@atlasauth/svelte 0.16.1 → 0.16.3

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @atlasauth/svelte changelog
 
+## 0.16.3 — 2026-11-06
+
+- The second-factor step emails the code on arrival when that's the account's only way, and offers "Use a passkey", which continues on the hosted page. Picks up the passkey origin handling from `@atlasauth/js` 0.34.2.
+
+## 0.16.2 — 2026-11-06
+
+- A username taken while the sign-up waited no longer shows a sign-in link beside the error. Picks up passkey promotion from `@atlasauth/js` 0.34.1.
+
 ## 0.16.1 — 2026-11-06
 
 - The sign-up code step shows a sign-in link beside the taken-address error.

package/dist/accessors.d.ts

@@ -127,6 +127,10 @@ export interface FlowController {
         sentTo?: string;
         error?: string;
     }>;
+    /** On arrival at the second factor: emails the code if the inbox is the only way. Resolves the masked address, or null. */
+    sendOnlyWayEmail(attemptId: string): Promise<string | null>;
+    /** Leaves for the hosted page to do the second factor with a passkey there. */
+    continueWithPasskey(attemptId: string): boolean;
     /** What the app lets the MFA steps offer (from {@link settings}). */
     mfaChoices(): MfaChoices;
     /**

package/dist/accessors.js

@@ -1,5 +1,5 @@
 import { derived, get, readable, writable } from 'svelte/store';
-import { FapiClient, advanceWithCaptcha, atlasCaptchaLabels, attemptPasswordHoldProof, preparePasswordHoldProof, createCaptchaController, createPasskeySignInController, createPasskeySignUp, createSignUp, finishPasskeySignUp, fetchInstanceSettings, fetchLastSignInMethod, startSignInWithAtlas, flowNeedsCaptcha, signInCaptchaOptions, flowFromPending, pollAttempt, prepareFactor, shouldKeepPolling, createOrganizationAuditLog, createMfaEnrollment, acknowledgeExistingAccount, acknowledgeRecoveryCodes, pendingExistingAccountNotice, pendingRecoveryCodes, mfaChoicesFrom, prepareSecondFactorCode, resendSignUpVerification, PolicyAcceptanceController, loadPolicies as loadPolicyList, initialFlow as emptyFlow, } from '@atlasauth/js';
+import { FapiClient, advanceWithCaptcha, atlasCaptchaLabels, attemptPasswordHoldProof, preparePasswordHoldProof, createCaptchaController, createPasskeySignInController, createPasskeySignUp, createSignUp, finishPasskeySignUp, fetchInstanceSettings, fetchLastSignInMethod, startSignInWithAtlas, flowNeedsCaptcha, signInCaptchaOptions, flowFromPending, pollAttempt, prepareFactor, shouldKeepPolling, createOrganizationAuditLog, createMfaEnrollment, acknowledgeExistingAccount, acknowledgeRecoveryCodes, pendingExistingAccountNotice, pendingRecoveryCodes, mfaChoicesFrom, prepareSecondFactorCode, sendOnlyWaySecondFactorCode, continueOnHostedPage, resendSignUpVerification, PolicyAcceptanceController, loadPolicies as loadPolicyList, initialFlow as emptyFlow, } from '@atlasauth/js';
 import { useAtlas } from './context';
 import { translate } from './i18n';
 import { evaluate } from './protect';
@@ -250,6 +250,8 @@ function createFlow(options = {}) {
     }
     const sendEmailSecondFactor = () => sendSecondFactorCode('email_code');
     const sendSmsSecondFactor = () => sendSecondFactorCode('sms');
+    const sendOnlyWayEmail = (attemptId) => sendOnlyWaySecondFactorCode(client, attemptId);
+    const continueWithPasskey = (attemptId) => continueOnHostedPage(mfaChoices(), attemptId, 'needs_second_factor');
     // The MFA enrolment step: started while the flow is at needs_mfa_enrollment.
     const mfaChoices = () => mfaChoicesFrom(get(settings)?.account);
     const enrollment = createMfaEnrollment(client, mfaChoices);
@@ -329,6 +331,8 @@ function createFlow(options = {}) {
         createPasskey,
         sendEmailSecondFactor,
         sendSmsSecondFactor,
+        sendOnlyWayEmail,
+        continueWithPasskey,
         mfaChoices,
         enrollment,
         enrollmentState: { subscribe: enrollmentState.subscribe },

package/dist/components/AttemptFlow.svelte

@@ -25,6 +25,8 @@ export let emailDelivery = null;
 export let onPrepare = null;
 export let onEmailSecondFactor = null;
 export let onSmsSecondFactor = null;
+export let onOnlyWayEmail = null;
+export let onPasskeySecondFactor = null;
 export let enrollment = null;
 export let enrollmentState = null;
 export let matchCode = null;
@@ -77,6 +79,14 @@ async function emailSecondFactor() {
   const r = await onEmailSecondFactor();
   emailed = r.error ? { attemptId, error: r.error } : { attemptId, sentTo: r.sentTo ?? "" };
 }
+let onlyWayFor = null;
+$: if (step.kind === "collect_second_factor" && onOnlyWayEmail && attempt?.id && onlyWayFor !== attempt.id) {
+  const attemptId = attempt.id;
+  onlyWayFor = attemptId;
+  void onOnlyWayEmail(attemptId).then((sentTo) => {
+    if (sentTo) emailed = { attemptId, sentTo };
+  });
+}
 let texted = null;
 $: textedNow = texted && texted.attemptId === (attempt?.id ?? null) ? texted : null;
 async function smsSecondFactor() {
@@ -171,7 +181,7 @@ function handleSubmit(event) {
   <h1 class={cls('headerTitle', 'atlas-title')}>{t(titleKey)}</h1>
 
   {#each errors.filter((e) => !e.param) as error (error.code)}
-    <p class={cls('formFieldError', 'atlas-error')} role="alert">{errorText(error)}{#if signInHref && step.kind === 'collect_email_code' && error.code === 'IDENTIFIER_EXISTS'}{' '}<a class="atlas-link" href={signInHref}>{t('signIn.title')}</a>{/if}</p>
+    <p class={cls('formFieldError', 'atlas-error')} role="alert">{errorText(error)}{#if signInHref && step.kind === 'collect_email_code' && error.code === 'IDENTIFIER_EXISTS' && error.meta?.['identifier'] !== 'username'}{' '}<a class="atlas-link" href={signInHref}>{t('signIn.title')}</a>{/if}</p>
   {/each}
 
   <form on:submit={handleSubmit}>
@@ -399,6 +409,17 @@ function handleSubmit(event) {
           {/if}
         {/if}
       {/if}
+      {#if step.kind === 'collect_second_factor' && onPasskeySecondFactor && attempt?.id}
+        <button
+          class={cls('formButtonSecondary', 'atlas-button-secondary')}
+          type="button"
+          data-atlas="passkey-second-factor"
+          disabled={busy}
+          on:click={() => onPasskeySecondFactor?.(attempt?.id ?? '')}
+        >
+          {t('mfa.enrollPasskeyOption')}
+        </button>
+      {/if}
       {#if showEmailOptions}
         {#each emailOptions as strategy (strategy)}
           <button

package/dist/components/AttemptFlow.svelte.d.ts

@@ -43,6 +43,8 @@ declare const __propDef: {
             sentTo?: string;
             error?: string;
         }>) | null;
+        /** On arrival at the second factor: emails the code if the inbox is the only way (masked address, or null). */ onOnlyWayEmail?: ((attemptId: string) => Promise<string | null>) | null;
+        /** "Use a passkey" at the second factor: leaves for the hosted page. */ onPasskeySecondFactor?: ((attemptId: string) => void) | null;
         /**
            * The MFA enrolment step (`FlowController.enrollment` and its state): the
            * authenticator app's QR code and setup key, or a texted code. Null: the step

package/dist/components/SignIn.svelte

@@ -99,6 +99,8 @@ onMount(() => {
   emailVerification={$settings?.account.emailVerification ?? 'code'}
   onEmailSecondFactor={$settings?.account.emailSecondFactor ? flow.sendEmailSecondFactor : null}
   onSmsSecondFactor={$settings && flow.mfaChoices().sms ? flow.sendSmsSecondFactor : null}
+  onOnlyWayEmail={$settings && flow.mfaChoices().emailCode ? flow.sendOnlyWayEmail : null}
+  onPasskeySecondFactor={$settings && flow.mfaChoices().passkey ? flow.continueWithPasskey : null}
   enrollment={flow.enrollment}
   enrollmentState={$enrollmentState}
   emailDelivery={$settings?.emailDelivery ?? null}

package/dist/components/SignUp.svelte

@@ -82,6 +82,8 @@ onMount(() => {
     matchCode={$flowState.matchCode ?? null}
     onEmailSecondFactor={$settings?.account.emailSecondFactor ? flow.sendEmailSecondFactor : null}
     onSmsSecondFactor={$settings && flow.mfaChoices().sms ? flow.sendSmsSecondFactor : null}
+    onOnlyWayEmail={$settings && flow.mfaChoices().emailCode ? flow.sendOnlyWayEmail : null}
+    onPasskeySecondFactor={$settings && flow.mfaChoices().passkey ? flow.continueWithPasskey : null}
     enrollment={flow.enrollment}
     enrollmentState={$enrollmentState}
     onPolicyDecline={flow.declinePolicy}

package/dist/version.d.ts

@@ -1,4 +1,4 @@
 import type { AtlasSdkInfo } from '@atlasauth/js';
 /** This package's version, sent as `X-Atlas-SDK` (kept in step with package.json by a test). */
-export declare const ATLAS_SVELTE_VERSION = "0.16.1";
+export declare const ATLAS_SVELTE_VERSION = "0.16.3";
 export declare const ATLAS_SVELTE_SDK: AtlasSdkInfo;

package/dist/version.js

@@ -1,3 +1,3 @@
 /** This package's version, sent as `X-Atlas-SDK` (kept in step with package.json by a test). */
-export const ATLAS_SVELTE_VERSION = '0.16.1';
+export const ATLAS_SVELTE_VERSION = '0.16.3';
 export const ATLAS_SVELTE_SDK = { name: '@atlasauth/svelte', version: ATLAS_SVELTE_VERSION };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/svelte",
-  "version": "0.16.1",
+  "version": "0.16.3",
   "type": "module",
   "svelte": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -23,9 +23,9 @@
   },
   "dependencies": {
     "@atlasauth/design": "0.3.0",
-    "@atlasauth/js": "0.34.0",
-    "@atlasauth/authz": "0.3.0",
-    "@atlasauth/backend": "0.39.0"
+    "@atlasauth/js": "0.34.2",
+    "@atlasauth/backend": "0.39.0",
+    "@atlasauth/authz": "0.3.0"
   },
   "peerDependencies": {
     "svelte": ">=4",