@atlasauth/angular 0.7.0 → 0.9.0

package/dist/lib/appearance.d.ts

@@ -31,7 +31,7 @@ export interface DesignTokens {
     spacingUnit?: string;
 }
 /** Every element a customer may target. Named for what it IS, not where it sits. */
-export type ElementKey = 'root' | 'card' | 'headerTitle' | 'headerSubtitle' | 'formField' | 'formFieldLabel' | 'formFieldInput' | 'formFieldError' | 'formButtonPrimary' | 'formButtonSecondary' | 'socialButton' | 'dividerText' | 'footerAction' | 'avatar' | 'menu' | 'menuItem' | 'badge';
+export type ElementKey = 'root' | 'card' | 'headerTitle' | 'headerSubtitle' | 'formField' | 'formFieldLabel' | 'formFieldInput' | 'formFieldError' | 'formButtonPrimary' | 'formButtonSecondary' | 'socialButton' | 'dividerText' | 'footerAction' | 'avatar' | 'menu' | 'menuItem' | 'list' | 'listItem' | 'badge';
 export interface Appearance extends DesignAppearance {
     /** A prebuilt token theme to start from (pre-design-system themes). */
     baseTheme?: keyof typeof THEMES;

package/dist/lib/atlas.service.d.ts

@@ -1,6 +1,7 @@
 import { OnDestroy, Signal } from '@angular/core';
 import { Observable } from 'rxjs';
-import { FapiClient, type ErrorLike, type ProviderToken, type SignOutOptions, type SignOutResult, type SignOutEvent, type SignOutListener } from '@atlasauth/js';
+import { AtlasOrganizationAuditLog } from './components/organization-audit-log';
+import { FapiClient, type ErrorLike, type OrganizationAuditLogOptions, type ProviderToken, type SignOutOptions, type SignOutResult, type EndImpersonationResult, type SignOutEvent, type SignOutListener } from '@atlasauth/js';
 import { type ProtectCondition } from '@atlasauth/authz';
 import { type Appearance, type AppearanceRender, type InstanceDesign } from './appearance';
 import { type Catalog } from './i18n';
@@ -124,6 +125,19 @@ export declare class AtlasService implements OnDestroy {
      * `appearance.instanceDesign: false`.
      */
     loadInstanceDesign(): Promise<InstanceDesign | null>;
+    /**
+     * The active organization's audit trail, for its admins: `state` is a signal
+     * of `{ entries, loading, forbidden, hasMore }`, one page at a time with
+     * `loadMore()`. `action` narrows it (exact, or a prefix ending in `.`). It
+     * follows the active organization; call `destroy()` when done. The peer of
+     * React's `useOrganizationAuditLog`.
+     */
+    organizationAuditLog(options?: OrganizationAuditLogOptions): AtlasOrganizationAuditLog;
+    /**
+     * Re-authenticate the signed-in user with their password (a step-up), for an
+     * action the server answered with STEP_UP_REQUIRED. Rejects when refused.
+     */
+    reauthenticate(password: string): Promise<void>;
     /** A fresh {@link FapiClient} for driving a sign-in/sign-up flow. */
     createFapiClient(): FapiClient;
     /**
@@ -159,6 +173,13 @@ export declare class AtlasService implements OnDestroy {
      * unless `{ frontchannel: false }`.
      */
     signOut(options?: SignOutOptions): Promise<SignOutResult>;
+    /**
+     * End the active impersonation ("return to admin"): the impersonator's own
+     * session on this browser becomes active again with no sign-in
+     * (`resumed: true`); with none, another account signed in here is adopted,
+     * or this browser is signed out.
+     */
+    endImpersonation(): Promise<EndImpersonationResult>;
     /**
      * Switch the active organization (or `null` for the personal account). The
      * new token carries the new org claims, so the app's permission checks update
@@ -166,7 +187,8 @@ export declare class AtlasService implements OnDestroy {
      */
     setActiveOrganization(organizationId: string | null): Promise<void>;
     /** Re-read `/v1/client`: refresh user, session, memberships and status. */
-    reload(): Promise<void>;
+    /** Re-boot from the Frontend API. Resolves true when a session now exists in this browser. */
+    reload(): Promise<boolean>;
     /**
      * §6.3 step 3: complete a redirect-based sign-in, then boot. An OAuth or
      * hosted-page flow lands back with a one-time ticket in the URL; exchange it

package/dist/lib/atlas.ui.d.ts

@@ -10,6 +10,7 @@ import { UserButtonComponent } from './components/user-button.component';
 import { OrganizationSwitcherComponent } from './components/organization-switcher.component';
 import { UserProfileComponent } from './components/user-profile.component';
 import { OrganizationProfileComponent } from './components/organization-profile.component';
+import { OrganizationAuditLogComponent } from './components/organization-audit-log.component';
 /**
  * Every standalone directive and component the SDK ships. Import the array in a
  * standalone component's `imports`, or rely on `AtlasModule` re-exporting it for
@@ -19,4 +20,4 @@ import { OrganizationProfileComponent } from './components/organization-profile.
  * @Component({ standalone: true, imports: [...ATLAS_UI], template: '…' })
  * ```
  */
-export declare const ATLAS_UI: readonly [typeof AtlasSignedInDirective, typeof AtlasSignedOutDirective, typeof AtlasLoadingDirective, typeof AtlasLoadedDirective, typeof AtlasProtectDirective, typeof AtlasRootDirective, typeof SignInComponent, typeof SignUpComponent, typeof UserButtonComponent, typeof OrganizationSwitcherComponent, typeof UserProfileComponent, typeof OrganizationProfileComponent];
+export declare const ATLAS_UI: readonly [typeof AtlasSignedInDirective, typeof AtlasSignedOutDirective, typeof AtlasLoadingDirective, typeof AtlasLoadedDirective, typeof AtlasProtectDirective, typeof AtlasRootDirective, typeof SignInComponent, typeof SignUpComponent, typeof UserButtonComponent, typeof OrganizationSwitcherComponent, typeof UserProfileComponent, typeof OrganizationProfileComponent, typeof OrganizationAuditLogComponent];

package/dist/lib/components/attempt-flow.component.d.ts

@@ -1,5 +1,5 @@
 import { EventEmitter } from '@angular/core';
-import { type AttemptView, type CaptchaController, type FieldError } from '@atlasauth/js';
+import { type AttemptView, type CaptchaController, type FieldError, type MfaEnrollmentController, type MfaEnrollmentState, type MfaEnrollmentStrategy } from '@atlasauth/js';
 import { type ElementKey } from '../appearance';
 import * as i0 from "@angular/core";
 /**
@@ -9,7 +9,7 @@ import * as i0 from "@angular/core";
  * minor. For a `message` row, `labelKey` carries the message's i18n key.
  */
 interface StepField {
-    kind: 'input' | 'message';
+    kind: 'input' | 'message' | 'alert';
     name: string;
     labelKey: string;
     type: string;
@@ -29,6 +29,8 @@ export declare class AttemptFlowComponent {
     attempt: AttemptView | null;
     busy: boolean;
     errors: FieldError[];
+    /** `FlowState.sessionKept`: whether this browser kept the session the sign-in created. */
+    sessionKept: boolean | undefined;
     titleKey: string;
     /**
      * The sign-in captcha, drawn above the submit button on the identifier step
@@ -48,6 +50,46 @@ export declare class AttemptFlowComponent {
     submitFlow: EventEmitter<Record<string, string>>;
     /** Emits when the user picks a first factor the server must send first (an emailed code). */
     chooseFactor: EventEmitter<"email_code">;
+    /**
+     * Offer "Email me a code instead" at the second factor (the instance's
+     * `account.emailSecondFactor`); `emailSecondFactor` asks for it and
+     * `emailedSecondFactor` reports how it went.
+     */
+    offerEmailSecondFactor: boolean;
+    /** `AtlasFlowController.emailSecondFactor()`: in flight, where it went, or why not. */
+    emailedSecondFactor: {
+        busy?: boolean;
+        sentTo?: string;
+        error?: string;
+    } | null;
+    emailSecondFactor: EventEmitter<void>;
+    /**
+     * Offer "Text me a code instead" at the second factor (where the app offers
+     * texted codes, `AtlasFlowController.mfaChoices().sms`); `smsSecondFactor`
+     * asks for it and `textedSecondFactor` reports how it went.
+     */
+    offerSmsSecondFactor: boolean;
+    /** `AtlasFlowController.smsSecondFactor()`: in flight, where it went, or why not. */
+    textedSecondFactor: {
+        busy?: boolean;
+        sentTo?: string;
+        error?: string;
+    } | null;
+    smsSecondFactor: EventEmitter<void>;
+    /**
+     * The MFA enrolment step (`AtlasFlowController.enrollment` and
+     * `enrollmentState()`): the authenticator app's QR code and setup key, or a
+     * texted code. Null: the step asks for two authenticator codes only.
+     */
+    enrollment: MfaEnrollmentController | null;
+    enrollmentState: MfaEnrollmentState | null;
+    /**
+     * The instance's `account.emailVerification`. On `link` a sign-up's
+     * verification step has nothing to type: it says to open the emailed link
+     * while the flow polls, and offers a resend (`resend`).
+     */
+    emailVerification: string;
+    resend: EventEmitter<void>;
     protected values: Record<string, string>;
     protected t(key: string, vars?: Record<string, string>): string;
     /** A server error in the app's language (`error.<reason>`, else the server's message). */
@@ -55,18 +97,33 @@ export declare class AttemptFlowComponent {
     protected cls(key: ElementKey, base: string): string;
     protected setValue(name: string, value: string): void;
     protected onSubmit(event: Event): void;
+    /** The shared enrolment step is drawn (a controller was passed and the flow is enrolling). */
+    protected enrolling(): boolean;
+    protected chooseMethod(method: MfaEnrollmentStrategy): void;
+    protected resendEnrollment(): void;
+    protected otherMethods(state: MfaEnrollmentState): MfaEnrollmentStrategy[];
+    protected setupKey(secret: string): string;
+    /** The submit button's label key (enrolment: "Text me a code" before the number is sent). */
+    protected submitKey(): string;
+    protected showSmsSecondFactor(): boolean;
+    /** Where the texted second-factor code went (masked), once it was sent. */
+    protected smsSecondFactorSentTo(): string | null;
     protected formErrors(): FieldError[];
     protected fieldErrorsFor(name: string): FieldError[];
     private step;
     protected showCaptcha(): boolean;
     /** The first factors on offer at a `needs_first_factor` step (empty on any other). */
     private offered;
+    protected linkOnly(): boolean;
+    protected showEmailSecondFactor(): boolean;
+    /** Where the emailed second-factor code went (masked), once it was sent. */
+    protected emailSecondFactorSentTo(): string | null;
     protected showEmailCodeOption(): boolean;
     /** The "we sent a code to …" line on the code step. */
     protected codeSentText(): string | null;
     protected showSubmit(): boolean;
     protected fields(): StepField[];
     static ɵfac: i0.ɵɵFactoryDeclaration<AttemptFlowComponent, never>;
-    static ɵcmp: i0.ɵɵComponentDeclaration<AttemptFlowComponent, "atlas-attempt-flow", never, { "attempt": { "alias": "attempt"; "required": false; }; "busy": { "alias": "busy"; "required": false; }; "errors": { "alias": "errors"; "required": false; }; "titleKey": { "alias": "titleKey"; "required": false; }; "captcha": { "alias": "captcha"; "required": false; }; "firstFactors": { "alias": "firstFactors"; "required": false; }; "preparedFactor": { "alias": "preparedFactor"; "required": false; }; }, { "submitFlow": "submitFlow"; "chooseFactor": "chooseFactor"; }, never, never, true, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<AttemptFlowComponent, "atlas-attempt-flow", never, { "attempt": { "alias": "attempt"; "required": false; }; "busy": { "alias": "busy"; "required": false; }; "errors": { "alias": "errors"; "required": false; }; "sessionKept": { "alias": "sessionKept"; "required": false; }; "titleKey": { "alias": "titleKey"; "required": false; }; "captcha": { "alias": "captcha"; "required": false; }; "firstFactors": { "alias": "firstFactors"; "required": false; }; "preparedFactor": { "alias": "preparedFactor"; "required": false; }; "offerEmailSecondFactor": { "alias": "offerEmailSecondFactor"; "required": false; }; "emailedSecondFactor": { "alias": "emailedSecondFactor"; "required": false; }; "offerSmsSecondFactor": { "alias": "offerSmsSecondFactor"; "required": false; }; "textedSecondFactor": { "alias": "textedSecondFactor"; "required": false; }; "enrollment": { "alias": "enrollment"; "required": false; }; "enrollmentState": { "alias": "enrollmentState"; "required": false; }; "emailVerification": { "alias": "emailVerification"; "required": false; }; }, { "submitFlow": "submitFlow"; "chooseFactor": "chooseFactor"; "emailSecondFactor": "emailSecondFactor"; "smsSecondFactor": "smsSecondFactor"; "resend": "resend"; }, never, never, true, never>;
 }
 export {};

package/dist/lib/components/flow-controller.d.ts

@@ -1,5 +1,5 @@
 import { WritableSignal } from '@angular/core';
-import { FapiClient, type CaptchaController, type FlowState, type InstanceSettings } from '@atlasauth/js';
+import { FapiClient, type CaptchaController, type FlowState, type InstanceSettings, type MfaChoices, type MfaEnrollmentController, type MfaEnrollmentState } from '@atlasauth/js';
 /**
  * The server-driven sign-in / sign-up engine, shared by `<atlas-sign-in>` and
  * `<atlas-sign-up>` — the Angular counterpart of React's `useFlow` hook.
@@ -26,6 +26,11 @@ export declare class AtlasFlowController {
      * resolves, or when the server could not be reached.
      */
     readonly settings: WritableSignal<InstanceSettings>;
+    /**
+     * The method this browser last signed in with (`password`, `oauth_github`, …)
+     * for the "Last used" hint; null when none, or the instance turned it off.
+     */
+    readonly lastMethod: WritableSignal<string>;
     /** The sign-in captcha (identifier step / `needs_captcha` challenge). */
     readonly captcha: CaptchaController;
     /** The sign-up captcha (the create-account step). */
@@ -40,14 +45,41 @@ export declare class AtlasFlowController {
      * otherwise.
      */
     readonly preparedFactor: WritableSignal<"email_code">;
+    /**
+     * "Email me a code instead" at the second factor ({@link sendEmailSecondFactor}):
+     * in flight, where the code went, or why it was not sent. Null until asked,
+     * and again once the flow leaves that step.
+     */
+    readonly emailSecondFactor: WritableSignal<{
+        busy?: boolean;
+        sentTo?: string;
+        error?: string;
+    }>;
+    /** "Text me a code instead" at the second factor ({@link sendSmsSecondFactor}): as {@link emailSecondFactor}. */
+    readonly smsSecondFactor: WritableSignal<{
+        busy?: boolean;
+        sentTo?: string;
+        error?: string;
+    }>;
+    /**
+     * The MFA enrolment step (`needs_mfa_enrollment`): the authenticator app's
+     * setup (QR code, setup key) or a texted code. Started and reset with the flow.
+     */
+    readonly enrollment: MfaEnrollmentController;
+    /** {@link enrollment}'s state, for templates. */
+    readonly enrollmentState: WritableSignal<MfaEnrollmentState>;
     private pollTimer;
     private identifier;
-    constructor(client: FapiClient, reload: () => Promise<void>, pending: {
+    constructor(client: FapiClient, reload: () => Promise<boolean>, pending: {
         id: string;
         status: string;
     } | null, 
     /** Resolves the captcha messages' catalog keys. Defaults to en-US. */
     t?: (key: string) => string);
+    /** What the app lets the MFA steps offer (from {@link settings}). */
+    mfaChoices(): MfaChoices;
+    /** Start the enrolment step for its attempt, or reset it once the flow leaves. */
+    private syncEnrollment;
     /** Fetch the instance's public settings and draw whatever captcha they require. */
     loadSettings(): Promise<void>;
     /**
@@ -94,6 +126,37 @@ export declare class AtlasFlowController {
      * then posted with {@link submit}.
      */
     create(values: Record<string, string>, consent?: boolean): Promise<void>;
+    /**
+     * "Email me a code instead" at the second factor (the instance's
+     * `account.emailSecondFactor`): mails a code to the account's verified email;
+     * it is then posted with {@link submit} like any 2FA code.
+     */
+    sendEmailSecondFactor(): Promise<void>;
+    /**
+     * "Text me a code instead" at the second factor (where the app offers texted
+     * codes, {@link mfaChoices}`().sms`): texts a code to the account's enrolled
+     * phone; it is then posted with {@link submit} like any 2FA code.
+     */
+    sendSmsSecondFactor(): Promise<void>;
+    private sendSecondFactorCode;
+    /** Resend a sign-up's emailed code / link (the earlier one stops working). */
+    resendSignUp(): Promise<void>;
+    /**
+     * Start a passkey-only sign-up (`POST /v1/client/sign_ups/passkey`) from the
+     * create-account form's values — no password. Offered when the instance's
+     * `account.passkeySignUp` is set.
+     */
+    createWithPasskey(values: Record<string, string>, consent?: boolean): Promise<void>;
+    /** The passkey-only sign-up's last step: create the passkey, and with it the account. */
+    createPasskey(): Promise<void>;
+    /**
+     * The recovery codes an MFA enrolment just completed the sign-in with, shown
+     * once before it finishes ({@link saveRecoveryCodes}); null otherwise. They
+     * live only in this controller's memory.
+     */
+    recoveryCodes(): string[] | null;
+    /** "I've saved my codes": forget the recovery codes and finish the sign-in. */
+    saveRecoveryCodes(): Promise<void>;
     private finish;
     /** Start/stop the §5.3 magic-link poll to match the current state. */
     syncPolling(): void;

package/dist/lib/components/impersonation-banner.component.d.ts

@@ -0,0 +1,27 @@
+import { EventEmitter } from '@angular/core';
+import { type EndImpersonationResult } from '@atlasauth/js';
+import { AtlasService } from '../atlas.service';
+import { type ElementKey } from '../appearance';
+import * as i0 from "@angular/core";
+/**
+ * `<atlas-impersonation-banner>` — shown only while the active session is an
+ * impersonation, naming the user acted as, with "Return to admin" (or "End
+ * impersonation" when there is no session of the impersonator's to resume).
+ * Emits `ended` with the outcome. The Angular peer of React's
+ * `<ImpersonationBanner/>`.
+ */
+export declare class ImpersonationBannerComponent {
+    protected readonly atlas: AtlasService;
+    readonly ended: EventEmitter<EndImpersonationResult>;
+    protected readonly busy: import("@angular/core").WritableSignal<boolean>;
+    protected readonly actor: import("@angular/core").Signal<{
+        sub: string;
+    }>;
+    protected readonly canReturn: import("@angular/core").Signal<boolean>;
+    protected readonly name: import("@angular/core").Signal<string>;
+    protected t(key: string, vars?: Record<string, string>): string;
+    protected cls(key: ElementKey, base: string): string;
+    protected end(): Promise<void>;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ImpersonationBannerComponent, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<ImpersonationBannerComponent, "atlas-impersonation-banner", never, {}, { "ended": "ended"; }, never, never, true, never>;
+}

package/dist/lib/components/organization-audit-log.component.d.ts

@@ -0,0 +1,34 @@
+import { type OnDestroy, type OnInit } from '@angular/core';
+import { AtlasService } from '../atlas.service';
+import { type ElementKey } from '../appearance';
+import type { AtlasOrganizationAuditLog } from './organization-audit-log';
+import * as i0 from "@angular/core";
+/**
+ * `<atlas-organization-audit-log>` — the active organization's audit trail for
+ * its admins, next to `<atlas-organization-profile>`. The Angular peer of
+ * React's `<OrganizationAuditLog/>`. Renders nothing for a member who may not
+ * read it (the server is the authority; the component just follows it). Labels
+ * are inputs so an app can localise them.
+ */
+export declare class OrganizationAuditLogComponent implements OnInit, OnDestroy {
+    /** Entries per page (the server caps it). */
+    pageSize?: number;
+    /** Narrow to one action, or a prefix ending in `.`. */
+    action?: string;
+    labels: {
+        title?: string;
+        empty?: string;
+        loadMore?: string;
+        actor?: string;
+    };
+    formatDate: (ms: number) => string;
+    protected readonly atlas: AtlasService;
+    /** Created in ngOnInit, once the inputs are set (templates render after it). */
+    protected log: AtlasOrganizationAuditLog;
+    ngOnInit(): void;
+    ngOnDestroy(): void;
+    protected describe(action: string): string;
+    protected cls(key: ElementKey, base: string): string;
+    static ɵfac: i0.ɵɵFactoryDeclaration<OrganizationAuditLogComponent, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<OrganizationAuditLogComponent, "atlas-organization-audit-log", never, { "pageSize": { "alias": "pageSize"; "required": false; }; "action": { "alias": "action"; "required": false; }; "labels": { "alias": "labels"; "required": false; }; "formatDate": { "alias": "formatDate"; "required": false; }; }, {}, never, never, true, never>;
+}

package/dist/lib/components/organization-audit-log.d.ts

@@ -0,0 +1,25 @@
+import { type Signal } from '@angular/core';
+import type { Observable } from 'rxjs';
+import { type FapiClient, type OrganizationAuditLogOptions, type OrganizationAuditLogState } from '@atlasauth/js';
+import type { AtlasOrganizationMembership } from '../types';
+/**
+ * The active organization's audit trail, for its admins — the engine behind
+ * `<atlas-organization-audit-log>` and `AtlasService.organizationAuditLog()`
+ * (the Angular peer of React's `useOrganizationAuditLog`). `state` is a signal
+ * of `{ entries, loading, forbidden, hasMore }`, one page at a time, newest
+ * first. It follows the active organization until {@link destroy}.
+ */
+export declare class AtlasOrganizationAuditLog {
+    private readonly _state;
+    private readonly log;
+    private readonly unsubscribe;
+    private readonly organizationSub;
+    readonly state: Signal<OrganizationAuditLogState>;
+    constructor(client: Pick<FapiClient, 'get'>, organization$: Observable<AtlasOrganizationMembership | null>, options?: OrganizationAuditLogOptions);
+    /** Append the next page, when there is one. */
+    loadMore(): Promise<void>;
+    /** Re-read from the newest entry. */
+    reload(): Promise<void>;
+    /** Stop following the active organization. */
+    destroy(): void;
+}

package/dist/lib/components/organization-profile.component.d.ts

@@ -1,16 +1,65 @@
+import { EventEmitter } from '@angular/core';
+import { type OrganizationProfileState } from '@atlasauth/js';
 import { AtlasService } from '../atlas.service';
 import { type ElementKey } from '../appearance';
 import * as i0 from "@angular/core";
+type Tab = 'members' | 'invitations' | 'roles' | 'settings';
+type ProfileRole = OrganizationProfileState['roles'][number];
 /**
- * `<atlas-organization-profile>` — the active organization's surface. The
- * Angular peer of React's `<OrganizationProfile/>`. Management controls are
- * gated on the ACTIVE org role via `*atlasProtect`, matching the server's rule
- * rather than duplicating a looser one. Renders nothing with no active org.
+ * `<atlas-organization-profile>` — the active organization's members (admins
+ * change roles and remove), invitations (admins invite, revoke and resend) and
+ * settings (leave; an admin deletes after confirming their password). The
+ * Angular peer of React's `<OrganizationProfile/>`, on the same headless
+ * controller. Every control is gated on the ACTIVE org role, matching the
+ * server's rule. Renders nothing with no active org. Emits `exit` with `left`
+ * or `deleted`.
  */
 export declare class OrganizationProfileComponent {
     protected readonly atlas: AtlasService;
-    protected t(key: string): string;
+    readonly exit: EventEmitter<"left" | "deleted">;
+    private readonly client;
+    private controller;
+    private unsubscribe;
+    protected readonly state: import("@angular/core").WritableSignal<OrganizationProfileState>;
+    protected readonly tab: import("@angular/core").WritableSignal<Tab>;
+    protected readonly email: import("@angular/core").WritableSignal<string>;
+    protected readonly inviteRole: import("@angular/core").WritableSignal<string>;
+    protected readonly confirm: import("@angular/core").WritableSignal<"delete" | "leave">;
+    protected readonly needsPassword: import("@angular/core").WritableSignal<boolean>;
+    protected readonly password: import("@angular/core").WritableSignal<string>;
+    protected readonly editingRole: import("@angular/core").WritableSignal<string>;
+    protected readonly roleKey: import("@angular/core").WritableSignal<string>;
+    protected readonly roleName: import("@angular/core").WritableSignal<string>;
+    protected readonly rolePerms: import("@angular/core").WritableSignal<string[]>;
+    protected readonly customRoles: import("@angular/core").Signal<import("@atlasauth/js").OrganizationRole[]>;
+    protected readonly userId: import("@angular/core").Signal<string>;
+    protected readonly canManage: import("@angular/core").Signal<boolean>;
+    protected readonly isAdmin: import("@angular/core").Signal<boolean>;
+    protected readonly tabs: import("@angular/core").Signal<Tab[]>;
+    protected readonly roles: import("@angular/core").Signal<import("@atlasauth/js").OrganizationRole[] | {
+        key: string;
+        name: string;
+    }[]>;
+    protected readonly errorMessage: import("@angular/core").Signal<string>;
+    constructor();
+    private bind;
+    protected t(key: string, vars?: Record<string, string>): string;
     protected cls(key: ElementKey, base: string): string;
+    protected memberName(m: OrganizationProfileState['members'][number]): string;
+    protected changeRole(userId: string, role: string): void;
+    protected removeMember(userId: string): void;
+    protected sendInvite(): Promise<void>;
+    protected resend(id: string): void;
+    protected revoke(id: string): void;
+    protected leave(): Promise<void>;
+    protected remove(): Promise<void>;
+    protected editRole(role: ProfileRole): void;
+    protected resetRoleForm(): void;
+    protected togglePermission(key: string, on: boolean): void;
+    protected saveRole(): Promise<void>;
+    protected deleteRole(role: ProfileRole): void;
+    protected cancel(): void;
     static ɵfac: i0.ɵɵFactoryDeclaration<OrganizationProfileComponent, never>;
-    static ɵcmp: i0.ɵɵComponentDeclaration<OrganizationProfileComponent, "atlas-organization-profile", never, {}, {}, never, never, true, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<OrganizationProfileComponent, "atlas-organization-profile", never, {}, { "exit": "exit"; }, never, never, true, never>;
 }
+export {};

package/dist/lib/components/recovery-codes.component.d.ts

@@ -0,0 +1,26 @@
+import { EventEmitter, OnChanges } from '@angular/core';
+import { type ElementKey } from '../appearance';
+import * as i0 from "@angular/core";
+/**
+ * The recovery codes a mid-sign-in MFA enrolment came with, shown once before
+ * the sign-in finishes: copy them, download them as a .txt file, then
+ * "I've saved my codes" (`saved`) exchanges the ticket. The codes live only in
+ * the flow controller's memory and are forgotten once saved.
+ */
+export declare class RecoveryCodesComponent implements OnChanges {
+    private readonly atlas;
+    private readonly cdr;
+    codes: string[];
+    busy: boolean;
+    saved: EventEmitter<void>;
+    protected readonly canCopy: boolean;
+    protected readonly canDownload: boolean;
+    protected copied: boolean;
+    ngOnChanges(): void;
+    protected t(key: string): string;
+    protected cls(key: ElementKey, base: string): string;
+    protected copy(): void;
+    protected download(): void;
+    static ɵfac: i0.ɵɵFactoryDeclaration<RecoveryCodesComponent, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<RecoveryCodesComponent, "atlas-recovery-codes", never, { "codes": { "alias": "codes"; "required": false; }; "busy": { "alias": "busy"; "required": false; }; }, { "saved": "saved"; }, never, never, true, never>;
+}

package/dist/lib/components/sign-in.component.d.ts

@@ -15,9 +15,19 @@ export declare class SignInComponent implements OnInit, OnDestroy {
     private readonly atlas;
     /** Where to send the user once the flow completes. Reserved for host routing. */
     afterUrl?: string;
+    /**
+     * Where "No account? Sign up" goes. Default: the instance's hosted sign-up
+     * page (carrying the visitor's referral). `null` hides it. Always shown, never
+     * only after a failed sign-in, so it says nothing about whether an email has an account.
+     */
+    signUpUrl?: string | null;
+    protected t(key: string): string;
+    /** "Last used: Password" on the identifier step, when the instance shows the hint. */
+    protected lastUsedLabel(): string | null;
+    protected signUpHref(): string | null;
     protected readonly flow: AtlasFlowController;
     ngOnInit(): void;
     ngOnDestroy(): void;
     static ɵfac: i0.ɵɵFactoryDeclaration<SignInComponent, never>;
-    static ɵcmp: i0.ɵɵComponentDeclaration<SignInComponent, "atlas-sign-in", never, { "afterUrl": { "alias": "afterUrl"; "required": false; }; }, {}, never, never, true, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<SignInComponent, "atlas-sign-in", never, { "afterUrl": { "alias": "afterUrl"; "required": false; }; "signUpUrl": { "alias": "signUpUrl"; "required": false; }; }, {}, never, never, true, never>;
 }

package/dist/lib/components/sign-up-form.component.d.ts

@@ -21,6 +21,14 @@ export declare class SignUpFormComponent {
     busy: boolean;
     errors: FieldError[];
     captcha: CaptchaController | null;
+    /** Passkey-only sign-up: no password field; the email per the instance's mode. */
+    passkey: {
+        email: 'off' | 'optional' | 'required';
+    } | null;
+    /** Whether the password / passkey toggle is shown (both are offered). */
+    switchable: boolean;
+    /** The user asked for the other sign-up method. */
+    switchMode: EventEmitter<void>;
     /** Emits the typed values and the consent tick when the form is submitted. */
     submitSignUp: EventEmitter<SignUpFormSubmit>;
     protected values: Record<string, string>;
@@ -32,6 +40,8 @@ export declare class SignUpFormComponent {
     protected setValue(name: string, value: string): void;
     /** Email + password sign-up cannot complete: the app cannot send the verification email. */
     protected emailUnavailable(): boolean;
+    protected showEmail(): boolean;
+    protected emailRequired(): boolean;
     protected fields(): PublicSignUpField[];
     protected label(f: PublicSignUpField): string;
     protected inputType(f: PublicSignUpField): string;
@@ -45,5 +55,5 @@ export declare class SignUpFormComponent {
     protected fieldErrorsFor(name: string): FieldError[];
     protected onSubmit(event: Event): void;
     static ɵfac: i0.ɵɵFactoryDeclaration<SignUpFormComponent, never>;
-    static ɵcmp: i0.ɵɵComponentDeclaration<SignUpFormComponent, "atlas-sign-up-form", never, { "settings": { "alias": "settings"; "required": false; }; "busy": { "alias": "busy"; "required": false; }; "errors": { "alias": "errors"; "required": false; }; "captcha": { "alias": "captcha"; "required": false; }; }, { "submitSignUp": "submitSignUp"; }, never, never, true, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<SignUpFormComponent, "atlas-sign-up-form", never, { "settings": { "alias": "settings"; "required": false; }; "busy": { "alias": "busy"; "required": false; }; "errors": { "alias": "errors"; "required": false; }; "captcha": { "alias": "captcha"; "required": false; }; "passkey": { "alias": "passkey"; "required": false; }; "switchable": { "alias": "switchable"; "required": false; }; }, { "switchMode": "switchMode"; "submitSignUp": "submitSignUp"; }, never, never, true, never>;
 }

package/dist/lib/components/sign-up.component.d.ts

@@ -1,4 +1,6 @@
 import { OnDestroy, OnInit } from '@angular/core';
+import { type FieldError } from '@atlasauth/js';
+import { type ElementKey } from '../appearance';
 import { AtlasFlowController } from './flow-controller';
 import * as i0 from "@angular/core";
 /**
@@ -18,6 +20,17 @@ export declare class SignUpComponent implements OnInit, OnDestroy {
     /** Where to send the user once the flow completes. Reserved for host routing. */
     afterUrl?: string;
     protected readonly flow: AtlasFlowController;
+    /** Password or passkey-only sign-up (the latter when the instance offers it). */
+    protected readonly mode: import("@angular/core").WritableSignal<"password" | "passkey">;
+    protected canPasskey(): boolean;
+    protected passkeyForm(): {
+        email: 'off' | 'optional' | 'required';
+    } | null;
+    protected toggleMode(): void;
+    protected awaitingPasskey(): boolean;
+    protected t(key: string): string;
+    protected cls(key: ElementKey, base: string): string;
+    protected errorText(error: FieldError): string;
     ngOnInit(): void;
     ngOnDestroy(): void;
     static ɵfac: i0.ɵɵFactoryDeclaration<SignUpComponent, never>;

package/dist/lib/provide-atlas.d.ts

@@ -13,6 +13,7 @@ import * as i9 from "./components/user-button.component";
 import * as i10 from "./components/organization-switcher.component";
 import * as i11 from "./components/user-profile.component";
 import * as i12 from "./components/organization-profile.component";
+import * as i13 from "./components/organization-audit-log.component";
 /**
  * Standalone-provider entry point (Angular 17+). Register Atlas once at the
  * application root — the direct analogue of wrapping the tree in React's
@@ -41,6 +42,6 @@ export declare function provideAtlas(options: AtlasOptions): EnvironmentProvider
 export declare class AtlasModule {
     static forRoot(options: AtlasOptions): ModuleWithProviders<AtlasModule>;
     static ɵfac: i0.ɵɵFactoryDeclaration<AtlasModule, never>;
-    static ɵmod: i0.ɵɵNgModuleDeclaration<AtlasModule, never, [typeof i1.AtlasSignedInDirective, typeof i2.AtlasSignedOutDirective, typeof i3.AtlasLoadingDirective, typeof i4.AtlasLoadedDirective, typeof i5.AtlasProtectDirective, typeof i6.AtlasRootDirective, typeof i7.SignInComponent, typeof i8.SignUpComponent, typeof i9.UserButtonComponent, typeof i10.OrganizationSwitcherComponent, typeof i11.UserProfileComponent, typeof i12.OrganizationProfileComponent], [typeof i1.AtlasSignedInDirective, typeof i2.AtlasSignedOutDirective, typeof i3.AtlasLoadingDirective, typeof i4.AtlasLoadedDirective, typeof i5.AtlasProtectDirective, typeof i6.AtlasRootDirective, typeof i7.SignInComponent, typeof i8.SignUpComponent, typeof i9.UserButtonComponent, typeof i10.OrganizationSwitcherComponent, typeof i11.UserProfileComponent, typeof i12.OrganizationProfileComponent]>;
+    static ɵmod: i0.ɵɵNgModuleDeclaration<AtlasModule, never, [typeof i1.AtlasSignedInDirective, typeof i2.AtlasSignedOutDirective, typeof i3.AtlasLoadingDirective, typeof i4.AtlasLoadedDirective, typeof i5.AtlasProtectDirective, typeof i6.AtlasRootDirective, typeof i7.SignInComponent, typeof i8.SignUpComponent, typeof i9.UserButtonComponent, typeof i10.OrganizationSwitcherComponent, typeof i11.UserProfileComponent, typeof i12.OrganizationProfileComponent, typeof i13.OrganizationAuditLogComponent], [typeof i1.AtlasSignedInDirective, typeof i2.AtlasSignedOutDirective, typeof i3.AtlasLoadingDirective, typeof i4.AtlasLoadedDirective, typeof i5.AtlasProtectDirective, typeof i6.AtlasRootDirective, typeof i7.SignInComponent, typeof i8.SignUpComponent, typeof i9.UserButtonComponent, typeof i10.OrganizationSwitcherComponent, typeof i11.UserProfileComponent, typeof i12.OrganizationProfileComponent, typeof i13.OrganizationAuditLogComponent]>;
     static ɵinj: i0.ɵɵInjectorDeclaration<AtlasModule>;
 }

package/dist/lib/types.d.ts

@@ -43,6 +43,12 @@ export interface AtlasSession {
     id: string;
     status: string;
     last_active_organization_id: string | null;
+    /** On an impersonation session: who is acting (the token's `act` claim). */
+    actor?: {
+        sub: string;
+    } | null;
+    /** On an impersonation session: the impersonator's own session that "return to admin" resumes, or null. */
+    actor_session_id?: string | null;
 }
 /** The three-state auth lifecycle, identical to the React provider's. */
 export type AuthStatus = 'loading' | 'signed_in' | 'signed_out';

package/dist/lib/version.d.ts

@@ -1,4 +1,4 @@
 import type { AtlasSdkInfo } from '@atlasauth/js';
 /** This package's version, sent as `X-Atlas-SDK` (kept in step with package.json by a test). */
-export declare const ATLAS_ANGULAR_VERSION = "0.7.0";
+export declare const ATLAS_ANGULAR_VERSION = "0.9.0";
 export declare const ATLAS_ANGULAR_SDK: AtlasSdkInfo;

package/dist/public-api.d.ts

@@ -17,6 +17,10 @@ export { UserButtonComponent } from './lib/components/user-button.component';
 export { OrganizationSwitcherComponent } from './lib/components/organization-switcher.component';
 export { UserProfileComponent } from './lib/components/user-profile.component';
 export { OrganizationProfileComponent } from './lib/components/organization-profile.component';
+export { OrganizationAuditLogComponent } from './lib/components/organization-audit-log.component';
+export { AtlasOrganizationAuditLog } from './lib/components/organization-audit-log';
+export type { OrganizationAuditLogEntry, OrganizationAuditLogState, OrganizationAuditLogOptions } from '@atlasauth/js';
+export { ImpersonationBannerComponent } from './lib/components/impersonation-banner.component';
 export { AttemptFlowComponent } from './lib/components/attempt-flow.component';
 export { SignUpFormComponent, type SignUpFormSubmit, } from './lib/components/sign-up-form.component';
 export { AtlasCaptchaSlotDirective } from './lib/directives/captcha-slot.directive';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/angular",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Official Angular SDK for Atlas — the Angular peer of @atlasauth/react.",
   "license": "MIT",
   "module": "./dist/fesm2022/atlas-angular.mjs",
@@ -20,8 +20,8 @@
   "dependencies": {
     "tslib": "^2.6.3",
     "@atlasauth/design": "0.2.0",
-    "@atlasauth/js": "0.13.0",
-    "@atlasauth/authz": "0.1.1"
+    "@atlasauth/js": "0.16.0",
+    "@atlasauth/authz": "0.2.0"
   },
   "peerDependencies": {
     "@angular/core": ">=17",