@atlasauth/svelte 0.13.0 → 0.15.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @atlasauth/svelte changelog
 
+## 0.15.0 — 2026-11-05
+
+- `<SignUp>` second-factor, enrolment and recovery-code steps; new `signInUrl`.
+
+## 0.14.0 — 2026-11-05
+
+### Added
+
+- Sign-in offers the emailed proof when a password is on hold, even with email code sign-in off, and shows the password field with a confirmation once it is proven.
+
+### Also
+
+- The existing-account notice after a sign-up reaches an account on hold (`FlowState.existingAccount`), and the `account_deleted` error reason.
+
 ## 0.13.0 — 2026-10-30
 
 - `<SignIn>` offers "Sign in with a passkey" and passkey autofill on the identifier field when the instance enables passkeys.

package/dist/accessors.d.ts

@@ -142,6 +142,8 @@ export interface FlowController {
      * for this before exchanging the ticket and finishing the sign-in.
      */
     saveRecoveryCodes(): void;
+    /** With `holdExistingAccountNotice`: the user read `pendingExistingAccountNotice($state)`; finish the sign-up. */
+    continueAfterExistingAccount(): void;
     /** Resend a sign-up's emailed code / link (the earlier one stops working). Resolves whether it was sent. */
     resendSignUp(): Promise<boolean>;
     /**
@@ -198,4 +200,6 @@ export declare function signIn(): FlowController;
  * `create(values)` posts `/v1/client/sign_ups` (the account is created there),
  * then `submit({ code })` verifies the emailed code and completes the session.
  */
-export declare function signUp(): FlowController;
+export declare function signUp(options?: {
+    holdExistingAccountNotice?: boolean;
+}): FlowController;

package/dist/accessors.js

@@ -1,5 +1,5 @@
 import { derived, get, readable, writable } from 'svelte/store';
-import { FapiClient, advanceWithCaptcha, atlasCaptchaLabels, createCaptchaController, createPasskeySignInController, createPasskeySignUp, createSignUp, finishPasskeySignUp, fetchInstanceSettings, fetchLastSignInMethod, startSignInWithAtlas, flowNeedsCaptcha, signInCaptchaOptions, flowFromPending, pollAttempt, prepareFactor, shouldKeepPolling, createOrganizationAuditLog, createMfaEnrollment, acknowledgeRecoveryCodes, pendingRecoveryCodes, mfaChoicesFrom, prepareSecondFactorCode, resendSignUpVerification, PolicyAcceptanceController, loadPolicies as loadPolicyList, initialFlow as emptyFlow, } from '@atlasauth/js';
+import { FapiClient, advanceWithCaptcha, atlasCaptchaLabels, attemptPasswordHoldProof, preparePasswordHoldProof, createCaptchaController, createPasskeySignInController, createPasskeySignUp, createSignUp, finishPasskeySignUp, fetchInstanceSettings, fetchLastSignInMethod, startSignInWithAtlas, flowNeedsCaptcha, signInCaptchaOptions, flowFromPending, pollAttempt, prepareFactor, shouldKeepPolling, createOrganizationAuditLog, createMfaEnrollment, acknowledgeExistingAccount, acknowledgeRecoveryCodes, pendingExistingAccountNotice, pendingRecoveryCodes, mfaChoicesFrom, prepareSecondFactorCode, resendSignUpVerification, PolicyAcceptanceController, loadPolicies as loadPolicyList, initialFlow as emptyFlow, } from '@atlasauth/js';
 import { useAtlas } from './context';
 import { translate } from './i18n';
 import { evaluate } from './protect';
@@ -89,7 +89,7 @@ export function getToken() {
 export function signOut(options) {
     return useAtlas().signOut(options);
 }
-function createFlow() {
+function createFlow(options = {}) {
     const atlas = useAtlas();
     const client = new FapiClient({
         publishableKey: atlas.publishableKey,
@@ -163,7 +163,13 @@ function createFlow() {
     async function finish(next) {
         // An enrolment's recovery codes are shown first; `saveRecoveryCodes` finishes.
         if (pendingRecoveryCodes(next)) {
-            state.set({ ...next, busy: false });
+            // The ticket dies in 60 seconds and saving the codes can take longer: redeem it now,
+            // and `saveRecoveryCodes` finishes. A refused exchange keeps the ticket, so the save reports it.
+            state.set({ ...next, busy: true });
+            const res = next.ticket
+                ? await client.post('/v1/client/tickets/exchange', { attempt_id: next.attempt.id, ticket: next.ticket })
+                : null;
+            state.set({ ...next, busy: false, ticket: res?.ok ? null : next.ticket });
             return;
         }
         if (next.attempt?.status === 'complete') {
@@ -176,6 +182,10 @@ function createFlow() {
                 });
                 exchanged = res.ok;
             }
+            if (exchanged && options.holdExistingAccountNotice && pendingExistingAccountNotice(next)) {
+                state.set({ ...next, ticket: null, busy: false });
+                return;
+            }
             const kept = exchanged && (await atlas.reload());
             state.set({ ...next, busy: false, sessionKept: kept });
             return;
@@ -183,9 +193,23 @@ function createFlow() {
         state.set(next);
         maybeStartPolling();
     }
+    // What lifts a password hold on this instance: the emailed code, or a link where it verifies by link only.
+    const holdProof = () => get(settings)?.account.emailVerification === 'link' ? 'email_link' : 'email_code';
     function submit(values) {
         void (async () => {
             state.update((current) => ({ ...current, busy: true, errors: [] }));
+            const { attempt, passwordHold, prepared } = get(state);
+            // A code that lifts a password hold goes to its own attempt, not this sign-in.
+            // `values.code`: "Use your password instead" leaves `prepared` set.
+            if (attempt?.status === 'needs_first_factor' &&
+                passwordHold &&
+                !passwordHold.released &&
+                prepared === 'email_code' &&
+                holdProof() === 'email_code' &&
+                values.code !== undefined) {
+                state.set(await attemptPasswordHoldProof(client, get(state), values.code));
+                return;
+            }
             const out = await advanceWithCaptcha(client, get(state), values, { captcha, identifier, t });
             identifier = out.identifier;
             await finish(out.state);
@@ -242,6 +266,9 @@ function createFlow() {
     function saveRecoveryCodes() {
         void finish(acknowledgeRecoveryCodes(get(state)));
     }
+    function continueAfterExistingAccount() {
+        void finish(acknowledgeExistingAccount(get(state)));
+    }
     async function resendSignUp() {
         state.update((current) => ({ ...current, busy: true, errors: [] }));
         const next = await resendSignUpVerification(client, get(state));
@@ -256,7 +283,11 @@ function createFlow() {
     }
     async function prepare(strategy) {
         state.update((current) => ({ ...current, busy: true, errors: [] }));
-        const next = await prepareFactor(client, get(state), strategy);
+        const hold = get(state).passwordHold;
+        const proof = holdProof();
+        const next = hold && !hold.released && strategy === proof
+            ? await preparePasswordHoldProof(client, get(state), proof)
+            : await prepareFactor(client, get(state), strategy);
         state.set({ ...next, busy: false });
         maybeStartPolling();
         return next.errors.length === 0;
@@ -299,6 +330,7 @@ function createFlow() {
         enrollment,
         enrollmentState: { subscribe: enrollmentState.subscribe },
         saveRecoveryCodes,
+        continueAfterExistingAccount,
         resendSignUp,
         prepare,
         settings: { subscribe: settings.subscribe },
@@ -322,6 +354,6 @@ export function signIn() {
  * `create(values)` posts `/v1/client/sign_ups` (the account is created there),
  * then `submit({ code })` verifies the emailed code and completes the session.
  */
-export function signUp() {
-    return createFlow();
+export function signUp(options = {}) {
+    return createFlow(options);
 }

package/dist/components/AttemptFlow.svelte

@@ -28,6 +28,7 @@ export let enrollmentState = null;
 export let emailVerification = "code";
 export let onResend = null;
 export let onPolicyDecline = null;
+export let passwordHold = null;
 const atlas = useAtlas();
 const cls = (key, base) => classFor(key, atlas.appearance, base);
 const t = (key, vars) => translate(atlas.catalog, key, vars);
@@ -36,10 +37,21 @@ let values = {};
 $: step = attempt ? nextStep(attempt) : { kind: "collect_identifier" };
 const strategyName = (s) => typeof s === "string" ? s : String(s?.strategy ?? "");
 $: offered = step.kind === "collect_first_factor" ? offeredFirstFactors(step.strategies.map(strategyName), emailDelivery) : [];
-$: emailOptions = onPrepare ? offered.filter((s) => s === "email_code" || s === "email_link") : [];
+let holdOption = null;
+$: holdOption = passwordHold && !passwordHold.released && emailDelivery?.available !== false ? emailVerification === "link" ? "email_link" : "email_code" : null;
+let emailOptions = [];
+$: {
+  const listed = offered.filter((s) => s === "email_code" || s === "email_link");
+  emailOptions = !onPrepare ? [] : holdOption && !listed.includes(holdOption) ? [...listed, holdOption] : listed;
+}
 $: plan = planFirstFactor(offered);
 $: showPassword = offered.includes("password") || emailOptions.length === 0;
 let prepared = null;
+$: released = passwordHold?.released === true;
+$: if (released) {
+  prepared = null;
+  values = {};
+}
 $: sent = prepared && prepared.attemptId === (attempt?.id ?? null) ? prepared.strategy : null;
 async function prepare(strategy) {
   if (!onPrepare) return;
@@ -52,7 +64,7 @@ $: if (step.kind === "collect_first_factor" && onPrepare && plan.autoSend && att
   void prepare(plan.autoSend);
 }
 $: sending = step.kind === "collect_first_factor" && sent === null && !!onPrepare && !plan.password && emailOptions.length > 0;
-$: identifier = attempt?.identifier ?? "";
+$: identifier = passwordHold?.email ?? attempt?.identifier ?? "";
 let emailed = null;
 $: emailedNow = emailed && emailed.attemptId === (attempt?.id ?? null) ? emailed : null;
 async function emailSecondFactor() {
@@ -185,6 +197,9 @@ function handleSubmit(event) {
       {#if sending}
         <p class="atlas-text" aria-live="polite">{t('signIn.sending')}</p>
       {/if}
+      {#if step.kind === 'collect_first_factor' && released && sent === null}
+        <p class="atlas-text" data-atlas-password-released="">{t('signIn.passwordHoldReleased')}</p>
+      {/if}
       {#if linkOnly}
         <p class="atlas-text" data-atlas-link-sent aria-live="polite">{t('signUp.linkSentTo', { email: identifier })}</p>
         {#if onResend}

package/dist/components/AttemptFlow.svelte.d.ts

@@ -1,5 +1,5 @@
 import { SvelteComponent } from "svelte";
-import { type AttemptView, type CaptchaController, type EmailDelivery, type FieldError, type MfaEnrollmentController, type MfaEnrollmentState } from '@atlasauth/js';
+import { type AttemptView, type CaptchaController, type EmailDelivery, type FieldError, type FlowState, type MfaEnrollmentController, type MfaEnrollmentState } from '@atlasauth/js';
 declare const __propDef: {
     props: {
         /**
@@ -55,6 +55,7 @@ declare const __propDef: {
            */ emailVerification?: string;
         onResend?: (() => Promise<boolean>) | null;
         /** The user declined a policy the sign-in was waiting on (`needs_policy_acceptance`): cancel the attempt. */ onPolicyDecline?: ((title: string) => void) | null;
+        /** `FlowState.passwordHold`: offers the emailed proof, whichever factors the instance signs in with. */ passwordHold?: FlowState["passwordHold"];
     };
     events: {
         [evt: string]: CustomEvent<any>;

package/dist/components/SignIn.svelte

@@ -85,6 +85,8 @@ function submitIdentifier(values) {
   titleKey="signIn.title"
   onSubmit={submitIdentifier}
   onPrepare={flow.prepare}
+  passwordHold={$flowState.passwordHold ?? null}
+  emailVerification={$settings?.account.emailVerification ?? 'code'}
   onEmailSecondFactor={$settings?.account.emailSecondFactor ? flow.sendEmailSecondFactor : null}
   onSmsSecondFactor={$settings && flow.mfaChoices().sms ? flow.sendSmsSecondFactor : null}
   enrollment={flow.enrollment}

package/dist/components/SignUp.svelte

@@ -1,13 +1,23 @@
 <script>import { onDestroy, onMount } from "svelte";
-import { awaitingPasskey, passkeysSupported } from "@atlasauth/js";
+import { awaitingPasskey, existingAccountResetUrl, passkeysSupported, pendingExistingAccountNotice, pendingRecoveryCodes, signInAfterProofUrl, signUpProvedByLink } from "@atlasauth/js";
 import { signUp } from "../accessors";
+import { classFor } from "../appearance";
+import { useAtlas } from "../context";
+import { translate } from "../i18n";
 import AttemptFlow from "./AttemptFlow.svelte";
 import PasskeySignUpStep from "./PasskeySignUpStep.svelte";
+import RecoveryCodes from "./RecoveryCodes.svelte";
 import SignUpForm from "./SignUpForm.svelte";
 export let afterUrl = void 0;
-const flow = signUp();
+export let resetPasswordUrl = void 0;
+export let signInUrl = void 0;
+const atlas = useAtlas();
+const cls = (key, base) => classFor(key, atlas.appearance, base);
+const t = (key) => translate(atlas.catalog, key);
+const flow = signUp({ holdExistingAccountNotice: true });
 const flowState = flow.state;
 const settings = flow.settings;
+const enrollmentState = flow.enrollmentState;
 onDestroy(() => flow.destroy());
 onMount(() => {
   void flow.loadPolicies();
@@ -18,13 +28,38 @@ let mode = "password";
 $: offer = $settings?.account.passkeySignUp ?? null;
 $: canPasskey = !!offer && passkeysSupported();
 $: usingPasskey = mode === "passkey" && canPasskey;
+$: recoveryCodes = pendingRecoveryCodes($flowState);
 function switchMode() {
   mode = usingPasskey ? "password" : "passkey";
 }
 </script>
 
-{#if $flowState.attempt && awaitingPasskey($flowState.attempt)}
+{#if recoveryCodes}
+  <RecoveryCodes codes={recoveryCodes} busy={$flowState.busy} onSaved={flow.saveRecoveryCodes} />
+{:else if pendingExistingAccountNotice($flowState)}
+  {@const resetHref = existingAccountResetUrl({ url: resetPasswordUrl, frontendApi: atlas.frontendApi, redirectUrl: afterUrl })}
+  <div class={cls('card', 'atlas-card')} data-atlas-existing-account="">
+    <h1 class={cls('headerTitle', 'atlas-title')}>{t('signUp.title')}</h1>
+    <p class="atlas-text">{t('signUp.existingAccount')}</p>
+    {#if resetHref}
+      <p class="atlas-text"><a class="atlas-link" href={resetHref}>{t('signIn.forgotPassword')}</a></p>
+    {/if}
+    <button class={cls('formButtonPrimary', 'atlas-button')} type="button" disabled={$flowState.busy} on:click={() => flow.continueAfterExistingAccount()}>
+      {t('signUp.submit')}
+    </button>
+  </div>
+{:else if $flowState.attempt && awaitingPasskey($flowState.attempt)}
   <PasskeySignUpStep busy={$flowState.busy} errors={$flowState.errors} onCreate={flow.createPasskey} />
+{:else if signUpProvedByLink($flowState.attempt)}
+  <!-- A link confirmed the address and made no session here. Says the same for any address. -->
+  {@const signInHref = signInAfterProofUrl({ url: signInUrl, frontendApi: atlas.frontendApi, redirectUrl: afterUrl })}
+  <div class={cls('card', 'atlas-card')} data-atlas-email-confirmed="">
+    <h1 class={cls('headerTitle', 'atlas-title')}>{t('signUp.title')}</h1>
+    <p class="atlas-text" role="status">{t('signUp.emailConfirmed')}</p>
+    {#if signInHref}
+      <a class={cls('formButtonPrimary', 'atlas-button')} href={signInHref}>{t('signIn.title')}</a>
+    {/if}
+  </div>
 {:else if $flowState.attempt}
   <AttemptFlow
     attempt={$flowState.attempt}
@@ -35,6 +70,11 @@ function switchMode() {
     onSubmit={flow.submit}
     emailVerification={$settings?.account.emailVerification ?? 'code'}
     onResend={flow.resendSignUp}
+    onEmailSecondFactor={$settings?.account.emailSecondFactor ? flow.sendEmailSecondFactor : null}
+    onSmsSecondFactor={$settings && flow.mfaChoices().sms ? flow.sendSmsSecondFactor : null}
+    enrollment={flow.enrollment}
+    enrollmentState={$enrollmentState}
+    onPolicyDecline={flow.declinePolicy}
   />
 {:else}
   <SignUpForm

package/dist/components/SignUp.svelte.d.ts

@@ -8,6 +8,8 @@ declare const __propDef: {
            * `/v1/client/sign_ups`; from there the flow is server-driven exactly like
            * `<SignIn/>` (the emailed-code step, then the ticket exchange).
            */ afterUrl?: string | undefined;
+        /** Where the existing-account notice's "Forgot password?" goes. Default: the hosted sign-in page; `null` hides it. */ resetPasswordUrl?: string | null | undefined;
+        /** Where "Sign in" goes once an emailed link confirmed the address and made no session here. Default: the hosted sign-in page; `null` hides it. */ signInUrl?: string | null | undefined;
     };
     events: {
         [evt: string]: CustomEvent<any>;

package/dist/i18n.js

@@ -33,6 +33,9 @@ export const EN_US = {
     'signIn.resendCode': 'Resend code',
     'signIn.resendLink': 'Resend link',
     'signIn.passwordOption': 'Use your password instead',
+    'signIn.passwordHoldReleased': 'Your email is verified. Enter your password to sign in.',
+    'signUp.existingAccount': 'You already had an account. Your existing password still applies.',
+    'signUp.emailConfirmed': 'Your email is confirmed. Sign in to continue.',
     'signIn.passkeyButton': 'Sign in with a passkey',
     'signIn.passkeyCancelled': "Passkey sign-in didn't finish. Try again, or use another way to sign in.",
     'signIn.signedIn': 'You\'re signed in.',
@@ -187,6 +190,9 @@ export const EN_US = {
     'error.email_delivery_unavailable': "This app can't send email right now. Try another sign-in method or contact the app owner.",
     'error.strategy_disabled': 'This sign-in method is not available for this app.',
     'error.sign_up_restricted': 'Sign-up on this app is by invitation only.',
+    'error.sign_up_denied': 'Sign-up is not available for this account.',
+    'error.password_not_yet_usable': 'Verify your email address before signing in with this password.',
+    'error.account_deleted': 'The account for this address was deleted, so it can’t be used to sign up again.',
     'error.waitlisted': "You're on the waitlist. We'll email you when a place opens up.",
     'error.identifier_not_allowed': 'This email or phone number is not allowed on this app.',
     'error.disposable_email_blocked': 'Sign-up with a disposable or temporary email address is not allowed.',
@@ -195,6 +201,7 @@ export const EN_US = {
     'error.sign_ups_disabled': 'Sign-ups are temporarily disabled.',
     'error.high_risk_blocked': 'This sign-in was blocked because it looked unusual.',
     'error.sms_region_blocked': 'Text messages are not available for this phone number.',
+    'error.github_team_required': 'Your GitHub account is not a member of a GitHub organization or team allowed to sign in here.',
 };
 /**
  * Look up a key and interpolate `{placeholders}`.

package/dist/version.d.ts

@@ -1,4 +1,4 @@
 import type { AtlasSdkInfo } from '@atlasauth/js';
 /** This package's version, sent as `X-Atlas-SDK` (kept in step with package.json by a test). */
-export declare const ATLAS_SVELTE_VERSION = "0.13.0";
+export declare const ATLAS_SVELTE_VERSION = "0.15.0";
 export declare const ATLAS_SVELTE_SDK: AtlasSdkInfo;

package/dist/version.js

@@ -1,3 +1,3 @@
 /** This package's version, sent as `X-Atlas-SDK` (kept in step with package.json by a test). */
-export const ATLAS_SVELTE_VERSION = '0.13.0';
+export const ATLAS_SVELTE_VERSION = '0.15.0';
 export const ATLAS_SVELTE_SDK = { name: '@atlasauth/svelte', version: ATLAS_SVELTE_VERSION };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/svelte",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "type": "module",
   "svelte": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -23,9 +23,9 @@
   },
   "dependencies": {
     "@atlasauth/design": "0.3.0",
-    "@atlasauth/js": "0.27.0",
+    "@atlasauth/js": "0.33.0",
     "@atlasauth/authz": "0.3.0",
-    "@atlasauth/backend": "0.28.0"
+    "@atlasauth/backend": "0.39.0"
   },
   "peerDependencies": {
     "svelte": ">=4",