@madauth/server 0.3.0-beta.1 → 0.3.0-beta.2

package/dist/bin.js

@@ -23,14 +23,14 @@ import {
   parseClaims,
   parseRoles,
   passwordAccountKey
-} from "./chunk-ODITZLMM.js";
+} from "./chunk-TI35AZ2U.js";
 import {
   generateSigningKey
 } from "./chunk-JDQLSL36.js";
 import {
   DEV_WEBHOOK_RECEIVER_URL,
   generateWebhookSecret
-} from "./chunk-NPNM26J3.js";
+} from "./chunk-3QRKWLR7.js";
 
 // src/cli.ts
 import { existsSync, readFileSync, rmSync, writeFileSync } from "fs";
@@ -293,7 +293,7 @@ ${name}=${value}
     password && variable("WEBHOOK_SECRET", generateWebhookSecret(), "Signs every webhook call. Your receiver needs the same one."),
     password && variable(
       "WEBHOOK_EVENTS",
-      "email.verify,email.reset,email.already_registered",
+      "email.verify,email.reset,email.already_registered,email.no_password",
       "The types your webhook receiver handles; only these are sent. Add e.g. signup.before or user.created."
     ),
     variable("PORT", String(PORT), "Port the server listens on.")

package/dist/{chunk-NPNM26J3.js → chunk-3QRKWLR7.js}

@@ -4,6 +4,7 @@ var WEBHOOK_TYPES = [
   "email.verify",
   "email.reset",
   "email.already_registered",
+  "email.no_password",
   "signup.before",
   "user.created",
   "email.verified",

package/dist/{chunk-ZSBKNV5W.js → chunk-DVVBIFIV.js}

@@ -34,7 +34,7 @@ import {
   toMadauthUser,
   verifyAgainstDummy,
   verifyPassword
-} from "./chunk-ODITZLMM.js";
+} from "./chunk-TI35AZ2U.js";
 import {
   importSigningKeys
 } from "./chunk-JDQLSL36.js";
@@ -42,7 +42,7 @@ import {
   WEBHOOK_TIMEOUT_MS,
   createWebhookClient,
   localeOf
-} from "./chunk-NPNM26J3.js";
+} from "./chunk-3QRKWLR7.js";
 
 // src/routes/google.ts
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
@@ -324,6 +324,11 @@ function passwordRoutes(app, ctx, password, users, webhook) {
       locale
     });
   };
+  const sendAccountEmail = async (user, type, target, locale) => {
+    if (!webhook.wants(type)) return true;
+    const methods = await users.signInMethods(user.id);
+    return sendEmail(user, type, { link: target.href, site: target.host, locale, methods });
+  };
   const consume = async (data, purpose) => {
     if (typeof data.token === "string" && data.token) {
       return { userId: await users.consumeLinkToken(data.token, purpose), via: "link" };
@@ -391,9 +396,7 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     const passwordHash = await hashPassword(data.password);
     const existing = await users.findByEmail(normalizeEmail(email));
     if (existing?.emailVerified) {
-      if (!webhook.wants("email.already_registered")) return accepted(c);
-      const sent = await sendEmail(existing, "email.already_registered", { link: target.href, site: target.host, locale });
-      return sent ? accepted(c) : unavailable(c);
+      return await sendAccountEmail(existing, "email.already_registered", target, locale) ? accepted(c) : unavailable(c);
     }
     if (existing) {
       if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
@@ -442,8 +445,11 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     if (target instanceof Response) return target;
     if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
     const user = await users.findByEmail(normalizeEmail(data.email));
-    if (user && (user.emailVerified || await users.passwordAccount(user.id))) {
-      if (!await sendLinkEmail(user, "reset", target, localeOf(data.locale))) return unavailable(c);
+    const locale = localeOf(data.locale);
+    if (user && await users.passwordAccount(user.id)) {
+      if (!await sendLinkEmail(user, "reset", target, locale)) return unavailable(c);
+    } else if (user) {
+      if (!await sendAccountEmail(user, "email.no_password", target, locale)) return unavailable(c);
     }
     return accepted(c);
   });
@@ -453,11 +459,10 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     if (policy) return error(c, 400, "weak_password", policy);
     const consumed = await consume(data, "reset");
     const user = consumed.userId ? await users.findById(consumed.userId) : null;
-    if (!user) return invalidVerification(c, consumed);
+    const account = user ? await users.passwordAccount(user.id) : null;
+    if (!user || !account) return invalidVerification(c, consumed);
     const secret = await hashPassword(data.password);
-    const account = await users.passwordAccount(user.id);
-    if (account) await users.updateAccount(account.id, { secret, failedAttempts: 0, lockedUntil: 0 });
-    else await users.linkAccount(user.id, { key: passwordAccountKey(user.id), secret });
+    if (!await users.updateAccount(account.id, { secret, failedAttempts: 0, lockedUntil: 0 })) return invalidVerification(c, consumed);
     const sessionVersion = user.sessionVersion + 1;
     await users.updateUser(user.id, { emailVerified: true, sessionVersion, wrongCodes: 0 });
     await users.clearVerifications(user.id);

package/dist/{chunk-ODITZLMM.js → chunk-TI35AZ2U.js}

@@ -8,7 +8,7 @@ import {
   WEBHOOK_TYPES,
   checkWebhookSecret,
   generateWebhookSecret
-} from "./chunk-NPNM26J3.js";
+} from "./chunk-3QRKWLR7.js";
 
 // src/claims.ts
 var ADMIN_ROLE = "admin";
@@ -216,7 +216,7 @@ MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
   const password = sendsEmails ? { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")) } : void 0;
   if (!clientId && !password) {
     throw new ConfigError(
-      `No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in, and/or a webhook that sends the e-mails for e-mail & password sign-in: for development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered. See docs/server.md.`
+      `No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in, and/or a webhook that sends the e-mails for e-mail & password sign-in: for development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered,email.no_password. See docs/server.md.`
     );
   }
   const store = overrides.store ?? await storeFromDatabaseUrl(read("DATABASE_URL"));
@@ -333,7 +333,7 @@ WEBHOOK_SECRET=${generateWebhookSecret()}
     throw new ConfigError(
       `WEBHOOK_EVENTS is not set. List the types your webhook receiver handles; only these are sent. E-mail & password sign-in is on when they include ${REQUIRED_EMAIL_TYPES.join(" and ")}. For a receiver that sends the e-mails:
 
-WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered
+WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered,email.no_password
 
 For one that only wants to know who signed in:
 
@@ -466,6 +466,12 @@ var Users = class {
   async passwordAccount(userId) {
     return this.findAccountByKey(passwordAccountKey(userId));
   }
+  /** How the user signs in, from their accounts: e.g. `['google']` for a user without a password. */
+  async signInMethods(userId) {
+    const accounts = await this.store.findMany("account", { userId });
+    const methods = accounts.map((account) => String(account.key).split(":")[0]);
+    return SIGN_IN_METHODS.filter((method) => methods.includes(method));
+  }
   async findAccountByKey(key) {
     return await this.store.findOne("account", { key });
   }
@@ -540,8 +546,9 @@ var Users = class {
   async updateUser(id, patch) {
     await this.store.update("user", { id }, patch);
   }
+  /** Changes an account. Resolves to false if it is gone meanwhile. */
   async updateAccount(id, patch) {
-    await this.store.update("account", { id }, patch);
+    return await this.store.update("account", { id }, patch) === 1;
   }
   /**
    * Counts a sign-in attempt: writes `patch` only if the account's `failedAttempts` is still the value that
@@ -635,15 +642,15 @@ export {
   normalizeEmail,
   isValidEmail,
   deriveCodeKey,
-  passwordAccountKey,
-  googleAccountKey,
-  toMadauthUser,
-  Users,
   SIGN_IN_METHODS,
   parseMethodSettings,
   Settings,
   isOn,
   anyOn,
+  passwordAccountKey,
+  googleAccountKey,
+  toMadauthUser,
+  Users,
   envVars,
   resolveEnv,
   ConfigError,

package/dist/{config-DEBYi8hb.d.ts → config-Dg2fZuWR.d.ts}

@@ -1,6 +1,6 @@
 import { JWK, JWTVerifyGetKey } from 'jose';
 import { S as StoreAdapter } from './schema-3yhCc2jH.js';
-import { W as WebhookSettings } from './webhook-DCDP6SaE.js';
+import { W as WebhookSettings } from './webhook-j5u9Kv9l.js';
 
 interface MadauthConfig {
     /** Public base URL of the server (MADAUTH_ISSUER). */

package/dist/entry/azure.d.ts

@@ -1,7 +1,7 @@
-import { E as EntryOptions } from '../config-DEBYi8hb.js';
+import { E as EntryOptions } from '../config-Dg2fZuWR.js';
 import 'jose';
 import '../schema-3yhCc2jH.js';
-import '../webhook-DCDP6SaE.js';
+import '../webhook-j5u9Kv9l.js';
 
 /**
  * Registers madAuth as an Azure Functions v4 HTTP function that handles every route. Pass `store` to use your

package/dist/entry/azure.js

@@ -1,13 +1,13 @@
 import {
   createApp
-} from "../chunk-ZSBKNV5W.js";
+} from "../chunk-DVVBIFIV.js";
 import "../chunk-DCDTO5LG.js";
 import {
   loadConfig,
   resolveEnv
-} from "../chunk-ODITZLMM.js";
+} from "../chunk-TI35AZ2U.js";
 import "../chunk-JDQLSL36.js";
-import "../chunk-NPNM26J3.js";
+import "../chunk-3QRKWLR7.js";
 
 // src/entry/azure.ts
 import { app } from "@azure/functions";

package/dist/entry/lambda.d.ts

@@ -1,8 +1,8 @@
 import { LambdaEvent, LambdaContext, handle } from 'hono/aws-lambda';
-import { E as EntryOptions } from '../config-DEBYi8hb.js';
+import { E as EntryOptions } from '../config-Dg2fZuWR.js';
 import 'jose';
 import '../schema-3yhCc2jH.js';
-import '../webhook-DCDP6SaE.js';
+import '../webhook-j5u9Kv9l.js';
 
 type LambdaHandler = (event: LambdaEvent, context: LambdaContext) => ReturnType<ReturnType<typeof handle>>;
 /**

package/dist/entry/lambda.js

@@ -1,13 +1,13 @@
 import {
   createApp
-} from "../chunk-ZSBKNV5W.js";
+} from "../chunk-DVVBIFIV.js";
 import "../chunk-DCDTO5LG.js";
 import {
   loadConfig,
   resolveEnv
-} from "../chunk-ODITZLMM.js";
+} from "../chunk-TI35AZ2U.js";
 import "../chunk-JDQLSL36.js";
-import "../chunk-NPNM26J3.js";
+import "../chunk-3QRKWLR7.js";
 
 // src/entry/lambda.ts
 import { handle } from "hono/aws-lambda";

package/dist/entry/node.d.ts

@@ -1,7 +1,7 @@
-import { E as EntryOptions } from '../config-DEBYi8hb.js';
+import { E as EntryOptions } from '../config-Dg2fZuWR.js';
 import 'jose';
 import '../schema-3yhCc2jH.js';
-import '../webhook-DCDP6SaE.js';
+import '../webhook-j5u9Kv9l.js';
 
 type StartOptions = EntryOptions;
 /**

package/dist/entry/node.js

@@ -1,13 +1,13 @@
 import {
   createApp
-} from "../chunk-ZSBKNV5W.js";
+} from "../chunk-DVVBIFIV.js";
 import "../chunk-DCDTO5LG.js";
 import {
   loadConfig,
   resolveEnv
-} from "../chunk-ODITZLMM.js";
+} from "../chunk-TI35AZ2U.js";
 import "../chunk-JDQLSL36.js";
-import "../chunk-NPNM26J3.js";
+import "../chunk-3QRKWLR7.js";
 
 // src/entry/node.ts
 import { serve } from "@hono/node-server";

package/dist/index.d.ts

@@ -1,11 +1,11 @@
 import { Hono } from 'hono';
-import { M as MadauthConfig } from './config-DEBYi8hb.js';
-export { C as ConfigError, a as ConfigOverrides, E as EntryOptions, e as envVars, l as loadConfig } from './config-DEBYi8hb.js';
+import { M as MadauthConfig } from './config-Dg2fZuWR.js';
+export { C as ConfigError, a as ConfigOverrides, E as EntryOptions, e as envVars, l as loadConfig } from './config-Dg2fZuWR.js';
 import { JWK } from 'jose';
 import { a as Schema } from './schema-3yhCc2jH.js';
 export { F as FieldDef, b as FieldType, R as Row, S as StoreAdapter, V as Value, W as Where, m as madauthSchema } from './schema-3yhCc2jH.js';
 export { M as MadauthUser } from './user-BMWEWREH.js';
-import './webhook-DCDP6SaE.js';
+import './webhook-j5u9Kv9l.js';
 
 /** Creates a new private ES256 JWK for MADAUTH_SIGNING_KEY. */
 declare function generateSigningKey(): Promise<JWK>;

package/dist/index.js

@@ -10,7 +10,7 @@ import {
 import {
   REDIRECT_ERROR_PARAM,
   createApp
-} from "./chunk-ZSBKNV5W.js";
+} from "./chunk-DVVBIFIV.js";
 import "./chunk-DCDTO5LG.js";
 import {
   ADMIN_ROLE,
@@ -20,11 +20,11 @@ import {
   loadConfig,
   parseClaims,
   parseRoles
-} from "./chunk-ODITZLMM.js";
+} from "./chunk-TI35AZ2U.js";
 import {
   generateSigningKey
 } from "./chunk-JDQLSL36.js";
-import "./chunk-NPNM26J3.js";
+import "./chunk-3QRKWLR7.js";
 export {
   ADMIN_ROLE,
   ConfigError,

package/dist/standalone/azure.mjs

@@ -7910,6 +7910,76 @@ function userFromClaims(claims) {
 
 // src/users.ts
 import { randomBytes as randomBytes2 } from "crypto";
+
+// src/settings.ts
+var SIGN_IN_METHODS = ["google", "password"];
+var METHODS_SETTING = "methods";
+function parseMethodSettings(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
+  const settings = {};
+  for (const [key, value] of Object.entries(input)) {
+    if (!SIGN_IN_METHODS.includes(key) || typeof value !== "boolean") return null;
+    settings[key] = value;
+  }
+  return settings;
+}
+var MAX_TRIES = 3;
+var Settings = class {
+  constructor(store) {
+    this.store = store;
+  }
+  /** The setting's value, or undefined if it was never set. */
+  async get(id) {
+    return (await this.read(id)).value;
+  }
+  /** The stored JSON and what it holds; both undefined if the setting was never set. */
+  async read(id) {
+    const record = await this.store.findOne("setting", { id });
+    if (typeof record?.value !== "string") return {};
+    try {
+      return { json: record.value, value: JSON.parse(record.value) };
+    } catch {
+      return { json: record.value };
+    }
+  }
+  /**
+   * Changes the setting: `apply` gets the current value and returns the new one, or null to refuse the
+   * change. The write only lands if nobody changed the setting since `apply` read it; otherwise `apply` runs
+   * again with the newer value. Resolves to the new value, or null if `apply` refused.
+   * `updatedBy` is the address of the admin, or null for the command line.
+   */
+  async change(id, apply, updatedBy) {
+    for (let attempt = 0; attempt < MAX_TRIES; attempt++) {
+      const { json, value } = await this.read(id);
+      const next = apply(value);
+      if (next === null) return null;
+      const patch = { value: JSON.stringify(next), updatedAt: Date.now(), updatedBy };
+      const written = json === void 0 ? await this.store.create("setting", { id, ...patch }) : await this.store.update("setting", { id, value: json }, patch) === 1;
+      if (written) return next;
+    }
+    throw new Error(`Setting "${id}" kept changing; try again.`);
+  }
+  /** Replaces the setting. */
+  async set(id, value, updatedBy) {
+    await this.change(id, () => value, updatedBy);
+  }
+  /** Which sign-in methods are on; a method that was never switched off is on. */
+  async methods() {
+    return parseMethodSettings(await this.get(METHODS_SETTING)) ?? {};
+  }
+  /** Changes which methods are on, see {@link change}; `apply` gets the methods as they are now. */
+  async changeMethods(apply, updatedBy) {
+    return this.change(METHODS_SETTING, (current) => apply(parseMethodSettings(current) ?? {}), updatedBy);
+  }
+};
+function isOn(method, available, methods) {
+  return available(method) && methods[method] !== false;
+}
+function anyOn(available, methods) {
+  return SIGN_IN_METHODS.some((method) => isOn(method, available, methods));
+}
+
+// src/users.ts
 var MAX_CODE_ATTEMPTS = 5;
 var MAX_WRONG_CODES = 10;
 var newId = (prefix) => `${prefix}_${randomBytes2(16).toString("base64url")}`;
@@ -7947,6 +8017,12 @@ var Users = class {
   async passwordAccount(userId) {
     return this.findAccountByKey(passwordAccountKey(userId));
   }
+  /** How the user signs in, from their accounts: e.g. `['google']` for a user without a password. */
+  async signInMethods(userId) {
+    const accounts = await this.store.findMany("account", { userId });
+    const methods = accounts.map((account) => String(account.key).split(":")[0]);
+    return SIGN_IN_METHODS.filter((method) => methods.includes(method));
+  }
   async findAccountByKey(key) {
     return await this.store.findOne("account", { key });
   }
@@ -8021,8 +8097,9 @@ var Users = class {
   async updateUser(id, patch) {
     await this.store.update("user", { id }, patch);
   }
+  /** Changes an account. Resolves to false if it is gone meanwhile. */
   async updateAccount(id, patch) {
-    await this.store.update("account", { id }, patch);
+    return await this.store.update("account", { id }, patch) === 1;
   }
   /**
    * Counts a sign-in attempt: writes `patch` only if the account's `failedAttempts` is still the value that
@@ -8107,6 +8184,7 @@ var WEBHOOK_TYPES = [
   "email.verify",
   "email.reset",
   "email.already_registered",
+  "email.no_password",
   "signup.before",
   "user.created",
   "email.verified",
@@ -8416,6 +8494,11 @@ function passwordRoutes(app2, ctx, password, users, webhook) {
       locale
     });
   };
+  const sendAccountEmail = async (user, type, target, locale) => {
+    if (!webhook.wants(type)) return true;
+    const methods = await users.signInMethods(user.id);
+    return sendEmail(user, type, { link: target.href, site: target.host, locale, methods });
+  };
   const consume = async (data, purpose) => {
     if (typeof data.token === "string" && data.token) {
       return { userId: await users.consumeLinkToken(data.token, purpose), via: "link" };
@@ -8483,9 +8566,7 @@ function passwordRoutes(app2, ctx, password, users, webhook) {
     const passwordHash = await hashPassword(data.password);
     const existing = await users.findByEmail(normalizeEmail(email));
     if (existing?.emailVerified) {
-      if (!webhook.wants("email.already_registered")) return accepted(c);
-      const sent = await sendEmail(existing, "email.already_registered", { link: target.href, site: target.host, locale });
-      return sent ? accepted(c) : unavailable(c);
+      return await sendAccountEmail(existing, "email.already_registered", target, locale) ? accepted(c) : unavailable(c);
     }
     if (existing) {
       if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
@@ -8534,8 +8615,11 @@ function passwordRoutes(app2, ctx, password, users, webhook) {
     if (target instanceof Response) return target;
     if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
     const user = await users.findByEmail(normalizeEmail(data.email));
-    if (user && (user.emailVerified || await users.passwordAccount(user.id))) {
-      if (!await sendLinkEmail(user, "reset", target, localeOf(data.locale))) return unavailable(c);
+    const locale = localeOf(data.locale);
+    if (user && await users.passwordAccount(user.id)) {
+      if (!await sendLinkEmail(user, "reset", target, locale)) return unavailable(c);
+    } else if (user) {
+      if (!await sendAccountEmail(user, "email.no_password", target, locale)) return unavailable(c);
     }
     return accepted(c);
   });
@@ -8545,11 +8629,10 @@ function passwordRoutes(app2, ctx, password, users, webhook) {
     if (policy) return error(c, 400, "weak_password", policy);
     const consumed = await consume(data, "reset");
     const user = consumed.userId ? await users.findById(consumed.userId) : null;
-    if (!user) return invalidVerification(c, consumed);
+    const account = user ? await users.passwordAccount(user.id) : null;
+    if (!user || !account) return invalidVerification(c, consumed);
     const secret = await hashPassword(data.password);
-    const account = await users.passwordAccount(user.id);
-    if (account) await users.updateAccount(account.id, { secret, failedAttempts: 0, lockedUntil: 0 });
-    else await users.linkAccount(user.id, { key: passwordAccountKey(user.id), secret });
+    if (!await users.updateAccount(account.id, { secret, failedAttempts: 0, lockedUntil: 0 })) return invalidVerification(c, consumed);
     const sessionVersion = user.sessionVersion + 1;
     await users.updateUser(user.id, { emailVerified: true, sessionVersion, wrongCodes: 0 });
     await users.clearVerifications(user.id);
@@ -8560,74 +8643,6 @@ function passwordRoutes(app2, ctx, password, users, webhook) {
   });
 }
 
-// src/settings.ts
-var SIGN_IN_METHODS = ["google", "password"];
-var METHODS_SETTING = "methods";
-function parseMethodSettings(input) {
-  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
-  const settings = {};
-  for (const [key, value] of Object.entries(input)) {
-    if (!SIGN_IN_METHODS.includes(key) || typeof value !== "boolean") return null;
-    settings[key] = value;
-  }
-  return settings;
-}
-var MAX_TRIES = 3;
-var Settings = class {
-  constructor(store) {
-    this.store = store;
-  }
-  /** The setting's value, or undefined if it was never set. */
-  async get(id) {
-    return (await this.read(id)).value;
-  }
-  /** The stored JSON and what it holds; both undefined if the setting was never set. */
-  async read(id) {
-    const record = await this.store.findOne("setting", { id });
-    if (typeof record?.value !== "string") return {};
-    try {
-      return { json: record.value, value: JSON.parse(record.value) };
-    } catch {
-      return { json: record.value };
-    }
-  }
-  /**
-   * Changes the setting: `apply` gets the current value and returns the new one, or null to refuse the
-   * change. The write only lands if nobody changed the setting since `apply` read it; otherwise `apply` runs
-   * again with the newer value. Resolves to the new value, or null if `apply` refused.
-   * `updatedBy` is the address of the admin, or null for the command line.
-   */
-  async change(id, apply, updatedBy) {
-    for (let attempt = 0; attempt < MAX_TRIES; attempt++) {
-      const { json, value } = await this.read(id);
-      const next = apply(value);
-      if (next === null) return null;
-      const patch = { value: JSON.stringify(next), updatedAt: Date.now(), updatedBy };
-      const written = json === void 0 ? await this.store.create("setting", { id, ...patch }) : await this.store.update("setting", { id, value: json }, patch) === 1;
-      if (written) return next;
-    }
-    throw new Error(`Setting "${id}" kept changing; try again.`);
-  }
-  /** Replaces the setting. */
-  async set(id, value, updatedBy) {
-    await this.change(id, () => value, updatedBy);
-  }
-  /** Which sign-in methods are on; a method that was never switched off is on. */
-  async methods() {
-    return parseMethodSettings(await this.get(METHODS_SETTING)) ?? {};
-  }
-  /** Changes which methods are on, see {@link change}; `apply` gets the methods as they are now. */
-  async changeMethods(apply, updatedBy) {
-    return this.change(METHODS_SETTING, (current) => apply(parseMethodSettings(current) ?? {}), updatedBy);
-  }
-};
-function isOn(method, available, methods) {
-  return available(method) && methods[method] !== false;
-}
-function anyOn(available, methods) {
-  return SIGN_IN_METHODS.some((method) => isOn(method, available, methods));
-}
-
 // src/app.ts
 var EVENT_TIMEOUT_MS = 5e3;
 function createApp(config) {
@@ -8933,7 +8948,7 @@ MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
   const password = sendsEmails ? { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")) } : void 0;
   if (!clientId && !password) {
     throw new ConfigError(
-      `No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in, and/or a webhook that sends the e-mails for e-mail & password sign-in: for development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered. See docs/server.md.`
+      `No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in, and/or a webhook that sends the e-mails for e-mail & password sign-in: for development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered,email.no_password. See docs/server.md.`
     );
   }
   const store = overrides.store ?? await storeFromDatabaseUrl(read("DATABASE_URL"));
@@ -9042,7 +9057,7 @@ WEBHOOK_SECRET=${generateWebhookSecret()}
     throw new ConfigError(
       `WEBHOOK_EVENTS is not set. List the types your webhook receiver handles; only these are sent. E-mail & password sign-in is on when they include ${REQUIRED_EMAIL_TYPES.join(" and ")}. For a receiver that sends the e-mails:
 
-WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered
+WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered,email.no_password
 
 For one that only wants to know who signed in:
 

package/dist/standalone/lambda.mjs

@@ -4062,6 +4062,76 @@ function userFromClaims(claims) {
 
 // src/users.ts
 import { randomBytes as randomBytes2 } from "crypto";
+
+// src/settings.ts
+var SIGN_IN_METHODS = ["google", "password"];
+var METHODS_SETTING = "methods";
+function parseMethodSettings(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
+  const settings = {};
+  for (const [key, value] of Object.entries(input)) {
+    if (!SIGN_IN_METHODS.includes(key) || typeof value !== "boolean") return null;
+    settings[key] = value;
+  }
+  return settings;
+}
+var MAX_TRIES = 3;
+var Settings = class {
+  constructor(store) {
+    this.store = store;
+  }
+  /** The setting's value, or undefined if it was never set. */
+  async get(id) {
+    return (await this.read(id)).value;
+  }
+  /** The stored JSON and what it holds; both undefined if the setting was never set. */
+  async read(id) {
+    const record = await this.store.findOne("setting", { id });
+    if (typeof record?.value !== "string") return {};
+    try {
+      return { json: record.value, value: JSON.parse(record.value) };
+    } catch {
+      return { json: record.value };
+    }
+  }
+  /**
+   * Changes the setting: `apply` gets the current value and returns the new one, or null to refuse the
+   * change. The write only lands if nobody changed the setting since `apply` read it; otherwise `apply` runs
+   * again with the newer value. Resolves to the new value, or null if `apply` refused.
+   * `updatedBy` is the address of the admin, or null for the command line.
+   */
+  async change(id, apply, updatedBy) {
+    for (let attempt = 0; attempt < MAX_TRIES; attempt++) {
+      const { json, value } = await this.read(id);
+      const next = apply(value);
+      if (next === null) return null;
+      const patch = { value: JSON.stringify(next), updatedAt: Date.now(), updatedBy };
+      const written = json === void 0 ? await this.store.create("setting", { id, ...patch }) : await this.store.update("setting", { id, value: json }, patch) === 1;
+      if (written) return next;
+    }
+    throw new Error(`Setting "${id}" kept changing; try again.`);
+  }
+  /** Replaces the setting. */
+  async set(id, value, updatedBy) {
+    await this.change(id, () => value, updatedBy);
+  }
+  /** Which sign-in methods are on; a method that was never switched off is on. */
+  async methods() {
+    return parseMethodSettings(await this.get(METHODS_SETTING)) ?? {};
+  }
+  /** Changes which methods are on, see {@link change}; `apply` gets the methods as they are now. */
+  async changeMethods(apply, updatedBy) {
+    return this.change(METHODS_SETTING, (current) => apply(parseMethodSettings(current) ?? {}), updatedBy);
+  }
+};
+function isOn(method, available, methods) {
+  return available(method) && methods[method] !== false;
+}
+function anyOn(available, methods) {
+  return SIGN_IN_METHODS.some((method) => isOn(method, available, methods));
+}
+
+// src/users.ts
 var MAX_CODE_ATTEMPTS = 5;
 var MAX_WRONG_CODES = 10;
 var newId = (prefix) => `${prefix}_${randomBytes2(16).toString("base64url")}`;
@@ -4099,6 +4169,12 @@ var Users = class {
   async passwordAccount(userId) {
     return this.findAccountByKey(passwordAccountKey(userId));
   }
+  /** How the user signs in, from their accounts: e.g. `['google']` for a user without a password. */
+  async signInMethods(userId) {
+    const accounts = await this.store.findMany("account", { userId });
+    const methods = accounts.map((account) => String(account.key).split(":")[0]);
+    return SIGN_IN_METHODS.filter((method) => methods.includes(method));
+  }
   async findAccountByKey(key) {
     return await this.store.findOne("account", { key });
   }
@@ -4173,8 +4249,9 @@ var Users = class {
   async updateUser(id, patch) {
     await this.store.update("user", { id }, patch);
   }
+  /** Changes an account. Resolves to false if it is gone meanwhile. */
   async updateAccount(id, patch) {
-    await this.store.update("account", { id }, patch);
+    return await this.store.update("account", { id }, patch) === 1;
   }
   /**
    * Counts a sign-in attempt: writes `patch` only if the account's `failedAttempts` is still the value that
@@ -4259,6 +4336,7 @@ var WEBHOOK_TYPES = [
   "email.verify",
   "email.reset",
   "email.already_registered",
+  "email.no_password",
   "signup.before",
   "user.created",
   "email.verified",
@@ -4568,6 +4646,11 @@ function passwordRoutes(app, ctx, password, users, webhook) {
       locale
     });
   };
+  const sendAccountEmail = async (user, type, target, locale) => {
+    if (!webhook.wants(type)) return true;
+    const methods = await users.signInMethods(user.id);
+    return sendEmail(user, type, { link: target.href, site: target.host, locale, methods });
+  };
   const consume = async (data, purpose) => {
     if (typeof data.token === "string" && data.token) {
       return { userId: await users.consumeLinkToken(data.token, purpose), via: "link" };
@@ -4635,9 +4718,7 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     const passwordHash = await hashPassword(data.password);
     const existing = await users.findByEmail(normalizeEmail(email));
     if (existing?.emailVerified) {
-      if (!webhook.wants("email.already_registered")) return accepted(c);
-      const sent = await sendEmail(existing, "email.already_registered", { link: target.href, site: target.host, locale });
-      return sent ? accepted(c) : unavailable(c);
+      return await sendAccountEmail(existing, "email.already_registered", target, locale) ? accepted(c) : unavailable(c);
     }
     if (existing) {
       if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c);
@@ -4686,8 +4767,11 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     if (target instanceof Response) return target;
     if (!isValidEmail(data.email)) return error(c, 400, "invalid_email", "This is not a valid e-mail address.");
     const user = await users.findByEmail(normalizeEmail(data.email));
-    if (user && (user.emailVerified || await users.passwordAccount(user.id))) {
-      if (!await sendLinkEmail(user, "reset", target, localeOf(data.locale))) return unavailable(c);
+    const locale = localeOf(data.locale);
+    if (user && await users.passwordAccount(user.id)) {
+      if (!await sendLinkEmail(user, "reset", target, locale)) return unavailable(c);
+    } else if (user) {
+      if (!await sendAccountEmail(user, "email.no_password", target, locale)) return unavailable(c);
     }
     return accepted(c);
   });
@@ -4697,11 +4781,10 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     if (policy) return error(c, 400, "weak_password", policy);
     const consumed = await consume(data, "reset");
     const user = consumed.userId ? await users.findById(consumed.userId) : null;
-    if (!user) return invalidVerification(c, consumed);
+    const account = user ? await users.passwordAccount(user.id) : null;
+    if (!user || !account) return invalidVerification(c, consumed);
     const secret = await hashPassword(data.password);
-    const account = await users.passwordAccount(user.id);
-    if (account) await users.updateAccount(account.id, { secret, failedAttempts: 0, lockedUntil: 0 });
-    else await users.linkAccount(user.id, { key: passwordAccountKey(user.id), secret });
+    if (!await users.updateAccount(account.id, { secret, failedAttempts: 0, lockedUntil: 0 })) return invalidVerification(c, consumed);
     const sessionVersion = user.sessionVersion + 1;
     await users.updateUser(user.id, { emailVerified: true, sessionVersion, wrongCodes: 0 });
     await users.clearVerifications(user.id);
@@ -4712,74 +4795,6 @@ function passwordRoutes(app, ctx, password, users, webhook) {
   });
 }
 
-// src/settings.ts
-var SIGN_IN_METHODS = ["google", "password"];
-var METHODS_SETTING = "methods";
-function parseMethodSettings(input) {
-  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
-  const settings = {};
-  for (const [key, value] of Object.entries(input)) {
-    if (!SIGN_IN_METHODS.includes(key) || typeof value !== "boolean") return null;
-    settings[key] = value;
-  }
-  return settings;
-}
-var MAX_TRIES = 3;
-var Settings = class {
-  constructor(store) {
-    this.store = store;
-  }
-  /** The setting's value, or undefined if it was never set. */
-  async get(id) {
-    return (await this.read(id)).value;
-  }
-  /** The stored JSON and what it holds; both undefined if the setting was never set. */
-  async read(id) {
-    const record = await this.store.findOne("setting", { id });
-    if (typeof record?.value !== "string") return {};
-    try {
-      return { json: record.value, value: JSON.parse(record.value) };
-    } catch {
-      return { json: record.value };
-    }
-  }
-  /**
-   * Changes the setting: `apply` gets the current value and returns the new one, or null to refuse the
-   * change. The write only lands if nobody changed the setting since `apply` read it; otherwise `apply` runs
-   * again with the newer value. Resolves to the new value, or null if `apply` refused.
-   * `updatedBy` is the address of the admin, or null for the command line.
-   */
-  async change(id, apply, updatedBy) {
-    for (let attempt = 0; attempt < MAX_TRIES; attempt++) {
-      const { json, value } = await this.read(id);
-      const next = apply(value);
-      if (next === null) return null;
-      const patch = { value: JSON.stringify(next), updatedAt: Date.now(), updatedBy };
-      const written = json === void 0 ? await this.store.create("setting", { id, ...patch }) : await this.store.update("setting", { id, value: json }, patch) === 1;
-      if (written) return next;
-    }
-    throw new Error(`Setting "${id}" kept changing; try again.`);
-  }
-  /** Replaces the setting. */
-  async set(id, value, updatedBy) {
-    await this.change(id, () => value, updatedBy);
-  }
-  /** Which sign-in methods are on; a method that was never switched off is on. */
-  async methods() {
-    return parseMethodSettings(await this.get(METHODS_SETTING)) ?? {};
-  }
-  /** Changes which methods are on, see {@link change}; `apply` gets the methods as they are now. */
-  async changeMethods(apply, updatedBy) {
-    return this.change(METHODS_SETTING, (current) => apply(parseMethodSettings(current) ?? {}), updatedBy);
-  }
-};
-function isOn(method, available, methods) {
-  return available(method) && methods[method] !== false;
-}
-function anyOn(available, methods) {
-  return SIGN_IN_METHODS.some((method) => isOn(method, available, methods));
-}
-
 // src/app.ts
 var EVENT_TIMEOUT_MS = 5e3;
 function createApp(config) {
@@ -5085,7 +5100,7 @@ MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
   const password = sendsEmails ? { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")) } : void 0;
   if (!clientId && !password) {
     throw new ConfigError(
-      `No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in, and/or a webhook that sends the e-mails for e-mail & password sign-in: for development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered. See docs/server.md.`
+      `No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in, and/or a webhook that sends the e-mails for e-mail & password sign-in: for development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered,email.no_password. See docs/server.md.`
     );
   }
   const store = overrides.store ?? await storeFromDatabaseUrl(read("DATABASE_URL"));
@@ -5194,7 +5209,7 @@ WEBHOOK_SECRET=${generateWebhookSecret()}
     throw new ConfigError(
       `WEBHOOK_EVENTS is not set. List the types your webhook receiver handles; only these are sent. E-mail & password sign-in is on when they include ${REQUIRED_EMAIL_TYPES.join(" and ")}. For a receiver that sends the e-mails:
 
-WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered
+WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered,email.no_password
 
 For one that only wants to know who signed in:
 

package/dist/standalone/main.mjs

@@ -30020,6 +30020,7 @@ var WEBHOOK_TYPES = [
   "email.verify",
   "email.reset",
   "email.already_registered",
+  "email.no_password",
   "signup.before",
   "user.created",
   "email.verified",
@@ -30158,7 +30159,7 @@ MADAUTH_SIGNING_KEY='${JSON.stringify(key)}'
   const password = sendsEmails ? { minLength: passwordMinLength(read("PASSWORD_MIN_LENGTH")) } : void 0;
   if (!clientId && !password) {
     throw new ConfigError(
-      `No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in, and/or a webhook that sends the e-mails for e-mail & password sign-in: for development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered. See docs/server.md.`
+      `No sign-in method is configured. Set GOOGLE_CLIENT_ID for Google sign-in, and/or a webhook that sends the e-mails for e-mail & password sign-in: for development, run the receiver at ${DEV_WEBHOOK_RECEIVER_URL} and set WEBHOOK_URL=http://localhost:8790/webhook and WEBHOOK_EVENTS=${REQUIRED_EMAIL_TYPES.join(",")},email.already_registered,email.no_password. See docs/server.md.`
     );
   }
   const store = overrides.store ?? await storeFromDatabaseUrl(read("DATABASE_URL"));
@@ -30267,7 +30268,7 @@ WEBHOOK_SECRET=${generateWebhookSecret()}
     throw new ConfigError(
       `WEBHOOK_EVENTS is not set. List the types your webhook receiver handles; only these are sent. E-mail & password sign-in is on when they include ${REQUIRED_EMAIL_TYPES.join(" and ")}. For a receiver that sends the e-mails:
 
-WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered
+WEBHOOK_EVENTS=email.verify,email.reset,email.already_registered,email.no_password
 
 For one that only wants to know who signed in:
 
@@ -33803,6 +33804,76 @@ function userFromClaims(claims) {
 
 // src/users.ts
 import { randomBytes as randomBytes3 } from "crypto";
+
+// src/settings.ts
+var SIGN_IN_METHODS = ["google", "password"];
+var METHODS_SETTING = "methods";
+function parseMethodSettings(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
+  const settings = {};
+  for (const [key, value] of Object.entries(input)) {
+    if (!SIGN_IN_METHODS.includes(key) || typeof value !== "boolean") return null;
+    settings[key] = value;
+  }
+  return settings;
+}
+var MAX_TRIES = 3;
+var Settings = class {
+  constructor(store) {
+    this.store = store;
+  }
+  /** The setting's value, or undefined if it was never set. */
+  async get(id) {
+    return (await this.read(id)).value;
+  }
+  /** The stored JSON and what it holds; both undefined if the setting was never set. */
+  async read(id) {
+    const record = await this.store.findOne("setting", { id });
+    if (typeof record?.value !== "string") return {};
+    try {
+      return { json: record.value, value: JSON.parse(record.value) };
+    } catch {
+      return { json: record.value };
+    }
+  }
+  /**
+   * Changes the setting: `apply` gets the current value and returns the new one, or null to refuse the
+   * change. The write only lands if nobody changed the setting since `apply` read it; otherwise `apply` runs
+   * again with the newer value. Resolves to the new value, or null if `apply` refused.
+   * `updatedBy` is the address of the admin, or null for the command line.
+   */
+  async change(id, apply, updatedBy) {
+    for (let attempt = 0; attempt < MAX_TRIES; attempt++) {
+      const { json: json2, value } = await this.read(id);
+      const next = apply(value);
+      if (next === null) return null;
+      const patch = { value: JSON.stringify(next), updatedAt: Date.now(), updatedBy };
+      const written = json2 === void 0 ? await this.store.create("setting", { id, ...patch }) : await this.store.update("setting", { id, value: json2 }, patch) === 1;
+      if (written) return next;
+    }
+    throw new Error(`Setting "${id}" kept changing; try again.`);
+  }
+  /** Replaces the setting. */
+  async set(id, value, updatedBy) {
+    await this.change(id, () => value, updatedBy);
+  }
+  /** Which sign-in methods are on; a method that was never switched off is on. */
+  async methods() {
+    return parseMethodSettings(await this.get(METHODS_SETTING)) ?? {};
+  }
+  /** Changes which methods are on, see {@link change}; `apply` gets the methods as they are now. */
+  async changeMethods(apply, updatedBy) {
+    return this.change(METHODS_SETTING, (current) => apply(parseMethodSettings(current) ?? {}), updatedBy);
+  }
+};
+function isOn(method, available, methods) {
+  return available(method) && methods[method] !== false;
+}
+function anyOn(available, methods) {
+  return SIGN_IN_METHODS.some((method) => isOn(method, available, methods));
+}
+
+// src/users.ts
 var MAX_CODE_ATTEMPTS = 5;
 var MAX_WRONG_CODES = 10;
 var newId = (prefix) => `${prefix}_${randomBytes3(16).toString("base64url")}`;
@@ -33840,6 +33911,12 @@ var Users = class {
   async passwordAccount(userId) {
     return this.findAccountByKey(passwordAccountKey(userId));
   }
+  /** How the user signs in, from their accounts: e.g. `['google']` for a user without a password. */
+  async signInMethods(userId) {
+    const accounts = await this.store.findMany("account", { userId });
+    const methods = accounts.map((account) => String(account.key).split(":")[0]);
+    return SIGN_IN_METHODS.filter((method) => methods.includes(method));
+  }
   async findAccountByKey(key) {
     return await this.store.findOne("account", { key });
   }
@@ -33914,8 +33991,9 @@ var Users = class {
   async updateUser(id, patch) {
     await this.store.update("user", { id }, patch);
   }
+  /** Changes an account. Resolves to false if it is gone meanwhile. */
   async updateAccount(id, patch) {
-    await this.store.update("account", { id }, patch);
+    return await this.store.update("account", { id }, patch) === 1;
   }
   /**
    * Counts a sign-in attempt: writes `patch` only if the account's `failedAttempts` is still the value that
@@ -34231,6 +34309,11 @@ function passwordRoutes(app, ctx, password, users, webhook) {
       locale
     });
   };
+  const sendAccountEmail = async (user, type, target, locale) => {
+    if (!webhook.wants(type)) return true;
+    const methods = await users.signInMethods(user.id);
+    return sendEmail(user, type, { link: target.href, site: target.host, locale, methods });
+  };
   const consume = async (data, purpose) => {
     if (typeof data.token === "string" && data.token) {
       return { userId: await users.consumeLinkToken(data.token, purpose), via: "link" };
@@ -34298,9 +34381,7 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     const passwordHash = await hashPassword(data.password);
     const existing = await users.findByEmail(normalizeEmail(email));
     if (existing?.emailVerified) {
-      if (!webhook.wants("email.already_registered")) return accepted(c6);
-      const sent = await sendEmail(existing, "email.already_registered", { link: target.href, site: target.host, locale });
-      return sent ? accepted(c6) : unavailable(c6);
+      return await sendAccountEmail(existing, "email.already_registered", target, locale) ? accepted(c6) : unavailable(c6);
     }
     if (existing) {
       if (Date.now() - existing.lastMailAt < MAIL_INTERVAL_MS) return accepted(c6);
@@ -34349,8 +34430,11 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     if (target instanceof Response) return target;
     if (!isValidEmail(data.email)) return error(c6, 400, "invalid_email", "This is not a valid e-mail address.");
     const user = await users.findByEmail(normalizeEmail(data.email));
-    if (user && (user.emailVerified || await users.passwordAccount(user.id))) {
-      if (!await sendLinkEmail(user, "reset", target, localeOf(data.locale))) return unavailable(c6);
+    const locale = localeOf(data.locale);
+    if (user && await users.passwordAccount(user.id)) {
+      if (!await sendLinkEmail(user, "reset", target, locale)) return unavailable(c6);
+    } else if (user) {
+      if (!await sendAccountEmail(user, "email.no_password", target, locale)) return unavailable(c6);
     }
     return accepted(c6);
   });
@@ -34360,11 +34444,10 @@ function passwordRoutes(app, ctx, password, users, webhook) {
     if (policy) return error(c6, 400, "weak_password", policy);
     const consumed = await consume(data, "reset");
     const user = consumed.userId ? await users.findById(consumed.userId) : null;
-    if (!user) return invalidVerification(c6, consumed);
+    const account = user ? await users.passwordAccount(user.id) : null;
+    if (!user || !account) return invalidVerification(c6, consumed);
     const secret = await hashPassword(data.password);
-    const account = await users.passwordAccount(user.id);
-    if (account) await users.updateAccount(account.id, { secret, failedAttempts: 0, lockedUntil: 0 });
-    else await users.linkAccount(user.id, { key: passwordAccountKey(user.id), secret });
+    if (!await users.updateAccount(account.id, { secret, failedAttempts: 0, lockedUntil: 0 })) return invalidVerification(c6, consumed);
     const sessionVersion = user.sessionVersion + 1;
     await users.updateUser(user.id, { emailVerified: true, sessionVersion, wrongCodes: 0 });
     await users.clearVerifications(user.id);
@@ -34375,74 +34458,6 @@ function passwordRoutes(app, ctx, password, users, webhook) {
   });
 }
 
-// src/settings.ts
-var SIGN_IN_METHODS = ["google", "password"];
-var METHODS_SETTING = "methods";
-function parseMethodSettings(input) {
-  if (!input || typeof input !== "object" || Array.isArray(input)) return null;
-  const settings = {};
-  for (const [key, value] of Object.entries(input)) {
-    if (!SIGN_IN_METHODS.includes(key) || typeof value !== "boolean") return null;
-    settings[key] = value;
-  }
-  return settings;
-}
-var MAX_TRIES = 3;
-var Settings = class {
-  constructor(store) {
-    this.store = store;
-  }
-  /** The setting's value, or undefined if it was never set. */
-  async get(id) {
-    return (await this.read(id)).value;
-  }
-  /** The stored JSON and what it holds; both undefined if the setting was never set. */
-  async read(id) {
-    const record = await this.store.findOne("setting", { id });
-    if (typeof record?.value !== "string") return {};
-    try {
-      return { json: record.value, value: JSON.parse(record.value) };
-    } catch {
-      return { json: record.value };
-    }
-  }
-  /**
-   * Changes the setting: `apply` gets the current value and returns the new one, or null to refuse the
-   * change. The write only lands if nobody changed the setting since `apply` read it; otherwise `apply` runs
-   * again with the newer value. Resolves to the new value, or null if `apply` refused.
-   * `updatedBy` is the address of the admin, or null for the command line.
-   */
-  async change(id, apply, updatedBy) {
-    for (let attempt = 0; attempt < MAX_TRIES; attempt++) {
-      const { json: json2, value } = await this.read(id);
-      const next = apply(value);
-      if (next === null) return null;
-      const patch = { value: JSON.stringify(next), updatedAt: Date.now(), updatedBy };
-      const written = json2 === void 0 ? await this.store.create("setting", { id, ...patch }) : await this.store.update("setting", { id, value: json2 }, patch) === 1;
-      if (written) return next;
-    }
-    throw new Error(`Setting "${id}" kept changing; try again.`);
-  }
-  /** Replaces the setting. */
-  async set(id, value, updatedBy) {
-    await this.change(id, () => value, updatedBy);
-  }
-  /** Which sign-in methods are on; a method that was never switched off is on. */
-  async methods() {
-    return parseMethodSettings(await this.get(METHODS_SETTING)) ?? {};
-  }
-  /** Changes which methods are on, see {@link change}; `apply` gets the methods as they are now. */
-  async changeMethods(apply, updatedBy) {
-    return this.change(METHODS_SETTING, (current) => apply(parseMethodSettings(current) ?? {}), updatedBy);
-  }
-};
-function isOn(method, available, methods) {
-  return available(method) && methods[method] !== false;
-}
-function anyOn(available, methods) {
-  return SIGN_IN_METHODS.some((method) => isOn(method, available, methods));
-}
-
 // src/app.ts
 var EVENT_TIMEOUT_MS = 5e3;
 function createApp(config) {

package/dist/{webhook-DCDP6SaE.d.ts → webhook-j5u9Kv9l.d.ts}

@@ -1,5 +1,5 @@
 /** Every `type` madAuth sends. */
-declare const WEBHOOK_TYPES: readonly ["email.verify", "email.reset", "email.already_registered", "signup.before", "user.created", "email.verified", "email.password_reset", "user.signed_in", "user.deleted", "user.claims_changed"];
+declare const WEBHOOK_TYPES: readonly ["email.verify", "email.reset", "email.already_registered", "email.no_password", "signup.before", "user.created", "email.verified", "email.password_reset", "user.signed_in", "user.deleted", "user.claims_changed"];
 type WebhookType = (typeof WEBHOOK_TYPES)[number];
 /** How old a call may be before receivers reject it, so a captured call can't be replayed. */
 declare const WEBHOOK_TOLERANCE_SECONDS: number;

package/dist/webhook.d.ts

@@ -1 +1 @@
-export { a as WEBHOOK_TOLERANCE_SECONDS, b as WEBHOOK_TYPES, c as WebhookType, g as generateWebhookSecret, s as signWebhook, v as verifyWebhook } from './webhook-DCDP6SaE.js';
+export { a as WEBHOOK_TOLERANCE_SECONDS, b as WEBHOOK_TYPES, c as WebhookType, g as generateWebhookSecret, s as signWebhook, v as verifyWebhook } from './webhook-j5u9Kv9l.js';

package/dist/webhook.js

@@ -4,7 +4,7 @@ import {
   generateWebhookSecret,
   signWebhook,
   verifyWebhook
-} from "./chunk-NPNM26J3.js";
+} from "./chunk-3QRKWLR7.js";
 export {
   WEBHOOK_TOLERANCE_SECONDS,
   WEBHOOK_TYPES,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@madauth/server",
-  "version": "0.3.0-beta.1",
+  "version": "0.3.0-beta.2",
   "description": "madAuth server: Google and e-mail & password sign-in with madAuth sessions, for Docker, AWS Lambda and Azure Functions.",
   "license": "MIT",
   "author": "David Neuy",