@passflow/react 0.11.0 → 0.13.0

package/CHANGELOG.md

@@ -2,6 +2,33 @@
 
 All notable changes to `@passflow/react` are documented in this file.
 
+## [0.13.0] - 2026-10-30
+
+### Added
+
+- Every sign-in path reaches the 2FA screen when the server asks for a second factor: sign-up, password reset, the typed OTP and the emailed link join sign-in's password and passkey paths, and `PassflowProvider` sends a federated landing that carries `#tfa_token=` there too. The route is the mounted flow's own, or the new `twoFactorVerifyPath` prop on `PassflowProvider`, `SignUp`, `VerifyChallengeOTP` and `ResetPassword`. A signed-in user who opens a `#tfa_token=` link stays where they are.
+- A "Trust this device" switch on the 2FA verify and recovery forms, off by default and labelled through `trustDeviceLabel`. Ticked, the server trusts the browser, and its later sign-ins skip the second factor while the app trusts devices.
+- `useTwoFactorVerify().verify(code, options?)` and `.useRecoveryCode(code, options?)` take `{ trustDevice }`.
+- `useTrustedDevices()` lists the user's trusted devices on the app and revokes one.
+- `Button` gains a `link` variant, which the 2FA forms' "use a recovery code" links now use; `Switch` gets its Storybook stories.
+
+### Changed
+
+- Requires `@passflow/core` 0.18.0 or later, up from 0.17.0.
+
+Needs a server that asks for the second factor on every sign-in path and sets trusted-device cookies (Passflow `src/v0.18.0`).
+
+## [0.12.0] - 2026-10-29
+
+### Added
+
+- The device verification page asks for a second factor when the CLI's app requires one. `/oidc/device/authenticate` says so with `second_factor_required` and `second_factor_methods`, and that ticket can no longer approve. The page asks for an authenticator code, or a recovery code instead, posts it to `/oidc/device/second-factor`, and approves with the ticket that answers, which records both factors. A consent tap and the passkey mode approve straight after the factor; full login lands on the usual approval screen.
+- `useDeviceVerify` gains a `second_factor` status, `isSecondFactorPending`, `secondFactorMethods` and `submitSecondFactor`.
+- A `second-factor` `LoginScreen` state, with a catalogued Storybook story for entering a code, checking it, and a wrong code. It uses the sign-in's own two-factor copy and switches between an authenticator code and a recovery code.
+- The device error taxonomy gains `second_factor_invalid` and `missing_second_factor`, each with the page's own copy.
+
+Needs a server that sends `second_factor_required` (Passflow `src/v0.16.1`). Against an older server the page behaves as in 0.11.0.
+
 ## [0.11.0] - 2026-10-28
 
 ### Changed