@atlasauth/angular 0.8.0 → 0.10.0

package/dist/lib/appearance.d.ts

@@ -31,7 +31,7 @@ export interface DesignTokens {
     spacingUnit?: string;
 }
 /** Every element a customer may target. Named for what it IS, not where it sits. */
-export type ElementKey = 'root' | 'card' | 'headerTitle' | 'headerSubtitle' | 'formField' | 'formFieldLabel' | 'formFieldInput' | 'formFieldError' | 'formButtonPrimary' | 'formButtonSecondary' | 'socialButton' | 'dividerText' | 'footerAction' | 'avatar' | 'menu' | 'menuItem' | 'badge';
+export type ElementKey = 'root' | 'card' | 'headerTitle' | 'headerSubtitle' | 'formField' | 'formFieldLabel' | 'formFieldInput' | 'formFieldError' | 'formButtonPrimary' | 'formButtonSecondary' | 'socialButton' | 'dividerText' | 'footerAction' | 'avatar' | 'menu' | 'menuItem' | 'list' | 'listItem' | 'badge';
 export interface Appearance extends DesignAppearance {
     /** A prebuilt token theme to start from (pre-design-system themes). */
     baseTheme?: keyof typeof THEMES;

package/dist/lib/atlas.service.d.ts

@@ -1,6 +1,7 @@
 import { OnDestroy, Signal } from '@angular/core';
 import { Observable } from 'rxjs';
-import { FapiClient, type ErrorLike, type ProviderToken, type SignOutOptions, type SignOutResult, type SignOutEvent, type SignOutListener } from '@atlasauth/js';
+import { AtlasOrganizationAuditLog } from './components/organization-audit-log';
+import { FapiClient, type ErrorLike, type OrganizationAuditLogOptions, type ProviderToken, type SignOutOptions, type SignOutResult, type EndImpersonationResult, type SignOutEvent, type SignOutListener } from '@atlasauth/js';
 import { type ProtectCondition } from '@atlasauth/authz';
 import { type Appearance, type AppearanceRender, type InstanceDesign } from './appearance';
 import { type Catalog } from './i18n';
@@ -56,6 +57,7 @@ export declare class AtlasService implements OnDestroy {
     readonly pendingAttempt: {
         id: string;
         status: string;
+        policyToken?: string;
     } | null;
     private readonly _status;
     private readonly _user;
@@ -124,6 +126,19 @@ export declare class AtlasService implements OnDestroy {
      * `appearance.instanceDesign: false`.
      */
     loadInstanceDesign(): Promise<InstanceDesign | null>;
+    /**
+     * The active organization's audit trail, for its admins: `state` is a signal
+     * of `{ entries, loading, forbidden, hasMore }`, one page at a time with
+     * `loadMore()`. `action` narrows it (exact, or a prefix ending in `.`). It
+     * follows the active organization; call `destroy()` when done. The peer of
+     * React's `useOrganizationAuditLog`.
+     */
+    organizationAuditLog(options?: OrganizationAuditLogOptions): AtlasOrganizationAuditLog;
+    /**
+     * Re-authenticate the signed-in user with their password (a step-up), for an
+     * action the server answered with STEP_UP_REQUIRED. Rejects when refused.
+     */
+    reauthenticate(password: string): Promise<void>;
     /** A fresh {@link FapiClient} for driving a sign-in/sign-up flow. */
     createFapiClient(): FapiClient;
     /**
@@ -159,6 +174,13 @@ export declare class AtlasService implements OnDestroy {
      * unless `{ frontchannel: false }`.
      */
     signOut(options?: SignOutOptions): Promise<SignOutResult>;
+    /**
+     * End the active impersonation ("return to admin"): the impersonator's own
+     * session on this browser becomes active again with no sign-in
+     * (`resumed: true`); with none, another account signed in here is adopted,
+     * or this browser is signed out.
+     */
+    endImpersonation(): Promise<EndImpersonationResult>;
     /**
      * Switch the active organization (or `null` for the personal account). The
      * new token carries the new org claims, so the app's permission checks update

package/dist/lib/atlas.ui.d.ts

@@ -10,6 +10,8 @@ import { UserButtonComponent } from './components/user-button.component';
 import { OrganizationSwitcherComponent } from './components/organization-switcher.component';
 import { UserProfileComponent } from './components/user-profile.component';
 import { OrganizationProfileComponent } from './components/organization-profile.component';
+import { OrganizationAuditLogComponent } from './components/organization-audit-log.component';
+import { AtlasPoliciesDirective, PolicyAcceptStepComponent, PolicyGateComponent } from './components/policy-host';
 /**
  * Every standalone directive and component the SDK ships. Import the array in a
  * standalone component's `imports`, or rely on `AtlasModule` re-exporting it for
@@ -19,4 +21,4 @@ import { OrganizationProfileComponent } from './components/organization-profile.
  * @Component({ standalone: true, imports: [...ATLAS_UI], template: '…' })
  * ```
  */
-export declare const ATLAS_UI: readonly [typeof AtlasSignedInDirective, typeof AtlasSignedOutDirective, typeof AtlasLoadingDirective, typeof AtlasLoadedDirective, typeof AtlasProtectDirective, typeof AtlasRootDirective, typeof SignInComponent, typeof SignUpComponent, typeof UserButtonComponent, typeof OrganizationSwitcherComponent, typeof UserProfileComponent, typeof OrganizationProfileComponent];
+export declare const ATLAS_UI: readonly [typeof AtlasSignedInDirective, typeof AtlasSignedOutDirective, typeof AtlasLoadingDirective, typeof AtlasLoadedDirective, typeof AtlasProtectDirective, typeof AtlasRootDirective, typeof SignInComponent, typeof SignUpComponent, typeof UserButtonComponent, typeof OrganizationSwitcherComponent, typeof UserProfileComponent, typeof OrganizationProfileComponent, typeof OrganizationAuditLogComponent, typeof AtlasPoliciesDirective, typeof PolicyAcceptStepComponent, typeof PolicyGateComponent];

package/dist/lib/components/attempt-flow.component.d.ts

@@ -1,5 +1,5 @@
 import { EventEmitter } from '@angular/core';
-import { type AttemptView, type CaptchaController, type FieldError } from '@atlasauth/js';
+import { type AttemptView, type CaptchaController, type FieldError, type MfaEnrollmentController, type MfaEnrollmentState, type MfaEnrollmentStrategy } from '@atlasauth/js';
 import { type ElementKey } from '../appearance';
 import * as i0 from "@angular/core";
 /**
@@ -50,6 +50,48 @@ export declare class AttemptFlowComponent {
     submitFlow: EventEmitter<Record<string, string>>;
     /** Emits when the user picks a first factor the server must send first (an emailed code). */
     chooseFactor: EventEmitter<"email_code">;
+    /**
+     * Offer "Email me a code instead" at the second factor (the instance's
+     * `account.emailSecondFactor`); `emailSecondFactor` asks for it and
+     * `emailedSecondFactor` reports how it went.
+     */
+    offerEmailSecondFactor: boolean;
+    /** `AtlasFlowController.emailSecondFactor()`: in flight, where it went, or why not. */
+    emailedSecondFactor: {
+        busy?: boolean;
+        sentTo?: string;
+        error?: string;
+    } | null;
+    emailSecondFactor: EventEmitter<void>;
+    /**
+     * Offer "Text me a code instead" at the second factor (where the app offers
+     * texted codes, `AtlasFlowController.mfaChoices().sms`); `smsSecondFactor`
+     * asks for it and `textedSecondFactor` reports how it went.
+     */
+    offerSmsSecondFactor: boolean;
+    /** `AtlasFlowController.smsSecondFactor()`: in flight, where it went, or why not. */
+    textedSecondFactor: {
+        busy?: boolean;
+        sentTo?: string;
+        error?: string;
+    } | null;
+    smsSecondFactor: EventEmitter<void>;
+    /**
+     * The MFA enrolment step (`AtlasFlowController.enrollment` and
+     * `enrollmentState()`): the authenticator app's QR code and setup key, or a
+     * texted code. Null: the step asks for two authenticator codes only.
+     */
+    enrollment: MfaEnrollmentController | null;
+    enrollmentState: MfaEnrollmentState | null;
+    /**
+     * The instance's `account.emailVerification`. On `link` a sign-up's
+     * verification step has nothing to type: it says to open the emailed link
+     * while the flow polls, and offers a resend (`resend`).
+     */
+    emailVerification: string;
+    resend: EventEmitter<void>;
+    /** The user declined a policy the sign-in was waiting on (`needs_policy_acceptance`): cancel the attempt. */
+    policyDeclined: EventEmitter<string>;
     protected values: Record<string, string>;
     protected t(key: string, vars?: Record<string, string>): string;
     /** A server error in the app's language (`error.<reason>`, else the server's message). */
@@ -57,18 +99,35 @@ export declare class AttemptFlowComponent {
     protected cls(key: ElementKey, base: string): string;
     protected setValue(name: string, value: string): void;
     protected onSubmit(event: Event): void;
+    /** The shared enrolment step is drawn (a controller was passed and the flow is enrolling). */
+    protected enrolling(): boolean;
+    protected chooseMethod(method: MfaEnrollmentStrategy): void;
+    protected resendEnrollment(): void;
+    protected otherMethods(state: MfaEnrollmentState): MfaEnrollmentStrategy[];
+    protected setupKey(secret: string): string;
+    /** The submit button's label key (enrolment: "Text me a code" before the number is sent). */
+    protected submitKey(): string;
+    protected showSmsSecondFactor(): boolean;
+    /** Where the texted second-factor code went (masked), once it was sent. */
+    protected smsSecondFactorSentTo(): string | null;
     protected formErrors(): FieldError[];
     protected fieldErrorsFor(name: string): FieldError[];
     private step;
     protected showCaptcha(): boolean;
     /** The first factors on offer at a `needs_first_factor` step (empty on any other). */
     private offered;
+    protected linkOnly(): boolean;
+    protected showEmailSecondFactor(): boolean;
+    /** Where the emailed second-factor code went (masked), once it was sent. */
+    protected emailSecondFactorSentTo(): string | null;
     protected showEmailCodeOption(): boolean;
     /** The "we sent a code to …" line on the code step. */
     protected codeSentText(): string | null;
+    /** The attempt is `needs_policy_acceptance`. */
+    protected awaitingPolicies(): boolean;
     protected showSubmit(): boolean;
     protected fields(): StepField[];
     static ɵfac: i0.ɵɵFactoryDeclaration<AttemptFlowComponent, never>;
-    static ɵcmp: i0.ɵɵComponentDeclaration<AttemptFlowComponent, "atlas-attempt-flow", never, { "attempt": { "alias": "attempt"; "required": false; }; "busy": { "alias": "busy"; "required": false; }; "errors": { "alias": "errors"; "required": false; }; "sessionKept": { "alias": "sessionKept"; "required": false; }; "titleKey": { "alias": "titleKey"; "required": false; }; "captcha": { "alias": "captcha"; "required": false; }; "firstFactors": { "alias": "firstFactors"; "required": false; }; "preparedFactor": { "alias": "preparedFactor"; "required": false; }; }, { "submitFlow": "submitFlow"; "chooseFactor": "chooseFactor"; }, never, never, true, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<AttemptFlowComponent, "atlas-attempt-flow", never, { "attempt": { "alias": "attempt"; "required": false; }; "busy": { "alias": "busy"; "required": false; }; "errors": { "alias": "errors"; "required": false; }; "sessionKept": { "alias": "sessionKept"; "required": false; }; "titleKey": { "alias": "titleKey"; "required": false; }; "captcha": { "alias": "captcha"; "required": false; }; "firstFactors": { "alias": "firstFactors"; "required": false; }; "preparedFactor": { "alias": "preparedFactor"; "required": false; }; "offerEmailSecondFactor": { "alias": "offerEmailSecondFactor"; "required": false; }; "emailedSecondFactor": { "alias": "emailedSecondFactor"; "required": false; }; "offerSmsSecondFactor": { "alias": "offerSmsSecondFactor"; "required": false; }; "textedSecondFactor": { "alias": "textedSecondFactor"; "required": false; }; "enrollment": { "alias": "enrollment"; "required": false; }; "enrollmentState": { "alias": "enrollmentState"; "required": false; }; "emailVerification": { "alias": "emailVerification"; "required": false; }; }, { "submitFlow": "submitFlow"; "chooseFactor": "chooseFactor"; "emailSecondFactor": "emailSecondFactor"; "smsSecondFactor": "smsSecondFactor"; "resend": "resend"; "policyDeclined": "policyDeclined"; }, never, never, true, never>;
 }
 export {};

package/dist/lib/components/flow-controller.d.ts

@@ -1,5 +1,5 @@
 import { WritableSignal } from '@angular/core';
-import { FapiClient, type CaptchaController, type FlowState, type InstanceSettings } from '@atlasauth/js';
+import { FapiClient, PolicyAcceptanceController, type CaptchaController, type FlowState, type InstanceSettings, type MfaChoices, type MfaEnrollmentController, type MfaEnrollmentState } from '@atlasauth/js';
 /**
  * The server-driven sign-in / sign-up engine, shared by `<atlas-sign-in>` and
  * `<atlas-sign-up>` — the Angular counterpart of React's `useFlow` hook.
@@ -26,6 +26,11 @@ export declare class AtlasFlowController {
      * resolves, or when the server could not be reached.
      */
     readonly settings: WritableSignal<InstanceSettings>;
+    /**
+     * The method this browser last signed in with (`password`, `oauth_github`, …)
+     * for the "Last used" hint; null when none, or the instance turned it off.
+     */
+    readonly lastMethod: WritableSignal<string>;
     /** The sign-in captcha (identifier step / `needs_captcha` challenge). */
     readonly captcha: CaptchaController;
     /** The sign-up captcha (the create-account step). */
@@ -40,6 +45,34 @@ export declare class AtlasFlowController {
      * otherwise.
      */
     readonly preparedFactor: WritableSignal<"email_code">;
+    /**
+     * "Email me a code instead" at the second factor ({@link sendEmailSecondFactor}):
+     * in flight, where the code went, or why it was not sent. Null until asked,
+     * and again once the flow leaves that step.
+     */
+    readonly emailSecondFactor: WritableSignal<{
+        busy?: boolean;
+        sentTo?: string;
+        error?: string;
+    }>;
+    /** "Text me a code instead" at the second factor ({@link sendSmsSecondFactor}): as {@link emailSecondFactor}. */
+    readonly smsSecondFactor: WritableSignal<{
+        busy?: boolean;
+        sentTo?: string;
+        error?: string;
+    }>;
+    /**
+     * The MFA enrolment step (`needs_mfa_enrollment`): the authenticator app's
+     * setup (QR code, setup key) or a texted code. Started and reset with the flow.
+     */
+    readonly enrollment: MfaEnrollmentController;
+    /** {@link enrollment}'s state, for templates. */
+    readonly enrollmentState: WritableSignal<MfaEnrollmentState>;
+    /**
+     * The instance's policies (terms, privacy, …) for the create-account form:
+     * {@link create} sends their acceptances and reloads them after a refusal.
+     */
+    readonly policies: PolicyAcceptanceController;
     private pollTimer;
     private identifier;
     constructor(client: FapiClient, reload: () => Promise<boolean>, pending: {
@@ -48,6 +81,10 @@ export declare class AtlasFlowController {
     } | null, 
     /** Resolves the captcha messages' catalog keys. Defaults to en-US. */
     t?: (key: string) => string);
+    /** What the app lets the MFA steps offer (from {@link settings}). */
+    mfaChoices(): MfaChoices;
+    /** Start the enrolment step for its attempt, or reset it once the flow leaves. */
+    private syncEnrollment;
     /** Fetch the instance's public settings and draw whatever captcha they require. */
     loadSettings(): Promise<void>;
     /**
@@ -87,6 +124,10 @@ export declare class AtlasFlowController {
      * the app sees a signed-in user.
      */
     submit(values: Record<string, string>): Promise<void>;
+    /** Load the sign-up's policies into {@link policies} (`<atlas-sign-up>` calls it on init). */
+    loadPolicies(locale?: string): Promise<void>;
+    /** The user declined a policy a sign-in was waiting on: cancel the attempt and say why. */
+    declinePolicy(title: string): void;
     /**
      * Create an account (`POST /v1/client/sign_ups`) from a create-account form's
      * values — email, password and any configured sign-up fields — carrying the
@@ -94,6 +135,37 @@ export declare class AtlasFlowController {
      * then posted with {@link submit}.
      */
     create(values: Record<string, string>, consent?: boolean): Promise<void>;
+    /**
+     * "Email me a code instead" at the second factor (the instance's
+     * `account.emailSecondFactor`): mails a code to the account's verified email;
+     * it is then posted with {@link submit} like any 2FA code.
+     */
+    sendEmailSecondFactor(): Promise<void>;
+    /**
+     * "Text me a code instead" at the second factor (where the app offers texted
+     * codes, {@link mfaChoices}`().sms`): texts a code to the account's enrolled
+     * phone; it is then posted with {@link submit} like any 2FA code.
+     */
+    sendSmsSecondFactor(): Promise<void>;
+    private sendSecondFactorCode;
+    /** Resend a sign-up's emailed code / link (the earlier one stops working). */
+    resendSignUp(): Promise<void>;
+    /**
+     * Start a passkey-only sign-up (`POST /v1/client/sign_ups/passkey`) from the
+     * create-account form's values — no password. Offered when the instance's
+     * `account.passkeySignUp` is set.
+     */
+    createWithPasskey(values: Record<string, string>, consent?: boolean): Promise<void>;
+    /** The passkey-only sign-up's last step: create the passkey, and with it the account. */
+    createPasskey(): Promise<void>;
+    /**
+     * The recovery codes an MFA enrolment just completed the sign-in with, shown
+     * once before it finishes ({@link saveRecoveryCodes}); null otherwise. They
+     * live only in this controller's memory.
+     */
+    recoveryCodes(): string[] | null;
+    /** "I've saved my codes": forget the recovery codes and finish the sign-in. */
+    saveRecoveryCodes(): Promise<void>;
     private finish;
     /** Start/stop the §5.3 magic-link poll to match the current state. */
     syncPolling(): void;

package/dist/lib/components/impersonation-banner.component.d.ts

@@ -0,0 +1,27 @@
+import { EventEmitter } from '@angular/core';
+import { type EndImpersonationResult } from '@atlasauth/js';
+import { AtlasService } from '../atlas.service';
+import { type ElementKey } from '../appearance';
+import * as i0 from "@angular/core";
+/**
+ * `<atlas-impersonation-banner>` — shown only while the active session is an
+ * impersonation, naming the user acted as, with "Return to admin" (or "End
+ * impersonation" when there is no session of the impersonator's to resume).
+ * Emits `ended` with the outcome. The Angular peer of React's
+ * `<ImpersonationBanner/>`.
+ */
+export declare class ImpersonationBannerComponent {
+    protected readonly atlas: AtlasService;
+    readonly ended: EventEmitter<EndImpersonationResult>;
+    protected readonly busy: import("@angular/core").WritableSignal<boolean>;
+    protected readonly actor: import("@angular/core").Signal<{
+        sub: string;
+    }>;
+    protected readonly canReturn: import("@angular/core").Signal<boolean>;
+    protected readonly name: import("@angular/core").Signal<string>;
+    protected t(key: string, vars?: Record<string, string>): string;
+    protected cls(key: ElementKey, base: string): string;
+    protected end(): Promise<void>;
+    static ɵfac: i0.ɵɵFactoryDeclaration<ImpersonationBannerComponent, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<ImpersonationBannerComponent, "atlas-impersonation-banner", never, {}, { "ended": "ended"; }, never, never, true, never>;
+}

package/dist/lib/components/organization-audit-log.component.d.ts

@@ -0,0 +1,34 @@
+import { type OnDestroy, type OnInit } from '@angular/core';
+import { AtlasService } from '../atlas.service';
+import { type ElementKey } from '../appearance';
+import type { AtlasOrganizationAuditLog } from './organization-audit-log';
+import * as i0 from "@angular/core";
+/**
+ * `<atlas-organization-audit-log>` — the active organization's audit trail for
+ * its admins, next to `<atlas-organization-profile>`. The Angular peer of
+ * React's `<OrganizationAuditLog/>`. Renders nothing for a member who may not
+ * read it (the server is the authority; the component just follows it). Labels
+ * are inputs so an app can localise them.
+ */
+export declare class OrganizationAuditLogComponent implements OnInit, OnDestroy {
+    /** Entries per page (the server caps it). */
+    pageSize?: number;
+    /** Narrow to one action, or a prefix ending in `.`. */
+    action?: string;
+    labels: {
+        title?: string;
+        empty?: string;
+        loadMore?: string;
+        actor?: string;
+    };
+    formatDate: (ms: number) => string;
+    protected readonly atlas: AtlasService;
+    /** Created in ngOnInit, once the inputs are set (templates render after it). */
+    protected log: AtlasOrganizationAuditLog;
+    ngOnInit(): void;
+    ngOnDestroy(): void;
+    protected describe(action: string): string;
+    protected cls(key: ElementKey, base: string): string;
+    static ɵfac: i0.ɵɵFactoryDeclaration<OrganizationAuditLogComponent, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<OrganizationAuditLogComponent, "atlas-organization-audit-log", never, { "pageSize": { "alias": "pageSize"; "required": false; }; "action": { "alias": "action"; "required": false; }; "labels": { "alias": "labels"; "required": false; }; "formatDate": { "alias": "formatDate"; "required": false; }; }, {}, never, never, true, never>;
+}

package/dist/lib/components/organization-audit-log.d.ts

@@ -0,0 +1,25 @@
+import { type Signal } from '@angular/core';
+import type { Observable } from 'rxjs';
+import { type FapiClient, type OrganizationAuditLogOptions, type OrganizationAuditLogState } from '@atlasauth/js';
+import type { AtlasOrganizationMembership } from '../types';
+/**
+ * The active organization's audit trail, for its admins — the engine behind
+ * `<atlas-organization-audit-log>` and `AtlasService.organizationAuditLog()`
+ * (the Angular peer of React's `useOrganizationAuditLog`). `state` is a signal
+ * of `{ entries, loading, forbidden, hasMore }`, one page at a time, newest
+ * first. It follows the active organization until {@link destroy}.
+ */
+export declare class AtlasOrganizationAuditLog {
+    private readonly _state;
+    private readonly log;
+    private readonly unsubscribe;
+    private readonly organizationSub;
+    readonly state: Signal<OrganizationAuditLogState>;
+    constructor(client: Pick<FapiClient, 'get'>, organization$: Observable<AtlasOrganizationMembership | null>, options?: OrganizationAuditLogOptions);
+    /** Append the next page, when there is one. */
+    loadMore(): Promise<void>;
+    /** Re-read from the newest entry. */
+    reload(): Promise<void>;
+    /** Stop following the active organization. */
+    destroy(): void;
+}

package/dist/lib/components/organization-profile.component.d.ts

@@ -1,16 +1,65 @@
+import { EventEmitter } from '@angular/core';
+import { type OrganizationProfileState } from '@atlasauth/js';
 import { AtlasService } from '../atlas.service';
 import { type ElementKey } from '../appearance';
 import * as i0 from "@angular/core";
+type Tab = 'members' | 'invitations' | 'roles' | 'settings';
+type ProfileRole = OrganizationProfileState['roles'][number];
 /**
- * `<atlas-organization-profile>` — the active organization's surface. The
- * Angular peer of React's `<OrganizationProfile/>`. Management controls are
- * gated on the ACTIVE org role via `*atlasProtect`, matching the server's rule
- * rather than duplicating a looser one. Renders nothing with no active org.
+ * `<atlas-organization-profile>` — the active organization's members (admins
+ * change roles and remove), invitations (admins invite, revoke and resend) and
+ * settings (leave; an admin deletes after confirming their password). The
+ * Angular peer of React's `<OrganizationProfile/>`, on the same headless
+ * controller. Every control is gated on the ACTIVE org role, matching the
+ * server's rule. Renders nothing with no active org. Emits `exit` with `left`
+ * or `deleted`.
  */
 export declare class OrganizationProfileComponent {
     protected readonly atlas: AtlasService;
-    protected t(key: string): string;
+    readonly exit: EventEmitter<"left" | "deleted">;
+    private readonly client;
+    private controller;
+    private unsubscribe;
+    protected readonly state: import("@angular/core").WritableSignal<OrganizationProfileState>;
+    protected readonly tab: import("@angular/core").WritableSignal<Tab>;
+    protected readonly email: import("@angular/core").WritableSignal<string>;
+    protected readonly inviteRole: import("@angular/core").WritableSignal<string>;
+    protected readonly confirm: import("@angular/core").WritableSignal<"delete" | "leave">;
+    protected readonly needsPassword: import("@angular/core").WritableSignal<boolean>;
+    protected readonly password: import("@angular/core").WritableSignal<string>;
+    protected readonly editingRole: import("@angular/core").WritableSignal<string>;
+    protected readonly roleKey: import("@angular/core").WritableSignal<string>;
+    protected readonly roleName: import("@angular/core").WritableSignal<string>;
+    protected readonly rolePerms: import("@angular/core").WritableSignal<string[]>;
+    protected readonly customRoles: import("@angular/core").Signal<import("@atlasauth/js").OrganizationRole[]>;
+    protected readonly userId: import("@angular/core").Signal<string>;
+    protected readonly canManage: import("@angular/core").Signal<boolean>;
+    protected readonly isAdmin: import("@angular/core").Signal<boolean>;
+    protected readonly tabs: import("@angular/core").Signal<Tab[]>;
+    protected readonly roles: import("@angular/core").Signal<import("@atlasauth/js").OrganizationRole[] | {
+        key: string;
+        name: string;
+    }[]>;
+    protected readonly errorMessage: import("@angular/core").Signal<string>;
+    constructor();
+    private bind;
+    protected t(key: string, vars?: Record<string, string>): string;
     protected cls(key: ElementKey, base: string): string;
+    protected memberName(m: OrganizationProfileState['members'][number]): string;
+    protected changeRole(userId: string, role: string): void;
+    protected removeMember(userId: string): void;
+    protected sendInvite(): Promise<void>;
+    protected resend(id: string): void;
+    protected revoke(id: string): void;
+    protected leave(): Promise<void>;
+    protected remove(): Promise<void>;
+    protected editRole(role: ProfileRole): void;
+    protected resetRoleForm(): void;
+    protected togglePermission(key: string, on: boolean): void;
+    protected saveRole(): Promise<void>;
+    protected deleteRole(role: ProfileRole): void;
+    protected cancel(): void;
     static ɵfac: i0.ɵɵFactoryDeclaration<OrganizationProfileComponent, never>;
-    static ɵcmp: i0.ɵɵComponentDeclaration<OrganizationProfileComponent, "atlas-organization-profile", never, {}, {}, never, never, true, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<OrganizationProfileComponent, "atlas-organization-profile", never, {}, { "exit": "exit"; }, never, never, true, never>;
 }
+export {};

package/dist/lib/components/policy-host.d.ts

@@ -0,0 +1,88 @@
+import { EventEmitter, OnChanges, OnDestroy, OnInit, type SimpleChanges } from '@angular/core';
+import { type PolicyAcceptanceController, type PolicyClasses, type PolicyT } from '@atlasauth/js';
+import { AtlasService } from '../atlas.service';
+import * as i0 from "@angular/core";
+/** The policy UI's translator (the localization bundle, else the English policy strings) for the current Atlas service. */
+export declare function policyUi(atlas: AtlasService): {
+    t: PolicyT;
+    classes: PolicyClasses;
+};
+/**
+ * `[atlasPolicies]="controller"` — draws the instance's policies (terms, privacy,
+ * …) into the host element: `kind="consent"` (default) is the checkbox block with
+ * its in-page viewer, `kind="clickwrap"` the "By continuing you agree to …" line.
+ * The state is the controller's (`AtlasFlowController.policies`); the DOM comes
+ * from `@atlasauth/js`, shared with every SDK.
+ */
+export declare class AtlasPoliciesDirective implements OnInit, OnChanges, OnDestroy {
+    private readonly host;
+    private readonly atlas;
+    private mounted;
+    private ready;
+    controller: PolicyAcceptanceController | null;
+    atlasPolicyKind: 'consent' | 'clickwrap';
+    ngOnInit(): void;
+    ngOnChanges(changes: SimpleChanges): void;
+    ngOnDestroy(): void;
+    private draw;
+    static ɵfac: i0.ɵɵFactoryDeclaration<AtlasPoliciesDirective, never>;
+    static ɵdir: i0.ɵɵDirectiveDeclaration<AtlasPoliciesDirective, "[atlasPolicies]", never, { "controller": { "alias": "atlasPolicies"; "required": false; }; "atlasPolicyKind": { "alias": "atlasPolicyKind"; "required": false; }; }, {}, never, never, true, never>;
+}
+/**
+ * `<atlas-policy-accept-step>` — the sign-in step for a `needs_policy_acceptance`
+ * attempt: scroll-mode policies in their unskippable dialog, the rest as
+ * checkboxes, then "Accept and continue". Emits `submitFlow` with the
+ * `policy_acceptances` JSON for the flow, and `declined` with the policy title
+ * when the user declines (cancel the attempt).
+ */
+export declare class PolicyAcceptStepComponent implements OnInit, OnChanges, OnDestroy {
+    private readonly host;
+    private readonly atlas;
+    private step;
+    private alive;
+    attempt: {
+        id: string | null;
+        pending_policies?: unknown;
+    } | null;
+    busy: boolean;
+    submitFlow: EventEmitter<Record<string, string>>;
+    declined: EventEmitter<string>;
+    protected readonly loading: import("@angular/core").WritableSignal<boolean>;
+    protected loadingText: string;
+    ngOnInit(): void;
+    ngOnChanges(changes: SimpleChanges): void;
+    ngOnDestroy(): void;
+    static ɵfac: i0.ɵɵFactoryDeclaration<PolicyAcceptStepComponent, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<PolicyAcceptStepComponent, "atlas-policy-accept-step", never, { "attempt": { "alias": "attempt"; "required": false; }; "busy": { "alias": "busy"; "required": false; }; }, { "submitFlow": "submitFlow"; "declined": "declined"; }, never, never, true, never>;
+}
+/**
+ * `<atlas-policy-gate>` — in-app re-acceptance. For a signed-in user, a banner
+ * when a policy needs re-acceptance; "Review and accept" opens the unskippable
+ * dialog / checkboxes and posts `/v1/client/me/policies/accept`. Projects its
+ * content always.
+ */
+export declare class PolicyGateComponent implements OnInit, OnDestroy {
+    private readonly host;
+    private readonly atlas;
+    private readonly ui;
+    private gate;
+    private off;
+    private step;
+    private readonly version;
+    accepted: EventEmitter<void>;
+    protected readonly reviewing: import("@angular/core").WritableSignal<boolean>;
+    protected readonly error: import("@angular/core").WritableSignal<string>;
+    protected title: string;
+    protected reviewText: string;
+    protected linkClass: string;
+    protected errorClass: string;
+    protected bannerClass: string;
+    protected cardClass: string;
+    protected bannerText(): string | null;
+    ngOnInit(): void;
+    begin(): Promise<void>;
+    private close;
+    ngOnDestroy(): void;
+    static ɵfac: i0.ɵɵFactoryDeclaration<PolicyGateComponent, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<PolicyGateComponent, "atlas-policy-gate", never, {}, { "accepted": "accepted"; }, never, ["*"], true, never>;
+}

package/dist/lib/components/recovery-codes.component.d.ts

@@ -0,0 +1,26 @@
+import { EventEmitter, OnChanges } from '@angular/core';
+import { type ElementKey } from '../appearance';
+import * as i0 from "@angular/core";
+/**
+ * The recovery codes a mid-sign-in MFA enrolment came with, shown once before
+ * the sign-in finishes: copy them, download them as a .txt file, then
+ * "I've saved my codes" (`saved`) exchanges the ticket. The codes live only in
+ * the flow controller's memory and are forgotten once saved.
+ */
+export declare class RecoveryCodesComponent implements OnChanges {
+    private readonly atlas;
+    private readonly cdr;
+    codes: string[];
+    busy: boolean;
+    saved: EventEmitter<void>;
+    protected readonly canCopy: boolean;
+    protected readonly canDownload: boolean;
+    protected copied: boolean;
+    ngOnChanges(): void;
+    protected t(key: string): string;
+    protected cls(key: ElementKey, base: string): string;
+    protected copy(): void;
+    protected download(): void;
+    static ɵfac: i0.ɵɵFactoryDeclaration<RecoveryCodesComponent, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<RecoveryCodesComponent, "atlas-recovery-codes", never, { "codes": { "alias": "codes"; "required": false; }; "busy": { "alias": "busy"; "required": false; }; }, { "saved": "saved"; }, never, never, true, never>;
+}

package/dist/lib/components/sign-in.component.d.ts

@@ -22,6 +22,8 @@ export declare class SignInComponent implements OnInit, OnDestroy {
      */
     signUpUrl?: string | null;
     protected t(key: string): string;
+    /** "Last used: Password" on the identifier step, when the instance shows the hint. */
+    protected lastUsedLabel(): string | null;
     protected signUpHref(): string | null;
     protected readonly flow: AtlasFlowController;
     ngOnInit(): void;

package/dist/lib/components/sign-up-form.component.d.ts

@@ -1,5 +1,5 @@
-import { EventEmitter } from '@angular/core';
-import { type CaptchaController, type FieldError, type InstanceSettings, type PublicSignUpField } from '@atlasauth/js';
+import { EventEmitter, OnChanges, OnDestroy, type SimpleChanges } from '@angular/core';
+import { type PolicyAcceptanceController, type CaptchaController, type FieldError, type InstanceSettings, type PublicSignUpField } from '@atlasauth/js';
 import { type ElementKey } from '../appearance';
 import * as i0 from "@angular/core";
 /** What the create-account form emits: the values typed plus the consent tick. */
@@ -15,16 +15,32 @@ export interface SignUpFormSubmit {
  * email (`settings.emailDelivery.passwordSignUp === false`) it shows the
  * `signUp.emailUnavailable` notice instead of the form.
  */
-export declare class SignUpFormComponent {
+export declare class SignUpFormComponent implements OnChanges, OnDestroy {
     private readonly atlas;
+    private readonly cdr;
+    private unwatch;
     settings: InstanceSettings | null;
     busy: boolean;
     errors: FieldError[];
     captcha: CaptchaController | null;
+    /** Passkey-only sign-up: no password field; the email per the instance's mode. */
+    passkey: {
+        email: 'off' | 'optional' | 'required';
+    } | null;
+    /** Whether the password / passkey toggle is shown (both are offered). */
+    switchable: boolean;
+    /** The instance's policies (terms, privacy, …); they replace the legacy consent row. */
+    policies: PolicyAcceptanceController | null;
+    /** The user asked for the other sign-up method. */
+    switchMode: EventEmitter<void>;
     /** Emits the typed values and the consent tick when the form is submitted. */
     submitSignUp: EventEmitter<SignUpFormSubmit>;
     protected values: Record<string, string>;
     protected agreed: boolean;
+    protected declined: string | null;
+    ngOnChanges(changes: SimpleChanges): void;
+    ngOnDestroy(): void;
+    protected hasPolicies(): boolean;
     protected t(key: string, vars?: Record<string, string>): string;
     /** A server error in the app's language (`error.<reason>`, else the server's message). */
     protected errorText(error: FieldError): string;
@@ -32,6 +48,8 @@ export declare class SignUpFormComponent {
     protected setValue(name: string, value: string): void;
     /** Email + password sign-up cannot complete: the app cannot send the verification email. */
     protected emailUnavailable(): boolean;
+    protected showEmail(): boolean;
+    protected emailRequired(): boolean;
     protected fields(): PublicSignUpField[];
     protected label(f: PublicSignUpField): string;
     protected inputType(f: PublicSignUpField): string;
@@ -45,5 +63,5 @@ export declare class SignUpFormComponent {
     protected fieldErrorsFor(name: string): FieldError[];
     protected onSubmit(event: Event): void;
     static ɵfac: i0.ɵɵFactoryDeclaration<SignUpFormComponent, never>;
-    static ɵcmp: i0.ɵɵComponentDeclaration<SignUpFormComponent, "atlas-sign-up-form", never, { "settings": { "alias": "settings"; "required": false; }; "busy": { "alias": "busy"; "required": false; }; "errors": { "alias": "errors"; "required": false; }; "captcha": { "alias": "captcha"; "required": false; }; }, { "submitSignUp": "submitSignUp"; }, never, never, true, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<SignUpFormComponent, "atlas-sign-up-form", never, { "settings": { "alias": "settings"; "required": false; }; "busy": { "alias": "busy"; "required": false; }; "errors": { "alias": "errors"; "required": false; }; "captcha": { "alias": "captcha"; "required": false; }; "passkey": { "alias": "passkey"; "required": false; }; "switchable": { "alias": "switchable"; "required": false; }; "policies": { "alias": "policies"; "required": false; }; }, { "switchMode": "switchMode"; "submitSignUp": "submitSignUp"; }, never, never, true, never>;
 }