@ultimabase/password 0.2.0 → 0.3.0-canary.20261031104207

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @ultimabase/password
 
+## 0.3.0-canary.20261031104207
+
+### Minor Changes
+
+- 876b414: `password()` adds `passwordSetAt` to the user model: when the password was last set by `signUp`, `changePassword`, `resetPassword` or `User.setPassword`, read by the user and Master, `null` once the account closes (D-169). With `sendEmail`, each change but the sign-up's sends a `'passwordChanged'` email to the account once it commits. Run a migration after the upgrade.
+
+### Patch Changes
+
+- 0f13ad3: Requests at once keep one pending token of each kind per user, as a new one replaces the older. A unique index on `PasswordToken` (`userId`, `kind`) enforces it: run a migration after the upgrade.
+- Updated dependencies [41cfff6]
+- Updated dependencies [6e8ebf6]
+- Updated dependencies [9cd2dd4]
+- Updated dependencies [353c2bf]
+  - ultimabase@0.3.0-canary.20261031104207
+  - @ultimabase/auth@0.3.0-canary.20261031104207
+
 ## 0.2.0
 
 ### Minor Changes

package/dist/core.d.ts

@@ -15,6 +15,8 @@ export interface State {
     readonly sending: Set<Promise<void>>;
     readonly sendEmail: SendEmail | undefined;
 }
+/** Whether `setPassword` wrote `at` for `userId`, told once. */
+export declare const passwordSet: (userId: string, at: Date) => boolean;
 /** What a sign-in returns: its session, and the user read as itself. */
 export interface SignedIn<U = Row> {
     /**
@@ -31,7 +33,7 @@ export declare const attemptOf: (subject: string, client: Client | undefined) =>
 /**
  * Creates the user, its account and its hash in one transaction, as Master:
  * the caller's fields were checked against the list (D-113). The email's
- * hook links the account (D-162).
+ * hook links the account (D-162); `passwordSetAt` is the sign-up's (D-169).
  */
 export declare function createUser(state: State, email: string, password: string, data: object): Promise<{
     readonly user: Row;
@@ -48,8 +50,8 @@ export declare function verified(state: State, email: string, password: string,
 export declare function checkCurrent(userId: string, password: string, attempt: Attempt): Promise<void>;
 /**
  * Replaces `userId`'s hash, or gives one to an email without (D-162), ends
- * every session of the user and deletes its pending reset tokens (D-117);
- * the new stamp.
+ * every session of the user, deletes its pending reset tokens (D-117) and
+ * sets `passwordSetAt` (D-169); the new stamp.
  */
 export declare function setPassword(state: State, userId: string, password: string): Promise<string>;
 /**

package/dist/core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC/C,OAAO,KAAK,EACX,MAAM,EAEN,YAAY,EACZ,MAAM,EAEN,GAAG,EAEH,MAAM,YAAY,CAAA;AAGnB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAErD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAK1C,sEAAsE;AACtE,eAAO,MAAM,MAAM,aAAa,CAAA;AAEhC,qEAAqE;AACrE,MAAM,WAAW,KAAK;IACrB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,KAAK,CAAA;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAAA;CACzC;AAED,wEAAwE;AACxE,MAAM,WAAW,QAAQ,CAAC,CAAC,GAAG,GAAG;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAA;CACvB;AASD,4EAA4E;AAC5E,eAAO,MAAM,SAAS,YACZ,MAAM,UACP,MAAM,GAAG,SAAS,KACxB,OACqE,CAAA;AAExE;;;;GAIG;AACH,wBAAsB,UAAU,CAC/B,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAWzD;AAyCD,uEAAuE;AACvE,MAAM,WAAW,QAAQ;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,wEAAwE;AACxE,wBAAsB,QAAQ,CAC7B,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,GACd,OAAO,CAAC,QAAQ,CAAC,CAOnB;AAED,gEAAgE;AAChE,wBAAsB,YAAY,CACjC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,GACd,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAChC,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAyBjB;AAaD;;;;GAIG;AACH,wBAAsB,QAAQ,CAC7B,KAAK,EAAE,KAAK,EACZ,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,QAAQ,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAAC,QAAQ,CAAC,CAQnB"}
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC/C,OAAO,KAAK,EACX,MAAM,EAEN,YAAY,EACZ,MAAM,EAEN,GAAG,EAEH,MAAM,YAAY,CAAA;AAGnB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAErD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAK1C,sEAAsE;AACtE,eAAO,MAAM,MAAM,aAAa,CAAA;AAEhC,qEAAqE;AACrE,MAAM,WAAW,KAAK;IACrB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;IAC5B,2EAA2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,KAAK,CAAA;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAAA;CACzC;AAKD,gEAAgE;AAChE,eAAO,MAAM,WAAW,WAAY,MAAM,MAAM,IAAI,KAAG,OACX,CAAA;AAE5C,wEAAwE;AACxE,MAAM,WAAW,QAAQ,CAAC,CAAC,GAAG,GAAG;IAChC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAA;CACvB;AASD,4EAA4E;AAC5E,eAAO,MAAM,SAAS,YACZ,MAAM,UACP,MAAM,GAAG,SAAS,KACxB,OACqE,CAAA;AAExE;;;;GAIG;AACH,wBAAsB,UAAU,CAC/B,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAWzD;AAyCD,uEAAuE;AACvE,MAAM,WAAW,QAAQ;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,wEAAwE;AACxE,wBAAsB,QAAQ,CAC7B,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,GACd,OAAO,CAAC,QAAQ,CAAC,CAOnB;AAED,gEAAgE;AAChE,wBAAsB,YAAY,CACjC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,GACd,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAChC,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAmCjB;AAaD;;;;GAIG;AACH,wBAAsB,QAAQ,CAC7B,KAAK,EAAE,KAAK,EACZ,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,QAAQ,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,GACxB,OAAO,CAAC,QAAQ,CAAC,CAQnB"}

package/dist/core.js

@@ -9,6 +9,10 @@ import { PasswordToken } from './tokens.js';
 const M = { as: master };
 /** The method `AuthAccount` links a password's email with (D-113). */
 export const method = 'password';
+/** The `passwordSetAt` each `setPassword` wrote, which its commit tells (D-169). */
+const setting = new Set();
+/** Whether `setPassword` wrote `at` for `userId`, told once. */
+export const passwordSet = (userId, at) => setting.delete(`${userId} ${at.getTime()}`);
 const invalid = () => new PublicError('INVALID_CREDENTIALS', 'Wrong email or password.');
 /** The current password is known to be the user's: no email to name (D-161). */
 const wrongPassword = () => new PublicError('INVALID_CREDENTIALS', 'Wrong password.');
@@ -17,13 +21,13 @@ export const attemptOf = (subject, client) => client === undefined ? undefined :
 /**
  * Creates the user, its account and its hash in one transaction, as Master:
  * the caller's fields were checked against the list (D-113). The email's
- * hook links the account (D-162).
+ * hook links the account (D-162); `passwordSetAt` is the sign-up's (D-169).
  */
 export async function createUser(state, email, password, data) {
     const hash = await hashPassword(password);
     const stamp = randomUUID();
     return transaction(async () => {
-        const user = await state.users.queries.create({ data: { ...data, email } }, M);
+        const user = await state.users.queries.create({ data: { ...data, email, passwordSetAt: new Date() } }, M);
         await PasswordHash.create({ data: { userId: user.id, hash, stamp } }, M);
         return { user, stamp };
     });
@@ -80,8 +84,8 @@ export async function checkCurrent(userId, password, attempt) {
 }
 /**
  * Replaces `userId`'s hash, or gives one to an email without (D-162), ends
- * every session of the user and deletes its pending reset tokens (D-117);
- * the new stamp.
+ * every session of the user, deletes its pending reset tokens (D-117) and
+ * sets `passwordSetAt` (D-169); the new stamp.
  */
 export async function setPassword(state, userId, password) {
     const stored = await PasswordHash.findUnique({ where: { userId } }, M);
@@ -99,6 +103,13 @@ export async function setPassword(state, userId, password) {
             : PasswordHash.update({ where: { userId }, data }, M));
         await PasswordToken.deleteMany({ where: { userId, kind: 'reset' } }, M);
         await state.auth.revokeSessions(userId);
+        // Through the user's queries, so the application's hooks see it, and
+        // password's own tells the account once it commits (D-169).
+        const passwordSetAt = new Date();
+        if (state.sendEmail !== undefined) {
+            setting.add(`${userId} ${passwordSetAt.getTime()}`);
+        }
+        await state.users.queries.update({ where: { id: userId }, data: { passwordSetAt } }, M);
     });
     // Again once the stamp is visible: a sign-in that read the old one opened
     // its session before, so this ends it (see `signedIn`).

package/dist/email-field.d.ts

@@ -29,7 +29,12 @@ export declare function updating(state: State, record: Emailed, data: Draft): Pr
  * and deletes the links the old one received.
  */
 export declare function updated(state: State, record: Emailed, previous: Emailed): Promise<void>;
-/** Tells the old address, once the change commits, when `sendEmail` exists. */
-export declare function committed(state: State, record: Emailed, previous: Emailed): void;
+/**
+ * Once the write commits, when `sendEmail` exists, tells the old address its
+ * new email (D-162) and the account a password `setPassword` set (D-169).
+ */
+export declare function committed(state: State, record: Emailed & {
+    readonly passwordSetAt: Date | null;
+}, previous: Emailed): void;
 export {};
 //# sourceMappingURL=email-field.d.ts.map

package/dist/email-field.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email-field.d.ts","sourceRoot":"","sources":["../src/email-field.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAExC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AAQtC,KAAK,OAAO,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAA;AACrE,KAAK,KAAK,GAAG;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IACjC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CACnC,CAAA;AAED,sDAAsD;AACtD,eAAO,MAAM,UAAU,UAAW;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CACxC,KAAG,OAKH,CAAA;AAED,wDAAwD;AACxD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAI1C;AAED,8DAA8D;AAC9D,wBAAsB,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1E;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAC7B,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,GACT,OAAO,CAAC,IAAI,CAAC,CAYf;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAC5B,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,+EAA+E;AAC/E,wBAAgB,SAAS,CACxB,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,OAAO,GACf,IAAI,CAcN"}
+{"version":3,"file":"email-field.d.ts","sourceRoot":"","sources":["../src/email-field.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAExC,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAA;AAQtC,KAAK,OAAO,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAA;AACrE,KAAK,KAAK,GAAG;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IACjC,aAAa,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CACnC,CAAA;AAED,sDAAsD;AACtD,eAAO,MAAM,UAAU,UAAW;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CACxC,KAAG,OAKH,CAAA;AAED,wDAAwD;AACxD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAI1C;AAED,8DAA8D;AAC9D,wBAAsB,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1E;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAC7B,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,GACT,OAAO,CAAC,IAAI,CAAC,CAYf;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAC5B,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,OAAO,EACf,QAAQ,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;GAGG;AACH,wBAAgB,SAAS,CACxB,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,OAAO,GAAG;IAAE,QAAQ,CAAC,aAAa,EAAE,IAAI,GAAG,IAAI,CAAA;CAAE,EACzD,QAAQ,EAAE,OAAO,GACf,IAAI,CAiBN"}

package/dist/email-field.js

@@ -1,5 +1,5 @@
 import { isMaster, master, PublicError } from 'ultimabase';
-import { method } from './core.js';
+import { method, passwordSet } from './core.js';
 import { later } from './email-functions.js';
 import { emailOf, valid } from './input.js';
 import { PasswordToken } from './tokens.js';
@@ -59,19 +59,28 @@ export async function updated(state, record, previous) {
     const where = { userId: record.id, kind: { in: ['reset', 'verify'] } };
     await PasswordToken.deleteMany({ where }, M);
 }
-/** Tells the old address, once the change commits, when `sendEmail` exists. */
+/**
+ * Once the write commits, when `sendEmail` exists, tells the old address its
+ * new email (D-162) and the account a password `setPassword` set (D-169).
+ */
 export function committed(state, record, previous) {
-    const { sendEmail } = state;
-    const [from, to] = [previous.email, record.email];
-    if (sendEmail === undefined || from === null || to === null || from === to) {
+    const { sendEmail, auth } = state;
+    if (sendEmail === undefined)
         return;
+    const { id: userId, passwordSetAt } = record;
+    if (passwordSetAt !== null && passwordSet(userId, passwordSetAt)) {
+        later(state, async () => {
+            // A user stored before D-162 reads no email: its account has it.
+            const to = await auth.subjectOf(userId, method);
+            if (to === undefined)
+                return;
+            await sendEmail({ kind: 'passwordChanged', to, userId });
+        });
     }
+    const [from, to] = [previous.email, record.email];
+    if (from === null || to === null || from === to)
+        return;
     later(state, async () => {
-        await sendEmail({
-            kind: 'emailChanged',
-            to: from,
-            newEmail: to,
-            userId: record.id,
-        });
+        await sendEmail({ kind: 'emailChanged', to: from, newEmail: to, userId });
     });
 }

package/dist/plugin.d.ts

@@ -69,6 +69,10 @@ export interface Password extends PluginTypes {
             readonly optional: true;
             readonly unique: true;
         }>;
+        /** When the password was last set (D-169). */
+        readonly passwordSetAt: Field<Date | null, {
+            readonly optional: true;
+        }>;
     };
     readonly commands: PasswordCommands<this['fields']>;
 }

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAW,MAAM,kBAAkB,CAAA;AAErD,OAAO,KAAK,EACX,MAAM,EAEN,KAAK,EACL,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,WAAW,EACX,OAAO,EACP,QAAQ,EACR,KAAK,EACL,MAAM,EACN,MAAM,YAAY,CAAA;AASnB,OAAO,KAAK,EAAE,QAAQ,EAAS,MAAM,WAAW,CAAA;AAiBhD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAGrD,OAAO,KAAK,EAAE,WAAW,EAAY,MAAM,YAAY,CAAA;AAKvD,kFAAkF;AAClF,MAAM,MAAM,SAAS,GAAG,QAAQ,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAChE,OAAO,CACP,OAAO,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,GAAG,WAAW,GAAG,WAAW,CAAC,EACjE,MAAM,CACN,GACA,MAAM,CAAA;AAET,MAAM,WAAW,eAAe;IAC/B,iGAAiG;IACjG,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,SAAS,EAAE,GAAG,KAAK,CAAA;IAC9C;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAC9B;AAED,KAAK,OAAO,GAAG;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAA;CAAE,CAAA;AACzC,kFAAkF;AAClF,KAAK,aAAa,GAAG,OAAO,GAAG;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAC3D,KAAK,UAAU,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AAChE,KAAK,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAEhC,qDAAqD;AACrD,MAAM,WAAW,gBAAgB,CAAC,CAAC;IAClC,oEAAoE;IACpE,MAAM,CACL,IAAI,EAAE,WAAW,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAA;KAAE,EACpD,OAAO,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IACtB;;;OAGG;IACH,MAAM,CACL,IAAI,EAAE,WAAW,EACjB,OAAO,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAChC;;;;OAIG;IACH,WAAW,CACV,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EACxD,OAAO,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB;;;;OAIG;IACH,aAAa,CACZ,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EACxD,OAAO,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,IAAI,CAAC,CAAA;CAChB;AAED,+BAA+B;AAC/B,MAAM,WAAW,QAAS,SAAQ,WAAW;IAC5C,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAA;IACpC,QAAQ,CAAC,WAAW,EAAE;QACrB,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE;YAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAA;SAAE,CAAC,CAAA;QACnE,4CAA4C;QAC5C,QAAQ,CAAC,KAAK,EAAE,KAAK,CACpB,MAAM,GAAG,IAAI,EACb;YAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;YAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;SAAE,CAClD,CAAA;KACD,CAAA;IACD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;CACnD;AA8PD;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAqB,CAAA;AACnE,0EAA0E;AAC1E,eAAO,MAAM,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAkB,CAAA"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAW,MAAM,kBAAkB,CAAA;AAErD,OAAO,KAAK,EACX,MAAM,EAEN,KAAK,EACL,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,WAAW,EACX,OAAO,EACP,QAAQ,EACR,KAAK,EACL,MAAM,EACN,MAAM,YAAY,CAAA;AASnB,OAAO,KAAK,EAAE,QAAQ,EAAS,MAAM,WAAW,CAAA;AAiBhD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAGrD,OAAO,KAAK,EAAE,WAAW,EAAY,MAAM,YAAY,CAAA;AAKvD,kFAAkF;AAClF,MAAM,MAAM,SAAS,GAAG,QAAQ,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAChE,OAAO,CACP,OAAO,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,GAAG,WAAW,GAAG,WAAW,CAAC,EACjE,MAAM,CACN,GACA,MAAM,CAAA;AAET,MAAM,WAAW,eAAe;IAC/B,iGAAiG;IACjG,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,SAAS,EAAE,GAAG,KAAK,CAAA;IAC9C;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAA;CAC9B;AAED,KAAK,OAAO,GAAG;IAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAA;CAAE,CAAA;AACzC,kFAAkF;AAClF,KAAK,aAAa,GAAG,OAAO,GAAG;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAC3D,KAAK,UAAU,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AAChE,KAAK,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAEhC,qDAAqD;AACrD,MAAM,WAAW,gBAAgB,CAAC,CAAC;IAClC,oEAAoE;IACpE,MAAM,CACL,IAAI,EAAE,WAAW,GAAG;QAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAA;KAAE,EACpD,OAAO,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IACtB;;;OAGG;IACH,MAAM,CACL,IAAI,EAAE,WAAW,EACjB,OAAO,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAChC;;;;OAIG;IACH,WAAW,CACV,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EACxD,OAAO,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB;;;;OAIG;IACH,aAAa,CACZ,IAAI,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EACxD,OAAO,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,IAAI,CAAC,CAAA;CAChB;AAED,+BAA+B;AAC/B,MAAM,WAAW,QAAS,SAAQ,WAAW;IAC5C,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAA;IACpC,QAAQ,CAAC,WAAW,EAAE;QACrB,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE;YAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAA;SAAE,CAAC,CAAA;QACnE,4CAA4C;QAC5C,QAAQ,CAAC,KAAK,EAAE,KAAK,CACpB,MAAM,GAAG,IAAI,EACb;YAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;YAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;SAAE,CAClD,CAAA;QACD,8CAA8C;QAC9C,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,IAAI,GAAG,IAAI,EAAE;YAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;SAAE,CAAC,CAAA;KACvE,CAAA;IACD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;CACnD;AAsQD;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,EAAE,QAAQ,CAAC,QAAQ,CAAqB,CAAA;AACnE,0EAA0E;AAC1E,eAAO,MAAM,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAkB,CAAA"}

package/dist/plugin.js

@@ -46,6 +46,7 @@ const reserved = new Set([
     'email',
     'password',
     'emailVerified',
+    'passwordSetAt',
 ]);
 /** The listed fields' properties; an unknown, a reserved or a missing one stops startup. */
 function signUpFields(users, listed) {
@@ -113,6 +114,10 @@ const definition = definePlugin({
         email: f.string({ optional: true, unique: true }).with({
             access: { read: readsEmail, create: () => false, update: () => false },
         }),
+        // Only Master writes it; password sets it with the password (D-169).
+        passwordSetAt: f.dateTime({ optional: true }).with({
+            access: { read: readsEmail, create: () => false, update: () => false },
+        }),
     }),
     hooks: {
         // The email and the password account stay one (D-162).
@@ -179,16 +184,18 @@ const definition = definePlugin({
         const sending = new Set();
         states.set(auth, { auth, users, signUp, logger, sending, sendEmail });
         // A closed account keeps its row, without a password, an email or a
-        // verified one (D-160, D-162).
+        // verified one (D-160, D-162, D-169).
         auth.onCloseAccount(async (userId) => {
             await forget(userId);
             const where = { id: userId };
             const user = await users.queries.findUnique({ where }, M);
             if (user === null)
                 return;
-            if (user.email === null && user.emailVerified !== true)
+            const { email, emailVerified, passwordSetAt } = user;
+            if (email === null && emailVerified !== true && passwordSetAt === null) {
                 return;
-            const data = { email: null, emailVerified: false };
+            }
+            const data = { email: null, emailVerified: false, passwordSetAt: null };
             await users.queries.update({ where, data }, M);
         });
     },

package/dist/tokens.d.ts

@@ -4,7 +4,8 @@ import { PublicError } from 'ultimabase';
 export type EmailKind = 'reset' | 'verify' | 'emailChange';
 /**
  * What `sendEmail` receives: the application writes the text and the link.
- * `'emailChanged'` tells the old address its email changed (D-162).
+ * `'emailChanged'` tells the old address its email changed (D-162),
+ * `'passwordChanged'` the account its password changed (D-169).
  */
 export type Email = {
     readonly kind: EmailKind;
@@ -19,6 +20,11 @@ export type Email = {
     readonly to: string;
     readonly newEmail: string;
     readonly userId: string;
+} | {
+    readonly kind: 'passwordChanged';
+    /** The account's email. */
+    readonly to: string;
+    readonly userId: string;
 };
 type TokenFields = {
     readonly userId: Field<string, ScalarOptions<string>>;
@@ -34,7 +40,7 @@ type TokenFields = {
     }>;
 };
 export declare const PasswordToken: ModelOf<'PasswordToken', TokenFields, []>;
-/** A new token of `kind` for `userId`, sent to `email`; it replaces the older one. */
+/** A new token of `kind` for `userId`, sent to `email`; it replaces the older one, even one issued at once. */
 export declare function issueToken(userId: string, kind: EmailKind, email: string): Promise<string>;
 /**
  * The user a token of `kind` was issued to, and the address it was sent to;

package/dist/tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/D,OAAO,EAAuB,WAAW,EAAE,MAAM,YAAY,CAAA;AAO7D,gDAAgD;AAChD,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,aAAa,CAAA;AAE1D;;;GAGG;AACH,MAAM,MAAM,KAAK,GACd;IACA,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACtB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,uBAAuB;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACtB,CAAA;AAQJ,KAAK,WAAW,GAAG;IAClB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IACrD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IACnD,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;IACvD,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;IACpD,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;CACjE,CAAA;AAED,eAAO,MAAM,aAAa,EAAE,OAAO,CAAC,eAAe,EAAE,WAAW,EAAE,EAAE,CAWjE,CAAA;AAKH,sFAAsF;AACtF,wBAAsB,UAAU,CAC/B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,CAcjB;AAKD;;;GAGG;AACH,wBAAsB,WAAW,CAChC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,SAAS,GACb,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAUrE;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,WAChB,MAAM,KACZ,OAAO,CAAC,WAAW,GAAG,SAAS,CAAoC,CAAA"}
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/D,OAAO,EAAuB,WAAW,EAAE,MAAM,YAAY,CAAA;AAO7D,gDAAgD;AAChD,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,aAAa,CAAA;AAE1D;;;;GAIG;AACH,MAAM,MAAM,KAAK,GACd;IACA,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,gDAAgD;IAChD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACtB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,uBAAuB;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACtB,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,2BAA2B;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACtB,CAAA;AAQJ,KAAK,WAAW,GAAG;IAClB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IACrD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;IACnD,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;IACvD,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAA;IACpD,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CAAA;CACjE,CAAA;AAED,eAAO,MAAM,aAAa,EAAE,OAAO,CAAC,eAAe,EAAE,WAAW,EAAE,EAAE,CAejE,CAAA;AAKH,+GAA+G;AAC/G,wBAAsB,UAAU,CAC/B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,EACf,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,CAyBjB;AAKD;;;GAGG;AACH,wBAAsB,WAAW,CAChC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,SAAS,GACb,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CAUrE;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,WAChB,MAAM,KACZ,OAAO,CAAC,WAAW,GAAG,SAAS,CAAoC,CAAA"}

package/dist/tokens.js

@@ -20,18 +20,32 @@ export const PasswordToken = defineModel({
         expiresAt: f.dateTime(),
         email: f.string({ optional: true }),
     }),
-    indexes: [{ fields: ['userId', 'kind'] }, { fields: ['expiresAt'] }],
+    // One pending token of each kind per user: requests at once cannot keep two.
+    indexes: [
+        { fields: ['userId', 'kind'], unique: true },
+        { fields: ['expiresAt'] },
+    ],
 });
 const hashOf = (token) => createHash('sha256').update(token).digest('base64url');
-/** A new token of `kind` for `userId`, sent to `email`; it replaces the older one. */
+/** A new token of `kind` for `userId`, sent to `email`; it replaces the older one, even one issued at once. */
 export async function issueToken(userId, kind, email) {
     const now = Date.now();
     await PasswordToken.deleteMany({ where: { expiresAt: { lte: new Date(now) } } }, M);
-    await PasswordToken.deleteMany({ where: { userId, kind } }, M);
-    const token = randomBytes(32).toString('base64url');
     const expiresAt = new Date(now + lifetimes[kind]);
-    await PasswordToken.create({ data: { userId, kind, hash: hashOf(token), expiresAt, email } }, M);
-    return token;
+    for (;;) {
+        await PasswordToken.deleteMany({ where: { userId, kind } }, M);
+        const token = randomBytes(32).toString('base64url');
+        try {
+            await PasswordToken.create({ data: { userId, kind, hash: hashOf(token), expiresAt, email } }, M);
+            return token;
+        }
+        catch (error) {
+            // Another request issued one meanwhile: this newer one replaces it.
+            if (!(error instanceof PublicError && error.code === 'UNIQUE_VIOLATION')) {
+                throw error;
+            }
+        }
+    }
 }
 const invalidLink = () => new PublicError('INVALID_CREDENTIALS', 'This link is invalid or has expired.');
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimabase/password",
-  "version": "0.2.0",
+  "version": "0.3.0-canary.20261031104207",
   "description": "Passwords for UltimaBase: sign-up, sign-in and password changes, hashed with Argon2id.",
   "type": "module",
   "license": "Apache-2.0",
@@ -34,18 +34,18 @@
     "ipaddr.js": "2.5.0"
   },
   "peerDependencies": {
-    "@ultimabase/auth": "^0.2.0",
-    "ultimabase": "^0.2.0"
+    "@ultimabase/auth": "0.3.0-canary.20261031104207",
+    "ultimabase": "0.3.0-canary.20261031104207"
   },
   "devDependencies": {
     "@types/pg": "8.23.1",
-    "@ultimabase/auth": "0.2.0",
-    "@ultimabase/graphql": "0.2.0",
-    "@ultimabase/http": "0.2.0",
-    "@ultimabase/postgres": "0.2.0",
+    "@ultimabase/auth": "0.3.0-canary.20261031104207",
+    "@ultimabase/graphql": "0.3.0-canary.20261031104207",
+    "@ultimabase/http": "0.3.0-canary.20261031104207",
+    "@ultimabase/postgres": "0.3.0-canary.20261031104207",
     "graphql": "17.0.2",
     "pg": "8.23.1",
-    "ultimabase": "0.2.0",
+    "ultimabase": "0.3.0-canary.20261031104207",
     "vite": "8.3.4",
     "vitest": "5.0.5"
   }

package/src/core.ts

@@ -35,6 +35,13 @@ export interface State {
 	readonly sendEmail: SendEmail | undefined
 }
 
+/** The `passwordSetAt` each `setPassword` wrote, which its commit tells (D-169). */
+const setting = new Set<string>()
+
+/** Whether `setPassword` wrote `at` for `userId`, told once. */
+export const passwordSet = (userId: string, at: Date): boolean =>
+	setting.delete(`${userId} ${at.getTime()}`)
+
 /** What a sign-in returns: its session, and the user read as itself. */
 export interface SignedIn<U = Row> {
 	/**
@@ -64,7 +71,7 @@ export const attemptOf = (
 /**
  * Creates the user, its account and its hash in one transaction, as Master:
  * the caller's fields were checked against the list (D-113). The email's
- * hook links the account (D-162).
+ * hook links the account (D-162); `passwordSetAt` is the sign-up's (D-169).
  */
 export async function createUser(
 	state: State,
@@ -76,7 +83,7 @@ export async function createUser(
 	const stamp = randomUUID()
 	return transaction(async () => {
 		const user = await state.users.queries.create(
-			{ data: { ...data, email } },
+			{ data: { ...data, email, passwordSetAt: new Date() } },
 			M,
 		)
 		await PasswordHash.create({ data: { userId: user.id, hash, stamp } }, M)
@@ -157,8 +164,8 @@ export async function checkCurrent(
 
 /**
  * Replaces `userId`'s hash, or gives one to an email without (D-162), ends
- * every session of the user and deletes its pending reset tokens (D-117);
- * the new stamp.
+ * every session of the user, deletes its pending reset tokens (D-117) and
+ * sets `passwordSetAt` (D-169); the new stamp.
  */
 export async function setPassword(
 	state: State,
@@ -184,6 +191,16 @@ export async function setPassword(
 			: PasswordHash.update({ where: { userId }, data }, M))
 		await PasswordToken.deleteMany({ where: { userId, kind: 'reset' } }, M)
 		await state.auth.revokeSessions(userId)
+		// Through the user's queries, so the application's hooks see it, and
+		// password's own tells the account once it commits (D-169).
+		const passwordSetAt = new Date()
+		if (state.sendEmail !== undefined) {
+			setting.add(`${userId} ${passwordSetAt.getTime()}`)
+		}
+		await state.users.queries.update(
+			{ where: { id: userId }, data: { passwordSetAt } },
+			M,
+		)
 	})
 	// Again once the stamp is visible: a sign-in that read the old one opened
 	// its session before, so this ends it (see `signedIn`).

package/src/email-field.ts

@@ -3,7 +3,7 @@
 import type { Caller } from 'ultimabase'
 import { isMaster, master, PublicError } from 'ultimabase'
 import type { State } from './core.ts'
-import { method } from './core.ts'
+import { method, passwordSet } from './core.ts'
 import { later } from './email-functions.ts'
 import { emailOf, valid } from './input.ts'
 import { PasswordToken } from './tokens.ts'
@@ -82,23 +82,29 @@ export async function updated(
 	await PasswordToken.deleteMany({ where }, M)
 }
 
-/** Tells the old address, once the change commits, when `sendEmail` exists. */
+/**
+ * Once the write commits, when `sendEmail` exists, tells the old address its
+ * new email (D-162) and the account a password `setPassword` set (D-169).
+ */
 export function committed(
 	state: State,
-	record: Emailed,
+	record: Emailed & { readonly passwordSetAt: Date | null },
 	previous: Emailed,
 ): void {
-	const { sendEmail } = state
-	const [from, to] = [previous.email, record.email]
-	if (sendEmail === undefined || from === null || to === null || from === to) {
-		return
+	const { sendEmail, auth } = state
+	if (sendEmail === undefined) return
+	const { id: userId, passwordSetAt } = record
+	if (passwordSetAt !== null && passwordSet(userId, passwordSetAt)) {
+		later(state, async () => {
+			// A user stored before D-162 reads no email: its account has it.
+			const to = await auth.subjectOf(userId, method)
+			if (to === undefined) return
+			await sendEmail({ kind: 'passwordChanged', to, userId })
+		})
 	}
+	const [from, to] = [previous.email, record.email]
+	if (from === null || to === null || from === to) return
 	later(state, async () => {
-		await sendEmail({
-			kind: 'emailChanged',
-			to: from,
-			newEmail: to,
-			userId: record.id,
-		})
+		await sendEmail({ kind: 'emailChanged', to: from, newEmail: to, userId })
 	})
 }

package/src/plugin.ts

@@ -119,6 +119,8 @@ export interface Password extends PluginTypes {
 			string | null,
 			{ readonly optional: true; readonly unique: true }
 		>
+		/** When the password was last set (D-169). */
+		readonly passwordSetAt: Field<Date | null, { readonly optional: true }>
 	}
 	readonly commands: PasswordCommands<this['fields']>
 }
@@ -168,6 +170,7 @@ const reserved = new Set([
 	'email',
 	'password',
 	'emailVerified',
+	'passwordSetAt',
 ])
 
 /** The listed fields' properties; an unknown, a reserved or a missing one stops startup. */
@@ -273,6 +276,10 @@ const definition = definePlugin<Password>({
 		email: f.string({ optional: true, unique: true }).with({
 			access: { read: readsEmail, create: () => false, update: () => false },
 		}),
+		// Only Master writes it; password sets it with the password (D-169).
+		passwordSetAt: f.dateTime({ optional: true }).with({
+			access: { read: readsEmail, create: () => false, update: () => false },
+		}),
 	}),
 	hooks: {
 		// The email and the password account stay one (D-162).
@@ -348,14 +355,17 @@ const definition = definePlugin<Password>({
 		const sending = new Set<Promise<void>>()
 		states.set(auth, { auth, users, signUp, logger, sending, sendEmail })
 		// A closed account keeps its row, without a password, an email or a
-		// verified one (D-160, D-162).
+		// verified one (D-160, D-162, D-169).
 		auth.onCloseAccount(async (userId) => {
 			await forget(userId)
 			const where = { id: userId }
 			const user = await users.queries.findUnique({ where }, M)
 			if (user === null) return
-			if (user.email === null && user.emailVerified !== true) return
-			const data = { email: null, emailVerified: false }
+			const { email, emailVerified, passwordSetAt } = user
+			if (email === null && emailVerified !== true && passwordSetAt === null) {
+				return
+			}
+			const data = { email: null, emailVerified: false, passwordSetAt: null }
 			await users.queries.update({ where, data }, M)
 		})
 	},

package/src/tokens.ts

@@ -14,7 +14,8 @@ export type EmailKind = 'reset' | 'verify' | 'emailChange'
 
 /**
  * What `sendEmail` receives: the application writes the text and the link.
- * `'emailChanged'` tells the old address its email changed (D-162).
+ * `'emailChanged'` tells the old address its email changed (D-162),
+ * `'passwordChanged'` the account its password changed (D-169).
  */
 export type Email =
 	| {
@@ -32,6 +33,12 @@ export type Email =
 			readonly newEmail: string
 			readonly userId: string
 	  }
+	| {
+			readonly kind: 'passwordChanged'
+			/** The account's email. */
+			readonly to: string
+			readonly userId: string
+	  }
 
 const lifetimes: Readonly<Record<EmailKind, number>> = {
 	reset: hour,
@@ -59,13 +66,17 @@ export const PasswordToken: ModelOf<'PasswordToken', TokenFields, []> =
 			expiresAt: f.dateTime(),
 			email: f.string({ optional: true }),
 		}),
-		indexes: [{ fields: ['userId', 'kind'] }, { fields: ['expiresAt'] }],
+		// One pending token of each kind per user: requests at once cannot keep two.
+		indexes: [
+			{ fields: ['userId', 'kind'], unique: true },
+			{ fields: ['expiresAt'] },
+		],
 	})
 
 const hashOf = (token: string): string =>
 	createHash('sha256').update(token).digest('base64url')
 
-/** A new token of `kind` for `userId`, sent to `email`; it replaces the older one. */
+/** A new token of `kind` for `userId`, sent to `email`; it replaces the older one, even one issued at once. */
 export async function issueToken(
 	userId: string,
 	kind: EmailKind,
@@ -76,14 +87,25 @@ export async function issueToken(
 		{ where: { expiresAt: { lte: new Date(now) } } },
 		M,
 	)
-	await PasswordToken.deleteMany({ where: { userId, kind } }, M)
-	const token = randomBytes(32).toString('base64url')
 	const expiresAt = new Date(now + lifetimes[kind])
-	await PasswordToken.create(
-		{ data: { userId, kind, hash: hashOf(token), expiresAt, email } },
-		M,
-	)
-	return token
+	for (;;) {
+		await PasswordToken.deleteMany({ where: { userId, kind } }, M)
+		const token = randomBytes(32).toString('base64url')
+		try {
+			await PasswordToken.create(
+				{ data: { userId, kind, hash: hashOf(token), expiresAt, email } },
+				M,
+			)
+			return token
+		} catch (error) {
+			// Another request issued one meanwhile: this newer one replaces it.
+			if (!(
+				error instanceof PublicError && error.code === 'UNIQUE_VIOLATION'
+			)) {
+				throw error
+			}
+		}
+	}
 }
 
 const invalidLink = () =>