@prabhask5/stellar-engine 1.0.11 → 1.0.13

package/dist/auth/singleUser.js

@@ -1,21 +1,25 @@
 /**
  * Single-User Auth Module
  *
- * Implements a local gate (code or password) verified against a SHA-256 hash
- * stored in IndexedDB. Uses Supabase anonymous auth for session/token management
- * and RLS compliance. Falls back to offline auth when connectivity is unavailable.
+ * Uses Supabase email/password auth where the PIN *is* the password (padded).
+ * Replaces the previous anonymous auth + client-side SHA-256 hash approach.
+ *
+ * - Setup: signUp() with email + padded PIN
+ * - Unlock: signInWithPassword() with email + padded PIN
+ * - Device verification: signInWithOtp() for untrusted devices
+ * - Offline fallback: cached credentials in IndexedDB
  */
 import { getEngineConfig } from '../config';
 import { supabase } from '../supabase/client';
 import { hashValue } from './crypto';
 import { cacheOfflineCredentials } from './offlineCredentials';
 import { createOfflineSession } from './offlineSession';
+import { isDeviceTrusted, trustCurrentDevice, touchTrustedDevice, sendDeviceVerification, maskEmail } from './deviceVerification';
 import { authState } from '../stores/authState';
 import { syncStatusStore } from '../stores/sync';
-import { getSession, isSessionExpired } from '../supabase/auth';
+import { getSession } from '../supabase/auth';
 import { debugLog, debugWarn, debugError } from '../debug';
 const CONFIG_ID = 'config';
-const SINGLE_USER_EMAIL_DOMAIN = 'single-user.local';
 // ============================================================
 // HELPERS
 // ============================================================
@@ -25,9 +29,20 @@ function getDb() {
         throw new Error('Database not initialized.');
     return db;
 }
-function getSingleUserEmail() {
-    const config = getEngineConfig();
-    return `single-user@${config.prefix || 'app'}.${SINGLE_USER_EMAIL_DOMAIN}`;
+/**
+ * Pad a PIN to meet Supabase's minimum password length.
+ * e.g. "1234" → "1234_stellar" (12 chars, well above the 6-char minimum)
+ */
+export function padPin(pin) {
+    const prefix = getEngineConfig().prefix || 'app';
+    return `${pin}_${prefix}`;
+}
+function getConfirmRedirectUrl() {
+    if (typeof window !== 'undefined') {
+        const path = getEngineConfig().auth?.confirmRedirectPath || '/confirm';
+        return `${window.location.origin}${path}`;
+    }
+    return '/confirm';
 }
 async function readConfig() {
     const db = getDb();
@@ -64,20 +79,28 @@ export async function getSingleUserInfo() {
     return {
         profile: config.profile,
         gateType: config.gateType,
-        codeLength: config.codeLength
+        codeLength: config.codeLength,
+        email: config.email,
+        maskedEmail: config.email ? maskEmail(config.email) : undefined,
     };
 }
 /**
- * First-time setup: hash gate, create anonymous Supabase user (if online),
- * store config, and set auth state.
+ * First-time setup: create Supabase user with email/password auth.
+ *
+ * Uses signUp() which sends a confirmation email if emailConfirmation is enabled.
+ * The PIN is padded to meet Supabase's minimum password length.
+ *
+ * @returns confirmationRequired — true if the caller should show a "check your email" modal
  */
-export async function setupSingleUser(gate, profile) {
+export async function setupSingleUser(gate, profile, email) {
     try {
         const engineConfig = getEngineConfig();
         const singleUserOpts = engineConfig.auth?.singleUser;
         const gateType = singleUserOpts?.gateType || 'code';
         const codeLength = singleUserOpts?.codeLength;
-        const gateHash = await hashValue(gate);
+        const emailConfirmationEnabled = engineConfig.auth?.emailConfirmation?.enabled ?? false;
+        const paddedPassword = padPin(gate);
+        const gateHash = await hashValue(gate); // Keep hash for offline fallback
         const now = new Date().toISOString();
         const isOffline = typeof navigator !== 'undefined' && !navigator.onLine;
         // Build profile metadata for Supabase user_metadata
@@ -85,60 +108,66 @@ export async function setupSingleUser(gate, profile) {
         const metadata = profileToMetadata ? profileToMetadata(profile) : profile;
         if (!isOffline) {
             // --- ONLINE SETUP ---
-            const { data, error } = await supabase.auth.signInAnonymously();
+            const { data, error } = await supabase.auth.signUp({
+                email,
+                password: paddedPassword,
+                options: {
+                    emailRedirectTo: getConfirmRedirectUrl(),
+                    data: metadata,
+                },
+            });
             if (error) {
-                debugError('[SingleUser] Anonymous sign-in failed:', error.message);
-                return { error: `Setup failed: ${error.message}` };
+                debugError('[SingleUser] signUp failed:', error.message);
+                return { error: `Setup failed: ${error.message}`, confirmationRequired: false };
             }
-            const session = data.session;
             const user = data.user;
-            // Store profile in user_metadata so userDisplayInfo works unchanged
-            const { error: updateError } = await supabase.auth.updateUser({ data: metadata });
-            if (updateError) {
-                debugWarn('[SingleUser] Failed to set user_metadata:', updateError.message);
-            }
+            const session = data.session; // null if email confirmation required
             // Store config in IndexedDB
             const config = {
                 id: CONFIG_ID,
                 gateType,
                 codeLength,
                 gateHash,
+                email,
                 profile,
                 supabaseUserId: user.id,
                 setupAt: now,
-                updatedAt: now
+                updatedAt: now,
             };
             await writeConfig(config);
-            // Write gate config to Supabase for extension access
-            try {
-                await supabase.from('single_user_config').upsert({
-                    id: 'config',
-                    gate_type: gateType,
-                    code_length: codeLength,
-                    gate_hash: gateHash,
-                    profile,
-                });
+            // If email confirmation is required, session will be null
+            // The caller should show a "check your email" modal
+            if (emailConfirmationEnabled && !session) {
+                debugLog('[SingleUser] Setup initiated, awaiting email confirmation for:', email);
+                return { error: null, confirmationRequired: true };
             }
-            catch (e) {
-                debugWarn('[SingleUser] Failed to write gate config to Supabase:', e);
-            }
-            // Cache offline credentials for offline fallback
-            try {
-                await cacheOfflineCredentials(getSingleUserEmail(), gate, user, session);
-            }
-            catch (e) {
-                debugWarn('[SingleUser] Failed to cache offline credentials:', e);
-            }
-            // Create offline session for offline fallback
-            try {
-                await createOfflineSession(user.id);
-            }
-            catch (e) {
-                debugWarn('[SingleUser] Failed to create offline session:', e);
+            // No confirmation needed (or already confirmed) — proceed immediately
+            if (session) {
+                // Cache offline credentials
+                try {
+                    await cacheOfflineCredentials(email, gate, user, session);
+                }
+                catch (e) {
+                    debugWarn('[SingleUser] Failed to cache offline credentials:', e);
+                }
+                // Create offline session
+                try {
+                    await createOfflineSession(user.id);
+                }
+                catch (e) {
+                    debugWarn('[SingleUser] Failed to create offline session:', e);
+                }
+                // Auto-trust current device
+                try {
+                    await trustCurrentDevice(user.id);
+                }
+                catch (e) {
+                    debugWarn('[SingleUser] Failed to trust device:', e);
+                }
+                authState.setSupabaseAuth(session);
+                debugLog('[SingleUser] Setup complete (online, no confirmation needed), userId:', user.id);
             }
-            // Set auth state
-            authState.setSupabaseAuth(session);
-            debugLog('[SingleUser] Setup complete (online), userId:', user.id);
+            return { error: null, confirmationRequired: false };
         }
         else {
             // --- OFFLINE SETUP ---
@@ -148,35 +177,88 @@ export async function setupSingleUser(gate, profile) {
                 gateType,
                 codeLength,
                 gateHash,
+                email,
                 profile,
-                // supabaseUserId deferred until online
                 setupAt: now,
-                updatedAt: now
+                updatedAt: now,
             };
             await writeConfig(config);
-            // Create offline session with temp ID
             await createOfflineSession(tempUserId);
-            // Build offline profile for authState
             const offlineProfile = {
                 id: 'current_user',
                 userId: tempUserId,
-                email: getSingleUserEmail(),
+                email,
                 password: gateHash,
                 profile,
-                cachedAt: now
+                cachedAt: now,
             };
             authState.setOfflineAuth(offlineProfile);
             debugLog('[SingleUser] Setup complete (offline), temp userId:', tempUserId);
+            return { error: null, confirmationRequired: false };
         }
-        return { error: null };
     }
     catch (e) {
         debugError('[SingleUser] Setup error:', e);
-        return { error: e instanceof Error ? e.message : 'Setup failed' };
+        return { error: e instanceof Error ? e.message : 'Setup failed', confirmationRequired: false };
     }
 }
 /**
- * Unlock: verify gate hash, restore Supabase session or fall back to offline auth.
+ * Complete setup after email confirmation succeeds.
+ * Called when the original tab receives AUTH_CONFIRMED via BroadcastChannel.
+ */
+export async function completeSingleUserSetup() {
+    try {
+        const config = await readConfig();
+        if (!config) {
+            return { error: 'Single-user config not found' };
+        }
+        // After email confirmation, the session should now be available
+        const { data: { session }, error: sessionError } = await supabase.auth.getSession();
+        if (sessionError || !session) {
+            debugError('[SingleUser] No session after confirmation:', sessionError?.message);
+            return { error: 'Session not found after confirmation. Please try logging in.' };
+        }
+        const user = session.user;
+        // Update config with user ID if needed
+        if (!config.supabaseUserId) {
+            config.supabaseUserId = user.id;
+            config.updatedAt = new Date().toISOString();
+            await writeConfig(config);
+        }
+        // Cache offline credentials
+        try {
+            await cacheOfflineCredentials(config.email || '', config.gateHash || '', user, session);
+        }
+        catch (e) {
+            debugWarn('[SingleUser] Failed to cache offline credentials after confirmation:', e);
+        }
+        // Create offline session
+        try {
+            await createOfflineSession(user.id);
+        }
+        catch (e) {
+            debugWarn('[SingleUser] Failed to create offline session after confirmation:', e);
+        }
+        // Auto-trust current device
+        try {
+            await trustCurrentDevice(user.id);
+        }
+        catch (e) {
+            debugWarn('[SingleUser] Failed to trust device after confirmation:', e);
+        }
+        authState.setSupabaseAuth(session);
+        debugLog('[SingleUser] Setup completed after email confirmation, userId:', user.id);
+        return { error: null };
+    }
+    catch (e) {
+        debugError('[SingleUser] Complete setup error:', e);
+        return { error: e instanceof Error ? e.message : 'Failed to complete setup' };
+    }
+}
+/**
+ * Unlock: verify PIN via signInWithPassword, handle device verification.
+ *
+ * Returns deviceVerificationRequired if the device is untrusted.
  */
 export async function unlockSingleUser(gate) {
     try {
@@ -184,80 +266,46 @@ export async function unlockSingleUser(gate) {
         if (!config) {
             return { error: 'Single-user mode is not set up' };
         }
-        // Verify gate
-        const inputHash = await hashValue(gate);
-        if (inputHash !== config.gateHash) {
-            return { error: 'Incorrect code' };
-        }
         const isOffline = typeof navigator !== 'undefined' && !navigator.onLine;
         const engineConfig = getEngineConfig();
-        if (!isOffline) {
-            // --- ONLINE UNLOCK ---
-            // Try existing session first
-            const existingSession = await getSession();
-            if (existingSession && !isSessionExpired(existingSession)) {
-                authState.setSupabaseAuth(existingSession);
-                debugLog('[SingleUser] Unlocked with existing session');
-                return { error: null };
-            }
-            // Session expired — try refreshing to keep the SAME anonymous user.
-            // signInAnonymously() creates a NEW user who can't see the old user's data,
-            // which causes all synced items to disappear.
-            let session;
-            let user;
-            if (existingSession) {
-                debugLog('[SingleUser] Session expired, attempting refresh...');
-                const { data: refreshData, error: refreshError } = await supabase.auth.refreshSession();
-                if (!refreshError && refreshData.session) {
-                    session = refreshData.session;
-                    user = refreshData.session.user;
-                    debugLog('[SingleUser] Session refreshed, same user:', user.id);
-                }
-                else {
-                    // Refresh failed — fall back to signInAnonymously as last resort
-                    debugWarn('[SingleUser] Refresh failed, signing in anonymously:', refreshError?.message);
-                    const { data, error } = await supabase.auth.signInAnonymously();
-                    if (error) {
-                        debugError('[SingleUser] Anonymous sign-in failed on unlock:', error.message);
-                        return { error: `Unlock failed: ${error.message}` };
-                    }
-                    session = data.session;
-                    user = data.user;
-                }
-            }
-            else {
-                // No session at all — sign in anonymously
-                const { data, error } = await supabase.auth.signInAnonymously();
-                if (error) {
-                    debugError('[SingleUser] Anonymous sign-in failed on unlock:', error.message);
-                    return { error: `Unlock failed: ${error.message}` };
-                }
-                session = data.session;
-                user = data.user;
+        if (!isOffline && config.email) {
+            // --- ONLINE UNLOCK via Supabase signInWithPassword ---
+            const paddedPassword = padPin(gate);
+            const { data, error } = await supabase.auth.signInWithPassword({
+                email: config.email,
+                password: paddedPassword,
+            });
+            if (error) {
+                debugWarn('[SingleUser] signInWithPassword failed:', error.message);
+                return { error: 'Incorrect code' };
             }
-            // If user ID changed (new anonymous user), update config
-            if (config.supabaseUserId && user.id !== config.supabaseUserId) {
-                debugWarn('[SingleUser] New anonymous user ID, updating config');
+            const session = data.session;
+            const user = data.user;
+            // Update supabaseUserId if needed
+            if (config.supabaseUserId !== user.id) {
                 config.supabaseUserId = user.id;
                 config.updatedAt = new Date().toISOString();
                 await writeConfig(config);
-                // Reset sync cursor for new user (dynamic import to avoid circular deps)
-                try {
-                    if (typeof localStorage !== 'undefined') {
-                        // Clear old user cursor
-                        const keys = Object.keys(localStorage).filter(k => k.startsWith('lastSyncCursor_'));
-                        keys.forEach(k => localStorage.removeItem(k));
+            }
+            // Check device verification
+            const deviceVerificationEnabled = engineConfig.auth?.deviceVerification?.enabled ?? false;
+            if (deviceVerificationEnabled) {
+                const trusted = await isDeviceTrusted(user.id);
+                if (!trusted) {
+                    // Untrusted device — sign out, send OTP
+                    debugLog('[SingleUser] Untrusted device detected, sending OTP');
+                    const { error: otpError } = await sendDeviceVerification(config.email);
+                    if (otpError) {
+                        debugError('[SingleUser] Failed to send device verification:', otpError);
                     }
+                    return {
+                        error: null,
+                        deviceVerificationRequired: true,
+                        maskedEmail: maskEmail(config.email),
+                    };
                 }
-                catch {
-                    // Ignore storage errors
-                }
-            }
-            else if (!config.supabaseUserId) {
-                // First time online after offline setup
-                config.supabaseUserId = user.id;
-                config.updatedAt = new Date().toISOString();
-                await writeConfig(config);
+                // Trusted — touch device
+                await touchTrustedDevice(user.id);
             }
             // Re-apply profile to user_metadata
             const profileToMetadata = engineConfig.auth?.profileToMetadata;
@@ -265,9 +313,9 @@ export async function unlockSingleUser(gate) {
             await supabase.auth.updateUser({ data: metadata }).catch((e) => {
                 debugWarn('[SingleUser] Failed to update user_metadata on unlock:', e);
             });
-            // Update offline credentials cache
+            // Cache offline credentials
             try {
-                await cacheOfflineCredentials(getSingleUserEmail(), gate, user, session);
+                await cacheOfflineCredentials(config.email, gate, user, session);
             }
             catch (e) {
                 debugWarn('[SingleUser] Failed to update offline credentials:', e);
@@ -279,12 +327,25 @@ export async function unlockSingleUser(gate) {
             catch (e) {
                 debugWarn('[SingleUser] Failed to update offline session:', e);
             }
+            // Update local gateHash for offline fallback
+            const newHash = await hashValue(gate);
+            if (config.gateHash !== newHash) {
+                config.gateHash = newHash;
+                config.updatedAt = new Date().toISOString();
+                await writeConfig(config);
+            }
             authState.setSupabaseAuth(session);
             debugLog('[SingleUser] Unlocked online, userId:', user.id);
+            return { error: null };
         }
         else {
-            // --- OFFLINE UNLOCK ---
-            // Try cached Supabase session from localStorage
+            // --- OFFLINE UNLOCK (or no email — legacy migration) ---
+            // Fall back to local hash verification
+            const inputHash = await hashValue(gate);
+            if (config.gateHash && inputHash !== config.gateHash) {
+                return { error: 'Incorrect code' };
+            }
+            // Try cached Supabase session
             const cachedSession = await getSession();
             if (cachedSession) {
                 authState.setSupabaseAuth(cachedSession);
@@ -297,28 +358,74 @@ export async function unlockSingleUser(gate) {
             const offlineProfile = {
                 id: 'current_user',
                 userId,
-                email: getSingleUserEmail(),
-                password: config.gateHash,
+                email: config.email || '',
+                password: config.gateHash || inputHash,
                 profile: config.profile,
-                cachedAt: new Date().toISOString()
+                cachedAt: new Date().toISOString(),
             };
             authState.setOfflineAuth(offlineProfile);
             debugLog('[SingleUser] Unlocked offline with offline session');
+            return { error: null };
         }
-        return { error: null };
     }
     catch (e) {
         debugError('[SingleUser] Unlock error:', e);
         return { error: e instanceof Error ? e.message : 'Unlock failed' };
     }
 }
+/**
+ * Complete device verification after OTP email link is clicked.
+ * Called when the original tab receives AUTH_CONFIRMED via BroadcastChannel.
+ */
+export async function completeDeviceVerification(tokenHash) {
+    try {
+        // If tokenHash is provided, verify it (called from confirm page)
+        if (tokenHash) {
+            const { verifyDeviceCode } = await import('./deviceVerification');
+            const { error } = await verifyDeviceCode(tokenHash);
+            if (error)
+                return { error };
+        }
+        // After OTP verification, session should be available
+        const { data: { session }, error: sessionError } = await supabase.auth.getSession();
+        if (sessionError || !session) {
+            return { error: 'Session not found after verification' };
+        }
+        const user = session.user;
+        // Trust the device
+        await trustCurrentDevice(user.id);
+        // Cache credentials
+        const config = await readConfig();
+        if (config?.email) {
+            try {
+                await cacheOfflineCredentials(config.email, config.gateHash || '', user, session);
+            }
+            catch (e) {
+                debugWarn('[SingleUser] Failed to cache credentials after device verification:', e);
+            }
+        }
+        // Create offline session
+        try {
+            await createOfflineSession(user.id);
+        }
+        catch (e) {
+            debugWarn('[SingleUser] Failed to create offline session after device verification:', e);
+        }
+        authState.setSupabaseAuth(session);
+        debugLog('[SingleUser] Device verification complete, userId:', user.id);
+        return { error: null };
+    }
+    catch (e) {
+        debugError('[SingleUser] Device verification error:', e);
+        return { error: e instanceof Error ? e.message : 'Device verification failed' };
+    }
+}
 /**
  * Lock: stop sync engine, reset auth state to 'none'.
  * Does NOT destroy session, data, or sign out of Supabase.
  */
 export async function lockSingleUser() {
     try {
-        // Dynamic import to avoid circular deps
         const { stopSyncEngine } = await import('../engine');
         await stopSyncEngine();
     }
@@ -330,7 +437,7 @@ export async function lockSingleUser() {
     debugLog('[SingleUser] Locked');
 }
 /**
- * Change the gate (code/password). Verifies old gate first.
+ * Change the gate (code/password). Verifies old gate via signInWithPassword.
  */
 export async function changeSingleUserGate(oldGate, newGate) {
     try {
@@ -338,37 +445,44 @@ export async function changeSingleUserGate(oldGate, newGate) {
         if (!config) {
             return { error: 'Single-user mode is not set up' };
         }
-        // Verify old gate
-        const oldHash = await hashValue(oldGate);
-        if (oldHash !== config.gateHash) {
-            return { error: 'Current code is incorrect' };
+        const isOffline = typeof navigator !== 'undefined' && !navigator.onLine;
+        if (!isOffline && config.email) {
+            // Online: verify old gate via Supabase, then update password
+            const { error: verifyError } = await supabase.auth.signInWithPassword({
+                email: config.email,
+                password: padPin(oldGate),
+            });
+            if (verifyError) {
+                return { error: 'Current code is incorrect' };
+            }
+            // Update password in Supabase
+            const { error: updateError } = await supabase.auth.updateUser({
+                password: padPin(newGate),
+            });
+            if (updateError) {
+                return { error: `Failed to update code: ${updateError.message}` };
+            }
         }
-        // Update hash
+        else {
+            // Offline: verify against local hash
+            const oldHash = await hashValue(oldGate);
+            if (config.gateHash && oldHash !== config.gateHash) {
+                return { error: 'Current code is incorrect' };
+            }
+        }
+        // Update local hash
         const newHash = await hashValue(newGate);
         config.gateHash = newHash;
         config.updatedAt = new Date().toISOString();
         await writeConfig(config);
-        // Update Supabase gate config
-        const isOffline = typeof navigator !== 'undefined' && !navigator.onLine;
-        if (!isOffline) {
-            try {
-                await supabase.from('single_user_config').update({
-                    gate_hash: newHash,
-                    updated_at: new Date().toISOString(),
-                }).eq('id', 'config');
-            }
-            catch (e) {
-                debugWarn('[SingleUser] Failed to update gate hash in Supabase:', e);
-            }
-        }
-        // Update offline credentials cache if it exists
+        // Update offline credentials cache
         try {
             const db = getDb();
             const creds = await db.table('offlineCredentials').get('current_user');
             if (creds) {
                 await db.table('offlineCredentials').update('current_user', {
                     password: newHash,
-                    cachedAt: new Date().toISOString()
+                    cachedAt: new Date().toISOString(),
                 });
             }
         }
@@ -392,11 +506,9 @@ export async function updateSingleUserProfile(profile) {
         if (!config) {
             return { error: 'Single-user mode is not set up' };
         }
-        // Update IndexedDB
         config.profile = profile;
         config.updatedAt = new Date().toISOString();
         await writeConfig(config);
-        // Update Supabase user_metadata and single_user_config if online
         const isOffline = typeof navigator !== 'undefined' && !navigator.onLine;
         if (!isOffline) {
             const engineConfig = getEngineConfig();
@@ -407,19 +519,8 @@ export async function updateSingleUserProfile(profile) {
                 debugWarn('[SingleUser] Failed to update Supabase profile:', error.message);
             }
             else {
-                // Update auth state to reflect changes in UI
                 authState.updateUserProfile(metadata);
             }
-            // Update single_user_config profile in Supabase
-            try {
-                await supabase.from('single_user_config').update({
-                    profile,
-                    updated_at: new Date().toISOString(),
-                }).eq('id', 'config');
-            }
-            catch (e) {
-                debugWarn('[SingleUser] Failed to update profile in Supabase config:', e);
-            }
         }
         // Update offline credentials cache
         try {
@@ -428,7 +529,7 @@ export async function updateSingleUserProfile(profile) {
             if (creds) {
                 await db.table('offlineCredentials').update('current_user', {
                     profile,
-                    cachedAt: new Date().toISOString()
+                    cachedAt: new Date().toISOString(),
                 });
             }
         }
@@ -443,15 +544,87 @@ export async function updateSingleUserProfile(profile) {
         return { error: e instanceof Error ? e.message : 'Failed to update profile' };
     }
 }
+/**
+ * Initiate an email change. Requires online state.
+ * Supabase sends a confirmation email to the new address.
+ */
+export async function changeSingleUserEmail(newEmail) {
+    try {
+        const isOffline = typeof navigator !== 'undefined' && !navigator.onLine;
+        if (isOffline) {
+            return { error: 'Email change requires an internet connection', confirmationRequired: false };
+        }
+        const config = await readConfig();
+        if (!config) {
+            return { error: 'Single-user mode is not set up', confirmationRequired: false };
+        }
+        const { error } = await supabase.auth.updateUser({ email: newEmail });
+        if (error) {
+            debugError('[SingleUser] Email change failed:', error.message);
+            return { error: `Email change failed: ${error.message}`, confirmationRequired: false };
+        }
+        debugLog('[SingleUser] Email change initiated, confirmation required for:', newEmail);
+        return { error: null, confirmationRequired: true };
+    }
+    catch (e) {
+        debugError('[SingleUser] Email change error:', e);
+        return { error: e instanceof Error ? e.message : 'Email change failed', confirmationRequired: false };
+    }
+}
+/**
+ * Complete email change after the user confirms via the email link.
+ * Called when the original tab receives AUTH_CONFIRMED with type 'email_change'.
+ */
+export async function completeSingleUserEmailChange() {
+    try {
+        // Refresh session to get updated user data
+        const { data, error: refreshError } = await supabase.auth.refreshSession();
+        if (refreshError || !data.session) {
+            debugError('[SingleUser] Failed to refresh session after email change:', refreshError?.message);
+            return { error: 'Failed to refresh session after email change', newEmail: null };
+        }
+        const session = data.session;
+        const newEmail = session.user.email;
+        if (!newEmail) {
+            return { error: 'No email found in updated session', newEmail: null };
+        }
+        // Update local IndexedDB config
+        const config = await readConfig();
+        if (config) {
+            config.email = newEmail;
+            config.updatedAt = new Date().toISOString();
+            await writeConfig(config);
+        }
+        // Update offline credentials cache
+        try {
+            const db = getDb();
+            const creds = await db.table('offlineCredentials').get('current_user');
+            if (creds) {
+                await db.table('offlineCredentials').update('current_user', {
+                    email: newEmail,
+                    cachedAt: new Date().toISOString(),
+                });
+            }
+        }
+        catch (e) {
+            debugWarn('[SingleUser] Failed to update offline credentials after email change:', e);
+        }
+        authState.setSupabaseAuth(session);
+        debugLog('[SingleUser] Email change completed, new email:', newEmail);
+        return { error: null, newEmail };
+    }
+    catch (e) {
+        debugError('[SingleUser] Complete email change error:', e);
+        return { error: e instanceof Error ? e.message : 'Failed to complete email change', newEmail: null };
+    }
+}
 /**
  * Full reset: clear config, sign out of Supabase, clear all data.
  */
 export async function resetSingleUser() {
     try {
-        // Import signOut which handles full cleanup
         const { signOut } = await import('../supabase/auth');
         const result = await signOut();
-        // Clear single-user config from IndexedDB
         try {
             const db = getDb();
             await db.table('singleUserConfig').delete(CONFIG_ID);
@@ -459,13 +632,6 @@ export async function resetSingleUser() {
         catch (e) {
             debugWarn('[SingleUser] Failed to clear config on reset:', e);
         }
-        // Clear single_user_config from Supabase
-        try {
-            await supabase.from('single_user_config').delete().eq('id', 'config');
-        }
-        catch (e) {
-            debugWarn('[SingleUser] Failed to delete Supabase config on reset:', e);
-        }
         debugLog('[SingleUser] Reset complete');
         return { error: result.error };
     }