Default to sending mailbox challenge emails

Author: thobson

CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- `@passlock/server` `createMailboxChallenge` will now send the challenge email unless `sendEmail: false` is set explicitly.
+- Upgraded npm dependencies
+
 ## [2.9.2] - 2026-06-25
 
 ### Removed

examples/sveltekit/package.json

@@ -31,20 +31,20 @@
 		"@lucide/svelte": "^1.21.0",
 		"@passlock/browser": "^2.9.2",
 		"@passlock/server": "^2.9.2",
-		"@sveltejs/adapter-node": "^5.5.6",
+		"@sveltejs/adapter-node": "^5.5.7",
 		"@sveltejs/kit": "^2.68.0",
 		"@sveltejs/vite-plugin-svelte": "^7.1.2",
 		"@tailwindcss/vite": "4.3.1",
 		"@types/node": "^24.1.0",
-		"daisyui": "^5.5.23",
+		"daisyui": "^5.6.2",
 		"dotenv": "^17.4.2",
 		"drizzle-kit": "^0.31.10",
 		"drizzle-orm": "^0.45.2",
 		"eslint": "^10.5.0",
 		"eslint-config-prettier": "^10.1.8",
-		"eslint-plugin-svelte": "^3.19.0",
+		"eslint-plugin-svelte": "^3.20.0",
 		"globals": "^17.7.0",
-		"prettier": "^3.8.4",
+		"prettier": "^3.8.5",
 		"prettier-plugin-svelte": "^4.1.1",
 		"prettier-plugin-tailwindcss": "^0.8.0",
 		"sort-package-json": "catalog:",

packages/server/src/mailbox/mailbox.ts

@@ -299,7 +299,9 @@ export interface CreateMailboxChallengeOptions {
   /**
    * Ask Passlock to send the generated one-time-code email.
    *
-   * When omitted or `false`, challenge creation keeps the generate-only
+   * When omitted or `true` emails will be sent via the Passlock infrastructure
+   *
+   * When set to false challenge creation keeps the generate-only
    * behavior and no email is sent by Passlock. The returned `code` and
    * `message` remain available for custom delivery in either mode.
    */