portal-mojo 0.2.7 → 0.2.8

package/src/admin/identity/users/sections/NotificationsSection.tsx

@@ -1,117 +1,38 @@
-// Notifications — AdminNotificationsSection port (read in full 2026-08-05):
-// the per-kind × per-channel (In-App / Email / Push) toggle grid over
-// /api/account/notification/preferences. A toggle POSTs the PARTIAL update
-// {preferences: {kind: {channel: bool}}} optimistically and reverts on
-// failure (source semantics; absent channels read as ON — `!== false`).
+// Notifications — AdminNotificationsSection port (read in full 2026-08-05),
+// now rendered by the shared portal-mojo/account NotificationPreferences:
+// three master channel cards (the reserved `"*"` all-kinds entry) over the
+// per-kind × channel grid on /api/account/notification/preferences. A
+// toggle POSTs the PARTIAL update {preferences: {kind: {channel: bool}}}
+// optimistically and reverts on failure (absent channels read as ON).
 //
 // LIVE-SCOPE NOTE (django-mojo notification_prefs.py, read 2026-08-05): the
 // real handler reads request.user and IGNORES the user param — the
 // admin-views-another-user path is not a backend surface. Other-user detail
 // therefore stays explicitly unavailable and never issues this query.
-import { useQuery, useQueryClient } from '@tanstack/react-query';
-import { mojoCall, useMe } from '../../../../client/runtime';
-import { Eyebrow, toast } from '../../../../ui';
+import { useMe } from '../../../../client/runtime';
+import { Eyebrow } from '../../../../ui';
+import type { NotificationKind } from '../../../../account/api';
+import { NotificationPreferences } from '../../../../account/NotificationPreferences';
 import type { UserRow } from '../models';
 
-const CHANNELS = ['in_app', 'email', 'push'] as const;
-const CHANNEL_LABELS: Record<string, string> = {
-    in_app: 'In-App',
-    email: 'Email',
-    push: 'Push',
-};
-
-type Preferences = Record<string, Record<string, boolean>>;
-
-const prefsKey = (userId: number) => ['/api/account/notification/preferences', userId] as const;
-
-export function NotificationsSection({ user }: { user: UserRow }) {
-    const qc = useQueryClient();
+export function NotificationsSection({ user, kinds }: {
+    user: UserRow;
+    /** The kinds this app sends; defaults to the server catalogue + stored kinds. */
+    kinds?: NotificationKind[];
+}) {
     const { data: me } = useMe();
     const isSelf = me?.id === user.id;
-    const { data: prefs, isPending, isError, error } = useQuery<Preferences>({
-        queryKey: prefsKey(user.id),
-        queryFn: async () => {
-            const body = await mojoCall('/api/account/notification/preferences');
-            const data = body.data as { preferences?: Preferences } | undefined;
-            return data?.preferences ?? {};
-        },
-        enabled: isSelf,
-    });
-
-    const toggle = async (kind: string, channel: string, next: boolean) => {
-        // Optimistic write into the query cache; revert + toast on rejection.
-        const prev = qc.getQueryData<Preferences>(prefsKey(user.id)) ?? {};
-        qc.setQueryData<Preferences>(prefsKey(user.id), {
-            ...prev,
-            [kind]: { ...(prev[kind] ?? {}), [channel]: next },
-        });
-        try {
-            await mojoCall('/api/account/notification/preferences', {
-                method: 'POST',
-                body: { preferences: { [kind]: { [channel]: next } } },
-            });
-        } catch (err) {
-            qc.setQueryData(prefsKey(user.id), prev);
-            toast.error(err instanceof Error ? err.message : 'Failed to update preference');
-        }
-    };
-
-    const kinds = Object.keys(prefs ?? {}).sort();
-    const kindLabel = (kind: string) =>
-        kind.replace(/[_-]/g, ' ').replace(/\b\w/g, (c) => c.toUpperCase());
-
     return (
         <>
             <Eyebrow>Notification preferences</Eyebrow>
-            {!isSelf && (
-                <div className="us-empty">
-                    <i className="bi bi-lock" />
-                    <div>Notification preferences are caller-only and cannot be administered for another user.</div>
-                </div>
-            )}
-            {isSelf && <>
-            {isPending && <p className="dim">Loading…</p>}
-            {isError && <p className="dim">{error instanceof Error ? error.message : 'Failed to load preferences.'}</p>}
-            {!isPending && !isError && kinds.length === 0 && (
-                <div className="us-empty">
-                    <i className="bi bi-bell" />
-                    <div>No notification preferences configured</div>
-                </div>
-            )}
-            {kinds.length > 0 && (
-                <table className="us-prefs-table">
-                    <thead>
-                        <tr>
-                            <th>Type</th>
-                            {CHANNELS.map((ch) => <th key={ch}>{CHANNEL_LABELS[ch]}</th>)}
-                        </tr>
-                    </thead>
-                    <tbody>
-                        {kinds.map((kind) => (
-                            <tr key={kind}>
-                                <td>{kindLabel(kind)}</td>
-                                {CHANNELS.map((ch) => {
-                                    // Absent channel == enabled (source `!== false`).
-                                    const checked = prefs?.[kind]?.[ch] !== false;
-                                    return (
-                                        <td key={ch}>
-                                            <input
-                                                type="checkbox"
-                                                role="switch"
-                                                className="switch"
-                                                checked={checked}
-                                                aria-label={`${kindLabel(kind)} via ${CHANNEL_LABELS[ch]}`}
-                                                onChange={(e) => void toggle(kind, ch, e.target.checked)}
-                                            />
-                                        </td>
-                                    );
-                                })}
-                            </tr>
-                        ))}
-                    </tbody>
-                </table>
-            )}
-            </>}
+            {isSelf
+                ? <NotificationPreferences kinds={kinds} />
+                : (
+                    <div className="us-empty">
+                        <i className="bi bi-lock" />
+                        <div>Notification preferences are caller-only and cannot be administered for another user.</div>
+                    </div>
+                )}
         </>
     );
 }

package/src/admin/identity/users/sections/PersonalSection.tsx

@@ -9,8 +9,13 @@
 // django-mojo's NO_SAVE_FIELDS (user.py RestMeta, read 2026-08-05), so the
 // server silently DROPS the write and the source UI toasts a success that
 // never happened. The verified badge still renders from the row.
+//
+// `model` (default UserModel) lets the signed-in user's own surfaces save
+// through portal-mojo/account's MeSaveModel (`/api/user/me`). Self-saves
+// cannot replace a date of birth once set (the server 403s), so with any
+// non-admin model a set DOB renders read-only.
 import { Badge, Eyebrow, FlatRow, FormView } from '../../../../ui';
-import type { Field } from '../../../../client/runtime';
+import type { Field, ModelDef } from '../../../../client/runtime';
 import { UserModel, type UserRow } from '../models';
 
 const NAME_FIELDS: Field[] = [
@@ -35,11 +40,19 @@ const ADDRESS_FIELDS: Field[] = [
     { name: 'metadata.country', type: 'text', label: 'Country', columns: 6 },
 ];
 
-export function PersonalSection({ user }: { user: UserRow }) {
+export interface PersonalSectionProps {
+    user: UserRow;
+    /** Save surface; default UserModel (admin). Pass MeSaveModel for self. */
+    model?: Pick<ModelDef<UserRow>, 'useSave'>;
+}
+
+export function PersonalSection({ user, model = UserModel }: PersonalSectionProps) {
+    const dobLocked = model !== UserModel && Boolean(user.dob);
+    const detailFields = dobLocked ? DETAIL_FIELDS.filter((field) => field.name !== 'dob') : DETAIL_FIELDS;
     return (
         <>
             <Eyebrow>Name</Eyebrow>
-            <FormView model={UserModel} row={user} fields={NAME_FIELDS} />
+            <FormView model={model} row={user} fields={NAME_FIELDS} />
 
             <Eyebrow>Details</Eyebrow>
             <FlatRow label="DOB status">
@@ -54,13 +67,13 @@ export function PersonalSection({ user }: { user: UserRow }) {
                     )
                     : <span className="dim-italic">Not set</span>}
             </FlatRow>
-            <FormView model={UserModel} row={user} fields={DETAIL_FIELDS} />
+            <FormView model={model} row={user} fields={detailFields} />
 
             <Eyebrow>Address</Eyebrow>
             <FlatRow label="On file">
                 {addressSummary(user) || <span className="dim-italic">Not set</span>}
             </FlatRow>
-            <FormView model={UserModel} row={user} fields={ADDRESS_FIELDS} />
+            <FormView model={model} row={user} fields={ADDRESS_FIELDS} />
         </>
     );
 }

package/src/admin/identity/users/sections/actions.tsx

@@ -10,19 +10,18 @@
 // the public, admin-targetable verification sender (NOT the JWT-scoped
 // auth/verify/email/send).
 import { useQueryClient } from '@tanstack/react-query';
-import { useEffect, useRef, useState } from 'react';
-import { mojoCall, useCan, useMe, withFreshAuth, type Field } from '../../../../client/runtime';
+import { useEffect, useState } from 'react';
+import { mojoCall, withFreshAuth, type Field } from '../../../../client/runtime';
 import {
-    Badge,
     ImageField,
     PasswordStrengthMeter,
-    fmt,
     formModal,
     modal,
     toast,
     type FileFieldOwnerResult,
 } from '../../../../ui';
-import { PasskeyModel, USER_MANAGE_PERMISSIONS, UserModel, type UserRow } from '../models';
+import { PasskeyList } from '../../../../account/PasskeyList';
+import { UserModel, type UserRow } from '../models';
 import { OAuthConnectionList } from './OAuthSection';
 import { openGroupDetail, useAdminCaller } from './shared';
 
@@ -664,106 +663,14 @@ function AvatarModal({ user, onClose, onPendingChange }: { user: UserRow; onClos
 }
 
 /**
- * Manage passkeys — list / rename / enable-disable / delete over
- * /api/account/passkeys (?user=<id>): the two REST-editable fields are
- * friendly_name and is_enabled; delete is real (CAN_DELETE).
+ * Manage passkeys — the shared portal-mojo/account PasskeyList (rename /
+ * enable-disable / remove over /api/account/passkeys?user=<id>).
  */
 function PasskeysModal({ userId, onClose }: { userId: number; onClose: () => void }) {
-    const admin = useCan(USER_MANAGE_PERMISSIONS).can;
-    const allowed = useMe().data?.id === userId || admin;
-    const permission = useRef(allowed); permission.current = allowed;
-    useEffect(() => { permission.current = allowed; return () => { permission.current = false; }; }, [allowed]);
-    const { data, isPending } = PasskeyModel.useList({ user: userId, size: 25, sort: '-created' });
-    const save = PasskeyModel.useSave();
-    const del = PasskeyModel.useDelete();
-    const rows = data?.rows ?? [];
-
-    const rename = async (id: number, current: string | null) => {
-        const data = await formModal({
-            title: 'Edit passkey',
-            submitText: 'Save',
-            fields: [{
-                name: 'friendly_name', type: 'text', label: 'Name', required: true,
-                placeholder: 'My iPhone', help: 'A friendly name to identify this passkey',
-            }],
-            initial: { friendly_name: current ?? '' },
-        });
-        const name = data?.friendly_name;
-        if (!permission.current || typeof name !== 'string' || !name.trim()) return;
-        try {
-            await save.mutateAsync({ id, changes: { friendly_name: name.trim() } });
-            toast.success('Passkey updated');
-        } catch (err) {
-            toast.error(err instanceof Error ? err.message : 'Failed to update passkey');
-        }
-    };
-
-    const toggleEnabled = async (id: number, next: boolean) => {
-        if (!permission.current) return;
-        try {
-            await save.mutateAsync({ id, changes: { is_enabled: next } });
-            toast.success(next ? 'Passkey enabled' : 'Passkey disabled');
-        } catch (err) {
-            toast.error(err instanceof Error ? err.message : 'Failed to update passkey');
-        }
-    };
-
-    const remove = async (id: number) => {
-        const ok = await modal.confirm({
-            title: 'Delete passkey',
-            message: `Remove ${rows.find(row => row.id === id)?.friendly_name || 'Unnamed passkey'} for ${rows.find(row => row.id === id)?.rp_id || 'unknown relying party'}, user #${userId}? Reenrollment is required to restore it. The physical device is not erased.`,
-            confirmText: 'Delete',
-            danger: true,
-        });
-        if (!ok || !permission.current) return;
-        try {
-            await del.mutateAsync({ id });
-            toast.success('Passkey deleted');
-        } catch (err) {
-            toast.error(err instanceof Error ? err.message : 'Failed to delete passkey');
-        }
-    };
-
     return (
         <div className="modal-pad">
             <h2 className="modal-title">Passkeys</h2>
-            {isPending && <p className="dim">Loading…</p>}
-            {!isPending && rows.length === 0 && (
-                <div className="us-empty">
-                    <i className="bi bi-fingerprint" />
-                    <div>No passkeys registered</div>
-                </div>
-            )}
-            {rows.map((p) => (
-                <div key={p.id} className="us-passkey-row">
-                    <div className="us-row-icon"><i className="bi bi-fingerprint" /></div>
-                    <div className="us-row-info">
-                        <div className="us-row-title">
-                            {p.friendly_name || 'Unnamed passkey'}
-                            {!p.is_enabled && <Badge tone="muted">Disabled</Badge>}
-                        </div>
-                        <div className="us-row-meta">
-                            Created {fmt.date(p.created)} · Last used {fmt.relative(p.last_used, 'never')} · {p.sign_count} uses
-                        </div>
-                    </div>
-                    <div className="us-row-actions" inert={!allowed || save.isPending || del.isPending}>
-                        <button className="btn-icon btn-icon-sm" title="Rename" aria-label={`Rename ${p.friendly_name ?? 'passkey'}`} onClick={() => void rename(p.id, p.friendly_name)}>
-                            <i className="bi bi-pencil" />
-                        </button>
-                        <button
-                            className="btn-icon btn-icon-sm"
-                            title={p.is_enabled ? 'Disable' : 'Enable'}
-                            aria-label={p.is_enabled ? 'Disable passkey' : 'Enable passkey'}
-                            onClick={() => void toggleEnabled(p.id, !p.is_enabled)}
-                        >
-                            <i className={`bi ${p.is_enabled ? 'bi-toggle-on' : 'bi-toggle-off'}`} />
-                        </button>
-                        <button className="btn-icon btn-icon-sm us-danger" title="Delete" aria-label="Delete passkey" onClick={() => void remove(p.id)}>
-                            <i className="bi bi-trash" />
-                        </button>
-                    </div>
-                </div>
-            ))}
+            <PasskeyList userId={userId} />
             <div className="modal-actions">
                 <button className="btn" onClick={onClose}>Close</button>
             </div>

package/src/client/auth.ts

@@ -133,7 +133,12 @@ export function subscribeAuth(cb: () => void): () => void {
 
 // ── Auth events ───────────────────────────────────────────────────────
 
-export type AuthEvent = 'login' | 'logout' | 'refreshed' | 'refresh-failed' | 'unauthorized';
+/**
+ * 'login' — an explicit, completed sign-in (password/MFA/passkey/magic/reset/
+ * exchange). 'rotated' — the SAME user's session re-issued by a credential
+ * change (sessions revoke, email-change confirm): new tokens, not a login.
+ */
+export type AuthEvent = 'login' | 'rotated' | 'logout' | 'refreshed' | 'refresh-failed' | 'unauthorized';
 const eventListeners = new Map<AuthEvent, Set<(detail?: unknown) => void>>();
 
 export function onAuth(event: AuthEvent, cb: (detail?: unknown) => void): () => void {
@@ -195,6 +200,9 @@ async function doRefresh(): Promise<boolean> {
     const persistent = sessionIsPersistent();
     try {
         const body = await mojoCall(REFRESH_PATH, { method: 'POST', body: { refresh_token: refresh } });
+        // The session changed while this POST was in flight (a new login was
+        // adopted, or logout): never write the old session's pair over it.
+        if (getRefreshToken() !== refresh) return getRefreshToken() != null;
         const pkg = body.data as { access_token: string; refresh_token?: string };
         setTokens(pkg.access_token, pkg.refresh_token, persistent);
         emitAuth('refreshed');
@@ -296,11 +304,26 @@ interface TokenGrant {
     expires_in?: number;
 }
 
-function adoptGrant(data: TokenGrant, remember = true): AuthUser {
+/** Copy for a grant that carries no usable session (e.g. a forced-password answer). */
+export const GRANT_SIGN_IN_AGAIN = 'Sign in again to continue';
+
+/**
+ * Store a TokenGrant as THE session. Validates first — a django-mojo
+ * forced_password_response, for one, answers without tokens after auth_key
+ * rotated — and leaves storage untouched (rejecting) when the grant has no
+ * access + refresh pair. Serialised behind any in-flight refresh so a
+ * refresh that started on the old session can never land on top of it.
+ */
+async function adoptGrant(data: TokenGrant | null | undefined, remember = true, event: 'login' | 'rotated' = 'login'): Promise<AuthUser> {
+    if (!data || typeof data.access_token !== 'string' || !data.access_token
+        || typeof data.refresh_token !== 'string' || !data.refresh_token) {
+        throw new Error(GRANT_SIGN_IN_AGAIN);
+    }
+    if (refreshPromise) await refreshPromise;
     setTokens(data.access_token, data.refresh_token, remember);
     startAutoRefresh();
     const user = data.user ?? {};
-    emitAuth('login', user);
+    emitAuth(event, user);
     return user;
 }
 
@@ -317,7 +340,7 @@ export async function login(username: string, password: string, opts: LoginOptio
     if (data.mfa_required) {
         return { kind: 'mfa', mfaToken: data.mfa_token ?? '', methods: data.mfa_methods ?? [], expiresIn: data.expires_in ?? 300 };
     }
-    return { kind: 'authenticated', user: adoptGrant(data, opts.remember ?? true) };
+    return { kind: 'authenticated', user: await adoptGrant(data, opts.remember ?? true) };
 }
 
 // ── MFA completion (deferred from A1; landed with the C3 pages) ───────
@@ -499,6 +522,170 @@ export async function loginWithPasskey(username?: string, opts: PasskeyLoginOpti
     return adoptGrant(body.data as TokenGrant, opts.remember ?? true);
 }
 
+// ── Passkey registration (self-service, signed in) ────────────────────
+// django-mojo account/rest/passkeys.py:59-150 + utils/passkeys.py:143-201.
+// Both legs are @requires_fresh_auth, so each runs under withFreshAuth. The
+// pair is retry-safe: complete matches on credential_id and the challenge is
+// deleted only after a successful complete, so a 440 on complete re-prompts
+// and replays complete with the SAME challenge and credential.
+
+/** Registration needs `create`, not just the `get` that login checks. */
+export function isPasskeyRegistrationSupported(): boolean {
+    return typeof window !== 'undefined'
+        && typeof window.PublicKeyCredential !== 'undefined'
+        && typeof navigator.credentials?.create === 'function';
+}
+
+/**
+ * A friendly default passkey name from this browser — web-mojo
+ * Passkey.suggestName() (core/models/Passkeys.js:42-59), e.g. "Mac — Chrome".
+ */
+export function suggestPasskeyName(userAgent?: string): string {
+    const ua = userAgent ?? (typeof navigator !== 'undefined' ? navigator.userAgent : '');
+    let device = 'Device';
+    if (/iPad/.test(ua)) device = 'iPad';
+    else if (/iPhone/.test(ua)) device = 'iPhone';
+    else if (/Macintosh|MacIntel/.test(ua)) device = 'Mac';
+    else if (/Android/.test(ua)) device = 'Android';
+    else if (/Windows/.test(ua)) device = 'Windows PC';
+    else if (/Linux/.test(ua)) device = 'Linux';
+    let browser = '';
+    if (/Edg\//.test(ua)) browser = 'Edge';
+    else if (/Chrome\//.test(ua) && !/Chromium/.test(ua)) browser = 'Chrome';
+    else if (/Safari\//.test(ua) && !/Chrome/.test(ua)) browser = 'Safari';
+    else if (/Firefox\//.test(ua)) browser = 'Firefox';
+    return browser ? `${device} — ${browser}` : device;
+}
+
+interface PasskeyRegisterBeginResponse {
+    challenge_id: string;
+    publicKey: Omit<PublicKeyCredentialCreationOptions, 'challenge' | 'user' | 'excludeCredentials'> & {
+        challenge: unknown;
+        user: { id: unknown; name: string; displayName: string };
+        excludeCredentials?: { id: unknown; type: string; transports?: string[] }[];
+    };
+    expiresAt?: string;
+}
+
+/** The saved Passkey row `register/complete` answers with (default graph). */
+export interface RegisteredPasskey {
+    id: number;
+    friendly_name: string | null;
+    [field: string]: unknown;
+}
+
+/**
+ * Register a passkey for the signed-in user on THIS browser/authenticator.
+ * `name` defaults to suggestPasskeyName(). Rejects with the authenticator's
+ * DOMException (NotAllowedError, InvalidStateError, …) or the server's
+ * MojoError — pass either to passkeyErrorMessage(). Callers refresh the
+ * passkey list and `me` (has_passkey) afterwards.
+ */
+export async function registerPasskey(name?: string): Promise<RegisteredPasskey> {
+    if (!isPasskeyRegistrationSupported()) throw new Error('Passkeys are not supported in this browser');
+
+    const begin = await withFreshAuth(() => mojoCall('/api/account/passkeys/register/begin', { method: 'POST', body: {} }));
+    const { challenge_id, publicKey } = begin.data as unknown as PasskeyRegisterBeginResponse;
+
+    const options: PublicKeyCredentialCreationOptions = {
+        ...publicKey,
+        challenge: base64urlToBuffer(String(publicKey.challenge)),
+        user: { ...publicKey.user, id: base64urlToBuffer(String(publicKey.user.id)) },
+        excludeCredentials: publicKey.excludeCredentials?.map((c) => ({
+            type: 'public-key' as const,
+            id: base64urlToBuffer(String(c.id)),
+            transports: c.transports as AuthenticatorTransport[] | undefined,
+        })),
+    };
+
+    const credential = (await navigator.credentials.create({ publicKey: options })) as PublicKeyCredential | null;
+    if (!credential) throw new Error('No credential received from authenticator');
+    const attestation = credential.response as AuthenticatorAttestationResponse;
+    const rawId = bufferToBase64url(credential.rawId);
+    // The server rejects id ≠ rawId; `transports` rides at the credential's
+    // TOP level (utils/passkeys.py:200), not inside `response`.
+    const payload = {
+        id: credential.id,
+        rawId,
+        type: credential.type,
+        response: {
+            clientDataJSON: bufferToBase64url(attestation.clientDataJSON),
+            attestationObject: bufferToBase64url(attestation.attestationObject),
+        },
+        transports: attestation.getTransports?.() ?? [],
+    };
+    const friendly_name = name?.trim() || suggestPasskeyName();
+    try {
+        const complete = await withFreshAuth(() => mojoCall('/api/account/passkeys/register/complete', {
+            method: 'POST',
+            body: { challenge_id, credential: payload, friendly_name },
+        }));
+        return complete.data as RegisteredPasskey;
+    } catch (error) {
+        // The authenticator now holds a credential the server never saved
+        // (complete failed, or its step-up was dismissed): tell the
+        // authenticator to forget it where the browser supports that.
+        signalUnknownPasskey(publicKey.rp?.id || window.location.hostname, rawId);
+        throw error;
+    }
+}
+
+type SignalUnknownCredential = (options: { rpId: string; credentialId: string }) => Promise<void>;
+
+/** Best-effort WebAuthn Signal API call; never throws, never blocks. */
+function signalUnknownPasskey(rpId: string, credentialId: string): void {
+    try {
+        const ctor = window.PublicKeyCredential as unknown as { signalUnknownCredential?: SignalUnknownCredential } | undefined;
+        const signal = ctor?.signalUnknownCredential;
+        if (typeof signal !== 'function') return;
+        void Promise.resolve(signal.call(ctor, { rpId, credentialId })).catch(() => {});
+    } catch { /* unsupported or refused — the orphan stays, as before */ }
+}
+
+/**
+ * User-facing copy for a failed passkey ceremony (login, step-up or
+ * registration). Authenticator DOMExceptions map to fixed copy; anything
+ * else — including server refusals — is shown as written.
+ */
+export function passkeyErrorMessage(error: unknown): string {
+    const name = error != null && typeof error === 'object' && typeof (error as { name?: unknown }).name === 'string'
+        ? (error as { name: string }).name : '';
+    switch (name) {
+        case 'NotAllowedError': return 'Passkey prompt was dismissed';
+        case 'InvalidStateError': return 'This authenticator already holds a passkey for your account';
+        case 'SecurityError': return 'Passkeys aren’t available on this domain (HTTPS and a matching domain are required)';
+        case 'AbortError': return 'Passkey request was cancelled';
+        default: break;
+    }
+    if (error instanceof Error && error.message) return error.message;
+    return 'Something went wrong. Please try again.';
+}
+
+// ── Self-service credential changes that re-issue the session ─────────
+
+/**
+ * Finish a code-flow email change (`POST /api/auth/email/change/confirm
+ * {code}`, rest/user.py:1953-1994). The server commits the new address,
+ * rotates auth_key (every other session dies) and answers with a NEW login,
+ * adopted here into the storage this session already uses. Emits 'rotated'
+ * (never 'login': no explicit sign-in happened).
+ */
+export async function confirmEmailChange(code: string): Promise<AuthUser> {
+    const body = await mojoCall('/api/auth/email/change/confirm', { method: 'POST', body: { code } });
+    return adoptGrant(body.data as TokenGrant, sessionIsPersistent(), 'rotated');
+}
+
+/**
+ * Sign out every OTHER session (`POST /api/auth/sessions/revoke`,
+ * rest/user.py:2331-2355, fresh-auth gated): auth_key rotates and the
+ * returned login keeps THIS session alive. Never the `revoke_sessions` user
+ * action — that one kills the caller's own session too.
+ */
+export async function revokeOtherSessions(): Promise<AuthUser> {
+    const body = await withFreshAuth(() => mojoCall('/api/auth/sessions/revoke', { method: 'POST', body: {} }));
+    return adoptGrant(body.data as TokenGrant, sessionIsPersistent(), 'rotated');
+}
+
 // ── Fresh-auth (step-up) challenges ───────────────────────────────────
 // django-mojo's freshness gate (account/services/fresh_auth.py): sensitive
 // operations can require that the JWT's `auth_time` claim — stamped at the
@@ -609,7 +796,7 @@ async function doExchange(code: string): Promise<AuthUser | null> {
         // block exchanging the fresh one-time login code.
         if (checkTokenStatus().action === 'logout') clearTokens({ silent: true });
         const body = await mojoCall('/api/auth/exchange', { method: 'POST', body: { code } });
-        return adoptGrant(body.data as TokenGrant);
+        return await adoptGrant(body.data as TokenGrant);
     } catch (error) {
         emitAuth('refresh-failed', error);
         return null;