@nxgt/janus-mail 0.7.0 → 0.7.1

package/README.md

@@ -165,7 +165,10 @@ await mail.verifyEmail(issued, { name: user.name, locale: 'fr' }, { expiresIn: '
 ### Telling a user their password or e-mail changed
 
 `@nxgt/janus` 0.14 sends `user.passwordChanged` once `changePassword` or
-`setPassword` wrote the password, and `user.emailChanged` once `update`
+`setPassword` wrote the password — and 0.16 once `signInCode.confirm` or
+`magicLink.confirm` dropped a password when proving the e-mail for the
+first time, so the inbox's owner hears of a password someone else had set —
+and `user.emailChanged` once `update`
 changed the e-mail. The e-mail change is told to the **former** address — the
 new one belongs to whoever changed it — which the event carries as
 `formerEmail`, `null` for a user who had none:
@@ -195,8 +198,11 @@ see [Sending](docs/guide/sending.md#emailchangedto).
 
 `@nxgt/janus` sends `user.secondFactorEnabled` once `secondFactor.activate`
 made the factor active, and `user.secondFactorDisabled` once
-`secondFactor.disable` removed an active one — never for a user who had
-none. The event names the user by id, so read the rest from the user:
+`secondFactor.disable` removed an active one — and, from 0.16, once
+`signInCode.confirm` or `magicLink.confirm` removed one when proving the
+e-mail for the first time, so the inbox's owner hears of a factor someone else
+had set — never for a user who had none. The event names the user by id, so
+read the rest from the user:
 
 ```ts
 const auth = janus({

package/docs/guide/sending.md

@@ -161,8 +161,10 @@ const auth = janus({
 
 A notice: the password of the account at `to.email` changed, with a link to
 `links.secureAccount()` for a user who did not change it. Send it on the
-`user.passwordChanged` event, which `changePassword` and `setPassword` send.
-A reset sends `user.passwordReset` instead, never both: to tell a reset too,
+`user.passwordChanged` event, which `changePassword` and `setPassword` send —
+and, from `@nxgt/janus` 0.16, `signInCode.confirm` and `magicLink.confirm`
+when their first proof of the e-mail dropped a password someone may have set
+without holding the inbox. A reset sends `user.passwordReset` instead, never both: to tell a reset too,
 send the same notice on that type — `event.type === 'user.passwordChanged'
 || event.type === 'user.passwordReset'`. The event names the user by id
 alone, so read the name, the locale and the address from the user.
@@ -210,17 +212,21 @@ const auth = janus({
 });
 ```
 
-Two notices: two-factor authentication was turned on, or off, for the
-account at `to.email`, each with a link to `links.secureAccount()` — the
-user's security settings — for a user who did not make the change. Send
+Two notices: two-factor authentication was turned on, or off, for the account
+at `to.email`, each with a link to `links.secureAccount()` — the user's
+security settings — for a user who did not make the change. Send
 `twoFactorEnabled` on the `user.secondFactorEnabled` event, which
 `auth.secondFactor.activate` sends once the factor is active, and
 `twoFactorDisabled` on `user.secondFactorDisabled`, which
 `auth.secondFactor.disable` sends only when it removed an active factor: a
-`disable` on a user who had none tells nobody anything. The event names the
-user by id alone, so read the name, the locale and the address from the
-user. Calling them right after `activate` or `disable` answered works as
-well — without the events, check `hasSecondFactor` before the `disable`.
+`disable` on a user who had none tells nobody anything. From `@nxgt/janus`
+0.16, `signInCode.confirm` and `magicLink.confirm` send it too when their
+first proof of the e-mail removed a factor someone may have enrolled without
+holding the inbox — after `user.passwordChanged`, so the inbox's owner gets
+both notices. The event names the user by id alone, so read the name, the
+locale and the address from the user. Calling them right after `activate` or
+`disable` answered works as well — without the events, check `hasSecondFactor`
+before the `disable`.
 
 ### `welcome(to)`
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@nxgt/janus-mail",
-	"version": "0.7.0",
+	"version": "0.7.1",
 	"description": "The e-mails of @nxgt/janus's flows — e-mail verification, password reset, sign-in code, sign-in link, password changed, e-mail changed, two-factor enabled and disabled, recovery code used, welcome — rendered in English and French from a prebuilt Maizzle build, with your brand, sent through any @nxgt/mail transport",
 	"license": "MIT",
 	"type": "module",
@@ -54,7 +54,7 @@
 		"@maizzle/framework": "6.1.7",
 		"@maizzle/tailwindcss": "1.5.6",
 		"@formatjs/icu-messageformat-parser": "3.5.20",
-		"@nxgt/janus": "^0.15.0",
+		"@nxgt/janus": "^0.16.0",
 		"@nxgt/mail": "1.0.1",
 		"@nxgt/mail-config": "1.0.1",
 		"@nxgt/mail-i18n": "1.0.1",
@@ -66,7 +66,7 @@
 		"zod": "^4.6.5"
 	},
 	"peerDependencies": {
-		"@nxgt/janus": "^0.15.0",
+		"@nxgt/janus": "^0.16.0",
 		"@nxgt/mail": ">=0.1.0 <2",
 		"typescript": "^6.0.3"
 	}