @@ async function runRefresh(options) {
         await syncSvelteStore((authStore) => authStore.rehydrate());
         return "refreshed";
       }
+      if (!sameGeneration()) return "rejected";
       await writeStoredTokens(attempt.accessToken, attempt.refreshToken);
       return "refreshed";
     }
@@ -276,6 +344,7 @@ async function runRefresh(options) {
         await syncSvelteStore((authStore) => authStore.rehydrate());
         return "refreshed";
       }
+      if (!sameGeneration()) return "rejected";
       await expireSession();
       return "rejected";
     }
@@ -305,7 +374,7 @@ function isApiOrigin(url, baseUrl) {
 function apiRequest(endpoint, options = {}) {
   return apiRequestInternal(endpoint, options, false);
 }
-async function apiRequestInternal(endpoint, options, isRetry) {
+async function apiRequestInternal(endpoint, options, isRetry, startedIn) {
   const {
     authenticated: wantsAuth = false,
     customFetch,
@@ -320,6 +389,14 @@ async function apiRequestInternal(endpoint, options, isRetry) {
   const isAbsolute = /^https?:\/\//i.test(endpoint);
   const url = isAbsolute ? endpoint : `${config.baseUrl}${endpoint}`;
   const authenticated = wantsAuth && (!isAbsolute || isApiOrigin(url, config.baseUrl));
+  const session = startedIn ?? captureSession();
+  const assertSameSession = async () => {
+    if (isCurrentSession(session)) return;
+    if (session.generation === getSessionGeneration()) {
+      await syncSvelteStore((authStore) => authStore.rehydrate());
+    }
+    throw new SessionChangedError();
+  };
   if (authenticated && noAuthRetry && !isRetry && typeof window !== "undefined") {
     const accessToken = getAccessToken();
     if (accessToken && isTokenExpired(accessToken)) {
@@ -327,6 +404,7 @@ async function apiRequestInternal(endpoint, options, isRetry) {
       if (outcome === "rejected") {
         throw new Error("Authentication failed. Please sign in again.");
       }
+      if (authenticated) await assertSameSession();
     }
   }
   const timeoutMs = timeout ?? config.requestTimeout ?? 3e4;
@@ -363,13 +441,15 @@ async function apiRequestInternal(endpoint, options, isRetry) {
     });
     clearTimeout(timeoutId);
     if (response.status === 401 && authenticated && !noAuthRetry && typeof window !== "undefined") {
+      await assertSameSession();
       if (isRetry) {
         await expireSession();
         throw new Error("Authentication failed. Please sign in again.");
       }
       const outcome = await refreshSession();
       if (outcome === "refreshed") {
-        return apiRequestInternal(endpoint, options, true);
+        await assertSameSession();
+        return apiRequestInternal(endpoint, options, true, session);
       }
       if (outcome === "rejected") {
         throw new Error("Authentication failed. Please sign in again.");
@@ -729,7 +809,9 @@ var authApi = {
     const config = getConfig();
     const requestBody = {
       code: data.code,
-      type: data.method === "backup" ? "backup" : "totp",
+      // CHAPI answers the challenge per method: an authenticator code, an
+      // emailed sign-in code or a backup code (no method → authenticator).
+      type: data.method === "backup" || data.method === "email" ? data.method : "totp",
       trustDevice: data.trustDevice
     };
     const response = await fetchWithTimeout(`${config.baseUrl}/auth/mfa/challenge`, {
@@ -747,6 +829,27 @@ var authApi = {
     const result = await response.json();
     return extractData(result);
   },
+  /**
+   * Email a sign-in code for an MFA challenge (accounts with email MFA).
+   * Authenticated by the challenge token from login / the SSO callback, not
+   * a session. Answer it with verifyMFAChallenge({ method: 'email' }).
+   * Throws MFAChallengeEmailError (with `retryAfterSeconds` on a cooldown).
+   */
+  async sendMFAChallengeEmail(mfaToken) {
+    const config = getConfig();
+    const response = await fetchWithTimeout(`${config.baseUrl}/auth/mfa/challenge/email/send`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${mfaToken}` }
+    });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok) {
+      const details = body?.error?.details;
+      const retryAfter = typeof details?.retryAfterSeconds === "number" ? details.retryAfterSeconds : typeof body?.retryAfterSeconds === "number" ? body.retryAfterSeconds : void 0;
+      const message = (typeof body?.error === "string" ? body.error : body?.error?.message) || body?.message || "Could not send the verification code";
+      throw new MFAChallengeEmailError(message, response.status, retryAfter);
+    }
+    return extractData(body);
+  },
   // ============================================================================
   // Device Management
   // ============================================================================
@@ -978,4 +1081,4 @@ var authApi = {
   }
 };
 
-export { InvalidAuthResponseError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, refreshSession, updateStoredTokens, verifySsoClientState };
+export { InvalidAuthResponseError, MFAChallengeEmailError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SessionChangedError, api, apiRequest, authApi, bumpSessionGeneration, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, isSessionChangedError, refreshSession, updateStoredTokens, verifySsoClientState };

package/dist/{chunk-XUOSWSDO.js → chunk-7JLCFRUU.js}

@@ -1,5 +1,5 @@
-import { authService } from './chunk-TUWTOMZZ.js';
-import { authStore, currentUser, isAuthenticated, authActions } from './chunk-S3DNV7VV.js';
+import { authService } from './chunk-LPQKZRPC.js';
+import { authStore, currentUser, isAuthenticated, authActions } from './chunk-MBVOLE5U.js';
 import { isInitialized, initAuth, getUserRoles } from './chunk-K6TV3ZVS.js';
 
 // src/svelte/guards/auth-guard.ts

package/dist/{chunk-TUWTOMZZ.js → chunk-LPQKZRPC.js}

@@ -1,4 +1,4 @@
-import { authApi, InvalidAuthResponseError, RoleDeniedError } from './chunk-GBYHYVXX.js';
+import { authApi, InvalidAuthResponseError, RoleDeniedError } from './chunk-7AQYLLTA.js';
 import { hasAnyRole, getUserRoles } from './chunk-K6TV3ZVS.js';
 
 // src/core/guards.ts
@@ -19,7 +19,7 @@ function getAvailableMethods(response) {
 async function setStoreAuth(response) {
   let store;
   try {
-    store = (await import('./auth.svelte-JLSRQJAC.js')).authStore;
+    store = (await import('./auth.svelte-XY4FQFZQ.js')).authStore;
   } catch {
     return;
   }
@@ -237,6 +237,15 @@ var AuthService = class {
     }
     return response;
   }
+  /**
+   * Email a sign-in code for an MFA challenge (accounts with email MFA).
+   * Pass the `mfaToken` from the login / SSO challenge; answer with
+   * `verifyMFAChallenge({ mfaToken, code, method: 'email' })`.
+   * Throws MFAChallengeEmailError — `retryAfterSeconds` is set on a cooldown.
+   */
+  async sendMFAChallengeEmail(mfaToken) {
+    return await authApi.sendMFAChallengeEmail(mfaToken);
+  }
   // ============================================================================
   // Device Management
   // ============================================================================

package/dist/{chunk-S3DNV7VV.js → chunk-MBVOLE5U.js}

@@ -1,4 +1,4 @@
-import { InvalidAuthResponseError, authApi } from './chunk-GBYHYVXX.js';
+import { InvalidAuthResponseError, bumpSessionGeneration, authApi } from './chunk-7AQYLLTA.js';
 import { isInitialized, getConfig, isValidSSOLogoutUrl, hasRole, hasAnyRole, hasAllRoles, decodeJWT, getStorage, getDefaultStorage } from './chunk-K6TV3ZVS.js';
 
 // src/svelte/stores/auth.svelte.ts
@@ -111,6 +111,7 @@ var AuthStore = class {
       throw new InvalidAuthResponseError("setAuth requires an access token and a user");
     }
     const userWithPermissions = normalizeUser(user, accessToken);
+    bumpSessionGeneration();
     this.state = {
       accessToken,
       refreshToken,
@@ -174,6 +175,7 @@ var AuthStore = class {
    * Clear auth state (logout).
    */
   logout() {
+    bumpSessionGeneration();
     this.state = {
       accessToken: null,
       refreshToken: null,
@@ -222,6 +224,7 @@ var AuthStore = class {
    */
   handleSessionExpired() {
     const currentPath = typeof window !== "undefined" ? window.location.pathname : "/";
+    bumpSessionGeneration();
     this.state = {
       accessToken: null,
       refreshToken: null,
@@ -303,6 +306,7 @@ var AuthStore = class {
    * ```
    */
   reset() {
+    bumpSessionGeneration();
     this.state = {
       accessToken: null,
       refreshToken: null,

package/dist/core/index.d.ts

@@ -1,6 +1,6 @@
-import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, p as User, j as ProfileUpdateData, C as ChangePasswordData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, U as UpdateApiKeyRequest, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, q as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination, r as UserRolesResponse } from '../types-B70Kgcc_.js';
-export { a as AuthConfig, b as AuthState, l as ResetPasswordData, S as SSOConfig, o as StorageAdapter, s as createMemoryStorage, t as createSessionStorage, u as getConfig, v as getDefaultStorage, w as getFetch, x as getStorage, y as initAuth, z as isInitialized, B as resetConfig } from '../types-B70Kgcc_.js';
-export { A as AuthService, I as InvalidAuthResponseError, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-DWEU-Ovm.js';
+import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, l as RegisterResponse, q as User, k as ProfileUpdateData, C as ChangePasswordData, o as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, U as UpdateApiKeyRequest, j as MFAStatus, i as MFASetupResponse, M as MFAChallengeData, h as MFAChallengeEmailResponse, D as Device, r as UserPreferences, L as LinkedAccount, n as SecurityEvent, P as Pagination, s as UserRolesResponse } from '../types-DF5Ny2IA.js';
+export { a as AuthConfig, b as AuthState, m as ResetPasswordData, S as SSOConfig, p as StorageAdapter, t as createMemoryStorage, u as createSessionStorage, v as getConfig, w as getDefaultStorage, x as getFetch, y as getStorage, z as initAuth, B as isInitialized, E as resetConfig } from '../types-DF5Ny2IA.js';
+export { A as AuthService, I as InvalidAuthResponseError, L as LoginOptions, M as MFAChallengeEmailError, a as MFAVerifyOptions, R as RoleDeniedError, S as SessionChangedError, b as authService, f as formatUserRoles, g as getAvatarFallback, c as getDisplayName, d as getGreeting, e as getUserEmail, h as getUserInitials, i as isRoleDeniedError, j as isSessionChangedError } from '../user-utils-Bo3lMsuT.js';
 
 /**
  * SSO client state
@@ -347,6 +347,13 @@ declare const authApi: {
      * Verify MFA challenge during login.
      */
     verifyMFAChallenge(data: MFAChallengeData): Promise<LoginResponse>;
+    /**
+     * Email a sign-in code for an MFA challenge (accounts with email MFA).
+     * Authenticated by the challenge token from login / the SSO callback, not
+     * a session. Answer it with verifyMFAChallenge({ method: 'email' }).
+     * Throws MFAChallengeEmailError (with `retryAfterSeconds` on a cooldown).
+     */
+    sendMFAChallengeEmail(mfaToken: string): Promise<MFAChallengeEmailResponse>;
     /**
      * Get all devices.
      */
@@ -696,4 +703,4 @@ declare function hasAnyRole(user: Pick<User, 'roles'> | null | undefined, roles:
  */
 declare function hasAllRoles(user: Pick<User, 'roles'> | null | undefined, roles: readonly string[]): boolean;
 
-export { ApiKey, type ApiRequestOptions, type ApiResponse, ChangePasswordData, CreateApiKeyRequest, CreateApiKeyResponse, Device, type JWTPayload, LinkedAccount, LoginCredentials, LoginResponse, LogoutResponse, MFAChallengeData, MFASetupResponse, MFAStatus, Pagination, ProfileUpdateData, ROLE_HIERARCHY, ROLE_NAMES, type RefreshOutcome, type RefreshSessionOptions, RegisterData, RegisterResponse, type RoleName, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SecurityEvent, Session, type SsoClientStateResult, type SsoClientStateVerification, UpdateApiKeyRequest, User, UserPreferences, UserRolesResponse, api, apiRequest, authApi, clearStoredAuth, computePrimaryRole, consumeSsoClientState, createSsoClientState, decodeJWT, extractClaims, extractData, getAccessToken, getAvailableMethods, getEffectiveLevel, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initCrossTabSync, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, refreshSession, updateStoredTokens, verifySsoClientState };
+export { ApiKey, type ApiRequestOptions, type ApiResponse, ChangePasswordData, CreateApiKeyRequest, CreateApiKeyResponse, Device, type JWTPayload, LinkedAccount, LoginCredentials, LoginResponse, LogoutResponse, MFAChallengeData, MFAChallengeEmailResponse, MFASetupResponse, MFAStatus, Pagination, ProfileUpdateData, ROLE_HIERARCHY, ROLE_NAMES, type RefreshOutcome, type RefreshSessionOptions, RegisterData, RegisterResponse, type RoleName, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SecurityEvent, Session, type SsoClientStateResult, type SsoClientStateVerification, UpdateApiKeyRequest, User, UserPreferences, UserRolesResponse, api, apiRequest, authApi, clearStoredAuth, computePrimaryRole, consumeSsoClientState, createSsoClientState, decodeJWT, extractClaims, extractData, getAccessToken, getAvailableMethods, getEffectiveLevel, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initCrossTabSync, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, refreshSession, updateStoredTokens, verifySsoClientState };

package/dist/core/index.js

@@ -1,3 +1,3 @@
-export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from '../chunk-TUWTOMZZ.js';
-export { InvalidAuthResponseError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, refreshSession, updateStoredTokens, verifySsoClientState } from '../chunk-GBYHYVXX.js';
+export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from '../chunk-LPQKZRPC.js';
+export { InvalidAuthResponseError, MFAChallengeEmailError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SessionChangedError, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, isSessionChangedError, refreshSession, updateStoredTokens, verifySsoClientState } from '../chunk-7AQYLLTA.js';
 export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from '../chunk-K6TV3ZVS.js';

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as ApiKey, a as AuthConfig, b as AuthState, C as ChangePasswordData, c as CreateApiKeyRequest, d as CreateApiKeyResponse, D as Device, L as LinkedAccount, e as LoginCredentials, f as LoginResponse, g as LogoutResponse, M as MFAChallengeData, h as MFASetupResponse, i as MFAStatus, P as Pagination, j as ProfileUpdateData, R as RegisterData, k as RegisterResponse, l as ResetPasswordData, S as SSOConfig, m as SecurityEvent, n as Session, o as StorageAdapter, U as UpdateApiKeyRequest, p as User, q as UserPreferences, r as UserRolesResponse, s as createMemoryStorage, t as createSessionStorage, u as getConfig, v as getDefaultStorage, w as getFetch, x as getStorage, y as initAuth, z as isInitialized, B as resetConfig } from './types-B70Kgcc_.js';
+export { A as ApiKey, a as AuthConfig, b as AuthState, C as ChangePasswordData, c as CreateApiKeyRequest, d as CreateApiKeyResponse, D as Device, L as LinkedAccount, e as LoginCredentials, f as LoginResponse, g as LogoutResponse, M as MFAChallengeData, h as MFAChallengeEmailResponse, i as MFASetupResponse, j as MFAStatus, P as Pagination, k as ProfileUpdateData, R as RegisterData, l as RegisterResponse, m as ResetPasswordData, S as SSOConfig, n as SecurityEvent, o as Session, p as StorageAdapter, U as UpdateApiKeyRequest, q as User, r as UserPreferences, s as UserRolesResponse, t as createMemoryStorage, u as createSessionStorage, v as getConfig, w as getDefaultStorage, x as getFetch, y as getStorage, z as initAuth, B as isInitialized, E as resetConfig } from './types-DF5Ny2IA.js';
 export { ApiRequestOptions, ApiResponse, JWTPayload, ROLE_HIERARCHY, ROLE_NAMES, RefreshOutcome, RefreshSessionOptions, RoleName, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SsoClientStateResult, SsoClientStateVerification, api, apiRequest, authApi, clearStoredAuth, computePrimaryRole, consumeSsoClientState, createSsoClientState, decodeJWT, extractClaims, extractData, getAccessToken, getAvailableMethods, getEffectiveLevel, getMfaToken, getRefreshToken, getSessionToken, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initCrossTabSync, isLoginSuccessResponse, isMfaChallengeResponse, isTokenExpired, refreshSession, updateStoredTokens, verifySsoClientState } from './core/index.js';
-export { A as AuthService, I as InvalidAuthResponseError, L as LoginOptions, M as MFAVerifyOptions, R as RoleDeniedError, a as authService, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from './user-utils-DWEU-Ovm.js';
+export { A as AuthService, I as InvalidAuthResponseError, L as LoginOptions, M as MFAChallengeEmailError, a as MFAVerifyOptions, R as RoleDeniedError, S as SessionChangedError, b as authService, f as formatUserRoles, g as getAvatarFallback, c as getDisplayName, d as getGreeting, e as getUserEmail, h as getUserInitials, i as isRoleDeniedError, j as isSessionChangedError } from './user-utils-Bo3lMsuT.js';
 export { AuthClient, AuthGuardOptions, AuthGuardResult, AuthHookOptions, CreateAuthClientOptions, NavFilterOptions, RoleRestrictedItem, authActions, authStore, canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, currentUser, filterByAccess, filterNavSections, isAuthenticated, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './svelte/index.js';

package/dist/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-XUOSWSDO.js';
-export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from './chunk-TUWTOMZZ.js';
-export { authActions, authStore, currentUser, isAuthenticated } from './chunk-S3DNV7VV.js';
-export { InvalidAuthResponseError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, refreshSession, updateStoredTokens, verifySsoClientState } from './chunk-GBYHYVXX.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from './chunk-7JLCFRUU.js';
+export { AuthService, authService, formatUserRoles, getAvailableMethods, getAvatarFallback, getDisplayName, getGreeting, getMfaToken, getUserEmail, getUserInitials, isLoginSuccessResponse, isMfaChallengeResponse } from './chunk-LPQKZRPC.js';
+export { authActions, authStore, currentUser, isAuthenticated } from './chunk-MBVOLE5U.js';
+export { InvalidAuthResponseError, MFAChallengeEmailError, RoleDeniedError, SSO_CLIENT_STATE_PARAM, SSO_CLIENT_STATE_TTL_MS, SessionChangedError, api, apiRequest, authApi, clearStoredAuth, consumeSsoClientState, createSsoClientState, extractData, getAccessToken, getRefreshToken, getSessionToken, initCrossTabSync, isRoleDeniedError, isSessionChangedError, refreshSession, updateStoredTokens, verifySsoClientState } from './chunk-7AQYLLTA.js';
 export { ROLE_HIERARCHY, ROLE_NAMES, computePrimaryRole, createMemoryStorage, createSessionStorage, decodeJWT, extractClaims, getConfig, getDefaultStorage, getEffectiveLevel, getFetch, getStorage, getTokenExpiration, getTokenRemainingTime, getUserRoles, hasAllRoles, hasAnyRole, hasRole, initAuth, isInitialized, isTokenExpired, resetConfig } from './chunk-K6TV3ZVS.js';

package/dist/svelte/index.d.ts

@@ -1,7 +1,7 @@
-import { b as AuthState, p as User, a as AuthConfig } from '../types-B70Kgcc_.js';
-export { y as initAuth, z as isInitialized } from '../types-B70Kgcc_.js';
-import { a as authService } from '../user-utils-DWEU-Ovm.js';
-export { I as InvalidAuthResponseError, R as RoleDeniedError, f as formatUserRoles, g as getAvatarFallback, b as getDisplayName, c as getGreeting, d as getUserEmail, e as getUserInitials, i as isRoleDeniedError } from '../user-utils-DWEU-Ovm.js';
+import { b as AuthState, q as User, a as AuthConfig } from '../types-DF5Ny2IA.js';
+export { z as initAuth, B as isInitialized } from '../types-DF5Ny2IA.js';
+import { b as authService } from '../user-utils-Bo3lMsuT.js';
+export { I as InvalidAuthResponseError, R as RoleDeniedError, S as SessionChangedError, f as formatUserRoles, g as getAvatarFallback, c as getDisplayName, d as getGreeting, e as getUserEmail, h as getUserInitials, i as isRoleDeniedError, j as isSessionChangedError } from '../user-utils-Bo3lMsuT.js';
 
 /**
  * Auth Store

package/dist/svelte/index.js

@@ -1,5 +1,5 @@
-export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-XUOSWSDO.js';
-export { formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials } from '../chunk-TUWTOMZZ.js';
-export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-S3DNV7VV.js';
-export { InvalidAuthResponseError, RoleDeniedError, isRoleDeniedError } from '../chunk-GBYHYVXX.js';
+export { canAccess, checkAuth, createAuthClient, createAuthGuard, createAuthHook, createNavFilter, filterByAccess, filterNavSections, matchesRoute, protectedLoad, requireAuth, requirePermission, requireRole, routePatterns } from '../chunk-7JLCFRUU.js';
+export { formatUserRoles, getAvatarFallback, getDisplayName, getGreeting, getUserEmail, getUserInitials } from '../chunk-LPQKZRPC.js';
+export { authActions, authStore, currentUser, isAuthenticated } from '../chunk-MBVOLE5U.js';
+export { InvalidAuthResponseError, RoleDeniedError, SessionChangedError, isRoleDeniedError, isSessionChangedError } from '../chunk-7AQYLLTA.js';
 export { initAuth, isInitialized } from '../chunk-K6TV3ZVS.js';

package/dist/testing/index.d.ts

@@ -1,4 +1,4 @@
-import { p as User, D as Device, f as LoginResponse, m as SecurityEvent, n as Session, A as ApiKey, L as LinkedAccount, g as LogoutResponse, h as MFASetupResponse, i as MFAStatus, k as RegisterResponse, q as UserPreferences, o as StorageAdapter, b as AuthState, a as AuthConfig } from '../types-B70Kgcc_.js';
+import { q as User, D as Device, f as LoginResponse, n as SecurityEvent, o as Session, A as ApiKey, L as LinkedAccount, g as LogoutResponse, i as MFASetupResponse, j as MFAStatus, l as RegisterResponse, r as UserPreferences, p as StorageAdapter, b as AuthState, a as AuthConfig } from '../types-DF5Ny2IA.js';
 
 /**
  * User Fixtures

package/dist/testing/index.js

@@ -1065,6 +1065,11 @@ var MockFetchInstance = class {
       path: "/auth/mfa/challenge",
       response: { data: mockLoginSuccess }
     });
+    this.addRoute({
+      method: "POST",
+      path: "/auth/mfa/challenge/email/send",
+      response: { success: true, email: "te***@example.com" }
+    });
     this.addRoute({
       method: "DELETE",
       path: "/auth/mfa",

package/dist/{types-B70Kgcc_.d.ts → types-DF5Ny2IA.d.ts}

@@ -326,6 +326,12 @@ interface MFAChallengeData {
     method?: 'totp' | 'email' | 'backup';
     trustDevice?: boolean;
 }
+/** CHAPI's answer to sending an MFA challenge email code. */
+interface MFAChallengeEmailResponse {
+    success: boolean;
+    /** The address the code went to, masked (`jo***@example.com`). */
+    email: string;
+}
 interface Device {
     id: string;
     deviceFingerprint: string;
@@ -407,4 +413,4 @@ interface ResetPasswordData {
     newPassword: string;
 }
 
-export { type ApiKey as A, resetConfig as B, type ChangePasswordData as C, type Device as D, type LinkedAccount as L, type MFAChallengeData as M, type Pagination as P, type RegisterData as R, type SSOConfig as S, type UpdateApiKeyRequest as U, type AuthConfig as a, type AuthState as b, type CreateApiKeyRequest as c, type CreateApiKeyResponse as d, type LoginCredentials as e, type LoginResponse as f, type LogoutResponse as g, type MFASetupResponse as h, type MFAStatus as i, type ProfileUpdateData as j, type RegisterResponse as k, type ResetPasswordData as l, type SecurityEvent as m, type Session as n, type StorageAdapter as o, type User as p, type UserPreferences as q, type UserRolesResponse as r, createMemoryStorage as s, createSessionStorage as t, getConfig as u, getDefaultStorage as v, getFetch as w, getStorage as x, initAuth as y, isInitialized as z };
+export { type ApiKey as A, isInitialized as B, type ChangePasswordData as C, type Device as D, resetConfig as E, type LinkedAccount as L, type MFAChallengeData as M, type Pagination as P, type RegisterData as R, type SSOConfig as S, type UpdateApiKeyRequest as U, type AuthConfig as a, type AuthState as b, type CreateApiKeyRequest as c, type CreateApiKeyResponse as d, type LoginCredentials as e, type LoginResponse as f, type LogoutResponse as g, type MFAChallengeEmailResponse as h, type MFASetupResponse as i, type MFAStatus as j, type ProfileUpdateData as k, type RegisterResponse as l, type ResetPasswordData as m, type SecurityEvent as n, type Session as o, type StorageAdapter as p, type User as q, type UserPreferences as r, type UserRolesResponse as s, createMemoryStorage as t, createSessionStorage as u, getConfig as v, getDefaultStorage as w, getFetch as x, getStorage as y, initAuth as z };

package/dist/{user-utils-DWEU-Ovm.d.ts → user-utils-Bo3lMsuT.d.ts}

@@ -1,4 +1,4 @@
-import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, k as RegisterResponse, p as User, j as ProfileUpdateData, n as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, U as UpdateApiKeyRequest, i as MFAStatus, h as MFASetupResponse, M as MFAChallengeData, D as Device, q as UserPreferences, L as LinkedAccount, m as SecurityEvent, P as Pagination } from './types-B70Kgcc_.js';
+import { e as LoginCredentials, f as LoginResponse, g as LogoutResponse, R as RegisterData, l as RegisterResponse, q as User, k as ProfileUpdateData, o as Session, A as ApiKey, c as CreateApiKeyRequest, d as CreateApiKeyResponse, U as UpdateApiKeyRequest, j as MFAStatus, i as MFASetupResponse, M as MFAChallengeData, h as MFAChallengeEmailResponse, D as Device, r as UserPreferences, L as LinkedAccount, n as SecurityEvent, P as Pagination } from './types-DF5Ny2IA.js';
 
 /**
  * Auth Service
@@ -192,6 +192,13 @@ declare class AuthService {
      * @param options - Optional settings for verification behavior
      */
     verifyMFAChallenge(data: MFAChallengeData, options?: MFAVerifyOptions): Promise<LoginResponse>;
+    /**
+     * Email a sign-in code for an MFA challenge (accounts with email MFA).
+     * Pass the `mfaToken` from the login / SSO challenge; answer with
+     * `verifyMFAChallenge({ mfaToken, code, method: 'email' })`.
+     * Throws MFAChallengeEmailError — `retryAfterSeconds` is set on a cooldown.
+     */
+    sendMFAChallengeEmail(mfaToken: string): Promise<MFAChallengeEmailResponse>;
     /**
      * Get all devices.
      */
@@ -319,6 +326,36 @@ declare class InvalidAuthResponseError extends Error {
     readonly name = "InvalidAuthResponseError";
     constructor(message?: string);
 }
+/**
+ * Error thrown when the session changed (logout, login as another account,
+ * expiry) while a request was in flight, and the request needed the session
+ * to continue (a 401 that would have been refreshed and retried). The request
+ * is not refreshed, retried or allowed to expire the new session: replaying it
+ * would send the previous account's request with the next account's
+ * credentials.
+ */
+declare class SessionChangedError extends Error {
+    readonly name = "SessionChangedError";
+    constructor(message?: string);
+}
+/**
+ * Type guard to check if an error is a SessionChangedError.
+ */
+declare function isSessionChangedError(error: unknown): error is SessionChangedError;
+/**
+ * Error thrown when CHAPI won't send an MFA challenge email code: the
+ * challenge token is invalid or expired (401), the account has no email MFA
+ * (400), or a code was requested too soon / too often (429). On a 429,
+ * `retryAfterSeconds` says how long to wait when the server gave one.
+ */
+declare class MFAChallengeEmailError extends Error {
+    readonly name = "MFAChallengeEmailError";
+    /** HTTP status CHAPI answered with. */
+    readonly status: number;
+    /** Seconds until another code may be requested (cooldown 429s only). */
+    readonly retryAfterSeconds?: number;
+    constructor(message: string, status: number, retryAfterSeconds?: number);
+}
 
 /**
  * User Display Utilities
@@ -423,4 +460,4 @@ declare function formatUserRoles(user: User | null | undefined, options?: {
     capitalize?: boolean;
 }): string;
 
-export { AuthService as A, InvalidAuthResponseError as I, type LoginOptions as L, type MFAVerifyOptions as M, RoleDeniedError as R, authService as a, getDisplayName as b, getGreeting as c, getUserEmail as d, getUserInitials as e, formatUserRoles as f, getAvatarFallback as g, isRoleDeniedError as i };
+export { AuthService as A, InvalidAuthResponseError as I, type LoginOptions as L, MFAChallengeEmailError as M, RoleDeniedError as R, SessionChangedError as S, type MFAVerifyOptions as a, authService as b, getDisplayName as c, getGreeting as d, getUserEmail as e, formatUserRoles as f, getAvatarFallback as g, getUserInitials as h, isRoleDeniedError as i, isSessionChangedError as j };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@classic-homes/auth",
-  "version": "1.28.0",
+  "version": "1.42.0",
   "description": "Authentication services and Svelte bindings for Classic Theme apps",
   "type": "module",
   "main": "dist/index.js",