@atlasauth/svelte 0.14.0 → 0.15.0

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # @atlasauth/svelte changelog
 
+## 0.15.0 — 2026-11-05
+
+- `<SignUp>` second-factor, enrolment and recovery-code steps; new `signInUrl`.
+
 ## 0.14.0 — 2026-11-05
 
 ### Added

package/dist/accessors.js

@@ -163,7 +163,13 @@ function createFlow(options = {}) {
     async function finish(next) {
         // An enrolment's recovery codes are shown first; `saveRecoveryCodes` finishes.
         if (pendingRecoveryCodes(next)) {
-            state.set({ ...next, busy: false });
+            // The ticket dies in 60 seconds and saving the codes can take longer: redeem it now,
+            // and `saveRecoveryCodes` finishes. A refused exchange keeps the ticket, so the save reports it.
+            state.set({ ...next, busy: true });
+            const res = next.ticket
+                ? await client.post('/v1/client/tickets/exchange', { attempt_id: next.attempt.id, ticket: next.ticket })
+                : null;
+            state.set({ ...next, busy: false, ticket: res?.ok ? null : next.ticket });
             return;
         }
         if (next.attempt?.status === 'complete') {

package/dist/components/AttemptFlow.svelte

@@ -44,7 +44,6 @@ $: {
   const listed = offered.filter((s) => s === "email_code" || s === "email_link");
   emailOptions = !onPrepare ? [] : holdOption && !listed.includes(holdOption) ? [...listed, holdOption] : listed;
 }
-$: provedSignUp = step.kind === "collect_first_factor" && attempt?.object === "sign_up_attempt" && !(attempt.supported_first_factors ?? []).includes("passkey");
 $: plan = planFirstFactor(offered);
 $: showPassword = offered.includes("password") || emailOptions.length === 0;
 let prepared = null;
@@ -100,7 +99,6 @@ $: fields = (() => {
     case "collect_identifier":
       return [{ name: "identifier", labelKey: "signIn.identifierLabel", type: "email", autocomplete: "username webauthn" }];
     case "collect_first_factor":
-      if (provedSignUp) return [];
       if (sent === "email_code") {
         return [{ name: "code", labelKey: "signIn.emailCodeLabel", type: "text" }];
       }
@@ -199,7 +197,7 @@ function handleSubmit(event) {
       {#if sending}
         <p class="atlas-text" aria-live="polite">{t('signIn.sending')}</p>
       {/if}
-      {#if provedSignUp || (step.kind === 'collect_first_factor' && released && sent === null)}
+      {#if step.kind === 'collect_first_factor' && released && sent === null}
         <p class="atlas-text" data-atlas-password-released="">{t('signIn.passwordHoldReleased')}</p>
       {/if}
       {#if linkOnly}

package/dist/components/SignUp.svelte

@@ -1,20 +1,23 @@
 <script>import { onDestroy, onMount } from "svelte";
-import { awaitingPasskey, existingAccountResetUrl, passkeysSupported, pendingExistingAccountNotice } from "@atlasauth/js";
+import { awaitingPasskey, existingAccountResetUrl, passkeysSupported, pendingExistingAccountNotice, pendingRecoveryCodes, signInAfterProofUrl, signUpProvedByLink } from "@atlasauth/js";
 import { signUp } from "../accessors";
 import { classFor } from "../appearance";
 import { useAtlas } from "../context";
 import { translate } from "../i18n";
 import AttemptFlow from "./AttemptFlow.svelte";
 import PasskeySignUpStep from "./PasskeySignUpStep.svelte";
+import RecoveryCodes from "./RecoveryCodes.svelte";
 import SignUpForm from "./SignUpForm.svelte";
 export let afterUrl = void 0;
 export let resetPasswordUrl = void 0;
+export let signInUrl = void 0;
 const atlas = useAtlas();
 const cls = (key, base) => classFor(key, atlas.appearance, base);
 const t = (key) => translate(atlas.catalog, key);
 const flow = signUp({ holdExistingAccountNotice: true });
 const flowState = flow.state;
 const settings = flow.settings;
+const enrollmentState = flow.enrollmentState;
 onDestroy(() => flow.destroy());
 onMount(() => {
   void flow.loadPolicies();
@@ -25,12 +28,15 @@ let mode = "password";
 $: offer = $settings?.account.passkeySignUp ?? null;
 $: canPasskey = !!offer && passkeysSupported();
 $: usingPasskey = mode === "passkey" && canPasskey;
+$: recoveryCodes = pendingRecoveryCodes($flowState);
 function switchMode() {
   mode = usingPasskey ? "password" : "passkey";
 }
 </script>
 
-{#if pendingExistingAccountNotice($flowState)}
+{#if recoveryCodes}
+  <RecoveryCodes codes={recoveryCodes} busy={$flowState.busy} onSaved={flow.saveRecoveryCodes} />
+{:else if pendingExistingAccountNotice($flowState)}
   {@const resetHref = existingAccountResetUrl({ url: resetPasswordUrl, frontendApi: atlas.frontendApi, redirectUrl: afterUrl })}
   <div class={cls('card', 'atlas-card')} data-atlas-existing-account="">
     <h1 class={cls('headerTitle', 'atlas-title')}>{t('signUp.title')}</h1>
@@ -44,6 +50,16 @@ function switchMode() {
   </div>
 {:else if $flowState.attempt && awaitingPasskey($flowState.attempt)}
   <PasskeySignUpStep busy={$flowState.busy} errors={$flowState.errors} onCreate={flow.createPasskey} />
+{:else if signUpProvedByLink($flowState.attempt)}
+  <!-- A link confirmed the address and made no session here. Says the same for any address. -->
+  {@const signInHref = signInAfterProofUrl({ url: signInUrl, frontendApi: atlas.frontendApi, redirectUrl: afterUrl })}
+  <div class={cls('card', 'atlas-card')} data-atlas-email-confirmed="">
+    <h1 class={cls('headerTitle', 'atlas-title')}>{t('signUp.title')}</h1>
+    <p class="atlas-text" role="status">{t('signUp.emailConfirmed')}</p>
+    {#if signInHref}
+      <a class={cls('formButtonPrimary', 'atlas-button')} href={signInHref}>{t('signIn.title')}</a>
+    {/if}
+  </div>
 {:else if $flowState.attempt}
   <AttemptFlow
     attempt={$flowState.attempt}
@@ -54,6 +70,11 @@ function switchMode() {
     onSubmit={flow.submit}
     emailVerification={$settings?.account.emailVerification ?? 'code'}
     onResend={flow.resendSignUp}
+    onEmailSecondFactor={$settings?.account.emailSecondFactor ? flow.sendEmailSecondFactor : null}
+    onSmsSecondFactor={$settings && flow.mfaChoices().sms ? flow.sendSmsSecondFactor : null}
+    enrollment={flow.enrollment}
+    enrollmentState={$enrollmentState}
+    onPolicyDecline={flow.declinePolicy}
   />
 {:else}
   <SignUpForm

package/dist/components/SignUp.svelte.d.ts

@@ -9,6 +9,7 @@ declare const __propDef: {
            * `<SignIn/>` (the emailed-code step, then the ticket exchange).
            */ afterUrl?: string | undefined;
         /** Where the existing-account notice's "Forgot password?" goes. Default: the hosted sign-in page; `null` hides it. */ resetPasswordUrl?: string | null | undefined;
+        /** Where "Sign in" goes once an emailed link confirmed the address and made no session here. Default: the hosted sign-in page; `null` hides it. */ signInUrl?: string | null | undefined;
     };
     events: {
         [evt: string]: CustomEvent<any>;

package/dist/i18n.js

@@ -35,6 +35,7 @@ export const EN_US = {
     'signIn.passwordOption': 'Use your password instead',
     'signIn.passwordHoldReleased': 'Your email is verified. Enter your password to sign in.',
     'signUp.existingAccount': 'You already had an account. Your existing password still applies.',
+    'signUp.emailConfirmed': 'Your email is confirmed. Sign in to continue.',
     'signIn.passkeyButton': 'Sign in with a passkey',
     'signIn.passkeyCancelled': "Passkey sign-in didn't finish. Try again, or use another way to sign in.",
     'signIn.signedIn': 'You\'re signed in.',

package/dist/version.d.ts

@@ -1,4 +1,4 @@
 import type { AtlasSdkInfo } from '@atlasauth/js';
 /** This package's version, sent as `X-Atlas-SDK` (kept in step with package.json by a test). */
-export declare const ATLAS_SVELTE_VERSION = "0.14.0";
+export declare const ATLAS_SVELTE_VERSION = "0.15.0";
 export declare const ATLAS_SVELTE_SDK: AtlasSdkInfo;

package/dist/version.js

@@ -1,3 +1,3 @@
 /** This package's version, sent as `X-Atlas-SDK` (kept in step with package.json by a test). */
-export const ATLAS_SVELTE_VERSION = '0.14.0';
+export const ATLAS_SVELTE_VERSION = '0.15.0';
 export const ATLAS_SVELTE_SDK = { name: '@atlasauth/svelte', version: ATLAS_SVELTE_VERSION };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/svelte",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "type": "module",
   "svelte": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -23,9 +23,9 @@
   },
   "dependencies": {
     "@atlasauth/design": "0.3.0",
-    "@atlasauth/js": "0.32.0",
+    "@atlasauth/js": "0.33.0",
     "@atlasauth/authz": "0.3.0",
-    "@atlasauth/backend": "0.38.0"
+    "@atlasauth/backend": "0.39.0"
   },
   "peerDependencies": {
     "svelte": ">=4",